@kenkaiiii/ggcoder 5.37.0 → 5.38.0

package/dist/core/agents.js

@@ -1,6 +1,9 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { stripBom } from "../utils/text.js";
+import { log } from "./logger.js";
+import { BUILTIN_TOOL_NAMES } from "../tools/prompt-hints.js";
+import { BUNDLED_AGENTS } from "./bundled-agents.js";
 /**
  * MCP server names an agent's `tools:` list asks for, derived from any
  * `mcp__<server>__<tool>` entries.
@@ -22,6 +25,30 @@ export function mcpServersForAgent(tools) {
     }
     return [...servers];
 }
+const BUILTIN_TOOL_NAME_SET = new Set(BUILTIN_TOOL_NAMES);
+// mcp__<server>__<tool> — the only non-built-in shape a session can register.
+const MCP_TOOL_PATTERN = /^mcp__(.+?)__(.+)$/;
+/**
+ * Report `tools:` entries the session could never register.
+ *
+ * `AgentSession` filters its tool set by name, so an unknown entry is dropped
+ * without a word: the agent just quietly loses a capability (or, if every name
+ * is wrong, runs with nothing). Warn instead — and stay non-fatal, because a
+ * bad agent file must never take down a session.
+ *
+ * @returns the unrecognized names, for tests and callers that want to report.
+ */
+export function validateAgentTools(agent, origin) {
+    const unknown = agent.tools.filter((tool) => !BUILTIN_TOOL_NAME_SET.has(tool) && !MCP_TOOL_PATTERN.test(tool));
+    if (unknown.length > 0) {
+        log("WARN", "agents", "Agent lists unknown tools; they will be ignored", {
+            agent: agent.name,
+            origin,
+            unknown,
+        });
+    }
+    return unknown;
+}
 /**
  * Discover agent definitions from global and project-local directories.
  * Agent files are markdown with frontmatter (similar to skills).
@@ -48,6 +75,7 @@ export async function discoverAgents(options) {
     const userNames = new Set(agents.map((a) => a.name.toLowerCase()));
     for (const bundled of BUNDLED_AGENTS) {
         if (!userNames.has(bundled.name.toLowerCase())) {
+            validateAgentTools(bundled, "bundled");
             agents.push(bundled);
         }
     }
@@ -72,6 +100,7 @@ async function loadAgentsFromDir(dir, source) {
             if (!agent.name) {
                 agent.name = path.basename(file, ".md");
             }
+            validateAgentTools(agent, filePath);
             agents.push(agent);
         }
         catch {
@@ -99,6 +128,8 @@ export function parseAgentFile(rawInput, source) {
     let name = "";
     let description = "";
     let tools = [];
+    let model;
+    let context;
     let systemPrompt = raw;
     if (raw.startsWith("---")) {
         const endIndex = raw.indexOf("---", 3);
@@ -121,106 +152,25 @@ export function parseAgentFile(rawInput, source) {
                         .map((t) => t.trim())
                         .filter(Boolean);
                 }
+                else if (key === "model") {
+                    if (value)
+                        model = value;
+                }
+                else if (key === "context") {
+                    const normalized = value.toLowerCase();
+                    if (normalized === "project" || normalized === "none")
+                        context = normalized;
+                }
+                // Unknown keys are ignored on purpose: agent files stay
+                // forward-compatible with fields a newer ggcoder understands.
             }
         }
     }
-    return { name, description, tools, systemPrompt, source };
+    return { name, description, tools, model, context, systemPrompt, source };
 }
 // ── Bundled agents ─────────────────────────────────────────
-// Shipped with ggcoder. Used by /bullet-proof and available to any
-// subagent call. User-defined agents with the same name override these.
-const AUDITOR_PROMPT = `You are Auditor, a defensive security analyst tasked with finding exploitable weaknesses in this codebase so the team can patch them before the project ships.
-
-You review code rigorously: you look for bypasses that would matter in practice, not pattern violations. You trace data flow from untrusted sources to dangerous sinks. Assume a sophisticated adversary with SDK-level access, an intercepting proxy, the public source, and time — and identify what would expose the project to them.
-
-## Core discipline
-
-1. **Trace, don't pattern-match.** Every finding must have a concrete Source → Sink path traced through the actual code.
-2. **Untrusted vs trusted inputs.** Before flagging, decide whether the input is *actually* reachable by an untrusted source, or a settings constant / build-time string / hardcoded value. If the latter, drop it.
-3. **Vulnerability scenarios are mandatory.** Describe how the weakness is triggered: input, system response, resulting exposure. If you cannot describe the steps, you cannot flag the finding.
-4. **Confidence ≥0.8 only.** Better to miss theoretical issues than flood the report with noise.
