@monoes/monomindcli 2.16.12 → 2.16.14

package/dist/src/orgrt/session-prompt.js

@@ -0,0 +1,115 @@
+// packages/@monomind/cli/src/orgrt/session-prompt.ts
+// Extracted from session.ts — a role session's system prompt and model.
+import { readFileSync } from 'node:fs';
+import { endpointBriefingLines } from './endpoint-roles.js';
+import { expandRolePromptVars, promptVarsFor } from './prompt-vars.js';
+import { roleSkillGuidance } from './skill-library.js';
+import { DEFAULT_CLAUDE_MODEL, VERCEL_PROVIDERS } from './vercel-providers.js';
+/**
+ * Resolves the extra system-prompt block for a role: its pinned library
+ * skills and on-demand skill catalog (skill-library.ts) plus the role's own
+ * `instructions_file`, if any — all optional and independent. A missing or
+ * unreadable `instructions_file` is skipped (not an error): a role shouldn't
+ * fail to start a session over a stale/typo'd custom-file path.
+ */
+export function resolveRoleExtraGuidance(role, projectRoot) {
+    const parts = [];
+    const skills = roleSkillGuidance(role, projectRoot);
+    if (skills)
+        parts.push(skills);
+    if (role.instructions_file) {
+        try {
+            const custom = readFileSync(role.instructions_file, 'utf-8').trim();
+            if (custom)
+                parts.push(custom);
+        }
+        catch {
+            // missing/unreadable custom instructions file — skip, don't crash session start
+        }
+    }
+    return parts.length ? parts.join('\n\n') : undefined;
+}
+/** Resolve the model string for a role: explicit adapter_config.model wins;
+ *  otherwise fall back to the vendor/runtime default.
+ *
+ *  Vendor defaults are read straight off VERCEL_PROVIDERS, which already
+ *  carries a defaultModel per vendor. A second hand-kept table lived here and
+ *  restated all sixteen of them — two lists of per-vendor defaults that would
+ *  eventually disagree, which is precisely the drift #252 was. An empty
+ *  registry default (openai-compatible, which serves arbitrary endpoints) is
+ *  falsy and so falls through to the runtime switch, as it always did. */
+export function resolveModel(role, runtime, vendor) {
+    const explicit = role.adapter_config?.model;
+    if (explicit)
+        return explicit;
+    const vendorDefault = vendor ? VERCEL_PROVIDERS[vendor]?.defaultModel : undefined;
+    if (vendorDefault)
+        return vendorDefault;
+    switch (runtime) {
+        case 'claude':
+            return DEFAULT_CLAUDE_MODEL;
+        // Kimi Code CLI namespaces model ids as <provider>/<model> (its own
+        // default_model is "kimi-code/kimi-for-coding-highspeed") — a bare "k3"
+        // 404s with "Model \"k3\" is not configured in config.toml".
+        case 'kimicode':
+            return 'kimi-code/k3';
+        case 'opencode':
+            return 'glm-5.2'; // opencode is typically paired with a vendor; this is the bare-runtime fallback
+        case 'codex':
+            return 'gpt-5.6-terra';
+        case 'antigravity':
+            return 'gemini-3.6-flash-high';
+        case 'vercel':
+            return 'gpt-5.5';
+        default:
+            return DEFAULT_CLAUDE_MODEL;
+    }
+}
+/** Role briefing given to each agent session (SDK systemPrompt option).
+ *  `extraGuidance` carries pre-resolved text the caller already loaded from
+ *  disk — the role's library skills and/or its own `instructions_file`,
+ *  if either resolved to something. Kept as a plain string param (not read here)
+ *  so this function stays synchronous/pure and trivially testable. */
+export function buildRolePrompt(role, def, roster, glossary, extraGuidance, 
+/** M2: one line per endpoint role (endpointBriefingLines) — boss only. */
+endpointBriefing) {
+    const isCoordinator = role.reports_to == null;
+    return [
+        `You are agent "${role.id}" (${role.title || role.type}) in the org "${def.name}".`,
+        `Org goal: ${def.goal}`,
+        isCoordinator ? `You are the coordinator of this org.` : `You report to "${role.reports_to}".`,
+        role.responsibilities?.length
+            ? `Your responsibilities:\n- ${role.responsibilities.join('\n- ')}`
+            : '',
+        extraGuidance || '',
+        `## Communication protocol`,
+        `The ONLY way to communicate with other agents is the org_send tool.`,
+        `Roster: ${roster.join(', ')}. Address another org's agent as "<org-name>:<role-id>".`,
+        endpointBriefing?.length ? `Automations in this org:\n${endpointBriefing.join('\n')}` : '',
+        `If you need a human decision, call ask_human with your question, then end your turn - you'll receive the human's answer as a new message when it arrives. Do not call ask_human for anything you can resolve yourself.`,
+        `For irreversible or high-risk actions (deployments, deletions, external communications), call org_gate to create a decision gate — a hard-blocking approval checkpoint. End your turn and wait for the human's approval or rejection before proceeding.`,
+        `You can structure work as a task DAG: use org_task to create tasks with dependencies, org_task_done to mark them complete, and org_tasks to see the full DAG. Tasks with satisfied dependencies are automatically dispatched to their assignee.`,
+        `The work graph is dynamic: call org_task_split when scope expands, org_task_merge when parallel branches converge early, or org_task_cancel when evidence makes a planned task moot. Use org_plan_graph to propose a full work graph in one call when you know the plan upfront. If a task genuinely can't proceed until a specific real-world time — a scheduled long-running process, a deadline someone gave you, anything with a known future unblock time — call org_task_block instead of leaving it idle: it stops the idle watchdog from nudging you about it and automatically resumes the task when the time arrives, instead of you repeatedly re-confirming "still waiting" every idle cycle.`,
+        `Before starting substantial work, call org_recall to check what previous runs already learned or delivered - do not redo finished work.`,
+        `The user's documents (notes, handbooks, specs) are searchable with knowledge_search - ground your work in them instead of guessing; results labeled [global] come from the user's personal cross-project brain.`,
+        `When you receive a message, act on it, then org_send your result to the requester.`,
+        isCoordinator
+            ? `When the org's goal for this run is achieved (or clearly can't be): first call org_learn ONCE with the durable knowledge this run produced, then call org_complete exactly once with the outcome and a concise summary. Then end your turn.`
+            : `When your current work is complete and no reply is needed, end your turn without further tool calls.`,
+        isCoordinator && glossary?.length
+            ? `Known entities (reuse these EXACT names in org_learn instead of near-duplicates): ${glossary.slice(0, 40).join(', ')}`
+            : '',
+    ]
+        .filter(Boolean)
+        .join('\n\n');
+}
+/** The system prompt one session of this role is built with. */
+export function rolePromptFor(opts) {
+    return buildRolePrompt(expandRolePromptVars(opts.role, promptVarsFor(opts.orgRoot ?? opts.cwd)), (opts.def ?? { name: opts.org, goal: '' }), opts.def?.roles.map((r) => r.id) ?? [opts.role.id], opts.glossary, 
+    // D7: the loadout's text follows the role's own guidance. With no
+    // loadout this is exactly resolveRoleExtraGuidance(role), as before.
