@jungjaehoon/mama-os 0.21.0 → 0.22.1

package/dist/multi-agent/runtime-process.js

@@ -36,11 +36,14 @@ class CodexRuntimeProcess extends events_1.EventEmitter {
         this.wrapper = new codex_mcp_process_js_1.CodexMCPProcess(wrapperOptions);
     }
     // ─── IModelRunner.prompt() ─────────────────────────────────────────────
-    async prompt(content, callbacks, _options) {
-        return this.sendMessage(content, callbacks);
+    async prompt(content, callbacks, options) {
+        // Narrowed on purpose: only systemPrompt is per-call plumbing (Task 3).
+        // model/resumeSession stay inert on codex - activating them is a separate,
+        // deliberate change (they alter thread lifecycle, codex-mcp-process.ts:261-266).
+        return this.sendMessage(content, callbacks, options?.systemPrompt !== undefined ? { systemPrompt: options.systemPrompt } : undefined);
     }
     // ─── AgentRuntimeProcess.sendMessage() ─────────────────────────────────
-    async sendMessage(content, callbacks) {
+    async sendMessage(content, callbacks, options) {
         if (this.state === 'dead') {
             throw new Error('Process is dead');
         }
@@ -58,7 +61,7 @@ class CodexRuntimeProcess extends events_1.EventEmitter {
                     onError: callbacks.onError,
                 }
                 : undefined;
-            const result = await this.wrapper.prompt(content, codexCallbacks);
+            const result = await this.wrapper.prompt(content, codexCallbacks, options?.systemPrompt !== undefined ? { systemPrompt: options.systemPrompt } : undefined);
             const normalized = {
                 response: result.response,
                 usage: {

package/dist/multi-agent/runtime-process.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-process.js","sourceRoot":"","sources":["../../src/multi-agent/runtime-process.ts"],"names":[],"mappings":";;;AAAA,mCAAsC;AACtC,wEAIuC;AAgCvC;;;;;;GAMG;AACH,MAAa,mBAAoB,SAAQ,qBAAY;IAC1C,WAAW,GAAG,WAAoB,CAAC;IAEpC,OAAO,CAAkB;IACzB,KAAK,GAA6B,MAAM,CAAC;IACzC,sBAAsB,GAAG,KAAK,CAAC;IAEvC,2BAA2B;IACnB,aAAa,GAAG,CAAC,CAAC;IAClB,aAAa,GAAG,CAAC,CAAC;IAClB,eAAe,GAAG,CAAC,CAAC;IACpB,cAAc,GAAkB,IAAI,CAAC;IAE7C,YAAY,OAAmC;QAC7C,KAAK,EAAE,CAAC;QACR,MAAM,cAAc,GAAoB;YACtC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,aAAa,EAAE,6EAA6E;YAC5F,SAAS,EAAE,OAAO,CAAC,cAAc;SAClC,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,sCAAe,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC;IAED,0EAA0E;IAE1E,KAAK,CAAC,MAAM,CACV,OAAe,EACf,SAAiC,EACjC,QAAwB;QAExB,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,0EAA0E;IAE1E,KAAK,CAAC,WAAW,CACf,OAAe,EACf,SAAiC;QAEjC,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,cAAc,GAAqC,SAAS;gBAChE,CAAC,CAAC;oBACE,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;iBAC3B;gBACH,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAElE,MAAM,UAAU,GAAuB;gBACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK,EAAE;oBACL,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;oBACvC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;oBACzC,uBAAuB,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB;iBAC1D;gBACD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE;gBAC5D,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,KAAK;aAClB,CAAC;YAEF,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC/C,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1E,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC/C,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAE1E,YAAY,CAAC,EAAU;QACrB,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,eAAe,CAAC,MAAc;QAC5B,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,0EAA0E;IAE1E,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;IAC/B,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;IAC/B,CAAC;IAED,UAAU;QACR,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,YAAY,EACV,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;YACpF,aAAa,EAAE,IAAI,CAAC,cAAc;SACnC,CAAC;IACJ,CAAC;IAED,IAAI;QACF,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IACrC,CAAC;CACF;AAxID,kDAwIC"}
