@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/cli/doctor/hook-liveness.js

@@ -0,0 +1,455 @@
+/**
+ * Hook liveness: are the hooks `harness apply` generates actually present in
+ * the live runtime config? Without this check a hook that exists only in the
+ * generated artefact (never installed, dropped by a hand edit) leaves its
+ * gate silently absent.
+ *
+ * Per runtime the generated hook entries are compared with the live config
+ * by (event, matcher, command):
+ * - Claude Code: `settings.json` under the `CLAUDE_CONFIG_DIR` resolution
+ *   `resolveSettingsPath` applies.
+ * - Codex: `~/.codex/config.toml`.
+ *
+ * Severity: a generated entry that is absent or carries another command is an
+ * error. An entry taken out by `harness gate disable` is a warning (the
+ * operator did it on purpose and can read it back from the recorded state:
+ * the live gate snapshot of either runtime). A Codex unit counts as disabled
+ * only when `harness gate enable --runtime codex` would restore it (an own
+ * snapshot that is not spent names it by id); an empty hooks array otherwise
+ * is a hand edit, so a missing error.
+ * The warning names the command that puts the entry back as that runtime's
+ * gate takes it: `harness gate enable` for Claude Code, with `--settings` when
+ * the compared file is not the one the gate targets by default (for example
+ * under `CLAUDE_CONFIG_DIR`) and `--force` when the gate would refuse the
+ * plain command (by its own refusal decision, `claudeEnableRefusal`: the file
+ * holds a group with the event and matcher of a removed one but other
+ * content, or it was edited since the disable and the still-missing groups do
+ * not add up to the pre-disable file); `harness gate enable --runtime codex`
+ * for Codex, with `--config` for a config other than the default one and
+ * `--force` when the config was edited since the disable (the restore refuses
+ * without it).
+ * A live hook that is not in the generated set is an info line, never counted.
+ * A live file that is missing or unreadable is one error finding, and so is a
+ * gate snapshot that cannot be read: the disabled state is then unknowable, so
+ * doctor fails closed and names the snapshot instead of guessing.
+ */
+import * as fs from "node:fs";
+import { parse as parseToml } from "smol-toml";
+import { expandPolicyPacks } from "../../policy-packs/index.js";
+import { generateCodexConfig } from "../apply/generate-codex-config.js";
+import { generateSettings } from "../apply/generate-settings.js";
+import { defaultCodexConfigPath, readCodexManagedHookUnits, } from "../apply/install-codex-config.js";
+import { CODEX_INSTALL_COMMAND, codexConfigFlag, latestInstall, planCodexRestore, readLiveCodexSnapshots, resolveCodexConfig, spentCodexSnapshot, } from "../gate/codex-snapshot.js";
+import { shellQuote } from "../shell-quote.js";
+import { claudeEnableRefusal, listLiveSnapshots, nextEnableSnapshots, parseSettingsHooks, planRestore, settingsFlag, sha256Hex, } from "../gate/snapshot.js";
+import { resolveSettingsPath } from "./claude-mcp.js";
+const keyId = (k) => JSON.stringify([k.event, k.matcher, k.command]);
+const slotId = (k) => JSON.stringify([k.event, k.matcher]);
+export function describeHook(k) {
+    return `${k.event} matcher ${k.matcher === null ? "(none)" : `"${k.matcher}"`} command ${k.command}`;
+}
+function isRecord(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+/** Flatten `{ [event]: [{ matcher?, hooks: [{ command }] }] }` into keys; malformed shapes are skipped. */
+function flattenHookTable(table) {
+    const out = [];
+    if (!isRecord(table))
+        return out;
+    for (const [event, groups] of Object.entries(table)) {
+        if (!Array.isArray(groups))
+            continue;
+        for (const group of groups) {
+            if (!isRecord(group))
+                continue;
+            const matcher = typeof group["matcher"] === "string" ? group["matcher"] : null;
+            const hooks = group["hooks"];
+            if (!Array.isArray(hooks))
+                continue;
+            for (const h of hooks) {
+                if (isRecord(h) && typeof h["command"] === "string") {
+                    out.push({ event, matcher, command: h["command"] });
+                }
+            }
+        }
+    }
+    return out;
+}
+export function expectedClaudeHooks(manifest) {
+    const hooks = [...manifest.hooks, ...expandPolicyPacks(manifest, "claude-code").hooks];
+    return flattenHookTable(generateSettings({ ...manifest, hooks }).hooks);
+}
+export function expectedCodexHooks(manifest) {
+    const hooks = [...manifest.hooks, ...expandPolicyPacks(manifest, "codex").hooks];
+    const text = generateCodexConfig({ ...manifest, hooks }).content;
+    const doc = parseToml(text);
+    return flattenHookTable(doc["hooks"]);
+}
+function fileFinding(message) {
+    return { kind: "file", status: "error", event: "", matcher: null, command: "", message };
+}
+/**
+ * Compare `expected` with `live`. `isDisabled` answers from the gate's own
+ * recorded state whether a missing entry was taken out by `harness gate disable`;
+ * `disabledMessage` words the warning for such an entry.
