@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/cli/doctor/rogue-ledger.js

@@ -1,153 +0,0 @@
-// Detect leftover rogue evidence-ledger DBs from the literal-tilde
-// `EVIDENCE_LEDGER_DB` env leak (root cause + fix: agent-tasks/42d224a6,
-// harness PR #101). The env block expanded `~/.evidence-ledger/ledger.db`
-// as a literal directory name relative to the grounding-mcp cwd, so
-// every spawn cwd grew a sibling `~/.evidence-ledger/ledger.db` tree.
-//
-// The fix removed the env block, so no new rogue DBs appear. The existing
-// ones on disk are harmless orphans, but they take up space and confuse
-// forensics ("why do I have three identical-shape ledger DBs?"). This
-// scan flags them so the operator can `rm -rf` at their convenience.
-//
-// Scan scope is bounded by design: the literal `~` directory only ever
-// appears one level deep under wherever grounding-mcp was spawned. The
-// well-known spawn-cwd locations are: $HOME (when claude-code spawns from
-// the user's home), $HOME/git/<repo> (the per-repo working tree), and
-// $PWD (whatever directory the operator invoked harness from). No
-// recursion past one level: we are not a generic disk-cleanup tool.
-import * as fs from "node:fs";
-import * as path from "node:path";
-import * as readline from "node:readline/promises";
-const ROGUE_DIRNAME = "~";
-const LEDGER_RELPATH = path.join(".evidence-ledger", "ledger.db");
-function hasRogueLedgerUnder(parent, fsi) {
-    // lstat (not stat) the `~` dir: a symlink at <parent>/~ pointing at
-    // /etc or at the real ~/.evidence-ledger would otherwise yield a
-    // false-positive flag (read-only, no security impact, but the
-    // operator gets nudged to rm -rf an arbitrary target). The orphan
-    // pattern we care about is a *real* literal-tilde directory.
-    const rogueDir = path.join(parent, ROGUE_DIRNAME);
-    if (!fsi.existsSync(rogueDir))
-        return null;
-    try {
-        if (fsi.lstatSync(rogueDir).isSymbolicLink())
-            return null;
-    }
-    catch {
-        return null;
-    }
-    const candidate = path.join(rogueDir, LEDGER_RELPATH);
-    if (!fsi.existsSync(candidate))
-        return null;
-    try {
-        if (!fsi.statSync(candidate).isFile())
-            return null;
-    }
-    catch {
-        return null;
-    }
-    return { path: candidate, rogueDir };
-}
-/**
- * Dedup key for a hit: prefer the realpath of the ledger.db file so two
- * parent dirs that symlink to the same physical location collapse into a
- * single hit. Falls back to the joined path when realpath is unavailable
- * (EACCES on a strict-mode mount, ENOENT during a race with deletion).
- * The fallback preserves the v1 dedup behavior so existing fixtures
- * stay stable.
- */
-function dedupKey(hit, fsi) {
-    try {
-        return fsi.realpathSync(hit.path);
-    }
-    catch {
-        return hit.path;
-    }
-}
-/**
- * Walk a small set of well-known parent directories for a literal `~`
- * subdirectory that contains `.evidence-ledger/ledger.db`. Best-effort:
- * unreadable directories are silently skipped. Returns deduplicated
- * results (by realpath) sorted by path for stable rendering.
- */
-export function scanForRogueLedgers(opts) {
-    const fsi = opts.fsInterface ?? fs;
-    const seen = new Set();
-    const out = [];
-    const consider = (parent) => {
-        const hit = hasRogueLedgerUnder(parent, fsi);
-        if (!hit)
-            return;
-        const key = dedupKey(hit, fsi);
-        if (seen.has(key))
-            return;
-        seen.add(key);
-        out.push(hit);
-    };
-    consider(opts.homeDir);
-    consider(opts.cwd);
-    const gitParent = path.join(opts.homeDir, "git");
-    if (fsi.existsSync(gitParent)) {
-        let entries = [];
-        try {
-            entries = fsi.readdirSync(gitParent, { withFileTypes: true });
-        }
-        catch {
-            entries = [];
-        }
-        for (const e of entries) {
-            if (!e.isDirectory())
-                continue;
-            consider(path.join(gitParent, e.name));
-        }
-    }
-    out.sort((a, b) => a.path.localeCompare(b.path));
-    return out;
-}
-/**
- * Delete confirmed rogue ledger directories.
