@productbrain/cli 0.1.0-beta.1131 → 0.1.0-beta.11313

package/dist/commands/files.test.js

@@ -0,0 +1,278 @@
+// packages/cli/src/commands/files.test.ts
+import { describe, it, expect } from 'vitest';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { execSync } from 'node:child_process';
+import { resolveFiles, formatFilesPretty } from './files.js';
+// TEN-3088 / TEN-3082: a child `git` process spawned for a throwaway temp-repo fixture must
+// never inherit any repository-local env var a git hook's own process may have set (GIT_DIR
+// et al.) — if this suite ever runs from within a git hook process, those vars redirect a
+// fixture's `git init` at the REAL repo's gitdir instead of the temp dir. Mirrors
+// scripts/lib/gitFixtureEnv.mjs's fix for the same class of leak, kept local here to avoid a
+// cross-package import. GIT_ENV_LEAK_KEYS is `git rev-parse --local-env-vars`'s own output,
+// VENDORED (never shelled out to here) — not a hand-picked subset, which is what let GIT_CONFIG
+// and GIT_OBJECT_DIRECTORY through undetected in review round 1 (PRRT_kwDORS4ils6YnoW2). The
+// canonical copy + its superset test (verified live against a real `git rev-parse
+// --local-env-vars` run) lives in scripts/lib/gitFixtureEnv.mjs / .node-test.mjs; this array
+// must be kept in sync with it by hand (no shared import across the package boundary).
+const GIT_ENV_LEAK_KEYS = [
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    'GIT_CONFIG',
+    'GIT_CONFIG_PARAMETERS',
+    'GIT_CONFIG_COUNT',
+    'GIT_OBJECT_DIRECTORY',
+    'GIT_DIR',
+    'GIT_WORK_TREE',
+    'GIT_IMPLICIT_WORK_TREE',
+    'GIT_GRAFT_FILE',
+    'GIT_INDEX_FILE',
+    'GIT_NO_REPLACE_OBJECTS',
+    'GIT_REPLACE_REF_BASE',
+    'GIT_PREFIX',
+    'GIT_SHALLOW_FILE',
+    'GIT_COMMON_DIR',
+];
+const GIT_FIXTURE_ENV = { ...process.env };
+for (const key of GIT_ENV_LEAK_KEYS)
+    delete GIT_FIXTURE_ENV[key];
+for (const key of Object.keys(GIT_FIXTURE_ENV)) {
+    if (/^GIT_CONFIG_(?:KEY|VALUE)_\d+$/.test(key))
+        delete GIT_FIXTURE_ENV[key];
+}
+function tmpRepoWith(files, gitignore) {
+    const dir = mkdtempSync(join(tmpdir(), 'pbcmd-'));
+    execSync('git init -q', { cwd: dir, env: GIT_FIXTURE_ENV });
+    mkdirSync(join(dir, '.productbrain'), { recursive: true });
+    for (const [p, c] of Object.entries(files))
+        writeFileSync(join(dir, '.productbrain', p), c);
+    if (gitignore !== undefined)
+        writeFileSync(join(dir, '.gitignore'), gitignore);
+    return dir;
+}
+describe('resolveFiles', () => {
+    it('classifies present files and finds an exposed secret', async () => {
+        const dir = tmpRepoWith({ 'config.local.json': '{}', 'soul.md': '#' }, '');
+        const cwd = process.cwd();
+        try {
+            process.chdir(dir);
+            const res = await resolveFiles({ fix: false, dryRun: false });
+            expect(res.git).toBe(true);
+            expect(res.files.find((f) => f.path === 'config.local.json').exposed).toBe(true);
+            expect(res.exposures.some((e) => e.path === 'config.local.json')).toBe(true);
+            // pretty output is legible: names the secret + the fix command
+            const pretty = formatFilesPretty(res);
+            expect(pretty).toMatch(/config\.local\.json/);
+            expect(pretty).toMatch(/pb files --fix/);
+        }
+        finally {
+            process.chdir(cwd);
+            rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    it('all-clear when the secret is gitignored', async () => {
+        const dir = tmpRepoWith({ 'config.local.json': '{}' }, '.productbrain/config.local.json\n');
+        const cwd = process.cwd();
+        try {
+            process.chdir(dir);
+            const res = await resolveFiles({ fix: false, dryRun: false });
+            expect(res.exposures).toHaveLength(0);
+            expect(formatFilesPretty(res)).toMatch(/all present pb-owned files are gitignored/i);
+        }
+        finally {
+            process.chdir(cwd);
+            rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});
+describe('resolveFiles --json shape + --fix', () => {
+    it('returns the documented --json schema', async () => {
+        const dir = tmpRepoWith({ 'config.local.json': '{}' }, '');
+        const cwd = process.cwd();
+        try {
+            process.chdir(dir);
+            const res = await resolveFiles({ fix: false, dryRun: false });
+            expect(res).toHaveProperty('workspace');
+            expect(res).toHaveProperty('root');
+            expect(res).toHaveProperty('git');
+            expect(Array.isArray(res.files)).toBe(true);
+            expect(Array.isArray(res.exposures)).toBe(true);
+            const row = res.files[0];
+            expect(row).toMatchObject({
