@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/cli/session-start/index.js

@@ -1,591 +0,0 @@
-// `harness session-start preflight` — SessionStart hook entrypoint.
-//
-// Wired by the Full template's `git-preflight` SessionStart hook. Reads
-// the SessionStart event JSON from stdin, runs `agent-preflight`
-// (`preflight run --json [--setup] <cwd>`; `--setup` is opt-in via the
-// manifest's `session_start_preflight.setup` key, default `false`, task
-// 30183330, see ./src/schema/session-start-preflight.ts), and on a
-// `ready:true` result writes a `preflight:${REPO}` fact to the evidence
-// ledger so the `preflight-before-investigation` / `preflight-before-push`
-// policies have a fresh tag to match within their `within` windows.
-//
-// SessionStart hooks are `blocking:false`: this command MUST NOT break
-// the session loop. Every failure path — `preflight` not on PATH, a
-// timeout, a non-`ready` result, an unreachable ledger — logs one line
-// to stderr and exits 0. The only observable effect of a failure is
-// that the preflight policies stay closed (which is the safe default).
-//
-// `ready:false` deliberately does NOT write the tag: the policy intent
-// is "block investigative git reads until agent-preflight ran cleanly",
-// so a failing preflight must leave the gate shut, not satisfy it.
-import { execFile } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { resolveGitContext, resolveScopedProjectName, } from "../../runtime/index.js";
-import { resolveManifestLedgerWriter } from "../../runtime/ledger-writer.js";
-import { resolveGeneratedDir } from "../../runtime/pending-approval.js";
-import { resolveReadSessionId } from "../../runtime/session-id.js";
-import { readStdinBounded, STDIN_IDLE_TIMEOUT_MS, stdinTimeoutNote } from "../bounded-stdin.js";
-import { loadManifest, resolvePaths } from "../loader.js";
-import { classifySessionSource, explicitSessionId, FALLBACK_SESSION, } from "./shared-options.js";
-// Exported (task 6993d9b5, round 2 F5) so
-// `session-start-preflight-setup-version.ts`'s `PREFLIGHT_SETUP_VERSION_COMMAND`
-// derives from this producer's own binary name instead of carrying an
-// independent "preflight" string literal that could silently drift from it.
-export const PREFLIGHT_BIN = "preflight";
-// Default upper bound on `preflight run --json <cwd>` for the
-// SessionStart producer. Was 25s through v0.17.4; bumped to 60s after
-// the agent-grounding dogfood (agent-tasks/7265599e) where a healthy
-// preflight took ~28s, just past the old ceiling. The wrapper still
-// kills runaway invocations; this only widens the window for honest
-// medium-size repos. Operators with even larger preflights can still
-// override per-call via `harness preflight --timeout <ms>`.
-const DEFAULT_PREFLIGHT_TIMEOUT_MS = 60_000;
-const LEDGER_SOURCE = "harness-session-start-preflight";
-// Not-ready diagnostic log: the raw `preflight run --json` payload is
-// persisted so an operator (or a follow-up session) can see the FULL
-// check output, not just the capped first-N detail lines this producer
-// surfaces on stderr. `keep-last-20` rotation bounds the directory —
-// it is shared across every repo the operator preflights from this
-// host, so unbounded growth would be a slow disk leak.
-const FAIL_LOG_KEEP_LAST = 20;
-const FAIL_LOG_PREFIX = "preflight-";
-/**
- * Environment for the spawned `preflight` child: the parent env minus
- * HARNESS_ALLOW_REAL_GENERATED_DIR. The launcher sets that flag so the
- * real harness binary may fall back to the operator's home dir, but the
- * preflight child runs the repo's own test suite (its `npm-test` check),
- * and an inherited flag re-enables the implicit real-homedir fallback
- * INSIDE those test processes. With non-empty operator state (e.g. a
- * `harness pause` sentinel) that broke 110 tests and surfaced as a false
- * `failing: npm-test`, keeping the preflight gate shut. Third incident
- * of the operator-state-isolation class PR #199 pinned; the flag must
- * stay scoped to the process the operator actually invoked.
- */
-export function preflightChildEnv(parentEnv = process.env) {
-    const env = { ...parentEnv };
-    delete env["HARNESS_ALLOW_REAL_GENERATED_DIR"];
-    return env;
-}
-/**
- * Build the argv passed to the `preflight` child (task 30183330). Pure
- * and exported so a test can pin the rendered command directly, with
- * and without `setup`, instead of only exercising the injected
- * `runPreflight` seam. `--setup` is inserted before the positional
- * `cwd` argument, matching agent-preflight's own `preflight run
- * [options] [repoPath]` usage.
- */
-export function buildPreflightArgv(cwd, setup) {
-    return setup ? ["run", "--json", "--setup", cwd] : ["run", "--json", cwd];
-}
-/**
- * Default `preflight` runner: spawn `preflight run --json [--setup]
- * <cwd>` and parse its stdout. Resolves `{ ok: false }` (never throws)
- * for the not-installed / timeout / unparseable cases so the caller can
- * degrade.