- *
- * Safety invariant: only deletes `hit.rogueDir` (the literal-tilde `~`
- * directory), never its parent. Any hit whose rogueDir basename is not
- * exactly `~` is silently skipped as a belt-and-suspenders guard.
- */
-export async function deleteRogueLedgers(hits, opts = {}) {
-    const deleted = [];
-    const skipped = [];
-    for (const hit of hits) {
-        // Safety: only ever remove a directory whose basename is the literal `~`.
-        if (path.basename(hit.rogueDir) !== "~") {
-            skipped.push(hit);
-            continue;
-        }
-        let confirmed;
-        if (opts.yes) {
-            confirmed = true;
-        }
-        else if (opts.promptFn) {
-            confirmed = await opts.promptFn(hit.rogueDir);
-        }
-        else {
-            confirmed = await defaultDeletePrompt(hit.rogueDir);
-        }
-        if (confirmed) {
-            fs.rmSync(hit.rogueDir, { recursive: true, force: true });
-            deleted.push(hit);
-        }
-        else {
-            skipped.push(hit);
-        }
-    }
-    return { deleted, skipped };
-}
-async function defaultDeletePrompt(rogueDir) {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
-    try {
-        const answer = await rl.question(`Delete rogue directory ${rogueDir}? (y/N) `);
-        return answer.trim().toLowerCase() === "y";
-    }
-    finally {
-        rl.close();
-    }
-}
-//# sourceMappingURL=rogue-ledger.js.map

package/dist/cli/doctor/rogue-ledger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rogue-ledger.js","sourceRoot":"","sources":["../../../src/cli/doctor/rogue-ledger.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,yEAAyE;AACzE,0EAA0E;AAC1E,oEAAoE;AACpE,sEAAsE;AACtE,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,0EAA0E;AAC1E,sEAAsE;AACtE,kEAAkE;AAClE,oEAAoE;AAEpE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AAqBnD,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;AAElE,SAAS,mBAAmB,CAC1B,MAAc,EACd,GAAuD;IAEvD,oEAAoE;IACpE,iEAAiE;IACjE,8DAA8D;IAC9D,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE;YAAE,OAAO,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACtD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CACf,GAAkB,EAClB,GAAuD;IAEvD,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA4B;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAoB,EAAE,CAAC;IAEhC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;QACxC,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,IAAI,OAAO,GAAgB,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;gBAAE,SAAS;YAC/B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AA4BD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAqB,EACrB,OAAkC,EAAE;IAEpC,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,0EAA0E;QAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QAED,IAAI,SAAkB,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,QAAQ,UAAU,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/cli/doctor/session-start-preflight-setup-version.d.ts

@@ -1,83 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-/**
- * The probe command run against the `preflight` binary on PATH. Matches
- * the `version_command` the shipped `git-preflight` hook template
- * declares (src/cli/init/templates.ts), same binary and `--version`
- * flag, but is not read FROM the manifest's hook entry: an operator
- * could rename/remove that hook while `session_start_preflight.setup`
- * stays on, and the check should still probe the binary the producer
- * (`harness session-start preflight`) actually spawns.
- */
-export declare const PREFLIGHT_SETUP_VERSION_COMMAND: readonly ["preflight", "--version"];
-export interface SessionStartPreflightSetupVersionFinding {
-    /**
-     * `layer_unresolvable` (task `1c4eb3ea`, round 2, D-027 item 3):
-     * `doctor()`'s own project-scoped SECOND `loadManifest` call threw
-     * (a malformed or unreadable cwd-derived project layer), so this
-     * check could not even determine whether `setup` is on. Built
-     * directly by `doctor()` (`src/cli/doctor/index.ts`), never by this
-     * module's own `checkSessionStartPreflightSetupVersion`: that
-     * function only ever sees a manifest that already degraded to
-     * `setup: false` on such a failure, and bails out before producing
-     * ANY finding for a `setup: false` manifest, which is exactly the
-     * silence this kind replaces.
-     */
-    kind: "below_floor" | "probe_failed" | "parse_failed" | "layer_unresolvable";
-    /**
-     * Parsed installed version, when the probe succeeded and parsed.
