@intutic/sync-daemon 1.9.0 → 1.10.1

package/README.md

@@ -15,7 +15,7 @@ fetch config → write harness files → compute hashes → report drift
 On each sync cycle the daemon:
 
 1. **Fetches** the latest SOP configuration from the control plane
-2. **Writes** harness-specific config files using 18 format-aware config writers
+2. **Writes** harness-specific config files using 19 format-aware config writers
 3. **Computes** content hashes for drift detection
 4. **Reports** any detected drift back to the control plane
 
@@ -23,7 +23,7 @@ On each sync cycle the daemon:
 
 ### Config Writers
 
-18 harness-specific config writers that translate governance SOPs into native configuration formats (YAML, JSON, TOML, Markdown, environment variables).
+Harness-specific config writers (one module per harness under `src/harness/`) that translate governance SOPs into native configuration formats (YAML, JSON, TOML, Markdown, environment variables); most of them emit blocking pre-tool gates. The authoritative list of which harness gets which gate shape is `src/harness/gateKind.ts`, and `__tests__/harness/gateRegistry.ts` exercises every generated gate — counts are not repeated here because they drifted every time a harness was added.
 
 ### Atomic Writes
 

package/dist/agentReporter.d.ts

@@ -0,0 +1,205 @@
+/**
+ * agentReporter.ts — register the workspace's agents with the control plane.
+ *
+ * Each detected harness is a durable agent identity. On the sync loop, the
+ * daemon collects the facets it can see locally — the configured guardrails,
+ * the role SOPs on disk, the skills bundled into the workspace, the MCP servers
+ * declared in the harness config, and the budget tier — and reports them to
+ * `POST /api/v1/agents/report`. The control plane rescores posture on each
+ * report, so the dashboard ring stays live.
+ *
+ * The daemon only reports what is locally observable; the control plane owns
+ * anything requiring cross-session state (agent-to-agent links from session
+ * parentage, spend actuals).
+ *
+ * @module
+ */
+import { type HarnessType } from '@intutic/shared-types';
+/** Live egress-enforcement status read from the proxy's own diagnostic endpoint. */
+export interface EgressFacet {
+    mode: string;
+    denied: number;
+    would_deny: number;
+}
+/**
+ * Summary of the proxy's last scheduled guard-liveness probe run
+ * (`GET /intutic/probes`, Wave 6.1 audit-remediation). `ranAt` is the Unix
+ * timestamp the *scheduled loop* recorded, not when this fetch ran — a dead
+ * loop shows up here as a timestamp that stops advancing, not a fresh
+ * "just ran" answer every cycle.
+ */
+export interface GuardProbesFacet {
+    total: number;
+    failed: number;
+    ranAt: number;
+    /** probe_id of every failing probe, capped at 10 — enough to act on
+     *  without turning this into an unbounded transcript. */
+    failing: string[];
+}
+interface AgentFacets {
+    guardrails: {
+        dlp: boolean;
+        wasm_rules: number;
+        /**
+         * True only when this harness's gate mechanism is `'hook'` (an on-disk
+         * file the daemon writes and verified existence of) — kept for older
+         * control-plane deployments that read this boolean directly. `false` for
+         * `gateKind: 'sdk'` is NOT "this harness is unprotected"; see
+         * `gate_kind` below and `harness/gateKind.ts`'s module doc. Previously
+         * hardcoded `true` for every harness regardless of mechanism.
