@intutic/cli 1.10.0 → 2.0.0

package/dist/commands/enterprise.js

@@ -0,0 +1,141 @@
+/**
+ * `intutic enterprise install` — CA-trust rollout, Cursor system-level
+ * hooks, and Jamf/Intune MDM manifest generation for a managed fleet.
+ *
+ * Replaces the deleted `enterprise-install.ts` (commit `8481b5d9`). Named
+ * `enterprise install`, deliberately not the old hyphenated
+ * `enterprise-install` — `tools/scripts/intutic-enterprise-install.sh`
+ * already exists as an unrelated air-gapped docker-compose installer.
+ *
+ * The host firewall is intentionally NOT part of this command — that's
+ * `intutic enforce apply`/`generate` (TD-332's real, tested implementation).
+ * Rebuilding a `pf.conf`/`iptables.rules` template generator here, as the
+ * deleted code did, would just be a second, unmaintained copy of it. This
+ * command prints a pointer to it instead.
+ *
+ * @module
+ */
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { createRequire } from 'node:module';
+import { writeCursorHooks } from '@intutic/sync-daemon/harness/cursorHooks';
+import { log } from '../lib/logger.js';
+import { loadConfig, loadCredentials } from '../config/store.js';
+import { getIntuticDir } from '../config/paths.js';
+import { isElevatedAsync } from '../lib/elevation.js';
+import { installCaTrust } from '../lib/caTrust.js';
+import { generateMobileconfig, generateJamfManifest, generateIntuneManifest, generateJamfFirewallManifest, generateIntuneFirewallManifest, } from '../lib/mdmManifest.js';
+import { writeEnforcementState } from '../lib/enforcementState.js';
+import { reportDeviceState } from '../lib/deviceReport.js';
+const { version: cliVersion } = createRequire(import.meta.url)('../../package.json');
+function resolveProxyUrl(opts) {
+    const raw = opts.proxyUrl ?? process.env.INTUTIC_PROXY_URL ?? 'http://localhost:4000';
+    return raw.replace(/\/+$/, '');
+}
+// Unlike `hookScriptPath` below (resolved from THIS process's own
+// workspaceRoot, which is meaningful because `enterprise install` runs on
+// the machine it configures), the intutic CLI binary path is inherently a
+// TARGET-machine fact this admin machine cannot observe — `process.execPath`
+// here would just be node's own path on the admin's box, not intutic's path
+// on the fleet. `/usr/local/bin/intutic` is the common global-install
+// location (Homebrew, npm -g with a standard prefix); operators whose fleet
+// installs elsewhere MUST override with --cli-binary-path.
+const DEFAULT_CLI_BINARY_PATH = '/usr/local/bin/intutic';
+function resolveCliBinaryPath(opts) {
+    return opts.cliBinaryPath ?? DEFAULT_CLI_BINARY_PATH;
+}
+export async function runEnterpriseInstall(opts) {
+    const proxyUrl = resolveProxyUrl(opts);
+    const outputDir = resolve(opts.mdmOutputDir ?? './intutic-mdm');
+    const config = loadConfig();
+    const creds = await loadCredentials();
+    const workspaceRoot = config?.workspaceRoot ?? process.cwd();
+    const workspaceId = creds?.workspaceId ?? '';
+    log.header('Intutic — Enterprise Install');
+    const caCertPath = join(getIntuticDir(), 'ca.crt');
+    let caCertPem;
+    try {
+        caCertPem = await readFile(caCertPath, 'utf-8');
+    }
+    catch {
+        log.error(`CA certificate not found at ${caCertPath}.`);
+        log.info('Run `intutic connect` (or `intutic start`) at least once first — it generates the CA on first run.');
+        process.exit(1);
+    }
+    // 1. Manifests — no privilege needed, always generated first.
+    await mkdir(outputDir, { recursive: true });
+    const hookScriptPath = join(workspaceRoot, '.intutic', 'hooks', 'cursor-check.js');
+    const cliBinaryPath = resolveCliBinaryPath(opts);
+    await writeFile(join(outputDir, 'intutic-governance.mobileconfig'), generateMobileconfig({ caCertPem }), 'utf-8');
+    await writeFile(join(outputDir, 'cursor-hooks-jamf.json'), generateJamfManifest({ hookScriptPath }), 'utf-8');
+    await writeFile(join(outputDir, 'cursor-hooks-intune.json'), generateIntuneManifest({ hookScriptPath }), 'utf-8');
+    await writeFile(join(outputDir, 'jamf-firewall-manifest.json'), generateJamfFirewallManifest({ cliBinaryPath }), 'utf-8');
+    await writeFile(join(outputDir, 'intune-firewall-manifest.json'), generateIntuneFirewallManifest({ cliBinaryPath }), 'utf-8');
+    log.success(`MDM manifests written to ${outputDir}/`);
+    log.field('CA trust profile', 'intutic-governance.mobileconfig');
+    log.field('Cursor hooks (Jamf)', 'cursor-hooks-jamf.json');
+    log.field('Cursor hooks (Intune)', 'cursor-hooks-intune.json');
+    log.field('Firewall re-assertion (Jamf)', 'jamf-firewall-manifest.json');
+    log.field('Firewall re-assertion (Intune)', 'intune-firewall-manifest.json');
+    if (!opts.cliBinaryPath) {
+        log.dim(`  (firewall manifests assume the intutic CLI is at ${DEFAULT_CLI_BINARY_PATH} on target machines — override with --cli-binary-path if your fleet installs elsewhere)`);
+    }
+    if (opts.generateMdmOnly) {
+        return;
+    }
+    // 2. Elevation check — warn but still attempt, matching `enforce.ts`'s
+    // "warn but still attempt" discipline (a container or root shell has
+    // nothing to escalate from, so pre-blocking would be wrong there).
+    const elevation = await isElevatedAsync();
+    if (elevation === 'unelevated') {
+        log.warn('System-wide CA trust and system-level Cursor hooks need admin/root privilege.');
+        log.info('Re-run with sudo (macOS/Linux) or from an elevated shell (Windows) to apply them now.');
+    }
+    // 3. System-level Cursor hooks — reuses the SAME writer `intutic connect`
+    // already uses for project/user level, this time with writeSystemLevel and
+    // a real workspaceId embedded in the hook script's event payloads.
+    if (!opts.skipHooks) {
+        try {
+            await writeCursorHooks(workspaceRoot, proxyUrl, workspaceId, true);
+            log.success('Cursor hooks written (project, user, and system level).');
+            await writeEnforcementState({ systemHooks: { installed: true, path: hookScriptPath, reportedAt: new Date().toISOString() } }, cliVersion);
+        }
+        catch (err) {
+            log.error(`Failed to write Cursor hooks: ${err instanceof Error ? err.message : String(err)}`);
+            await writeEnforcementState({ systemHooks: { installed: false, reportedAt: new Date().toISOString() } }, cliVersion);
+        }
+    }
+    // 4. System-wide CA trust.
+    if (!opts.skipCa) {
+        const result = await installCaTrust(caCertPath, 'system');
+        if (result.installed) {
+            log.success(`CA cert trusted system-wide via ${result.mechanism}.`);
+        }
+        else {
+            log.error(`Could not install system CA trust: ${result.detail}`);
+        }
+        await writeEnforcementState({ caTrust: { installed: result.installed, scope: 'system', mechanism: result.mechanism, reportedAt: new Date().toISOString() } }, cliVersion);
+    }
+    // Best-effort phone-home for whatever legs this run actually touched —
+    // never fails the command; the CA-trust/hooks steps above already
+    // succeeded or failed on their own merits.
+    const report = await reportDeviceState({ dev: opts.dev });
+    if (!report.reported) {
+        log.dim(`  (device report not sent: ${report.reason})`);
+    }
+    // 5. Firewall — deliberately not duplicated here. Point at the real thing.
+    const defaultPort = (() => {
+        try {
+            return new URL(proxyUrl).port || '4000';
+        }
+        catch {
+            return '4000';
+        }
+    })();
+    console.log('');
+    log.header('Next: mandatory egress firewall');
+    log.dim('  This command does not touch the host firewall. To make the proxy the only path out:');
+    log.dim(`    sudo intutic enforce apply --port ${defaultPort}`);
+    log.dim('  See what it would do first with: intutic enforce generate');
+}
+//# sourceMappingURL=enterprise.js.map

