@panguard-ai/panguard 1.6.0 → 1.7.0

package/dist/cli/commands/doctor.js

@@ -14,14 +14,20 @@ import { homedir } from 'node:os';
 import { execFileSync } from 'node:child_process';
 import { c, symbols, box, header } from '@panguard-ai/core';
 import { PANGUARD_VERSION } from '../../index.js';
+import { readHookProtectionStatus } from './hook.js';
 // ---------------------------------------------------------------------------
 // Paths
 // ---------------------------------------------------------------------------
 const HOME = homedir();
 const PANGUARD_DIR = join(HOME, '.panguard');
 const CONFIG_PATH = join(PANGUARD_DIR, 'config.json');
+// `pga setup` writes the canonical config to ~/.panguard-guard/config.json, not
+// ~/.panguard/config.json. Doctor must check the guard config path so a freshly
+// configured install is not reported as broken.
+const GUARD_DIR = join(HOME, '.panguard-guard');
+const GUARD_CONFIG_PATH = join(GUARD_DIR, 'config.json');
 const LAST_SCAN_PATH = join(PANGUARD_DIR, 'last-scan.json');
-const GUARD_PID_PATH = join(HOME, '.panguard-guard', 'panguard-guard.pid');
+const GUARD_PID_PATH = join(GUARD_DIR, 'panguard-guard.pid');
 const LAUNCHD_PLIST_PATH = join(HOME, 'Library', 'LaunchAgents', 'ai.panguard.guard.plist');
 const ZSH_COMPLETIONS_PATH = join(HOME, '.zsh', 'completions', '_panguard');
 // ---------------------------------------------------------------------------
@@ -37,28 +43,38 @@ function checkInstallation() {
     };
 }
 function checkConfiguration() {
-    if (!existsSync(CONFIG_PATH)) {
+    // The canonical config `pga setup` writes is ~/.panguard-guard/config.json.
+    // Prefer it; fall back to the legacy ~/.panguard/config.json so installs that
+    // only have the master config still pass. A configured install must never be
+    // reported as broken just because the legacy path is absent.
+    const candidate = existsSync(GUARD_CONFIG_PATH)
+        ? GUARD_CONFIG_PATH
+        : existsSync(CONFIG_PATH)
+            ? CONFIG_PATH
+            : null;
+    if (!candidate) {
         return {
             status: 'fail',
             label: 'Configuration valid',
-            detail: '~/.panguard/config.json not found',
+            detail: '~/.panguard-guard/config.json not found',
             fix: 'Run "pga setup" to create your configuration',
         };
     }
+    const display = candidate === GUARD_CONFIG_PATH ? '~/.panguard-guard/config.json' : '~/.panguard/config.json';
     try {
-        const raw = readFileSync(CONFIG_PATH, 'utf-8');
+        const raw = readFileSync(candidate, 'utf-8');
         JSON.parse(raw);
         return {
             status: 'pass',
             label: 'Configuration valid',
-            detail: '~/.panguard/config.json',
+            detail: display,
         };
     }
     catch {
         return {
             status: 'fail',
             label: 'Configuration valid',
-            detail: '~/.panguard/config.json is not valid JSON',
+            detail: `${display} is not valid JSON`,
             fix: 'Run "pga setup" to regenerate the configuration file',
         };
     }
@@ -262,35 +278,35 @@ function checkLastScan() {
 }
 const DEFAULT_TC_ENDPOINT = 'https://tc.panguard.ai';
 function checkThreatCloud() {
-    // TC defaults to tc.panguard.ai — no config required. Customer's audit/scan
-    // already uploads here transparently. Only flag as warn if customer has
-    // explicitly opted out (threatCloud.enabled: false) or pointed at a custom
-    // endpoint that's not reachable.
+    // Threat Cloud is OPT-IN and defaults to OFF. The single source of truth is the
+    // guard config's threatCloudUploadEnabled flag (the same gate the upload path
+    // checks with `=== true`). Nothing is shared unless the user explicitly opts in,
+    // so doctor must not imply sharing happens "by default".
     let endpoint = DEFAULT_TC_ENDPOINT;
-    let enabledFlag;
-    if (existsSync(CONFIG_PATH)) {
+    let uploadEnabled = false;
+    if (existsSync(GUARD_CONFIG_PATH)) {
         try {
-            const raw = readFileSync(CONFIG_PATH, 'utf-8');
+            const raw = readFileSync(GUARD_CONFIG_PATH, 'utf-8');
             const cfg = JSON.parse(raw);
-            if (cfg.threatCloud?.endpoint)
-                endpoint = cfg.threatCloud.endpoint;
-            enabledFlag = cfg.threatCloud?.enabled;
+            uploadEnabled = cfg.threatCloudUploadEnabled === true;
+            if (cfg.threatCloudEndpoint)
+                endpoint = cfg.threatCloudEndpoint;
         }
         catch {
-            // Config parse error → fall through to default
+            // Config parse error → treat as not enabled (privacy-safe default)
         }
     }
-    if (enabledFlag === false) {
+    if (uploadEnabled) {
         return {
             status: 'pass',
             label: 'Threat Cloud',
-            detail: 'Disabled (opted out — pga config set threatCloud.enabled true to re-enable)',
+            detail: `Enabled (opted in) — sharing anonymized findings with ${endpoint.replace(/^https?:\/\//, '')}`,
         };
     }
     return {
         status: 'pass',
         label: 'Threat Cloud',
-        detail: `Connected to ${endpoint.replace(/^https?:\/\//, '')} (default — pga audit shares anonymized findings here)`,
+        detail: 'opt-in, currently OFF (enable: pga config set threat-cloud true)',
     };
 }
 function checkSystemService() {
@@ -333,6 +349,32 @@ function checkSystemService() {
         };
     }
 }
+function checkHookProtection() {
+    // The built-in-tool PreToolUse hook fails OPEN when it loads 0 rules (correct:
+    // it must never brick the agent). But silent permanent no-protection is not
+    // acceptable — the hook records a degraded marker we surface here.