+                path: expect.any(String), kind: expect.any(String), writer: expect.any(String),
+                when: expect.any(String), present: expect.any(Boolean),
+            });
+        }
+        finally {
+            process.chdir(cwd);
+            rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    it('--fix --dry-run computes lines but writes nothing', async () => {
+        const dir = tmpRepoWith({ 'config.local.json': '{}' }, '');
+        const cwd = process.cwd();
+        try {
+            process.chdir(dir);
+            const res = await resolveFiles({ fix: true, dryRun: true });
+            expect(res.fix.added).toContain('.productbrain/config.local.json');
+            // dry-run: .gitignore unchanged (still empty)
+            expect(readFileSync(join(dir, '.gitignore'), 'utf8')).not.toMatch(/config\.local\.json/);
+        }
+        finally {
+            process.chdir(cwd);
+            rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    it('--fix actually seals the boundary (idempotent on re-run)', async () => {
+        const dir = tmpRepoWith({ 'config.local.json': '{}' }, '');
+        const cwd = process.cwd();
+        try {
+            process.chdir(dir);
+            const first = await resolveFiles({ fix: true, dryRun: false });
+            expect(first.fix.added).toContain('.productbrain/config.local.json');
+            expect(first.exposures).toHaveLength(0); // recomputed post-write: no stale exposure in the same call
+            const second = await resolveFiles({ fix: true, dryRun: false });
+            expect(second.fix.added).not.toContain('.productbrain/config.local.json');
+            expect(second.exposures).toHaveLength(0); // now sealed
+        }
+        finally {
+            process.chdir(cwd);
+            rmSync(dir, { recursive: true, force: true });
+        }
+    }, 60000);
+    it('nested root — fix refused message names <root>/.gitignore, not toplevel', async () => {
+        const dir = mkdtempSync(join(tmpdir(), 'pbcmd-nested-'));
+        const cwd = process.cwd();
+        try {
+            execSync('git init -q', { cwd: dir, env: GIT_FIXTURE_ENV });
+            const sub = join(dir, 'sub');
+            mkdirSync(join(sub, '.productbrain'), { recursive: true });
+            writeFileSync(join(sub, '.productbrain', 'config.json'), '{}');
+            process.chdir(sub);
+            const res = await resolveFiles({ fix: true, dryRun: false });
+            expect(res.fix.refused).toContain(sub + '/.gitignore');
+            expect(res.fix.refused).toContain('patterns are relative to that file');
+        }
+        finally {
+            process.chdir(cwd);
+            rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    it('--fix reports a tracked+exposed secret as needing git rm --cached, not sealed', async () => {
+        const dir = tmpRepoWith({ 'config.local.json': '{}' }, '.productbrain/config.local.json\n');
+        const cwd = process.cwd();
+        try {
+            // commit the secret so it is TRACKED despite the gitignore line
+            execSync('git add -f .productbrain/config.local.json', { cwd: dir, env: GIT_FIXTURE_ENV });
+            execSync('git -c user.email=t@t -c user.name=t commit -qm seed', { cwd: dir, env: GIT_FIXTURE_ENV });
+            process.chdir(dir);
+            const res = await resolveFiles({ fix: true, dryRun: false });
+            expect(res.fix.trackedExposed).toContain('config.local.json');
+            expect(res.fix.added).not.toContain('.productbrain/config.local.json');
+            expect(formatFilesPretty(res)).toMatch(/git rm --cached/);
+        }
+        finally {
+            process.chdir(cwd);
+            rmSync(dir, { recursive: true, force: true });
+        }
+    }, 60000);
+    it('--fix reports stillExposed when a nested .productbrain/.gitignore negation overrides the root', async () => {
+        const dir = tmpRepoWith({ 'config.local.json': '{}' }, ''); // empty root .gitignore
+        const cwd = process.cwd();
+        try {
+            // nested negation un-ignores the secret; a root pattern cannot override it (git precedence)
+            writeFileSync(join(dir, '.productbrain', '.gitignore'), '!config.local.json\n');
+            process.chdir(dir);
+            const res = await resolveFiles({ fix: true, dryRun: false });
+            expect(res.fix.stillExposed).toContain('.productbrain/config.local.json');
+            expect(formatFilesPretty(res)).toMatch(/still exposed/);
+        }
+        finally {
+            process.chdir(cwd);
+            rmSync(dir, { recursive: true, force: true });
+        }
+    }, 60000);
+    it('--fix writes the rule for a tracked+exposed secret AND flags git rm --cached (coherent output)', async () => {