package/dist/commands/enterprise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterprise.js","sourceRoot":"","sources":["../../src/commands/enterprise.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAA;AAC3E,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE1D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAwB,CAAA;AAa3G,SAAS,eAAe,CAAC,IAA8B;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAA;IACrF,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC;AAED,kEAAkE;AAClE,0EAA0E;AAC1E,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,2DAA2D;AAC3D,MAAM,uBAAuB,GAAG,wBAAwB,CAAA;AAExD,SAAS,oBAAoB,CAAC,IAA8B;IAC1D,OAAO,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAA;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAA8B;IACvE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,eAAe,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IAC5D,MAAM,WAAW,GAAG,KAAK,EAAE,WAAW,IAAI,EAAE,CAAA;IAE5C,GAAG,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAA;IAE1C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,QAAQ,CAAC,CAAA;IAClD,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,+BAA+B,UAAU,GAAG,CAAC,CAAA;QACvD,GAAG,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAA;QAC9G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,8DAA8D;IAC9D,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAA;IAClF,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAEhD,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,iCAAiC,CAAC,EAAE,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;IACjH,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,oBAAoB,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7G,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAAE,sBAAsB,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;IACjH,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,6BAA6B,CAAC,EAAE,4BAA4B,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;IACzH,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,+BAA+B,CAAC,EAAE,8BAA8B,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;IAE7H,GAAG,CAAC,OAAO,CAAC,4BAA4B,SAAS,GAAG,CAAC,CAAA;IACrD,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAA;IAChE,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAA;IAC1D,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,0BAA0B,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAA;IACxE,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE,+BAA+B,CAAC,CAAA;IAC5E,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,sDAAsD,uBAAuB,yFAAyF,CAAC,CAAA;IACjL,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,OAAM;IACR,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,SAAS,GAAG,MAAM,eAAe,EAAE,CAAA;IACzC,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAA;QACzF,GAAG,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAA;IACnG,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;YAClE,GAAG,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAA;YACtE,MAAM,qBAAqB,CACzB,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,EAChG,UAAU,CACX,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC9F,MAAM,qBAAqB,CACzB,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,EAC3E,UAAU,CACX,CAAA;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,GAAG,CAAC,OAAO,CAAC,mCAAmC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAA;QACrE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,qBAAqB,CACzB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,EAChI,UAAU,CACX,CAAA;IACH,CAAC;IAED,uEAAuE;IACvE,kEAAkE;IAClE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;IACzD,CAAC;IAED,2EAA2E;IAC3E,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;QACxB,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,MAAM,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACf,GAAG,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAA;IAC7C,GAAG,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAA;IAChG,GAAG,CAAC,GAAG,CAAC,yCAAyC,WAAW,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;AACxE,CAAC"}

