@posthog/wizard 2.52.0 → 2.53.0

package/dist/pi-2hh_NXKT.js

@@ -0,0 +1,409 @@
+import { a as getLogFilePath, f as getUI, ft as WIZARD_USER_AGENT, s as logToFile, ut as WIZARD_REMARK_EVENT_NAME } from "./debug-tCr3A18e.js";
+import { n as analytics } from "./analytics-BC3iiS1p.js";
+import { M as GATEWAY_PROVIDER, N as buildGatewayProvider, f as AgentOutputSignals, h as assembleCommandments, m as REMARK_INSTRUCTION, p as AgentSignals } from "./agent-interface-xWyATfJi.js";
+import fs from "fs";
+import path from "path";
+//#region src/lib/agent/runner/harness/pi/completion.ts
+/** Which completion guard should fail a pi run, or undefined for a clean finish. */
+function completionFailure(args) {
+	if (args.toolCalls === 0) return "WIZARD_NO_PROGRESS";
+	if (args.openTasks) return "WIZARD_INCOMPLETE_TASKS";
+}
+//#endregion
+//#region src/lib/agent/runner/harness/pi/index.ts
+/**
+* The `pi` backend — the challenger. Drives pi.dev's coding agent
+* (`@earendil-works/pi-coding-agent`) against the PostHog LLM gateway, behind
+* `wizard-orchestrator`. It owns the agent loop and model transport; prompt
+* assembly, error routing, and the outro stay in `linear.ts`, shared with the
+* `anthropic` control.
+*
+* Transport: the gateway is registered as an `anthropic-messages` provider
+* (same protocol the claude-agent-sdk path uses), bearer auth, Bedrock-fallback
+* + wizard metadata/flag headers, model id matched to `anthropic` for a clean
+* A/B. Security parity (canUseTool + YARA) and skills/MCP discovery are
+* follow-ups (#525, #524 skills) — v1 uses pi's built-in coding tools.
+*/
+/** Injects the MCP server `instructions` pi-mcp-adapter drops (project env, skill steer, tool domains) into the system prompt, falling back to a bootstrap-derived project block when the warm-connect captured none. */
+function piMcpContext(boot, instructions) {
+	if (instructions) return [
+		"",
+		"## PostHog MCP server",
+		instructions
+	].join("\n");
+	return [
+		"",
+		"## PostHog project",
+		"Your `posthog_exec` calls run against this project:",
+		`- Project: ${boot.project?.name ? `${boot.project.name} (id ${boot.credentials.projectId})` : `id ${boot.credentials.projectId}`}`,
+		`- Host: ${boot.credentials.host.apiHost}`,
+		`- Region: ${boot.credentials.host.region}`
+	].join("\n");
+}
+/**
+* The ONLY environment variables pi's tool subprocesses (bash → npm/pip/…) are
+* allowed to see. Everything else — every secret (POSTHOG_PERSONAL_API_KEY,
+* ANTHROPIC_*, AWS_*), every ambient credential, the parent process's whole env
+* — is dropped before a child is spawned. pi's own gateway auth is programmatic
+* (the access token never lives in env), so a minimal env costs the agent
+* nothing while closing the leak that exposed the key before. Kept to what a
+* package manager genuinely needs to run.
+*/
+const ALLOWED_SUBPROCESS_ENV_KEYS = [
+	"PATH",
+	"HOME",
+	"SHELL",
+	"USER",
+	"LOGNAME",
+	"TMPDIR",
+	"TMP",
+	"TEMP",
+	"TERM",
+	"LANG",
+	"LC_ALL",
+	"LC_CTYPE",
+	"NODE_EXTRA_CA_CERTS",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"NO_PROXY",
+	"http_proxy",
+	"https_proxy",
+	"no_proxy"
+];
+/** A fresh subprocess env holding only the allowlisted keys present in process.env. */
+function buildScrubbedEnv() {
+	const env = {};
+	for (const key of ALLOWED_SUBPROCESS_ENV_KEYS) {
+		const value = process.env[key];
+		if (value !== void 0) env[key] = value;
+	}
+	return env;
+}
+/**
+* Tag a tool with an execution mode (mutates + returns it). Read-only tools are
+* `parallel` so a single turn that batches independent reads/searches runs them
+* at once; mutating/install tools are `sequential` so a batch never races writes
+* or concurrent installs. pi-agent-core runs a batch in parallel only when no
+* tool in it is `sequential`.
+*/
+function withMode(tool, mode) {
+	tool.executionMode = mode;
+	return tool;
+}
+/** Pull plain text out of a pi AgentMessage (content is text/image blocks). */
+function extractText(message) {
+	const content = message?.content;
+	if (typeof content === "string") return content;
+	if (Array.isArray(content)) return content.filter((c) => {
+		const block = c;
+		return block?.type === "text" && typeof block.text === "string";
+	}).map((c) => c.text).join("");
+	return "";
+}
+/**
+* Surface `[DASHBOARD_URL]` / `[NOTEBOOK_URL]` markers the agent prints (after
+* the MCP creates them) into the outro link, mirroring the anthropic path's
+* signal parsing (#9). The marker carries the URL the MCP returned.
+*/
+function applyOutroMarkers(textBlock) {
+	const markers = [[AgentSignals.DASHBOARD_URL, (url) => getUI().setDashboardUrl(url)], [AgentSignals.NOTEBOOK_URL, (url) => getUI().setNotebookUrl(url)]];
+	for (const [marker, apply] of markers) {
+		const idx = textBlock.indexOf(marker);
+		if (idx === -1) continue;
+		const url = textBlock.slice(idx + marker.length).trim().split(/\s/)[0];
+		if (url) apply(url);
+	}
+}
+/**
+* The text of the last `[STATUS] …` line in a block, if any. Last wins so the
+* spinner shows the most recent action when a turn prints several.