-     * Null otherwise. Always the NUMERIC run (`parseProbedVersion`'s
-     * `version` field, e.g. "0.6.0"), never the probed prerelease/build
-     * suffix: for a `below_floor` finding caused by a prerelease of the
-     * floor (e.g. probed "0.6.0-rc.1" against a "0.6.0" `requiredVersion`),
-     * `actualVersion` therefore equals `requiredVersion` even though
-     * `kind` is `"below_floor"`: the numeric components tie, and
-     * `compareVersionFloor`'s prerelease tie-break is what actually
-     * failed the floor. `message` carries the full probed token
-     * (including the suffix) for the human-facing distinction; this
-     * field's JSON shape does not gain a new field for it. See
-     * docs/decisions/2026-09-08-preflight-floors.md.
-     */
-    actualVersion: string | null;
-    /** Always `SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION` today; carried on the finding so format.ts never re-imports the constant. */
-    requiredVersion: string;
-    message: string;
-    /**
-     * The cwd-derived (or explicit `--project`) project name `doctor`
-     * fed its scoped, project-aware `loadManifest` call from when this
-     * finding's `manifest` was resolved (task c88461c1, review round 3
-     * residual). `null` when no project layer FILE actually decided the
-     * result: no project name was derivable for that cwd (not inside a
-     * git work tree, and no explicit `--project`), OR a name WAS
-     * derivable but no matching `<home>/projects/<name>/harness.overrides.yaml`
-     * exists on disk (task `1c4eb3ea`, round 2, D-027 item 1: `doctor()`
-     * only sets this to a non-null name when `resolvePaths(...).projectLayer`
-     * resolved, not merely whenever a name was attempted, so a
-     * base/machine-decided warning stays genuinely distinguishable from
-     * a project-decided one). Present only when the CALLER passes a
-     * `projectName` argument (see below); `checkSessionStartPreflightSetupVersion`'s
-     * own unit tests call it with just `manifest`/`versionProbe`, so
-     * their findings carry no `projectName` key at all, not an
-     * `undefined` value. The report's own top-level `project` field only
-     * ever reflects an EXPLICIT `--project` (`opts.project ?? null`,
-     * `doctor/index.ts`), never this derived name.
-     */
-    projectName?: string | null;
-}
-/**
- * Pure: manifest + versionProbe in, a finding out (or `undefined` when
- * there is nothing to flag). Mirrors `checkHookVersion`'s probe/parse
- * idiom (src/cli/doctor/index.ts) so the warning vocabulary
- * (`below_floor` / `probe_failed` / `parse_failed`) and version-regex
- * parsing stay consistent across both checks, without importing from
- * index.ts (which would create a cycle back into this module's own
- * caller).
- *
- * `projectName` (task c88461c1, review round 3 residual; task
- * `1c4eb3ea`): OPTIONAL third argument, carried onto every returned finding
- * unchanged (see {@link SessionStartPreflightSetupVersionFinding.projectName}'s
- * doc comment). `doctor()` always passes it (the SAME name it derived
- * for its own scoped load, or `null`); every pre-existing direct call
- * to this pure function in its own unit tests omits it, so those
- * findings' shape is unchanged.
- */
-export declare function checkSessionStartPreflightSetupVersion(manifest: Manifest, versionProbe: (cmd: readonly string[]) => string | null, projectName?: string | null): SessionStartPreflightSetupVersionFinding | undefined;

package/dist/cli/doctor/session-start-preflight-setup-version.js

@@ -1,114 +0,0 @@
-// Doctor finding for task 6993d9b5 (tracker id, harness repo): warns
-// when `session_start_preflight.setup: true` is set but the resolved
-// `preflight` binary is below the release that made `--setup` build
-// code, not just install dependencies (agent-preflight 0.6.0, tag
-// v0.6.0). On 0.5.0 `--setup` is dependency-install only, so an
-// operator who enabled the knob against that version pays install time
-// plus the `--setup` trust exposure (see session-start-preflight.ts's
-// SECURITY note) for zero build benefit, with nothing today telling
-// them so.
-//
-// Deliberately independent of the `git-preflight` manifest hook's own
-// `min_version`/`version_command` (checked generically by
-// `checkHookVersion` in ./index.ts): that floor is whatever the
-// operator's own manifest declares, and existing manifests generated
-// before task 6993d9b5 still carry the pre-existing 0.2.0 floor (bumped
-// to `GIT_PREFLIGHT_HOOK_MIN_VERSION`, src/cli/init/templates.ts, in the
-// `init` template only going forward, task 6993d9b5's second commit).
