@massa-ai/core 1.2.1

package/dist/services/executor/executor.js

@@ -0,0 +1,518 @@
+/**
+ * PolyglotExecutor — spawn user code in a detected runtime.
+ *
+ * Approach ported from context-mode `PolyglotExecutor` (rewritten fresh in TS;
+ * no source copied). One temp script is written per language, the resolved
+ * runtime is spawned with it, stdout/stderr are streamed to a byte cap, and a
+ * timeout kills the whole process group on expiry.
+ *
+ * SECURITY / TRUST MODEL (read before extending):
+ *   massa-ai is a LOCAL-DEV tool. `execute` / `execute_file` run
+ *   USER-SUPPLIED code ON THE HOST — there is no OS-level sandbox (no
+ *   seccomp, no namespaces, no cgroups). Containment is BEST-EFFORT:
+ *     - default `cwd` is the caller's project root (so relative paths resolve
+ *       naturally), but the code can still read/write anywhere the host user
+ *       can. Document this; do not imply isolation.
+ *     - timeouts are enforced (default 30s, cap 300s) and kill the process
+ *       GROUP so orphaned children cannot outlive a killed parent.
+ *     - a runtime-injection env denylist strips known code-injection vectors
+ *       (NODE_OPTIONS, LD_PRELOAD, BASH_ENV, …) from the inherited env.
+ *     - `execute_file` additionally enforces a project-boundary check plus a
+ *       deny-glob guard so it won't read paths outside cwd or sensitive
+ *       patterns by default.
+ *   For multi-tenant or untrusted input, this executor is NOT sufficient —
+ *   wrap it in a real container/VM.
+ */
+import { spawn, execSync, execFileSync } from "node:child_process";
+import { mkdtempSync, writeFileSync, rmSync, realpathSync } from "node:fs";
+import { join, resolve, isAbsolute, relative } from "node:path";
+import { tmpdir } from "node:os";
+import { detectRuntimes, buildCommand, SCRIPT_EXT, } from "./runtime.js";
+import { getSandboxMode, wrapSpawn } from "./sandbox.js";
+const isWin = process.platform === "win32";
+/**
+ * Default + hard-cap timeout. The default (30s) is conservative on purpose —
+ * most sandbox probes (print, parse, count) finish in <1s. The hard cap
+ * (300s) bounds runaway builds/installs invoked from user code.
+ */
+export const DEFAULT_TIMEOUT_MS = 30_000;
+export const MAX_TIMEOUT_MS = 300_000;
+/** Combined stdout+stderr byte cap. Prevents `yes`/`/dev/urandom` OOMs. */
+export const DEFAULT_HARD_CAP_BYTES = 10 * 1024 * 1024; // 10MB
+/**
+ * Paths that `execute_file` refuses to read by default. Mirrors context-mode's
+ * deny-glob: secrets, credentials, host-private key material.
+ *
+ * Matching is conservative but anchored to reduce false positives:
+ *   - Patterns containing a path separator ("/") are matched as case-insensitive
+ *     SUBSTRINGS of the full path (these identify sensitive directories like
+ *     `.ssh/` wherever they appear).
+ *   - Separator-free patterns (filename markers like `.env`, `id_rsa`,
+ *     `credentials`) are matched against the path's BASENAME with a leading
+ *     word-boundary, so `my_credentials_notes.md` / `user_permissions.ts` are
+ *     NOT blocked while `.env`, `id_rsa`, `credentials.json`, and
+ *     `aws-credentials` still are.
+ */
+const DENY_PATH_PATTERNS = [
+    ".ssh/",
+    ".aws/",
+    ".gnupg/",
+    "id_rsa",
+    "id_ecdsa",
+    "id_ed25519",
+    ".env",
+    ".npmrc",
+    ".pypirc",
+    "credentials",
+    "secrets.json",
+    "secrets.yaml",
+    "secrets.yml",
+    ".netrc",
+];
+/**
+ * Test whether a (lowercased) absolute path matches a deny pattern. Directory
+ * patterns (containing "/") substring-match the full path; filename patterns
+ * match at a SEPARATOR boundary so a deny token embedded in a longer word
+ * (e.g. `my_credentials_notes.md`) is NOT flagged, while `aws-credentials`,
+ * `credentials.json`, `.env`, and `id_rsa.pub` still are.
+ *
+ * Boundary chars are `-`, `.`, `/`, and start-of-string. Underscore is treated
+ * as a WORD character (not a boundary), so `my_credentials_notes` does not
+ * match `credentials` — the token is part of a longer identifier.