+    const status = readHookProtectionStatus();
+    if (!status) {
+        return {
+            status: 'pass',
+            label: 'Built-in-tool hook',
+            detail: 'No degraded protection recorded',
+        };
+    }
+    if (status.degraded) {
+        return {
+            status: 'fail',
+            label: 'Built-in-tool hook',
+            detail: `Hook loaded 0 rules — protection DEGRADED (allowing all tool calls)${status.at ? ` since ${status.at}` : ''}`,
+            fix: 'Run "pga guard sync-rules" (or reinstall) to restore detection rules, then restart the host agent',
+        };
+    }
+    return {
+        status: 'pass',
+        label: 'Built-in-tool hook',
+        detail: `Active (${status.ruleCount} rules at last run)`,
+    };
+}
 function checkShellCompletions() {
     if (existsSync(ZSH_COMPLETIONS_PATH)) {
         return {
@@ -467,6 +509,7 @@ function runAllChecks() {
         checkAiLayerLocal(),
         checkAiLayerCloud(),
         checkGuardEngine(),
+        checkHookProtection(),
         checkNotificationChannels(),
         checkLastScan(),
         checkThreatCloud(),

package/dist/cli/commands/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAiBlD,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;AACvB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AACtD,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;AAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;AAC3E,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,yBAAyB,CAAC,CAAC;AAC5F,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAE5E,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAS,iBAAiB;IACxB,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7C,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACpC,KAAK,EAAE,wBAAwB;QAC/B,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,gBAAgB,EAAE,CAAC,CAAC,CAAC,0BAA0B;QACnF,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0DAA0D;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,mCAAmC;YAC3C,GAAG,EAAE,8CAA8C;SACpD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,yBAAyB;SAClC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,2CAA2C;YACnD,GAAG,EAAE,sDAAsD;SAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,uEAAuE;IACvE,OAAO;QACL,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,mCAAmC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,mCAAmC;IACnC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACzD,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IAED,qCAAqC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAEjG,IAAI,YAAY,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAEpD,oCAAoC;IACpC,IAAI,cAAkC,CAAC;IACvC,IAAI,YAAgC,CAAC;IACrC,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAEzB,CAAC;YACF,IAAI,GAAG,CAAC,EAAE,EAAE,UAAU,KAAK,YAAY,EAAE,CAAC;gBACxC,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE,yDAAyD;iBAClE,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC;gBACrB,cAAc,GAAG,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;gBACjC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC;gBAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC1D,MAAM,CAAC,IAAI,CACT,SAAS,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC,QAAQ,WAAW;oBAC9C,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACrE,IAAI,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmD,CAAC;YAC9E,IAAI,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC1D,MAAM,CAAC,IAAI,CACT,SAAS,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC,QAAQ,iBAAiB;oBACpD,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;SAC1B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,qDAAqD;QAC7D,GAAG,EAAE,2FAA2F;KACjG,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,kCAAkC;YAC1C,GAAG,EAAE,iDAAiD;SACvD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,4CAA4C;QAClE,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,uBAAuB,GAAG,GAAG;SACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,2CAA2C;YACnD,GAAG,EAAE,mDAAmD;SACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB;IAChC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,2CAA2C;YACnD,GAAG,EAAE,iDAAiD;SACvD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAEzB,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,EAAE,OAAO,IAAI,MAAM,CAAC;QAErD,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACzC,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,uBAAuB;gBAC9B,MAAM,EAAE,oCAAoC;gBAC5C,GAAG,EAAE,qEAAqE;aAC3E,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,aAAa;SAC5C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,2CAA2C;YACnD,GAAG,EAAE,gCAAgC;SACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,sBAAsB;YAC9B,GAAG,EAAE,2CAA2C;SACjD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEnE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,4CAA4C;gBACpD,GAAG,EAAE,wCAAwC;aAC9C,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC;QAE7E,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,GAAG,QAAQ,8BAA8B;gBACjD,GAAG,EAAE,wCAAwC;aAC9C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM;SACrF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,iCAAiC;YACzC,GAAG,EAAE,gDAAgD;SACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAErD,SAAS,gBAAgB;IACvB,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,iCAAiC;IACjC,IAAI,QAAQ,GAAG,mBAAmB,CAAC;IACnC,IAAI,WAAgC,CAAC;IACrC,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAEzB,CAAC;YACF,IAAI,GAAG,CAAC,WAAW,EAAE,QAAQ;gBAAE,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC;YACnE,WAAW,GAAG,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IAED,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,6EAA6E;SACtF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,gBAAgB,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,wDAAwD;KACrH,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAE9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,4CAA4C;QAC5C,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,aAAa,OAAO,CAAC,QAAQ,0BAA0B;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