+ */
+function compare(expected, live, isDisabled, disabledMessage, liveLabel, fixHintFor) {
+    const out = [];
+    const liveIds = new Set(live.map(keyId));
+    const expectedIds = new Set(expected.map(keyId));
+    const extraOrDisabled = live.some((l) => !expectedIds.has(keyId(l))) ||
+        expected.some((e) => !liveIds.has(keyId(e)) && isDisabled(e));
+    const fixHint = fixHintFor({ extraOrDisabled });
+    const liveBySlot = new Map();
+    for (const l of live) {
+        const list = liveBySlot.get(slotId(l)) ?? [];
+        list.push(l);
+        liveBySlot.set(slotId(l), list);
+    }
+    for (const e of expected) {
+        if (liveIds.has(keyId(e))) {
+            out.push({ ...e, kind: "present", status: "ok", message: `present: ${describeHook(e)}` });
+            continue;
+        }
+        if (isDisabled(e)) {
+            out.push({ ...e, kind: "disabled", status: "warn", message: disabledMessage(e) });
+            continue;
+        }
+        const sameSlot = (liveBySlot.get(slotId(e)) ?? []).filter((l) => !expectedIds.has(keyId(l)));
+        if (sameSlot.length > 0) {
+            out.push({
+                ...e,
+                kind: "differing",
+                status: "error",
+                message: `differs in ${liveLabel}: expected ${describeHook(e)}, live has ` +
+                    `${sameSlot.map((l) => l.command).join(", ")}; ${fixHint}`,
+            });
+            continue;
+        }
+        out.push({
+            ...e,
+            kind: "missing",
+            status: "error",
+            message: `missing from ${liveLabel}: ${describeHook(e)}; ${fixHint}`,
+        });
+    }
+    const differingLive = new Set(out.filter((o) => o.kind === "differing").map((o) => slotId(o)));
+    for (const l of live) {
+        if (expectedIds.has(keyId(l)))
+            continue;
+        // A live entry that stands in for a generated one is reported by the
+        // differing line, not a second time as extra.
+        if (differingLive.has(slotId(l)))
+            continue;
+        out.push({
+            ...l,
+            kind: "extra",
+            status: "info",
+            message: `not generated by harness: ${describeHook(l)}`,
+        });
+    }
+    return out;
+}
+function readText(p, fixHint) {
+    try {
+        return { ok: true, text: fs.readFileSync(p, "utf8") };
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT") {
+            return { ok: false, message: `${p} not found; ${fixHint}` };
+        }
+        return { ok: false, message: `cannot read ${p}: ${err.message}` };
+    }
+}
+export function checkClaudeLiveHooks(manifest, settingsPath, opts = {}) {
+    const report = { runtime: "claude-code", livePath: settingsPath, entries: [] };
+    const expected = expectedClaudeHooks(manifest);
+    if (expected.length === 0)
+        return report;
+    const applyHint = `run \`harness apply --target ${shellQuote(settingsPath)} --merge\``;
+    const read = readText(settingsPath, applyHint);
+    if (!read.ok) {
+        report.entries.push(fileFinding(read.message));
+        return report;
+    }
+    let doc;
+    try {
+        doc = JSON.parse(read.text);
+    }
+    catch (err) {
+        report.entries.push(fileFinding(`${settingsPath} is not valid JSON: ${err.message}`));
+        return report;
+    }
+    if (!isRecord(doc)) {
+        report.entries.push(fileFinding(`${settingsPath} is not a JSON object`));
+        return report;
+    }
+    const live = flattenHookTable(doc["hooks"]);
+    // The gate's own record of what it took out: every live snapshot beside the
+    // file lists the removed groups. A snapshot that cannot be read leaves the
+    // disabled state unknowable: one error finding names it, and the missing
+    // entries point at it instead of at an apply that would not help.