+        // realistic bootstrap: the secret is committed BEFORE any .gitignore rule exists
+        const dir = tmpRepoWith({ 'config.local.json': '{}' }, ''); // empty root .gitignore
+        const cwd = process.cwd();
+        try {
+            execSync('git add -f .productbrain/config.local.json', { cwd: dir, env: GIT_FIXTURE_ENV });
+            execSync('git -c user.email=t@t -c user.name=t commit -qm seed', { cwd: dir, env: GIT_FIXTURE_ENV });
+            process.chdir(dir);
+            const res = await resolveFiles({ fix: true, dryRun: false });
+            // the rule IS written — after `git rm --cached` it keeps the secret ignored (Codex: add the rule)
+            expect(res.fix.added).toContain('.productbrain/config.local.json');
+            expect(readFileSync(join(dir, '.gitignore'), 'utf8')).toMatch(/^\.productbrain\/config\.local\.json$/m);
+            // and the untrack step is surfaced — coherently, WITHOUT the old contradictory "will NOT remove"
+            expect(res.fix.trackedExposed).toContain('config.local.json');
+            const pretty = formatFilesPretty(res);
+            expect(pretty).toMatch(/Added to \.gitignore/);
+            expect(pretty).toMatch(/git rm --cached [^\n]*config\.local\.json/);
+            expect(pretty).not.toMatch(/will NOT remove/);
+        }
+        finally {
+            process.chdir(cwd);
+            rmSync(dir, { recursive: true, force: true });
+        }
+    }, 60000);
+    it('--fix does not duplicate a root line on repeat runs, and never prints a false all-clear', async () => {
+        const dir = tmpRepoWith({ 'config.local.json': '{}' }, '');
+        const cwd = process.cwd();
+        try {
+            writeFileSync(join(dir, '.productbrain', '.gitignore'), '!config.local.json\n');
+            process.chdir(dir);
+            await resolveFiles({ fix: true, dryRun: false });
+            const second = await resolveFiles({ fix: true, dryRun: false });
+            // still exposed (nested negation wins), but the root line is appended at most once
+            expect(second.fix.added).not.toContain('.productbrain/config.local.json');
+            expect(second.fix.stillExposed).toContain('.productbrain/config.local.json');
+            const gi = readFileSync(join(dir, '.gitignore'), 'utf8');
+            expect(gi.match(/^\.productbrain\/config\.local\.json$/gm) ?? []).toHaveLength(1);
+            // Codex: no "Nothing to fix — all gitignored" while a path remains exposed
+            const pretty = formatFilesPretty(second);
+            expect(pretty).not.toMatch(/Nothing to fix/);
+            expect(pretty).toMatch(/still exposed/);
+        }
+        finally {
+            process.chdir(cwd);
+            rmSync(dir, { recursive: true, force: true });
+        }
+    }, 60000);
+    it('--fix REPORTS (does not silently pass) an absent path a same-file negation keeps exposed', async () => {
+        // self-contradictory pair: the next preview.json write would be committable → must be surfaced
+        const dir = tmpRepoWith({}, '.productbrain/preview.json\n!.productbrain/preview.json\n');
+        const cwd = process.cwd();
+        try {
+            process.chdir(dir);
+            const res = await resolveFiles({ fix: true, dryRun: false });
+            // the descriptor line is already present, so it isn't re-added; the residual exposure is reported
+            expect(res.fix.added).not.toContain('.productbrain/preview.json');
+            expect(res.fix.stillExposed).toContain('.productbrain/preview.json');
+        }
+        finally {
+            process.chdir(cwd);
+            rmSync(dir, { recursive: true, force: true });
+        }
+    }, 60000);
+    it('--fix uses -r --cached when a tracked exposed entry is a directory', async () => {
+        const dir = mkdtempSync(join(tmpdir(), 'pbcmd-dir-'));
+        const cwd = process.cwd();
+        try {
+            execSync('git init -q', { cwd: dir, env: GIT_FIXTURE_ENV });
+            mkdirSync(join(dir, '.productbrain', 'drafts'), { recursive: true });
+            writeFileSync(join(dir, '.productbrain', 'drafts', 'foo.md'), 'x');
+            execSync('git add -f .productbrain/drafts/foo.md', { cwd: dir, env: GIT_FIXTURE_ENV });
+            execSync('git -c user.email=t@t -c user.name=t commit -qm seed', { cwd: dir, env: GIT_FIXTURE_ENV });
+            process.chdir(dir);
+            const res = await resolveFiles({ fix: true, dryRun: false });
+            expect(res.fix.trackedExposed).toContain('drafts/');
+            expect(formatFilesPretty(res)).toMatch(/git rm -r --cached/);
+        }
+        finally {
+            process.chdir(cwd);
+            rmSync(dir, { recursive: true, force: true });
+        }
+    }, 60000);
+});
+//# sourceMappingURL=files.test.js.map

