@mininglamp-oss/cc-channel-octo 1.0.1-dev.0ac574a

package/dist/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAaH,sEAAsE;AACtE,MAAM,aAAa,GAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvD,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,gCAAgC;IAChC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,iDAAiD;AACjD,MAAM,SAAS,GAAG;IAChB,qBAAqB;IACrB,kIAAkI;IAClI,iDAAiD;IACjD,+BAA+B;CAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,KAAK,GACT,MAAM,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG;QAC7B,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO;QACL,mBAAmB;QACnB,YAAY,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,eAAe,EAAE;QACjD,mBAAmB,KAAK,EAAE;QAC1B,qBAAqB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE;QAChD,gBAAgB,MAAM,CAAC,SAAS,CAAC,YAAY,UAAU;QACvD,mBAAmB,MAAM,CAAC,OAAO,CAAC,YAAY,WAAW;KAC1D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,UAAkB,EAClB,KAAmB,EACnB,MAAc,EACd,UAAmB;IAEnB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,CAAC;IAElC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,2EAA2E;YAC3E,2EAA2E;YAC3E,wEAAwE;YACxE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAChC,yEAAyE;YACzE,kEAAkE;YAClE,uEAAuE;YACvE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAChD,CAAC;YACD,0EAA0E;YAC1E,4EAA4E;YAC5E,KAAK,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC;QAChG,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC7C,CAAC;QACD;YACE,kEAAkE;YAClE,0DAA0D;YAC1D,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,qBAAqB,MAAM,CAAC,IAAI,OAAO,SAAS,EAAE;aAC1D,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,294 @@
+/**
+ * Configuration loading.
+ *
+ * Two-layer, bot-first model:
+ *  - GLOBAL `~/.cc-channel-octo/config.json` — shared defaults + a `bots` list.
+ *    Never holds a botToken.
+ *  - PER-BOT `~/.cc-channel-octo/<id>/config.json` — that bot's botToken + any
+ *    overrides. Each bot is a self-contained subtree:
+ *      <baseDir>/<id>/{config.json, SOUL.md, data/, workspace/, memory/}
+ *  - `baseDir` is the directory containing the global config.json. Per-bot dirs
+ *    are DERIVED from `<baseDir>/<id>/…` (not separately configurable) so a bot
+ *    can never point its data outside its own subtree.
+ *
+ * env overrides still apply to the shared/global layer.
+ */
+/**
+ * Default global config path: `~/.cc-channel-octo/config.json`. This is the
+ * single, fixed production location (no env/CLI override). Tests pass an
+ * explicit path, which also sets `baseDir` to that file's directory.
+ */
+export declare const DEFAULT_CONFIG_PATH: string;
+/**
+ * Q2: Wildcard form of `allowedTools` — `"*"` means "allow every tool the SDK
+ * exposes". Otherwise must be an explicit string array (whitelist mode).
+ */
+export type AllowedTools = string[] | '*';
+export interface Config {
+    botToken: string;
+    apiUrl: string;
+    /**
+     * Base directory containing the global config.json. Every bot's subtree lives
+     * at `<baseDir>/<botId>/…`. Defaults to `~/.cc-channel-octo` (the dir of
+     * DEFAULT_CONFIG_PATH); when an explicit config path is passed, it is that
+     * file's directory.
+     */
+    baseDir: string;
+    /**
+     * DERIVED (not user-configurable): per-session cwd sandbox base for THIS bot,
+     * `<baseDir>/<botId>/workspace`. Each (DM peer | group channel) gets its own
+     * hashed subdir under it via `cwd-resolver.resolveSessionCwd()`. Populated by
+     * `resolveBotConfigs()`.
+     */
+    cwdBase?: string;
+    /**
+     * @deprecated Alias of `cwdBase`, kept in sync so hand-built Config objects
+     * (tests, legacy consumers reading `config.cwd`) still compile.
+     */
+    cwd: string;
+    /**
+     * DERIVED (not user-configurable): SQLite/data dir for THIS bot,
+     * `<baseDir>/<botId>/data`. Populated by `resolveBotConfigs()`.
+     */
+    dataDir: string;
+    /**
+     * DERIVED (not user-configurable): SDK auto-memory base for THIS bot,
+     * `<baseDir>/<botId>/memory`. Each session gets a hashed subdir under it (same
+     * partitioning as the cwd sandbox: group=shared per channel, DM=private per
+     * peer). Separate from the cwd sandbox so the 7-day cwd TTL never reclaims
+     * memory. Populated by `resolveBotConfigs()`.
+     */
+    memoryBase?: string;
+    /**
+     * DERIVED (not user-configurable): per-bot skills directory,
+     * `<baseDir>/<botId>/skills`. Each immediate subdir is a Claude skill
+     * (`SKILL.md` + optional `references/`, `scripts/`). Symlinked into each
+     * session sandbox's `.claude/skills/` so the SDK discovers it (requires
+     * `sdk.settingSources` to include `project`). Per-bot skills override
+     * same-named global skills. Populated by `resolveBotConfigs()`.