+ */
+function matchesDenyPattern(lowerPath) {
+    for (const p of DENY_PATH_PATTERNS) {
+        if (p.includes("/")) {
+            if (lowerPath.includes(p))
+                return true;
+        }
+        else {
+            // Anchored regex: pattern must be preceded by start or a separator
+            // (not underscore) and followed by end or a separator.
+            const escaped = p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const re = new RegExp(`(?:^|[-./])${escaped}(?:$|[-./])`);
+            if (re.test(lowerPath))
+                return true;
+        }
+    }
+    return false;
+}
+/** Resolve a sandbox temp dir that is NOT under the project working tree. */
+function sandboxTmpDir() {
+    // Prefer the OS real temp dir; fall back to os.tmpdir() (may be overridden
+    // by TMPDIR but still outside the project in practice).
+    try {
+        return mkdtempSync(join(tmpdir(), ".massa-ai-exec-"));
+    }
+    catch {
+        return mkdtempSync(join("/tmp", ".massa-ai-exec-"));
+    }
+}
+/** Best-effort recursive removal; never throws (OS reclaims %TEMP%). */
+function cleanupTmpDir(tmpDir) {
+    try {
+        rmSync(tmpDir, {
+            recursive: true,
+            force: true,
+            maxRetries: isWin ? 8 : 2,
+            retryDelay: 100,
+        });
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/** Kill an entire process tree. Windows: taskkill /T; POSIX: kill the group. */
+function killTree(proc) {
+    if (!proc.pid)
+        return;
+    if (isWin) {
+        try {
+            execSync(`taskkill /F /T /PID ${proc.pid}`, { stdio: "pipe" });
+        }
+        catch {
+            /* already dead */
+        }
+    }
+    else {
+        try {
+            process.kill(-proc.pid, "SIGKILL"); // negative pid = whole group
+        }
+        catch {
+            /* already dead */
+        }
+    }
+}
+/**
+ * Build a child env that strips known code-injection vectors. The denylist is
+ * intentionally a focused subset of context-mode's larger list — every entry
+ * here is a documented RCE vector (startup scripts, module-path injection,
+ * dynamic-linker hijack, compiler substitution). Anything not on the list is
+ * inherited as-is (the code runs as the host user regardless).
+ */
+function buildSafeEnv(tmpDir) {
+    const DENIED = new Set([
+        // Shell startup / option injection
+        "BASH_ENV",
+        "ENV",
+        "PROMPT_COMMAND",
+        "ZDOTDIR",
+        // Node module/option injection
+        "NODE_OPTIONS",
+        "NODE_PATH",
+        // Python startup / stdlib override
+        "PYTHONSTARTUP",
+        "PYTHONHOME",
+        "PYTHONPATH",
+        // Ruby / Perl option + lib injection
+        "RUBYOPT",
+        "RUBYLIB",
+        "PERL5OPT",
+        "PERL5LIB",
+        "PERLLIB",
+        // Dynamic linker hijack (loads a .so/.dylib before all others)
+        "LD_PRELOAD",
+        "LD_LIBRARY_PATH",
+        "DYLD_INSERT_LIBRARIES",
+        "DYLD_LIBRARY_PATH",
+        // Compiler substitution
+        "RUSTC",
+        "RUSTC_WRAPPER",
+        "CC",
+        "CXX",
+    ]);
+    const env = {};
+    for (const [key, val] of Object.entries(process.env)) {
+        if (val !== undefined && !DENIED.has(key) && !key.startsWith("BASH_FUNC_")) {
+            env[key] = val;
+        }
+    }
+    env["TMPDIR"] = tmpDir;
+    env["LANG"] = env["LANG"] ?? "en_US.UTF-8";
+    env["PYTHONDONTWRITEBYTECODE"] = "1";
+    env["PYTHONUNBUFFERED"] = "1";
+    env["NO_COLOR"] = "1";
+    return env;
+}
+export class PolyglotExecutor {
+    #hardCapBytes;
+    #projectRootResolver;
+    #runtimes;
+    #backgroundedPids = new Set();
+    #deps;
+    constructor(opts) {
+        this.#hardCapBytes = opts?.hardCapBytes ?? DEFAULT_HARD_CAP_BYTES;
+        const pr = opts?.projectRoot;
+        this.#projectRootResolver =
+            typeof pr === "function" ? pr : typeof pr === "string" ? () => pr : () => process.cwd();
+        this.#runtimes = opts?.runtimes ?? detectRuntimes(opts?.deps);
+        this.#deps = opts?.deps;
+    }
+    get runtimes() {
+        return { ...this.#runtimes };
+    }
+    get projectRoot() {
+        return this.#projectRootResolver();
+    }
+    /**
+     * Kill all backgrounded processes (SIGTERM the group). Call on shutdown to
+     * prevent zombies / port conflicts.