package/dist/commands/files.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.test.js","sourceRoot":"","sources":["../../src/commands/files.test.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE7D,4FAA4F;AAC5F,4FAA4F;AAC5F,0FAA0F;AAC1F,kFAAkF;AAClF,6FAA6F;AAC7F,4FAA4F;AAC5F,gGAAgG;AAChG,6FAA6F;AAC7F,kFAAkF;AAClF,6FAA6F;AAC7F,uFAAuF;AACvF,MAAM,iBAAiB,GAAG;IACxB,kCAAkC;IAClC,YAAY;IACZ,uBAAuB;IACvB,kBAAkB;IAClB,sBAAsB;IACtB,SAAS;IACT,eAAe;IACf,wBAAwB;IACxB,gBAAgB;IAChB,gBAAgB;IAChB,wBAAwB;IACxB,sBAAsB;IACtB,YAAY;IACZ,kBAAkB;IAClB,gBAAgB;CACjB,CAAC;AACF,MAAM,eAAe,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC9D,KAAK,MAAM,GAAG,IAAI,iBAAiB;IAAE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AACjE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;IAC/C,IAAI,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,KAA6B,EAAE,SAAkB;IACpE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;IAC5D,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,SAAS,KAAK,SAAS;QAAE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClF,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7E,+DAA+D;YAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,mCAAmC,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;QACvF,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;gBACxB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC9E,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,CAAC,GAAG,CAAC,GAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YACpE,8CAA8C;YAC9C,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC3F,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,MAAM,CAAC,KAAK,CAAC,GAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YACtE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,4DAA4D;YACrG,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,MAAM,CAAC,GAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YAC3E,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa;QACzD,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,QAAQ,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;YAC/D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,GAAG,CAAC,GAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG,aAAa,CAAC,CAAC;YACxD,MAAM,CAAC,GAAG,CAAC,GAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC3E,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,mCAAmC,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,gEAAgE;YAChE,QAAQ,CAAC,4CAA4C,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;YAC3F,QAAQ,CAAC,sDAAsD,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;YACrG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,GAAG,CAAC,GAAI,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YAC/D,MAAM,CAAC,GAAG,CAAC,GAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YACxE,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC5D,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;QAC7G,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;QACpF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,4FAA4F;YAC5F,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,sBAAsB,CAAC,CAAC;YAChF,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,GAAG,CAAC,GAAI,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YAC3E,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1D,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;QAC9G,iFAAiF;QACjF,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;QACpF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,QAAQ,CAAC,4CAA4C,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;YAC3F,QAAQ,CAAC,sDAAsD,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;YACrG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,kGAAkG;YAClG,MAAM,CAAC,GAAG,CAAC,GAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YACpE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC;YACxG,iGAAiG;YACjG,MAAM,CAAC,GAAG,CAAC,GAAI,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC;YACpE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAChD,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,sBAAsB,CAAC,CAAC;YAChF,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,mFAAmF;YACnF,MAAM,CAAC,MAAM,CAAC,GAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YAC3E,MAAM,CAAC,MAAM,CAAC,GAAI,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YAC9E,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,yCAAyC,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAClF,2EAA2E;YAC3E,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,+FAA+F;QAC/F,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,EAAE,2DAA2D,CAAC,CAAC;QACzF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,kGAAkG;YAClG,MAAM,CAAC,GAAG,CAAC,GAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;YACnE,MAAM,CAAC,GAAG,CAAC,GAAI,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACxE,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,QAAQ,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACnE,QAAQ,CAAC,wCAAwC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;YACvF,QAAQ,CAAC,sDAAsD,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;YACrG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,GAAG,CAAC,GAAI,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC,CAAC,CAAC"}