+{"version":3,"file":"runtime-process.js","sourceRoot":"","sources":["../../src/multi-agent/runtime-process.ts"],"names":[],"mappings":";;;AAAA,mCAAsC;AACtC,wEAIuC;AAgCvC;;;;;;GAMG;AACH,MAAa,mBAAoB,SAAQ,qBAAY;IAC1C,WAAW,GAAG,WAAoB,CAAC;IAEpC,OAAO,CAAkB;IACzB,KAAK,GAA6B,MAAM,CAAC;IACzC,sBAAsB,GAAG,KAAK,CAAC;IAEvC,2BAA2B;IACnB,aAAa,GAAG,CAAC,CAAC;IAClB,aAAa,GAAG,CAAC,CAAC;IAClB,eAAe,GAAG,CAAC,CAAC;IACpB,cAAc,GAAkB,IAAI,CAAC;IAE7C,YAAY,OAAmC;QAC7C,KAAK,EAAE,CAAC;QACR,MAAM,cAAc,GAAoB;YACtC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,aAAa,EAAE,6EAA6E;YAC5F,SAAS,EAAE,OAAO,CAAC,cAAc;SAClC,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,sCAAe,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC;IAED,0EAA0E;IAE1E,KAAK,CAAC,MAAM,CACV,OAAe,EACf,SAAiC,EACjC,OAAuB;QAEvB,wEAAwE;QACxE,2EAA2E;QAC3E,iFAAiF;QACjF,OAAO,IAAI,CAAC,WAAW,CACrB,OAAO,EACP,SAAS,EACT,OAAO,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CACzF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAE1E,KAAK,CAAC,WAAW,CACf,OAAe,EACf,SAAiC,EACjC,OAAmC;QAEnC,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,cAAc,GAAqC,SAAS;gBAChE,CAAC,CAAC;oBACE,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;iBAC3B;gBACH,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CACtC,OAAO,EACP,cAAc,EACd,OAAO,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CACzF,CAAC;YAEF,MAAM,UAAU,GAAuB;gBACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK,EAAE;oBACL,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;oBACvC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;oBACzC,uBAAuB,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB;iBAC1D;gBACD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE;gBAC5D,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,KAAK;aAClB,CAAC;YAEF,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC/C,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1E,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC/C,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAE1E,YAAY,CAAC,EAAU;QACrB,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,eAAe,CAAC,MAAc;QAC5B,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,0EAA0E;IAE1E,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;IAC/B,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;IAC/B,CAAC;IAED,UAAU;QACR,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,YAAY,EACV,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;YACpF,aAAa,EAAE,IAAI,CAAC,cAAc;SACnC,CAAC;IACJ,CAAC;IAED,IAAI;QACF,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IACrC,CAAC;CACF;AApJD,kDAoJC"}

package/dist/observability/code-audit.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Deterministic code-based system audit.
+ *
+ * Lands the 2026-04-22 owner decision (mama_conductor_audit_code_based_read_only):
+ * the hourly audit is fact collection and recording, executed by code - no LLM
+ * invocation, no auto-fix, no filesystem access beyond explicit read-only checks.
+ * The previous LLM audit loop once exfiltrated a credential when its report
+ * path failed; this module removes that class of failure structurally.
+ *
+ * Every check here is read-only and local. MAJOR findings are alerted through
+ * a caller-provided callback subject to the 24h dedup contract the checklist
+ * established (alert only NEW / ESCALATED / older-than-24h re-alerts). MINOR
+ * and INFO findings are recorded in the state file, never alerted.