+    [resolveRoleExtraGuidance(opts.role, opts.orgRoot ?? opts.cwd), opts.loadout?.guidance]
+        .filter(Boolean)
+        .join('\n\n') || undefined, opts.onComplete ? endpointBriefingLines(opts.def) : undefined);
+}
+//# sourceMappingURL=session-prompt.js.map

package/dist/src/orgrt/session-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-prompt.js","sourceRoot":"","sources":["../../../src/orgrt/session-prompt.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,wEAAwE;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAa,EAAE,WAAoB;IAC1E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YACpE,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;;;;0EAQ0E;AAC1E,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,OAAgB,EAAE,MAAe;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC;IAC5C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,oBAAoB,CAAC;QAC9B,oEAAoE;QACpE,wEAAwE;QACxE,6DAA6D;QAC7D,KAAK,UAAU;YACb,OAAO,cAAc,CAAC;QACxB,KAAK,UAAU;YACb,OAAO,SAAS,CAAC,CAAC,gFAAgF;QACpG,KAAK,OAAO;YACV,OAAO,eAAe,CAAC;QACzB,KAAK,aAAa;YAChB,OAAO,uBAAuB,CAAC;QACjC,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,oBAAoB,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;sEAIsE;AACtE,MAAM,UAAU,eAAe,CAC7B,IAAa,EACb,GAAkC,EAClC,MAAgB,EAChB,QAAmB,EACnB,aAAsB;AACtB,0EAA0E;AAC1E,gBAA2B;IAE3B,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,OAAO;QACL,kBAAkB,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,iBAAiB,GAAG,CAAC,IAAI,IAAI;QACnF,aAAa,GAAG,CAAC,IAAI,EAAE;QACvB,aAAa,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,UAAU,IAAI;QAC9F,IAAI,CAAC,gBAAgB,EAAE,MAAM;YAC3B,CAAC,CAAC,6BAA6B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE;QACN,aAAa,IAAI,EAAE;QACnB,2BAA2B;QAC3B,qEAAqE;QACrE,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,0DAA0D;QACtF,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,6BAA6B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QAC1F,wNAAwN;QACxN,yPAAyP;QACzP,iPAAiP;QACjP,2qBAA2qB;QAC3qB,yIAAyI;QACzI,iNAAiN;QACjN,oFAAoF;QACpF,aAAa;YACX,CAAC,CAAC,6OAA6O;YAC/O,CAAC,CAAC,sGAAsG;QAC1G,aAAa,IAAI,QAAQ,EAAE,MAAM;YAC/B,CAAC,CAAC,qFAAqF,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACzH,CAAC,CAAC,EAAE;KACP;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,OAAO,eAAe,CACpB,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EACxE,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAW,EACpD,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAClD,IAAI,CAAC,QAAQ;IACb,kEAAkE;IAClE,qEAAqE;IACrE,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;SACpF,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,MAAM,CAAC,IAAI,SAAS,EAC5B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAC9D,CAAC;AACJ,CAAC"}

package/dist/src/orgrt/session-run.d.ts

@@ -0,0 +1,18 @@
+import type { CumulativeMeter } from './cumulative-meter.js';
+import type { StreamOptions } from './mailbox.js';
+import type { TokenUsage } from './policy.js';
+import { type FaultRestarts } from './sandbox-fault.js';
+import type { SessionOpts } from './session-types.js';
+/** One bounded SDK session for a role; resolves with the SDK's session_id (for
+ *  resuming on restart) and whether it ended by hitting the turn limit (so the
+ *  caller can push a continuation) when the stream ends (mailbox closed or
+ *  maxTurns reached). */
+export declare function runOneSession(opts: SessionOpts, resume?: string, costTotals?: CumulativeMeter<{
+    usd: number;
+}>, progress?: {
+    replied: boolean;
+}, tokenTotals?: CumulativeMeter<TokenUsage>, streamOpts?: StreamOptions, faultWatch?: ReturnType<FaultRestarts['watch']>, cancelled?: AbortSignal): Promise<{
+    sessionId?: string;
+    hitTurnLimit?: boolean;
+}>;
+//# sourceMappingURL=session-run.d.ts.map

package/dist/src/orgrt/session-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-run.d.ts","sourceRoot":"","sources":["../../../src/orgrt/session-run.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C,OAAO,EAAE,KAAK,aAAa,EAAqB,MAAM,oBAAoB,CAAC;AAI3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAQtD;;;yBAGyB;AACzB,wBAAsB,aAAa,CACjC,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,EAC7C,QAAQ,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAC/B,WAAW,CAAC,EAAE,eAAe,CAAC,UAAU,CAAC,EACzC,UAAU,CAAC,EAAE,aAAa,EAC1B,UAAU,CAAC,EAAE,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAC/C,SAAS,CAAC,EAAE,WAAW,GACtB,OAAO,CAAC;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqZzD"}

package/dist/src/orgrt/session-run.js

@@ -0,0 +1,429 @@
+// packages/@monomind/cli/src/orgrt/session-run.ts
+// Extracted from session.ts — one bounded runner session for a role (runOneSession).