- */
-function spawnPreflight(cwd, timeoutMs, setup) {
-    return new Promise((resolve) => {
-        execFile(PREFLIGHT_BIN, buildPreflightArgv(cwd, setup), {
-            timeout: timeoutMs,
-            maxBuffer: 16 * 1024 * 1024,
-            encoding: "utf8",
-            env: preflightChildEnv(),
-        }, (err, stdout) => {
-            // `preflight` may exit non-zero on a not-ready result while still
-            // emitting valid JSON, so a parseable stdout wins over the exit
-            // code. Only a missing binary / timeout / unparseable output is a
-            // genuine "could not run".
-            const text = (stdout ?? "").trim();
-            if (text.length > 0) {
-                try {
-                    return resolve({ ok: true, json: JSON.parse(text) });
-                }
-                catch {
-                    /* fall through to the error path */
-                }
-            }
-            if (err) {
-                const e = err;
-                if (e.code === "ENOENT") {
-                    return resolve({
-                        ok: false,
-                        reason: `\`${PREFLIGHT_BIN}\` not on PATH (npm i -g @lannguyensi/agent-preflight)`,
-                    });
-                }
-                // maxBuffer overflow also sets `killed:true`; check it first so
-                // an over-budget output is not mis-reported as a timeout.
-                if (e.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") {
-                    return resolve({
-                        ok: false,
-                        reason: `\`${PREFLIGHT_BIN} run --json\` output exceeded the read buffer`,
-                    });
-                }
-                if (e.killed) {
-                    return resolve({
-                        ok: false,
-                        reason: `\`${PREFLIGHT_BIN} run\` timed out after ${timeoutMs}ms`,
-                    });
-                }
-                return resolve({ ok: false, reason: `\`${PREFLIGHT_BIN} run\` failed: ${e.message}` });
-            }
-            return resolve({
-                ok: false,
-                reason: `\`${PREFLIGHT_BIN} run --json\` produced no parseable JSON`,
-            });
-        });
-    });
-}
-// Up to this many valid detail lines are surfaced per failing check.
-// Was 1 (the check's first detail line only) through v0.2x; a bare
-// check name plus a single truncated line once cost a long false-
-// negative diagnosis because the actual FAIL line (test name) sat
-// past the first line the producer looked at. Task T-001.
-const MAX_DETAIL_LINES_PER_CHECK = 3;
-const DETAIL_LINE_CHAR_CAP = 140;
-function capDetailLine(raw) {
-    const trimmed = raw.trim().replace(/\s+/g, " ");
-    return trimmed.length > DETAIL_LINE_CHAR_CAP
-        ? `${trimmed.slice(0, DETAIL_LINE_CHAR_CAP - 1)}…`
-        : trimmed;
-}
-function describeNotReady(json, logPath) {
-    const failing = (json.checks ?? [])
-        .filter((c) => c.status === "fail" || c.status === "error")
-        .map((c) => {
-        const name = c.name ?? "(unnamed)";
-        // Surface up to MAX_DETAIL_LINES_PER_CHECK of the check's own detail
-        // lines: a bare check name ("failing: npm-test") once cost a long
-        // false-negative diagnosis because the actual reason never left the
-        // child JSON. The typeof guards matter: this is untrusted subprocess
-        // JSON behind a cast, and a SessionStart producer must never throw
-        // (blocking:false, exit-0 contract above), so a malformed element is
-        // filtered out instead of crashing; a check with no valid detail
-        // line at all degrades to its bare name.
-        const validDetails = Array.isArray(c.details)
-            ? c.details.filter((d) => typeof d === "string" && d.trim().length > 0)
-            : [];
-        const lines = validDetails.length > 0
-            ? validDetails.slice(0, MAX_DETAIL_LINES_PER_CHECK)
-            : typeof c.message === "string" && c.message.trim().length > 0
-                ? [c.message]
-                : [];
-        if (lines.length === 0)
-            return name;
-        const capped = lines.map(capDetailLine).join(" | ");
-        return `${name} (${capped})`;
-    });
-    const confidence = typeof json.confidence === "number" ? json.confidence.toFixed(2) : "?";
-    const failSuffix = failing.length > 0 ? `; failing: ${failing.join(", ")}` : "";
-    const logSuffix = logPath ? `; log: ${logPath}` : "";
-    return `preflight not ready (confidence ${confidence})${failSuffix}${logSuffix}`;
-}
-/**
- * Default not-ready log directory: `<home>/logs` (task T-001). Routed
- * through `resolvePaths()` — the same idiom `defaultReportsDir`'s caller
- * uses in approve/understanding.ts — instead of hardcoding
- * `path.join(os.homedir(), ".harness", "logs")` directly (task 80f49922,
- * reviewer finding on a48b9729). Two effects: (1) this now respects the
- * real home-dir precedence chain ($HARNESS_HOME, then `~/.harness/`,
- * then the legacy `~/.claude/` fallback) instead of silently diverging
- * from the rest of the harness state (regression from 31fbf856); (2) it
- * inherits the throw-on-real-home-dir guard in `resolvePaths()`
- * (loader.ts:45-64), which previously protected this seam only via a
- * suite-local `vi.mock("node:os")` pin in preflight.test.ts — a caller
- * that forgot to inject `logDir` from any OTHER test or child process
- * would still silently write into the operator's real home dir.