+     */
+    cleanupBackgrounded() {
+        for (const pid of this.#backgroundedPids) {
+            try {
+                process.kill(isWin ? pid : -pid, "SIGTERM");
+            }
+            catch {
+                /* already dead */
+            }
+        }
+        this.#backgroundedPids.clear();
+    }
+    /**
+     * Run `code` in the chosen language's detected runtime.
+     *
+     * The script FILE lives in a sandbox tmpDir; the process CWD is the project
+     * root (or `cwd` override) so repo-relative paths resolve naturally.
+     */
+    async execute(opts) {
+        const { language, code, background = false } = opts;
+        const timeout = this.#clampTimeout(opts.timeout);
+        const tmpDir = sandboxTmpDir();
+        try {
+            const filePath = this.#writeScript(tmpDir, code, language);
+            const cmd = buildCommand(this.#runtimes, language, filePath);
+            if (cmd[0] === "__rust_compile_run__") {
+                // #compileAndRunRust owns tmpDir cleanup (it always removes the dir in
+                // a finally, since both the compile-failure and run paths return early).
+                return await this.#compileAndRunRust(filePath, tmpDir, timeout);
+            }
+            const cwd = opts.cwd ?? this.#projectRootResolver();
+            const result = await this.#spawn(cmd, cwd, tmpDir, timeout, background);
+            if (!result.backgrounded)
+                cleanupTmpDir(tmpDir);
+            return result;
+        }
+        catch (err) {
+            cleanupTmpDir(tmpDir);
+            throw err;
+        }
+    }
+    /**
+     * Read `path` into a sandboxed FILE_CONTENT var, then run `code` over it.
+     * Enforces project-boundary containment + deny-glob before execution so a
+     * stray path can't exfiltrate secrets by default.
+     *
+     * SYMLINK DEFENSE: the boundary + deny-glob checks run against the REALPATH
+     * of both the target file and the project root. A symlink inside the project
+     * root pointing to `/etc/passwd` or a non-deny-glob secrets file would
+     * otherwise pass both checks (its link path is under root and may not match
+     * a deny pattern), then `readFileSync` follows the symlink out of the
+     * project. Resolving symlinks first closes this bypass. If the target does
+     * not exist yet (realpathSync throws ENOENT), we fall back to the lexical
+     * absolute path so a missing-file error surfaces from the read, not a
+     * spurious "blocked" message.
+     */
+    async executeFile(opts) {
+        const { path: filePath, language, code } = opts;
+        const root = this.#projectRootResolver();
+        const absolutePath = resolve(root, filePath);
+        // Resolve symlinks on BOTH the target and the root so a symlinked target
+        // that escapes the (possibly symlinked) root is caught. realpathSync
+        // resolves the FULL chain of links to the canonical filesystem path.
+        let realPath;
+        let realRoot;
+        try {
+            realPath = realpathSync(absolutePath);
+        }
+        catch {
+            // Target doesn't exist (ENOENT) or is unreadable. Fall back to the
+            // lexical absolute path so the caller gets a clear "file not found"
+            // from the read attempt, not a misleading "blocked" error.
+            realPath = absolutePath;
+        }
+        try {
+            realRoot = realpathSync(root);
+        }
+        catch {
+            realRoot = root;
+        }
+        // Boundary: the realpath MUST stay under the realpath root. Resolves
+        // `../` traversal, absolute paths, AND symlink escapes alike.
+        const rel = relative(realRoot, realPath);
+        if (rel.startsWith("..") || isAbsolute(rel)) {
+            const err = {
+                stdout: "",
+                stderr: `Blocked: path "${filePath}" resolves outside the project root (${root}).`,
+                exitCode: 1,
+                timedOut: false,
+            };
+            return err;
+        }
+        // Deny-glob: refuse sensitive path patterns regardless of boundary. Check
+        // BOTH the lexical absolute path (catches a link named `.env` that points
+        // elsewhere) AND the realpath (catches a link pointing TO a secrets file).
+        if (matchesDenyPattern(absolutePath.toLowerCase()) || matchesDenyPattern(realPath.toLowerCase())) {
+            const err = {
+                stdout: "",
+                stderr: `Blocked: path "${filePath}" matches a deny-listed pattern (secrets/credentials).`,
+                exitCode: 1,
+                timedOut: false,
+            };
+            return err;
+        }
+        const wrappedCode = this.#wrapWithFileContent(absolutePath, language, code);
+        return this.execute({ ...opts, code: wrappedCode });
+    }
+    #clampTimeout(timeout) {
+        if (timeout === undefined)
+            return DEFAULT_TIMEOUT_MS;
+        // Guard against NaN/Infinity/non-positive: setTimeout(NaN) coerces to 1ms
+        // and kills the process immediately. Fall back to the default.