,yBAAyB;YACjC,GAAG,EAAE,uDAAuD;SAC7D,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACvC,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,aAAa;gBACnB,CAAC,CAAC,6BAA6B;gBAC/B,CAAC,CAAC,0CAA0C;YAC9C,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kDAAkD;SACpF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,2CAA2C;YACnD,GAAG,EAAE,kDAAkD;SACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,2BAA2B;SACpC,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,MAAM,QAAQ,GAAG;QACf,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,CAAC;QACpD,+CAA+C;QAC/C,kDAAkD;KACnD,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,8BAA8B,GAAG,GAAG;aAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,mBAAmB;QAC1B,MAAM,EAAE,2BAA2B;QACnC,GAAG,EAAE,2DAA2D;KACjE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,iBAAiB;IACxB,+BAA+B;IAC/B,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;YACpD,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,sBAAsB;YAC9B,GAAG,EAAE,gFAAgF;SACtF,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7F,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,oBAAoB;gBAC3B,MAAM,EAAE,qBAAqB,aAAa,wBAAwB;gBAClE,GAAG,EAAE,oCAAoC;aAC1C,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QAC/D,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,iBAAiB,UAAU,CAAC,MAAM,SAAS,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,UAAU,GAAG;SAC3G,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,0DAA0D;YAClE,GAAG,EAAE,4BAA4B;SAClC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAEzD,qBAAqB;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,cAAc,GAAG,EAAE,CAAC;IACxB,KAAK,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QAClF,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAEzB,CAAC;gBACF,IAAI,GAAG,CAAC,EAAE,EAAE,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;oBACvE,WAAW,GAAG,IAAI,CAAC;oBACnB,cAAc,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACnF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,YAAY,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5C,IAAI,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC,CAAC;QAC5D,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;SAC3B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,gCAAgC;QACxC,GAAG,EAAE,oEAAoE;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,iBAAiB,EAAE;QACnB,kBAAkB,EAAE;QACpB,gBAAgB,EAAE;QAClB,eAAe,EAAE;QACjB,iBAAiB,EAAE;QACnB,iBAAiB,EAAE;QACnB,gBAAgB,EAAE;QAClB,yBAAyB,EAAE;QAC3B,aAAa,EAAE;QACf,gBAAgB,EAAE;QAClB,kBAAkB,EAAE;QACpB,qBAAqB,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAS,YAAY,CAAC,MAAmB;IACvC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,IAAI,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,OAAO,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,QAAQ,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAU;IACxC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAE/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAExF,mCAAmC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEvE,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,UAAU;IACV,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAEjE,MAAM,YAAY,GAAa;QAC7B,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,CAAC;QAC1B,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,WAAW,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QAC3F,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;KAChE,CAAC;IAEF,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;SACzB,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;SAC1C,MAAM,CAAC,OAAO,EAAE,uCAAuC,CAAC;SACxD,MAAM,CAAC,mBAAmB,EAAE,gCAAgC,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,IAAsD,EAAE,EAAE;QACvE,MAAM,IAAI,GAAS,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;QAE/B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,MAAM,CACJ,IAAI,KAAK,OAAO;gBACd,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,qCAAqC,CAC1C,CACF,CAAC;YAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACxC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3D,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CACxB,IAAI,KAAK,OAAO;gBACd,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,yCAAyC,CAC9C,EAAE,CACJ,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QAEtB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC5D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAiBrD,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;AACvB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AACtD,gFAAgF;AAChF,gFAAgF;AAChF,gDAAgD;AAChD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;AAChD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AACzD,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;AAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAC7D,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,yBAAyB,CAAC,CAAC;AAC5F,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAE5E,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAS,iBAAiB;IACxB,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7C,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACpC,KAAK,EAAE,wBAAwB;QAC/B,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,gBAAgB,EAAE,CAAC,CAAC,CAAC,0BAA0B;QACnF,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0DAA0D;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,iBAAiB,CAAC;QAC7C,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;YACvB,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,yCAAyC;YACjD,GAAG,EAAE,8CAA8C;SACpD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAE9G,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,GAAG,OAAO,oBAAoB;YACtC,GAAG,EAAE,sDAAsD;SAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,uEAAuE;IACvE,OAAO;QACL,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,mCAAmC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,mCAAmC;IACnC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACzD,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IAED,qCAAqC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAEjG,IAAI,YAAY,