package/dist/commands/handshakeCursorSkillCleanup.d.ts

@@ -0,0 +1,36 @@
+/** Nested Cursor-skill (.cursor/skills/<name>/SKILL.md) leftover-file reporting — offset
+ *  extraction out of commands/handshake.ts (STD-2/DEC-1504 shrink-only offset). Called by
+ *  handshake.ts, which owns the flat <dir>/<name>.<ext> layout's equivalent scan.
+ *
+ *  REPORT-ONLY (coordinator ruling, PR #912 round 10): a deletion mechanism over a user's
+ *  filesystem — symlinks, case collisions, empty-DB states, tamper preservation — is defensive
+ *  machinery whose edge cases never end (nine review rounds on exactly this). `pb handshake`
+ *  never unlinks, renames, or recreates a leftover file here; it only lists what looks stale so
+ *  the human can remove it. Because nothing is written or deleted, the realpath containment and
+ *  tamper classification that guarded those unlink calls have no write left to gate and are gone
+ *  with them — reads for a report are accepted as fine.
+ */
+export interface LeftoverFile {
+    path: string;
+    reason: string;
+}
+/** Round 12/13: cap on a reported leftover-file list — unbounded read/report I/O otherwise.
+ *  Owned here, not in handshake.ts (which imports it), to avoid re-opening the handshake.ts ↔
+ *  this-module import cycle a prior round already broke. */
+export declare const LEFTOVER_FILES_MAX = 100;
+/**
+ * Lists marker-bearing .cursor/skills/<name>/SKILL.md files that don't match a canonical,
+ * currently-projected Cursor skill — either because no such skill exists at all (orphan) or
+ * because the directory's own name isn't the canonical RAW name (a stale case/punctuation
+ * variant; the write loop emits .cursor/skills/${skill.name}/SKILL.md using the raw name, so a
+ * directory's normalized stem matching a canonical skill is not enough — round 8 of this chain).
+ *
+ * Round 12 (Codex P2): stops after collecting `maxResults + 1` matches rather than enumerating
+ * and reading every file in a large tree; `truncated` says more exist beyond the returned,
+ * capped-at-`maxResults` list.
+ */
+export declare function findLeftoverCursorSkills(cwd: string, canonicalSkillNames: string[], maxResults?: number): {
+    files: LeftoverFile[];
+    truncated: boolean;
+};
+//# sourceMappingURL=handshakeCursorSkillCleanup.d.ts.map

package/dist/commands/handshakeCursorSkillCleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshakeCursorSkillCleanup.d.ts","sourceRoot":"","sources":["../../src/commands/handshakeCursorSkillCleanup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;4DAE4D;AAC5D,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,mBAAmB,EAAE,MAAM,EAAE,EAC7B,UAAU,GAAE,MAA2B,GACtC;IAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAoE/C"}