- * Evaluated lazily from the `opts.logDir ?? defaultFailLogDir(opts)`
- * call site, so injecting `logDir` alone still bypasses the guard.
- *
- * Precedence when BOTH `homeDir` and `configPath` are injected at once:
- * `configPath` wins here, inherited from `resolvePaths()`'s own `base =
- * opts.configPath ?? path.join(home, DEFAULT_BASENAME)` (loader.ts) —
- * `configPath`, when present, is used verbatim regardless of `homeDir`.
- * This is the opposite of `resolveGeneratedDir()` (io/generated-dir.ts),
- * which checks `homeDir` FIRST and only falls back to the manifest
- * path's directory when `homeDir` is undefined, so `homeDir` wins there.
- * Intentional, pre-existing divergence between the two resolvers, not a
- * bug to reconcile here — documented, not changed.
- */
-function defaultFailLogDir(opts) {
-    return path.join(path.dirname(resolvePaths(opts).base), "logs");
-}
-/**
- * Resolve the not-ready fail-log directory, catching only the
- * `resolvePaths()` guard's throw (task 80f49922 reviewer finding).
- * `persistFailLog()` below has its own never-throws contract (see its
- * doc comment), so it is called OUTSIDE this try/catch at the call
- * site — wrapping it here too would blur which of the two failure
- * modes (guard throw vs. write failure) actually produced a given
- * `{ ok: false, reason }`.
- */
-function resolveFailLogDir(opts) {
-    try {
-        return { ok: true, logDir: opts.logDir ?? defaultFailLogDir(opts) };
-    }
-    catch (err) {
-        return { ok: false, reason: err instanceof Error ? err.message : String(err) };
-    }
-}
-/** Repo names land in a filename; strip anything not filename-safe. */
-function sanitizeForFilename(value) {
-    const cleaned = value.replace(/[^a-zA-Z0-9._-]/g, "-");
-    return cleaned.length > 0 ? cleaned : "repo";
-}
-/**
- * Rotate `logDir` down to the `FAIL_LOG_KEEP_LAST` most recently modified
- * `preflight-*.json` files, oldest first. Best-effort: any single stat/
- * unlink failure is swallowed so one unreadable entry cannot block
- * rotation of the rest. The directory is shared across every repo the
- * operator preflights from this host, so filename order is not a
- * reliable time proxy — mtime is.
- */
-function rotateFailLogDir(logDir) {
-    const names = fs
-        .readdirSync(logDir)
-        .filter((name) => name.startsWith(FAIL_LOG_PREFIX) && name.endsWith(".json"));
-    if (names.length <= FAIL_LOG_KEEP_LAST)
-        return;
-    const withMtime = names
-        .map((name) => {
-        const full = path.join(logDir, name);
-        try {
-            return { full, mtimeMs: fs.statSync(full).mtimeMs };
-        }
-        catch {
-            return null;
-        }
-    })
-        .filter((e) => e !== null)
-        .sort((a, b) => a.mtimeMs - b.mtimeMs);
-    const excess = withMtime.length - FAIL_LOG_KEEP_LAST;
-    for (let i = 0; i < excess; i++) {
-        const entry = withMtime[i];
-        if (!entry)
-            continue;
-        try {
-            fs.unlinkSync(entry.full);
-        }
-        catch {
-            /* best-effort rotation; a stray leftover file is not fatal */
-        }
-    }
-}
-/**
- * Persist the not-ready `preflight run --json` payload (pretty-printed)
- * to `<logDir>/preflight-<repo>-<timestamp>-<hex4>.json`, then rotate the
- * directory. The 4-hex suffix disambiguates writes that land in the same
- * millisecond (the ISO timestamp's resolution), where the second write
- * would otherwise silently overwrite the first. Never throws: a write or
- * rotation failure degrades to `{ ok: false, reason }` so the caller can
- * note() and keep going — the SessionStart producer must exit 0 on every
- * path.
- */
-function persistFailLog(json, repo, logDir) {
-    let filePath;
-    try {
-        fs.mkdirSync(logDir, { recursive: true });
-        const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
-        const unique = randomBytes(2).toString("hex");
-        // Cap the sanitized basename so a very long repo/worktree name can't blow past filesystem name-length limits.