+import { homedir } from 'node:os';
+import { ClaudeAgentRunner, defaultClaudeRunner } from './agent-runner.js';
+import { ensureAuthorityDirs } from './authority-mask.js';
+import { resolveRoleCostTier } from './cost-tier.js';
+import { buildOrgTools } from './org-tools.js';
+import { summarizeToolOutput } from './policy.js';
+import { resolveRoleProvider } from './provider.js';
+import { resolveRoleGitEnforcement, roleAuthorityMask } from './role-sandbox.js';
+import { ProcessFaultError } from './sandbox-fault.js';
+import { sandboxStubPaths, sandboxStubs } from './sandbox-stubs.js';
+import { resolveModel } from './session-prompt.js';
+import { openSessionStream, sessionRunArgs } from './session-stream.js';
+import { addTo, emitUsage, resultBreakdown, totalTokens, turnBreakdown } from './session-usage.js';
+import { StateDetector } from './state-detector.js';
+import { linkAbort } from './task-cancel.js';
+const CONTEXT_LIMIT_RE = /context.window.limit|context.length.exceeded|maximum.context/i;
+/** One bounded SDK session for a role; resolves with the SDK's session_id (for
+ *  resuming on restart) and whether it ended by hitting the turn limit (so the
+ *  caller can push a continuation) when the stream ends (mailbox closed or
+ *  maxTurns reached). */
+export async function runOneSession(opts, resume, costTotals, progress, tokenTotals, streamOpts, faultWatch, cancelled) {
+    const { org, role, bus, policy, mailbox, cwd } = opts;
+    // Each call starts a new runner process, whose cumulative totals may or may
+    // not continue the previous one's (cumulative-meter.ts).
+    costTotals?.newProcess();
+    tokenTotals?.newProcess();
+    // Read lastMessageId live from opts instead of capturing at session start
+    // This ensures chat responses link to the most recent message delivered
+    const getLastMessageId = () => (opts.lastMessageId ? opts.lastMessageId() : undefined);
+    // Resolve runner. Precedence: explicit runner > queryFn-wrapped > default.
+    // queryFn stays supported so daemon.ts / test-loop.ts need no changes.
+    const runner = opts.runner ?? (opts.queryFn ? new ClaudeAgentRunner(opts.queryFn) : defaultClaudeRunner);
+    const tools = buildOrgTools(opts);
+    // M1: provider tools are listed per session start, so a hot-reloaded
+    // tool_providers block takes effect at the role's next session.
+    const providerSet = opts.buildProviderTools ? await opts.buildProviderTools() : undefined;
+    if (providerSet)
+        tools.push(...providerSet.tools);
+    // Named-provider resolution (`adapter_config.provider`): explicit role
+    // provider wins, else the named entry from `monomind providers configure`.
+    // The named provider's default model fills in adapter_config.model when the
+    // role didn't pin one.
+    const prov = resolveRoleProvider(role, opts.orgRoot ?? opts.cwd);
+    // ADR-O001 D8: the role's cost tier, when the org declares one. Resolved
+    // here — the single choke point where a role's model is decided — so the
+    // documented precedence holds in exactly one place:
+    //   explicit adapter_config.model > tier > named-provider default > runtime
+    // The tier's EFFORT is applied even when the model came from an explicit
+    // pin: which model to run and how hard to think are separate axes, and
+    // silently dropping the effort because a model was pinned would be the
+    // "silent downgrade" this decision exists to prevent.
+    // Throws (fails the session) rather than guessing when the tier has no
+    // entry for this role's provider — daemon.ts validates the whole roster
+    // up front so that is normally caught before any token is spent.
+    const tier = resolveRoleCostTier({
+        role,
+        def: opts.def,
+        vendor: role.provider?.vendor ?? prov.cfg?.vendor,
+    });
+    const model = role.adapter_config?.model ??
+        tier?.model ??
+        prov.defaultModel ??
+        resolveModel(role, role.runtime, role.provider?.vendor ?? prov.cfg?.vendor);
+    bus.emit({ type: 'status', from: role.id, msg: 'session starting' });
+    let sessionId = resume;
+    let hitTurnLimit = false;
+    let contextLimitFired = false;
+    // #budget-realtime: real tokens already accounted for the message CURRENTLY
+    // in flight, via the per-assistant-turn accounting below — reset to 0 each
+    // time a 'result' message ends one mailbox message and the next one starts.
+    // Exists purely so the 'result' branch never re-adds what this branch
+    // already added (see there for why it can't just always add).
+    let messageTurnTokens = { input: 0, output: 0, cacheRead: 0, cacheCreation: 0 };
+    // Abort hook for the runner (AgentRunArgs.signal): the silent-stream
+    // abort below used to call iterator.return() only, which queues behind a
+    // subprocess runner blocked in `for await (child.stdout)` — the child was
+    // never killed, so every supervisor retry stacked another live CLI.
+    //
+    // Per attempt, linked one way to the caller's externalAbort (#256): the
+    // silent-stream abort used to fire the daemon's slot controller itself,
+    // permanently. Every retry then started on an already-aborted signal (a
+    // runner honoring it kills its child at once) and the daemon's crash
+    // backoff, which races that controller to notice an org stop, resolved
+    // immediately - the role burned its retries and crashed. An org stop still
+    // aborts the attempt; the attempt's own abort stays its own.
+    const abort = new AbortController();
+    const external = opts.externalAbort?.signal;
+    const onExternalAbort = () => abort.abort(external?.reason);
+    if (external?.aborted)
+        onExternalAbort();
+    else
+        external?.addEventListener('abort', onExternalAbort, { once: true });
+    // org_task_cancel for this process's task: end it the same way (task-cancel.ts).
+    // Already aborted when it landed during the setup awaits above.