+        if (!Number.isFinite(timeout) || timeout <= 0)
+            return DEFAULT_TIMEOUT_MS;
+        return Math.min(timeout, MAX_TIMEOUT_MS);
+    }
+    #writeScript(tmpDir, code, language) {
+        let body = code;
+        // Go: wrap in a main package if the user didn't provide one.
+        if (language === "go" && !body.includes("package ")) {
+            body = `package main\n\nimport "fmt"\n\nfunc main() {\n${body}\n}\n`;
+        }
+        // PHP: needs an opening tag.
+        if (language === "php" && !body.trimStart().startsWith("<?")) {
+            body = `<?php\n${body}`;
+        }
+        const fp = join(tmpDir, `script.${SCRIPT_EXT[language]}`);
+        writeFileSync(fp, body, { encoding: "utf-8", mode: 0o700 });
+        return fp;
+    }
+    async #compileAndRunRust(srcPath, cwd, timeout) {
+        const binPath = srcPath.replace(/\.rs$/, isWin ? ".exe" : "");
+        // Compile rustc with its own (smaller) timeout so a hung compile can't
+        // consume the whole runtime budget.
+        try {
+            try {
+                execFileSync("rustc", [srcPath, "-o", binPath], {
+                    cwd,
+                    timeout: Math.min(timeout, 60_000),
+                    encoding: "utf-8",
+                    stdio: ["pipe", "pipe", "pipe"],
+                });
+            }
+            catch (err) {
+                const message = err instanceof Error
+                    ? (err.stderr ?? err.message)
+                    : String(err);
+                return {
+                    stdout: "",
+                    stderr: `Compilation failed:\n${message}`,
+                    exitCode: 1,
+                    timedOut: false,
+                };
+            }
+            return await this.#spawn([binPath], cwd, cwd, timeout, false);
+        }
+        finally {
+            // Always clean up the sandbox tmpDir (source + binary) regardless of
+            // compile success, compile failure, or runtime outcome. Without this,
+            // every Rust run leaked a `.massa-ai-exec-*` dir under /tmp.
+            cleanupTmpDir(cwd);
+        }
+    }
+    #spawn(cmd, cwd, sandboxTmpDir, timeout, background) {
+        return new Promise((res) => {
+            // OS-level sandbox (W7-08): wrap the command with platform-specific
+            // isolation. auto = use if available, fall back to best-effort (F1).
+            // The seatbelt profile uses realpathSync for project root (F2).
+            const sandboxMode = getSandboxMode();
+            const sandboxedCmd = wrapSpawn(cmd, cwd, sandboxTmpDir, sandboxMode);
+            const proc = spawn(sandboxedCmd[0], sandboxedCmd.slice(1), {
+                cwd,
+                stdio: ["ignore", "pipe", "pipe"],
+                env: buildSafeEnv(sandboxTmpDir),
+                // New process group on Unix so killTree() can kill all children.
+                detached: !isWin,
+                windowsHide: isWin,
+            });
+            let timedOut = false;
+            let resolved = false;
+            let capExceeded = false;
+            const stdoutChunks = [];
+            const stderrChunks = [];
+            let totalBytes = 0;
+            const timer = setTimeout(() => {
+                timedOut = true;
+                if (background) {
+                    // Detach: return partial output, keep the process running but tracked.
+                    resolved = true;
+                    if (proc.pid)
+                        this.#backgroundedPids.add(proc.pid);
+                    proc.unref();
+                    // Drain streams to no-op so the pipe doesn't fill + block the child.