+ */
+export type AuditSeverity = 'INFO' | 'MINOR' | 'MAJOR';
+export interface AuditFinding {
+    id: string;
+    severity: AuditSeverity;
+    summary: string;
+    detail?: string;
+}
+interface StoredFinding {
+    id: string;
+    severity: AuditSeverity;
+    summary?: string;
+    detail?: string;
+    first_seen: string;
+    last_seen: string;
+    last_alerted_at: string | null;
+}
+export interface AuditStateFile {
+    audit_date: string;
+    audit_timestamp: string;
+    checklist_version: string;
+    findings: StoredFinding[];
+    resolved_since_last_run: string[];
+    pass_items: string[];
+}
+export interface CodeAuditReport {
+    mode: 'code';
+    timestamp: string;
+    duration_ms: number;
+    findings: AuditFinding[];
+    pass_items: string[];
+    alerted: string[];
+    alert_delivery_failures: string[];
+    resolved_since_last_run: string[];
+}
+export type AuditAlertReason = 'new' | 'escalated' | 're-alert';
+export interface CodeAuditConfigView {
+    telegram?: {
+        enabled?: boolean;
+        allowed_chats?: string[];
+    };
+    multi_agent?: {
+        enabled?: boolean;
+        agents?: Record<string, {
+            persona_file?: string;
+            enabled?: boolean;
+        }>;
+    };
+}
+export interface CodeAuditOptions {
+    /** Base dir for ~/.mama files. Tests inject a temp dir. */
+    mamaDir?: string;
+    /** Findings/dedup state file. Default: <mamaDir>/state/audit-findings.json */
+    stateFilePath?: string;
+    /** Daemon log whose size is checked. Default: <mamaDir>/logs/daemon.log */
+    daemonLogPath?: string;
+    /** Local health endpoint. Default: http://127.0.0.1:3847/health. '' disables. */
+    healthUrl?: string;
+    /** Loaded runtime config (already-validated view). */
+    config?: CodeAuditConfigView;
+    /** True when a security alert sender is registered (checklist hygiene item). */
+    securityAlertConfigured?: boolean;
+    /** MAJOR-only alert callback, invoked per the 24h dedup contract. */
+    alert?: (finding: AuditFinding, reason: AuditAlertReason) => void | Promise<void>;
+    /** Injectable clock for tests. */
+    now?: () => Date;
+}
+export declare function runCodeAudit(options?: CodeAuditOptions): Promise<CodeAuditReport>;
+export {};
+//# sourceMappingURL=code-audit.d.ts.map

package/dist/observability/code-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-audit.d.ts","sourceRoot":"","sources":["../../src/observability/code-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,aAAa;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,uBAAuB,EAAE,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,WAAW,GAAG,UAAU,CAAC;AAEhE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC3D,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,YAAY,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KACvE,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,gFAAgF;IAChF,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qEAAqE;IACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAgKD,wBAAsB,YAAY,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuK3F"}

package/dist/observability/code-audit.js

@@ -0,0 +1,334 @@
+"use strict";
+/**
+ * Deterministic code-based system audit.
+ *
+ * Lands the 2026-04-22 owner decision (mama_conductor_audit_code_based_read_only):
+ * the hourly audit is fact collection and recording, executed by code - no LLM
+ * invocation, no auto-fix, no filesystem access beyond explicit read-only checks.
+ * The previous LLM audit loop once exfiltrated a credential when its report
+ * path failed; this module removes that class of failure structurally.
+ *
+ * Every check here is read-only and local. MAJOR findings are alerted through
+ * a caller-provided callback subject to the 24h dedup contract the checklist
+ * established (alert only NEW / ESCALATED / older-than-24h re-alerts). MINOR
+ * and INFO findings are recorded in the state file, never alerted.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCodeAudit = runCodeAudit;
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const yaml = __importStar(require("js-yaml"));
+const CHECKLIST_VERSION = 'code-2026-07-17';
+const REALERT_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const MEMORY_WAL_LIMIT = 10 * 1024 * 1024;
+const METRICS_WAL_LIMIT = 5 * 1024 * 1024;
+const DAEMON_LOG_LIMIT = 50 * 1024 * 1024;
+const SEVERITY_RANK = { INFO: 0, MINOR: 1, MAJOR: 2 };
+function fileSize(path) {
+    try {
+        return (0, node_fs_1.statSync)(path).size;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * First line of a parse error only, length-capped. js-yaml's YAMLException
+ * message embeds a source snippet of the malformed file; config files hold
+ * tokens, so the snippet must never travel into alert payloads.