+*/
+function lastStatusLine(textBlock) {
+	let status;
+	for (const line of textBlock.split("\n")) {
+		const idx = line.indexOf(AgentSignals.STATUS);
+		if (idx !== -1) status = line.slice(idx + AgentSignals.STATUS.length).trim();
+	}
+	return status || void 0;
+}
+/** Cap on completion-guard re-prompts while tasks remain open (see the run loop). */
+const MAX_CONTINUE_NUDGES = 20;
+/** Nudge re-sent when the agent stops early with tasks still open. */
+const CONTINUE_INSTRUCTION = "You still have open tasks in your list (not all are marked `completed`). Do not stop — pick up the next `in_progress` or `pending` task and keep working until every task is `completed`. Continue now.";
+/** True while any task in the store is not yet `completed`. */
+function hasOpenTasks(store) {
+	for (const t of store.values()) if (t.status !== "completed") return true;
+	return false;
+}
+const piBackend = {
+	name: "pi",
+	async run(inputs) {
+		const { session, boot, prompt, spinner, config, programConfig } = inputs;
+		const modelId = inputs.model;
+		getUI().log.step("Initializing Wizard agent...");
+		getUI().log.step(`Verbose logs: ${getLogFilePath()}`);
+		getUI().log.success("Agent initialized. Let's get cooking!");
+		spinner.start(config.spinnerMessage ?? "Customizing your PostHog setup...");
+		const startTime = Date.now();
+		const signals = new AgentOutputSignals();
+		let assistantTurns = 0;
+		let toolCalls = 0;
+		const runDurations = () => {
+			const durationMs = Date.now() - startTime;
+			return {
+				duration_ms: durationMs,
+				duration_seconds: Math.round(durationMs / 1e3)
+			};
+		};
+		const captureAborted = () => analytics.wizardCapture("agent aborted", {
+			...runDurations(),
+			model: modelId
+		});
+		try {
+			const { createAgentSession, DefaultResourceLoader, SessionManager, AuthStorage, ModelRegistry, getAgentDir, createLsToolDefinition, createFindToolDefinition, createGrepToolDefinition, createBashToolDefinition, createReadToolDefinition, createEditToolDefinition, createWriteToolDefinition } = await import("@earendil-works/pi-coding-agent");
+			const { provider, caps } = buildGatewayProvider({
+				gatewayUrl: boot.credentials.host.gatewayUrl,
+				accessToken: boot.credentials.accessToken,
+				wizardMetadata: boot.wizardMetadata,
+				wizardFlags: boot.wizardFlags,
+				modelId,
+				effort: inputs.thinkingLevel
+			});
+			const registry = ModelRegistry.inMemory(AuthStorage.create());
+			registry.registerProvider(GATEWAY_PROVIDER, provider);
+			const model = registry.find(GATEWAY_PROVIDER, modelId);
+			if (!model) return {
+				error: "WIZARD_API_ERROR",
+				message: "pi: gateway model could not be resolved"
+			};
+			const askState = { pending: false };
+			const { createSecurityExtension } = await import("./security-BtIAMdyk.js");
+			const security = createSecurityExtension({
+				disallowedTools: programConfig.disallowedTools,
+				getWizardAskPending: () => askState.pending,
+				triageProvider: boot.triageProvider,
+				workingDirectory: session.installDir
+			});
+			const { prewarmYaraScanner } = await import("./yara-hooks-Cj7xUAKE.js");
+			prewarmYaraScanner();
+			const extensionFactories = [security.factory];
+			let mcpCleanup;
+			let mcpInstructions;
+			try {
+				const { setupPostHogMcp, fetchInstructions } = await import("./mcp-C4Xn8mq5.js");
+				const instructionsPromise = fetchInstructions(boot.credentials.host.mcpUrl, boot.credentials.accessToken, WIZARD_USER_AGENT);
+				const mcp = await setupPostHogMcp({
+					mcpUrl: boot.credentials.host.mcpUrl,
+					accessToken: boot.credentials.accessToken,
+					userAgent: WIZARD_USER_AGENT
+				});
+				extensionFactories.push(mcp.extensionFactory);
+				mcpCleanup = mcp.cleanup;
+				mcpInstructions = await instructionsPromise;
+			} catch (err) {
+				logToFile(`[pi] PostHog MCP setup skipped: ${String(err)}`);
+				analytics.wizardCapture("mcp setup failed", {
+					harness: "pi",
+					scope: "run",
+					error: String(err).slice(0, 300)
+				});
+			}
+			const resourceLoader = new DefaultResourceLoader({
+				cwd: session.installDir,
+				agentDir: getAgentDir(),
+				systemPrompt: assembleCommandments({
+					program: programConfig.id,
+					sequence: "linear",
+					harness: "pi",
+					caps: {
+						bash: true,
+						posthogMcp: true
+					}
+				}) + "\n" + piMcpContext(boot, mcpInstructions),
+				noExtensions: true,
+				noSkills: true,
+				noContextFiles: true,
+				noPromptTemplates: true,
+				noThemes: true,
+				extensionFactories
+			});
+			await resourceLoader.reload();
+			const { createWizardPiTools } = await import("./tools-2weX1XHC.js");
+			const { createWizardPiTaskTools } = await import("./tasks-C9yxUVN7.js");
+			const { createDispatchAgentTool } = await import("./subagent-DsfcNf0P.js");
+			const wizardTaskTools = createWizardPiTaskTools();
+			const scrubbedBash = withMode(createBashToolDefinition(session.installDir, { spawnHook: (ctx) => ({
+				...ctx,
+				env: buildScrubbedEnv()
+			}) }), "sequential");
+			const customTools = [
+				withMode(createReadToolDefinition(session.installDir), "parallel"),
+				withMode(createEditToolDefinition(session.installDir), "sequential"),
+				withMode(createWriteToolDefinition(session.installDir), "sequential"),
+				scrubbedBash,
+				withMode(createLsToolDefinition(session.installDir), "parallel"),
+				withMode(createFindToolDefinition(session.installDir), "parallel"),
+				withMode(createGrepToolDefinition(session.installDir), "parallel"),
+				...createWizardPiTools({
+					workingDirectory: session.installDir,
+					skillsBaseUrl: boot.skillsBaseUrl,
+					triageProvider: boot.triageProvider,
+					detectPackageManager: config.detectPackageManager,
+					askBridge: inputs.askBridge,
+					maxQuestions: config.maxQuestions,
+					onAskPendingChange: (pending) => {
+						askState.pending = pending;
+					},
+					disallowedTools: programConfig.disallowedTools
+				}),
+				...wizardTaskTools.tools,
+				createDispatchAgentTool({
+					model,
+					modelRegistry: registry,
+					cwd: session.installDir,
+					agentDir: getAgentDir(),
+					securityFactory: security.factory,
+					bashTool: scrubbedBash,
+					sdk: {
+						createAgentSession,
+						DefaultResourceLoader,
+						SessionManager
+					}
+				})
+			];
+			const { session: agentSession } = await createAgentSession({
+				model,
+				modelRegistry: registry,
+				thinkingLevel: caps.thinkingLevel,
+				cwd: session.installDir,