+     */
+    skillsDir?: string;
+    /**
+     * DERIVED (not user-configurable): install-wide skills directory shared by all
+     * bots, `<baseDir>/skills`. Loaded for every bot (lower precedence than the
+     * per-bot `skillsDir`). Populated by `resolveBotConfigs()`.
+     */
+    globalSkillsDir?: string;
+    /**
+     * v1.0: directory of per-group instruction files (`<groupId>.md`). When set,
+     * a matching file's contents are injected into the system prompt as trusted
+     * custom instructions for that group. Operator-controlled — must NOT be the
+     * per-session cwd sandbox (which the agent can write). Unset = feature off.
+     */
+    groupConfigDir?: string;
+    sdk: {
+        model?: string;
+        /**
+         * Q2: `"*"` allows every tool the SDK exposes; otherwise an explicit
+         * whitelist. Default is `"*"` because we already control surface area via
+         * `permissionMode` and `cwdBase` isolation — the old hard-coded 8-tool
+         * list was redundant lockdown and broke operators who needed SDK-internal
+         * tools like `TodoWrite`/`Task`.
+         */
+        allowedTools: AllowedTools;
+        permissionMode: string;
+        maxTurns?: number;
+        systemPrompt?: string;
+        /**
+         * Which filesystem settings sources the SDK loads (`user`/`project`/`local`).
+         * Default is `['project']` so the SDK discovers skills symlinked into the
+         * session sandbox's `.claude/skills/` (#100 — generic external tooling).
+         *
+         * Memory isolation is preserved INDEPENDENTLY of this: the auto-memory
+         * directory is pinned via inline `settings.autoMemoryDirectory` (the SDK's
+         * `flagSettings` tier), which takes precedence over any `projectSettings`
+         * value — and the SDK explicitly ignores `autoMemoryDirectory` coming from a
+         * checked-in `projectSettings` for security. So `['project']` lets the bot
+         * read the sandbox `.claude/` (skills, and any CLAUDE.md/settings.json the
+         * agent itself wrote — acceptable, it's the agent's own workspace) WITHOUT
+         * the memory leaking into the host `~/.claude` (verified empirically).
+         *
+         * `'user'` would additionally load the operator's real `~/.claude` config —
+         * opt into that deliberately only. Note: this controls what is LOADED (read),
+         * not tool-write scope (governed by `permissionMode`/`allowedTools`).
+         */
+        settingSources: string[];
+        /**
+         * v0.3: when true, the bot sends brief "🔧 Running <tool>…" progress
+         * messages as the agent invokes tools, so users see activity during long
+         * tool-heavy turns. Default false — it adds extra chat messages, so it is
+         * opt-in. Env: `CC_OCTO_SDK_TOOL_PROGRESS=true`.
+         */
+        toolProgress?: boolean;
+        /**
+         * Q1: Override the upstream Claude API endpoint (e.g. self-hosted gateway).
+         * Forwarded to the SDK subprocess via the standard `ANTHROPIC_BASE_URL`
+         * environment variable.
+         */
+        anthropicBaseUrl?: string;
+        /**
+         * Q1b: Anthropic API key for the upstream gateway. When set, forwarded to
+         * the SDK subprocess via the standard `ANTHROPIC_API_KEY` env var (same
+         * mechanism as `anthropicBaseUrl`). Written by the `configure` subcommand
+         * during daemon-driven one-click install; persisted in the global config.
+         */
+        apiKey?: string;
+        /**
+         * #107: extra environment variables injected verbatim into the agent's SDK
+         * subprocess (on top of the inherited process.env). Generic and declarative
+         * — cc knows nothing about what they mean. Use it to give a bot's skills the
+         * env their external CLIs need, e.g. `{ "OCTO_BOT_ID": "<robotId>" }` so a
+         * multi-bot deploy's `octo-cli` calls select the right stored profile.
+         * Per-bot (set in `<baseDir>/<id>/config.json`).
+         */
+        env?: Record<string, string>;
+        /**
+         * #110: which skills this bot enables, selecting a subset of the skills
+         * discovered in its session sandbox's `.claude/skills/` (the shared library
+         * `<baseDir>/skills` + per-bot `<baseDir>/<id>/skills`, symlinked in by the
+         * skill-linker). Names match each SKILL.md `name` / directory name.
+         *   - omitted: SDK default (no explicit selection).
+         *   - `'all'`: enable every discovered skill.
+         *   - `string[]`: enable only the listed skills.
+         * This is the per-bot SELECTION layer over the centrally-maintained library:
+         * maintain skills once, each bot picks its own subset. Per-bot (set in
+         * `<baseDir>/<id>/config.json`).