package/dist/commands/env.d.ts

@@ -0,0 +1,7 @@
+/** Persist ANTHROPIC_BASE_URL / OPENAI_BASE_URL so they survive a restart. */
+export declare function runEnvPersist(opts: {
+    proxyUrl?: string;
+}): Promise<void>;
+/** Remove whatever `intutic env persist` wrote. */
+export declare function runEnvClear(): Promise<void>;
+//# sourceMappingURL=env.d.ts.map

package/dist/commands/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AAwBA,8EAA8E;AAC9E,wBAAsB,aAAa,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B9E;AAED,mDAAmD;AACnD,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAIjD"}

package/dist/commands/env.js

@@ -0,0 +1,55 @@
+/**
+ * env.ts — Persist or clear the proxy base-URL environment variables.
+ *
+ * `lib/envInjector.ts` implements system-level injection for macOS
+ * (`launchctl setenv`), Linux (`~/.bashrc`) and Windows (`setx`). It shipped
+ * under a ✅ RESOLVED marker with a full test file and **no caller anywhere** —
+ * so the capability the entry described could not be invoked. This is the
+ * route it never had (TD-041).
+ *
+ * Deliberately opt-in rather than a side effect of `intutic start` or
+ * `intutic connect`: on macOS `launchctl setenv` reaches every GUI application
+ * the user launches afterwards, and on Linux it appends to a shell profile.
+ * Neither belongs in a command the user ran for another reason.
+ *
+ * @module
+ */
+import { log } from '../lib/logger.js';
+import { injectBaseUrlEnvVars, removeBaseUrlEnvVars, PlatformNotSupportedError, ElevationRequiredError, } from '../lib/envInjector.js';
+/** Persist ANTHROPIC_BASE_URL / OPENAI_BASE_URL so they survive a restart. */
+export async function runEnvPersist(opts) {
+    const proxyUrl = opts.proxyUrl ?? 'http://localhost:4000';
+    try {
+        const result = await injectBaseUrlEnvVars(proxyUrl);
+        log.success(`Persisted ${result.vars.join(', ')} → ${proxyUrl}`);
+        log.field('Platform', result.platform);
+        log.field('Scope', result.scope);
+        log.field('Method', result.method);
+        log.info('');
+        log.info('Already-open terminals keep their old environment — restart them,');
+        log.info('or re-source your shell profile, before the change is visible.');
+        log.info('');
+        log.info('Undo with: intutic env clear');
+    }
+    catch (err) {
+        if (err instanceof PlatformNotSupportedError) {
+            log.error(`${err.message}`);
+            log.info('Set ANTHROPIC_BASE_URL and OPENAI_BASE_URL by hand, or use `intutic exec`,');
+            log.info('which sets them for one child process without touching your system.');
+            process.exit(1);
+        }
+        if (err instanceof ElevationRequiredError) {
+            log.error(`${err.message}`);
+            log.info('Re-run with the privileges that path needs, or use `intutic exec` instead.');
+            process.exit(1);
+        }
+        throw err;
+    }
+}
+/** Remove whatever `intutic env persist` wrote. */
+export async function runEnvClear() {
+    await removeBaseUrlEnvVars();
+    log.success('Cleared the persisted base-URL environment variables.');
+    log.info('Already-open terminals keep the old values until they are restarted.');
+}
+//# sourceMappingURL=env.js.map

package/dist/commands/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,uBAAuB,CAAA;AAE9B,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA2B;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,uBAAuB,CAAA;IAEzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QACnD,GAAG,CAAC,OAAO,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAA;QAChE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACtC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QAClC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACZ,GAAG,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAA;QAC7E,GAAG,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAA;QAC1E,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACZ,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;YAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC3B,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAA;YACtF,GAAG,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAA;YAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC3B,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAA;YACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,oBAAoB,EAAE,CAAA;IAC5B,GAAG,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAA;IACpE,GAAG,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAA;AAClF,CAAC"}