package/dist/commands/handshakeCursorSkillCleanup.js

@@ -0,0 +1,110 @@
+/** Nested Cursor-skill (.cursor/skills/<name>/SKILL.md) leftover-file reporting — offset
+ *  extraction out of commands/handshake.ts (STD-2/DEC-1504 shrink-only offset). Called by
+ *  handshake.ts, which owns the flat <dir>/<name>.<ext> layout's equivalent scan.
+ *
+ *  REPORT-ONLY (coordinator ruling, PR #912 round 10): a deletion mechanism over a user's
+ *  filesystem — symlinks, case collisions, empty-DB states, tamper preservation — is defensive
+ *  machinery whose edge cases never end (nine review rounds on exactly this). `pb handshake`
+ *  never unlinks, renames, or recreates a leftover file here; it only lists what looks stale so
+ *  the human can remove it. Because nothing is written or deleted, the realpath containment and
+ *  tamper classification that guarded those unlink calls have no write left to gate and are gone
+ *  with them — reads for a report are accepted as fine.
+ */
+import { existsSync, readdirSync, readFileSync, lstatSync } from 'fs';
+import { join } from 'path';
+import { MARKER } from '../generators/adapters.js';
+import { normalizeMaterializedFilename } from '../lib/normalizeMaterializedFilename.js';
+/** Round 12/13: cap on a reported leftover-file list — unbounded read/report I/O otherwise.
+ *  Owned here, not in handshake.ts (which imports it), to avoid re-opening the handshake.ts ↔
+ *  this-module import cycle a prior round already broke. */
+export const LEFTOVER_FILES_MAX = 100;
+/**
+ * Lists marker-bearing .cursor/skills/<name>/SKILL.md files that don't match a canonical,
+ * currently-projected Cursor skill — either because no such skill exists at all (orphan) or
+ * because the directory's own name isn't the canonical RAW name (a stale case/punctuation
+ * variant; the write loop emits .cursor/skills/${skill.name}/SKILL.md using the raw name, so a
+ * directory's normalized stem matching a canonical skill is not enough — round 8 of this chain).
+ *
+ * Round 12 (Codex P2): stops after collecting `maxResults + 1` matches rather than enumerating
+ * and reading every file in a large tree; `truncated` says more exist beyond the returned,
+ * capped-at-`maxResults` list.
+ */
+export function findLeftoverCursorSkills(cwd, canonicalSkillNames, maxResults = LEFTOVER_FILES_MAX) {
+    const leftovers = [];
+    const cursorSkillsDir = join(cwd, '.cursor', 'skills');
+    if (!existsSync(cursorSkillsDir))
+        return { files: leftovers, truncated: false };
+    const rawNamesByStem = new Map();
+    for (const rawName of canonicalSkillNames) {
+        const stem = normalizeMaterializedFilename(rawName);
+        const set = rawNamesByStem.get(stem) ?? new Set();
+        set.add(rawName);
+        rawNamesByStem.set(stem, set);
+    }
+    let skillDirNames = [];
+    try {
+        skillDirNames = readdirSync(cursorSkillsDir);
+    }
+    catch {
+        return { files: leftovers, truncated: false };
+    }
+    let truncated = false;
+    for (const skillDirName of skillDirNames) {
+        const skillMdPath = join(cursorSkillsDir, skillDirName, 'SKILL.md');
+        let content;
+        try {
+            content = readFileSync(skillMdPath, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        if (!content.includes(MARKER))
+            continue; // user-owned — never reported
+        const normalizedStem = normalizeMaterializedFilename(skillDirName);
+        const rawNames = rawNamesByStem.get(normalizedStem);
+        let entry = null;
+        if (!rawNames) {
+            entry = { path: skillMdPath, reason: 'orphan — no canonical Cursor skill matches this name' };
+        }
+        else if (!rawNames.has(skillDirName)) {
+            // Round 13 (Codex P2): on a case-insensitive filesystem, a canonical raw name differing
+            // only by case/punctuation from this directory's on-disk name resolves to THIS SAME entry
+            // — the exact-string compare above can't see that. Round 14 tried "never exempt a
+            // symlink," which overcorrected: the SOLE on-disk entry can itself legitimately be a
+            // symlink that both case-spellings resolve through (one real entry, addressed two ways).
+            // Round 15 (Codex P2): compare DIRECTORY-ENTRY identity via lstatSync (never follows the
+            // final component) on BOTH the discovered and each canonical path. Same dev+ino → one
+            // physical entry addressed two ways (live alias, not leftover), even if that entry is
+            // itself a symlink. Different dev+ino → two distinct physical entries — including a
+            // symlink named like the stale variant that merely points AT the canonical directory,
+            // which lstat (unlike stat) reports as its own, different inode.
+            const discoveredDirPath = join(cursorSkillsDir, skillDirName);
+            const isLiveAlias = [...rawNames].some((rawName) => {
+                try {
+                    const here = lstatSync(discoveredDirPath);
+                    const candidate = lstatSync(join(cursorSkillsDir, rawName));
+                    return here.dev === candidate.dev && here.ino === candidate.ino;
+                }
+                catch {
+                    return false;
+                }
+            });
+            if (!isLiveAlias) {
+                entry = {
+                    path: skillMdPath,
+                    reason: `stale case/punctuation variant — canonical name is "${[...rawNames].join('" / "')}"`,
+                };
+            }
+        }
+        if (!entry)
+            continue;
+        leftovers.push(entry);
+        if (leftovers.length > maxResults) {
+            truncated = true;
+            leftovers.pop();
+            break;
+        }
+    }
+    return { files: leftovers, truncated };
+}
+//# sourceMappingURL=handshakeCursorSkillCleanup.js.map

package/dist/commands/handshakeCursorSkillCleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshakeCursorSkillCleanup.js","sourceRoot":"","sources":["../../src/commands/handshakeCursorSkillCleanup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACnD,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAOxF;;4DAE4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAW,EACX,mBAA6B,EAC7B,aAAqB,kBAAkB;IAEvC,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEhF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IACtD,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAC1D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjB,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,aAAa,GAAa,EAAE,CAAC;IACjC,IAAI,CAAC;QAAC,aAAa,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;IAE9G,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACpE,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YAAC,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QACxE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS,CAAC,8BAA8B;QAEvE,MAAM,cAAc,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,KAAK,GAAwB,IAAI,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;QAChG,CAAC;aAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,wFAAwF;YACxF,0FAA0F;YAC1F,kFAAkF;YAClF,qFAAqF;YACrF,yFAAyF;YACzF,yFAAyF;YACzF,sFAAsF;YACtF,sFAAsF;YACtF,oFAAoF;YACpF,sFAAsF;YACtF,iEAAiE;YACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;YAC9D,MAAM,WAAW,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBACjD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;oBAC1C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;oBAC5D,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,CAAC;gBAClE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,KAAK,GAAG;oBACN,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,uDAAuD,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG;iBAC9F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,SAAS,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAClC,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC"}