+    const unlinkCancelled = linkAbort(cancelled, abort);
+    try {
+        // #258: policy.git enforced where git runs, not only by Bash text
+        // classification — guard env for every runtime, OS sandbox + file-tool
+        // deny rules for Claude. Throws (session fails) when the role requires
+        // the sandbox and it can't start.
+        // Before the sandbox is built: it can only mask directories that exist.
+        ensureAuthorityDirs(homedir(), process.env);
+        const gitEnforcement = resolveRoleGitEnforcement({
+            org,
+            role,
+            cwd,
+            orgRoot: opts.orgRoot,
+            orgDir: opts.orgDir,
+            bus,
+            claudeRuntime: runner instanceof ClaudeAgentRunner,
+            runtime: role.runtime ?? opts.def?.runtime,
+            // The sandbox's mount-point stubs, created once and kept until the run
+            // ends, so no other role's process deletes one mid-bind (sandbox-stubs.ts).
+            // Held before the deny list is built, which keeps a denied cwd read-only
+            // when all of them are in place (sandbox-deny-write.ts).
+            holdStubs: (writableRoots) => {
+                const paths = sandboxStubPaths({ cwd, home: homedir(), writableRoots, env: process.env });
+                sandboxStubs.hold(`${org}:${opts.run ?? ''}`, paths);
+                return sandboxStubs.missing(paths);
+            },
+        });
+        // What this session really got, not what the config asked for (policy-git.ts).
+        policy.setOsSandboxed(!!gitEnforcement.claudeRestrictions?.sandbox);
+        const authorityMask = roleAuthorityMask({
+            bus,
+            roleId: role.id,
+            inSdkSandbox: !!gitEnforcement.claudeRestrictions?.sandbox,
+            // vercel runs in-process with no shell; its file tools go through the policy engine.
+            inProcess: (role.runtime ?? opts.def?.runtime) === 'vercel',
+            cwd,
+            orgRoot: opts.orgRoot,
+        });
+        const stream = runner.run(sessionRunArgs(opts, {
+            runner,
+            tools,
+            streamOpts,
+            gitEnforcement,
+            model,
+            tier,
+            prov,
+            resume,
+            authorityMask,
+            abort,
+        }));
+        const detector = new StateDetector();
+        const rest = await openSessionStream(opts, stream, abort);
+        for await (const m of rest) {
+            if (process.env.MONOMIND_DEBUG) {
+                console.error(`[orgrt:${org}/${role.id}] runner message type=${m.type} subtype=${String(m.subtype ?? '-')}`);
+            }
+            if (cancelled?.aborted)
+                throw cancelled.reason;
+            mailbox.observeTurn(m.type); // the prompt stream outlives a live turn (#331)
+            if (m.session_id) {
+                sessionId = m.session_id;
+                // P2-13: propagate the session ID back to the daemon so checkpoints
+                // can resume the SDK session after a crash/restart.
+                opts.onSessionId?.(sessionId);
+            }
+            const prevState = detector.current();
+            const textForDetect = m.type === 'assistant' ? m.text || '' : undefined;
+            const newState = detector.onMessage(m.type, m.subtype, textForDetect);
+            if (newState !== prevState) {
+                bus.emit({
+                    type: 'status',
+                    from: role.id,
+                    reason: 'state-change',
+                    msg: `${prevState} → ${newState}`,
+                    data: { from: prevState, to: newState },
+                });
+            }
+            if (m.type === 'assistant') {
+                if (progress)
+                    progress.replied = true;
+                const text = m.text || '';
+                if (text.trim()) {
+                    opts.onOutput?.(text);
+                    bus.emit({ type: 'chat', from: role.id, msg: text, parentId: getLastMessageId() });
+                    if (opts.onContextLimit && !contextLimitFired && CONTEXT_LIMIT_RE.test(text)) {
+                        contextLimitFired = true;
+                        bus.emit({
+                            type: 'audit',
+                            from: role.id,
+                            reason: 'boss-context-limit',
+                            msg: 'coordinator context window exhausted — requesting whole-org restart with fresh sessions',
+                        });
+                        opts.onContextLimit();
+                    }
+                }
+                // #budget-realtime (HIGH): the SDK's 'result' message arrives once per
+                // WHOLE mailbox message in streaming-input mode — with
+                // max_turns_per_message defaulting to 100,000, a single message can
+                // internally loop through hundreds/thousands of tool-use turns before
+                // that 'result' ever arrives, during which policy.used never moved and
+                // policy.decide() allowed every one of those turns' tool calls
+                // regardless of real spend (the overspend was already done by the time
+                // overBudget could ever trip). Each 'assistant' SDK message DOES carry
+                // that ONE model turn's real usage (agent-runner.ts reads it off
+                // BetaMessage.usage) — accumulate it as turns actually happen and
+                // enforce the budget immediately, so overBudget can close the mailbox
+                // DURING a runaway message instead of only once it finally completes.
+                // (USD budget can't get the same real-time treatment: the SDK only
+                // exposes cost as a cumulative total on 'result', not per-turn on
+                // 'assistant' — verified against this project's Claude Agent SDK
+                // .d.ts, which puts `usage`/token counts on BetaMessage but cost only
+                // on SDKResultSuccess.total_cost_usd/modelUsage. overBudgetUsd is
+                // still checked below, once per message, same as before this fix.)
+                //
+                // ADR-O001 D1: the sum must include BOTH cache fields. They are
+                // siblings of input_tokens in the Anthropic API, not subsets of it —
+                // `input_tokens` is the uncached remainder — and both are billable
+                // (~0.1x and ~1.25x input). Omitting them meant the better the cache
+                // worked the less the meter saw: on one measured run, 2,765M tokens
+                // billed against 8.1M recorded, with input_tokens at 0.0M.