package/dist/commands/exec.d.ts

@@ -17,6 +17,36 @@
  * LLD #8 — Sync Daemon / CLI
  * @module
  */
+import type { IntuticCredentials } from '@intutic/shared-types';
+import { type GraphIdentity } from '../lib/graphIdentity.js';
+import { type SandboxKind } from '../lib/sandbox/index.js';
+/** Workspace requirement for whether agents must run sandboxed (LLD #63 §6). */
+export type SandboxRequirement = 'off' | 'warn' | 'require';
+/**
+ * Resolve this workspace's sandbox requirement, resiliently. A best-effort
+ * control-plane fetch (short timeout) refreshes a local cache; if the control
+ * plane is unreachable we fall back to the cache, and if there is none we
+ * default to `off`. This keeps an offline developer working and keeps open core
+ * — which has no control plane to read this from — entirely unaffected.
+ *
+ * This is a client-side, advisory layer (a determined user can bypass by not
+ * using `intutic exec` at all); server-side attestation is the stronger
+ * follow-on. So failing open toward `off` on an unreachable, never-cached
+ * control plane is the honest behaviour for what this layer is.
+ */
+export declare function resolveSandboxRequirement(creds: IntuticCredentials): Promise<SandboxRequirement>;
+/** Options for a sandboxed `intutic exec`. */
+export interface SandboxExecOptions {
+    kind: SandboxKind;
+    image: string;
+    memory: string;
+    cpus: string;
+    pidsLimit: number;
+    /** Extra destination CIDRs the sandbox may reach beyond the proxy + DNS. */
+    allow: string[];
+}
+/** The proxy port the host listens on, from INTUTIC_PROXY_URL (default 4000). */
+export declare function proxyPortFromEnv(): string;
 /**
  * Build the proxy environment variables for a child process.
  *
@@ -24,11 +54,17 @@
  * @param devMode  - retained for call-site compatibility; the proxy is always local
  * @returns Record of env vars to inject
  */
-export declare function buildProxyEnv(apiKey: string, devMode: boolean): Record<string, string>;
+export declare function buildProxyEnv(apiKey: string, devMode: boolean, identity?: GraphIdentity, proxyUrlOverride?: string): Record<string, string>;
 /**
  * Execute a command with Intutic proxy environment variables injected.
  *
  * @param commandAndArgs - Array of command + arguments (e.g. ['claude'] or ['python', 'main.py'])
+ * @param sandbox - when set, run the command inside an isolated runtime whose
+ *   only egress is the proxy (LLD #63 §6) instead of directly on the host.
  */
-export declare function runExec(commandAndArgs: string[]): Promise<void>;
+export declare function runExec(commandAndArgs: string[], sandbox?: SandboxExecOptions): Promise<void>;
+/** Opens a SANDBOX-mode session for telemetry. Returns null on any failure. */
+export declare function openSandboxSession(creds: IntuticCredentials, identity: GraphIdentity, backendName: string): Promise<string | null>;
+/** Ends a session opened by openSandboxSession. Best-effort. */
+export declare function closeSandboxSession(creds: IntuticCredentials, sessionId: string): Promise<void>;
 //# sourceMappingURL=exec.d.ts.map

package/dist/commands/exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6BtF;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDrE"}
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE/D,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAAiB,KAAK,WAAW,EAAoB,MAAM,yBAAyB,CAAA;AAG3F,gFAAgF;AAChF,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;AAE3D;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAkC7B;AAKD,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,IAAI,MAAM,CAOzC;AAgBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,QAAQ,CAAC,EAAE,aAAa,EACxB,gBAAgB,CAAC,EAAE,MAAM,GACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAyDxB;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,cAAc,EAAE,MAAM,EAAE,EACxB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAiFf;AA6FD,+EAA+E;AAC/E,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,aAAa,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmBxB;AAED,gEAAgE;AAChE,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAarG"}