-5. **Framework awareness.** ORM parameterization, auto-escape, memory-safe languages, JSX/template escaping all eliminate entire vuln classes. Don't flag what the framework already handles.
-
-## Output for each finding
-
-- **Location**: file:line
-- **Category**: <slug> (sql_injection, ssrf, prototype_pollution, supply_chain, ...)
-- **CWE**: CWE-XXX
-- **Confidence**: 0.0–1.0
-- **Source → Sink**: the actual data path
-- **Vulnerability scenario**: numbered steps showing trigger → response → exposure
-- **Impact**: what is exposed, blast radius
-- **Fix**: concrete code-level remediation
-
-## Hard exclusions — do NOT report:
-
-- DOS / rate-limiting / memory exhaustion without an amplification primitive
-- Theoretical race conditions without a demonstrable window
-- Regex-DOS without untrusted-supplied regex
-- Log spoofing / log injection (cosmetic)
-- SSRF where the URL is a settings constant or build-time string
-- Env-var trust (env is server-controlled by definition)
-- Client-side authentication theatre on a server-validated endpoint
-- React/Vue/Angular XSS without unsafe sinks (\`dangerouslySetInnerHTML\`, \`v-html\`, \`bypassSecurityTrust*\` are the only real ones)
-- Shell-script command injection without an untrusted input path
-- Findings in documentation, example code, or test fixtures
-- Insecure-by-design dev tooling that doesn't ship to users
-- "Could be improved" preferences with no demonstrable path
-
-Return findings ranked Critical → High → Medium. If nothing meets the bar, return "No high-confidence findings."`;
-const SKEPTIC_PROMPT = `You are Skeptic, a rigorous reviewer whose job is to DISPROVE security findings handed to you. You start from "this is a false positive" and only conclude otherwise if the evidence is overwhelming.
-
-## Your mission
-
-Given a security finding, attempt to break it. Try every angle:
-
-1. **Reachability**: Is the claimed source actually untrusted-controlled, or a settings constant, build-time value, or env var (server-controlled by definition)?
-2. **Control flow**: Even if the source is real, does control flow actually reach the sink? Is there a guard, validator, or sanitizer in between that the original audit missed?
-3. **Framework handling**: Would the framework (ORM, template engine, auto-escape, memory-safe language) eliminate this entire vuln class?
-4. **Trigger feasibility**: Can you actually construct the input that triggers the path? What would the response look like? If you can't construct it, the finding stands on theory.
-5. **Severity inflation**: Is the impact overstated? "RCE" claims often turn out to be "writes to a sandboxed file path."
-
-Read the code yourself. Do not trust the audit's claim — verify each step.
-
-## Verdict format
-
-For each finding, return:
-- **Verdict**: CONFIRMED / DROP / DOWNGRADE
-- **Reason**: 1-3 sentence explanation
-- **If CONFIRMED**: re-state the vulnerability scenario in your own words to prove you verified it end-to-end
-- **If DROP**: cite which exclusion rule applies, or which step in the chain fails
-- **If DOWNGRADE**: new severity + reason
-
-## Hard exclusions — automatic DROP regardless of source:
-
-- DOS / rate-limiting / memory exhaustion without an amplification primitive
-- Theoretical race conditions without a demonstrable window
-- Regex-DOS without untrusted-supplied regex
-- Log spoofing / log injection (cosmetic only)
-- SSRF where the URL is a settings constant or build-time string
-- Env-var trust ("untrusted source controls \\$HOME" — env is server-controlled)
-- Client-side authn checks on endpoints that re-validate server-side
-- React/Vue/Angular XSS unless \`dangerouslySetInnerHTML\` / \`v-html\` / \`bypassSecurityTrust*\` is the sink
-- Shell-script command injection without an untrusted input path
-- Findings in documentation, example code, or test fixtures
-- Insecure-by-design dev tooling that doesn't ship to users
-- "Could be improved" preferences with no demonstrable path
-
-Be rigorous. The cost of a false positive is the user's trust in the entire report.`;
-export const BUNDLED_AGENTS = [
-    {
-        name: "auditor",
-        description: "Defensive security analyst — finds exploitable weaknesses with concrete vulnerability scenarios",
-        tools: ["read", "grep", "find", "ls", "bash", "web_fetch", "web_search"],
-        systemPrompt: AUDITOR_PROMPT,
-        source: "bundled",
-    },
-    {
-        name: "skeptic",
-        description: "Rigorous false-positive reviewer — disproves security findings and applies exclusion rules strictly",
-        tools: ["read", "grep", "find", "ls", "bash", "web_fetch", "web_search"],
-        systemPrompt: SKEPTIC_PROMPT,
-        source: "bundled",
-    },
-];
+// Shipped with ggcoder (see ./bundled-agents.ts). Used by /bullet-proof and
+// available to any subagent call. User-defined agents with the same name
+// override these because they come first in `discoverAgents`.