+ */
+function sanitizeParseError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.split('\n')[0].slice(0, 200);
+}
+function checkParseable(path, kind, findings, passes) {
+    const name = (0, node_path_1.basename)(path);
+    if (!(0, node_fs_1.existsSync)(path)) {
+        passes.push(`${name}: absent (nothing to validate)`);
+        return;
+    }
+    try {
+        const raw = (0, node_fs_1.readFileSync)(path, 'utf8');
+        if (kind === 'yaml') {
+            yaml.load(raw);
+        }
+        else {
+            JSON.parse(raw);
+        }
+        passes.push(`${name}: valid ${kind.toUpperCase()}`);
+    }
+    catch (error) {
+        findings.push({
+            id: `config-parse-${name}`,
+            severity: 'MAJOR',
+            summary: `${name} is not valid ${kind.toUpperCase()}`,
+            detail: sanitizeParseError(error),
+        });
+    }
+}
+function checkFileSizeLimit(id, path, limit, severity, findings, passes) {
+    const size = fileSize(path);
+    const name = (0, node_path_1.basename)(path);
+    if (size === null) {
+        passes.push(`${name}: absent`);
+        return;
+    }
+    const mb = (size / 1024 / 1024).toFixed(1);
+    const limitMb = (limit / 1024 / 1024).toFixed(0);
+    if (size < limit) {
+        passes.push(`${name}: ${mb}MB < ${limitMb}MB limit`);
+    }
+    else {
+        findings.push({
+            id,
+            severity,
+            summary: `${name} is ${mb}MB (limit ${limitMb}MB)`,
+        });
+    }
+}
+async function checkHealthEndpoint(url, findings, passes) {
+    let outcome;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 3_000);
+    try {
+        const res = await fetch(url, { signal: controller.signal });
+        const body = await res.text();
+        let structurallyOk = false;
+        try {
+            const parsed = JSON.parse(body);
+            structurallyOk = parsed.status === 'ok';
+        }
+        catch {
+            structurallyOk = false;
+        }
+        outcome = {
+            ok: res.status === 200 && structurallyOk,
+            detail: `HTTP ${res.status} ${body.slice(0, 120)}`,
+        };
+    }
+    catch (error) {
+        const aborted = error instanceof Error && error.name === 'AbortError';
+        outcome = {
+            ok: false,
+            detail: aborted ? 'timeout after 3s' : error instanceof Error ? error.message : String(error),
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (outcome.ok) {
+        passes.push(`health endpoint: ${outcome.detail}`);
+    }
+    else {
+        findings.push({
+            id: 'health-endpoint',
+            severity: 'MAJOR',
+            summary: 'Local /health endpoint is not answering ok',
+            detail: outcome.detail,
+        });
+    }
+}
+function expandHome(p) {
+    return p.startsWith('~') ? (0, node_path_1.join)((0, node_os_1.homedir)(), p.slice(1)) : p;
+}
+async function readState(stateFilePath) {
+    let raw;
+    try {
+        raw = await (0, promises_1.readFile)(stateFilePath, 'utf8');
+    }
+    catch (error) {
+        // Missing file is the normal first run. Anything else (EACCES, EIO) is a
+        // real system problem: fail the audit run loudly instead of silently
+        // resetting dedup history - the subsequent state write would fail anyway.
+        if (error.code === 'ENOENT') {
+            return [];
+        }
+        throw error;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed.findings) ? parsed.findings : [];
+    }
+    catch (error) {
+        // Corrupt state is NOT silent: dedup history is lost, so every current
+        // MAJOR re-alerts as new. Over-alerting is the safe direction, but the
+        // owner must be able to see why.
+        console.warn(`[code-audit] audit state file is corrupt, resetting dedup history (${stateFilePath}): ${error instanceof Error ? error.message : String(error)}`);
+        return [];
+    }
+}
+async function runCodeAudit(options = {}) {
+    const startedAt = Date.now();
+    const now = options.now ? options.now() : new Date();
+    const nowIso = now.toISOString();
+    const mamaDir = options.mamaDir || (0, node_path_1.join)((0, node_os_1.homedir)(), '.mama');
+    const stateFilePath = options.stateFilePath || (0, node_path_1.join)(mamaDir, 'state', 'audit-findings.json');
+    const daemonLogPath = options.daemonLogPath || (0, node_path_1.join)(mamaDir, 'logs', 'daemon.log');
+    const healthUrl = options.healthUrl ?? 'http://127.0.0.1:3847/health';
+    const findings = [];