+         */
+        skills?: string[] | 'all';
+        /**
+         * #115: when true, give the agent a `cron` tool set (cron_create / cron_list
+         * / cron_delete) to register per-bot scheduled tasks, persisted to
+         * `<baseDir>/<botId>/cron.json` and fired by the gateway scheduler through
+         * the normal message pipeline (bound to the creating session). Task creation
+         * is gated to the bot owner uid (registerBot.owner_uid). Default off. Per-bot.
+         */
+        cron?: boolean;
+    };
+    rateLimit: {
+        maxPerMinute: number;
+    };
+    context: {
+        maxContextChars: number;
+        historyLimit: number;
+    };
+    /** Maximum response length in chars before truncation (Q32). */
+    maxResponseChars: number;
+    /**
+     * Per-message dispatch timeout in ms (#141). Bounds the full handler
+     * pipeline (agent query + stream) under the per-session lock. If a turn
+     * hangs past this, the session lock is released (a hung turn would otherwise
+     * block every subsequent message on that session forever) and the user gets
+     * a one-shot apology. Does NOT cancel the in-flight turn — only unblocks the
+     * queue. Default 5 minutes.
+     */
+    dispatchTimeoutMs: number;
+    botBlocklist?: string[];
+    /**
+     * G14: Bots in this list are allowed to DM the bot even if their uid matches
+     * the `_bot` heuristic. Use this to whitelist trusted bots.
+     */
+    allowedBotUids?: string[];
+    /** Group IDs where the bot responds without being @mentioned (G12). */
+    mentionFreeGroups?: string[];
+    /**
+     * v0.3 multi-bot: optional per-bot overrides. When present and non-empty, the
+     * process runs ONE independent bot per entry, each with its own gateway,
+     * router, store, and (by default) data directory — so bots never share history
+     * or working dirs. Each entry inherits every top-level field and overrides the
+     * listed ones; `botToken` is required per entry. When absent, the process runs
+     * a single bot from the top-level fields exactly as before.
+     *
+     * Resolved into concrete per-bot Config objects by `resolveBotConfigs()`.
+     */
+    bots?: BotOverride[];
+    /**
+     * v0.3 multi-bot: stable identifier for THIS bot, used to namespace its data
+     * directory and logs when running multiple bots. Defaults to `default` for the
+     * single-bot case. Populated by `resolveBotConfigs()`.
+     */
+    botId?: string;
+    /**
+     * #86: media CDN host (no scheme), prefetched at startup from the upload-
+     * credentials STS response (`cdnBaseUrl`). Octo serves media from a separate
+     * CDN host than `apiUrl`; inbound media URLs on this host are allowed by
+     * buildMediaUrl. Runtime-populated (not from the config file); undefined until
+     * the prefetch succeeds, in which case only same-apiUrl-host media is allowed.
+     */
+    mediaCdnHost?: string;
+}
+/**
+ * One bot's entry. In the two-layer model the global config's `bots` array
+ * lists which bots to run (by `id`); each bot's real settings — including its
+ * required `botToken` — live in `<baseDir>/<id>/config.json`, which is merged
+ * OVER both the global shared fields and any inline fields here (per-dir wins).
+ *
+ * Per-bot directories are NOT configurable here: they are always derived as
+ * `<baseDir>/<id>/{data,workspace,memory}` so a bot cannot escape its subtree.
+ */
+export interface BotOverride {
+    /**
+     * Stable id — also the bot's subtree name under `baseDir`. Required in the
+     * two-layer model (it selects `<baseDir>/<id>/config.json`). Must be a
+     * conservative slug: letters, digits, dot, underscore, hyphen — no path
+     * separators (it becomes a path segment).
+     */
+    id?: string;
+    /**
+     * Optional here — normally provided by the per-bot `<id>/config.json`. If set
+     * inline it is used unless the per-bot file overrides it.
+     */
+    botToken?: string;
+    apiUrl?: string;
+    model?: string;
+    systemPrompt?: string;
+    botBlocklist?: string[];
+    allowedBotUids?: string[];
+    mentionFreeGroups?: string[];
+}
+/**
+ * SSRF protection for apiUrl: implemented in url-policy.ts (isAllowedApiUrl).
+ * S6 fix: now rejects https://127.0.0.1 too — https doesn't make a private
+ * address safe (could be a self-signed mitmproxy).
+ */
+export declare function loadConfig(configPath?: string): Config;
+/**
+ * v0.3 multi-bot: expand a loaded Config into one concrete Config per bot.
+ *
+ * - Single-bot (no `bots`): returns `[config]` with `botId` defaulted to
+ *   `default`, unchanged otherwise — fully backward compatible.