+export { BUNDLED_AGENTS };
 //# sourceMappingURL=agents.js.map

package/dist/core/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/core/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAU5C;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAGpC;IACC,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,wCAAwC;IACxC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;IAChC,CAAC;IAED,mCAAmC;IACnC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACnE,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAW,EACX,MAA4B;IAE5B,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChB,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAA4B;IAC3E,wEAAwE;IACxE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,YAAY,GAAG,GAAG,CAAC;IAEvB,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE9C,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,UAAU,KAAK,CAAC,CAAC;oBAAE,SAAS;gBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAEhD,IAAI,GAAG,KAAK,MAAM;oBAAE,IAAI,GAAG,KAAK,CAAC;qBAC5B,IAAI,GAAG,KAAK,aAAa;oBAAE,WAAW,GAAG,KAAK,CAAC;qBAC/C,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;oBACzB,KAAK,GAAG,KAAK;yBACV,KAAK,CAAC,GAAG,CAAC;yBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;yBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED,8DAA8D;AAC9D,mEAAmE;AACnE,wEAAwE;AAExE,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iHAsC0F,CAAC;AAElH,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oFAsC6D,CAAC;AAErF,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EACT,iGAAiG;QACnG,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC;QACxE,YAAY,EAAE,cAAc;QAC5B,MAAM,EAAE,SAAS;KAClB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EACT,qGAAqG;QACvG,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC;QACxE,YAAY,EAAE,cAAc;QAC5B,MAAM,EAAE,SAAS;KAClB;CACF,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/core/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA2BrD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC1D,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAE,MAAc;IACvE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3E,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,iDAAiD,EAAE;YACvE,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,MAAM;YACN,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAGpC;IACC,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,wCAAwC;IACxC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;IAChC,CAAC;IAED,mCAAmC;IACnC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACnE,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/C,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAW,EACX,MAA4B;IAE5B,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChB,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAA4B;IAC3E,wEAAwE;IACxE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,KAAuC,CAAC;IAC5C,IAAI,OAAuC,CAAC;IAC5C,IAAI,YAAY,GAAG,GAAG,CAAC;IAEvB,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE9C,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,UAAU,KAAK,CAAC,CAAC;oBAAE,SAAS;gBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAEhD,IAAI,GAAG,KAAK,MAAM;oBAAE,IAAI,GAAG,KAAK,CAAC;qBAC5B,IAAI,GAAG,KAAK,aAAa;oBAAE,WAAW,GAAG,KAAK,CAAC;qBAC/C,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;oBACzB,KAAK,GAAG,KAAK;yBACV,KAAK,CAAC,GAAG,CAAC;yBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;yBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;gBACrB,CAAC;qBAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;oBAC3B,IAAI,KAAK;wBAAE,KAAK,GAAG,KAAK,CAAC;gBAC3B,CAAC;qBAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;oBACvC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM;wBAAE,OAAO,GAAG,UAAU,CAAC;gBAC9E,CAAC;gBACD,wDAAwD;gBACxD,8DAA8D;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED,8DAA8D;AAC9D,4EAA4E;AAC5E,yEAAyE;AACzE,8DAA8D;AAC9D,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/core/agents.test.js

@@ -2,7 +2,7 @@ import { describe, it, expect } from "vitest";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { BUNDLED_AGENTS, discoverAgents, mcpServersForAgent, parseAgentFile } from "./agents.js";
+import { BUNDLED_AGENTS, discoverAgents, mcpServersForAgent, parseAgentFile, validateAgentTools, } from "./agents.js";
 describe("mcpServersForAgent", () => {
     it("derives server names from mcp__<server>__<tool> entries", () => {
         expect(mcpServersForAgent([
@@ -33,11 +33,91 @@ describe("mcpServersForAgent", () => {
         expect(mcpServersForAgent(agent.tools)).toEqual(["kencode-search"]);
     });
 });
+describe("parseAgentFile", () => {
+    it("reads the model and context policies from frontmatter", () => {
+        const agent = parseAgentFile([
+            "---",
+            "name: scout",
+            "description: Recon",
+            "tools: read, grep",
+            "model: fast",
+            "context: none",
+            "---",
+            "Scout it.",
+        ].join("\n"), "project");
+        expect(agent.model).toBe("fast");