+    const passes = [];
+    // Config parse checks
+    checkParseable((0, node_path_1.join)(mamaDir, 'config.yaml'), 'yaml', findings, passes);
+    checkParseable((0, node_path_1.join)(mamaDir, 'config.json'), 'json', findings, passes);
+    checkParseable((0, node_path_1.join)(mamaDir, 'connectors.json'), 'json', findings, passes);
+    // Size limits
+    checkFileSizeLimit('memory-db-wal', (0, node_path_1.join)(mamaDir, 'mama-memory.db-wal'), MEMORY_WAL_LIMIT, 'MINOR', findings, passes);
+    checkFileSizeLimit('metrics-db-wal', (0, node_path_1.join)(mamaDir, 'mama-metrics.db-wal'), METRICS_WAL_LIMIT, 'MINOR', findings, passes);
+    checkFileSizeLimit('daemon-log-size', daemonLogPath, DAEMON_LOG_LIMIT, 'MINOR', findings, passes);
+    // Health endpoint (self-check through the real server socket)
+    if (healthUrl) {
+        await checkHealthEndpoint(healthUrl, findings, passes);
+    }
+    // Persona files referenced by multi-agent config
+    const agents = options.config?.multi_agent?.agents || {};
+    const multiAgentEnabled = options.config?.multi_agent?.enabled === true;
+    for (const [agentId, agent] of Object.entries(agents)) {
+        if (!agent?.persona_file) {
+            continue;
+        }
+        const personaPath = expandHome(agent.persona_file);
+        if ((0, node_fs_1.existsSync)(personaPath)) {
+            passes.push(`persona ${agentId}: file exists`);
+        }
+        else {
+            findings.push({
+                id: `persona-missing-${agentId}`,
+                severity: multiAgentEnabled ? 'MINOR' : 'INFO',
+                summary: `Persona file for agent "${agentId}" is missing`,
+                detail: personaPath,
+            });
+        }
+    }
+    // Security hygiene
+    if (options.securityAlertConfigured === false) {
+        findings.push({
+            id: 'security-alert-channel-missing',
+            severity: 'MINOR',
+            summary: 'No security alert channel configured (MAMA_SECURITY_ALERT_CHANNELS or gateway default)',
+        });
+    }
+    else if (options.securityAlertConfigured === true) {
+        passes.push('security alert channel configured');
+    }
+    const telegram = options.config?.telegram;
+    if (telegram?.enabled) {
+        if (Array.isArray(telegram.allowed_chats) && telegram.allowed_chats.length > 0) {
+            passes.push(`telegram inbound allowlist: ${telegram.allowed_chats.length} chat(s)`);
+        }
+        else {
+            findings.push({
+                id: 'telegram-open-inbound',
+                severity: 'MAJOR',
+                summary: 'Telegram gateway accepts messages from ANY chat (allowed_chats unset)',
+                detail: 'Set telegram.allowed_chats in config.yaml to the owner chat id(s).',
+            });
+        }
+    }
+    // Dedup + alert per the 24h contract
+    const previous = await readState(stateFilePath);
+    const previousById = new Map(previous.map((f) => [f.id, f]));
+    const alerted = [];
+    const alertDeliveryFailures = [];
+    const stored = [];
+    for (const finding of findings) {
+        const prior = previousById.get(finding.id);
+        const firstSeen = prior?.first_seen || nowIso;
+        let lastAlertedAt = prior?.last_alerted_at ?? null;
+        if (finding.severity === 'MAJOR') {
+            let reason = null;
+            if (!prior) {
+                reason = 'new';
+            }
+            else if (SEVERITY_RANK[finding.severity] > SEVERITY_RANK[prior.severity]) {
+                // Reachable across checklist_version upgrades: when a check's grading
+                // changes (e.g. a MINOR becomes MAJOR in a new release), the stored
+                // lower severity escalates and must alert immediately instead of
+                // waiting out a 24h window stamped under the old grading.
+                reason = 'escalated';
+            }
+            else if (!prior.last_alerted_at ||
+                now.getTime() - Date.parse(prior.last_alerted_at) >= REALERT_INTERVAL_MS) {
+                reason = 're-alert';
+            }
+            if (reason && options.alert) {
+                try {
+                    await options.alert(finding, reason);
+                    alerted.push(finding.id);
+                    lastAlertedAt = nowIso;
+                }
+                catch (error) {
+                    // Fail loud in the report; the finding stays un-alerted so the next
+                    // run retries instead of silently swallowing delivery failure.