+         */
+        hook_gate: boolean;
+        /** How this harness's tool calls get gated — see `harness/gateKind.ts`. */
+        gate_kind: import('./harness/gateKind.js').GateKind;
+        pcas: boolean;
+        /** Present when the local proxy answered GET /intutic/egress (LLD #63 §4). */
+        egress?: EgressFacet;
+    };
+    sops: Array<{
+        sop_id: string;
+        name: string;
+        enforced: boolean;
+    }>;
+    budgets: {
+        tier?: string;
+    };
+    mcp_tools: Array<{
+        server: string;
+        harness: string;
+        transport: string;
+        wrapped: boolean;
+    }>;
+    skills: Array<{
+        name: string;
+        source: string;
+        /** Whether `scanSkillContent` actually ran against this skill's
+         *  `SKILL.md`. `false` on a read failure — never omitted, and never
+         *  paired with `clean: true`; see `collectSkills` below. */
+        scanned: boolean;
+        /** Only meaningful when `scanned` is `true`. `false` means the content
+         *  scan found at least one pattern match (report-only — see
+         *  `packages/shared-types/src/skillScan.ts`'s doc comment; nothing here
+         *  blocks or modifies the skill). */
+        clean: boolean;
+        /** Count of findings when scanned and not clean; `0` when scanned+clean
+         *  or when unscanned (there is nothing to count). */
+        findingsCount: number;
+        /**
+         * Bundled-script enumeration for this skill (TD-356, Phase S2) — files
+         * alongside `SKILL.md` inside the same skill directory, discovered by
+         * the same bounded, symlink-skipping walk `discoverSkillBundledFiles`
+         * (`tools/cli/src/commands/skill.ts`) uses, and content-scanned via
+         * `scanScriptContent` when a recognized language and within
+         * `MAX_SCRIPT_SCAN_BYTES`. Omitted (not `{total: 0, ...}`) when the
+         * skill has no bundled files at all — `agentPosture.ts`'s `skills`
+         * scorer treats an absent facet as "nothing to say," not as a finding.
+         */
+        scripts?: {
+            /** Every bundled file the walk found, scanned or not. */
+            total: number;
+            /** How many of `total` were actually content-scanned — excludes
+             *  unreadable files, files over the byte cap (refused, not skipped),
+             *  and files whose language `detectScriptLanguage` could not
+             *  determine. */
+            scanned: number;
+            /** How many of `scanned` came back with at least one finding. */
+            flagged: number;
+        };
+        /**
+         * sha256 of the `SKILL.md` content this row describes (Phase S5,
+         * TD-357) — lets `services/control-plane/src/routes/agents.ts` look up
+         * a previously-judged semantic verdict
+         * (`services/semanticSkillAnalysisService.ts`'s `skills:semantic:*`
+         * Valkey entry) keyed by the exact content this cycle read, without this
+         * daemon ever transmitting the content itself over `/api/v1/agents/report`
+         * — only the CLI's `/skills/report` path (opt-in,
+         * `semanticSkillAnalysisEnabled`) does that. Absent when `SKILL.md`
+         * could not be read.
+         */
+        sha256?: string;
+    }>;
+    loops: {
+        configured: boolean;
+    };
+    harness: {
+        type: string;
+        config_synced: boolean;
+    };
+    memory: Array<{
+        provider: string;
+        configured: boolean;
+    }>;
+    /**
+     * Present only when the local proxy answered `GET /intutic/probes`. A
+     * sibling of `guardrails`, not a member of it — `guardrails` already names
+     * one boolean/count per guard mechanism (dlp, wasm_rules, hook_gate, pcas,
+     * egress); guard-liveness is a different axis (did the loaded guards prove
+     * themselves against a live probe, on a schedule) and collapsing it into
+     * `guardrails` would make `hasOwnProperty` checks there ambiguous between
+     * "this guard exists" and "this guard is alive". Absence here (vs. a
+     * present-but-empty facet) is itself meaningful to `agentPosture.ts`: no
+     * report means `not_enforced`, never a silent pass.
+     */
+    guardProbes?: GuardProbesFacet;
+}
+export interface AgentReport {
+    agentKey: string;
+    displayName: string;
+    harnessType: string;
+    agentRole: string;
+    facets: AgentFacets;
+}
+/**
+ * Read the local proxy's egress-enforcement status (LLD #63 §4). The proxy
+ * exposes `{mode, denied, would_deny}` at `GET /intutic/egress`, but nothing
+ * plumbed those counters off the machine — this is the wiring that carries them
+ * up so an egress denial is visible in the dashboard, not just the proxy log.
+ * Best-effort: an unreachable or non-managed proxy simply omits the facet.