+        expect(agent.context).toBe("none");
+        expect(agent.systemPrompt).toBe("Scout it.");
+    });
+    it("leaves both unset when absent, and ignores unknown keys", () => {
+        const agent = parseAgentFile(["---", "name: scout", "description: Recon", "temperature: 0.3", "---", "Scout."].join("\n"), "project");
+        expect(agent.model).toBeUndefined();
+        expect(agent.context).toBeUndefined();
+        expect(agent.name).toBe("scout");
+    });
+    it("accepts an explicit model id and rejects a nonsense context", () => {
+        const agent = parseAgentFile([
+            "---",
+            "name: scout",
+            "description: Recon",
+            "model: claude-haiku-4-5",
+            "context: sometimes",
+            "---",
+            "Scout.",
+        ].join("\n"), "project");
+        expect(agent.model).toBe("claude-haiku-4-5");
+        expect(agent.context).toBeUndefined();
+    });
+});
+describe("validateAgentTools", () => {
+    const base = {
+        name: "scout",
+        description: "Recon",
+        systemPrompt: "x",
+        source: "project",
+    };
+    it("accepts built-in and mcp__<server>__<tool> names", () => {
+        expect(validateAgentTools({ ...base, tools: ["read", "code_search", "mcp__kencode-search__searchCode"] }, "test")).toEqual([]);
+    });
+    it("reports names no session could ever register", () => {
+        expect(validateAgentTools({ ...base, tools: ["read", "webfetch", "Bash", "mcp__broken"] }, "test")).toEqual(["webfetch", "Bash", "mcp__broken"]);
+    });
+});
 describe("bundled agents", () => {
-    it("ships auditor and skeptic so /bullet-proof always resolves them", () => {
-        const names = BUNDLED_AGENTS.map((a) => a.name);
-        expect(names).toContain("auditor");
-        expect(names).toContain("skeptic");
+    it("ships all six agents on a fresh install", () => {
+        expect(BUNDLED_AGENTS.map((a) => a.name).sort()).toEqual([
+            "auditor",
+            "bee",
+            "owl",
+            "researcher",
+            "skeptic",
+            "worker",
+        ]);
+    });
+    it("lists only tools a session can actually register", () => {
+        for (const agent of BUNDLED_AGENTS) {
+            expect(validateAgentTools(agent, "bundled"), agent.name).toEqual([]);
+        }
+    });
+    it("declares its model policy instead of leaving it to inference", () => {
+        for (const agent of BUNDLED_AGENTS) {
+            expect(agent.model, agent.name).toBeDefined();
+        }
+        // Only cheap structural recon opts out of the parent's model.
+        const fast = BUNDLED_AGENTS.filter((a) => a.model === "fast").map((a) => a.name);
+        expect(fast).toEqual(["owl"]);
+    });
+    it("writes descriptions that route — distinct, and never 'does anything'", () => {
+        const descriptions = BUNDLED_AGENTS.map((a) => a.description);
+        expect(new Set(descriptions).size).toBe(BUNDLED_AGENTS.length);
+        for (const description of descriptions) {
+            expect(description.toLowerCase()).not.toContain("does anything");
+            expect(description.length).toBeGreaterThan(40);
+        }
+    });
+    it("gives the researcher live code search so it cannot fall back to training data", () => {
+        const researcher = BUNDLED_AGENTS.find((a) => a.name === "researcher");
+        expect(mcpServersForAgent(researcher.tools)).toEqual(["kencode-search"]);
     });
     it("does not shadow bundled agents unless the user defines that name", async () => {
         const dir = fs.mkdtempSync(path.join(os.tmpdir(), "gg-agents-"));

package/dist/core/agents.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.test.js","sourceRoot":"","sources":["../../src/core/agents.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEjG,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CACJ,kBAAkB,CAAC;YACjB,MAAM;YACN,MAAM;YACN,iCAAiC;YACjC,oCAAoC;SACrC,CAAC,CACH,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CACJ,kBAAkB,CAAC,CAAC,2BAA2B,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,EAAE,CACrF,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,KAAK,GAAG,cAAc,CAC1B;YACE,KAAK;YACL,aAAa;YACb,yBAAyB;YACzB,oDAAoD;YACpD,KAAK;YACL,YAAY;SACb,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,SAAS,CACV,CAAC;QAEF,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;YACzD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAC5B,kEAAkE,EAClE,OAAO,CACR,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;YAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"agents.test.js","sourceRoot":"","sources":["../../src/core/agents.