@provos/ironcurtain 0.6.0 → 0.7.0

package/dist/daemon/ironcurtain-daemon.js

@@ -0,0 +1,548 @@
+/**
+ * IronCurtainDaemon -- Unified daemon managing both Signal-initiated
+ * interactive sessions and cron-scheduled headless sessions.
+ *
+ * Lifecycle:
+ *   1. start() -- loads jobs, starts Signal (if configured), schedules jobs
+ *   2. Runs indefinitely, processing Signal messages and cron triggers
+ *   3. shutdown() -- unschedules all jobs, ends all sessions, disconnects
+ *
+ * Both Signal and cron sessions are managed through a shared SessionManager
+ * instance. This enables unified escalation routing: `approve #N` from
+ * Signal works for both Signal-initiated and cron-initiated sessions.
+ */
+import { mkdirSync, readFileSync, existsSync } from 'node:fs';
+import { syncGitRepo } from '../cron/git-sync.js';
+import { resolve } from 'node:path';
+import { createSession } from '../session/index.js';
+import { loadConfig } from '../config/index.js';
+import { loadUserConfig } from '../config/user-config.js';
+import { getJobWorkspaceDir, getJobGeneratedDir, getJobDir } from '../config/paths.js';
+import { SessionManager } from '../session/session-manager.js';
+import { HeadlessTransport } from '../cron/headless-transport.js';
+import { buildCronSystemPromptAugmentation } from '../session/prompts.js';
+import { createCronScheduler } from '../cron/cron-scheduler.js';
+import { loadAllJobs, loadJob, saveJob, deleteJob, saveRunRecord, loadRecentRuns } from '../cron/job-store.js';
+import { compileTaskPolicy } from '../cron/compile-task-policy.js';
+import { CRON_BUDGET_DEFAULTS } from '../cron/types.js';
+import { BudgetExhaustedError } from '../session/errors.js';
+import { validateWorkspacePath } from '../session/workspace-validation.js';
+import * as logger from '../logger.js';
+import { getDaemonLogPath } from '../config/paths.js';
+import { ControlSocketServer } from './control-socket.js';
+/**
+ * Builds an IronCurtainConfig patched for cron session budget defaults.
+ */
+function buildCronSessionConfig(globalConfig, job) {
+    const cronBudget = {
+        ...CRON_BUDGET_DEFAULTS,
+        ...(job.budgetOverrides ?? {}),
+    };
+    const patchedUserConfig = {
+        ...globalConfig.userConfig,
+        resourceBudget: {
+            ...globalConfig.userConfig.resourceBudget,
+            ...cronBudget,
+        },
+    };
+    return {
+        ...globalConfig,
+        userConfig: patchedUserConfig,
+    };
+}
+export class IronCurtainDaemon {
+    mode;
+    noSignal;
+    sessionManager = new SessionManager();
+    scheduler;
+    /** Time the daemon was started (for uptime calculation). */
+    startTime = null;
+    /** Tracks which jobs are currently running (jobId -> session label). */
+    activeJobRuns = new Map();
+    /** Control socket server for CLI communication. */
+    controlSocket = null;
+    /** Signal daemon instance (null if Signal not configured). */
+    signalDaemon = null;
+    /** Resolve to exit the daemon. */
+    exitResolve = null;
+    constructor(options) {
+        this.mode = options.mode;
+        this.noSignal = options.noSignal ?? false;
+        this.scheduler = createCronScheduler();
+    }
+    /**
+     * Starts the daemon. Loads all enabled jobs, schedules them,
+     * optionally starts the Signal transport.