+                const turn = turnBreakdown(m);
+                const turnTokens = totalTokens(turn);
+                if (turnTokens > 0) {
+                    addTo(messageTurnTokens, turn);
+                    policy.addTokenUsage(turn);
+                    if (policy.overBudget) {
+                        bus.emit({
+                            type: 'status',
+                            from: role.id,
+                            reason: 'budget-exhausted',
+                            msg: 'token budget exhausted - closing session',
+                        });
+                        mailbox.close('token-budget');
+                    }
+                }
+            }
+            else if (m.type === 'tool_result') {
+                // #289: the tool call's outcome. Until this event existed, a Bash
+                // running a test suite looked identical on the bus whether the suite
+                // passed, failed, or the binary was missing — one 'allow' at the moment
+                // it started — so every consumer inferred success from the agent's own
+                // narration. `call_id` joins this back to that invocation event; the
+                // body is redacted and capped (policy.ts) so a megabyte of output, or a
+                // credential echoed by a command, never lands in bus.jsonl.
+                const body = summarizeToolOutput(m.text ?? '');
+                const data = {
+                    ...(m.tool_use_id ? { call_id: m.tool_use_id } : {}),
+                    ok: m.is_error !== true,
+                    ...(typeof m.duration_ms === 'number' ? { duration_ms: m.duration_ms } : {}),
+                    output: body.output,
+                    ...(body.truncated ? { truncated: true } : {}),
+                    output_chars: body.output_chars,
+                };
+                bus.emit({
+                    type: 'tool_result',
+                    from: role.id,
+                    ...(m.tool ? { tool: m.tool } : {}),
+                    data: data,
+                });
+                faultWatch?.observe(m, sessionId);
+            }
+            else if (m.type === 'result') {
+                // ADR-O001 D1: prefer the SDK's `modelUsage` over `usage`. The SDK
+                // documents `usage` as "MAIN AGENT LOOP ONLY — excludes Task
+                // subagent, sidechain, and auxiliary model calls ... Prefer
+                // modelUsage for token/cost accounting"; the measured run made 46
+                // subagent calls this counter never saw. modelUsage is CUMULATIVE per
+                // session (same lifecycle as total_cost_usd, per its own type doc),
+                // so it is converted to a delta here rather than added, exactly as
+                // cost is below. A runner that reports no modelUsage falls back to
+                // the per-turn `usage` fields, which keep their old semantics.
+                const resultTokens = resultBreakdown(m, tokenTotals, m.session_id ?? sessionId ?? '');
+                // Per the SDK's own type docs, a 'result' message's usage is that
+                // message's own (effectively last-turn) usage in streaming-input mode,
+                // NOT a cumulative total across every turn of the mailbox message —
+                // and that last turn was already counted above via its own 'assistant'
+                // message, specifically so overBudget could trip mid-message. Adding
+                // the result's own usage again unconditionally would double-count it.
+                // (A modelUsage-derived delta is per-session-cumulative, so the same
+                // subtraction is exactly right there too: it removes what the
+                // assistant turns of THIS message already contributed and leaves the
+                // subagent/auxiliary volume the main loop never reported.) Only make
+                // up the shortfall (never negative) so a turn whose usage somehow
+                // never reached the 'assistant' branch (e.g. a runner/test double that
+                // doesn't emit per-turn usage) still gets counted at least once.
+                const shortfall = {
+                    input: Math.max(0, resultTokens.input - messageTurnTokens.input),
+                    output: Math.max(0, resultTokens.output - messageTurnTokens.output),
+                    cacheRead: Math.max(0, resultTokens.cacheRead - messageTurnTokens.cacheRead),
+                    cacheCreation: Math.max(0, resultTokens.cacheCreation - messageTurnTokens.cacheCreation),
+                };
+                if (totalTokens(shortfall) > 0)
+                    policy.addTokenUsage(shortfall);
+                // What this whole mailbox message actually added to the meter: the
+                // per-turn accounting above plus whatever the result topped up. This
+                // is what the 'usage' event reports, so a consumer summing events
+                // lands on the same number as policy.usage.
+                const messageTokens = {
+                    input: messageTurnTokens.input + shortfall.input,
+                    output: messageTurnTokens.output + shortfall.output,
+                    cacheRead: messageTurnTokens.cacheRead + shortfall.cacheRead,
+                    cacheCreation: messageTurnTokens.cacheCreation + shortfall.cacheCreation,
+                };
+                messageTurnTokens = { input: 0, output: 0, cacheRead: 0, cacheCreation: 0 };
+                // Convert the SDK's cumulative total_cost_usd into a per-result
+                // delta before emitting - downstream sums usage events. A new session
+                // id counts in full; a same-process dip (rounding, a provider-side
+                // correction) floors at 0 rather than re-adding the cumulative cost,
+                // which feeds USD budget enforcement (ORG-7). A resume in a new
+                // process is judged by the meter (cumulative-meter.ts).
+                let costDelta = m.cost_usd;
+                if (costTotals && typeof m.cost_usd === 'number' && Number.isFinite(m.cost_usd)) {
+                    const sid = m.session_id ?? sessionId ?? '';
+                    costDelta = costTotals.delta(sid, { usd: m.cost_usd }).usd;
+                }
+                // ORG-7: accumulate real USD cost so policy.overBudgetUsd (role.budget_usd) is enforceable.