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CACJ,kBAAkB,CAAC;YACjB,MAAM;YACN,MAAM;YACN,iCAAiC;YACjC,oCAAoC;SACrC,CAAC,CACH,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CACJ,kBAAkB,CAAC,CAAC,2BAA2B,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,EAAE,CACrF,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,KAAK,GAAG,cAAc,CAC1B;YACE,KAAK;YACL,aAAa;YACb,yBAAyB;YACzB,oDAAoD;YACpD,KAAK;YACL,YAAY;SACb,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,SAAS,CACV,CAAC;QAEF,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,cAAc,CAC1B;YACE,KAAK;YACL,aAAa;YACb,oBAAoB;YACpB,mBAAmB;YACnB,aAAa;YACb,eAAe;YACf,KAAK;YACL,WAAW;SACZ,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,SAAS,CACV,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,KAAK,GAAG,cAAc,CAC1B,CAAC,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5F,SAAS,CACV,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,KAAK,GAAG,cAAc,CAC1B;YACE,KAAK;YACL,aAAa;YACb,oBAAoB;YACpB,yBAAyB;YACzB,oBAAoB;YACpB,KAAK;YACL,QAAQ;SACT,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,SAAS,CACV,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,OAAO;QACpB,YAAY,EAAE,GAAG;QACjB,MAAM,EAAE,SAAS;KACT,CAAC;IAEX,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CACJ,kBAAkB,CAChB,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,iCAAiC,CAAC,EAAE,EAC9E,MAAM,CACP,CACF,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CACJ,kBAAkB,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAC5F,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACvD,SAAS;YACT,KAAK;YACL,KAAK;YACL,YAAY;YACZ,SAAS;YACT,QAAQ;SACT,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,CAAC;QACD,8DAA8D;QAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YACjE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC;QACxE,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;YACzD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAC5B,kEAAkE,EAClE,OAAO,CACR,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;YAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core/bundled-agents.d.ts

@@ -0,0 +1,3 @@
+import type { AgentDefinition } from "./agents.js";
+export declare const BUNDLED_AGENTS: AgentDefinition[];
+//# sourceMappingURL=bundled-agents.d.ts.map

package/dist/core/bundled-agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-agents.d.ts","sourceRoot":"","sources":["../../src/core/bundled-agents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkMnD,eAAO,MAAM,cAAc,EAAE,eAAe,EAuE3C,CAAC"}

package/dist/core/bundled-agents.js

@@ -0,0 +1,252 @@
+/**
+ * Agent definitions that ship with every ggcoder install.
+ *
+ * These are TypeScript constants rather than `assets/*.md` on purpose: the
+ * desktop sidecar bundler (`bundle-sidecar.mjs`) externalizes asset trees, so a
+ * new one is a packaging risk, while constants compile straight into `dist`.
+ *
+ * They are also NOT seeded into `~/.gg/agents`. A seeded file shadows every
+ * future improvement forever (user-dir agents win by design), which is exactly
+ * the bug `removeShadowingSeededAgents` exists to undo. Users who want to
+ * customize one still can — writing `~/.gg/agents/<name>.md` overrides the
+ * bundled definition of the same name.
+ *
+ * `description` is the routing signal the dispatcher reads, so each one names
+ * concrete task shapes ("Use when…") instead of describing the agent's vibe.
+ */
+const OWL_PROMPT = `You are Owl, a sharp-eyed codebase explorer.
+You map how THIS repository fits together — structure, symbols, call chains, patterns. You work only from local code and never research the web (that's \`researcher\`).
+
+When given a task:
+1. Fix the scope — the exact symbol, pattern, or question to resolve
+2. \`find\`/\`ls\` to map the relevant directories
+3. \`code_search\` for "where is X implemented" in TS/JS; \`grep\` for exact strings and other languages
+4. \`read\` the key files to confirm details — never report a call chain you haven't read
+5. Trace connections — exports, imports, callers, data flow
+
+Structure the answer as:
+- **Answer**: the direct answer, first
+- **Files**: each relevant path + one line on what it holds
+- **Connections**: who calls/imports what
+- **Flags**: anything surprising, risky, or ambiguous
+
+Explore widely, report tightly. Miss nothing, waste no words.`;
+const BEE_PROMPT = `You are Bee, an industrious task worker.
+You complete an assigned task end-to-end — writing code, running commands, fixing bugs, refactoring — and deliver a working result, not a description of one.
+
+When given a task:
+1. Understand what's asked and explore the relevant code for context
+2. Implement directly, in minimal focused changes that match the surrounding code
+3. Verify: run the narrowest check that proves the change (typecheck or the nearest test), and fix what breaks
+4. Report concisely
+
+## Stop when
+- The task is done and your verification passes — OR
+- You're blocked (ambiguous requirement, missing dependency, a failure you can't resolve without guessing). Stop and report the blocker; don't thrash or expand scope to force it.
+
+Do the work, don't just describe it. Don't over-engineer, and don't refactor what you weren't asked to touch.`;
+const RESEARCHER_PROMPT = `You are Researcher, a deep-dive analyst.