+                    proc.stdout?.removeAllListeners("data");
+                    proc.stdout?.on("data", () => { });
+                    proc.stderr?.removeAllListeners("data");
+                    proc.stderr?.on("data", () => { });
+                    res({
+                        stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
+                        stderr: Buffer.concat(stderrChunks).toString("utf-8"),
+                        exitCode: 0,
+                        timedOut: true,
+                        backgrounded: true,
+                        command: cmd.join(" "),
+                        cwd,
+                    });
+                }
+                else {
+                    killTree(proc);
+                }
+            }, timeout);
+            proc.stdout?.on("data", (chunk) => {
+                totalBytes += chunk.length;
+                if (totalBytes <= this.#hardCapBytes) {
+                    stdoutChunks.push(chunk);
+                }
+                else if (!capExceeded) {
+                    capExceeded = true;
+                    killTree(proc);
+                }
+            });
+            proc.stderr?.on("data", (chunk) => {
+                totalBytes += chunk.length;
+                if (totalBytes <= this.#hardCapBytes) {
+                    stderrChunks.push(chunk);
+                }
+                else if (!capExceeded) {
+                    capExceeded = true;
+                    killTree(proc);
+                }
+            });
+            proc.on("close", (exitCode) => {
+                clearTimeout(timer);
+                if (resolved)
+                    return;
+                let stderr = Buffer.concat(stderrChunks).toString("utf-8");
+                if (capExceeded) {
+                    stderr += `\n[output capped at ${(this.#hardCapBytes / 1024 / 1024).toFixed(0)}MB — process killed]`;
+                }
+                res({
+                    stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
+                    stderr,
+                    exitCode: timedOut ? null : exitCode,
+                    timedOut,
+                    command: cmd.join(" "),
+                    cwd,
+                });
+            });
+            proc.on("error", (err) => {
+                clearTimeout(timer);
+                if (resolved)
+                    return;
+                // Mark resolved so a subsequent "close" event (some Node versions emit
+                // both on ENOENT) cannot double-fire res().
+                resolved = true;
+                res({
+                    stdout: "",
+                    stderr: err.message,
+                    exitCode: null,
+                    timedOut: false,
+                    command: cmd.join(" "),
+                    cwd,
+                });
+            });
+        });
+    }
+    /**
+     * Prepend a FILE_CONTENT bootstrap to user code, per language. The user code
+     * then has `FILE_CONTENT` (the file's text) and `file_path` (its absolute
+     * path) in scope.
+     */
+    #wrapWithFileContent(absolutePath, language, code) {
+        const escaped = JSON.stringify(absolutePath);
+        switch (language) {
+            case "javascript":
+            case "typescript":
+                return `const FILE_CONTENT_PATH = ${escaped};\nconst file_path = FILE_CONTENT_PATH;\nconst FILE_CONTENT = require("fs").readFileSync(FILE_CONTENT_PATH, "utf-8");\n${code}`;
+            case "python":
+                return `FILE_CONTENT_PATH = ${escaped}\nfile_path = FILE_CONTENT_PATH\nwith open(FILE_CONTENT_PATH, "r", encoding="utf-8") as _f:\n    FILE_CONTENT = _f.read()\n${code}`;
+            case "shell": {
+                const sq = "'" + absolutePath.replace(/'/g, "'\\''") + "'";
+                return `FILE_CONTENT_PATH=${sq}\nfile_path=${sq}\nFILE_CONTENT=$(cat ${sq})\n${code}`;
+            }
+            case "ruby":
+                return `FILE_CONTENT_PATH = ${escaped}\nfile_path = FILE_CONTENT_PATH\nFILE_CONTENT = File.read(FILE_CONTENT_PATH, encoding: "utf-8")\n${code}`;
+            case "go":
+                return `package main\n\nimport (\n\t"fmt"\n\t"os"\n)\n\nvar FILE_CONTENT_PATH = ${escaped}\nvar file_path = FILE_CONTENT_PATH\n\nfunc main() {\n\tb, _ := os.ReadFile(FILE_CONTENT_PATH)\n\tFILE_CONTENT := string(b)\n\t_ = FILE_CONTENT\n\t_ = fmt.Sprint()\n${code}\n}\n`;
+            case "rust":
+                return `use std::fs;\n\nfn main() {\n    let file_content_path = ${escaped};\n    let file_path = file_content_path;\n    let file_content = fs::read_to_string(file_content_path).unwrap();\n    let _ = file_content;\n${code}\n}\n`;
+            case "php":
+                return `<?php\n$FILE_CONTENT_PATH = ${escaped};\n$file_path = $FILE_CONTENT_PATH;\n$FILE_CONTENT = file_get_contents($FILE_CONTENT_PATH);\n${code}`;