-// This check hardcodes the build-capable floor so an operator on an
-// unregenerated manifest still gets the warning the moment they flip
-// `setup: true`, rather than only after re-running `harness init`.
-//
-// BY DESIGN: on a freshly generated manifest with `setup: true` probed
-// against a stale preflight, this check and the generic `hooks[]`
-// `min_version` walk both fire and both count toward `warningCount` (see
-// `docs/CLI.md`'s VERSION CAVEAT). The two are not a duplicate of the
-// same finding: the hook floor guards the `git-preflight` hook itself,
-// this check guards the `--setup` build-step feature specifically, and
-// a stale preflight breaks both independently.
-//
-// SPLIT FROM THE HOOK FLOOR (task 65952a0c, docs/decisions/2026-09-08-
-// preflight-floors.md): this check's floor,
-// `SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION`, and the hook
-// floor above, `GIT_PREFLIGHT_HOOK_MIN_VERSION`, were ONE shared
-// constant through task 6993d9b5. Both are `"0.6.0"` today and can
-// diverge on a future bump that applies to only one rationale; see the
-// ADR for the bump rule each carries.
-//
-// Silent (returns `undefined`) whenever `session_start_preflight.setup`
-// is `false`/absent: the trust exposure and the install/build cost only
-// exist once the knob is actually on, mirroring every other advisory
-// doctor check's "no opinion when the feature isn't in use" gate.
-import { parseProbedVersion, compareVersionFloor } from "../../io/version-compare.js";
-import { PREFLIGHT_BIN } from "../session-start/index.js";
-import { SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION } from "../../schema/session-start-preflight.js";
-/**
- * The probe command run against the `preflight` binary on PATH. Matches
- * the `version_command` the shipped `git-preflight` hook template
- * declares (src/cli/init/templates.ts), same binary and `--version`
- * flag, but is not read FROM the manifest's hook entry: an operator
- * could rename/remove that hook while `session_start_preflight.setup`
- * stays on, and the check should still probe the binary the producer
- * (`harness session-start preflight`) actually spawns.
- */
-export const PREFLIGHT_SETUP_VERSION_COMMAND = [PREFLIGHT_BIN, "--version"];
-/**
- * Pure: manifest + versionProbe in, a finding out (or `undefined` when
- * there is nothing to flag). Mirrors `checkHookVersion`'s probe/parse
- * idiom (src/cli/doctor/index.ts) so the warning vocabulary
- * (`below_floor` / `probe_failed` / `parse_failed`) and version-regex
- * parsing stay consistent across both checks, without importing from
- * index.ts (which would create a cycle back into this module's own
- * caller).
- *
- * `projectName` (task c88461c1, review round 3 residual; task
- * `1c4eb3ea`): OPTIONAL third argument, carried onto every returned finding
- * unchanged (see {@link SessionStartPreflightSetupVersionFinding.projectName}'s
- * doc comment). `doctor()` always passes it (the SAME name it derived
- * for its own scoped load, or `null`); every pre-existing direct call
- * to this pure function in its own unit tests omits it, so those
- * findings' shape is unchanged.
- */
-export function checkSessionStartPreflightSetupVersion(manifest, versionProbe, projectName) {
-    if (!manifest.session_start_preflight.setup)
-        return undefined;
-    const withProjectName = (finding) => projectName !== undefined ? { ...finding, projectName } : finding;
-    const required = SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION;
-    const stdout = versionProbe(PREFLIGHT_SETUP_VERSION_COMMAND);
-    if (stdout === null) {
-        return withProjectName({
-            kind: "probe_failed",
-            actualVersion: null,
-            requiredVersion: required,
-            message: `session_start_preflight.setup is enabled but the installed preflight version could not ` +
-                `be determined (probe for "${PREFLIGHT_SETUP_VERSION_COMMAND.join(" ")}" failed); the ` +
-                `build step needs preflight >= ${required}`,
-        });
-    }
-    // parseProbedVersion/compareVersionFloor (not plain compareNumericVersions):
-    // a preflight release candidate of the floor (e.g. "0.6.0-rc.1") must not
-    // count as build-capable. See docs/decisions/2026-09-08-preflight-floors.md.