+                if (typeof costDelta === 'number' && Number.isFinite(costDelta))
+                    policy.addUsageUsd(costDelta);
+                emitUsage(bus, role.id, messageTokens, costDelta, m.subtype);
+                if (m.subtype && m.subtype !== 'success') {
+                    if (m.subtype === 'error_max_turns')
+                        hitTurnLimit = true;
+                    bus.emit({
+                        type: 'audit',
+                        from: role.id,
+                        reason: 'session-result-error',
+                        msg: `turn ended with subtype "${m.subtype}"${m.is_error ? ' (is_error)' : ''} - the role produced no usable output`,
+                    });
+                    if (opts.circuitBreaker && m.subtype !== 'error_max_turns') {
+                        const cb = opts.circuitBreaker;
+                        cb.state.failures++;
+                        if (cb.state.failures >= cb.threshold) {
+                            cb.state.tripped = true;
+                            bus.emit({
+                                type: 'audit',
+                                from: role.id,
+                                reason: 'circuit-breaker-tripped',
+                                msg: `circuit breaker tripped after ${cb.state.failures} consecutive failures — closing role`,
+                                data: { failures: cb.state.failures, threshold: cb.threshold },
+                            });
+                            mailbox.close();
+                        }
+                    }
+                }
+                else if (m.subtype === 'success' && opts.circuitBreaker) {
+                    opts.circuitBreaker.state.failures = 0;
+                }
+                if (policy.overBudget) {
+                    bus.emit({
+                        type: 'status',
+                        from: role.id,
+                        reason: 'budget-exhausted',
+                        msg: 'token budget exhausted - closing session',
+                    });
+                    // #205: tag WHY the mailbox closed. A budget-exhausted boss is
+                    // recoverable (raise the budget, resume) — the idle watchdog reads
+                    // this to stop reporting it as generic "unreachable" (crash-like).
+                    mailbox.close('token-budget');
+                }
+                // ORG-7: parallel USD-budget enforcement, same pattern as the token check above.
+                if (policy.overBudgetUsd) {
+                    bus.emit({
+                        type: 'status',
+                        from: role.id,
+                        reason: 'budget-exhausted',
+                        msg: 'USD budget exhausted - closing session',
+                    });
+                    mailbox.close('usd-budget');
+                }
+                // The turn is over: whatever tool calls it was going to make, it has
+                // made. What the role left open is knowable here (decisions.ts's
+                // nudgeOpenTasksAtTurnEnd) instead of only to the idle watchdog.
+                opts.onTurnEnd?.();
+            }
+        }
+        if (cancelled?.aborted)
+            throw cancelled.reason;
+        bus.emit({ type: 'status', from: role.id, msg: 'session ended' });
+        return { sessionId, hitTurnLimit };
+    }
+    catch (err) {
+        // The turn in flight never got its 'result', so its metered turns (already
+        // in policy) have no usage event yet. Cost is only on 'result': unknown.
+        if (totalTokens(messageTurnTokens) > 0)
+            emitUsage(bus, role.id, messageTurnTokens, undefined, 'aborted');
+        // Ending the process was the point; sandbox-fault.ts already audited it.
+        if (err instanceof ProcessFaultError)
+            throw err;
+        if (cancelled?.aborted)
+            throw cancelled.reason;
+        // org_complete / org stop close the mailbox and abort every session: a
+        // normal stop, not a failure. The daemon still classifies it.
+        const message = err instanceof Error ? err.message : String(err);
+        if ((mailbox.isClosed || (external?.aborted ?? false)) &&
+            (err?.name === 'AbortError' || /\baborted\b/i.test(message))) {
+            bus.emit({
+                type: 'status',
+                from: role.id,
+                reason: 'session-stopped',
+                msg: 'session stopped',
+            });
+            throw err;
+        }
+        // #304: the daemon's role loop catches this same error one step later and
+        // emits the authoritative CLASSIFIED status — crashed / stopped with the
+        // org / terminated by stop — carrying the real error text when it is a
+        // genuine crash (daemon.ts's 'agent-session-crash' audit). This
+        // breadcrumb must not pre-empt that with the raw SDK string: on a
+        // planned stop it announced "Claude Code process aborted by user" about
+        // a stop nobody requested. It deliberately does NOT classify —
+        // session.ts relays, the daemon decides — and it carries a `reason` so
+        // it is filterable; its absence is why every #304/#251 test was
+        // structurally unable to see this event.
+        bus.emit({
+            type: 'status',
+            from: role.id,
+            reason: 'session-error',
+            msg: 'session ended with an error — see the classified status that follows',
+        });
+        throw err;
+    }
+    finally {
+        // Unlink so a long-lived role doesn't pile a listener per attempt onto the
+        // slot controller. Aborting the finished attempt keeps a runner abandoned
+        // mid-stream by a throw from outliving it now that an org stop can no
+        // longer reach it.
+        external?.removeEventListener('abort', onExternalAbort);
+        unlinkCancelled();
+        abort.abort();
+        providerSet?.close();
+    }
+}
+//# sourceMappingURL=session-run.js.map