+				sessionManager: SessionManager.inMemory(session.installDir),
+				resourceLoader,
+				noTools: "builtin",
+				customTools
+			});
+			await agentSession.bindExtensions({});
+			const unsubscribe = agentSession.subscribe((event) => {
+				switch (event.type) {
+					case "message_end": {
+						if (event.message?.role !== "assistant") break;
+						assistantTurns += 1;
+						const assistant = extractText(event.message).trim();
+						if (assistant) {
+							logToFile(`[pi] assistant: ${assistant.slice(0, 1e3)}`);
+							applyOutroMarkers(assistant);
+							const statusText = lastStatusLine(assistant);
+							if (statusText) {
+								getUI().pushStatus(statusText);
+								spinner.message(statusText);
+							}
+							for (const line of assistant.split("\n")) signals.push(line);
+						}
+						break;
+					}
+					case "tool_execution_start": {
+						toolCalls += 1;
+						const args = JSON.stringify(event.args ?? {}).slice(0, 200);
+						logToFile(`[pi] → ${event.toolName} ${args}`);
+						break;
+					}
+					case "tool_execution_end":
+						logToFile(`[pi] ${event.isError ? "✗" : "←"} ${event.toolName}: ${typeof event.result === "string" ? event.result : JSON.stringify(event.result ?? "")}`);
+						break;
+					case "agent_end":
+						logToFile(`[pi] agent_end (willRetry=${String(event.willRetry)})`);
+						break;
+					default: break;
+				}
+			});
+			try {
+				await agentSession.prompt(prompt);
+				let continueNudges = 0;
+				while (continueNudges < MAX_CONTINUE_NUDGES && !security.state.criticalViolation && hasOpenTasks(wizardTaskTools.store)) {
+					continueNudges += 1;
+					logToFile(`[pi] completion guard: tasks still open, nudge ${continueNudges}/${MAX_CONTINUE_NUDGES}`);
+					await agentSession.prompt(CONTINUE_INSTRUCTION);
+				}
+				if (!security.state.criticalViolation) try {
+					await agentSession.prompt(REMARK_INSTRUCTION);
+				} catch (err) {
+					logToFile(`[pi] remark request failed: ${String(err)}`);
+				}
+			} finally {
+				unsubscribe();
+				mcpCleanup?.();
+			}
+			if (security.state.criticalViolation) {
+				spinner.stop("Security violation detected");
+				logToFile(`[pi] terminated: YARA violation (blocked ${security.state.blockedCount} call(s))`);
+				captureAborted();
+				return { error: "WIZARD_YARA_VIOLATION" };
+			}
+			const openTasks = hasOpenTasks(wizardTaskTools.store);
+			const failure = completionFailure({
+				toolCalls,
+				openTasks
+			});
+			if (failure === "WIZARD_NO_PROGRESS") {
+				spinner.stop("Agent made no changes");
+				logToFile(`[pi] no progress: ${assistantTurns} assistant turn(s), 0 tool calls`);
+				analytics.wizardCapture("agent no progress", { assistant_turns: assistantTurns });
+				captureAborted();
+				return { error: failure };
+			}
+			if (failure === "WIZARD_INCOMPLETE_TASKS") {
+				spinner.stop("Agent stopped before finishing");
+				logToFile("[pi] incomplete: tasks left open");
+				analytics.wizardCapture("agent incomplete tasks", { open_tasks: true });
+				captureAborted();
+				return { error: failure };
+			}
+			const remark = signals.remark();
+			if (remark) analytics.capture(WIZARD_REMARK_EVENT_NAME, { remark });
+			const skillFailure = signals.skillInstallFailure();
+			if (skillFailure !== void 0) analytics.wizardCapture("agent continued without skill", { detail: skillFailure });
+			try {
+				const planFile = path.join(session.installDir, ".posthog-events.json");
+				if (fs.existsSync(planFile)) await fs.promises.rm(planFile);
+			} catch (err) {
+				logToFile(`[pi] .posthog-events.json cleanup skipped: ${String(err)}`);
+			}
+			const stats = agentSession.getSessionStats();
+			analytics.wizardCapture("agent completed", {
+				...runDurations(),
+				model: modelId,
+				num_turns: assistantTurns,
+				input_tokens: stats.tokens.input,
+				output_tokens: stats.tokens.output,
+				cache_creation_input_tokens: stats.tokens.cacheWrite,
+				cache_read_input_tokens: stats.tokens.cacheRead
+			});
+			spinner.stop(config.successMessage ?? "PostHog integration complete");
+			return {};
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			logToFile(`[pi] run error: ${message}`);
+			spinner.stop(config.errorMessage ?? `${config.integrationLabel} failed`);
+			getUI().log.error(`pi backend error: ${message}`);
+			captureAborted();
+			const lower = message.toLowerCase();
+			if (lower.includes("rate limit") || lower.includes("429")) return {
+				error: "WIZARD_RATE_LIMIT",
+				message
+			};
+			return {
+				error: "WIZARD_API_ERROR",
+				message
+			};
+		}
+	},
+	async runTask(inputs) {
+		const { runPiTask } = await import("./task-BZ77d7rm.js");
+		return runPiTask(inputs);
+	}
+};
+//#endregion
+export { piBackend as a, lastStatusLine as i, buildScrubbedEnv as n, withMode as o, extractText as r, applyOutroMarkers as t };
+
+//# sourceMappingURL=pi-2hh_NXKT.js.map

package/dist/pi-2hh_NXKT.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-2hh_NXKT.js","names":[],"sources":["../src/lib/agent/runner/harness/pi/completion.ts","../src/lib/agent/runner/harness/pi/index.ts"],"sourcesContent":["import { AgentErrorType } from '@lib/agent/signals';\n\n/** Which completion guard should fail a pi run, or undefined for a clean finish. */\nexport function completionFailure(args: {\n  toolCalls: number;\n  openTasks: boolean;\n}): AgentErrorType | undefined {\n  // No tool call at all — the project was never touched.\n  if (args.toolCalls === 0) return AgentErrorType.NO_PROGRESS;\n  // Acted but left tasks in its own plan unfinished (skill install not required).\n  if (args.openTasks) return AgentErrorType.INCOMPLETE_TASKS;\n  return undefined;\n}\n","/**\n * The `pi` backend — the challenger. Drives pi.dev's coding agent\n * (`@earendil-works/pi-coding-agent`) against the PostHog LLM gateway, behind\n * `wizard-orchestrator`. It owns the agent loop and model transport; prompt\n * assembly, error routing, and the outro stay in `linear.ts`, shared with the\n * `anthropic` control.\n *\n * Transport: the gateway is registered as an `anthropic-messages` provider\n * (same protocol the claude-agent-sdk path uses), bearer auth, Bedrock-fallback\n * + wizard metadata/flag headers, model id matched to `anthropic` for a clean\n * A/B. Security parity (canUseTool + YARA) and skills/MCP discovery are\n * follow-ups (#525, #524 skills) — v1 uses pi's built-in coding tools.