+ * - Multi-bot: returns one Config per `bots[]` entry. Each inherits the base
+ *   config and applies its overrides. To guarantee bots never share history,
+ *   cwd, or lock files, each bot's `dataDir` and `cwdBase` are namespaced by its
+ *   id UNLESS the entry sets them explicitly.
+ *
+ * Throws on missing/duplicate bot tokens or duplicate ids (fail fast at boot).
+ */
+/**
+ * Expand a loaded GLOBAL config into one concrete Config per bot.
+ *
+ * Two-layer, bot-first model:
+ * - Single-bot (no `bots`): one bot with id `default`. Its token/overrides come
+ *   from the global config and/or `<baseDir>/default/config.json`.
+ * - Multi-bot: one Config per `bots[]` entry (selected by `id`). For each, the
+ *   effective config is: global shared fields ⊕ inline `bots[]` fields ⊕
+ *   `<baseDir>/<id>/config.json` (per-dir file wins).
+ *
+ * Every bot's directories are DERIVED (never configurable):
+ *   data      = <baseDir>/<id>/data
+ *   workspace = <baseDir>/<id>/workspace   (cwdBase)
+ *   memory    = <baseDir>/<id>/memory
+ * and its personality from `<baseDir>/<id>/SOUL.md` (overrides systemPrompt).
+ *
+ * Throws on missing/duplicate tokens, duplicate ids, invalid id slugs, or unsafe
+ * apiUrl (fail fast at boot).
+ */
+export declare function resolveBotConfigs(config: Config): Config[];
+/**
+ * v1.1: openclaw-style per-bot personality. Read `<botRoot>/SOUL.md` if it
+ * exists and return its trimmed contents as the bot's "soul" (voice/stance/
+ * boundaries), to be composed into the agent system prompt. Mirrors openclaw's
+ * SOUL.md: a file you edit, not a config string. When the file is absent or
+ * empty, returns undefined so the caller falls back to the `systemPrompt`
+ * config string. Best-effort — a read error never blocks startup.
+ */
+export declare function loadSoul(botRoot: string): string | undefined;

package/dist/config.js

@@ -0,0 +1,344 @@
+/**
+ * Configuration loading.
+ *
+ * Two-layer, bot-first model:
+ *  - GLOBAL `~/.cc-channel-octo/config.json` — shared defaults + a `bots` list.
+ *    Never holds a botToken.
+ *  - PER-BOT `~/.cc-channel-octo/<id>/config.json` — that bot's botToken + any
+ *    overrides. Each bot is a self-contained subtree:
+ *      <baseDir>/<id>/{config.json, SOUL.md, data/, workspace/, memory/}
+ *  - `baseDir` is the directory containing the global config.json. Per-bot dirs
+ *    are DERIVED from `<baseDir>/<id>/…` (not separately configurable) so a bot
+ *    can never point its data outside its own subtree.
+ *
+ * env overrides still apply to the shared/global layer.
+ */
+import { readFileSync, existsSync, statSync, realpathSync } from 'node:fs';
+import { resolve as resolvePath, sep, dirname, join as pathJoin } from 'node:path';
+import { homedir } from 'node:os';
+import { isAllowedApiUrl } from './url-policy.js';
+/**
+ * Default global config path: `~/.cc-channel-octo/config.json`. This is the
+ * single, fixed production location (no env/CLI override). Tests pass an
+ * explicit path, which also sets `baseDir` to that file's directory.
+ */
+export const DEFAULT_CONFIG_PATH = pathJoin(homedir(), '.cc-channel-octo', 'config.json');
+function defaults() {
+    return {
+        botToken: '',
+        apiUrl: '',
+        // baseDir is set by loadConfig() from the config path's directory; the
+        // per-bot dirs below are DERIVED in resolveBotConfigs() as
+        // <baseDir>/<botId>/{workspace,data,memory}. Left empty here.
+        baseDir: '',
+        cwdBase: '',
+        cwd: '',
+        dataDir: '',
+        memoryBase: '',
+        sdk: {
+            // Q2: default to wildcard — operators tighten only when they need to.
+            allowedTools: '*',
+            permissionMode: 'bypassPermissions',
+            // #100: load project-scope settings so the SDK discovers skills symlinked
+            // into the session sandbox's .claude/skills/. Memory stays isolated via the
+            // inline settings.autoMemoryDirectory pin (flagSettings > projectSettings).
+            settingSources: ['project'],
+        },
+        rateLimit: {
+            maxPerMinute: 5,
+        },
+        context: {
+            maxContextChars: 6000,
+            historyLimit: 40,
+        },
+        maxResponseChars: 524_288, // 512 KB (Q32)
+        dispatchTimeoutMs: 300_000, // 5 min (#141)
+    };
+}
+function readConfigFile(configFilePath) {
+    if (!existsSync(configFilePath)) {
+        return {};
+    }
+    // Q12: Warn if config file is readable by group/others (contains botToken).