+ */
+export declare function fetchEgressStatus(): Promise<EgressFacet | null>;
+/**
+ * Read the local proxy's last scheduled guard-liveness probe run
+ * (`GET /intutic/probes`, loopback-only — this must run on the same machine
+ * as the proxy, exactly like `fetchEgressStatus` above). Best-effort: an
+ * unreachable proxy, a 403 (non-loopback — should not happen here), or a 503
+ * (suite hasn't run yet, the narrow window right after proxy start) all
+ * simply omit the facet rather than reporting a false pass.
+ */
+export declare function fetchGuardProbes(): Promise<GuardProbesFacet | null>;
+/**
+ * Read the local proxy's process-lifetime instance id (`GET /intutic/instance`,
+ * loopback-only like the two probes above; TD-231, Wave 5.6). The control
+ * plane derives one `agent_sessions` row per (workspace, harness, instance)
+ * for the traces that proxy publishes; knowing the id lets the daemon register
+ * that same row with the workspace's git/task context instead of opening a
+ * separate `ses_` session the traces never join.
+ *
+ * Returns `null` — and the caller falls back to a `ses_` session — for an
+ * unreachable or non-managed proxy, a non-OK answer, a malformed body, and for
+ * a SHARED GATEWAY (`shared_gateway: true`, or an id that does not carry the
+ * local `proxy_` prefix): a gateway pod's row aggregates every developer
+ * behind it, so one developer's branch must never be written onto it.
+ */
+export declare function fetchLocalProxyInstanceId(): Promise<string | null>;
+/**
+ * Build a facet report for one harness in the workspace.
+ *
+ * `dlpEnabled` / `policyEnforced` come from the daemon's known proxy config;
+ * the daemon spawns and configures the proxy, so it knows these without a
+ * round-trip.
+ */
+export declare function collectAgentReport(opts: {
+    workspaceRoot: string;
+    harnessType: HarnessType;
+    agentRole?: string;
+    configSynced: boolean;
+    dlpEnabled: boolean;
+    policyEnforced: boolean;
+    budgetTier?: string;
+    /** Workspace policy: may local vaults feed /fix? Defaults to allowed. */
+    allowLocalVaults?: boolean;
+}): Promise<AgentReport>;
+/** POST a report to the control plane. Non-fatal on failure (mirrors reportStatus). */
+export declare function reportAgent(controlPlaneUrl: string, apiKey: string, workspaceId: string, report: AgentReport): Promise<void>;
+export {};
+//# sourceMappingURL=agentReporter.d.ts.map

package/dist/agentReporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentReporter.d.ts","sourceRoot":"","sources":["../src/agentReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EAOL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAA;AAI9B,oFAAoF;AACpF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb;6DACyD;IACzD,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,UAAU,WAAW;IACnB,UAAU,EAAE;QACV,GAAG,EAAE,OAAO,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB;;;;;;;WAOG;QACH,SAAS,EAAE,OAAO,CAAA;QAClB,2EAA2E;QAC3E,SAAS,EAAE,OAAO,uBAAuB,EAAE,QAAQ,CAAA;QACnD,IAAI,EAAE,OAAO,CAAA;QACb,8EAA8E;QAC9E,MAAM,CAAC,EAAE,WAAW,CAAA;KACrB,CAAA;IACD,IAAI,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAChE,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1B,SAAS,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC1F,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;QACd;;oEAE4D;QAC5D,OAAO,EAAE,OAAO,CAAA;QAChB;;;6CAGqC;QACrC,KAAK,EAAE,OAAO,CAAA;QACd;6DACqD;QACrD,aAAa,EAAE,MAAM,CAAA;QACrB;;;;;;;;;WASG;QACH,OAAO,CAAC,EAAE;YACR,yDAAyD;YACzD,KAAK,EAAE,MAAM,CAAA;YACb;;;6BAGiB;YACjB,OAAO,EAAE,MAAM,CAAA;YACf,iEAAiE;YACjE,OAAO,EAAE,MAAM,CAAA;SAChB,CAAA;QACD;;;;;;;;;;WAUG;QACH,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;IACF,KAAK,EAAE;QAAE,UAAU,EAAE,OAAO,CAAA;KAAE,CAAA;IAC9B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAA;IACjD,MAAM,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IACxD;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAA;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,WAAW,CAAA;CACpB;AAWD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAkBrE;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAyBzE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYxE;AAsMD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,OAAO,CAAA;IACrB,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,EAAE,OAAO,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,GAAG,OAAO,CAAC,WAAW,CAAC,CA+CvB;AAED,uFAAuF;AACvF,wBAAsB,WAAW,CAC/B,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/agentReporter.js

@@ -0,0 +1,394 @@
+/**
+ * agentReporter.ts — register the workspace's agents with the control plane.