+                    alertDeliveryFailures.push(`${finding.id}: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+        }
+        stored.push({
+            id: finding.id,
+            severity: finding.severity,
+            summary: finding.summary,
+            detail: finding.detail,
+            first_seen: firstSeen,
+            last_seen: nowIso,
+            last_alerted_at: lastAlertedAt,
+        });
+    }
+    const currentIds = new Set(findings.map((f) => f.id));
+    const resolved = previous.filter((f) => !currentIds.has(f.id)).map((f) => f.id);
+    const state = {
+        audit_date: nowIso.slice(0, 10),
+        audit_timestamp: nowIso,
+        checklist_version: CHECKLIST_VERSION,
+        findings: stored,
+        resolved_since_last_run: resolved,
+        pass_items: passes,
+    };
+    await (0, promises_1.mkdir)((0, node_path_1.dirname)(stateFilePath), { recursive: true });
+    await (0, promises_1.writeFile)(stateFilePath, `${JSON.stringify(state, null, 2)}\n`, 'utf8');
+    return {
+        mode: 'code',
+        timestamp: nowIso,
+        duration_ms: Date.now() - startedAt,
+        findings,
+        pass_items: passes,
+        alerted,
+        alert_delivery_failures: alertDeliveryFailures,
+        resolved_since_last_run: resolved,
+    };
+}
+//# sourceMappingURL=code-audit.js.map

package/dist/observability/code-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-audit.js","sourceRoot":"","sources":["../../src/observability/code-audit.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0OH,oCAuKC;AA/YD,qCAA6D;AAC7D,+CAA8D;AAC9D,qCAAkC;AAClC,yCAAoD;AACpD,8CAAgC;AAsEhC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAC5C,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,aAAa,GAAkC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAErF,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CACrB,IAAY,EACZ,IAAqB,EACrB,QAAwB,EACxB,MAAgB;IAEhB,MAAM,IAAI,GAAG,IAAA,oBAAQ,EAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,gBAAgB,IAAI,EAAE;YAC1B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,GAAG,IAAI,iBAAiB,IAAI,CAAC,WAAW,EAAE,EAAE;YACrD,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,EAAU,EACV,IAAY,EACZ,KAAa,EACb,QAAuB,EACvB,QAAwB,EACxB,MAAgB;IAEhB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAA,oBAAQ,EAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,EAAE,QAAQ,OAAO,UAAU,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE;YACF,QAAQ;YACR,OAAO,EAAE,GAAG,IAAI,OAAO,EAAE,aAAa,OAAO,KAAK;SACnD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAW,EACX,QAAwB,EACxB,MAAgB;IAEhB,IAAI,OAAwC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;YACxD,cAAc,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,GAAG,KAAK,CAAC;QACzB,CAAC;QACD,OAAO,GAAG;YACR,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,cAAc;YACxC,MAAM,EAAE,QAAQ,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACnD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;QACtE,OAAO,GAAG;YACR,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9F,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,iBAAiB;YACrB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,4CAA4C;YACrD,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,aAAqB;IAC5C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,qEAAqE;QACrE,0EAA0E;QAC1E,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmC,CAAC;QACjE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,uEAAuE;QACvE,iCAAiC;QACjC,OAAO,CAAC,IAAI,CACV,sEAAsE,aAAa,MACjF,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,UAA4B,EAAE;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAA,gBAAI,EAAC,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAC7F,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAA,gBAAI,EAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,8BAA8B,CAAC;IAEtE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,sBAAsB;IACtB,cAAc,CAAC,IAAA,gBAAI,EAAC,OAAO,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvE,cAAc,CAAC,IAAA,gBAAI,EAAC,OAAO,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvE,cAAc,CAAC,IAAA,gBAAI,EAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE3E,cAAc;IACd,kBAAkB,CAChB,eAAe,EACf,IAAA,gBAAI,EAAC,OAAO,EAAE,oBAAoB,CAAC,EACnC,gBAAgB,EAChB,OAAO,EACP,QAAQ,EACR,MAAM,CACP,CAAC;IACF,kBAAkB,CAChB,gBAAgB,EAChB,IAAA,gBAAI,EAAC,OAAO,EAAE,qBAAqB,CAAC,EACpC,iBAAiB,EACjB,OAAO,EACP,QAAQ,EACR,MAAM,CACP,CAAC;IACF,kBAAkB,CAAC,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAElG,8DAA8D;IAC9D,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,mBAAmB,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,iDAAiD;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC;IACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;IACxE,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,IAAA,oBAAU,EAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,OAAO,eAAe,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,mBAAmB,OAAO,EAAE;gBAChC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;gBAC9C,OAAO,EAAE,2BAA2B,OAAO,cAAc;gBACzD,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,IAAI,OAAO,CAAC,uBAAuB,KAAK,KAAK,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,gCAAgC;YACpC,QAAQ,EAAE,OAAO;YACjB,OAAO,EACL,wFAAwF;SAC3F,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,uBAAuB,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1C,IAAI,QAAQ,EAAE,OAAO,