\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport { getUI } from '@ui';\nimport { getLogFilePath, logToFile } from '@utils/debug';\nimport {\n  Harness,\n  Sequence,\n  WIZARD_REMARK_EVENT_NAME,\n  WIZARD_USER_AGENT,\n} from '@lib/constants';\nimport { analytics } from '@utils/analytics';\nimport { AgentErrorType } from '@lib/agent/agent-interface';\nimport { AgentSignals, REMARK_INSTRUCTION } from '@lib/agent/signals';\nimport { AgentOutputSignals } from '@lib/agent/output-signals';\nimport { assembleCommandments } from '../../switchboard/commandments';\nimport { buildGatewayProvider, GATEWAY_PROVIDER } from './gateway';\nimport type {\n  AgentResult,\n  AgentHarness,\n  BackendRunInputs,\n  TaskRunInputs,\n} from '../types';\nimport type { BootstrapResult } from '@lib/agent/runner/shared/types';\nimport type { TaskStore } from './tasks';\nimport { completionFailure } from './completion';\n\n/** Injects the MCP server `instructions` pi-mcp-adapter drops (project env, skill steer, tool domains) into the system prompt, falling back to a bootstrap-derived project block when the warm-connect captured none. */\nfunction piMcpContext(boot: BootstrapResult, instructions?: string): string {\n  if (instructions) {\n    // Heading + verbatim server instructions (see PR #862 for a full sample).\n    return ['', '## PostHog MCP server', instructions].join('\\n');\n  }\n  const project = boot.project?.name\n    ? `${boot.project.name} (id ${boot.credentials.projectId})`\n    : `id ${boot.credentials.projectId}`;\n  // Fallback: a `## PostHog project` block with name/id, host, region.\n  return [\n    '',\n    '## PostHog project',\n    'Your `posthog_exec` calls run against this project:',\n    `- Project: ${project}`,\n    `- Host: ${boot.credentials.host.apiHost}`,\n    `- Region: ${boot.credentials.host.region}`,\n  ].join('\\n');\n}\n\n/**\n * The ONLY environment variables pi's tool subprocesses (bash → npm/pip/…) are\n * allowed to see. Everything else — every secret (POSTHOG_PERSONAL_API_KEY,\n * ANTHROPIC_*, AWS_*), every ambient credential, the parent process's whole env\n * — is dropped before a child is spawned. pi's own gateway auth is programmatic\n * (the access token never lives in env), so a minimal env costs the agent\n * nothing while closing the leak that exposed the key before. Kept to what a\n * package manager genuinely needs to run.\n */\nconst ALLOWED_SUBPROCESS_ENV_KEYS = [\n  'PATH',\n  'HOME',\n  'SHELL',\n  'USER',\n  'LOGNAME',\n  'TMPDIR',\n  'TMP',\n  'TEMP',\n  'TERM',\n  'LANG',\n  'LC_ALL',\n  'LC_CTYPE',\n  'NODE_EXTRA_CA_CERTS',\n  'SSL_CERT_FILE',\n  'SSL_CERT_DIR',\n  'HTTP_PROXY',\n  'HTTPS_PROXY',\n  'NO_PROXY',\n  'http_proxy',\n  'https_proxy',\n  'no_proxy',\n];\n\n/** A fresh subprocess env holding only the allowlisted keys present in process.env. */\nexport function buildScrubbedEnv(): NodeJS.ProcessEnv {\n  const env: NodeJS.ProcessEnv = {};\n  for (const key of ALLOWED_SUBPROCESS_ENV_KEYS) {\n    const value = process.env[key];\n    if (value !== undefined) env[key] = value;\n  }\n  return env;\n}\n\n/**\n * Tag a tool with an execution mode (mutates + returns it). Read-only tools are\n * `parallel` so a single turn that batches independent reads/searches runs them\n * at once; mutating/install tools are `sequential` so a batch never races writes\n * or concurrent installs. pi-agent-core runs a batch in parallel only when no\n * tool in it is `sequential`.\n */\nexport function withMode<T>(tool: T, mode: 'sequential' | 'parallel'): T {\n  (tool as { executionMode?: 'sequential' | 'parallel' }).executionMode = mode;\n  return tool;\n}\n\n/** Pull plain text out of a pi AgentMessage (content is text/image blocks). */\nexport function extractText(message: unknown): string {\n  const content = (message as { content?: unknown })?.content;\n  if (typeof content === 'string') return content;\n  if (Array.isArray(content)) {\n    return content\n      .filter((c): c is { type: string; text: string } => {\n        const block = c as { type?: string; text?: unknown };\n        return block?.type === 'text' && typeof block.text === 'string';\n      })\n      .map((c) => c.text)\n      .join('');\n  }\n  return '';\n}\n\n/**\n * Surface `[DASHBOARD_URL]` / `[NOTEBOOK_URL]` markers the agent prints (after\n * the MCP creates them) into the outro link, mirroring the anthropic path's\n * signal parsing (#9). The marker carries the URL the MCP returned.\n */\nexport function applyOutroMarkers(textBlock: string): void {\n  const markers: Array<[string, (url: string) => void]> = [\n    [AgentSignals.DASHBOARD_URL, (url) => getUI().setDashboardUrl(url)],\n    [AgentSignals.NOTEBOOK_URL, (url) => getUI().setNotebookUrl(url)],\n  ];\n  for (const [marker, apply] of markers) {\n    const idx = textBlock.indexOf(marker);\n    if (idx === -1) continue;\n    const url = textBlock\n      .slice(idx + marker.length)\n      .trim()\n      .split(/\\s/)[0];\n    if (url) apply(url);\n  }\n}\n\n/**\n * The text of the last `[STATUS] …` line in a block, if any. Last wins so the\n * spinner shows the most recent action when a turn prints several.\n */\nexport function lastStatusLine(textBlock: string): string | undefined {\n  let status: string | undefined;\n  for (const line of textBlock.split('\\n')) {\n    const idx = line.indexOf(AgentSignals.STATUS);\n    if (idx !== -1) {\n      status = line.slice(idx + AgentSignals.STATUS.length).trim();\n    }\n  }\n  return status || undefined;\n}\n\n/** Cap on completion-guard re-prompts while tasks remain open (see the run loop). */\nconst MAX_CONTINUE_NUDGES = 20;\n\n/** Nudge re-sent when the agent stops early with tasks still open. */\nconst CONTINUE_INSTRUCTION =\n  'You still have open tasks in your list (not all are marked `completed`). Do not stop — pick up the next `in_progress` or `pending` task and keep working until every task is `completed`. Continue now.';\n\n/** True while any task in the store is not yet `completed`. */\nfunction hasOpenTasks(store: TaskStore): boolean {\n  for (const t of store.values()) if (t.status !== 'completed') return true;\n  return false;\n}\n\nexport const piBackend: AgentHarness = {\n  name: Harness.pi,\n\n  async run(inputs: BackendRunInputs): Promise<AgentResult> {\n    const { session, boot, prompt, spinner, config, programConfig } = inputs;\n    const modelId = inputs.model;\n\n    // Init banner (parity #5).\n    getUI().log.step('Initializing Wizard agent...');\n    getUI().log.step(`Verbose logs: ${getLogFilePath()}`);\n    getUI().log.success(\"Agent initialized. Let's get cooking!