+            case "perl":
+                return `my $FILE_CONTENT_PATH = ${escaped};\nmy $file_path = $FILE_CONTENT_PATH;\nopen(my $fh, '<:encoding(UTF-8)', $FILE_CONTENT_PATH) or die "Cannot open: $!";\nmy $FILE_CONTENT = do { local $/; <$fh> };\nclose($fh);\n${code}`;
+            case "r":
+                return `FILE_CONTENT_PATH <- ${escaped}\nfile_path <- FILE_CONTENT_PATH\nFILE_CONTENT <- readLines(FILE_CONTENT_PATH, warn=FALSE, encoding="UTF-8")\nFILE_CONTENT <- paste(FILE_CONTENT, collapse="\\n")\n${code}`;
+        }
+    }
+}
+//# sourceMappingURL=executor.js.map

package/dist/services/executor/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/services/executor/executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,UAAU,GAIX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,SAAS,EAAoB,MAAM,cAAc,CAAC;AAE3E,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAiC3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAE/D;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAG;IACzB,OAAO;IACP,OAAO;IACP,SAAS;IACT,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,SAAS;IACT,aAAa;IACb,cAAc;IACd,cAAc;IACd,aAAa;IACb,QAAQ;CACT,CAAC;AAEF;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,uDAAuD;YACvD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,cAAc,OAAO,aAAa,CAAC,CAAC;YAC1D,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa;IACpB,2EAA2E;IAC3E,wDAAwD;IACxD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,EAAE;YACb,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,QAAQ,CAAC,IAA8B;IAC9C,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO;IACtB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,QAAQ,CAAC,uBAAuB,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,6BAA6B;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;QACrB,mCAAmC;QACnC,UAAU;QACV,KAAK;QACL,gBAAgB;QAChB,SAAS;QACT,+BAA+B;QAC/B,cAAc;QACd,WAAW;QACX,mCAAmC;QACnC,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,qCAAqC;QACrC,SAAS;QACT,SAAS;QACT,UAAU;QACV,UAAU;QACV,SAAS;QACT,+DAA+D;QAC/D,YAAY;QACZ,iBAAiB;QACjB,uBAAuB;QACvB,mBAAmB;QACnB,wBAAwB;QACxB,OAAO;QACP,eAAe;QACf,IAAI;QACJ,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACjB,CAAC;IACH,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IACvB,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC;IAC3C,GAAG,CAAC,yBAAyB,CAAC,GAAG,GAAG,CAAC;IACrC,GAAG,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAAC;IAC9B,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,gBAAgB;IAC3B,aAAa,CAAS;IACtB,oBAAoB,CAAe;IACnC,SAAS,CAAa;IACtB,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,CAAc;IAEnB,YAAY,IAKX;QACC,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,YAAY,IAAI,sBAAsB,CAAC;QAClE,MAAM,EAAE,GAAG,IAAI,EAAE,WAAW,CAAC;QAC7B,IAAI,CAAC,oBAAoB;YACvB,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1F,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,QAAQ,IAAI,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,IAAI,CAAC;IAC1B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,mBAAmB;QACjB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,IAAoB;QAChC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAE7D,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,sBAAsB,EAAE,CAAC;gBACtC,uEAAuE;gBACvE,yEAAyE;gBACzE,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,YAAY;gBAAE,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,WAAW,CAAC,IAAwB;QACxC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE7C,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,QAAgB,CAAC;QACrB,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,oEAAoE;YACpE,2DAA2D;YAC3D,QAAQ,GAAG,YAAY,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QAED,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAe;gBACtB,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,kBAAkB,QAAQ,wCAAwC,IAAI,IAAI;gBAClF,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,KAAK;aAChB,CAAC;YACF,OAAO,GAAG,CAAC;QACb,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACjG,MAAM,GAAG,GAAe;gBACtB,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,kBAAkB,QAAQ,wDAAwD;gBAC1F,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,KAAK;aAChB,CAAC;YACF,OAAO,GAAG,CAAC;QACb,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,aAAa,CAAC,OAA2B;QACvC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,kBAAkB,CAAC;QACrD,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;YAAE,OAAO,kBAAkB,CAAC;QACzE,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC3C,CAAC;IAED,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,QAAkB;QAC3D,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,6DAA6D;QAC7D,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACpD,IAAI,GAAG,kDAAkD,IAAI,OAAO,CAAC;QACvE,CAAC;QACD,6BAA6B;QAC7B,IAAI,QAAQ,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,IAAI,GAAG,UAAU,