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAEpD,oCAAoC;IACpC,IAAI,cAAkC,CAAC;IACvC,IAAI,YAAgC,CAAC;IACrC,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAEzB,CAAC;YACF,IAAI,GAAG,CAAC,EAAE,EAAE,UAAU,KAAK,YAAY,EAAE,CAAC;gBACxC,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE,yDAAyD;iBAClE,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC;gBACrB,cAAc,GAAG,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;gBACjC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC;gBAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC1D,MAAM,CAAC,IAAI,CACT,SAAS,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC,QAAQ,WAAW;oBAC9C,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACrE,IAAI,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmD,CAAC;YAC9E,IAAI,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC1D,MAAM,CAAC,IAAI,CACT,SAAS,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC,QAAQ,iBAAiB;oBACpD,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;SAC1B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,qDAAqD;QAC7D,GAAG,EAAE,2FAA2F;KACjG,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,kCAAkC;YAC1C,GAAG,EAAE,iDAAiD;SACvD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,4CAA4C;QAClE,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,uBAAuB,GAAG,GAAG;SACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,2CAA2C;YACnD,GAAG,EAAE,mDAAmD;SACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB;IAChC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,2CAA2C;YACnD,GAAG,EAAE,iDAAiD;SACvD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAEzB,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,EAAE,OAAO,IAAI,MAAM,CAAC;QAErD,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACzC,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,uBAAuB;gBAC9B,MAAM,EAAE,oCAAoC;gBAC5C,GAAG,EAAE,qEAAqE;aAC3E,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,aAAa;SAC5C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,2CAA2C;YACnD,GAAG,EAAE,gCAAgC;SACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,sBAAsB;YAC9B,GAAG,EAAE,2CAA2C;SACjD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEnE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,4CAA4C;gBACpD,GAAG,EAAE,wCAAwC;aAC9C,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC;QAE7E,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,GAAG,QAAQ,8BAA8B;gBACjD,GAAG,EAAE,wCAAwC;aAC9C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM;SACrF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,iCAAiC;YACzC,GAAG,EAAE,gDAAgD;SACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAErD,SAAS,gBAAgB;IACvB,gFAAgF;IAChF,8EAA8E;IAC9E,iFAAiF;IACjF,yDAAyD;IACzD,IAAI,QAAQ,GAAG,mBAAmB,CAAC;IACnC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAGzB,CAAC;YACF,aAAa,GAAG,GAAG,CAAC,wBAAwB,KAAK,IAAI,CAAC;YACtD,IAAI,GAAG,CAAC,mBAAmB;gBAAE,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,yDAAyD,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE;SACxG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,kEAAkE;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAE9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,4CAA4C;QAC5C,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,aAAa,OAAO,CAAC,QAAQ,0BAA0B;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,yBAAyB;YACjC,GAAG,EAAE,uDAAuD;SAC7D,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACvC,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,aAAa;gBACnB,CAAC,CAAC,6BAA6B;gBAC/B,CAAC,CAAC,0CAA0C;YAC9C,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kDAAkD;SACpF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,2CAA2C;YACnD,GAAG,EAAE,kDAAkD;SACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,+EAA+E;IAC/E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,iCAAiC;SAC1C,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,sEACN,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EACtC,EAAE;YACF,GAAG,EAAE,mGAAmG;SACzG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,WAAW,MAAM,CAAC,SAAS,qBAAqB;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,2BAA2B;SACpC,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,MAAM,QAAQ,GAAG;QACf,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,CAAC;QACpD,+CAA+C;QAC/C,kDAAkD;KACnD,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,8BAA8B,GAAG,GAAG;aAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,mBAAmB;QAC1B,MAAM,EAAE,2BAA2B;QACnC,GAAG,EAAE,2DAA2D;KACjE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,iBAAiB;IACxB,+BAA+B;IAC/B,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;YACpD,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,sBAAsB;YAC9B,GAAG,EAAE,gFAAgF;SACtF,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7F,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,oBAAoB;gBAC3B,MAAM,EAAE,qBAAqB,aAAa,wBAAwB;gBAClE,GAAG,EAAE,oCAAoC;aAC1C,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QAC/D,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,iBAAiB,UAAU,CAAC,MAAM,SAAS,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,UAAU,GAAG;SAC3G,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,0DAA0D;YAClE,GAAG,EAAE,4BAA4B;SAClC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAEzD,qBAAqB;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,cAAc,GAAG,EAAE,CAAC;IACxB,KAAK,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QAClF,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAEzB,CAAC;gBACF,IAAI,GAAG,CAAC,EAAE,EAAE,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;oBACvE,WAAW,GAAG,IAAI,CAAC;oBACnB,cAAc,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACnF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,YAAY,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5C,IAAI,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC,CAAC;QAC5D,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;SAC3B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,gCAAgC;QACxC,GAAG,EAAE,oEAAoE;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,iBAAiB,EAAE;QACnB,kBAAkB,EAAE;QACpB,gBAAgB,EAAE;QAClB,eAAe,EAAE;QACjB,iBAAiB,EAAE;QACnB,iBAAiB,EAAE;QACnB,gBAAgB,EAAE;QAClB,mBAAmB,EAAE;QACrB,yBAAyB,EAAE;QAC3B,aAAa,EAAE;QACf,gBAAgB,EAAE;QAClB,kBAAkB,EAAE;QACpB,qBAAqB,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAS,YAAY,CAAC,MAAmB;IACvC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,IAAI,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,OAAO,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,QAAQ,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAU;IACxC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAE/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAExF,mCAAmC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEvE,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,UAAU;IACV,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAEjE,MAAM,YAAY,GAAa;QAC7B,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,CAAC;QAC1B,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,WAAW,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QAC3F,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;KAChE,CAAC;IAEF,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;SACzB,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;SAC1C,MAAM,CAAC,OAAO,EAAE,uCAAuC,CAAC;SACxD,MAAM,CAAC,mBAAmB,EAAE,gCAAgC,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,IAAsD,EAAE,EAAE;QACvE,MAAM,IAAI,GAAS,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;QAE/B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,MAAM,CACJ,IAAI,KAAK,OAAO;gBACd,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,qCAAqC,CAC1C,CACF,CAAC;YAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACxC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3D,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CACxB,IAAI,KAAK,OAAO;gBACd,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,yCAAyC,CAC9C,EAAE,CACJ,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QAEtB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC5D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/guard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,YAAY,IAAI,OAAO,CA4HtC"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/guard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,wBAAgB,YAAY,IAAI,OAAO,CAqJtC"}

package/dist/cli/commands/guard.js

@@ -2,14 +2,15 @@
  * panguard guard - Guard engine management
  * panguard guard - 守護引擎管理
  */
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
 import { join } from 'node:path';
-import { homedir } from 'node:os';
+import { homedir, platform } from 'node:os';
 import { request as httpNodeRequest } from 'node:http';
 import { execFileSync as nodeExecFileSync } from 'node:child_process';
 import { Command } from 'commander';
-import { runCLI } from '@panguard-ai/panguard-guard';
+import { runCLI, writeEncryptedLlmConfig, clearEncryptedLlmConfig, getEncryptedLlmConfigPath, } from '@panguard-ai/panguard-guard';
 import { c, box, header, symbols, divider } from '@panguard-ai/core';
+import { ensurePersistentService } from './persist.js';
 export function guardCommand() {
     const cmd = new Command('guard')
         .description('Guard engine management')
@@ -108,9 +109,28 @@ export function guardCommand() {
     });
     cmd
         .command('install')
-        .description('Install as system service')
+        .description('Install as a reboot-surviving service')
         .option('--data-dir <path>', 'Data directory')
         .action(async (opts) => {
+        // macOS: install the user-level LaunchAgent via the proven command
+        // (`pga guard --watch`) — the same path `pga up` uses, one source of truth.
+        // The legacy panguard-guard installer builds a `<bin> start` plist, which is
+        // wrong from the pga binary (pga has no top-level `start` command) and would
+        // silently fail to protect after reboot.
+        if (platform() === 'darwin') {
+            const r = ensurePersistentService();
+            if (r === 'installed') {
+                console.log(`  ${symbols.pass} ${c.safe('Always-on service installed')} — protection restarts after reboot.`);
+            }
+            else if (r === 'already') {
+                console.log(`  ${symbols.info} ${c.dim('Always-on service already installed.')}`);
+            }
+            else {
+                console.log(`  ${symbols.fail} ${c.caution('Could not install the service.')}`);
+            }
+            return;
+        }
+        // Linux/Windows: system-service path (may require sudo/admin).
         const args = ['install'];
         if (opts.dataDir)
             args.push('--data-dir', opts.dataDir);
@@ -124,8 +144,14 @@ export function guardCommand() {
     });
     cmd
         .command('setup-ai')
-        .description('Interactive AI layer setup')
-        .action(async () => {
+        .alias('ai')
+        .description('Connect the optional semantic layer (Layer C): local Ollama (free) or a cloud key')
+        .option('--remove', 'Remove the stored LLM config and turn Layer C off')
+        .action(async (opts) => {
+        if (opts.remove) {
+            await commandRemoveAi();
+            return;
+        }
         await commandSetupAi();
     });
     return cmd;
@@ -144,16 +170,6 @@ function isOllamaInstalled() {
         return false;
     }
 }
-/** Validate API key format */
-function validateApiKeyFormat(key) {
-    if (key.startsWith('sk-ant-')) {
-        return { valid: true, provider: 'anthropic' };
-    }
-    if (key.startsWith('sk-') && !key.startsWith('sk-ant-')) {
-        return { valid: true, provider: 'openai' };
-    }
-    return { valid: false, provider: 'unknown' };
-}
 /** Read a single line from stdin */
 function readLine(prompt) {
     return new Promise((resolve) => {
@@ -174,6 +190,70 @@ function readLine(prompt) {
         });
     });
 }
+/**
+ * Read a secret from stdin without echoing it. The key never appears on screen,
+ * in argv, or in shell history. Falls back to a plain line read when stdin is
+ * not a TTY (e.g. piped input in scripts).