+ *
+ * Each detected harness is a durable agent identity. On the sync loop, the
+ * daemon collects the facets it can see locally — the configured guardrails,
+ * the role SOPs on disk, the skills bundled into the workspace, the MCP servers
+ * declared in the harness config, and the budget tier — and reports them to
+ * `POST /api/v1/agents/report`. The control plane rescores posture on each
+ * report, so the dashboard ring stays live.
+ *
+ * The daemon only reports what is locally observable; the control plane owns
+ * anything requiring cross-session state (agent-to-agent links from session
+ * parentage, spend actuals).
+ *
+ * @module
+ */
+import { readFile, readdir, access } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { newIso } from '@intutic/id';
+import { scanSkillContent, scanScriptContent, detectScriptLanguage, MAX_SKILL_DIR_DEPTH, MAX_FILES_PER_SKILL, MAX_SCRIPT_SCAN_BYTES, } from '@intutic/shared-types';
+import { discoverMcpServers } from './harness/mcpAutoWrite.js';
+import { gateKindForHarness } from './harness/gateKind.js';
+async function exists(p) {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Read the local proxy's egress-enforcement status (LLD #63 §4). The proxy
+ * exposes `{mode, denied, would_deny}` at `GET /intutic/egress`, but nothing
+ * plumbed those counters off the machine — this is the wiring that carries them
+ * up so an egress denial is visible in the dashboard, not just the proxy log.
+ * Best-effort: an unreachable or non-managed proxy simply omits the facet.
+ */
+export async function fetchEgressStatus() {
+    // Regex-free trailing-slash trim — CodeQL flags `/\/+$/` as a polynomial
+    // pattern even on operator-env input; a loop sidesteps the category.
+    let base = process.env.INTUTIC_PROXY_URL ?? 'http://localhost:4000';
+    while (base.endsWith('/'))
+        base = base.slice(0, -1);
+    try {
+        const res = await fetch(`${base}/intutic/egress`, { signal: AbortSignal.timeout(2000) });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        if (typeof body.mode !== 'string')
+            return null;
+        return {
+            mode: body.mode,
+            denied: typeof body.denied === 'number' ? body.denied : 0,
+            would_deny: typeof body.would_deny === 'number' ? body.would_deny : 0,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read the local proxy's last scheduled guard-liveness probe run
+ * (`GET /intutic/probes`, loopback-only — this must run on the same machine
+ * as the proxy, exactly like `fetchEgressStatus` above). Best-effort: an
+ * unreachable proxy, a 403 (non-loopback — should not happen here), or a 503
+ * (suite hasn't run yet, the narrow window right after proxy start) all
+ * simply omit the facet rather than reporting a false pass.
+ */
+export async function fetchGuardProbes() {
+    let base = process.env.INTUTIC_PROXY_URL ?? 'http://localhost:4000';
+    while (base.endsWith('/'))
+        base = base.slice(0, -1);
+    try {
+        const res = await fetch(`${base}/intutic/probes`, { signal: AbortSignal.timeout(2000) });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        if (typeof body.total !== 'number' || typeof body.failed !== 'number' || typeof body.ran_at !== 'number') {
+            return null;
+        }
+        const probes = Array.isArray(body.probes) ? body.probes : [];
+        const failing = probes
+            .filter((p) => typeof p === 'object' && p !== null)
+            .filter((p) => p.passed === false && typeof p.probe_id === 'string')
+            .map((p) => p.probe_id)
+            .slice(0, 10);
+        return { total: body.total, failed: body.failed, ranAt: body.ran_at, failing };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read the local proxy's process-lifetime instance id (`GET /intutic/instance`,
+ * loopback-only like the two probes above; TD-231, Wave 5.6). The control
+ * plane derives one `agent_sessions` row per (workspace, harness, instance)
+ * for the traces that proxy publishes; knowing the id lets the daemon register
+ * that same row with the workspace's git/task context instead of opening a
+ * separate `ses_` session the traces never join.