package/dist/commands/handshakeDriftClassification.d.ts

@@ -0,0 +1,33 @@
+/** Three-bucket drift classification (WP-421 S3, doneWhen #17) — offset extraction out of
+ *  commands/handshake.ts (STD-2/DEC-1504 shrink-only offset).
+ *
+ *  PR #912 round 11 (Codex P2): the ONLY remaining consumer is handshake.ts's own
+ *  flat-projection tamper-classification write loop (the WP-421 S3 adopt-or-revert flow, which
+ *  still gates a real WRITE). `handshakeCursorSkillCleanup.ts`'s nested Cursor-skill scan was
+ *  made report-only in round 10 (coordinator ruling on PR #912) — it neither imports this module
+ *  nor unlinks anything, so it needs no tamper classification; there is nothing left there for
+ *  this classifier to protect.
+ *
+ *  Buckets: 'pb-managed-clean' (MARKER, hash trailer matches) / 'pb-managed-tampered' (MARKER,
+ *  trailer mismatches) / 'user-owned' (no MARKER). Mirrors runHandshake's own trailer
+ *  normalization — keep in sync if that normalization ever changes.
+ */
+export type DriftBucket = 'pb-managed-clean' | 'pb-managed-tampered' | 'user-owned';
+/**
+ * Classify a single projection-target file into one of the three drift buckets.
+ *
+ * Returns `null` when `filePath` does not exist (first-run / unprojected) — the
+ * write loop treats that as "would-write" and the file is not part of any bucket.
+ *
+ * @param filePath  Absolute path to the projection file on disk.
+ * @returns         { bucket, expectedHash, actualHash } when the file exists.
+ *                  `expectedHash`/`actualHash` are populated only for the
+ *                  tampered bucket so the headless refusal payload can include
+ *                  them verbatim. For clean / user-owned, both are `''`.
+ */
+export declare function classifyDriftBucket(filePath: string): {
+    bucket: DriftBucket;
+    expectedHash: string;
+    actualHash: string;
+} | null;
+//# sourceMappingURL=handshakeDriftClassification.d.ts.map

package/dist/commands/handshakeDriftClassification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshakeDriftClassification.d.ts","sourceRoot":"","sources":["../../src/commands/handshakeDriftClassification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,MAAM,MAAM,WAAW,GAAG,kBAAkB,GAAG,qBAAqB,GAAG,YAAY,CAAC;AAMpF;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG;IACrD,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,IAAI,CA+BP"}