\");\n\n    spinner.start(config.spinnerMessage ?? 'Customizing your PostHog setup...');\n\n    // Same `agent completed`/`agent aborted` shape as anthropic.\n    const startTime = Date.now();\n    const signals = new AgentOutputSignals();\n    let assistantTurns = 0;\n    // Tool calls across the whole run. Zero means the agent only ever produced\n    // text and never acted — a no-op that leaves the project untouched.\n    let toolCalls = 0;\n    const runDurations = () => {\n      const durationMs = Date.now() - startTime;\n      return {\n        duration_ms: durationMs,\n        duration_seconds: Math.round(durationMs / 1000),\n      };\n    };\n    const captureAborted = () =>\n      analytics.wizardCapture('agent aborted', {\n        ...runDurations(),\n        model: modelId,\n      });\n\n    try {\n      const {\n        createAgentSession,\n        DefaultResourceLoader,\n        SessionManager,\n        AuthStorage,\n        ModelRegistry,\n        getAgentDir,\n        createLsToolDefinition,\n        createFindToolDefinition,\n        createGrepToolDefinition,\n        createBashToolDefinition,\n        createReadToolDefinition,\n        createEditToolDefinition,\n        createWriteToolDefinition,\n      } = await import('@earendil-works/pi-coding-agent');\n\n      // the claude-agent-sdk path. The provider spec is shared with the\n      // orchestrator's per-task sessions (gateway.ts).\n      const { provider, caps } = buildGatewayProvider({\n        gatewayUrl: boot.credentials.host.gatewayUrl,\n        accessToken: boot.credentials.accessToken,\n        wizardMetadata: boot.wizardMetadata,\n        wizardFlags: boot.wizardFlags,\n        modelId,\n        effort: inputs.thinkingLevel,\n      });\n      const registry = ModelRegistry.inMemory(AuthStorage.create());\n      registry.registerProvider(GATEWAY_PROVIDER, provider as never);\n\n      const model = registry.find(GATEWAY_PROVIDER, modelId);\n      if (!model) {\n        return {\n          error: AgentErrorType.API_ERROR,\n          message: 'pi: gateway model could not be resolved',\n        };\n      }\n\n      // System prompt = wizard commandments. Skip project context files /\n      // user extensions / skills so the run is hermetic; skills discovery is a\n      // follow-up (#524).\n      //\n      // Fail-closed security (#525): an extension intercepts EVERY tool call —\n      // built-in and custom — and reuses the anthropic policy (canUseTool\n      // allowlist + .env fencing + YARA). `noExtensions: true` only suppresses\n      // disk-discovered extensions; explicit `extensionFactories` still load,\n      // so the fence is on while the target project can't inject its own.\n      // Shared flag: true while a wizard_ask overlay is open. The ask tool\n      // flips it; the security gate reads it to block Write/Edit meanwhile.\n      const askState = { pending: false };\n\n      const { createSecurityExtension } = await import('./security');\n      const security = createSecurityExtension({\n        disallowedTools: programConfig.disallowedTools,\n        getWizardAskPending: () => askState.pending,\n        triageProvider: boot.triageProvider,\n        // Where pi's bash runs; the rm allowance is confined to this tree.\n        workingDirectory: session.installDir,\n      });\n\n      // Pay warlock's WASM-init + rule-compile cost now, off the tool-call\n      // path, so the first scanned call doesn't eat cold-start latency.\n      const { prewarmYaraScanner } = await import('@lib/yara-hooks');\n      void prewarmYaraScanner();\n\n      // Wire the real PostHog MCP into pi (#10): load pi's MCP adapter and point\n      // it at the hosted MCP the anthropic path uses, so dashboards/insights are\n      // created through the sanctioned MCP. Best-effort — if it can't load or\n      // connect, the run continues (minus the dashboard step) rather than failing\n      // the whole integration. The security factory is always first.\n      const extensionFactories = [security.factory] as Array<\n        (pi: unknown) => void\n      >;\n      let mcpCleanup: (() => void) | undefined;\n      let mcpInstructions: string | undefined;\n      try {\n        const { setupPostHogMcp, fetchInstructions } = await import('./mcp');\n        // Overlaps the network handshake with the adapter's jiti load.\n        const instructionsPromise = fetchInstructions(\n          boot.credentials.host.mcpUrl,\n          boot.credentials.accessToken,\n          WIZARD_USER_AGENT,\n        );\n        const mcp = await setupPostHogMcp({\n          mcpUrl: boot.credentials.host.mcpUrl,\n          accessToken: boot.credentials.accessToken,\n          userAgent: WIZARD_USER_AGENT,\n        });\n        extensionFactories.push(mcp.extensionFactory);\n        mcpCleanup = mcp.cleanup;\n        mcpInstructions = await instructionsPromise;\n      } catch (err) {\n        logToFile(`[pi] PostHog MCP setup skipped: ${String(err)}`);\n        analytics.wizardCapture('mcp setup failed', {\n          harness: 'pi',\n          scope: 'run',\n          error: String(err).slice(0, 300),\n        });\n      }\n\n      const resourceLoader = new DefaultResourceLoader({\n        cwd: session.installDir,\n        agentDir: getAgentDir(),\n        systemPrompt:\n          assembleCommandments({\n            program: programConfig.id,\n            sequence: Sequence.linear,\n            harness: Harness.pi,\n            caps: { bash: true, posthogMcp: true },\n          }) +\n          '\\n' +\n          piMcpContext(boot, mcpInstructions),\n        noExtensions: true,\n        noSkills: true,\n        noContextFiles: true,\n        noPromptTemplates: true,\n        noThemes: true,\n        extensionFactories,\n      });\n      await resourceLoader.reload();\n\n      // Wizard capabilities as custom tools (pi has no MCP): skill\n      // discovery/install + fenced .env edits, same names as the MCP server so\n      // the shared prompt is unchanged. pi's built-in Read/Write/Edit/Bash do\n      // the code changes. Loaded lazily — it pulls in typebox (ESM), which must\n      // stay out of the static module graph so CommonJS unit tests can load the\n      // backend seam without parsing it.\n      const { createWizardPiTools } = await import('./tools');\n      const { createWizardPiTaskTools } = await import('./tasks');\n      const { createDispatchAgentTool } = await import('./subagent');\n      // Created once so the run loop can read the store for the completion guard.