package/dist/commands/exec.js

@@ -18,9 +18,88 @@
  * @module
  */
 import { spawn } from 'node:child_process';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
 import { loadCredentials, loadConfig } from '../config/store.js';
+import { getIntuticDir } from '../config/paths.js';
+import { deriveIdentity, identityEnv, identityHeaders, identityPathPrefix, } from '../lib/graphIdentity.js';
 import { log } from '../lib/logger.js';
+import { NOT_AUTHENTICATED } from '../lib/authMessages.js';
+import { selectBackend } from '../lib/sandbox/index.js';
 import pc from 'picocolors';
+/**
+ * Resolve this workspace's sandbox requirement, resiliently. A best-effort
+ * control-plane fetch (short timeout) refreshes a local cache; if the control
+ * plane is unreachable we fall back to the cache, and if there is none we
+ * default to `off`. This keeps an offline developer working and keeps open core
+ * — which has no control plane to read this from — entirely unaffected.
+ *
+ * This is a client-side, advisory layer (a determined user can bypass by not
+ * using `intutic exec` at all); server-side attestation is the stronger
+ * follow-on. So failing open toward `off` on an unreachable, never-cached
+ * control plane is the honest behaviour for what this layer is.
+ */
+export async function resolveSandboxRequirement(creds) {
+    const cachePath = path.join(getIntuticDir(), 'exec-policy.json');
+    const coerce = (v) => v === 'warn' || v === 'require' ? v : 'off';
+    const base = trimTrailingSlashes(creds.controlPlaneUrl ?? 'https://api.intutic.ai');
+    try {
+        const res = await fetch(`${base}/api/v1/workspace/settings`, {
+            headers: {
+                Authorization: `Bearer ${creds.apiKey}`,
+                'x-workspace-id': creds.workspaceId ?? '',
+            },
+            signal: AbortSignal.timeout(2500),
+        });
+        if (res.ok) {
+            const body = (await res.json());
+            const val = coerce(body?.settings?.sandboxRequirement);
+            try {
+                await fs.writeFile(cachePath, JSON.stringify({ sandboxRequirement: val, cachedAt: new Date().toISOString() }));
+            }
+            catch {
+                /* cache write is best-effort */
+            }
+            return val;
+        }
+    }
+    catch {
+        /* fall through to the cache */
+    }
+    try {
+        const cached = JSON.parse(await fs.readFile(cachePath, 'utf-8'));
+        return coerce(cached?.sandboxRequirement);
+    }
+    catch {
+        return 'off';
+    }
+}
+/** The hostname a container reaches the host (and so the proxy) at. */
+const PROXY_HOST_ALIAS = 'host.docker.internal';
+/** The proxy port the host listens on, from INTUTIC_PROXY_URL (default 4000). */
+export function proxyPortFromEnv() {
+    const raw = process.env.INTUTIC_PROXY_URL ?? 'http://localhost:4000';
+    try {
+        return new URL(raw).port || '4000';
+    }
+    catch {
+        return '4000';
+    }
+}
+/**
+ * Trims trailing `/` characters without a regex.
+ *
+ * `INTUTIC_PROXY_URL` is a local environment variable, not remotely
+ * attacker-controlled — but CodeQL's static analysis flags `/\/+$/` as a
+ * polynomial-time pattern on external input regardless, and a loop is O(n)
+ * and cannot be mis-classified as a ReDoS shape by any static analyzer.
+ */
+function trimTrailingSlashes(s) {
+    let end = s.length;
+    while (end > 0 && s.charCodeAt(end - 1) === 47 /* '/' */)
+        end--;
+    return s.slice(0, end);
+}
 /**
  * Build the proxy environment variables for a child process.
  *
@@ -28,18 +107,25 @@ import pc from 'picocolors';
  * @param devMode  - retained for call-site compatibility; the proxy is always local
  * @returns Record of env vars to inject
  */
-export function buildProxyEnv(apiKey, devMode) {
+export function buildProxyEnv(apiKey, devMode, identity, proxyUrlOverride) {
     // The local proxy is the default, and for open core it is the only proxy
     // there is. This used to point at a remote host unless --dev was passed, so
     // `intutic exec` sent both the agent's traffic and OPENAI_API_KEY off the
     // machine -- to a host that does not resolve, so the command could not work
     // either. `intutic start` binds :4000; that is what these should reach.
     //
-    // Set INTUTIC_PROXY_URL to point at a proxy you run somewhere else.
-    const proxyHost = (process.env.INTUTIC_PROXY_URL ?? 'http://localhost:4000').replace(/\/+$/, '');
-    const proxyUrl = `${proxyHost}/v1`;
+    // Set INTUTIC_PROXY_URL to point at a proxy you run somewhere else. A sandbox
+    // launch overrides it with the host-gateway alias, because inside the sandbox
+    // `localhost` is the sandbox, not the host the proxy runs on.
+    const rawHost = trimTrailingSlashes(proxyUrlOverride ?? process.env.INTUTIC_PROXY_URL ?? 'http://localhost:4000');
     void devMode;
-    return {