-        filePath = path.join(logDir, `${FAIL_LOG_PREFIX}${sanitizeForFilename(repo).slice(0, 100)}-${timestamp}-${unique}.json`);
-        fs.writeFileSync(filePath, `${JSON.stringify(json, null, 2)}\n`, "utf8");
-    }
-    catch (err) {
-        return { ok: false, reason: err.message };
-    }
-    try {
-        rotateFailLogDir(logDir);
-    }
-    catch {
-        /* rotation failure must not undo an already-successful log write */
-    }
-    return { ok: true, path: filePath };
-}
-export async function runSessionStartPreflight(opts = {}) {
-    const stdin = opts.stdin ?? process.stdin;
-    const stderr = opts.stderr ?? process.stderr;
-    const preflightTimeoutMs = opts.preflightTimeoutMs ?? DEFAULT_PREFLIGHT_TIMEOUT_MS;
-    const note = (msg) => {
-        stderr.write(`harness session-start preflight: ${msg}\n`);
-    };
-    const done = (wrote, repo, branch, sessionId, sessionSource, reason) => ({
-        exitCode: 0,
-        wrote,
-        repo,
-        branch,
-        sessionId,
-        sessionSource,
-        ...(reason !== undefined && { reason }),
-    });
-    // An explicit --session id overrides every other source, so stdin is not
-    // read at all in that case: a manual or scripted call must not wait on a
-    // stream that may never close. Without it, the read is idle-bounded and a
-    // timeout falls back to the default session resolution below.
-    let event;
-    try {
-        if (typeof opts.session === "string" && opts.session.length > 0) {
-            event = {};
-        }
-        else {
-            const idleTimeoutMs = opts.stdinIdleTimeoutMs ?? STDIN_IDLE_TIMEOUT_MS;
-            const read = await readStdinBounded(stdin, idleTimeoutMs);
-            if (read.timedOut)
-                note(stdinTimeoutNote(read, idleTimeoutMs));
-            event = JSON.parse(read.text.trim() || "{}");
-        }
-    }
-    catch (err) {
-        const reason = `malformed event JSON: ${err.message}`;
-        note(reason);
-        return done(false, "", "", FALLBACK_SESSION, "default", reason);
-    }
-    const cwd = typeof event.cwd === "string" && event.cwd.length > 0 ? event.cwd : process.cwd();
-    const { repo, branch, sha } = resolveGitContext(cwd);
-    if (repo === "") {
-        const reason = `cwd is not inside a git work tree (${cwd}); nothing to preflight`;
-        note(reason);
-        return done(false, "", "", FALLBACK_SESSION, "default", reason);
-    }
-    // Session-id resolution chain. The hook-driven path (Claude Code feeds
-    // SessionStart event JSON on stdin) lands at tier "stdin" and is the
-    // common case. Manual invocations from an operator's `!`-shell — where
-    // there is no event JSON — fall back through env, then transcript
-    // discovery (same heuristic `harness audit` / `harness explain --trace`
-    // use), and only as a last resort to the literal `"default"`. Tags
-    // recorded under `"default"` will never satisfy a `preflight-before-*`
-    // gate, so we loud-warn rather than letting the success line read as
-    // if the producer worked.
-    const explicit = explicitSessionId(opts.session, event);
-    const resolveSession = opts.resolveSession ?? resolveReadSessionId;
-    const sessionId = resolveSession(explicit, {});
-    const sessionSource = classifySessionSource(opts.session, event, sessionId);
-    // Stage `.pending-approval` as soon as we resolve a real session id so
-    // `harness approve understanding` (no flags) works from the operator's
-    // `!`-shell without needing a prior PreToolUse gate-block. Producer
-    // hand-off matches the PreToolUse hook's existing one (same writer,
-    // same path, same single-line content). Skipped when the session id
-    // is the literal "default", since pointing approve at "default" would
-    // never satisfy any task-scoped gate. Best-effort: a write failure
-    // must NOT break the session loop, so any error is silently swallowed
-    // (the operator can always fall back to `--session <id>` as before).
-    // Multi-session caveat: two parallel Claude sessions on the same host
-    // will clobber each other's `.pending-approval` (single-slot file).
-    // Acceptable for the one-Claude-per-repo operator pattern; the worst
-    // case is approve resolving to the wrong session id, which the operator
-    // catches via the canonical-gate-signal line in the approve output.
-    // OPT-IN: only fires when the caller explicitly passes a writer. The
-    // CLI entry points wire `writePendingApproval`; library callers (and
-    // every existing vitest case) get the no-op default, so the producer
-    // never pollutes the real `~/.claude/harness.generated/` from a test.
-    // Hotfix for v0.21.0 which defaulted to ON and caused the npm-test
-    // preflight check to clobber the operator's pending-approval file.
-    if (sessionSource !== "default" &&
-        typeof opts.stagePendingApproval === "function") {
-        try {
-            const generatedDir = resolveGeneratedDir({
-                ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}),
-                manifestPath: resolvePaths(opts).base,
-            });
-            opts.stagePendingApproval(generatedDir, sessionId);
-        }
-        catch {
-            /* best-effort, never escalate into a hook error */
-        }
-    }
-    // Resolve `--setup` (task 30183330) BEFORE spawning `preflight` so the
-    // flag reaches the very first invocation. Best-effort, independent of
-    // the ledger-writer's own `loadManifest` call further down: a
-    // config/parse failure here degrades to `setup: false` (matches the
-    // sibling companions' "not configured -> skip" contract) rather than
-    // aborting the whole preflight run over an unrelated manifest problem,
-    // whereas the ledger-writer's later load failure DOES abort (existing
-    // behavior, unrelated to this change).