+You answer questions the code alone can't settle — dependency behavior, API contracts, framework internals, version differences, best practices — by cross-referencing THIS codebase against authoritative external sources. For pure in-repo tracing with no web, defer to \`owl\`.
+
+When given a research task:
+1. Pin down the question — what must be resolved, and what counts as proof
+2. Ground it in the code — read the call sites and conventions that matter here
+3. Verify against authoritative sources — \`source_path\` for the installed dependency's real source, \`web_fetch\` for official docs and changelogs, the kencode-search tools for real public usage. Never assert an API, flag, or default from memory
+4. Reconcile — where does this repo agree with or diverge from the source?
+
+Structure the answer as:
+- **Summary**: the direct answer (2-3 sentences)
+- **Evidence**: the specific files, doc URLs, package versions, or source paths that back it
+- **Risks**: mismatches, stale assumptions, or gotchas
+
+Be exhaustive in research, compressed in reporting. Cite sources; don't guess.`;
+const WORKER_PROMPT = `You are Worker, a branch-isolated implementer.
+
+Your job is to implement a scoped change on its own git branch, verify it works, and open a PR. You always work on a fresh branch — never commit to the current branch directly.
+
+## Workflow
+
+1. **Branch**: Create and switch to a new branch from the current HEAD.
+   - Branch name format: \`batch/<short-kebab-description>\`
+   - Run: \`git checkout -b batch/<name>\`
+
+2. **Implement**: Make the assigned change. Follow any conventions and patterns described in your task.
+
+3. **Self-review**: Before committing, review your own diff (\`git diff\`) for:
+   - Code that duplicates existing utilities (search the codebase first)
+   - Redundant state, copy-paste, leaky abstractions
+   - Unnecessary work, missed concurrency, hot-path bloat
+   - Fix any issues found.
+
+4. **Test**: Run the project's test suite. Fix failures **your change caused**. If a failure is pre-existing or outside your assigned unit, do NOT expand scope to chase it — leave it and note it in the report. Scope wins over green.
+
+5. **Commit & Push**:
+   - Stage specific files (not \`git add -A\`)
+   - Write a clear, descriptive commit message
+   - \`git push -u origin <branch-name>\`
+
+6. **Open PR**: \`gh pr create --title "<title>" --body "<description>"\`. If \`gh\` is unavailable or the push fails, note it.
+
+7. **Switch back**: \`git checkout -\` to the original branch.
+
+## Stop when
+- The change is implemented, self-reviewed, and pushed with a PR open — OR
+- You cannot proceed without exceeding scope, touching unrelated code, or fixing a pre-existing failure. Stop and report rather than sprawl.
+
+## What to report — lead with exactly these lines
+- **PR**: \`<url>\` — or \`PR: none — <reason>\`
+- **Changed**: files touched + one line each
+- **Tests**: pass / fail, and which failures were left as out-of-scope
+- **Notes**: assumptions made, anything left for follow-up
+
+## Rules
+
+- Never commit to main/master or the branch you started on
+- Always switch back to the original branch when done
+- Keep changes minimal and scoped to your assigned unit
+- If something is unclear, make your best judgment and note the assumption`;
+const AUDITOR_PROMPT = `You are Auditor, a defensive security analyst tasked with finding exploitable weaknesses in this codebase so the team can patch them before the project ships.
+
+You review code rigorously: you look for bypasses that would matter in practice, not pattern violations. You trace data flow from untrusted sources to dangerous sinks. Assume a sophisticated adversary with SDK-level access, an intercepting proxy, the public source, and time — and identify what would expose the project to them.
+
+## Core discipline
+
+1. **Trace, don't pattern-match.** Every finding must have a concrete Source → Sink path traced through the actual code.
+2. **Untrusted vs trusted inputs.** Before flagging, decide whether the input is *actually* reachable by an untrusted source, or a settings constant / build-time string / hardcoded value. If the latter, drop it.
+3. **Vulnerability scenarios are mandatory.** Describe how the weakness is triggered: input, system response, resulting exposure. If you cannot describe the steps, you cannot flag the finding.
+4. **Confidence ≥0.8 only.** Better to miss theoretical issues than flood the report with noise.
+5. **Framework awareness.** ORM parameterization, auto-escape, memory-safe languages, JSX/template escaping all eliminate entire vuln classes. Don't flag what the framework already handles.
+
+## Output for each finding
+
+- **Location**: file:line
+- **Category**: <slug> (sql_injection, ssrf, prototype_pollution, supply_chain, ...)