+ *
+ * Returns `null` — and the caller falls back to a `ses_` session — for an
+ * unreachable or non-managed proxy, a non-OK answer, a malformed body, and for
+ * a SHARED GATEWAY (`shared_gateway: true`, or an id that does not carry the
+ * local `proxy_` prefix): a gateway pod's row aggregates every developer
+ * behind it, so one developer's branch must never be written onto it.
+ */
+export async function fetchLocalProxyInstanceId() {
+    let base = process.env.INTUTIC_PROXY_URL ?? 'http://localhost:4000';
+    while (base.endsWith('/'))
+        base = base.slice(0, -1);
+    try {
+        const res = await fetch(`${base}/intutic/instance`, { signal: AbortSignal.timeout(2000) });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        if (typeof body.proxy_instance_id !== 'string' || body.shared_gateway === true)
+            return null;
+        return body.proxy_instance_id.startsWith('proxy_') ? body.proxy_instance_id : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Count `.wasm` rules under `~/.intutic/wasm` (best-effort). */
+async function countWasmRules() {
+    const dir = join(process.env.HOME ?? '', '.intutic', 'wasm');
+    try {
+        const entries = await readdir(dir);
+        return entries.filter((e) => e.endsWith('.wasm')).length;
+    }
+    catch {
+        return 0;
+    }
+}
+/** Role SOPs on disk under `<root>/.intutic/sops`. */
+async function collectSops(workspaceRoot) {
+    const dir = join(workspaceRoot, '.intutic', 'sops');
+    try {
+        const entries = await readdir(dir);
+        const out = [];
+        for (const file of entries.filter((e) => e.endsWith('.md'))) {
+            const body = await readFile(join(dir, file), 'utf8').catch(() => '');
+            // An SOP is "enforced" if it declares deny_tools or allow_harnesses.
+            const enforced = /deny_tools|allow_harnesses/.test(body);
+            out.push({ sop_id: file.replace(/\.md$/, ''), name: file, enforced });
+        }
+        return out;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Bounded, symlink-skipping walk of one skill directory's bundled files
+ * (siblings of `SKILL.md`), content-scanning each one via `scanScriptContent`
+ * when its language is recognized and it is within `MAX_SCRIPT_SCAN_BYTES`.
+ *
+ * TD-356, Phase S2: mirrors `discoverSkillBundledFiles`
+ * (`tools/cli/src/commands/skill.ts`) closely — the exact same caps
+ * (`MAX_SKILL_DIR_DEPTH`, `MAX_FILES_PER_SKILL`) and symlink-skip discipline
+ * (`Dirent.isSymbolicLink()` checked and skipped outright during `readdir`,
+ * never stat-ed or resolved — a symlink inside a skill directory could point
+ * outside it, or outside the workspace entirely, turning a bounded walk
+ * unbounded) — but is its own implementation, not a shared import. This
+ * module has no dependency on `tools/cli`; `collectSkills` already
+ * re-implements skill-directory discovery independently of the CLI's
+ * `discoverSkillFiles` for the same reason, and this walk follows that same
+ * precedent rather than introducing a new cross-package dependency for it.
+ *
+ * Returns `undefined` (not `{total: 0, scanned: 0, flagged: 0}`) when the
+ * skill has no bundled files at all, so `collectSkills` can omit `scripts`
+ * entirely for the common case of a skill that is only a `SKILL.md` — see
+ * that field's own doc comment on the `AgentFacets['skills']` item type.