-    //
-    // Per-repo scoping (task c88461c1): an explicit `opts.project` (the
-    // CLI's `--project <name>`) still wins outright. Otherwise this
-    // producer derives a project name from `cwd` via the shared
-    // `deriveProjectName` helper (review round 2, decision D-021a:
-    // resolves to the MAIN checkout's directory name, the basename of
-    // the directory containing the repository's shared git common dir,
-    // so every linked worktree of one repository shares the same
-    // project layer, unlike `repo` above, which names the checkout
-    // directory itself and differs per worktree) and feeds it through
-    // the loader's EXISTING `LoaderOptions.project` mechanism
-    // (src/cli/loader.ts's `resolvePaths`/`applyLayers`), the same seam
-    // every other command's own `--project <name>` flag already uses.
-    // `explain-policy` and `doctor` derive the SAME name from the SAME
-    // helper (review round 2, decision D-021b), so all three consumers
-    // of `session_start_preflight.setup` agree on which layer applies to
-    // a given cwd. The `?? repo` fallback only matters when
-    // `deriveProjectName` returns null (an unreadable `.git` file); `cwd`
-    // is already known to sit inside a git work tree at this point (an
-    // empty `repo` already returned early above), so in practice this
-    // reduces to the checkout basename either way. A repo with no
-    // `<home>/projects/<name>/harness.overrides.yaml` on disk keeps the
-    // host-wide (base plus machine-layer) value: the loader resolves
-    // `projectLayer: null` when that file does not exist (loader.ts's
-    // `fs.existsSync` check), so nothing extra is merged in that case.
-    // See docs/CLI.md's `session_start_preflight.setup` Notes for the
-    // full rule.
-    const sessionStartPreflightProjectName = resolveScopedProjectName({
-        project: opts.project,
-        cwd,
-        fallback: repo,
-    });
-    const setupEnabled = (() => {
-        try {
-            const manifest = opts.manifest ??
-                loadManifest({ ...opts, project: sessionStartPreflightProjectName }).manifest;
-            return manifest.session_start_preflight.setup;
-        }
-        catch (err) {
-            // One diagnostic line naming the layer path (task c88461c1,
-            // review round 3 residual; task `1c4eb3ea`): a scoped-load
-            // failure here was silent everywhere before this task, degrading
-            // straight to `setup: false` with no trace of WHY. Best-effort:
-            // only fires when `!opts.manifest` (an injected manifest never
-            // reaches `loadManifest` above, so a throw from THAT branch would
-            // be a caller bug, not a layer failure) and only names the layer
-            // path when `resolvePaths` itself can resolve one (its own
-            // "refused to fall back to the real harness home dir" test-safety
-            // throw, see loader.ts, is swallowed here rather than surfaced as
-            // a misleading "layer failed to load" line).
-            //
-            // Lead-in describes the SCOPED LOAD, not "the project layer"
-            // (task 1c4eb3ea, round 2, D-027 item 5): `loadManifest` above
-            // merges the base manifest, every applicable machine-override
-            // layer, AND the project layer in one call, so a throw here can
-            // come from any of the three; `layerPath` below is only ever
-            // used to DECIDE whether to emit this line at all (a project
-            // layer must actually exist on disk to attribute the failure to
-            // project scoping at all) and as context in the message, never
-            // as the claimed culprit, so a base- or machine-layer parse
-            // failure with a valid, existing project layer no longer reads
-            // as "the project layer failed to load" when it did not.
-            // Multi-line YAML parse errors are collapsed to their FIRST line
-            // (D-027 item 5) so this stays the promised one diagnostic line.
-            if (!opts.manifest) {
-                try {
-                    const layerPath = resolvePaths({
-                        ...opts,
-                        project: sessionStartPreflightProjectName,
-                    }).projectLayer;
-                    if (layerPath !== null) {
-                        const errMessage = err instanceof Error ? err.message : String(err);
-                        const errFirstLine = errMessage.split("\n")[0];
-                        note(`session_start_preflight.setup: the project-scoped manifest load for ` +
-                            `project ${sessionStartPreflightProjectName} failed (${errFirstLine}); ` +
-                            `degrading to setup: false (project layer: ${layerPath})`);
-                    }
-                }
-                catch {
-                    /* best-effort diagnostic only; setup:false below still happens */
-                }
-            }
-            return false;
-        }
-    })();
-    const runPreflight = opts.runPreflight ?? spawnPreflight;
-    const preflight = await runPreflight(cwd, preflightTimeoutMs, setupEnabled);
-    if (!preflight.ok) {
-        note(preflight.reason);
-        return done(false, repo, branch, sessionId, sessionSource, preflight.reason);
-    }
-    if (preflight.json.ready !== true) {
-        // defaultFailLogDir() now routes through resolvePaths(), which throws
-        // when neither homeDir nor configPath is injected and the real binary
-        // has not set HARNESS_ALLOW_REAL_GENERATED_DIR=1 (loader.ts:45-64,
-        // task 80f49922). Fold that into the same { ok: false, reason } shape
-        // persistFailLog already returns for a write failure — this producer
-        // must degrade, never throw (see file header).