+ */
+function readSecret(prompt) {
+    return new Promise((resolve) => {
+        const stdin = process.stdin;
+        const NL = String.fromCharCode(10);
+        process.stdout.write(prompt);
+        stdin.setEncoding('utf-8');
+        if (!stdin.isTTY) {
+            stdin.resume();
+            stdin.once('data', (data) => {
+                stdin.pause();
+                resolve(data.trim());
+            });
+            return;
+        }
+        const wasRaw = stdin.isRaw;
+        stdin.setRawMode(true);
+        stdin.resume();
+        let buf = '';
+        const onData = (ch) => {
+            const code = ch.charCodeAt(0);
+            // Enter (CR=13 / LF=10) or Ctrl-D (EOT=4) terminates input.
+            if (code === 13 || code === 10 || code === 4) {
+                stdin.removeListener('data', onData);
+                stdin.setRawMode(wasRaw);
+                stdin.pause();
+                process.stdout.write(NL);
+                resolve(buf.trim());
+                return;
+            }
+            if (code === 3) {
+                // Ctrl-C: abort without leaking the buffer.
+                stdin.setRawMode(wasRaw);
+                process.stdout.write(NL);
+                process.exit(130);
+            }
+            if (code === 127 || code === 8) {
+                buf = buf.slice(0, -1);
+                return;
+            }
+            buf += ch;
+        };
+        stdin.on('data', onData);
+    });
+}
+/** Remove the stored (encrypted) LLM config — turns the optional Layer C off. */
+async function commandRemoveAi() {
+    const encPath = await getEncryptedLlmConfigPath();
+    const removed = await clearEncryptedLlmConfig();
+    console.log('');
+    if (removed) {
+        console.log(`  ${symbols.pass} Removed stored LLM config (${c.sage(encPath)}).`);
+        console.log(`  ${c.dim('Layer C is now off. Cloud env vars (ANTHROPIC_API_KEY / OPENAI_API_KEY), if set, still apply — unset them too for a full opt-out. Restart guard to apply:')} ${c.sage('pga guard restart')}`);
+    }
+    else {
+        console.log(`  ${symbols.info} No stored LLM config to remove.`);
+        console.log(`  ${c.dim('If you set ANTHROPIC_API_KEY / OPENAI_API_KEY in your environment, unset them to disable Layer C.')}`);
+    }
+    console.log('');
+}
 /** Interactive AI setup command */
 async function commandSetupAi() {
     const configDir = join(homedir(), '.panguard');
@@ -187,12 +267,21 @@ async function commandSetupAi() {
     console.log(`    ${c.sage('Layer 1')} - Pattern Detection (regex rules, always active)`);
     console.log(`    ${c.dim('第一層')}   ${c.dim('模式偵測（正則規則，始終啟用）')}`);
     console.log('');
-    console.log(`    ${c.sage('Layer 2')} - Local AI (Ollama - free, private, on-device)`);
-    console.log(`    ${c.dim('第二層')}   ${c.dim('本地 AI（Ollama - 免費、私密、裝置端）')}`);
+    console.log(`    ${c.sage('Layer 2')} - Local AI (Ollama - $0, fully private, on-device)`);
+    console.log(`    ${c.dim('第二層')}   ${c.dim('本地 AI（Ollama - $0、完全私密、裝置端執行）')}`);
     console.log('');
     console.log(`    ${c.sage('Layer 3')} - Cloud AI (Anthropic/OpenAI - fastest, most accurate)`);
     console.log(`    ${c.dim('第三層')}   ${c.dim('雲端 AI（Anthropic/OpenAI - 最快、最準確）')}`);
     console.log('');
+    // Cost reality up front, so the choice is informed before anyone picks Layer 3.
+    // The semantic judge runs ONLY on events the deterministic layers already
+    // flagged — not on every action — so real-world usage is a handful of calls
+    // a day, not thousands.
+    console.log(`  ${c.dim('Layers 2 and 3 only run on events Layer 1 already flagged — not on every')}`);
+    console.log(`  ${c.dim('action — so a typical developer triggers them just a handful of times a day.')}`);
+    console.log(`  ${c.dim('第二、三層只在第一層已標記的事件上執行 — 不是每個動作都跑 — 所以一般開發者')}`);
+    console.log(`  ${c.dim('一天只會觸發幾次。')}`);
+    console.log('');
     console.log(divider());
     console.log('');
     // Check current state
@@ -228,14 +317,19 @@ async function commandSetupAi() {
     }
     const setupLocal = choice === '1' || choice === '3';
     const setupCloud = choice === '2' || choice === '3';
-    // Ensure config directory exists
+    // Ensure config directory exists. 0o700: ~/.panguard can hold secret-bearing
+    // config — never world/group-traversable on shared machines.
     if (!existsSync(configDir)) {
-        mkdirSync(configDir, { recursive: true });
+        mkdirSync(configDir, { recursive: true, mode: 0o700 });
     }
     // Step 2a: Local AI (Ollama)
     if (setupLocal) {
         console.log(divider('Layer 2: Local AI'));
         console.log('');
+        // Honest cost framing: local inference never calls a paid API.