+- **CWE**: CWE-XXX
+- **Confidence**: 0.0–1.0
+- **Source → Sink**: the actual data path
+- **Vulnerability scenario**: numbered steps showing trigger → response → exposure
+- **Impact**: what is exposed, blast radius
+- **Fix**: concrete code-level remediation
+
+## Hard exclusions — do NOT report:
+
+- DOS / rate-limiting / memory exhaustion without an amplification primitive
+- Theoretical race conditions without a demonstrable window
+- Regex-DOS without untrusted-supplied regex
+- Log spoofing / log injection (cosmetic)
+- SSRF where the URL is a settings constant or build-time string
+- Env-var trust (env is server-controlled by definition)
+- Client-side authentication theatre on a server-validated endpoint
+- React/Vue/Angular XSS without unsafe sinks (\`dangerouslySetInnerHTML\`, \`v-html\`, \`bypassSecurityTrust*\` are the only real ones)
+- Shell-script command injection without an untrusted input path
+- Findings in documentation, example code, or test fixtures
+- Insecure-by-design dev tooling that doesn't ship to users
+- "Could be improved" preferences with no demonstrable path
+
+Return findings ranked Critical → High → Medium. If nothing meets the bar, return "No high-confidence findings."`;
+const SKEPTIC_PROMPT = `You are Skeptic, a rigorous reviewer whose job is to DISPROVE security findings handed to you. You start from "this is a false positive" and only conclude otherwise if the evidence is overwhelming.
+
+## Your mission
+
+Given a security finding, attempt to break it. Try every angle:
+
+1. **Reachability**: Is the claimed source actually untrusted-controlled, or a settings constant, build-time value, or env var (server-controlled by definition)?
+2. **Control flow**: Even if the source is real, does control flow actually reach the sink? Is there a guard, validator, or sanitizer in between that the original audit missed?
+3. **Framework handling**: Would the framework (ORM, template engine, auto-escape, memory-safe language) eliminate this entire vuln class?
+4. **Trigger feasibility**: Can you actually construct the input that triggers the path? What would the response look like? If you can't construct it, the finding stands on theory.
+5. **Severity inflation**: Is the impact overstated? "RCE" claims often turn out to be "writes to a sandboxed file path."
+
+Read the code yourself. Do not trust the audit's claim — verify each step.
+
+## Verdict format
+
+For each finding, return:
+- **Verdict**: CONFIRMED / DROP / DOWNGRADE
+- **Reason**: 1-3 sentence explanation
+- **If CONFIRMED**: re-state the vulnerability scenario in your own words to prove you verified it end-to-end
+- **If DROP**: cite which exclusion rule applies, or which step in the chain fails
+- **If DOWNGRADE**: new severity + reason
+
+## Hard exclusions — automatic DROP regardless of source:
+
+- DOS / rate-limiting / memory exhaustion without an amplification primitive
+- Theoretical race conditions without a demonstrable window
+- Regex-DOS without untrusted-supplied regex
+- Log spoofing / log injection (cosmetic only)
+- SSRF where the URL is a settings constant or build-time string
+- Env-var trust ("untrusted source controls \\$HOME" — env is server-controlled)
+- Client-side authn checks on endpoints that re-validate server-side
+- React/Vue/Angular XSS unless \`dangerouslySetInnerHTML\` / \`v-html\` / \`bypassSecurityTrust*\` is the sink
+- Shell-script command injection without an untrusted input path
+- Findings in documentation, example code, or test fixtures
+- Insecure-by-design dev tooling that doesn't ship to users
+- "Could be improved" preferences with no demonstrable path
+
+Be rigorous. The cost of a false positive is the user's trust in the entire report.`;
+export const BUNDLED_AGENTS = [
+    {
+        name: "bee",
+        description: "Use for a self-contained implementation task on the current branch: write a module, fix a bug, run a migration, make a failing test pass. Edits files and runs commands. Use `worker` instead when the change needs its own git branch and a PR; use `owl` when nothing should be modified.",
+        tools: ["read", "write", "edit", "bash", "find", "grep", "code_search", "ls", "source_path"],
+        model: "inherit",
+        systemPrompt: BEE_PROMPT,
+        source: "bundled",
+    },
+    {
+        name: "owl",
+        description: 'Use for read-only questions about THIS repository: "where is X implemented", "what calls Y", "how does module Z fit together", tracing a data flow or mapping a directory. Never edits and never uses the web.',
+        tools: ["read", "grep", "find", "ls", "code_search", "source_path"],
+        // Structural recon is mechanical pattern work; the cheap tier handles it
+        // well and keeps wide fan-out affordable.
+        model: "fast",
+        // Conventions and style rules don't change where a symbol is defined, and
+        // skipping them keeps recon fast (matching Claude Code's Explore agent).