\n      const wizardTaskTools = createWizardPiTaskTools();\n      // The one bash the agent (and its subagents) may use: every subprocess it\n      // spawns gets a scrubbed env, so no secret or ambient variable reaches an\n      // `npm install`. Shared with the subagent so the lockdown is inherited.\n      const scrubbedBash = withMode(\n        createBashToolDefinition(session.installDir, {\n          spawnHook: (ctx) => ({ ...ctx, env: buildScrubbedEnv() }),\n        }),\n        'sequential',\n      );\n\n      const customTools = [\n        // Built-ins re-registered explicitly. `noTools: 'builtin'` disables pi's\n        // defaults so we can supply the env-scrubbed bash above; read/edit/write\n        // are the stock definitions. Reads run in parallel so a batched turn of\n        // independent reads executes at once; edit/write/bash stay sequential.\n        withMode(createReadToolDefinition(session.installDir), 'parallel'),\n        withMode(createEditToolDefinition(session.installDir), 'sequential'),\n        withMode(createWriteToolDefinition(session.installDir), 'sequential'),\n        scrubbedBash,\n        // Native ls/find/grep so the agent explores with proper tools instead\n        // of fence-blocked `bash {ls/find}` (the profiled retry-spirals came\n        // from this gap). Parallel — exploration batches cleanly.\n        withMode(createLsToolDefinition(session.installDir), 'parallel'),\n        withMode(createFindToolDefinition(session.installDir), 'parallel'),\n        withMode(createGrepToolDefinition(session.installDir), 'parallel'),\n        ...createWizardPiTools({\n          workingDirectory: session.installDir,\n          skillsBaseUrl: boot.skillsBaseUrl,\n          triageProvider: boot.triageProvider,\n          detectPackageManager: config.detectPackageManager,\n          // The host ask bridge — lets interactive programs (self-driving) ask\n          // the user through pi. Threaded from the runner, same path as the\n          // anthropic harness. Absent in CI → the tool errors on call.\n          askBridge: inputs.askBridge,\n          maxQuestions: config.maxQuestions,\n          onAskPendingChange: (pending) => {\n            askState.pending = pending;\n          },\n          // Skip wizard_ask when the program disallows it (bare pi tool names\n          // don't match the MCP-prefixed disallow list at the security gate).\n          disallowedTools: programConfig.disallowedTools,\n        }),\n        // Task/todo tools (#526): render the todo list live in the TUI, parity\n        // with the anthropic path.\n        ...wizardTaskTools.tools,\n        // Controlled subagent dispatch (#526): a nested fenced session with a\n        // read-only toolset and no dispatch_agent of its own, so it can't\n        // escape the fence or recurse.\n        createDispatchAgentTool({\n          model,\n          modelRegistry: registry,\n          cwd: session.installDir,\n          agentDir: getAgentDir(),\n          securityFactory: security.factory as (pi: unknown) => void,\n          bashTool: scrubbedBash,\n          sdk: { createAgentSession, DefaultResourceLoader, SessionManager },\n        }),\n      ];\n\n      const { session: agentSession } = await createAgentSession({\n        model,\n        modelRegistry: registry,\n        // Reasoning effort from the switchboard capability matrix (undefined =\n        // pi's default). Sent as `reasoning_effort` for openai-completions.\n        thinkingLevel: caps.thinkingLevel,\n        cwd: session.installDir,\n        sessionManager: SessionManager.inMemory(session.installDir),\n        resourceLoader,\n        // Disable the default built-in tools; `customTools` re-registers\n        // read/edit/write + an env-scrubbed bash, so no subprocess inherits the\n        // host env. Custom + extension tools stay enabled.\n        noTools: 'builtin',\n        customTools,\n      });\n\n      // Fire the extension lifecycle — what interactive mode does via\n      // rebindCurrentSession. createAgentSession builds the session but does not\n      // emit session_start on its own, and the MCP adapter connects on that\n      // event; without this its tools report \"MCP not initialized\".\n      await agentSession.bindExtensions({});\n\n      // Map pi events onto the run spinner + the log file, mirroring the\n      // anthropic path's log shape (assistant turns + tool I/O) and driving the\n      // single run spinner with one stable status at a time (no overlap).\n      const unsubscribe = agentSession.subscribe((event) => {\n        switch (event.type) {\n          case 'message_end': {\n            // User prompts also emit message_end; only assistant turns count.\n            if ((event.message as { role?: string })?.role !== 'assistant') {\n              break;\n            }\n            assistantTurns += 1;\n            const assistant = extractText(event.message).trim();\n            if (assistant) {\n              logToFile(`[pi] assistant: ${assistant.slice(0, 1000)}`);\n              applyOutroMarkers(assistant);\n              // Surface [STATUS] lines into the live spinner + status history,\n              // mirroring the anthropic path — pi otherwise drops them.\n              const statusText = lastStatusLine(assistant);\n              if (statusText) {\n                getUI().pushStatus(statusText);\n                spinner.message(statusText);\n              }\n              for (const line of assistant.split('\\n')) signals.push(line);\n            }\n            break;\n          }\n          case 'tool_execution_start': {\n            toolCalls += 1;\n            const args = JSON.stringify(event.args ?? {}).slice(0, 200);\n            logToFile(`[pi] → ${event.toolName} ${args}`);\n            // Don't surface raw tool names in the spinner — the anthropic path\n            // doesn't, and it reads as noise. The Task panel (syncTodos) is the\n            // visible progress, matching the anthropic presentation.\n            break;\n          }\n          case 'tool_execution_end': {\n            // Log every result in full, matching the anthropic path's\n            // SDK-message logging. Call-only logs make failed runs\n            // undiagnosable: a tool can fail (or return something the model\n            // misreads) with no trace of what came back.