+    const removed = [];
+    const snaps = listLiveSnapshots(settingsPath);
+    let snapshotProblem = false;
+    if (snaps.ok) {
+        for (const s of snaps.live) {
+            for (const r of s.snapshot.removed) {
+                removed.push(...flattenHookTable({ [r.event]: [r.group] }));
+            }
+        }
+    }
+    else {
+        snapshotProblem = true;
+        report.entries.push(fileFinding(`cannot read the gate snapshot ${snaps.path}: ${snaps.reason}; ` +
+            "a hook taken out by `harness gate disable` cannot be told from a missing one until it is readable " +
+            "(fix or move the snapshot aside)"));
+    }
+    const removedIds = new Set(removed.map(keyId));
+    // The gate does not read CLAUDE_CONFIG_DIR: any other file than its default needs --settings.
+    const enable = `harness gate enable${settingsPath === opts.gateDefaultPath ? "" : ` ${settingsFlag(settingsPath)}`}`;
+    // A disabled hook comes back with `gate enable` alone, or with `gate enable
+    // --force`, by the gate's own decision: when the gate refuses the snapshot
+    // the next plain call applies without `--force`, that snapshot marks every
+    // group it removed, so the warning names the flag exactly when the plain
+    // command would refuse and say why.
+    const forceOf = claudeEnableForce(read.text, doc, snaps.ok ? snaps.live : []);
+    report.entries.push(...compare(expected, live, (k) => removedIds.has(keyId(k)), (k) => {
+        const head = `disabled via \`harness gate disable\`: ${describeHook(k)}; `;
+        const force = forceOf.get(keyId(k));
+        if (force === undefined)
+            return `${head}run \`${enable}\` to put it back`;
+        // An edit since the disable is a fact about the file, true for every
+        // hook; a changed group is a fact about the refusing snapshot's own
+        // removed groups, so a hook only another live snapshot removed must
+        // name the refusing snapshot instead of claiming such a group stands
+        // in for ITS removed one.
+        const reason = force.reason !== "changed-group"
+            ? "settings.json was edited since the disable"
+            : force.removedByRefusing
+                ? "settings.json holds a group with the event and matcher of the removed one but other content"
+                : "the snapshot the next `harness gate enable` applies refuses, because settings.json holds a group with the event and matcher of a group that snapshot removed, but other content";
+        return (`${head}run \`${enable} --force\` to put it back: ${reason}` +
+            `, so the restore refuses without \`--force\` (inspect the diff against ${force.settingsBackupPath} first)`);
+    }, "settings.json", ({ extraOrDisabled }) => snapshotProblem
+        ? "see the gate snapshot finding above"
+        : applyHint +
+            (extraOrDisabled
+                ? " (`--merge` replaces the hooks key: live hooks harness did not generate are lost, hooks " +
+                    "taken out by `harness gate disable` come back and the gate snapshot goes stale)"
+                : "")));
+    return report;
+}
+/**
+ * Why doctor must name `--force` for each group a live snapshot removed, by
+ * the gate's own decision and not a copy of it: the snapshots a plain
+ * `gate enable` applies next are the only refusal the operator is about to
+ * meet. `nextEnableSnapshots` answers which those are (the newest; an older
+ * one waits until that restore changed the file, so its own decision against
+ * this file is never what the next plain enable does). When one of them needs
+ * `--force`, the plain command refuses for every gate-disabled group, so
+ * every group any live snapshot removed is marked with that refusal, and the
+ * mark says whether the refusing snapshot itself removed the group: a changed
+ * group is a fact about that snapshot's own removed groups, so the warning
+ * for a group only an older snapshot removed must name the refusing snapshot
+ * rather than claim the changed group stands in for that group. A `hooks`
+ * shape the gate refuses to read marks nothing: that refusal is not one of
+ * the two `--force` answers this warning could name.
+ */
+function claudeEnableForce(text, doc, live) {
+    const out = new Map();
+    const parsedHooks = parseSettingsHooks(doc);
+    if (!parsedHooks.ok)
+        return out;
+    for (const { snapshot } of nextEnableSnapshots(live)) {
+        const reason = claudeEnableRefusal(sha256Hex(text), doc, planRestore(parsedHooks.hooks, snapshot), snapshot);
+        if (reason === null)
+            continue;
+        // The refusing snapshot first, so the "first one wins" below counts a
+        // group both it and an older snapshot removed as removed by the refusing
+        // one: the refusal's reason is then a fact about that group's own slot.