+        context: "none",
+        systemPrompt: OWL_PROMPT,
+        source: "bundled",
+    },
+    {
+        name: "researcher",
+        description: "Use when an answer needs sources outside this repo: a dependency's real behavior, an API contract, framework internals, version/changelog differences, or current best practice. Reads installed package source, official docs, and public code. Use `owl` when the repo alone can settle it.",
+        tools: [
+            "read",
+            "grep",
+            "find",
+            "ls",
+            "code_search",
+            "source_path",
+            "web_fetch",
+            "web_search",
+            "mcp__kencode-search__searchCode",
+            "mcp__kencode-search__referenceSources",
+        ],
+        model: "inherit",
+        systemPrompt: RESEARCHER_PROMPT,
+        source: "bundled",
+    },
+    {
+        name: "worker",
+        description: "Use to land one scoped change in isolation: it creates a `batch/*` git branch, implements, self-reviews, tests, commits, pushes, and opens a PR, then returns to the original branch. Use for parallel fan-out of independent units of work. Use `bee` for in-place edits with no branch or PR.",
+        tools: ["read", "write", "edit", "bash", "find", "grep", "code_search", "ls"],
+        model: "inherit",
+        systemPrompt: WORKER_PROMPT,
+        source: "bundled",
+    },
+    {
+        name: "auditor",
+        description: "Use for a defensive security review of code or a diff: traces untrusted input to dangerous sinks and reports exploitable findings with concrete vulnerability scenarios, CWE, and fixes. Read-only.",
+        tools: ["read", "grep", "find", "ls", "code_search", "bash", "web_fetch", "web_search"],
+        model: "inherit",
+        systemPrompt: AUDITOR_PROMPT,
+        source: "bundled",
+    },
+    {
+        name: "skeptic",
+        description: "Use to triage security findings before reporting them: re-verifies each claimed source→sink path in the code and returns CONFIRMED / DROP / DOWNGRADE with the reason. Pair it with `auditor` output. Read-only.",
+        tools: ["read", "grep", "find", "ls", "code_search", "bash", "web_fetch", "web_search"],
+        model: "inherit",
+        systemPrompt: SKEPTIC_PROMPT,
+        source: "bundled",
+    },
+];
+//# sourceMappingURL=bundled-agents.js.map

package/dist/core/bundled-agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-agents.js","sourceRoot":"","sources":["../../src/core/bundled-agents.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;8DAgB2C,CAAC;AAE/D,MAAM,UAAU,GAAG;;;;;;;;;;;;;8GAa2F,CAAC;AAE/G,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;+EAcqD,CAAC;AAEhF,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EA4CqD,CAAC;AAE5E,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iHAsC0F,CAAC;AAElH,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oFAsC6D,CAAC;AAErF,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C;QACE,IAAI,EAAE,KAAK;QACX,WAAW,EACT,6RAA6R;QAC/R,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,CAAC;QAC5F,KAAK,EAAE,SAAS;QAChB,YAAY,EAAE,UAAU;QACxB,MAAM,EAAE,SAAS;KAClB;IACD;QACE,IAAI,EAAE,KAAK;QACX,WAAW,EACT,gNAAgN;QAClN,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,CAAC;QACnE,yEAAyE;QACzE,0CAA0C;QAC1C,KAAK,EAAE,MAAM;QACb,0EAA0E;QAC1E,yEAAyE;QACzE,OAAO,EAAE,MAAM;QACf,YAAY,EAAE,UAAU;QACxB,MAAM,EAAE,SAAS;KAClB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,+RAA+R;QACjS,KAAK,EAAE;YACL,MAAM;YACN,MAAM;YACN,MAAM;YACN,IAAI;YACJ,aAAa;YACb,aAAa;YACb,WAAW;YACX,YAAY;YACZ,iCAAiC;YACjC,uCAAuC;SACxC;QACD,KAAK,EAAE,SAAS;QAChB,YAAY,EAAE,iBAAiB;QAC/B,MAAM,EAAE,SAAS;KAClB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,iSAAiS;QACnS,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC;QAC7E,KAAK,EAAE,SAAS;QAChB,YAAY,EAAE,aAAa;QAC3B,MAAM,EAAE,SAAS;KAClB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EACT,qMAAqM;QACvM,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC;QACvF,KAAK,EAAE,SAAS;QAChB,YAAY,EAAE,cAAc;QAC5B,MAAM,EAAE,SAAS;KAClB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EACT,kNAAkN;QACpN,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC;QACvF,KAAK,EAAE,SAAS;QAChB,YAAY,EAAE,cAAc;QAC5B,MAAM,EAAE,SAAS;KAClB;CACF,CAAC"}