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAe,EACf,GAAW,EACX,OAAe;QAEf,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9D,uEAAuE;QACvE,oCAAoC;QACpC,IAAI,CAAC;YACH,IAAI,CAAC;gBACH,YAAY,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;oBAC9C,GAAG;oBACH,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;oBAClC,QAAQ,EAAE,OAAO;oBACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,OAAO,GACX,GAAG,YAAY,KAAK;oBAClB,CAAC,CAAC,CAAE,GAA2B,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC;oBACtD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAClB,OAAO;oBACL,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,wBAAwB,OAAO,EAAE;oBACzC,QAAQ,EAAE,CAAC;oBACX,QAAQ,EAAE,KAAK;iBAChB,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC;gBAAS,CAAC;YACT,qEAAqE;YACrE,sEAAsE;YACtE,6DAA6D;YAC7D,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,CACJ,GAAa,EACb,GAAW,EACX,aAAqB,EACrB,OAAe,EACf,UAAmB;QAEnB,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACzB,oEAAoE;YACpE,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;YAErE,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBACzD,GAAG;gBACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC;gBAChC,iEAAiE;gBACjE,QAAQ,EAAE,CAAC,KAAK;gBAChB,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YAEH,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,IAAI,UAAU,GAAG,CAAC,CAAC;YAEnB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,UAAU,EAAE,CAAC;oBACf,uEAAuE;oBACvE,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,IAAI,CAAC,GAAG;wBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACb,qEAAqE;oBACrE,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBACxC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAClC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBACxC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAClC,GAAG,CAAC;wBACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;wBACrD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;wBACrD,QAAQ,EAAE,CAAC;wBACX,QAAQ,EAAE,IAAI;wBACd,YAAY,EAAE,IAAI;wBAClB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;wBACtB,GAAG;qBACJ,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACxC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC3B,IAAI,UAAU,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;oBACrC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;qBAAM,IAAI,CAAC,WAAW,EAAE,CAAC;oBACxB,WAAW,GAAG,IAAI,CAAC;oBACnB,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACxC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC3B,IAAI,UAAU,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;oBACrC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;qBAAM,IAAI,CAAC,WAAW,EAAE,CAAC;oBACxB,WAAW,GAAG,IAAI,CAAC;oBACnB,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,QAAQ;oBAAE,OAAO;gBACrB,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC;gBACvG,CAAC;gBACD,GAAG,CAAC;oBACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACrD,MAAM;oBACN,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;oBACpC,QAAQ;oBACR,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;oBACtB,GAAG;iBACJ,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,QAAQ;oBAAE,OAAO;gBACrB,uEAAuE;gBACvE,4CAA4C;gBAC5C,QAAQ,GAAG,IAAI,CAAC;gBAChB,GAAG,CAAC;oBACF,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,GAAG,CAAC,OAAO;oBACnB,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;oBACtB,GAAG;iBACJ,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,YAAoB,EAAE,QAAkB,EAAE,IAAY;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC7C,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,YAAY,CAAC;YAClB,KAAK,YAAY;gBACf,OAAO,6BAA6B,OAAO,0HAA0H,IAAI,EAAE,CAAC;YAC9K,KAAK,QAAQ;gBACX,OAAO,uBAAuB,OAAO,8HAA8H,IAAI,EAAE,CAAC;YAC5K,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,EAAE,GAAG,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;gBAC3D,OAAO,qBAAqB,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,IAAI,EAAE,CAAC;YACxF,CAAC;YACD,KAAK,MAAM;gBACT,OAAO,uBAAuB,OAAO,oGAAoG,IAAI,EAAE,CAAC;YAClJ,KAAK,IAAI;gBACP,OAAO,2EAA2E,OAAO,wKAAwK,IAAI,OAAO,CAAC;YAC/Q,KAAK,MAAM;gBACT,OAAO,4DAA4D,OAAO,iJAAiJ,IAAI,OAAO,CAAC;YACzO,KAAK,KAAK;gBACR,OAAO,+BAA+B,OAAO,gGAAgG,IAAI,EAAE,CAAC;YACtJ,KAAK,MAAM;gBACT,OAAO,2BAA2B,OAAO,qLAAqL,IAAI,EAAE,CAAC;YACvO,KAAK,GAAG;gBACN,OAAO,wBAAwB,OAAO,sKAAsK,IAAI,EAAE,CAAC;QACvN,CAAC;IACH,CAAC;CACF"}

package/dist/services/executor/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Executor service — polyglot sandbox + run-pool + intent progressive disclosure.
+ *
+ * Exports are deliberately grouped:
+ *   - `PolyglotExecutor` + types: the sandbox spawner.
+ *   - `runPool`: standalone concurrency primitive (no executor dependency —
+ *     reused by P2-T2 web fetch).
+ *   - `detectRuntimes` etc.: runtime detection (also exported for tests).
+ *   - `intentSearch`: opt-in progressive disclosure for large outputs.