\n            logToFile(\n              `[pi] ${event.isError ? '✗' : '←'} ${event.toolName}: ${\n                typeof event.result === 'string'\n                  ? event.result\n                  : JSON.stringify(event.result ?? '')\n              }`,\n            );\n            break;\n          }\n          case 'agent_end': {\n            logToFile(`[pi] agent_end (willRetry=${String(event.willRetry)})`);\n            break;\n          }\n          default:\n            break;\n        }\n      });\n\n      try {\n        // Non-streaming: resolves when the agent run completes. Throws if no\n        // model/api key, or on a transport error.\n        await agentSession.prompt(prompt);\n\n        // Completion guard: pi's prompt() resolves the moment the model returns\n        // a turn with no tool call (e.g. a lone [STATUS] line), even mid-plan.\n        // While tasks remain open and we're under the cap, nudge it to continue.\n        let continueNudges = 0;\n        while (\n          continueNudges < MAX_CONTINUE_NUDGES &&\n          !security.state.criticalViolation &&\n          hasOpenTasks(wizardTaskTools.store)\n        ) {\n          continueNudges += 1;\n          logToFile(\n            `[pi] completion guard: tasks still open, nudge ${continueNudges}/${MAX_CONTINUE_NUDGES}`,\n          );\n          await agentSession.prompt(CONTINUE_INSTRUCTION);\n        }\n\n        // Best-effort remark ask — a failed turn never fails a successful run.\n        if (!security.state.criticalViolation) {\n          try {\n            await agentSession.prompt(REMARK_INSTRUCTION);\n          } catch (err) {\n            logToFile(`[pi] remark request failed: ${String(err)}`);\n          }\n        }\n      } finally {\n        unsubscribe();\n        mcpCleanup?.();\n      }\n\n      // A latched post-scan violation terminates the run as a YARA violation,\n      // matching the anthropic path's AgentErrorType.YARA_VIOLATION.\n      if (security.state.criticalViolation) {\n        spinner.stop('Security violation detected');\n        logToFile(\n          `[pi] terminated: YARA violation (blocked ${security.state.blockedCount} call(s))`,\n        );\n        captureAborted();\n        return { error: AgentErrorType.YARA_VIOLATION };\n      }\n\n      // pi ends a run on any tool-call-less turn, so guard against a hollow\n      // success reaching the outro (nothing done, or stopped mid-plan).\n      const openTasks = hasOpenTasks(wizardTaskTools.store);\n      const failure = completionFailure({ toolCalls, openTasks });\n      if (failure === AgentErrorType.NO_PROGRESS) {\n        spinner.stop('Agent made no changes');\n        logToFile(\n          `[pi] no progress: ${assistantTurns} assistant turn(s), 0 tool calls`,\n        );\n        analytics.wizardCapture('agent no progress', {\n          assistant_turns: assistantTurns,\n        });\n        captureAborted();\n        return { error: failure };\n      }\n      if (failure === AgentErrorType.INCOMPLETE_TASKS) {\n        spinner.stop('Agent stopped before finishing');\n        logToFile('[pi] incomplete: tasks left open');\n        analytics.wizardCapture('agent incomplete tasks', { open_tasks: true });\n        captureAborted();\n        return { error: failure };\n      }\n\n      const remark = signals.remark();\n      if (remark) {\n        analytics.capture(WIZARD_REMARK_EVENT_NAME, { remark });\n      }\n\n      // A failed install_skill is non-fatal — the agent continues best-effort\n      // without the skill — but every such run must be measurable.\n      const skillFailure = signals.skillInstallFailure();\n      if (skillFailure !== undefined) {\n        analytics.wizardCapture('agent continued without skill', {\n          detail: skillFailure,\n        });\n      }\n\n      // The skill plans events into .posthog-events.json then asks to remove it\n      // on completion; pi's `rm` is fence-blocked, so the agent can't — clean it\n      // up host-side rather than leave a stale (often empty) artifact (#15).\n      try {\n        const planFile = path.join(session.installDir, '.posthog-events.json');\n        if (fs.existsSync(planFile)) await fs.promises.rm(planFile);\n      } catch (err) {\n        logToFile(`[pi] .posthog-events.json cleanup skipped: ${String(err)}`);\n      }\n\n      const stats = agentSession.getSessionStats();\n      analytics.wizardCapture('agent completed', {\n        ...runDurations(),\n        model: modelId,\n        num_turns: assistantTurns,\n        // API-reported tokens only; no total_cost_usd — the API returns no\n        // cost, and $ai_generation already prices the run authoritatively.\n        input_tokens: stats.tokens.input,\n        output_tokens: stats.tokens.output,\n        cache_creation_input_tokens: stats.tokens.cacheWrite,\n        cache_read_input_tokens: stats.tokens.cacheRead,\n      });\n      spinner.stop(config.successMessage ?? 'PostHog integration complete');\n      return {};\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      logToFile(`[pi] run error: ${message}`);\n      spinner.stop(config.errorMessage ?? `${config.integrationLabel} failed`);\n      getUI().log.error(`pi backend error: ${message}`);\n      captureAborted();\n\n      const lower = message.toLowerCase();\n      if (lower.includes('rate limit') || lower.includes('429')) {\n        return { error: AgentErrorType.RATE_LIMIT, message };\n      }\n      return { error: AgentErrorType.API_ERROR, message };\n    }\n  },\n\n  // Orchestrator mode: one fresh pi session per seed plan / drained task, with\n  // the in-process queue tools registered as pi custom tools. Lazily imported —\n  // task.ts pulls in typebox (ESM), which must stay out of the static module\n  // graph so CommonJS unit tests can load the backend seam without parsing it.