+        for (const named of [snapshot, ...live.map((s) => s.snapshot).filter((s) => s !== snapshot)]) {
+            for (const r of named.removed) {
+                for (const k of flattenHookTable({ [r.event]: [r.group] })) {
+                    if (!out.has(keyId(k))) {
+                        out.set(keyId(k), {
+                            reason,
+                            settingsBackupPath: snapshot.settingsBackupPath,
+                            removedByRefusing: named === snapshot,
+                        });
+                    }
+                }
+            }
+        }
+        break;
+    }
+    return out;
+}
+export function checkCodexLiveHooks(manifest, configPath, opts = {}) {
+    const report = { runtime: "codex", livePath: configPath, entries: [] };
+    const expected = expectedCodexHooks(manifest);
+    if (expected.length === 0)
+        return report;
+    const namedPath = configPath === opts.gateDefaultPath ? null : configPath;
+    const fixHint = `run \`${CODEX_INSTALL_COMMAND}${codexConfigFlag(namedPath, "--codex-config")}\``;
+    const read = readText(configPath, fixHint);
+    if (!read.ok) {
+        report.entries.push(fileFinding(read.message));
+        return report;
+    }
+    let doc;
+    try {
+        doc = parseToml(read.text);
+    }
+    catch (err) {
+        report.entries.push(fileFinding(`${configPath} is not valid TOML: ${err.message}`));
+        return report;
+    }
+    const live = flattenHookTable(doc["hooks"]);
+    // The gate neutralises a unit in place (`hooks = []`) and records it in an
+    // own snapshot beside the config. A unit counts as disabled only when
+    // `harness gate enable --runtime codex` would restore it: the unit is still
+    // neutralised in the block, an own snapshot names it by id, that snapshot is
+    // not spent (the gate's own predicate: an install re-rendered the block
+    // after it, the config is back at its pre-disable state, or it names units
+    // that were deleted), the restore plan holds and does not hit the refusal
+    // for an unedited config. The original hooks text must carry the expected
+    // command. An empty array without that record is a hand edit and stays a
+    // missing error, since `gate enable` could not put it back. A config edited
+    // since the disable is restored only with `--force`, so the warning says so.
+    let snapshotProblem = false;
+    let ownSnapshots = [];
+    try {
+        ownSnapshots = readLiveCodexSnapshots(configPath, (m) => new Error(m), namedPath).own;
+    }
+    catch (err) {
+        snapshotProblem = true;
+        report.entries.push(fileFinding(`cannot read the gate snapshot beside ${configPath}: ${err.message} ` +
+            "A hook taken out by `harness gate disable` cannot be told from a missing one until it is readable."));
+    }
+    const disabledUnits = [];
+    if (ownSnapshots.length > 0) {
+        disabledUnits.push(...restorableCodexUnits(read.text, configPath, ownSnapshots));
+    }
+    const recordsOf = (k) => disabledUnits.filter((d) => keyId(d.key) === keyId(k));
+    const enable = `harness gate enable --runtime codex${codexConfigFlag(namedPath)}`;
+    const disabledMessage = (k) => {
+        const head = `disabled via \`harness gate disable --runtime codex\`: ${describeHook(k)}; `;
+        const edited = recordsOf(k).find((d) => d.needsForce);
+        return edited === undefined
+            ? `${head}run \`${enable}\` to put it back`
+            : `${head}run \`${enable} --force\` to put it back: the config was edited since the disable, so the ` +
+                `restore refuses without \`--force\` (inspect the diff against ${edited.configBackupPath} first)`;
+    };
+    report.entries.push(...compare(expected, live, (k) => recordsOf(k).length > 0, disabledMessage, "config.toml", () => (snapshotProblem ? "see the gate snapshot finding above" : fixHint)));
+    return report;
+}
+/**
+ * The hooks `harness gate enable --runtime codex` would put back into `text`,
+ * by the gate's own rules (the same predicates, not a re-implementation): a
+ * snapshot that is spent is skipped (enable only retires it), a restore plan
+ * that fails restores nothing, and neither does the refusal for a config that
+ * is exactly what the snapshot left behind but does not rebuild its pre-disable
+ * sha. Units match by id only, like the restore.
+ */
+function restorableCodexUnits(text, configPath, snapshots) {
+    let units;
+    let generation;
+    try {
+        const block = readCodexManagedHookUnits(text, configPath);
+        units = block?.units ?? null;
+        generation = block?.generation ?? null;
+    }
+    catch {
+        // A block the scanner refuses yields no record; the entry stays a plain missing error.
+        return [];
+    }
+    let requestedPath = configPath;
+    let resolvedPath = configPath;
+    try {
+        const resolved = resolveCodexConfig({ configPath }, (m) => new Error(m));
+        requestedPath = resolved.requestedPath;
+        resolvedPath = resolved.configPath;
+    }
+    catch {
+        // A dangling link: the install backups are looked for beside the path as given.