+    try {
+        const stat = statSync(configFilePath);
+        const mode = stat.mode & 0o777;
+        if (mode & 0o077) {
+            console.warn(`[cc-channel-octo] WARNING: ${configFilePath} has mode ${mode.toString(8)} — ` +
+                `secrets may be exposed to other users. Fix with: chmod 600 ${configFilePath}`);
+        }
+    }
+    catch {
+        // Best-effort check — don't block startup if stat fails.
+    }
+    const raw = readFileSync(configFilePath, 'utf-8');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to parse config file ${configFilePath}: ${msg}`);
+    }
+    // Strip top-level keys starting with "_" (e.g. _comment).
+    const cleaned = {};
+    for (const [k, v] of Object.entries(parsed)) {
+        if (!k.startsWith('_'))
+            cleaned[k] = v;
+    }
+    return cleaned;
+}
+function mergeConfig(base, override) {
+    return {
+        botToken: override.botToken ?? base.botToken,
+        apiUrl: override.apiUrl ?? base.apiUrl,
+        // baseDir + derived dirs are filled by loadConfig()/resolveBotConfigs(),
+        // not by config-file merge.
+        baseDir: base.baseDir,
+        cwdBase: base.cwdBase,
+        cwd: base.cwd,
+        dataDir: base.dataDir,
+        memoryBase: base.memoryBase,
+        groupConfigDir: override.groupConfigDir ?? base.groupConfigDir,
+        sdk: {
+            ...base.sdk,
+            ...(override.sdk ?? {}),
+        },
+        rateLimit: {
+            ...base.rateLimit,
+            ...(override.rateLimit ?? {}),
+        },
+        context: {
+            ...base.context,
+            ...(override.context ?? {}),
+        },
+        maxResponseChars: override.maxResponseChars ?? base.maxResponseChars,
+        dispatchTimeoutMs: override.dispatchTimeoutMs ?? base.dispatchTimeoutMs,
+        botBlocklist: override.botBlocklist ?? base.botBlocklist,
+        allowedBotUids: override.allowedBotUids ?? base.allowedBotUids,
+        mentionFreeGroups: override.mentionFreeGroups ?? base.mentionFreeGroups,
+        bots: override.bots ?? base.bots,
+    };
+}
+/**
+ * SSRF protection for apiUrl: implemented in url-policy.ts (isAllowedApiUrl).
+ * S6 fix: now rejects https://127.0.0.1 too — https doesn't make a private
+ * address safe (could be a self-signed mitmproxy).
+ */
+export function loadConfig(configPath) {
+    const path = configPath ?? DEFAULT_CONFIG_PATH;
+    // Migration aid: if the fixed global config is missing but a legacy
+    // ./config.json exists in the cwd, point the operator at the move rather than
+    // failing later with a cryptic "Missing required config: apiUrl".
+    if (configPath === undefined && !existsSync(path) && existsSync('./config.json')) {
+        throw new Error(`No config at ${path}, but ./config.json exists. The config location moved: ` +
+            `cc-channel-octo now loads ~/.cc-channel-octo/config.json (shared, no token) plus ` +
+            `~/.cc-channel-octo/<botId>/config.json (per-bot token). Move your settings there ` +
+            `(see config.example.json / config.bot.example.json).`);
+    }
+    const fileCfg = readConfigFile(path);
+    // Config comes ONLY from config.json (global + per-bot layers) — there is no
+    // environment-variable override path (#103). The sole exception that still
+    // *reads* the environment lives nowhere here: `sdk.anthropicBaseUrl` is set in
+    // config.json and forwarded to the SDK subprocess by agent-bridge.
+    const final = mergeConfig(defaults(), fileCfg);
+    // baseDir = the directory containing the global config.json. Every bot's
+    // subtree lives at <baseDir>/<botId>/…. resolveBotConfigs() derives the
+    // per-bot dirs from this.
+    final.baseDir = dirname(resolvePath(path));
+    // apiUrl is shared and required at the global layer (a per-bot config.json may
+    // still override it, re-checked per bot in resolveBotConfigs). botToken is NOT
+    // validated here — it lives in each bot's <id>/config.json.
+    if (!final.apiUrl) {
+        throw new Error('Missing required config: apiUrl (set CC_OCTO_API_URL or config.json)');
+    }
+    if (!isAllowedApiUrl(final.apiUrl)) {
+        throw new Error(`Unsafe apiUrl: ${final.apiUrl} — must be https:// or http://localhost/http://127.0.0.1 (SSRF protection)`);
+    }
+    // Q1: the gateway endpoint receives the Anthropic API key and all prompt /
+    // response content, so it gets the same SSRF policy as apiUrl.