+    // Graph identity rides in the base URL. Harnesses append their own path to
+    // whatever host they are given, so a prefix here reaches the proxy from every
+    // one of them — including the many that offer no way to set a header. The
+    // proxy strips it before routing, so upstream sees the path the harness meant.
+    const proxyHost = identity ? `${rawHost}${identityPathPrefix(identity)}` : rawHost;
+    const proxyUrl = `${proxyHost}/v1`;
+    const env = {
         // OpenAI-compatible (covers LiteLLM, LangChain, CrewAI, ADK, Aider)
         OPENAI_API_BASE: proxyUrl,
         // OpenAI SDK v1+ (covers Python SDK, Pydantic-AI, Agent SDK)
@@ -56,38 +142,74 @@ export function buildProxyEnv(apiKey, devMode) {
         // Intutic-native
         INTUTIC_API_KEY: apiKey,
     };
+    if (identity) {
+        // Passed down so a nested `intutic exec` — an agent spawning an agent —
+        // derives itself as this node's child without anything tracking the graph
+        // centrally.
+        Object.assign(env, identityEnv(identity));
+        // Claude Code is the one harness that can send arbitrary headers, and the
+        // proxy prefers headers over the path. Anything already configured is kept:
+        // clobbering a user's own headers to add telemetry would be a poor trade.
+        const existing = process.env.ANTHROPIC_CUSTOM_HEADERS;
+        const ours = Object.entries(identityHeaders(identity))
+            .map(([k, v]) => `${k}: ${v}`)
+            .join('\n');
+        env.ANTHROPIC_CUSTOM_HEADERS = existing ? `${existing}\n${ours}` : ours;
+    }
+    return env;
 }
 /**
  * Execute a command with Intutic proxy environment variables injected.
  *
  * @param commandAndArgs - Array of command + arguments (e.g. ['claude'] or ['python', 'main.py'])
+ * @param sandbox - when set, run the command inside an isolated runtime whose
+ *   only egress is the proxy (LLD #63 §6) instead of directly on the host.
  */
-export async function runExec(commandAndArgs) {
+export async function runExec(commandAndArgs, sandbox) {
     if (commandAndArgs.length === 0) {
         log.error('No command specified.');
         log.dim('Usage: intutic exec -- <command> [args...]');
         log.dim('Example: intutic exec -- claude');
         log.dim('Example: intutic exec -- aider --model openai/gpt-4o');
-        log.dim('Example: intutic exec -- python my_agent.py');
+        log.dim('Example: intutic exec --sandbox -- python my_agent.py');
         process.exit(1);
     }
     // Load credentials
     const creds = await loadCredentials();
     if (!creds) {
-        log.error('Not authenticated. This command needs an Intutic control plane, which open core does not include. To run the proxy without one: `intutic start`.');
+        log.error(NOT_AUTHENTICATED);
         process.exit(1);
     }
     // Load config for dev mode
     const config = loadConfig();
     const devMode = config?.devMode ?? process.env.INTUTIC_DEV === '1';
-    // Build env
-    const proxyEnv = buildProxyEnv(creds.apiKey, devMode);
+    // Build env. A nested `intutic exec` inherits identity from its parent and
+    // becomes a child node; a top-level one starts a new graph.
+    const identity = deriveIdentity();
+    if (sandbox) {
+        await runSandboxed(commandAndArgs, creds, devMode, identity, sandbox);
+        return;
+    }
+    // Not sandboxed — honour the workspace's sandbox requirement (LLD #63 §6).
+    const requirement = await resolveSandboxRequirement(creds);
+    if (requirement === 'require') {
+        log.error('This workspace requires agents to run inside a sandbox.');
+        log.dim(`Re-run with the sandbox:  intutic exec --sandbox -- ${commandAndArgs.join(' ')}`);
+        process.exit(1);
+    }
+    if (requirement === 'warn') {
+        log.warn('This workspace recommends running agents in a sandbox — add --sandbox.');
+    }
+    const proxyEnv = buildProxyEnv(creds.apiKey, devMode, identity);
     const childEnv = { ...process.env, ...proxyEnv };
     const [exe, ...args] = commandAndArgs;
     // Print info
     log.info(`Launching: ${pc.bold(exe)} ${args.join(' ')}`);
     log.dim(`Proxy: ${proxyEnv.OPENAI_API_BASE}`);
     log.dim(`API Key: ${creds.apiKey.slice(0, 8)}...${creds.apiKey.slice(-4)}`);
+    log.dim(identity.depth === 0
+        ? `Graph: ${identity.graphId} (root)`
+        : `Graph: ${identity.graphId} · node ${identity.nodeId} · depth ${identity.depth}`);
     console.log('');
     // Spawn the child process with inherited stdio (full interactivity)
     const child = spawn(exe, args, {
@@ -114,4 +236,119 @@ export async function runExec(commandAndArgs) {
         }
     });
 }
+/**
+ * Run the agent inside an isolated sandbox whose only egress is the proxy.
+ *
+ * Inside the sandbox `localhost` is the sandbox, not the host — so the proxy
+ * env is rebuilt against the host-gateway alias, and the sandbox's egress