-    const parsed = parseProbedVersion(stdout);
-    if (!parsed) {
-        return withProjectName({
-            kind: "parse_failed",
-            actualVersion: null,
-            requiredVersion: required,
-            message: `session_start_preflight.setup is enabled but the installed preflight version could not ` +
-                `be parsed from "${stdout.trim()}"; the build step needs preflight >= ${required}`,
-        });
-    }
-    const { version: actual, isPrerelease, token } = parsed;
-    if (compareVersionFloor(actual, isPrerelease, required) < 0) {
-        return withProjectName({
-            kind: "below_floor",
-            actualVersion: actual,
-            requiredVersion: required,
-            message: `session_start_preflight.setup is enabled but installed preflight v${token} < ${required}: ` +
-                `--setup on v${token} is dependency-install only (no build step); upgrade preflight ` +
-                `(npm i -g @lannguyensi/agent-preflight) or set session_start_preflight.setup: false`,
-        });
-    }
-    return undefined;
-}
-//# sourceMappingURL=session-start-preflight-setup-version.js.map

package/dist/cli/doctor/session-start-preflight-setup-version.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-start-preflight-setup-version.js","sourceRoot":"","sources":["../../../src/cli/doctor/session-start-preflight-setup-version.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,qEAAqE;AACrE,oEAAoE;AACpE,kEAAkE;AAClE,gEAAgE;AAChE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,WAAW;AACX,EAAE;AACF,sEAAsE;AACtE,0DAA0D;AAC1D,gEAAgE;AAChE,qEAAqE;AACrE,wEAAwE;AACxE,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,EAAE;AACF,uEAAuE;AACvE,kEAAkE;AAClE,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,+CAA+C;AAC/C,EAAE;AACF,uEAAuE;AACvE,4CAA4C;AAC5C,kEAAkE;AAClE,iEAAiE;AACjE,mEAAmE;AACnE,uEAAuE;AACvE,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,kEAAkE;AAElE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,+CAA+C,EAAE,MAAM,yCAAyC,CAAC;AAG1G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,aAAa,EAAE,WAAW,CAAU,CAAC;AAyDrF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sCAAsC,CACpD,QAAkB,EAClB,YAAuD,EACvD,WAA2B;IAE3B,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE9D,MAAM,eAAe,GAAG,CACtB,OAAsE,EAC5B,EAAE,CAC5C,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAEpE,MAAM,QAAQ,GAAG,+CAA+C,CAAC;IACjE,MAAM,MAAM,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;YACrB,IAAI,EAAE,cAAc;YACpB,aAAa,EAAE,IAAI;YACnB,eAAe,EAAE,QAAQ;YACzB,OAAO,EACL,yFAAyF;gBACzF,6BAA6B,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB;gBACvF,iCAAiC,QAAQ,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,eAAe,CAAC;YACrB,IAAI,EAAE,cAAc;YACpB,aAAa,EAAE,IAAI;YACnB,eAAe,EAAE,QAAQ;YACzB,OAAO,EACL,yFAAyF;gBACzF,mBAAmB,MAAM,CAAC,IAAI,EAAE,wCAAwC,QAAQ,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACxD,IAAI,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,eAAe,CAAC;YACrB,IAAI,EAAE,aAAa;YACnB,aAAa,EAAE,MAAM;YACrB,eAAe,EAAE,QAAQ;YACzB,OAAO,EACL,qEAAqE,KAAK,MAAM,QAAQ,IAAI;gBAC5F,eAAe,KAAK,iEAAiE;gBACrF,qFAAqF;SACxF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/cli/doctor/settings-drift.d.ts

@@ -1,25 +0,0 @@
-export interface SettingsDriftSection {
-    /** ℹ lines; never roll into warningCount. */
-    notes: string[];
-    /** ⚠ lines; each rolls into warningCount. */
-    warnings: string[];
-}
-/**
- * `~`-relativize `absPath` under `home` for display; never leak the raw
- * absolute path. Exported for `codex-config-drift.ts`'s `$CODEX_HOME`
- * candidate label, which needs the same convention.