-        const logDirResult = resolveFailLogDir(opts);
-        const persisted = logDirResult.ok
-            ? persistFailLog(preflight.json, repo, logDirResult.logDir)
-            : { ok: false, reason: logDirResult.reason };
-        if (!persisted.ok) {
-            note(`preflight fail-log write failed: ${persisted.reason}`);
-        }
-        const reason = describeNotReady(preflight.json, persisted.ok ? persisted.path : undefined);
-        note(`${reason} — leaving the preflight tag unwritten so the gate stays closed`);
-        return done(false, repo, branch, sessionId, sessionSource, reason);
-    }
-    const confidence = typeof preflight.json.confidence === "number"
-        ? preflight.json.confidence.toFixed(2)
-        : "?";
-    // Emit BOTH per-repo and per-branch tags in one fact: the requires
-    // evaluator substring-matches, so a single entry containing
-    // `preflight:${REPO}` and `preflight:${BRANCH}` satisfies both
-    // `preflight-before-investigation` (REPO, within 1h) and
-    // `preflight-before-push` (BRANCH, within 10m). Caveat: a SessionStart
-    // producer cannot keep the 10m push window fresh through a long
-    // session — a push-time refresh is a separate concern (see task notes).
-    // On a detached HEAD `branch` is "" — only the REPO tag is written.
-    // `head:<sha>` is appended when resolveGitContext returned a sha (loose
-    // ref read or packed-refs fallback succeeded, or detached HEAD held a
-    // raw sha). The at_head requires-flag relies on this token to satisfy
-    // the gate at the recorded HEAD regardless of `within`; consumers that
-    // ignore the flag continue to work because the token is ignored by
-    // substring-match logic.
-    const tags = branch.length > 0 ? `preflight:${repo} preflight:${branch}` : `preflight:${repo}`;
-    const headSuffix = sha.length > 0 ? ` head:${sha}` : "";
-    const content = `${tags} ready:true confidence:${confidence}${headSuffix}`;
-    let writeLedger = opts.writeLedger;
-    if (!writeLedger) {
-        let manifest;
-        try {
-            // Second `loadManifest(opts)` call of this run (task 30183330); the
-            // `setupEnabled` resolution earlier in this function is the first.
-            // Deliberately NOT reused, and deliberately NOT reading
-            // `opts.manifest`: a failure here ABORTS the whole run (the catch
-            // below returns early with no ledger write attempted), while the
-            // `setupEnabled` call's failure degrades to `setup: false` and lets
-            // the run proceed. One shared load could carry both outcomes (a
-            // captured result plus its error), but two local try/catch blocks
-            // keep each site's failure handling obvious where it is read, and
-            // the second load is cheap; that is the whole reason for the repeat.
-            //
-            // Deliberately plain `opts` here (no `project: deriveProjectName(cwd)
-            // ?? repo`, unlike the `setupEnabled` load above, task c88461c1):
-            // this manifest only feeds `resolveManifestLedgerWriter` below, which
-            // reads the ledger-writer wiring (`tools.mcp[]` / grounding config),
-            // not `session_start_preflight`. The per-repo project layer exists
-            // to scope THAT key; routing it through this unrelated load would
-            // let a project layer silently reach ledger-writer config it was
-            // never meant to touch, for zero benefit to this call site.
-            manifest = loadManifest(opts).manifest;
-        }
-        catch (err) {
-            const reason = `manifest load failed: ${err.message}`;
-            note(reason);
-            return done(false, repo, branch, sessionId, sessionSource, reason);
-        }
-        const resolved = resolveManifestLedgerWriter(manifest, {
-            ...(opts.ledgerTimeoutMs !== undefined ? { ledgerTimeoutMs: opts.ledgerTimeoutMs } : {}),
-        });
-        if (!resolved.ok) {
-            const reason = `${resolved.reason}; cannot record preflight tag`;
-            note(reason);
-            return done(false, repo, branch, sessionId, sessionSource, reason);
-        }
-        writeLedger = resolved.write;
-    }
-    const result = await writeLedger({ sessionId, content, source: LEDGER_SOURCE });
-    if (!result.ok) {
-        const reason = `ledger write failed: ${result.reason ?? "unknown error"}`;
-        note(reason);
-        return done(false, repo, branch, sessionId, sessionSource, reason);
-    }
-    note(`recorded ${content} for session ${sessionId}`);
-    if (sessionSource === "default") {
-        // Loud-warn: the tag landed under the literal "default" session, which
-        // no `preflight-before-*` policy ever queries. The recorded line above
-        // can read as success; this second line is the actionable corrective.