+ * firewall is opened to exactly that address plus DNS (and any `--sandbox-allow`
+ * CIDRs). Secrets are passed by env-var *name*, so they never appear in the
+ * container runtime's argv.
+ */
+async function runSandboxed(commandAndArgs, creds, devMode, identity, opts) {
+    const port = proxyPortFromEnv();
+    const proxyUrlOverride = `http://${PROXY_HOST_ALIAS}:${port}`;
+    const proxyEnv = buildProxyEnv(creds.apiKey, devMode, identity, proxyUrlOverride);
+    // The values the runtime will read for the `--env NAME` references.
+    //
+    // INTUTIC_SANDBOX_PROXY_PORT is separate from ANTHROPIC_BASE_URL/etc on
+    // purpose: those carry an identity path prefix (buildProxyEnv, when
+    // `identity` is set) that the proxy's /intutic/* routes don't expect —
+    // building the attest URL from host+port directly, not by trimming a path
+    // off an identity-bearing URL in shell, keeps entrypoint.sh simple and
+    // correct regardless of whether identity is present.
+    const env = {
+        ...proxyEnv,
+        INTUTIC_SANDBOX_PROXY_HOST: PROXY_HOST_ALIAS,
+        INTUTIC_SANDBOX_PROXY_PORT: port,
+        ...(opts.allow.length ? { INTUTIC_SANDBOX_ALLOW: opts.allow.join(',') } : {}),
+    };
+    let backend;
+    try {
+        backend = selectBackend(opts.kind, env);
+    }
+    catch (err) {
+        log.error(`Sandbox unavailable: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+    const health = await backend.health();
+    if (!health.available) {
+        // Honesty rule (LLD #63 §6): never silently fall back to running the agent
+        // ungoverned on the host — say what is unavailable and stop.
+        log.error(`Sandbox backend '${backend.name}' is not available: ${health.detail}`);
+        log.dim('Start Docker (or Podman), or drop --sandbox to run on the host.');
+        process.exit(1);
+    }
+    log.info(`Sandbox: ${backend.name} · image ${opts.image} · egress locked to the proxy`);
+    log.dim(`Proxy (from sandbox): ${proxyUrlOverride}`);
+    const [exe, ...rest] = commandAndArgs;
+    log.info(`Launching in sandbox: ${pc.bold(exe)} ${rest.join(' ')}`);
+    console.log('');
+    // Best-effort telemetry: a SANDBOX-mode session makes "how many runs were
+    // sandboxed" answerable (agent_sessions.executionMode already exists as a
+    // column with no other writer for this case — reusing it needs no schema
+    // change). Never blocks or fails the run: an unreachable control plane costs
+    // a debug log line, not a broken `intutic exec --sandbox`.
+    //
+    // Opened before `spec` so the session id can ride into the container as
+    // INTUTIC_SESSION_ID — the entrypoint uses it to attest itself server-side
+    // (LLD #63 §6, TD-333) once its own firewall + capability drop are in
+    // effect, closing the gap where this executionMode:'SANDBOX' record was
+    // the entire, self-reported, host-side claim.
+    const sessionId = await openSandboxSession(creds, identity, backend.name);
+    if (sessionId)
+        env.INTUTIC_SESSION_ID = sessionId;
+    const spec = {
+        command: commandAndArgs,
+        workdir: process.cwd(),
+        image: opts.image,
+        envKeys: Object.keys(env),
+        proxyHostAlias: PROXY_HOST_ALIAS,
+        allowCidrs: opts.allow,
+        memory: opts.memory,
+        cpus: opts.cpus,
+        pidsLimit: opts.pidsLimit,
+        tty: Boolean(process.stdout.isTTY),
+    };
+    const code = await backend.run(spec);
+    if (sessionId)
+        await closeSandboxSession(creds, sessionId);
+    process.exit(code);
+}
+/** Opens a SANDBOX-mode session for telemetry. Returns null on any failure. */
+export async function openSandboxSession(creds, identity, backendName) {
+    try {
+        const res = await fetch(`${trimTrailingSlashes(creds.controlPlaneUrl)}/api/v1/sessions`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${creds.apiKey}` },
+            body: JSON.stringify({
+                workspaceId: creds.workspaceId,
+                harnessType: 'sandbox',
+                executionMode: 'SANDBOX',
+                envTaskContext: `sandbox-backend:${backendName};graph:${identity.graphId}`,
+            }),
+            signal: AbortSignal.timeout(5_000),
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        return body.sessionId ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Ends a session opened by openSandboxSession. Best-effort. */
+export async function closeSandboxSession(creds, sessionId) {
+    try {
+        await fetch(`${trimTrailingSlashes(creds.controlPlaneUrl)}/api/v1/sessions/${sessionId}/end`, {
+            method: 'PATCH',
+            headers: { Authorization: `Bearer ${creds.apiKey}` },
+            signal: AbortSignal.timeout(5_000),
+        });
+    }
+    catch {
+        /* best-effort */
+    }
+}
 //# sourceMappingURL=exec.js.map