\n  async runTask(inputs: TaskRunInputs): Promise<AgentResult> {\n    const { runPiTask } = await import('./task');\n    return runPiTask(inputs);\n  },\n};\n"],"mappings":";;;;;;;AAGA,SAAgB,kBAAkB,MAGH;AAE7B,KAAI,KAAK,cAAc,EAAG,QAAA;AAE1B,KAAI,KAAK,UAAW,QAAA;;;;;;;;;;;;;;;;;;AC+BtB,SAAS,aAAa,MAAuB,cAA+B;AAC1E,KAAI,aAEF,QAAO;EAAC;EAAI;EAAyB;EAAa,CAAC,KAAK,KAAK;AAM/D,QAAO;EACL;EACA;EACA;EACA,cARc,KAAK,SAAS,OAC1B,GAAG,KAAK,QAAQ,KAAK,OAAO,KAAK,YAAY,UAAU,KACvD,MAAM,KAAK,YAAY;EAOzB,WAAW,KAAK,YAAY,KAAK;EACjC,aAAa,KAAK,YAAY,KAAK;EACpC,CAAC,KAAK,KAAK;;;;;;;;;;;AAYd,MAAM,8BAA8B;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;;AAGD,SAAgB,mBAAsC;CACpD,MAAM,MAAyB,EAAE;AACjC,MAAK,MAAM,OAAO,6BAA6B;EAC7C,MAAM,QAAQ,QAAQ,IAAI;AAC1B,MAAI,UAAU,KAAA,EAAW,KAAI,OAAO;;AAEtC,QAAO;;;;;;;;;AAUT,SAAgB,SAAY,MAAS,MAAoC;AACtE,MAAuD,gBAAgB;AACxE,QAAO;;;AAIT,SAAgB,YAAY,SAA0B;CACpD,MAAM,UAAW,SAAmC;AACpD,KAAI,OAAO,YAAY,SAAU,QAAO;AACxC,KAAI,MAAM,QAAQ,QAAQ,CACxB,QAAO,QACJ,QAAQ,MAA2C;EAClD,MAAM,QAAQ;AACd,SAAO,OAAO,SAAS,UAAU,OAAO,MAAM,SAAS;GACvD,CACD,KAAK,MAAM,EAAE,KAAK,CAClB,KAAK,GAAG;AAEb,QAAO;;;;;;;AAQT,SAAgB,kBAAkB,WAAyB;CACzD,MAAM,UAAkD,CACtD,CAAC,aAAa,gBAAgB,QAAQ,OAAO,CAAC,gBAAgB,IAAI,CAAC,EACnE,CAAC,aAAa,eAAe,QAAQ,OAAO,CAAC,eAAe,IAAI,CAAC,CAClE;AACD,MAAK,MAAM,CAAC,QAAQ,UAAU,SAAS;EACrC,MAAM,MAAM,UAAU,QAAQ,OAAO;AACrC,MAAI,QAAQ,GAAI;EAChB,MAAM,MAAM,UACT,MAAM,MAAM,OAAO,OAAO,CAC1B,MAAM,CACN,MAAM,KAAK,CAAC;AACf,MAAI,IAAK,OAAM,IAAI;;;;;;;AAQvB,SAAgB,eAAe,WAAuC;CACpE,IAAI;AACJ,MAAK,MAAM,QAAQ,UAAU,MAAM,KAAK,EAAE;EACxC,MAAM,MAAM,KAAK,QAAQ,aAAa,OAAO;AAC7C,MAAI,QAAQ,GACV,UAAS,KAAK,MAAM,MAAM,aAAa,OAAO,OAAO,CAAC,MAAM;;AAGhE,QAAO,UAAU,KAAA;;;AAInB,MAAM,sBAAsB;;AAG5B,MAAM,uBACJ;;AAGF,SAAS,aAAa,OAA2B;AAC/C,MAAK,MAAM,KAAK,MAAM,QAAQ,CAAE,KAAI,EAAE,WAAW,YAAa,QAAO;AACrE,QAAO;;AAGT,MAAa,YAA0B;CACrC,MAAA;CAEA,MAAM,IAAI,QAAgD;EACxD,MAAM,EAAE,SAAS,MAAM,QAAQ,SAAS,QAAQ,kBAAkB;EAClE,MAAM,UAAU,OAAO;AAGvB,SAAO,CAAC,IAAI,KAAK,+BAA+B;AAChD,SAAO,CAAC,IAAI,KAAK,iBAAiB,gBAAgB,GAAG;AACrD,SAAO,CAAC,IAAI,QAAQ,wCAAwC;AAE5D,UAAQ,MAAM,OAAO,kBAAkB,oCAAoC;EAG3E,MAAM,YAAY,KAAK,KAAK;EAC5B,MAAM,UAAU,IAAI,oBAAoB;EACxC,IAAI,iBAAiB;EAGrB,IAAI,YAAY;EAChB,MAAM,qBAAqB;GACzB,MAAM,aAAa,KAAK,KAAK,GAAG;AAChC,UAAO;IACL,aAAa;IACb,kBAAkB,KAAK,MAAM,aAAa,IAAK;IAChD;;EAEH,MAAM,uBACJ,UAAU,cAAc,iBAAiB;GACvC,GAAG,cAAc;GACjB,OAAO;GACR,CAAC;AAEJ,MAAI;GACF,MAAM,EACJ,oBACA,uBACA,gBACA,aACA,eACA,aACA,wBACA,0BACA,0BACA,0BACA,0BACA,0BACA,8BACE,MAAM,OAAO;GAIjB,MAAM,EAAE,UAAU,SAAS,qBAAqB;IAC9C,YAAY,KAAK,YAAY,KAAK;IAClC,aAAa,KAAK,YAAY;IAC9B,gBAAgB,KAAK;IACrB,aAAa,KAAK;IAClB;IACA,QAAQ,OAAO;IAChB,CAAC;GACF,MAAM,WAAW,cAAc,SAAS,YAAY,QAAQ,CAAC;AAC7D,YAAS,iBAAiB,kBAAkB,SAAkB;GAE9D,MAAM,QAAQ,SAAS,KAAK,kBAAkB,QAAQ;AACtD,OAAI,CAAC,MACH,QAAO;IACL,OAAA;IACA,SAAS;IACV;GAcH,MAAM,WAAW,EAAE,SAAS,OAAO;GAEnC,MAAM,EAAE,4BAA4B,MAAM,OAAO;GACjD,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,cAAc;IAC/B,2BAA2B,SAAS;IACpC,gBAAgB,KAAK;IAErB,kBAAkB,QAAQ;IAC3B,CAAC;GAIF,MAAM,EAAE,uBAAuB,MAAM,OAAO;AACvC,uBAAoB;GAOzB,MAAM,qBAAqB,CAAC,SAAS,QAAQ;GAG7C,IAAI;GACJ,IAAI;AACJ,OAAI;IACF,MAAM,EAAE,iBAAiB,sBAAsB,MAAM,OAAO;IAE5D,MAAM,sBAAsB,kBAC1B,KAAK,YAAY,KAAK,QACtB,KAAK,YAAY,aACjB,kBACD;IACD,MAAM,MAAM,MAAM,gBAAgB;KAChC,QAAQ,KAAK,YAAY,KAAK;KAC9B,aAAa,KAAK,YAAY;KAC9B,WAAW;KACZ,CAAC;AACF,uBAAmB,KAAK,IAAI,iBAAiB;AAC7C,iBAAa,IAAI;AACjB,sBAAkB,MAAM;YACjB,KAAK;AACZ,cAAU,mCAAmC,OAAO,IAAI,GAAG;AAC3D,cAAU,cAAc,oBAAoB;KAC1C,SAAS;KACT,OAAO;KACP,OAAO,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI;KACjC,CAAC;;GAGJ,MAAM,iBAAiB,IAAI,sBAAsB;IAC/C,KAAK,QAAQ;IACb,UAAU,aAAa;IACvB,cACE,qBAAqB;KACnB,SAAS,cAAc;KACvB,UAAA;KACA,SAAA;KACA,MAAM;MAAE,MAAM;MAAM,YAAY;MAAM;KACvC,CAAC,GACF,OACA,aAAa,MAAM,gBAAgB;IACrC,cAAc;IACd,UAAU;IACV,gBAAgB;IAChB,mBAAmB;IACnB,UAAU;IACV;IACD,CAAC;AACF,SAAM,eAAe,QAAQ;GAQ7B,MAAM,EAAE,wBAAwB,MAAM,OAAO;GAC7C,MAAM,EAAE,4BAA4B,MAAM,OAAO;GACjD,MAAM,EAAE,4BAA4B,MAAM,OAAO;GAEjD,MAAM,kBAAkB,yBAAyB;GAIjD,MAAM,eAAe,SACnB,yBAAyB,QAAQ,YAAY,EAC3C,YAAY,SAAS;IAAE,GAAG;IAAK,KAAK,kBAAkB;IAAE,GACzD,CAAC,EACF,aACD;GAED,MAAM,cAAc;IAKlB,SAAS,yBAAyB,QAAQ,WAAW,EAAE,WAAW;IAClE,SAAS,yBAAyB,QAAQ,WAAW,EAAE,aAAa;IACpE,SAAS,0BAA0B,QAAQ,WAAW,EAAE,aAAa;IACrE;IAIA,SAAS,uBAAuB,QAAQ,WAAW,EAAE,WAAW;IAChE,SAAS,yBAAyB,QAAQ,WAAW,EAAE,WAAW;IAClE,SAAS,yBAAyB,QAAQ,WAAW,EAAE,WAAW;IAClE,GAAG,oBAAoB;KACrB,kBAAkB,QAAQ;KAC1B,eAAe,KAAK;KACpB,gBAAgB,KAAK;KACrB,sBAAsB,OAAO;KAI7B,WAAW,OAAO;KAClB,cAAc,OAAO;KACrB,qBAAqB,YAAY;AAC/B,eAAS,UAAU;;KAIrB,iBAAiB,cAAc;KAChC,CAAC;IAGF,GAAG,gBAAgB;IAInB,wBAAwB;KACtB;KACA,eAAe;KACf,KAAK,QAAQ;KACb,UAAU,aAAa;KACvB,iBAAiB,SAAS;KAC1B,UAAU;KACV,KAAK;MAAE;MAAoB;MAAuB;MAAgB;KACnE,CAAC;IACH;GAED,MAAM,EAAE,SAAS,iBAAiB,MAAM,mBAAmB;IACzD;IACA,eAAe;IAGf,eAAe,KAAK;IACpB,KAAK,QAAQ;IACb,gBAAgB,eAAe,SAAS,QAAQ,WAAW;IAC3D;IAIA,SAAS;IACT;IACD,CAAC;AAMF,SAAM,aAAa,eAAe,EAAE,CAAC;GAKrC,MAAM,cAAc,aAAa,WAAW,UAAU;AACpD,YAAQ,MAAM,MAAd;KACE,KAAK,eAAe;AAElB,UAAK,MAAM,SAA+B,SAAS,YACjD;AAEF,wBAAkB;MAClB,MAAM,YAAY,YAAY,MAAM,QAAQ,CAAC,MAAM;AACnD,UAAI,WAAW;AACb,iBAAU,mBAAmB,UAAU,MAAM,GAAG,IAAK,GAAG;AACxD,yBAAkB,UAAU;OAG5B,MAAM,aAAa,eAAe,UAAU;AAC5C,WAAI,YAAY;AACd,eAAO,CAAC,WAAW,WAAW;AAC9B,gBAAQ,QAAQ,WAAW;;AAE7B,YAAK,MAAM,QAAQ,UAAU,MAAM,KAAK,CAAE,SAAQ,KAAK,KAAK;;AAE9D;;KAEF,KAAK,wBAAwB;AAC3B,mBAAa;MACb,MAAM,OAAO,KAAK,UAAU,MAAM,QAAQ,EAAE,CAAC,CAAC,MAAM,GAAG,IAAI;AAC3D,gBAAU,UAAU,MAAM,SAAS,GAAG,OAAO;AAI7C;;KAEF,KAAK;AAKH,gBACE,QAAQ,MAAM,UAAU,MAAM,IAAI,GAAG,MAAM,SAAS,IAClD,OAAO,MAAM,WAAW,WACpB,MAAM,SACN,KAAK,UAAU,MAAM,UAAU,GAAG,GAEzC;AACD;KAEF,KAAK;AACH,gBAAU,6BAA6B,OAAO,MAAM,UAAU,CAAC,GAAG;AAClE;KAEF,QACE;;KAEJ;AAEF,OAAI;AAGF,UAAM,aAAa,OAAO,OAAO;IAKjC,IAAI,iBAAiB;AACrB,WACE,iBAAiB,uBACjB,CAAC,SAAS,MAAM,qBAChB,aAAa,gBAAgB,MAAM,EACnC;AACA,uBAAkB;AAClB,eACE,kDAAkD,eAAe,GAAG,sBACrE;AACD,WAAM,aAAa,OAAO,qBAAqB;;AAIjD,QAAI,CAAC,SAAS,MAAM,kBAClB,KAAI;AACF,WAAM,aAAa,OAAO,mBAAmB;aACtC,KAAK;AACZ,eAAU,+BAA+B,OAAO,IAAI,GAAG;;aAGnD;AACR,iBAAa;AACb,kBAAc;;AAKhB,OAAI,SAAS,MAAM,mBAAmB;AACpC,YAAQ,KAAK,8BAA8B;AAC3C,cACE,4CAA4C,SAAS,MAAM,aAAa,WACzE;AACD,oBAAgB;AAChB,WAAO,EAAE,OAAA,yBAAsC;;GAKjD,MAAM,YAAY,aAAa,gBAAgB,MAAM;GACrD,MAAM,UAAU,kBAAkB;IAAE;IAAW;IAAW,CAAC;AAC3D,OAAI,YAAA,sBAAwC;AAC1C,YAAQ,KAAK,wBAAwB;AACrC,cACE,qBAAqB,eAAe,kCACrC;AACD,cAAU,cAAc,qBAAqB,EAC3C,iBAAiB,gBAClB,CAAC;AACF,oBAAgB;AAChB,WAAO,EAAE,OAAO,SAAS;;AAE3B,OAAI,YAAA,2BAA6C;AAC/C,YAAQ,KAAK,iCAAiC;AAC9C,cAAU,mCAAmC;AAC7C,cAAU,cAAc,0BAA0B,EAAE,YAAY,MAAM,CAAC;AACvE,oBAAgB;AAChB,WAAO,EAAE,OAAO,SAAS;;GAG3B,MAAM,SAAS,QAAQ,QAAQ;AAC/B,OAAI,OACF,WAAU,QAAQ,0BAA0B,EAAE,QAAQ,CAAC;GAKzD,MAAM,eAAe,QAAQ,qBAAqB;AAClD,OAAI,iBAAiB,KAAA,EACnB,WAAU,cAAc,iCAAiC,EACvD,QAAQ,cACT,CAAC;AAMJ,OAAI;IACF,MAAM,WAAW,KAAK,KAAK,QAAQ,YAAY,uBAAuB;AACtE,QAAI,GAAG,WAAW,SAAS,CAAE,OAAM,GAAG,SAAS,GAAG,SAAS;YACpD,KAAK;AACZ,cAAU,8CAA8C,OAAO,IAAI,GAAG;;GAGxE,MAAM,QAAQ,aAAa,iBAAiB;AAC5C,aAAU,cAAc,mBAAmB;IACzC,GAAG,cAAc;IACjB,OAAO;IACP,WAAW;IAGX,cAAc,MAAM,OAAO;IAC3B,eAAe,MAAM,OAAO;IAC5B,6BAA6B,MAAM,OAAO;IAC1C,yBAAyB,MAAM,OAAO;IACvC,CAAC;AACF,WAAQ,KAAK,OAAO,kBAAkB,+BAA+B;AACrE,UAAO,EAAE;WACF,KAAK;GACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,aAAU,mBAAmB,UAAU;AACvC,WAAQ,KAAK,OAAO,gBAAgB,GAAG,OAAO,iBAAiB,SAAS;AACxE,UAAO,CAAC,IAAI,MAAM,qBAAqB,UAAU;AACjD,mBAAgB;GAEhB,MAAM,QAAQ,QAAQ,aAAa;AACnC,OAAI,MAAM,SAAS,aAAa,IAAI,MAAM,SAAS,MAAM,CACvD,QAAO;IAAE,OAAA;IAAkC;IAAS;AAEtD,UAAO;IAAE,OAAA;IAAiC;IAAS;;;CAQvD,MAAM,QAAQ,QAA6C;EACzD,MAAM,EAAE,cAAc,MAAM,OAAO;AACnC,SAAO,UAAU,OAAO;;CAE3B"}