+    if (final.sdk.anthropicBaseUrl && !isAllowedApiUrl(final.sdk.anthropicBaseUrl)) {
+        throw new Error(`Unsafe sdk.anthropicBaseUrl: ${final.sdk.anthropicBaseUrl} — must be https:// ` +
+            `or http://localhost/http://127.0.0.1 (SSRF protection)`);
+    }
+    return final;
+}
+/**
+ * Enforce that `groupConfigDir` (whose files are injected UNSANITIZED into the
+ * system prompt) is not the same as, nor nested under, the agent-writable
+ * `cwdBase`. Otherwise a user-driven agent could write its own future
+ * system-prompt instructions.
+ *
+ * Uses realpathSync.native for paths that exist (so symlinks can't dodge the
+ * boundary) and falls back to lexical resolve() for not-yet-created dirs.
+ */
+function assertGroupConfigDirOutsideCwd(cfg) {
+    if (!cfg.groupConfigDir)
+        return;
+    const cwdBase = cfg.cwdBase ?? cfg.cwd;
+    const cwdBaseResolved = canonicalize(cwdBase);
+    const groupDirResolved = canonicalize(cfg.groupConfigDir);
+    if (groupDirResolved === cwdBaseResolved || isPathInside(groupDirResolved, cwdBaseResolved)) {
+        throw new Error(`Unsafe groupConfigDir: ${cfg.groupConfigDir} is the same as or nested under ` +
+            `cwdBase (${cwdBase}). It must be operator-controlled and outside the ` +
+            `agent-writable sandbox, since its files are injected into the system prompt.`);
+    }
+}
+/** Resolve to a real path when it exists (defeats symlink dodges), else lexical. */
+function canonicalize(p) {
+    try {
+        return realpathSync.native(p);
+    }
+    catch {
+        return resolvePath(p);
+    }
+}
+/** True when `child` is strictly inside `parent` (both already resolved). */
+function isPathInside(child, parent) {
+    const parentWithSep = parent.endsWith(sep) ? parent : parent + sep;
+    return child.startsWith(parentWithSep);
+}
+/**
+ * v0.3 multi-bot: expand a loaded Config into one concrete Config per bot.
+ *
+ * - Single-bot (no `bots`): returns `[config]` with `botId` defaulted to
+ *   `default`, unchanged otherwise — fully backward compatible.
+ * - Multi-bot: returns one Config per `bots[]` entry. Each inherits the base
+ *   config and applies its overrides. To guarantee bots never share history,
+ *   cwd, or lock files, each bot's `dataDir` and `cwdBase` are namespaced by its
+ *   id UNLESS the entry sets them explicitly.
+ *
+ * Throws on missing/duplicate bot tokens or duplicate ids (fail fast at boot).
+ */
+/**
+ * Expand a loaded GLOBAL config into one concrete Config per bot.
+ *
+ * Two-layer, bot-first model:
+ * - Single-bot (no `bots`): one bot with id `default`. Its token/overrides come
+ *   from the global config and/or `<baseDir>/default/config.json`.
+ * - Multi-bot: one Config per `bots[]` entry (selected by `id`). For each, the
+ *   effective config is: global shared fields ⊕ inline `bots[]` fields ⊕
+ *   `<baseDir>/<id>/config.json` (per-dir file wins).
+ *
+ * Every bot's directories are DERIVED (never configurable):
+ *   data      = <baseDir>/<id>/data
+ *   workspace = <baseDir>/<id>/workspace   (cwdBase)
+ *   memory    = <baseDir>/<id>/memory
+ * and its personality from `<baseDir>/<id>/SOUL.md` (overrides systemPrompt).
+ *
+ * Throws on missing/duplicate tokens, duplicate ids, invalid id slugs, or unsafe
+ * apiUrl (fail fast at boot).
+ */
+export function resolveBotConfigs(config) {
+    // Zero-bot idle: no bots[] list and no global botToken — and no token in the
+    // default per-bot file either. Return [] so the gateway can run idle (online,
+    // no bots) until the first bot is provisioned, instead of throwing. A legacy
+    // single bot may keep its token only in <baseDir>/default/config.json (read by
+    // the synthesized "default" entry below), so check that before idling.
+    const hasInlineBots = !!(config.bots && config.bots.length > 0);
+    if (!hasInlineBots && !config.botToken) {
+        const defaultPerBot = readConfigFile(pathJoin(config.baseDir, 'default', 'config.json'));
+        if (!defaultPerBot.botToken) {
+            return [];
+        }
+    }
+    // Single-bot: synthesize one entry with id "default".
+    const entries = config.bots && config.bots.length > 0
+        ? config.bots
+        : [{ id: 'default', botToken: config.botToken || undefined }];
+    const seenIds = new Set();
+    const seenTokens = new Set();
+    const resolvedBots = entries.map((bot, i) => {
+        const id = bot.id ?? `bot${i}`;
+        // The id becomes a path segment for the bot's subtree, so restrict it to a
+        // conservative slug — otherwise ids like "../ops" or "a/b" could escape or
+        // alias the intended directory, defeating isolation.