package/dist/commands/exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,MAAM,YAAY,CAAA;AAE3B;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAgB;IAC5D,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,EAAE;IACF,oEAAoE;IACpE,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAChG,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,CAAA;IAClC,KAAK,OAAO,CAAA;IAEZ,OAAO;QACL,oEAAoE;QACpE,eAAe,EAAE,QAAQ;QACzB,6DAA6D;QAC7D,eAAe,EAAE,QAAQ;QACzB,+CAA+C;QAC/C,mBAAmB,EAAE,QAAQ;QAC7B,gDAAgD;QAChD,WAAW,EAAE,SAAS;QACtB,iCAAiC;QACjC,cAAc,EAAE,MAAM;QACtB,wEAAwE;QACxE,kBAAkB,EAAE,SAAS;QAC7B,iBAAiB,EAAE,MAAM;QACzB,iBAAiB;QACjB,eAAe,EAAE,MAAM;KACxB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,cAAwB;IACpD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAClC,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QACrD,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;QAC1C,GAAG,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QAC/D,GAAG,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAA;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,mBAAmB;IACnB,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,kJAAkJ,CAAC,CAAA;QAC7J,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,2BAA2B;IAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAA;IAElE,YAAY;IACZ,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA;IAEhD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,CAAA;IAErC,aAAa;IACb,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEf,oEAAoE;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,2CAA2C;KACjF,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;YACtC,GAAG,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QACjE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;QACzB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EACL,cAAc,EACd,WAAW,EACX,eAAe,EACf,kBAAkB,GAEnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAsC,MAAM,yBAAyB,CAAA;AAC3F,OAAO,EAAE,MAAM,YAAY,CAAA;AAK3B;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,kBAAkB,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,CAAC,CAAU,EAAsB,EAAE,CAChD,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAE7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,eAAe,IAAI,wBAAwB,CAAC,CAAA;IACnF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,4BAA4B,EAAE;YAC3D,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;gBACvC,gBAAgB,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;aAC1C;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoD,CAAA;YAClF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAA;YACtD,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAA;YAChH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAqC,CAAA;QACpG,OAAO,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,sBAAsB,CAAA;AAa/C,iFAAiF;AACjF,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAA;IACpE,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAC/D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,OAAgB,EAChB,QAAwB,EACxB,gBAAyB;IAEzB,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,mBAAmB,CACjC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAC7E,CAAA;IACD,KAAK,OAAO,CAAA;IAEZ,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IAClF,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,CAAA;IAElC,MAAM,GAAG,GAA2B;QAClC,oEAAoE;QACpE,eAAe,EAAE,QAAQ;QACzB,6DAA6D;QAC7D,eAAe,EAAE,QAAQ;QACzB,+CAA+C;QAC/C,mBAAmB,EAAE,QAAQ;QAC7B,gDAAgD;QAChD,WAAW,EAAE,SAAS;QACtB,iCAAiC;QACjC,cAAc,EAAE,MAAM;QACtB,wEAAwE;QACxE,kBAAkB,EAAE,SAAS;QAC7B,iBAAiB,EAAE,MAAM;QACzB,iBAAiB;QACjB,eAAe,EAAE,MAAM;KACxB,CAAA;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,wEAAwE;QACxE,0EAA0E;QAC1E,aAAa;QACb,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAA;QAEzC,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAA;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,GAAG,CAAC,wBAAwB,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACzE,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,cAAwB,EACxB,OAA4B;IAE5B,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAClC,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QACrD,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;QAC1C,GAAG,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QAC/D,GAAG,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,mBAAmB;IACnB,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,2BAA2B;IAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAA;IAElE,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAA;IAEjC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QACrE,OAAM;IACR,CAAC;IAED,2EAA2E;IAC3E,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAC1D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,GAAG,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAA;QACpE,GAAG,CAAC,GAAG,CAAC,uDAAuD,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC/D,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA;IAEhD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,CAAA;IAErC,aAAa;IACb,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3E,GAAG,CAAC,GAAG,CACL,QAAQ,CAAC,KAAK,KAAK,CAAC;QAClB,CAAC,CAAC,UAAU,QAAQ,CAAC,OAAO,SAAS;QACrC,CAAC,CAAC,UAAU,QAAQ,CAAC,OAAO,WAAW,QAAQ,CAAC,MAAM,YAAY,QAAQ,CAAC,KAAK,EAAE,CACrF,CAAA;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEf,oEAAoE;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,2CAA2C;KACjF,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;YACtC,GAAG,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QACjE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;QACzB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CACzB,cAAwB,EACxB,KAAyB,EACzB,OAAgB,EAChB,QAAuB,EACvB,IAAwB;IAExB,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAA;IAC/B,MAAM,gBAAgB,GAAG,UAAU,gBAAgB,IAAI,IAAI,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAA;IAEjF,oEAAoE;IACpE,EAAE;IACF,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,GAAG,GAA2B;QAClC,GAAG,QAAQ;QACX,0BAA0B,EAAE,gBAAgB;QAC5C,0BAA0B,EAAE,IAAI;QAChC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAA;IAED,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;IACrC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,2EAA2E;QAC3E,6DAA6D;QAC7D,GAAG,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,IAAI,uBAAuB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QACjF,GAAG,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,IAAI,YAAY,IAAI,CAAC,KAAK,+BAA+B,CAAC,CAAA;IACvF,GAAG,CAAC,GAAG,CAAC,yBAAyB,gBAAgB,EAAE,CAAC,CAAA;IACpD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,CAAA;IACrC,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEf,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,2DAA2D;IAC3D,EAAE;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,wEAAwE;IACxE,8CAA8C;IAC9C,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACzE,IAAI,SAAS;QAAE,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAA;IAEjD,MAAM,IAAI,GAAgB;QACxB,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE;QACtB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,cAAc,EAAE,gBAAgB;QAChC,UAAU,EAAE,IAAI,CAAC,KAAK;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;KACnC,CAAA;IAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAEpC,IAAI,SAAS;QAAE,MAAM,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAC1D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpB,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAyB,EACzB,QAAuB,EACvB,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,kBAAkB,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE;YACxF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,SAAS;gBACtB,aAAa,EAAE,SAAS;gBACxB,cAAc,EAAE,mBAAmB,WAAW,UAAU,QAAQ,CAAC,OAAO,EAAE;aAC3E,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAA;QACzD,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAyB,EAAE,SAAiB;IACpF,IAAI,CAAC;QACH,MAAM,KAAK,CACT,GAAG,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,oBAAoB,SAAS,MAAM,EAChF;YACE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE;YACpD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CACF,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC"}