- */
-export declare function tildeize(absPath: string, home: string): string;
-export interface BuildSettingsDriftOptions {
-    /** `harness.generated/` for the manifest in use; `.last-apply` lives here. */
-    generatedDir: string;
-    /** `harness.lock` path for the manifest in use. */
-    lockPath: string;
-    /** Resolves the two project-scoped candidate files (`.claude/settings.json`, `.claude/settings.local.json`). */
-    cwd: string;
-    /** Operator home; resolves the user-scope candidate file and its display label. */
-    home: string;
-    /** Env for `CLAUDE_CONFIG_DIR` resolution of the user-scope file. */
-    env: NodeJS.ProcessEnv;
-}
-export declare function buildSettingsDrift(opts: BuildSettingsDriftOptions): SettingsDriftSection;

package/dist/cli/doctor/settings-drift.js

@@ -1,213 +0,0 @@
-// Settings-drift half of ADR docs/decisions/2026-08-27-ug-auto-mode-approval.md
-// slice 1 (agent-tasks 74b4b17d), threat model (c): "The permission mode
-// itself is settings-derived, and settings files are agent-editable
-// after approval" and "The same settings write also reaches the hook
-// roster, which supplies key two." A post-approval agent can plant
-// `permissions.defaultMode: "bypassPermissions"` (key one) and/or a
-// `UserPromptSubmit`/`SessionStart` hook entry that mints a report for
-// every later session (key two) into a Claude Code settings file, and
-// nothing named that plant before this check: `harness diff
-// --since-apply` only re-hashes the whole `--target` file as a lock
-// entry, so it flags SOME change without naming which key moved.
-//
-// What this module actually has to compare against, verified against
-// the real `apply()` code path (not assumed from the ADR prose):
-//
-//   - `.last-apply` (`src/io/last-apply.ts`) stores exactly ONE
-//     `files["settings.json"]` entry: harness's own GENERATED
-//     settings.json content (`buildExpectedFiles` in apply.ts), keyed by
-//     basename, not by which `--target` path it was merged into. Harness
-//     never writes `permissions.defaultMode` itself
-//     (`generate-settings.ts` has no such key), and `--merge` replaces
-//     `hooks` WHOLESALE (`src/io/merge-settings.ts`'s module header: "harness
-//     owns whichever top-level keys appear in the generated output...
-//     hooks stays wholesale-owned"). So this one snapshot is, for every
-//     settings file harness has ever targeted, an accurate "what harness
-//     itself put there at apply time" baseline: defaultMode absent
-//     (harness never owns it) and hooks exactly the generated roster (no
-//     operator hand-added hook entry survives a `--merge`).
-//   - `harness.lock` (`src/io/harness-lock.ts`) records which absolute
-//     path(s) were an actual `--target` write, as a `kind: "target"`
-//     entry. This is how a live settings file is told apart from one
-//     harness has never touched: matching against this lock entry is
-//     the "SAME path" mapping the file was written under.
-//
-// A file whose absolute path has no `target` lock entry never received
-// harness's baseline at all, so it gets the EMPTY baseline (everything
-// in it reads as "absent at last apply") rather than the shared
-// generated-settings.json baseline.
-//
-// Warnings only, never a block; this is the compensating control named
-// in the ADR, not an enforcement (the enforcing lever is the managed
-// setting in operator decision 7).
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { lastApplyPath, readLastApply } from "../../io/last-apply.js";
-import { readLock } from "../../io/harness-lock.js";
-import { safeJsonParse } from "../../io/safe-json-parse.js";
-import { resolveSettingsPath as resolveUserSettingsPath } from "./claude-mcp.js";
-function isRecord(v) {
-    return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function hookIdentityKey(h) {
-    return JSON.stringify([h.event, h.matcher, h.type, h.command]);
-}
-/**
- * Enumerate every `hooks[event][].hooks[]` entry in a parsed settings
- * object as an identity tuple. Mirrors the group-parsing convention
- * `collectOwnedHookGroups`/`classifyHookGroup` use in
- * `src/cli/uninstall/index.ts` for the same on-disk shape. Malformed
- * groups/entries are skipped rather than throwing — a live settings.json
- * this check does not own may carry shapes this parser has no opinion
- * about.