+ */
+async function collectSkillScripts(skillDir) {
+    const files = [];
+    async function walk(dir, depth) {
+        if (depth > MAX_SKILL_DIR_DEPTH || files.length >= MAX_FILES_PER_SKILL)
+            return;
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (files.length >= MAX_FILES_PER_SKILL)
+                return;
+            if (entry.isSymbolicLink())
+                continue; // never follow — see this function's doc comment
+            const full = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                await walk(full, depth + 1);
+            }
+            else if (entry.isFile()) {
+                if (depth === 0 && entry.name === 'SKILL.md')
+                    continue;
+                files.push(full);
+            }
+        }
+    }
+    await walk(skillDir, 0);
+    if (files.length === 0)
+        return undefined;
+    let scanned = 0;
+    let flagged = 0;
+    for (const filePath of files) {
+        let buffer;
+        try {
+            buffer = await readFile(filePath);
+        }
+        catch {
+            continue; // unreadable — counted in `total`, not `scanned`
+        }
+        if (buffer.length > MAX_SCRIPT_SCAN_BYTES)
+            continue; // refused, not silently skipped or scanned
+        const firstLine = buffer.toString('utf8', 0, Math.min(buffer.length, 200)).split('\n')[0];
+        const language = detectScriptLanguage(filePath, firstLine);
+        if (language === 'unknown')
+            continue; // not a script language this scanner understands
+        const result = scanScriptContent(buffer.toString('utf8'), language);
+        scanned++;
+        if (!result.clean)
+            flagged++;
+    }
+    return { total: files.length, scanned, flagged };
+}
+/**
+ * Bundled skills under `<root>/.agents/skills/<name>/SKILL.md`, content-
+ * scanned via `scanSkillContent` (`@intutic/shared-types`) on every cycle,
+ * plus (TD-356, Phase S2) a bounded enumeration of each skill's bundled
+ * scripts via `collectSkillScripts`, attached as the `scripts` facet.
+ *
+ * Report-only, matching `scanSkillContent`'s own doc comment: this function
+ * never modifies, blocks, or removes anything — it reads and attaches a
+ * verdict for `agentPosture.ts`'s content-aware `skills` scoring to consume.
+ *
+ * Refusal-not-pass: a `SKILL.md` that cannot be read (permissions, vanished
+ * between `readdir` and `readFile`, not a regular file, …) is reported
+ * `scanned: false, clean: false` — never `clean: true`, and never silently
+ * dropped from the list. An unreadable skill is not a skill the daemon can
+ * vouch for, and dropping it would make a workspace's posture score look
+ * better than what is actually known. The `scripts` enumeration runs
+ * regardless of whether `SKILL.md` itself was readable — a script bundled
+ * next to an unreadable `SKILL.md` is still on disk and still a surface to
+ * report on.
+ */
+async function collectSkills(workspaceRoot) {
+    const dir = join(workspaceRoot, '.agents', 'skills');
+    let entries;
+    try {
+        entries = await readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const dirs = entries.filter((e) => e.isDirectory());
+    const out = [];
+    for (const e of dirs) {
+        const skillDir = join(dir, e.name);
+        const skillMdPath = join(skillDir, 'SKILL.md');
+        const scripts = await collectSkillScripts(skillDir);
+        try {
+            const content = await readFile(skillMdPath, 'utf8');
+            const result = scanSkillContent(content);
+            const sha256 = createHash('sha256').update(content, 'utf8').digest('hex');
+            out.push({
+                name: e.name,
+                source: '.agents/skills',
+                scanned: true,
+                clean: result.clean,
+                findingsCount: result.findings.length,
+                sha256,
+                ...(scripts ? { scripts } : {}),
+            });
+        }
+        catch {
+            out.push({
+                name: e.name,
+                source: '.agents/skills',
+                scanned: false,
+                clean: false,
+                findingsCount: 0,
+                ...(scripts ? { scripts } : {}),
+            });
+        }
+    }
+    return out;
+}
+/** Local notes vaults (Obsidian/Logseq/Foam) at or above the workspace root. */
+async function detectLocalVaults(workspaceRoot) {
+    const markers = ['.obsidian', '.logseq', '.foam'];
+    const found = [];
+    let dir = workspaceRoot;
+    for (let depth = 0; depth < 8; depth++) {
+        for (const marker of markers) {
+            if (await exists(join(dir, marker))) {
+                found.push(marker.slice(1));
+            }
+        }
+        const parent = join(dir, '..');
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return [...new Set(found)];
+}
+/**
+ * MCP servers declared across every harness config format this daemon knows
+ * how to parse (see `mcpAutoWrite.ts`'s `discoverMcpServers` — 11 config paths
+ * across 9 harnesses), with each server's proxy-wrapped status. Previously
+ * this only read 3 hardcoded paths (`.mcp.json`, `.cursor/mcp.json`,
+ * `~/.claude.json`) and flattened per declared tool; `discoverMcpServers` is
+ * the shared, read-only extraction of the same format knowledge
+ * `injectMcpServer` uses to wrap servers, so this reporter's coverage can
+ * never silently lag behind what actually gets wrapped.