+        if (!/^[a-zA-Z0-9._-]+$/.test(id) || id === '.' || id === '..') {
+            throw new Error(`Bot "${id}": invalid id — use only letters, digits, dot, underscore, hyphen (no path separators)`);
+        }
+        if (seenIds.has(id)) {
+            throw new Error(`Duplicate bot id "${id}" — ids must be unique`);
+        }
+        seenIds.add(id);
+        // Derive the bot's self-contained subtree under baseDir.
+        const botRoot = pathJoin(config.baseDir, id);
+        const botDataDir = pathJoin(botRoot, 'data');
+        const botCwdBase = pathJoin(botRoot, 'workspace');
+        const botMemoryBase = pathJoin(botRoot, 'memory');
+        // #100: per-bot skills (<baseDir>/<id>/skills) + install-wide global skills
+        // (<baseDir>/skills). Symlinked into each session sandbox by skill-linker.
+        const botSkillsDir = pathJoin(botRoot, 'skills');
+        const globalSkillsDir = pathJoin(config.baseDir, 'skills');
+        // Per-bot config.json (in the bot's own subtree) is the highest-priority
+        // layer: global shared ⊕ inline bots[] entry ⊕ <baseDir>/<id>/config.json.
+        const perBotFile = readConfigFile(pathJoin(botRoot, 'config.json'));
+        const botToken = perBotFile.botToken ?? bot.botToken ?? '';
+        if (!botToken) {
+            throw new Error(`Bot "${id}": missing botToken — set it in ${pathJoin(botRoot, 'config.json')}`);
+        }
+        if (seenTokens.has(botToken)) {
+            throw new Error(`Duplicate botToken across bots — each bot needs a distinct token`);
+        }
+        seenTokens.add(botToken);
+        // openclaw-style SOUL.md in the bot's subtree overrides systemPrompt (which
+        // may come from the per-bot file, the inline entry, or the shared config).
+        const botSoul = loadSoul(botRoot);
+        const sharedSystemPrompt = config.sdk.systemPrompt;
+        const botSystemPrompt = botSoul ?? perBotFile.sdk?.systemPrompt ?? bot.systemPrompt ?? sharedSystemPrompt;
+        const apiUrl = perBotFile.apiUrl ?? bot.apiUrl ?? config.apiUrl;
+        const model = perBotFile.sdk?.model ?? bot.model ?? config.sdk.model;
+        const resolved = {
+            ...config,
+            bots: undefined, // a per-bot config is single-bot
+            botId: id,
+            botToken,
+            apiUrl,
+            baseDir: config.baseDir,
+            dataDir: botDataDir,
+            cwdBase: botCwdBase,
+            cwd: botCwdBase,
+            memoryBase: botMemoryBase,
+            skillsDir: botSkillsDir,
+            globalSkillsDir,
+            botBlocklist: perBotFile.botBlocklist ?? bot.botBlocklist ?? config.botBlocklist,
+            allowedBotUids: perBotFile.allowedBotUids ?? bot.allowedBotUids ?? config.allowedBotUids,
+            mentionFreeGroups: perBotFile.mentionFreeGroups ?? bot.mentionFreeGroups ?? config.mentionFreeGroups,
+            groupConfigDir: perBotFile.groupConfigDir ?? config.groupConfigDir,
+            sdk: {
+                ...config.sdk,
+                ...(perBotFile.sdk ?? {}),
+                ...(model !== undefined ? { model } : {}),
+                ...(botSystemPrompt !== undefined ? { systemPrompt: botSystemPrompt } : {}),
+            },
+        };
+        if (!isAllowedApiUrl(resolved.apiUrl)) {
+            throw new Error(`Bot "${id}": unsafe apiUrl ${resolved.apiUrl} (SSRF protection)`);
+        }
+        // GROUP.md trust boundary: groupConfigDir must not be the bot's writable cwd.
+        assertGroupConfigDirOutsideCwd(resolved);
+        return resolved;
+    });
+    return resolvedBots;
+}
+/**
+ * v1.1: openclaw-style per-bot personality. Read `<botRoot>/SOUL.md` if it
+ * exists and return its trimmed contents as the bot's "soul" (voice/stance/
+ * boundaries), to be composed into the agent system prompt. Mirrors openclaw's
+ * SOUL.md: a file you edit, not a config string. When the file is absent or
+ * empty, returns undefined so the caller falls back to the `systemPrompt`
+ * config string. Best-effort — a read error never blocks startup.