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC,+BAA+B,QAAQ,CAAC,aAAa,CAAC,MAAM,UAAU,CAAC,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,uBAAuB;gBAC3B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,uEAAuE;gBAChF,MAAM,EAAE,oEAAoE;aAC7E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,qBAAqB,GAAa,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAoB,EAAE,CAAC;IAEnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,KAAK,EAAE,UAAU,IAAI,MAAM,CAAC;QAC9C,IAAI,aAAa,GAAG,KAAK,EAAE,eAAe,IAAI,IAAI,CAAC;QAEnD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,MAAM,GAA4B,IAAI,CAAC;YAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,GAAG,KAAK,CAAC;YACjB,CAAC;iBAAM,IAAI,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3E,sEAAsE;gBACtE,oEAAoE;gBACpE,iEAAiE;gBACjE,0DAA0D;gBAC1D,MAAM,GAAG,WAAW,CAAC;YACvB,CAAC;iBAAM,IACL,CAAC,KAAK,CAAC,eAAe;gBACtB,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,mBAAmB,EACxE,CAAC;gBACD,MAAM,GAAG,UAAU,CAAC;YACtB,CAAC;YAED,IAAI,MAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBACrC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACzB,aAAa,GAAG,MAAM,CAAC;gBACzB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,oEAAoE;oBACpE,+DAA+D;oBAC/D,qBAAqB,CAAC,IAAI,CACxB,GAAG,OAAO,CAAC,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,MAAM;YACjB,eAAe,EAAE,aAAa;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEhF,MAAM,KAAK,GAAmB;QAC5B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/B,eAAe,EAAE,MAAM;QACvB,iBAAiB,EAAE,iBAAiB;QACpC,QAAQ,EAAE,MAAM;QAChB,uBAAuB,EAAE,QAAQ;QACjC,UAAU,EAAE,MAAM;KACnB,CAAC;IAEF,MAAM,IAAA,gBAAK,EAAC,IAAA,mBAAO,EAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,IAAA,oBAAS,EAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE9E,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,MAAM;QACjB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACnC,QAAQ;QACR,UAAU,EAAE,MAAM;QAClB,OAAO;QACP,uBAAuB,EAAE,qBAAqB;QAC9C,uBAAuB,EAAE,QAAQ;KAClC,CAAC;AACJ,CAAC"}

package/dist/operator/action-verifier.d.ts

@@ -0,0 +1,50 @@
+/**
+ * OperatorActionVerifier (M8 Phase 2) - verifies that a reconcile run actually
+ * performed its obligated action. Ports Kagemusha's ContractActionVerifier
+ * snapshot-diff mechanism, strengthened per plan review: signals must be BOUND
+ * to the run, not to unrelated board activity.
+ *
+ * Verified iff, after the run:
+ *  (a) a NEW gateway tool-call trace row exists (rowid past the snapshot)
+ *      whose normalized tool name is one of the obligated tools, or
+ *  (b) a NEW no-update note exists with EXACTLY this run's scope.
+ * Slot/ledger hash deltas are recorded as evidence detail only -- another
+ * writer may have moved them (the board-writer queue makes in-queue runs
+ * non-concurrent, which closes the remaining race).
+ *
+ * Observe, never block: the caller records the outcome and emits a notice;
+ * an unverified run is a loud signal, not a rejection.
+ */
+export declare const OBLIGATED_TOOLS: readonly ["report_publish", "task_create", "task_update", "contract_no_update"];
+export interface VerifierDeps {
+    /** Current report slots (id -> html). */
+    getSlots: () => Array<{
+        slotId: string;
+        html: string;
+    }>;
+    /** Stable hash of the task ledger payload. */
+    getLedgerHash: () => string;
+    /** Max no-update note id for a scope (0 when none). */
+    getScopedNoteMaxId: (scope: string) => number;
+    /**
+     * Count of gateway tool-call trace rows past a rowid whose normalized tool
+     * name is in OBLIGATED_TOOLS (bound to the reconcile agent).
+     */
+    countObligatedTraceRowsSince: (maxId: number) => number;
+    /** Max gateway trace rowid right now (0 when none). */
+    getTraceMaxId: () => number;
+}
+export interface ActionSnapshot {
+    slotHashes: Record<string, string>;
+    ledgerHash: string;
+    scopedNoteMaxId: number;
+    traceMaxId: number;
+}
+export interface VerifyResult {
+    verified: boolean;
+    /** Human-readable evidence lines for the activity record. */
+    effects: string[];
+}
+export declare function captureSnapshot(deps: VerifierDeps, scope: string): ActionSnapshot;
+export declare function verifyAfterRun(deps: VerifierDeps, before: ActionSnapshot, scope: string): VerifyResult;
+//# sourceMappingURL=action-verifier.d.ts.map

package/dist/operator/action-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-verifier.d.ts","sourceRoot":"","sources":["../../src/operator/action-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,eAAO,MAAM,eAAe,iFAKlB,CAAC;AAEX,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,QAAQ,EAAE,MAAM,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,8CAA8C;IAC9C,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,uDAAuD;IACvD,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C;;;OAGG;IACH,4BAA4B,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACxD,uDAAuD;IACvD,aAAa,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,CAWjF;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,GACZ,YAAY,CA+Bd"}

package/dist/operator/action-verifier.js

@@ -0,0 +1,68 @@
+"use strict";
+/**
+ * OperatorActionVerifier (M8 Phase 2) - verifies that a reconcile run actually
+ * performed its obligated action. Ports Kagemusha's ContractActionVerifier
+ * snapshot-diff mechanism, strengthened per plan review: signals must be BOUND
+ * to the run, not to unrelated board activity.