+ */
+async function collectMcpTools(workspaceRoot) {
+    return discoverMcpServers(workspaceRoot);
+}
+/**
+ * Build a facet report for one harness in the workspace.
+ *
+ * `dlpEnabled` / `policyEnforced` come from the daemon's known proxy config;
+ * the daemon spawns and configures the proxy, so it knows these without a
+ * round-trip.
+ */
+export async function collectAgentReport(opts) {
+    const [wasmRules, sops, skills, mcpTools, vaults, egress, guardProbes] = await Promise.all([
+        countWasmRules(),
+        collectSops(opts.workspaceRoot),
+        collectSkills(opts.workspaceRoot),
+        collectMcpTools(opts.workspaceRoot),
+        detectLocalVaults(opts.workspaceRoot),
+        fetchEgressStatus(),
+        fetchGuardProbes(),
+    ]);
+    const role = opts.agentRole ?? '';
+    return {
+        agentKey: `${opts.harnessType}:${role || 'default'}`,
+        displayName: role ? `${opts.harnessType} (${role})` : opts.harnessType,
+        harnessType: opts.harnessType,
+        agentRole: role,
+        facets: {
+            guardrails: {
+                dlp: opts.dlpEnabled,
+                wasm_rules: wasmRules,
+                // Computed per-harness rather than hardcoded true — see gateKind.ts's
+                // module doc for why "the daemon writes the hook gate for every
+                // harness it supports" was never actually true (langgraph, aider).
+                hook_gate: gateKindForHarness(opts.harnessType) === 'hook',
+                gate_kind: gateKindForHarness(opts.harnessType),
+                pcas: opts.policyEnforced,
+                // Present only when the local proxy answered; an egress denial thus
+                // becomes visible in the dashboard, not just the proxy's own log.
+                ...(egress ? { egress } : {}),
+            },
+            sops,
+            budgets: { tier: opts.budgetTier },
+            mcp_tools: mcpTools,
+            skills,
+            loops: { configured: false }, // set by the loops feature when a run is active
+            harness: { type: opts.harnessType, config_synced: opts.configSynced },
+            // Visibility, not content: which vault kinds exist near the workspace,
+            // and whether workspace policy lets them feed /fix. Note names/content
+            // never leave the machine.