package/dist/src/orgrt/session-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-run.js","sourceRoot":"","sources":["../../../src/orgrt/session-run.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,qFAAqF;AAErF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAsB,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAG7C,MAAM,gBAAgB,GAAG,+DAA+D,CAAC;AAEzF;;;yBAGyB;AACzB,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAiB,EACjB,MAAe,EACf,UAA6C,EAC7C,QAA+B,EAC/B,WAAyC,EACzC,UAA0B,EAC1B,UAA+C,EAC/C,SAAuB;IAEvB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACtD,4EAA4E;IAC5E,yDAAyD;IACzD,UAAU,EAAE,UAAU,EAAE,CAAC;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEvF,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;IAE5F,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,qEAAqE;IACrE,gEAAgE;IAChE,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,IAAI,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAElD,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,uBAAuB;IACvB,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,yEAAyE;IACzE,yEAAyE;IACzE,oDAAoD;IACpD,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,sDAAsD;IACtD,uEAAuE;IACvE,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,IAAI,GAAG,mBAAmB,CAAC;QAC/B,IAAI;QACJ,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM;KAClD,CAAC,CAAC;IACH,MAAM,KAAK,GACT,IAAI,CAAC,cAAc,EAAE,KAAK;QAC1B,IAAI,EAAE,KAAK;QACX,IAAI,CAAC,YAAY;QACjB,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE9E,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAErE,IAAI,SAAS,GAAuB,MAAM,CAAC;IAC3C,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,sEAAsE;IACtE,8DAA8D;IAC9D,IAAI,iBAAiB,GAAe,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC5F,qEAAqE;IACrE,yEAAyE;IACzE,0EAA0E;IAC1E,oEAAoE;IACpE,EAAE;IACF,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IAC5C,MAAM,eAAe,GAAG,GAAS,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,OAAO;QAAE,eAAe,EAAE,CAAC;;QACpC,QAAQ,EAAE,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,iFAAiF;IACjF,gEAAgE;IAChE,MAAM,eAAe,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,kEAAkE;QAClE,uEAAuE;QACvE,uEAAuE;QACvE,kCAAkC;QAClC,wEAAwE;QACxE,mBAAmB,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,cAAc,GAAG,yBAAyB,CAAC;YAC/C,GAAG;YACH,IAAI;YACJ,GAAG;YACH,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG;YACH,aAAa,EAAE,MAAM,YAAY,iBAAiB;YAClD,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO;YAC1C,uEAAuE;YACvE,4EAA4E;YAC5E,yEAAyE;YACzE,yDAAyD;YACzD,SAAS,EAAE,CAAC,aAAa,EAAE,EAAE;gBAC3B,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC1F,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBACrD,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;SACF,CAAC,CAAC;QACH,+EAA+E;QAC/E,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,iBAAiB,CAAC;YACtC,GAAG;YACH,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,YAAY,EAAE,CAAC,CAAC,cAAc,CAAC,kBAAkB,EAAE,OAAO;YAC1D,qFAAqF;YACrF,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,QAAQ;YAC3D,GAAG;YACH,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CACvB,cAAc,CAAC,IAAI,EAAE;YACnB,MAAM;YACN,KAAK;YACL,UAAU;YACV,cAAc;YACd,KAAK;YACL,IAAI;YACJ,IAAI;YACJ,MAAM;YACN,aAAa;YACb,KAAK;SACN,CAAC,CACH,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAE1D,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;gBAC/B,OAAO,CAAC,KAAK,CACX,UAAU,GAAG,IAAI,IAAI,CAAC,EAAE,yBAAyB,CAAC,CAAC,IAAI,YAAY,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,EAAE,CAC9F,CAAC;YACJ,CAAC;YACD,IAAI,SAAS,EAAE,OAAO;gBAAE,MAAM,SAAS,CAAC,MAAM,CAAC;YAC/C,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gDAAgD;YAC7E,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBACjB,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC;gBACzB,oEAAoE;gBACpE,oDAAoD;gBACpD,IAAI,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACtE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,IAAI,CAAC,EAAE;oBACb,MAAM,EAAE,cAAc;oBACtB,GAAG,EAAE,GAAG,SAAS,MAAM,QAAQ,EAAE;oBACjC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC3B,IAAI,QAAQ;oBAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;gBACtC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;oBAChB,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;oBACtB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;oBACnF,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC7E,iBAAiB,GAAG,IAAI,CAAC;wBACzB,GAAG,CAAC,IAAI,CAAC;4BACP,IAAI,EAAE,OAAO;4BACb,IAAI,EAAE,IAAI,CAAC,EAAE;4BACb,MAAM,EAAE,oBAAoB;4BAC5B,GAAG,EAAE,yFAAyF;yBAC/F,CAAC,CAAC;wBACH,IAAI,CAAC,cAAc,EAAE,CAAC;oBACxB,CAAC;gBACH,CAAC;gBACD,uEAAuE;gBACvE,uDAAuD;gBACvD,oEAAoE;gBACpE,sEAAsE;gBACtE,uEAAuE;gBACvE,+DAA+D;gBAC/D,uEAAuE;gBACvE,uEAAuE;gBACvE,iEAAiE;gBACjE,kEAAkE;gBAClE,sEAAsE;gBACtE,sEAAsE;gBACtE,mEAAmE;gBACnE,kEAAkE;gBAClE,iEAAiE;gBACjE,sEAAsE;gBACtE,kEAAkE;gBAClE,mEAAmE;gBACnE,EAAE;gBACF,gEAAgE;gBAChE,qEAAqE;gBACrE,mEAAmE;gBACnE,qEAAqE;gBACrE,oEAAoE;gBACpE,2DAA2D;gBAC3D,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;gBAC9B,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;oBACnB,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;oBAC/B,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;oBAC3B,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;wBACtB,GAAG,CAAC,IAAI,CAAC;4BACP,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,IAAI,CAAC,EAAE;4BACb,MAAM,EAAE,kBAAkB;4BAC1B,GAAG,EAAE,0CAA0C;yBAChD,CAAC,CAAC;wBACH,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACpC,kEAAkE;gBAClE,qEAAqE;gBACrE,wEAAwE;gBACxE,uEAAuE;gBACvE,qEAAqE;gBACrE,wEAAwE;gBACxE,4DAA4D;gBAC5D,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBAC/C,MAAM,IAAI,GAAwB;oBAChC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI;oBACvB,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,IAAI,CAAC,EAAE;oBACb,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnC,IAAI,EAAE,IAA0C;iBACjD,CAAC,CAAC;gBACH,UAAU,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACpC,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,mEAAmE;gBACnE,6DAA6D;gBAC7D,4DAA4D;gBAC5D,kEAAkE;gBAClE,sEAAsE;gBACtE,oEAAoE;gBACpE,mEAAmE;gBACnE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,YAAY,GAAG,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,IAAI,SAAS,IAAI,EAAE,CAAC,CAAC;gBACtF,kEAAkE;gBAClE,uEAAuE;gBACvE,oEAAoE;gBACpE,uEAAuE;gBACvE,qEAAqE;gBACrE,sEAAsE;gBACtE,qEAAqE;gBACrE,8DAA8D;gBAC9D,qEAAqE;gBACrE,qEAAqE;gBACrE,kEAAkE;gBAClE,uEAAuE;gBACvE,iEAAiE;gBACjE,MAAM,SAAS,GAAe;oBAC5B,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC;oBAChE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC;oBACnE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC;oBAC5E,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,aAAa,GAAG,iBAAiB,CAAC,aAAa,CAAC;iBACzF,CAAC;gBACF,IAAI,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;gBAChE,mEAAmE;gBACnE,qEAAqE;gBACrE,kEAAkE;gBAClE,4CAA4C;gBAC5C,MAAM,aAAa,GAAe;oBAChC,KAAK,EAAE,iBAAiB,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK;oBAChD,MAAM,EAAE,iBAAiB,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM;oBACnD,SAAS,EAAE,iBAAiB,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS;oBAC5D,aAAa,EAAE,iBAAiB,CAAC,aAAa,GAAG,SAAS,CAAC,aAAa;iBACzE,CAAC;gBACF,iBAAiB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;gBAC5E,gEAAgE;gBAChE,sEAAsE;gBACtE,mEAAmE;gBACnE,qEAAqE;gBACrE,gEAAgE;gBAChE,wDAAwD;gBACxD,IAAI,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAC3B,IAAI,UAAU,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChF,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,SAAS,IAAI,EAAE,CAAC;oBAC5C,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC;gBAC7D,CAAC;gBACD,4FAA4F;gBAC5F,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAC7D,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;gBAChC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC7D,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBACzC,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB;wBAAE,YAAY,GAAG,IAAI,CAAC;oBACzD,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,OAAO;wBACb,IAAI,EAAE,IAAI,CAAC,EAAE;wBACb,MAAM,EAAE,sBAAsB;wBAC9B,GAAG,EAAE,4BAA4B,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,uCAAuC;qBACrH,CAAC,CAAC;oBACH,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;wBAC3D,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;wBAC/B,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;wBACpB,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;4BACtC,EAAE,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;4BACxB,GAAG,CAAC,IAAI,CAAC;gCACP,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,IAAI,CAAC,EAAE;gCACb,MAAM,EAAE,yBAAyB;gCACjC,GAAG,EAAE,iCAAiC,EAAE,CAAC,KAAK,CAAC,QAAQ,sCAAsC;gCAC7F,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE;6BAC/D,CAAC,CAAC;4BACH,OAAO,CAAC,KAAK,EAAE,CAAC;wBAClB,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBAC1D,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACzC,CAAC;gBACD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;oBACtB,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,IAAI,CAAC,EAAE;wBACb,MAAM,EAAE,kBAAkB;wBAC1B,GAAG,EAAE,0CAA0C;qBAChD,CAAC,CAAC;oBACH,+DAA+D;oBAC/D,mEAAmE;oBACnE,mEAAmE;oBACnE,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBAChC,CAAC;gBACD,iFAAiF;gBACjF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;oBACzB,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,IAAI,CAAC,EAAE;wBACb,MAAM,EAAE,kBAAkB;wBAC1B,GAAG,EAAE,wCAAwC;qBAC9C,CAAC,CAAC;oBACH,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC9B,CAAC;gBACD,qEAAqE;gBACrE,iEAAiE;gBACjE,iEAAiE;gBACjE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;QACD,IAAI,SAAS,EAAE,OAAO;YAAE,MAAM,SAAS,CAAC,MAAM,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,WAAW,CAAC,iBAAiB,CAAC,GAAG,CAAC;YACpC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACnE,yEAAyE;QACzE,IAAI,GAAG,YAAY,iBAAiB;YAAE,MAAM,GAAG,CAAC;QAChD,IAAI,SAAS,EAAE,OAAO;YAAE,MAAM,SAAS,CAAC,MAAM,CAAC;QAC/C,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IACE,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;YAClD,CAAE,GAAgC,EAAE,IAAI,KAAK,YAAY,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAC1F,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,IAAI,CAAC,EAAE;gBACb,MAAM,EAAE,iBAAiB;gBACzB,GAAG,EAAE,iBAAiB;aACvB,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,gEAAgE;QAChE,kEAAkE;QAClE,wEAAwE;QACxE,+DAA+D;QAC/D,uEAAuE;QACvE,gEAAgE;QAChE,yCAAyC;QACzC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,IAAI,CAAC,EAAE;YACb,MAAM,EAAE,eAAe;YACvB,GAAG,EAAE,sEAAsE;SAC5E,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,mBAAmB;QACnB,QAAQ,EAAE,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxD,eAAe,EAAE,CAAC;QAClB,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,WAAW,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/src/orgrt/session-stream.d.ts

@@ -0,0 +1,21 @@
+import type { AgentMessage, AgentRunner, OrgToolDef } from './agent-runner.js';
+import type { resolveRoleCostTier } from './cost-tier.js';
+import type { StreamOptions } from './mailbox.js';
+import { type resolveRoleProvider } from './provider.js';
+import type { resolveRoleGitEnforcement, roleAuthorityMask } from './role-sandbox.js';
+import type { SessionOpts } from './session-types.js';
+/** The AgentRunner.run() arguments for one session, built by runOneSession. */
+export declare function sessionRunArgs(opts: SessionOpts, s: {
+    runner: AgentRunner;
+    tools: OrgToolDef[];
+    streamOpts: StreamOptions | undefined;
+    gitEnforcement: ReturnType<typeof resolveRoleGitEnforcement>;
+    model: string;
+    tier: ReturnType<typeof resolveRoleCostTier>;
+    prov: ReturnType<typeof resolveRoleProvider>;
+    resume: string | undefined;
+    authorityMask: ReturnType<typeof roleAuthorityMask>;
+    abort: AbortController;
+}): Parameters<AgentRunner['run']>[0];
+export declare function openSessionStream(opts: SessionOpts, stream: AsyncIterable<AgentMessage>, abort: AbortController): Promise<AsyncGenerator<AgentMessage>>;
+//# sourceMappingURL=session-stream.d.ts.map

package/dist/src/orgrt/session-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-stream.d.ts","sourceRoot":"","sources":["../../../src/orgrt/session-stream.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAO/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAQtD,+EAA+E;AAC/E,wBAAgB,cAAc,CAC5B,IAAI,EAAE,WAAW,EACjB,CAAC,EAAE;IACD,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,UAAU,EAAE,aAAa,GAAG,SAAS,CAAC;IACtC,cAAc,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;IAC7C,IAAI,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;IAC7C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,aAAa,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;IACpD,KAAK,EAAE,eAAe,CAAC;CACxB,GACA,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAyGnC;AAuBD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,EACnC,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAqDvC"}