- */
-function collectHookIdentities(hooksValue) {
-    const out = [];
-    if (!isRecord(hooksValue))
-        return out;
-    for (const event of Object.keys(hooksValue)) {
-        const groups = hooksValue[event];
-        if (!Array.isArray(groups))
-            continue;
-        for (const group of groups) {
-            if (!isRecord(group))
-                continue;
-            const matcher = typeof group["matcher"] === "string" ? group["matcher"] : "";
-            const inner = group["hooks"];
-            if (!Array.isArray(inner))
-                continue;
-            for (const h of inner) {
-                if (!isRecord(h))
-                    continue;
-                const type = typeof h["type"] === "string" ? h["type"] : "";
-                const command = typeof h["command"] === "string" ? h["command"] : "";
-                out.push({ event, matcher, type, command });
-            }
-        }
-    }
-    return out;
-}
-function defaultModeOf(settings) {
-    const permissions = settings["permissions"];
-    if (!isRecord(permissions))
-        return undefined;
-    const mode = permissions["defaultMode"];
-    return typeof mode === "string" ? mode : undefined;
-}
-function checkOneFile(file, baseline, targetAbsPaths, warnings) {
-    // Plain read, no readRegularFileRejectingSymlink: this is a live
-    // Claude Code settings file (project or user scope), not one of
-    // harness's own generated artefacts, and doctor's existing reader for
-    // this exact file class (`findDeadSettingsMcpNames` in claude-mcp.ts)
-    // already reads it the same way — a missing file resolves to "nothing
-    // to report" here too, not a symlink-defense case.
-    let raw;
-    try {
-        raw = fs.readFileSync(file.absolutePath, "utf8");
-    }
-    catch {
-        return;
-    }
-    const parsed = safeJsonParse(raw);
-    if (!isRecord(parsed)) {
-        warnings.push(`${file.displayLabel}: unreadable settings JSON`);
-        return;
-    }
-    const live = parsed;
-    const hasSnapshot = targetAbsPaths.has(path.resolve(file.absolutePath));
-    const effectiveBaseline = hasSnapshot ? baseline : {};
-    const suffix = hasSnapshot ? "" : " (no apply snapshot for this file)";
-    const liveMode = defaultModeOf(live);
-    const baselineMode = defaultModeOf(effectiveBaseline);
-    if (liveMode !== undefined && liveMode !== baselineMode) {
-        if (baselineMode === undefined) {
-            warnings.push(`permissions.defaultMode set in ${file.displayLabel} but absent at last apply: ${liveMode}${suffix}`);
-        }
-        else {
-            warnings.push(`permissions.defaultMode set in ${file.displayLabel} changed from ${baselineMode} to ${liveMode}${suffix}`);
-        }
-    }
-    const liveHooks = collectHookIdentities(live["hooks"]);
-    const baselineHookKeys = new Set(collectHookIdentities(effectiveBaseline["hooks"]).map(hookIdentityKey));
-    for (const h of liveHooks) {
-        if (baselineHookKeys.has(hookIdentityKey(h)))
-            continue;
-        warnings.push(`hook entries in ${file.displayLabel} absent at last apply: ${h.event}/${h.matcher || "*"}${suffix}`);
-    }
-}
-/**
- * The absolute paths `harness.lock` records as an actual `--target`
- * write (see the module header: this is the "SAME path" mapping a live
- * file was written under). Not exported: `codex-config-drift.ts` no
- * longer shares this lookup (it keeps no apply-time snapshot to gate on
- * at all, see that module's header).
- */
-function targetLockAbsPaths(lockPath) {
-    const lockEntries = readLock(lockPath) ?? [];
-    return new Set(lockEntries
-        .filter((e) => e.kind === "target")
-        .map((e) => path.resolve(e.path)));
-}
-/**
- * `~`-relativize `absPath` under `home` for display; never leak the raw
- * absolute path. Exported for `codex-config-drift.ts`'s `$CODEX_HOME`
- * candidate label, which needs the same convention.
- */
-export function tildeize(absPath, home) {
-    const resolvedHome = path.resolve(home);
-    const resolvedPath = path.resolve(absPath);
-    if (resolvedPath === resolvedHome)
-        return "~";
-    const withSep = resolvedHome.endsWith(path.sep) ? resolvedHome : `${resolvedHome}${path.sep}`;
-    if (resolvedPath.startsWith(withSep)) {
-        return path.join("~", resolvedPath.slice(withSep.length));
-    }
-    return absPath;
-}
-export function buildSettingsDrift(opts) {
-    const notes = [];
-    const warnings = [];
-    // A malformed `.last-apply` must not abort doctor: degrade to a warning
-    // naming the file and skip the drift comparison (same shape as the
-    // runtime-selection fallback in index.ts).