+            memory: opts.allowLocalVaults === false
+                ? []
+                : vaults.map((kind) => ({ provider: `local-vault:${kind}`, configured: true })),
+            ...(guardProbes ? { guardProbes } : {}),
+        },
+    };
+}
+/** POST a report to the control plane. Non-fatal on failure (mirrors reportStatus). */
+export async function reportAgent(controlPlaneUrl, apiKey, workspaceId, report) {
+    try {
+        const res = await fetch(`${controlPlaneUrl}/api/v1/agents/report`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
+            body: JSON.stringify({ ...report, reportedAt: newIso() }),
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!res.ok) {
+            console.warn(`[sync-daemon] reportAgent failed for ${report.agentKey}: ${res.status}`);
+        }
+    }
+    catch (err) {
+        console.warn(`[sync-daemon] reportAgent error for ${report.agentKey}:`, err instanceof Error ? err.message : err);
+    }
+}
+//# sourceMappingURL=agentReporter.js.map

package/dist/agentReporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentReporter.js","sourceRoot":"","sources":["../src/agentReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAyH1D,KAAK,UAAU,MAAM,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,CAAC,CAAC,CAAA;QACf,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,yEAAyE;IACzE,qEAAqE;IACrE,IAAI,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAA;IACnE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,iBAAiB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACxF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+D,CAAA;QAC7F,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC9C,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACzD,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;SACtE,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAA;IACnE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,iBAAiB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACxF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAK7B,CAAA;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzG,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5D,MAAM,OAAO,GAAG,MAAM;aACnB,MAAM,CAAC,CAAC,CAAC,EAA+C,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;aAC/F,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;aACnE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAkB,CAAC;aAChC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACf,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAA;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,IAAI,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAA;IACnE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,mBAAmB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8D,CAAA;QAC5F,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC3F,OAAO,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAA;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,cAAc;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAA;IACV,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,KAAK,UAAU,WAAW,CAAC,aAAqB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;IACnD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,MAAM,GAAG,GAAwB,EAAE,CAAA;QACnC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YACpE,qEAAqE;YACrE,MAAM,QAAQ,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACxD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACvE,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,KAAK,UAAU,mBAAmB,CAChC,QAAgB;IAEhB,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,KAAa;QAC5C,IAAI,KAAK,GAAG,mBAAmB,IAAI,KAAK,CAAC,MAAM,IAAI,mBAAmB;YAAE,OAAM;QAC9E,IAAI,OAAO,CAAA;QACX,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAM;QACR,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,mBAAmB;gBAAE,OAAM;YAC/C,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAQ,CAAC,iDAAiD;YACtF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC7B,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;oBAAE,SAAQ;gBACtD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACvB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAExC,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,MAAc,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ,CAAC,iDAAiD;QAC5D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,qBAAqB;YAAE,SAAQ,CAAC,2CAA2C;QAC/F,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACzF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC1D,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAQ,CAAC,iDAAiD;QACtF,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAA;QACnE,OAAO,EAAE,CAAA;QACT,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,EAAE,CAAA;IAC9B,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,aAAa,CAAC,aAAqB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;IACpD,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IACnD,MAAM,GAAG,GAA0B,EAAE,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAC9C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAA;QAEnD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;YACxC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACzE,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,gBAAgB;gBACxB,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gBACrC,MAAM;gBACN,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,gBAAgB;gBACxB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK;gBACZ,aAAa,EAAE,CAAC;gBAChB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IACpD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,GAAG,GAAG,aAAa,CAAA;IACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBACpC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC9B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAK;QACzB,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,aAAqB;IAClD,OAAO,kBAAkB,CAAC,aAAa,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAUxC;IACC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzF,cAAc,EAAE;QAChB,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC;QAC/B,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;QACjC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;QACnC,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC;QACrC,iBAAiB,EAAE;QACnB,gBAAgB,EAAE;KACnB,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAA;IACjC,OAAO;QACL,QAAQ,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,SAAS,EAAE;QACpD,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW;QACtE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI;QACf,MAAM,EAAE;YACN,UAAU,EAAE;gBACV,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,UAAU,EAAE,SAAS;gBACrB,sEAAsE;gBACtE,gEAAgE;gBAChE,mEAAmE;gBACnE,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,MAAM;gBAC1D,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC/C,IAAI,EAAE,IAAI,CAAC,cAAc;gBACzB,oEAAoE;gBACpE,kEAAkE;gBAClE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B;YACD,IAAI;YACJ,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;YAClC,SAAS,EAAE,QAAQ;YACnB,MAAM;YACN,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,gDAAgD;YAC9E,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,2BAA2B;YAC3B,MAAM,EACJ,IAAI,CAAC,gBAAgB,KAAK,KAAK;gBAC7B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC;KACF,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,MAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,uBAAuB,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;YAClF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC;YACzD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,wCAAwC,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACxF,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,QAAQ,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACnH,CAAC;AACH,CAAC"}