+    }
+    const install = latestInstall(requestedPath, resolvedPath);
+    const sha = sha256Hex(text);
+    const out = [];
+    for (const live of snapshots) {
+        const { snapshot } = live;
+        const spent = spentCodexSnapshot(snapshot, sha, units, install, generation);
+        if (spent.retire !== null)
+            continue;
+        const plan = planCodexRestore(text, units, configPath, live);
+        if (!plan.ok)
+            continue;
+        if (sha === snapshot.configAfterSha256 && sha256Hex(plan.text) !== snapshot.configBeforeSha256)
+            continue;
+        // An unedited config that the restore does not rebuild was skipped above, so a restore that does not
+        // rebuild the pre-disable bytes here is one on an edited config: the gate makes it only under --force.
+        const needsForce = sha256Hex(plan.text) !== snapshot.configBeforeSha256;
+        for (const restored of plan.restored) {
+            for (const command of snapshotCommands(restored.hooksText)) {
+                out.push({
+                    key: { event: restored.event, matcher: restored.matcher, command },
+                    needsForce,
+                    configBackupPath: snapshot.configBackupPath,
+                });
+            }
+        }
+    }
+    return out;
+}
+/** The commands in a snapshot's original `hooks = [...]` line; none when it does not parse. */
+function snapshotCommands(hooksText) {
+    try {
+        const doc = parseToml(hooksText);
+        const hooks = doc["hooks"];
+        return Array.isArray(hooks)
+            ? hooks.flatMap((h) => (isRecord(h) && typeof h["command"] === "string" ? [h["command"]] : []))
+            : [];
+    }
+    catch {
+        return [];
+    }
+}
+export function buildHookLiveness(manifest, opts) {
+    const runtimes = [];
+    if (opts.runtimes.includes("claude-code")) {
+        // `harness gate enable` without --settings targets `~/.claude/settings.json`; it does not read CLAUDE_CONFIG_DIR.
+        runtimes.push(checkClaudeLiveHooks(manifest, resolveSettingsPath(opts.home, opts.env), {
+            gateDefaultPath: resolveSettingsPath(opts.home, {}),
+        }));
+    }
+    if (opts.runtimes.includes("codex")) {
+        const defaultConfig = defaultCodexConfigPath(opts.home);
+        runtimes.push(checkCodexLiveHooks(manifest, opts.codexConfigPath ?? defaultConfig, { gateDefaultPath: defaultConfig }));
+    }
+    return { runtimes };
+}
+export function countHookLiveness(section) {
+    let errorCount = 0;
+    let warningCount = 0;
+    for (const r of section.runtimes) {
+        for (const e of r.entries) {
+            if (e.status === "error")
+                errorCount++;
+            else if (e.status === "warn")
+                warningCount++;
+        }
+    }
+    return { errorCount, warningCount };
+}
+/** The runtimes whose live config doctor compares: the one a plain apply selects, plus Codex under `--target codex`. */
+export function livenessRuntimes(selected, target) {
+    const out = [];
+    if (selected === "claude-code")
+        out.push("claude-code");
+    if (selected === "codex" || target === "codex")
+        out.push("codex");
+    return out;
+}
+//# sourceMappingURL=hook-liveness.js.map

package/dist/cli/doctor/hook-liveness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-liveness.js","sourceRoot":"","sources":["../../../src/cli/doctor/hook-liveness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAEL,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,aAAa,EAEb,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACL,mBAAmB,EAGnB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,SAAS,GACV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAmDtD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACtF,MAAM,MAAM,GAAG,CAAC,CAAqC,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAEvG,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,OAAO,GAAG,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;AACvG,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,2GAA2G;AAC3G,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC/B,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACpD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAkB;IACpD,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC;IACvF,OAAO,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAkB;IACnD,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjE,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CACd,QAA4B,EAC5B,IAAwB,EACxB,UAAmC,EACnC,eAAuC,EACvC,SAAiB,EACjB,UAAyD;IAEzD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,MAAM,eAAe,GACnB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1F,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClF,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,CAAC;gBACJ,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,OAAO;gBACf,OAAO,EACL,cAAc,SAAS,cAAc,YAAY,CAAC,CAAC,CAAC,aAAa;oBACjE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE;aAC7D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,CAAC;YACJ,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,gBAAgB,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE;SACrE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAChE,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACxC,qEAAqE;QACrE,8CAA8C;QAC9C,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,CAAC;YACJ,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,6BAA6B,YAAY,CAAC,CAAC,CAAC,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CACf,CAAS,EACT,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,eAAe,OAAO,EAAE,EAAE,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAkB,EAClB,YAAoB,EACpB,OAA6B,EAAE;IAE/B,MAAM,MAAM,GAA8B,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC1G,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,gCAAgC,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC;IACvF,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,YAAY,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjG,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,YAAY,uBAAuB,CAAC,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CACjB,WAAW,CACT,iCAAiC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI;YAC9D,oGAAoG;YACpG,kCAAkC,CACrC