package/dist/commands/handshakeDriftClassification.js

@@ -0,0 +1,62 @@
+/** Three-bucket drift classification (WP-421 S3, doneWhen #17) — offset extraction out of
+ *  commands/handshake.ts (STD-2/DEC-1504 shrink-only offset).
+ *
+ *  PR #912 round 11 (Codex P2): the ONLY remaining consumer is handshake.ts's own
+ *  flat-projection tamper-classification write loop (the WP-421 S3 adopt-or-revert flow, which
+ *  still gates a real WRITE). `handshakeCursorSkillCleanup.ts`'s nested Cursor-skill scan was
+ *  made report-only in round 10 (coordinator ruling on PR #912) — it neither imports this module
+ *  nor unlinks anything, so it needs no tamper classification; there is nothing left there for
+ *  this classifier to protect.
+ *
+ *  Buckets: 'pb-managed-clean' (MARKER, hash trailer matches) / 'pb-managed-tampered' (MARKER,
+ *  trailer mismatches) / 'user-owned' (no MARKER). Mirrors runHandshake's own trailer
+ *  normalization — keep in sync if that normalization ever changes.
+ */
+import { existsSync, readFileSync } from 'fs';
+import { createHash } from 'crypto';
+import { MARKER } from '../generators/adapters.js';
+const DRIFT_HASH_TRAILER_REGEX = /^<!--\s*pb-hash:\s*sha256:([0-9a-f]+)\s*-->\s*$/m;
+const DRIFT_HASH_TRAILER_STRIP = /^<!--\s*pb-hash:.*-->\s*$/gm;
+const DRIFT_TIMESTAMP_STRIP = /^<!--\s*pb-generated-at:.*-->\s*$/gm;
+/**
+ * Classify a single projection-target file into one of the three drift buckets.
+ *
+ * Returns `null` when `filePath` does not exist (first-run / unprojected) — the
+ * write loop treats that as "would-write" and the file is not part of any bucket.
+ *
+ * @param filePath  Absolute path to the projection file on disk.
+ * @returns         { bucket, expectedHash, actualHash } when the file exists.
+ *                  `expectedHash`/`actualHash` are populated only for the
+ *                  tampered bucket so the headless refusal payload can include
+ *                  them verbatim. For clean / user-owned, both are `''`.
+ */
+export function classifyDriftBucket(filePath) {
+    if (!existsSync(filePath))
+        return null;
+    const content = readFileSync(filePath, 'utf8');
+    // No auto-gen MARKER → user-owned. Never touch.
+    if (!content.includes(MARKER)) {
+        return { bucket: 'user-owned', expectedHash: '', actualHash: '' };
+    }
+    // Marker present but no hash trailer → legacy / pre-S0c projection: treat as
+    // clean (the hash trailer was added in WP-345 S0c). The user-owned-vs-clean
+    // semantic falls back to existing shouldWriteAdapter behavior.
+    const trailerMatch = content.match(DRIFT_HASH_TRAILER_REGEX);
+    if (!trailerMatch) {
+        return { bucket: 'pb-managed-clean', expectedHash: '', actualHash: '' };
+    }
+    const expectedHash = `sha256:${trailerMatch[1]}`;
+    // Recompute the actual hash from the body (strip trailer + timestamp, LF, trim).
+    const normalized = content
+        .replace(DRIFT_HASH_TRAILER_STRIP, '')
+        .replace(DRIFT_TIMESTAMP_STRIP, '')
+        .replace(/\r\n/g, '\n')
+        .replace(/\r/g, '\n')
+        .trimEnd();
+    const actualHash = `sha256:${createHash('sha256').update(normalized, 'utf8').digest('hex')}`;
+    if (actualHash === expectedHash) {
+        return { bucket: 'pb-managed-clean', expectedHash, actualHash };
+    }
+    return { bucket: 'pb-managed-tampered', expectedHash, actualHash };
+}
+//# sourceMappingURL=handshakeDriftClassification.js.map

package/dist/commands/handshakeDriftClassification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshakeDriftClassification.js","sourceRoot":"","sources":["../../src/commands/handshakeDriftClassification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAInD,MAAM,wBAAwB,GAAG,kDAAkD,CAAC;AACpF,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAC/D,MAAM,qBAAqB,GAAG,qCAAqC,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAKlD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE/C,gDAAgD;IAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACpE,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjD,iFAAiF;IACjF,MAAM,UAAU,GAAG,OAAO;SACvB,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;SACrC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC;SAClC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;SACtB,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;SACpB,OAAO,EAAE,CAAC;IACb,MAAM,UAAU,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAE7F,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACrE,CAAC"}

package/dist/commands/history.d.ts

@@ -0,0 +1,32 @@
+/**
+ * pb history — entryVersions read-back: one line per published version (version, when, who,
+ * acting role, change note) plus an "Accepted by <person> (<role>)" line. Closes the gap where a
+ * post-accept edit published an invisible version row with no CLI/MCP verb to see it. Reuses the
+ * EXISTING `chain.listEntryVersions` gateway route (already registered, `agentKnowledge/entries.ts`'s
+ * `listEntryVersions`) — no new route for this slice.
+ */
+interface EntryVersionRow {
+    version: number | undefined;
+    name: string;
+    changeNote: string | null;
+    publishedAt: number;
+    versionStatus: string;
+    displayName: string;
+    authorRole: string | null;
+    authorRoleArchived: boolean;
+}
+interface ListEntryVersionsResult {
+    acceptedBy: string | null;
+    acceptedByRole: string | null;
+    acceptedByRoleArchived: boolean;
+    /** TASK-915 (DEC-1973): the kernel's words when the accept was made covering an empty role, else null. */
+    acceptedCovering: string | null;
+    truncated: boolean;
+    versions: EntryVersionRow[];
+}
+export declare function runHistory(options: {
+    entryId: string;
+}): Promise<void>;
+export declare function formatHistory(entryId: string, result: ListEntryVersionsResult): string;
+export {};
+//# sourceMappingURL=history.d.ts.map

package/dist/commands/history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"history.d.ts","sourceRoot":"","sources":["../../src/commands/history.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,UAAU,uBAAuB;IAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sBAAsB,EAAE,OAAO,CAAC;IAChC,0GAA0G;IAC1G,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB5E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAkBtF"}