+ */
+export function loadSoul(botRoot) {
+    const path = pathJoin(botRoot, 'SOUL.md');
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const content = readFileSync(path, 'utf-8').trim();
+        return content.length > 0 ? content : undefined;
+    }
+    catch (err) {
+        console.warn(`[cc-channel-octo] WARNING: failed to read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC;AAsP1F,SAAS,QAAQ;IACf,OAAO;QACL,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE;QACV,uEAAuE;QACvE,2DAA2D;QAC3D,8DAA8D;QAC9D,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,EAAE;QACP,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,EAAE;QACd,GAAG,EAAE;YACH,sEAAsE;YACtE,YAAY,EAAE,GAAG;YACjB,cAAc,EAAE,mBAAmB;YACnC,0EAA0E;YAC1E,4EAA4E;YAC5E,4EAA4E;YAC5E,cAAc,EAAE,CAAC,SAAS,CAAC;SAC5B;QACD,SAAS,EAAE;YACT,YAAY,EAAE,CAAC;SAChB;QACD,OAAO,EAAE;YACP,eAAe,EAAE,IAAI;YACrB,YAAY,EAAE,EAAE;SACjB;QACD,gBAAgB,EAAE,OAAO,EAAE,eAAe;QAC1C,iBAAiB,EAAE,OAAO,EAAE,eAAe;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,cAAsB;IAC5C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CACV,8BAA8B,cAAc,aAAa,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;gBAC9E,8DAA8D,cAAc,EAAE,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;IAC3D,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,MAA+C,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4C,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,+BAA+B,cAAc,KAAK,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,0DAA0D;IAC1D,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAwB,CAAC;AAClC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAuB;IACxD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;QAC5C,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;QACtC,yEAAyE;QACzE,4BAA4B;QAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc;QAC9D,GAAG,EAAE;YACH,GAAG,IAAI,CAAC,GAAG;YACX,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC;SACxB;QACD,SAAS,EAAE;YACT,GAAG,IAAI,CAAC,SAAS;YACjB,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;SAC9B;QACD,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,OAAO;YACf,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;SAC5B;QACD,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB;QACpE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB;QACvE,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY;QACxD,cAAc,EAAE,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc;QAC9D,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB;QACvE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;KACjC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AAEH,MAAM,UAAU,UAAU,CAAC,UAAmB;IAC5C,MAAM,IAAI,GAAG,UAAU,IAAI,mBAAmB,CAAC;IAC/C,oEAAoE;IACpE,8EAA8E;IAC9E,kEAAkE;IAClE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,yDAAyD;YAC7E,mFAAmF;YACnF,mFAAmF;YACnF,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,6EAA6E;IAC7E,2EAA2E;IAC3E,+EAA+E;IAC/E,mEAAmE;IACnE,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAE/C,yEAAyE;IACzE,wEAAwE;IACxE,0BAA0B;IAC1B,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3C,+EAA+E;IAC/E,+EAA+E;IAC/E,4DAA4D;IAC5D,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kBAAkB,KAAK,CAAC,MAAM,4EAA4E,CAC3G,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,+DAA+D;IAC/D,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,CAAC,GAAG,CAAC,gBAAgB,sBAAsB;YAChF,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,8BAA8B,CAAC,GAAW;IACjD,IAAI,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO;IAChC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC;IACvC,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1D,IAAI,gBAAgB,KAAK,eAAe,IAAI,YAAY,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,CAAC,cAAc,kCAAkC;YAC9E,YAAY,OAAO,oDAAoD;YACvE,8EAA8E,CAC/E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,KAAa,EAAE,MAAc;IACjD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;IACnE,OAAO,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,sDAAsD;IACtD,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,CAAC;QAC/B,2EAA2E;QAC3E,2EAA2E;QAC3E,qDAAqD;QACrD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,QAAQ,EAAE,wFAAwF,CACnG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,yDAAyD;QACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE3D,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,QAAQ,EAAE,mCAAmC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEzB,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACnD,MAAM,eAAe,GACnB,OAAO,IAAI,UAAU,CAAC,GAAG,EAAE,YAAY,IAAI,GAAG,CAAC,YAAY,IAAI,kBAAkB,CAAC;QAEpF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QAChE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAErE,MAAM,QAAQ,GAAW;YACvB,GAAG,MAAM;YACT,IAAI,EAAE,SAAS,EAAE,iCAAiC;YAClD,KAAK,EAAE,EAAE;YACT,QAAQ;YACR,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,UAAU;YACnB,GAAG,EAAE,UAAU;YACf,UAAU,EAAE,aAAa;YACzB,SAAS,EAAE,YAAY;YACvB,eAAe;YACf,YAAY,EAAE,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY;YAChF,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc;YACxF,iBAAiB,EACf,UAAU,CAAC,iBAAiB,IAAI,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC,iBAAiB;YACnF,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc;YAClE,GAAG,EAAE;gBACH,GAAG,MAAM,CAAC,GAAG;gBACb,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E;SACF,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,oBAAoB,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAAC;QACrF,CAAC;QACD,8EAA8E;QAC9E,8BAA8B,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,6CAA6C,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACzG,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}