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,8FAA8F;IAC9F,MAAM,MAAM,GAAG,sBAAsB,YAAY,KAAK,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;IACrH,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,MAAM,CAAC,OAAO,CAAC,IAAI,CACjB,GAAG,OAAO,CACR,QAAQ,EACR,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAC/B,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,IAAI,GAAG,0CAA0C,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,GAAG,IAAI,SAAS,MAAM,mBAAmB,CAAC;QAC1E,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,0BAA0B;QAC1B,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,KAAK,eAAe;YAC9B,CAAC,CAAC,4CAA4C;YAC9C,CAAC,CAAC,KAAK,CAAC,iBAAiB;gBACvB,CAAC,CAAC,6FAA6F;gBAC/F,CAAC,CAAC,iLAAiL,CAAC;QAC1L,OAAO,CACL,GAAG,IAAI,SAAS,MAAM,8BAA8B,MAAM,EAAE;YAC5D,0EAA0E,KAAK,CAAC,kBAAkB,SAAS,CAC5G,CAAC;IACJ,CAAC,EACD,eAAe,EACf,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,CACtB,eAAe;QACb,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,SAAS;YACT,CAAC,eAAe;gBACd,CAAC,CAAC,0FAA0F;oBAC1F,iFAAiF;gBACnF,CAAC,CAAC,EAAE,CAAC,CACd,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,iBAAiB,CACxB,IAAY,EACZ,GAA4B,EAC5B,IAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmG,CAAC;IACvH,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAChC,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7G,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC7F,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC3D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;4BAChB,MAAM;4BACN,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;4BAC/C,iBAAiB,EAAE,KAAK,KAAK,QAAQ;yBACtC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAkB,EAClB,UAAkB,EAClB,OAA6B,EAAE;IAE/B,MAAM,MAAM,GAA8B,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClG,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1E,MAAM,OAAO,GAAG,SAAS,qBAAqB,GAAG,eAAe,CAAC,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC;IAClG,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,UAAU,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/F,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,2EAA2E;IAC3E,sEAAsE;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,YAAY,GAA0B,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,YAAY,GAAG,sBAAsB,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CACjB,WAAW,CACT,wCAAwC,UAAU,KAAM,GAAa,CAAC,OAAO,GAAG;YAC9E,oGAAoG,CACvG,CACF,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAA0B,EAAE,CAAC;IAChD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,aAAa,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,CAAU,EAAyB,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,sCAAsC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;IAClF,MAAM,eAAe,GAAG,CAAC,CAAU,EAAU,EAAE;QAC7C,MAAM,IAAI,GAAG,0DAA0D,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACtD,OAAO,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,GAAG,IAAI,SAAS,MAAM,mBAAmB;YAC3C,CAAC,CAAC,GAAG,IAAI,SAAS,MAAM,6EAA6E;gBACjG,iEAAiE,MAAM,CAAC,gBAAgB,SAAS,CAAC;IAC1G,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,IAAI,CACjB,GAAG,OAAO,CACR,QAAQ,EACR,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAC9B,eAAe,EACf,aAAa,EACb,GAAG,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,OAAO,CAAC,CAC1E,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,IAAY,EACZ,UAAkB,EAClB,SAAyC;IAEzC,IAAI,KAAoC,CAAC;IACzC,IAAI,UAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1D,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC;QAC7B,UAAU,GAAG,KAAK,EAAE,UAAU,IAAI,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,uFAAuF;QACvF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,aAAa,GAAG,UAAU,CAAC;IAC/B,IAAI,YAAY,GAAG,UAAU,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;QACvC,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,SAAS;QACvB,IAAI,GAAG,KAAK,QAAQ,CAAC,iBAAiB,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,kBAAkB;YAAE,SAAS;QACzG,qGAAqG;QACrG,uGAAuG;QACvG,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,kBAAkB,CAAC;QACxE,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,KAAK,MAAM,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,IAAI,CAAC;oBACP,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE;oBAClE,UAAU;oBACV,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACzB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAkB,EAAE,IAAyB;IAC7E,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1C,kHAAkH;QAClH,QAAQ,CAAC,IAAI,CACX,oBAAoB,CAAC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;YACvE,eAAe,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;SACpD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,QAAQ,CAAC,IAAI,CACX,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,IAAI,aAAa,EAAE,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;gBAAE,UAAU,EAAE,CAAC;iBAClC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;gBAAE,YAAY,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACtC,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,gBAAgB,CAAC,QAAiB,EAAE,MAA0B;IAC5E,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,IAAI,QAAQ,KAAK,aAAa;QAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cli/doctor/index.d.ts

@@ -1,12 +1,9 @@
 import { type McpProbe } from "../../probes/mcp.js";
-import type { Manifest } from "../../schema/index.js";
-import { type GitIgnoreProbe } from "../validate/checks.js";
+import { type Manifest } from "../../schema/index.js";
 import { type LoaderOptions } from "../loader.js";
 import { type RunCodexCheckOptions } from "./codex.js";
 import { type RunOpencodeCheckOptions } from "./opencode.js";
 import { type NpmExec } from "./npm-bin-path.js";
-import { type RogueLedgerScanOptions } from "./rogue-ledger.js";
-import { type RunDoctorToolchainParityOptions } from "./toolchain-parity.js";
 import type { ClaudeMcpExec } from "../../io/claude-mcp.js";
 import { isDoctorTarget, KNOWN_DOCTOR_TARGETS, type DoctorReport, type DoctorTarget } from "./types.js";
 export interface DoctorOptions extends LoaderOptions {
@@ -17,11 +14,12 @@ export interface DoctorOptions extends LoaderOptions {
     now?: Date;
     homeOverride?: string;
     /**
-     * Phase 6 #6 follow-up: when set to `codex`, run the harness-side
-     * codex adapter health checks in addition to the default suite.