+ */
+export { PolyglotExecutor } from "./executor.js";
+export type { ExecResult, ExecuteOptions, ExecuteFileOptions, } from "./executor.js";
+export { DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS, DEFAULT_HARD_CAP_BYTES, } from "./executor.js";
+export { runPool, fulfilledValues } from "./run-pool.js";
+export type { PoolJob, RunPoolOptions, RunPoolResult, } from "./run-pool.js";
+export { detectRuntimes, commandExists, runnableExists, getVersion, getRuntimeSummary, getAvailableLanguages, buildCommand, SCRIPT_EXT, } from "./runtime.js";
+export type { Language, RuntimeMap, RuntimeInfo, DetectDeps, } from "./runtime.js";
+export { intentSearch, renderIntentResult, INTENT_SEARCH_THRESHOLD, } from "./intent-search.js";
+export type { IntentSearchResult, IntentSection, } from "./intent-search.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/services/executor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/executor/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,YAAY,EACV,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACzD,YAAY,EACV,OAAO,EACP,cAAc,EACd,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,QAAQ,EACR,UAAU,EACV,WAAW,EACX,UAAU,GACX,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,kBAAkB,EAClB,aAAa,GACd,MAAM,oBAAoB,CAAC"}

package/dist/services/executor/index.js

@@ -0,0 +1,16 @@
+/**
+ * Executor service — polyglot sandbox + run-pool + intent progressive disclosure.
+ *
+ * Exports are deliberately grouped:
+ *   - `PolyglotExecutor` + types: the sandbox spawner.
+ *   - `runPool`: standalone concurrency primitive (no executor dependency —
+ *     reused by P2-T2 web fetch).
+ *   - `detectRuntimes` etc.: runtime detection (also exported for tests).
+ *   - `intentSearch`: opt-in progressive disclosure for large outputs.
+ */
+export { PolyglotExecutor } from "./executor.js";
+export { DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS, DEFAULT_HARD_CAP_BYTES, } from "./executor.js";
+export { runPool, fulfilledValues } from "./run-pool.js";
+export { detectRuntimes, commandExists, runnableExists, getVersion, getRuntimeSummary, getAvailableLanguages, buildCommand, SCRIPT_EXT, } from "./runtime.js";
+export { intentSearch, renderIntentResult, INTENT_SEARCH_THRESHOLD, } from "./intent-search.js";
+//# sourceMappingURL=index.js.map

package/dist/services/executor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/executor/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMjD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAOzD,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,cAAc,CAAC;AAQtB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC"}

package/dist/services/executor/intent-search.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Intent-driven progressive disclosure for execution output.
+ *
+ * When `execute` / `execute_file` output exceeds a threshold, returning it
+ * verbatim floods the agent's context window. Instead, when the caller passes
+ * an `intent` query, we:
+ *   1. chunk the output into sections (reuse the existing smart-chunker),
+ *   2. build a tiny IN-MEMORY keyword index (TF + title boost) over those
+ *      sections,
+ *   3. return ONLY the sections matching the intent query + a vocabulary-hint
+ *      list (top distinctive terms).
+ *
+ * This mirrors context-mode `intentSearch` (server.ts:1982) in shape but is
+ * self-contained — it does NOT touch the persistent FTS5/PG keyword store, so
+ * it can never OOM the shared e2e index or trigger a full-repo index. If
+ * `intent` is absent or output is below threshold, the output is returned
+ * verbatim (no indexing at all).
+ */
+/** Output ≥ this many bytes triggers intent search (when intent is set). */
+export declare const INTENT_SEARCH_THRESHOLD = 5000;
+export interface IntentSection {
+    label: string;
+    lineStart: number;
+    lineEnd: number;
+    preview: string;
+}
+export interface IntentSearchResult {
+    /** Whether intent search actually ran (output large enough + intent set). */
+    searched: boolean;
+    /** Total output size (bytes). */
+    totalBytes: number;
+    /** Total output lines. */
+    totalLines: number;
+    /** Sections that matched the intent (only meaningful when searched). */
+    matchedSections: IntentSection[];
+    /** Distinctive vocabulary terms extracted from the output. */
+    vocabularyHints: string[];
+}
+/**
+ * Run intent search on `output` for `intent`. Returns the structured result;
+ * the caller decides how to render it.
+ *
+ * Returns `searched: false` (and empty arrays) when the output is too small
+ * or no intent was provided — in that case the caller returns output verbatim.
+ */
+export declare function intentSearch(output: string, intent: string | undefined, maxResults?: number): IntentSearchResult;
+/**
+ * Render an IntentSearchResult as a human-readable summary string (the shape
+ * agents consume when intent search fires). Mirrors the context-mode layout.
+ */
+export declare function renderIntentResult(result: IntentSearchResult, intent: string): string;
+//# sourceMappingURL=intent-search.d.ts.map

package/dist/services/executor/intent-search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent-search.d.ts","sourceRoot":"","sources":["../../../src/services/executor/intent-search.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;IAClB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,8DAA8D;IAC9D,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AA+HD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,UAAU,SAAI,GACb,kBAAkB,CAiCpB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,MAAM,GACb,MAAM,CAoBR"}