+        console.log(`  ${c.dim('Cost: $0 and fully private — runs on your machine, nothing leaves it.')}`);
+        console.log(`  ${c.dim('費用：$0 且完全私密 — 在你的機器上執行，不會有任何資料離開。')}`);
+        console.log('');
         const ollamaInstalled = isOllamaInstalled();
         if (ollamaInstalled) {
             console.log(`  ${symbols.pass} Ollama is installed / Ollama 已安裝`);
@@ -278,79 +372,135 @@ async function commandSetupAi() {
             aiConfig['endpoint'] = ollamaEndpoint;
         }
         existingConfig = { ...existingConfig, ai: aiConfig };
+        // Persist to the encrypted store the daemon reads first (resolveOptedInLLM),
+        // so the local model is used deterministically — no PANGUARD_SEMANTIC=1
+        // probe needed, and it survives a launchd/systemd restart. Ollama carries no
+        // secret, so this is just provider/model/endpoint. If a cloud key is also
+        // configured below, that write overwrites this one (cloud takes priority).
+        try {
+            await writeEncryptedLlmConfig({
+                provider: 'ollama',
+                model: ollamaModel,
+                endpoint: ollamaEndpoint || undefined,
+            });
+        }
+        catch {
+            /* non-fatal — daemon can still discover Ollama via PANGUARD_SEMANTIC=1 */
+        }
         console.log('');
         console.log(`  ${symbols.pass} Local AI configured: ${c.sage(`ollama / ${ollamaModel}`)}`);
         console.log(`  ${c.dim('本地 AI 已設定')}: ollama / ${ollamaModel}`);
         console.log('');
     }
     // Step 2b: Cloud AI
+    //
+    // The cloud key is persisted ENCRYPTED at rest (~/.panguard/llm.enc,
+    // AES-256-GCM, machine-bound, 0600) via writeEncryptedLlmConfig — the Guard
+    // daemon reads it on startup (resolveOptedInLLM). This is what makes Layer C
+    // actually work with the launchd/systemd-spawned daemon, which does NOT
+    // inherit a shell environment variable. Users who prefer a key that never
+    // touches disk can instead export ANTHROPIC_API_KEY / OPENAI_API_KEY (also
+    // read at startup). Prefer no key at all? Local AI (Ollama) needs none.
     if (setupCloud) {
         console.log(divider('Layer 3: Cloud AI'));
         console.log('');
-        const envKey = process.env['PANGUARD_AI_KEY'] ||
-            process.env['ANTHROPIC_API_KEY'] ||
-            process.env['OPENAI_API_KEY'];
-        if (envKey) {
-            const { provider } = validateApiKeyFormat(envKey);
-            console.log(`  ${symbols.pass} API key found in environment: ${c.sage(provider)}`);
-            console.log(`  ${c.dim('已在環境變數中找到 API 金鑰')}: ${provider}`);
-            console.log('');
-        }
-        console.log(`  Enter your API key (Anthropic or OpenAI):`);
-        console.log(`  ${c.dim('輸入您的 API 金鑰（Anthropic 或 OpenAI）：')}`);
-        console.log(`  ${c.dim('  Anthropic: https://console.anthropic.com/')}`);
-        console.log(`  ${c.dim('  OpenAI:    https://platform.openai.com/api-keys')}`);
+        // Honest cost framing (verified): the semantic judge runs ONLY on events the
+        // deterministic layers already flagged — a handful of times a day for a
+        // typical developer, so roughly a few cents per month.
+        console.log(`  ${c.dim('Cost: the cloud judge runs only on already-flagged events — a handful of')}`);
+        console.log(`  ${c.dim('times a day for typical use, so roughly a few cents per month. You pay')}`);
+        console.log(`  ${c.dim('your AI provider directly; PanGuard adds no markup and no subscription.')}`);
+        console.log(`  ${c.dim('費用：雲端判斷層只在已標記的事件上執行 — 一般一天幾次，約每月幾美分；直接付給供應商。')}`);
         console.log('');
-        const apiKey = await readLine(`  API Key: `);
+        const provider = await readLine(`  Cloud provider [claude/openai] (default claude): `);
+        const cloudProvider = provider === 'openai' ? 'openai' : 'claude';
+        const defaultModel = cloudProvider === 'claude' ? 'claude-sonnet-4-20250514' : 'gpt-4o';
+        const model = await readLine(`  Model [${defaultModel}]: `);
+        const cloudModel = model || defaultModel;
+        const envVarName = cloudProvider === 'claude' ? 'ANTHROPIC_API_KEY' : 'OPENAI_API_KEY';
+        const envHasKey = (cloudProvider === 'claude' && !!process.env['ANTHROPIC_API_KEY']) ||
+            (cloudProvider === 'openai' && !!process.env['OPENAI_API_KEY']);
         console.log('');
-        if (apiKey) {
-            const { valid, provider } = validateApiKeyFormat(apiKey);
-            if (!valid) {
-                console.log(`  ${symbols.warn} Unrecognized key format, saving as-is / 無法識別的金鑰格式，直接儲存`);
-            }
-            const cloudProvider = provider === 'anthropic' ? 'claude' : provider === 'openai' ? 'openai' : 'claude';
-            const defaultModel = cloudProvider === 'claude' ? 'claude-sonnet-4-20250514' : 'gpt-4o';
-            const model = await readLine(`  Model [${defaultModel}]: `);
-            const cloudModel = model || defaultModel;
-            // If we already set local AI, merge into a combined config
-            const currentAi = (existingConfig['ai'] ?? {});
-            if (setupLocal && currentAi['provider'] === 'ollama') {
-                // Store cloud as the primary with local as fallback info
-                existingConfig = {
-                    ...existingConfig,
-                    ai: {
+        console.log(`  How would you like to provide the key?`);
+        console.log(`    ${c.sage('1')} - Paste it now (stored encrypted on this machine; the daemon reads it)`);
+        console.log(`    ${c.sage('2')} - I'll set ${envVarName} in my environment myself`);
+        if (envHasKey) {
+            console.log(`        ${c.dim(`(${envVarName} is already set in this shell)`)}`);
+        }
+        console.log('');
+        const keyChoice = await readLine(`  Choice [1]: `);
+        let persistedKey = false;
+        if (keyChoice !== '2') {
+            // Hidden input: the key never appears on screen, in argv, or in shell history.