+ *
+ * Verified iff, after the run:
+ *  (a) a NEW gateway tool-call trace row exists (rowid past the snapshot)
+ *      whose normalized tool name is one of the obligated tools, or
+ *  (b) a NEW no-update note exists with EXACTLY this run's scope.
+ * Slot/ledger hash deltas are recorded as evidence detail only -- another
+ * writer may have moved them (the board-writer queue makes in-queue runs
+ * non-concurrent, which closes the remaining race).
+ *
+ * Observe, never block: the caller records the outcome and emits a notice;
+ * an unverified run is a loud signal, not a rejection.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OBLIGATED_TOOLS = void 0;
+exports.captureSnapshot = captureSnapshot;
+exports.verifyAfterRun = verifyAfterRun;
+const node_crypto_1 = require("node:crypto");
+exports.OBLIGATED_TOOLS = [
+    'report_publish',
+    'task_create',
+    'task_update',
+    'contract_no_update',
+];
+function captureSnapshot(deps, scope) {
+    const slotHashes = {};
+    for (const slot of deps.getSlots()) {
+        slotHashes[slot.slotId] = (0, node_crypto_1.createHash)('sha256').update(slot.html).digest('hex');
+    }
+    return {
+        slotHashes,
+        ledgerHash: deps.getLedgerHash(),
+        scopedNoteMaxId: deps.getScopedNoteMaxId(scope),
+        traceMaxId: deps.getTraceMaxId(),
+    };
+}
+function verifyAfterRun(deps, before, scope) {
+    const effects = [];
+    let verified = false;
+    // (a) run-bound signal: obligated gateway tool traces past the snapshot.
+    const obligatedTraces = deps.countObligatedTraceRowsSince(before.traceMaxId);
+    if (obligatedTraces > 0) {
+        verified = true;
+        effects.push(`obligated tool traces: ${obligatedTraces}`);
+    }
+    // (b) run-bound signal: a new no-update note with EXACTLY this scope.
+    const noteMaxNow = deps.getScopedNoteMaxId(scope);
+    if (noteMaxNow > before.scopedNoteMaxId) {
+        verified = true;
+        effects.push(`no-update note recorded (scope=${scope})`);
+    }
+    // Evidence detail only (NOT sufficient alone -- see module doc).
+    const after = captureSnapshot(deps, scope);
+    const changedSlots = Object.keys({ ...before.slotHashes, ...after.slotHashes }).filter((id) => before.slotHashes[id] !== after.slotHashes[id]);
+    if (changedSlots.length > 0) {
+        effects.push(`slots changed: ${changedSlots.join(', ')}`);
+    }
+    if (after.ledgerHash !== before.ledgerHash) {
+        effects.push('task ledger changed');
+    }
+    return { verified, effects };
+}
+//# sourceMappingURL=action-verifier.js.map

package/dist/operator/action-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-verifier.js","sourceRoot":"","sources":["../../src/operator/action-verifier.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAwCH,0CAWC;AAED,wCAmCC;AAtFD,6CAAyC;AAE5B,QAAA,eAAe,GAAG;IAC7B,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,oBAAoB;CACZ,CAAC;AA+BX,SAAgB,eAAe,CAAC,IAAkB,EAAE,KAAa;IAC/D,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,CAAC;IACD,OAAO;QACL,UAAU;QACV,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE;QAChC,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAC/C,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE;KACjC,CAAC;AACJ,CAAC;AAED,SAAgB,cAAc,CAC5B,IAAkB,EAClB,MAAsB,EACtB,KAAa;IAEb,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,yEAAyE;IACzE,MAAM,eAAe,GAAG,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7E,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,0BAA0B,eAAe,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,sEAAsE;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,UAAU,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACxC,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,kCAAkC,KAAK,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,iEAAiE;IACjE,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CACpF,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CACvD,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,kBAAkB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}