-     * Future runtimes plug in here without restructuring the surface.
-     * Restricted to targets that have a wired adapter-health module
-     * (today: `codex`); see `KNOWN_DOCTOR_TARGETS`.
+     * Phase 6 #6 follow-up: when set to `codex` or `opencode`, run the
+     * harness-side adapter health checks for that target in addition to
+     * the default suite. Future runtimes plug in here without
+     * restructuring the surface. Restricted to targets that have a wired
+     * adapter-health module (today: `codex` and `opencode`); see
+     * `KNOWN_DOCTOR_TARGETS`.
      */
     target?: DoctorTarget;
     /** Test-injection knobs forwarded to the codex target evaluator. */
@@ -29,11 +27,10 @@ export interface DoctorOptions extends LoaderOptions {
     /** Test-injection knobs forwarded to the opencode target evaluator. */
     opencodeCheckOptions?: Partial<RunOpencodeCheckOptions>;
     /**
-     * Test-injection knobs for the rogue-ledger scan. `homeDir` and `cwd`
-     * default to the runtime values resolved inside `doctor`; tests
-     * usually override both plus `fsInterface`.
+     * Test-injection knob for the hook-liveness check: the Codex config to
+     * compare. Defaults to `~/.codex/config.toml` under the operator home.
      */
-    rogueLedgerScanOptions?: Partial<RogueLedgerScanOptions>;
+    codexLiveConfigPath?: string;
     /**
      * Test-injection knob for the npm global-bin PATH check (task
      * 4ddd78ed). Tests fake the `npm prefix -g` invocation by passing a
@@ -41,18 +38,10 @@ export interface DoctorOptions extends LoaderOptions {
      * this and the real `npm` is spawned.
      */
     npmBinExec?: NpmExec;
-    /**
-     * Test-injection knob for the solution-acceptance knob-ignored check
-     * (task 24f6ceb9). Defaults to a real `git check-ignore` probe against
-     * the process cwd; `shallow` runs degrade it to `() => null` (no spawn),
-     * mirroring how the version probe degrades. An explicit probe wins over
-     * `shallow` so tests can exercise the check without paying for spawns.
-     */
-    gitIgnoreProbe?: GitIgnoreProbe;
     /**
      * Test-injection knob for the claude-code MCP registration check (task
      * init-mcp-wiring-claude-code/T-003). Tests fake the `claude mcp list`
-     * spawn the same way `npmBinExec`/`gitIgnoreProbe` fake theirs;
+     * spawn the same way `npmBinExec` fakes theirs;
      * production omits this and the real `claude` CLI is spawned. The live
      * call itself is additionally gated on `!shallow` and at least one
      * enabled `tools.mcp[]` entry — see `buildClaudeMcpRegistration`.
@@ -60,49 +49,11 @@ export interface DoctorOptions extends LoaderOptions {
     claudeMcpExec?: ClaudeMcpExec;
     /**
      * Test-injection knob for env-dependent checks: the dead settings.json
-     * `mcpServers` block lookup (honors `CLAUDE_CONFIG_DIR`), and the
-     * understanding-gate mode env/config divergence advisory (task
-     * 24abdecb, reads `UNDERSTANDING_GATE_MODE`). Defaults to
+     * `mcpServers` block lookup (honors `CLAUDE_CONFIG_DIR`). Defaults to
      * `process.env`; tests inject `{}` (or specific values) to stay
      * hermetic against the operator's real env.