-        note("WARNING: session resolved to the literal \"default\". preflight-before-* gates query " +
-            "the real Claude Code session id and will NOT see this tag. Pipe SessionStart event JSON " +
-            "on stdin, export $CLAUDE_SESSION_ID, or pass --session <id> for manual / scripted use.");
-    }
-    return done(true, repo, branch, sessionId, sessionSource);
-}
-//# sourceMappingURL=index.js.map

package/dist/cli/session-start/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/session-start/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,wEAAwE;AACxE,iEAAiE;AACjE,uEAAuE;AACvE,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AACxE,2EAA2E;AAC3E,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,mEAAmE;AAEnE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAC9E,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,GAIjB,MAAM,qBAAqB,CAAC;AAE7B,0CAA0C;AAC1C,iFAAiF;AACjF,sEAAsE;AACtE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;AACzC,8DAA8D;AAC9D,sEAAsE;AACtE,qEAAqE;AACrE,oEAAoE;AACpE,oEAAoE;AACpE,qEAAqE;AACrE,4DAA4D;AAC5D,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAC5C,MAAM,aAAa,GAAG,iCAAiC,CAAC;AAExD,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,mEAAmE;AACnE,uDAAuD;AACvD,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,eAAe,GAAG,YAAY,CAAC;AAwGrC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,YAA+B,OAAO,CAAC,GAAG;IAE1C,MAAM,GAAG,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IAC7B,OAAO,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,KAAc;IAC5D,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,GAAW,EACX,SAAiB,EACjB,KAAc;IAEd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CACN,aAAa,EACb,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,EAC9B;YACE,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,iBAAiB,EAAE;SACzB,EACD,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACd,kEAAkE;YAClE,gEAAgE;YAChE,kEAAkE;YAClE,2BAA2B;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,EAAE,CAAC,CAAC;gBACxE,CAAC;gBAAC,MAAM,CAAC;oBACP,oCAAoC;gBACtC,CAAC;YACH,CAAC;YACD,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,GAAG,GAAmD,CAAC;gBAC9D,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACxB,OAAO,OAAO,CAAC;wBACb,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,KAAK,aAAa,wDAAwD;qBACnF,CAAC,CAAC;gBACL,CAAC;gBACD,gEAAgE;gBAChE,0DAA0D;gBAC1D,IAAI,CAAC,CAAC,IAAI,KAAK,mCAAmC,EAAE,CAAC;oBACnD,OAAO,OAAO,CAAC;wBACb,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,KAAK,aAAa,+CAA+C;qBAC1E,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO,OAAO,CAAC;wBACb,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,KAAK,aAAa,0BAA0B,SAAS,IAAI;qBAClE,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,aAAa,kBAAkB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,OAAO,CAAC;gBACb,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,KAAK,aAAa,0CAA0C;aACrE,CAAC,CAAC;QACL,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,mEAAmE;AACnE,kEAAkE;AAClE,kEAAkE;AAClE,0DAA0D;AAC1D,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,MAAM,GAAG,oBAAoB;QAC1C,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,GAAG,CAAC,CAAC,GAAG;QAClD,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAmB,EAAE,OAAgB;IAC7D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;SAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC;QACnC,qEAAqE;QACrE,kEAAkE;QAClE,oEAAoE;QACpE,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,iEAAiE;QACjE,yCAAyC;QACzC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YACpF,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,KAAK,GACT,YAAY,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC;YACnD,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAC5D,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBACb,CAAC,CAAC,EAAE,CAAC;QACX,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,GAAG,IAAI,KAAK,MAAM,GAAG,CAAC;IAC/B,CAAC,CAAC,CAAC;IACL,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,OAAO,mCAAmC,UAAU,IAAI,UAAU,GAAG,SAAS,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAS,iBAAiB,CAAC,IAAmB;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CACxB,IAAkC;IAElC,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,KAAK,GAAG,EAAE;SACb,WAAW,CAAC,MAAM,CAAC;SACnB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,IAAI,KAAK,CAAC,MAAM,IAAI,kBAAkB;QAAE,OAAO;IAC/C,MAAM,SAAS,GAAG,KAAK;SACpB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAA0C,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;SACjE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,kBAAkB,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CACrB,IAAmB,EACnB,IAAY,EACZ,MAAc;IAEd,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,8GAA8G;QAC9G,QAAQ,GAAG,IAAI,CAAC,IAAI,CAClB,MAAM,EACN,GAAG,eAAe,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,SAAS,IAAI,MAAM,OAAO,CAC3F,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,CAAC;QACH,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAqC,EAAE;IAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;IACnF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,oCAAoC,GAAG,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CACX,KAAc,EACd,IAAY,EACZ,MAAc,EACd,SAAiB,EACjB,aAA2D,EAC3D,MAAe,EACc,EAAE,CAAC,CAAC;QACjC,QAAQ,EAAE,CAAC;QACX,KAAK;QACL,IAAI;QACJ,MAAM;QACN,SAAS;QACT,aAAa;QACb,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;KACxC,CAAC,CAAC;IAEH,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,IAAI,qBAAqB,CAAC;YACvE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YAC/D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAsB,CAAC;QACpE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,yBAA0B,GAAa,CAAC,OAAO,EAAE,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,sCAAsC,GAAG,yBAAyB,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,mEAAmE;IACnE,uEAAuE;IACvE,qEAAqE;IACrE,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,oBAAoB,CAAC;IACnE,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAE5E,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,sEAAsE;IACtE,mEAAmE;IACnE,mEAAmE;IACnE,IACE,aAAa,KAAK,SAAS;QAC3B,OAAO,IAAI,CAAC,oBAAoB,KAAK,UAAU,EAC/C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,mBAAmB,CAAC;gBACvC,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI;aACtC,CAAC,CAAC;YACH,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,8DAA8D;IAC9D,oEAAoE;IACpE,qEAAqE;IACrE,uEAAuE;IACvE,sEAAsE;IACtE,uCAAuC;IACvC,EAAE;IACF,oEAAoE;IACpE,gEAAgE;IAChE,4DAA4D;IAC5D,+DAA+D;IAC/D,kEAAkE;IAClE,mEAAmE;IACnE,6DAA6D;IAC7D,+DAA+D;IAC/D,kEAAkE;IAClE,0DAA0D;IAC1D,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,qEAAqE;IACrE,wDAAwD;IACxD,sEAAsE;IACtE,mEAAmE;IACnE,kEAAkE;IAClE,8DAA8D;IAC9D,oEAAoE;IACpE,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,aAAa;IACb,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;QAChE,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG;QACH,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ;gBACb,YAAY,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC,QAAQ,CAAC;YAChF,OAAO,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4DAA4D;YAC5D,2DAA2D;YAC3D,iEAAiE;YACjE,gEAAgE;YAChE,+DAA+D;YAC/D,kEAAkE;YAClE,iEAAiE;YACjE,2DAA2D;YAC3D,kEAAkE;YAClE,kEAAkE;YAClE,6CAA6C;YAC7C,EAAE;YACF,6DAA6D;YAC7D,+DAA+D;YAC/D,8DAA8D;YAC9D,gEAAgE;YAChE,6DAA6D;YAC7D,6DAA6D;YAC7D,gEAAgE;YAChE,+DAA+D;YAC/D,4DAA4D;YAC5D,+DAA+D;YAC/D,yDAAyD;YACzD,iEAAiE;YACjE,iEAAiE;YACjE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,YAAY,CAAC;wBAC7B,GAAG,IAAI;wBACP,OAAO,EAAE,gCAAgC;qBAC1C,CAAC,CAAC,YAAY,CAAC;oBAChB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;wBACvB,MAAM,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBACpE,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC/C,IAAI,CACF,sEAAsE;4BACpE,WAAW,gCAAgC,YAAY,YAAY,KAAK;4BACxE,6CAA6C,SAAS,GAAG,CAC5D,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,kEAAkE;gBACpE,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,cAAc,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAClC,sEAAsE;QACtE,sEAAsE;QACtE,mEAAmE;QACnE,sEAAsE;QACtE,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,SAAS,GAA+D,YAAY,CAAC,EAAE;YAC3F,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC;YAC3D,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,oCAAoC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3F,IAAI,CAAC,GAAG,MAAM,iEAAiE,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,UAAU,GACd,OAAO,SAAS,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ;QAC3C,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,GAAG,CAAC;IACV,mEAAmE;IACnE,4DAA4D;IAC5D,+DAA+D;IAC/D,yDAAyD;IACzD,uEAAuE;IACvE,gEAAgE;IAChE,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,mEAAmE;IACnE,yBAAyB;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,cAAc,MAAM,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/F,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,IAAI,0BAA0B,UAAU,GAAG,UAAU,EAAE,CAAC;IAE3E,IAAI,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACnC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,oEAAoE;YACpE,mEAAmE;YACnE,wDAAwD;YACxD,kEAAkE;YAClE,iEAAiE;YACjE,oEAAoE;YACpE,gEAAgE;YAChE,kEAAkE;YAClE,kEAAkE;YAClE,qEAAqE;YACrE,EAAE;YACF,sEAAsE;YACtE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,kEAAkE;YAClE,iEAAiE;YACjE,4DAA4D;YAC5D,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,yBAA0B,GAAa,CAAC,OAAO,EAAE,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,CAAC;YACb,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,+BAA+B,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,CAAC;YACb,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QACrE,CAAC;QACD,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,wBAAwB,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,YAAY,OAAO,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACrD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,IAAI,CACF,uFAAuF;YACrF,0FAA0F;YAC1F,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAC5D,CAAC"}