+            const key = await readSecret(`  Paste ${envVarName} (input hidden): `);
+            if (key) {
+                try {
+                    const encPath = await writeEncryptedLlmConfig({
                         provider: cloudProvider,
                         model: cloudModel,
-                        apiKey: apiKey,
-                    },
-                    aiLocal: {
-                        provider: currentAi['provider'],
-                        model: currentAi['model'],
-                        endpoint: currentAi['endpoint'],
-                    },
-                };
+                        apiKey: key,
+                    });
+                    persistedKey = true;
+                    console.log(`  ${symbols.pass} Key stored encrypted at ${c.sage(encPath)} ${c.dim('(0600, AES-256-GCM)')}`);
+                    console.log(`  ${c.dim('Remove it any time with:')} ${c.sage('pga guard ai --remove')}`);
+                }
+                catch (err) {
+                    console.log(`  ${symbols.fail} Could not store key: ${err instanceof Error ? err.message : String(err)}`);
+                }
             }
             else {
-                existingConfig = {
-                    ...existingConfig,
-                    ai: {
-                        provider: cloudProvider,
-                        model: cloudModel,
-                        apiKey: apiKey,
-                    },
-                };
+                console.log(`  ${symbols.info} No key entered — Layer C stays off until you provide one.`);
             }
+        }
+        else {
             console.log('');
-            console.log(`  ${symbols.pass} Cloud AI configured: ${c.sage(`${cloudProvider} / ${cloudModel}`)}`);
+            console.log(`  ${c.dim('Set it before restarting guard:')} ${c.sage(`export ${envVarName}=...`)}`);
+        }
+        // Store provider + model (NO secret) in the master config so status/dashboard
+        // can show the intended provider. The secret lives only in llm.enc (encrypted)
+        // or the env var. If local AI was also configured, keep it as fallback metadata.
+        const currentAi = (existingConfig['ai'] ?? {});
+        if (setupLocal && currentAi['provider'] === 'ollama') {
+            existingConfig = {
+                ...existingConfig,
+                ai: { provider: cloudProvider, model: cloudModel },
+                aiLocal: {
+                    provider: currentAi['provider'],
+                    model: currentAi['model'],
+                    endpoint: currentAi['endpoint'],
+                },
+            };
+        }
+        else {
+            existingConfig = {
+                ...existingConfig,
+                ai: { provider: cloudProvider, model: cloudModel },
+            };
+        }
+        console.log('');
+        console.log(`  ${symbols.pass} Cloud AI provider set: ${c.sage(`${cloudProvider} / ${cloudModel}`)}`);
+        if (persistedKey || envHasKey) {
+            console.log(`  ${c.dim('Restart guard to activate Layer C:')} ${c.sage('pga guard restart')}`);
         }
         else {
-            console.log(`  ${symbols.info} Skipped cloud AI setup`);
+            console.log(`  ${symbols.warn} Layer C stays off until ${c.sage(envVarName)} is set; then run ${c.sage('pga guard restart')}.`);
         }
         console.log('');
     }
-    // Save config
+    // Save config. 0o600 file + chmod (even if the file already existed, to
+    // tighten a loosely-created one): config.json can carry other secret-bearing
+    // fields (threatCloudApiKey, notification secrets) — never world/group-readable.
     try {
-        writeFileSync(configPath, JSON.stringify(existingConfig, null, 2), 'utf-8');
+        writeFileSync(configPath, JSON.stringify(existingConfig, null, 2), {
+            encoding: 'utf-8',
+            mode: 0o600,
+        });
+        try {
+            chmodSync(configPath, 0o600);
+        }
+        catch {
+            /* best effort — platforms without POSIX permissions */
+        }
         console.log(`  ${symbols.pass} Configuration saved to ${c.sage(configPath)}`);
         console.log(`  ${c.dim('設定已儲存至')} ${configPath}`);
     }