      */
     envOverride?: NodeJS.ProcessEnv;
-    /**
-     * Test-injection knobs for the toolchain-parity comparison (task
-     * 13919613). Mirrors `codexCheckOptions`/`opencodeCheckOptions`: tests
-     * inject `runNodeVersion`/`runNpmGlobals`/`readOwKitVersion`/
-     * `readMcpServerNames` to fake the reused session-start Collector
-     * without a real spawn (see the hermetic-spawn-guard doc on those
-     * collectors); production omits this and the real collectors run,
-     * gated the same way `--shallow` gates every other live-spawn check.
-     */
-    toolchainParityOptions?: Partial<RunDoctorToolchainParityOptions>;
-    /**
-     * Window size for the understanding-gate auto-approval doctor listing
-     * (ADR docs/decisions/2026-08-27-ug-auto-mode-approval.md slice 1,
-     * agent-tasks 74b4b17d): how many of the newest `.approvals/` session
-     * markers to scan for the "auto approvals in the last N sessions"
-     * metric. Defaults to {@link DEFAULT_RECENT_SESSIONS}. Must be an
-     * integer >= 1; `doctor()` throws otherwise (mirrors the CLI's own
-     * `--recent-sessions` validation, but also covers direct/programmatic
-     * callers that bypass the CLI parser).
-     */
-    recentSessions?: number;
-    /**
-     * cwd the two project-scoped settings-drift candidates
-     * (`.claude/settings.json`, `.claude/settings.local.json`) resolve
-     * against, mirroring how `harness apply --target <relative path>`
-     * resolves its own target (`resolveTargetPath` in apply.ts, which
-     * calls bare `path.resolve`). Defaults to `process.cwd()`; tests
-     * inject a fixture dir to stay hermetic against the real cwd.
-     *
-     * Also the cwd `session_start_preflight.setup`'s per-repo project
-     * layer is derived from when `opts.project` is absent (task
-     * c88461c1, review round 2, decision D-021b), via the same
-     * `deriveProjectName` helper `harness session-start preflight` and
-     * `harness explain-policy` feed their own `loadManifest` calls from.
-     */
-    cwd?: string;
 }
 export { isDoctorTarget, KNOWN_DOCTOR_TARGETS };
 /** One unresolved `tools.mcp[]` / `tools.cli[]` binary from `checkBinResolution`. */
@@ -143,37 +94,12 @@ export declare function formatBinResolutionIssues(report: BinResolutionReport):
 /**
  * Wraps a version probe with a per-full-argv cache, keyed on
  * `JSON.stringify(cmd)` so two commands sharing only `cmd[0]` (e.g.
- * `["understanding-gate", "--version"]` vs. `["understanding-gate",
- * "--check"]`) are never conflated into the same cache slot; only a
+ * `["some-bin", "--version"]` vs. `["some-bin", "--check"]`) are never conflated into the same cache slot; only a
  * byte-identical argv array is deduped. Exported standalone (task
  * ab634898) so this caching contract has its own focused
  * unit test independent of any particular pack's hook shape.
  */
 export declare function memoizeVersionProbe(probe: (cmd: readonly string[]) => string | null): (cmd: readonly string[]) => string | null;
-/**
- * Declared-but-not-live policy pack check. `expandPolicyPacks` silently
- * skips a pack whose `source:` token is unrecognised or whose builtin
- * `name:` doesn't resolve in the registry — its hooks never reach
- * `settings.json`, so the operator's gate is inert. Surface each gap
- * as a doctor error so the misconfig is impossible to miss.
- *
- * Skipped (`enabled: false`) packs are NOT checked: they're not
- * expected to be live, and flagging them would flood the report.
- */
-/**
- * Sentinel "cannot tell" probe: shallow runs answer every ignoredness
- * question with `null` instead of spawning `git check-ignore`. Exported
- * (with the resolver below) so a test can pin the no-spawn contract by
- * identity instead of mocking `node:child_process`.
- */
-export declare const NULL_GIT_IGNORE_PROBE: GitIgnoreProbe;
-/**
- * Probe resolution order: an explicit (test) probe always wins; `shallow`
- * degrades to the no-spawn sentinel, mirroring how the npm-bin probe and
- * MCP probes degrade; otherwise the real `git check-ignore` probe runs
- * against the process cwd.
- */
-export declare function resolveGitIgnoreProbe(opts: Pick<DoctorOptions, "gitIgnoreProbe" | "shallow">): GitIgnoreProbe;
 export declare function doctor(opts?: DoctorOptions): Promise<DoctorReport>;
 export { format } from "./format.js";
 export type * from "./types.js";