-    let lastApply;
-    try {
-        lastApply = readLastApply(opts.generatedDir);
-    }
-    catch (err) {
-        warnings.push(`${lastApplyPath(opts.generatedDir)} is unreadable (${err instanceof Error ? err.message : String(err)}); settings drift not checked`);
-        return { notes, warnings };
-    }
-    if (lastApply === null) {
-        notes.push("no apply snapshot; settings drift not checked");
-        return { notes, warnings };
-    }
-    const baselineRaw = lastApply.files["settings.json"]?.content;
-    let baseline = {};
-    if (baselineRaw !== undefined) {
-        const parsed = safeJsonParse(baselineRaw);
-        if (isRecord(parsed))
-            baseline = parsed;
-    }
-    const targetAbsPaths = targetLockAbsPaths(opts.lockPath);
-    const userSettingsPath = resolveUserSettingsPath(opts.home, opts.env);
-    const candidates = [
-        {
-            absolutePath: path.resolve(opts.cwd, ".claude", "settings.json"),
-            displayLabel: ".claude/settings.json",
-        },
-        {
-            absolutePath: path.resolve(opts.cwd, ".claude", "settings.local.json"),
-            displayLabel: ".claude/settings.local.json",
-        },
-        {
-            absolutePath: path.resolve(userSettingsPath),
-            displayLabel: tildeize(userSettingsPath, opts.home),
-        },
-    ];
-    for (const c of candidates) {
-        checkOneFile(c, baseline, targetAbsPaths, warnings);
-    }
-    return { notes, warnings };
-}
-//# sourceMappingURL=settings-drift.js.map

package/dist/cli/doctor/settings-drift.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"settings-drift.js","sourceRoot":"","sources":["../../../src/cli/doctor/settings-drift.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,yEAAyE;AACzE,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,4DAA4D;AAC5D,oEAAoE;AACpE,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,iEAAiE;AACjE,EAAE;AACF,gEAAgE;AAChE,8DAA8D;AAC9D,yEAAyE;AACzE,yEAAyE;AACzE,oDAAoD;AACpD,uEAAuE;AACvE,8EAA8E;AAC9E,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,mEAAmE;AACnE,yEAAyE;AACzE,4DAA4D;AAC5D,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,gEAAgE;AAChE,oCAAoC;AACpC,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,mCAAmC;AAEnC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAoB,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,IAAI,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAejF,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAUD,SAAS,eAAe,CAAC,CAAe;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,UAAmB;IAChD,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC/B,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAK,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,QAAiC;IACtD,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CACnB,IAAuB,EACvB,QAAiC,EACjC,cAAmC,EACnC,QAAkB;IAElB,iEAAiE;IACjE,gEAAgE;IAChE,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,4BAA4B,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC;IAEpB,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oCAAoC,CAAC;IAEvE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QACxD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,kCAAkC,IAAI,CAAC,YAAY,8BAA8B,QAAQ,GAAG,MAAM,EAAE,CACrG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CACX,kCAAkC,IAAI,CAAC,YAAY,iBAAiB,YAAY,OAAO,QAAQ,GAAG,MAAM,EAAE,CAC3G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACvD,QAAQ,CAAC,IAAI,CACX,mBAAmB,IAAI,CAAC,YAAY,0BAA0B,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,GAAG,MAAM,EAAE,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7C,OAAO,IAAI,GAAG,CACZ,WAAW;SACR,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACpC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,IAAY;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,YAAY,KAAK,YAAY;QAAE,OAAO,GAAG,CAAC;IAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9F,IAAI,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAeD,MAAM,UAAU,kBAAkB,CAAC,IAA+B;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,wEAAwE;IACxE,mEAAmE;IACnE,2CAA2C;IAC3C,IAAI,SAA2C,CAAC;IAChD,IAAI,CAAC;QACH,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,+BAA+B,CACtI,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC9D,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,CAAC;YAAE,QAAQ,GAAG,MAAM,CAAC;IAC1C,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEzD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACtE,MAAM,UAAU,GAAwB;QACtC;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC;YAChE,YAAY,EAAE,uBAAuB;SACtC;QACD;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,qBAAqB,CAAC;YACtE,YAAY,EAAE,6BAA6B;SAC5C;QACD;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC5C,YAAY,EAAE,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC;SACpD;KACF,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC"}