+     */
+    async start() {
+        this.startTime = new Date();
+        // Set up file-based logger (redirects console.* to log file)
+        logger.setup({ logFilePath: getDaemonLogPath('daemon') });
+        // Start control socket for CLI communication
+        await this.startControlSocket();
+        // Load and schedule all enabled jobs
+        const jobs = loadAllJobs();
+        const enabledJobs = jobs.filter((j) => j.enabled);
+        logger.info(`[Daemon] Loaded ${jobs.length} job(s), ${enabledJobs.length} enabled`);
+        for (const job of enabledJobs) {
+            try {
+                this.scheduler.schedule(job, (j) => this.onJobTrigger(j));
+                const nextRun = this.scheduler.getNextRun(job.id);
+                logger.info(`[Daemon] Scheduled job ${job.id}: ${job.schedule} (next: ${nextRun?.toISOString() ?? 'unknown'})`);
+            }
+            catch (err) {
+                logger.warn(`[Daemon] Failed to schedule job ${job.id}: ${String(err)}`);
+            }
+        }
+        // Start Signal daemon if configured and not disabled
+        if (!this.noSignal) {
+            try {
+                await this.startSignalDaemon();
+            }
+            catch (err) {
+                logger.warn(`[Daemon] Signal transport not available: ${err instanceof Error ? err.message : String(err)}`);
+                logger.info('[Daemon] Continuing in cron-only mode');
+            }
+        }
+        process.stderr.write('IronCurtain daemon started.\n');
+        if (this.controlSocket) {
+            process.stderr.write('  Control socket: listening\n');
+        }
+        if (enabledJobs.length > 0) {
+            process.stderr.write(`  Scheduled jobs: ${enabledJobs.length}\n`);
+        }
+        if (this.signalDaemon) {
+            process.stderr.write('  Signal transport: connected\n');
+        }
+        // Block until shutdown
+        await new Promise((resolve) => {
+            this.exitResolve = resolve;
+        });
+    }
+    /** Graceful shutdown. */
+    async shutdown() {
+        logger.info('[Daemon] Shutting down...');
+        // Stop control socket first (reject new CLI commands)
+        if (this.controlSocket) {
+            try {
+                await this.controlSocket.stop();
+            }
+            catch (err) {
+                logger.warn(`[Daemon] Error stopping control socket: ${String(err)}`);
+            }
+            this.controlSocket = null;
+        }
+        // Unschedule all jobs
+        this.scheduler.unscheduleAll();
+        // Shutdown Signal daemon first (ends Signal sessions via shared SessionManager)
+        if (this.signalDaemon) {
+            try {
+                await this.signalDaemon.shutdown();
+            }
+            catch (err) {
+                logger.warn(`[Daemon] Error shutting down Signal: ${String(err)}`);
+            }
+        }
+        // End remaining sessions (cron sessions and any Signal stragglers)
+        const remaining = this.sessionManager.all();
+        await Promise.allSettled(remaining.map(async (s) => {
+            try {
+                await this.sessionManager.end(s.label);
+            }
+            catch (err) {
+                logger.warn(`[Daemon] Error ending session #${s.label}: ${String(err)}`);
+            }
+        }));
+        // Teardown logger last (restores console.* to original behavior)
+        logger.teardown();
+        this.exitResolve?.();
+    }
+    // -----------------------------------------------------------------------
+    // Job management (called by CLI subcommands)
+    // -----------------------------------------------------------------------
+    /**
+     * Adds a new job. Runs the full policy compilation pipeline
+     * before confirming. Schedules the job if enabled.
+     */
+    async addJob(job) {
+        // Validate custom workspace before proceeding
+        if (job.workspace) {
+            const globalConfig = loadConfig();
+            validateWorkspacePath(job.workspace, globalConfig.protectedPaths);
+        }
+        // Ensure workspace exists
+        const workspace = job.workspace ?? getJobWorkspaceDir(job.id);
+        mkdirSync(workspace, { recursive: true });
+        // Clone git repo if specified
+        if (job.gitRepo) {
+            logger.info(`[Daemon] Cloning repo for job ${job.id}...`);
+            syncGitRepo(job.gitRepo, workspace);
+            logger.info(`[Daemon] Repo cloned for job ${job.id}`);
+        }
+        // Compile per-job policy
+        logger.info(`[Daemon] Compiling task policy for job ${job.id}...`);
+        await compileTaskPolicy(job.taskConstitution, getJobDir(job.id));
+        // Save job definition
+        await saveJob(job);
+        // Schedule if enabled
+        if (job.enabled) {
+            this.scheduler.schedule(job, (j) => this.onJobTrigger(j));
+            const nextRun = this.scheduler.getNextRun(job.id);
+            logger.info(`[Daemon] Job ${job.id} scheduled. Next run: ${nextRun?.toISOString() ?? 'unknown'}`);
+        }
+    }
+    /** Removes a job. Stops any active run, unschedules, deletes files. */
+    async removeJob(jobId) {
+        // Stop active run if any
+        const activeLabel = this.activeJobRuns.get(jobId);
+        if (activeLabel !== undefined) {
+            await this.sessionManager.end(activeLabel);
+            this.activeJobRuns.delete(jobId);
+        }
+        this.scheduler.unschedule(jobId);
+        deleteJob(jobId);
+        logger.info(`[Daemon] Removed job ${jobId}`);
+    }
+    /** Enables a previously disabled job. Schedules it. */
+    async enableJob(jobId) {
+        const job = loadJob(jobId);
+        if (!job)
+            throw new Error(`Job not found: ${jobId}`);
+        const updated = { ...job, enabled: true };
+        await saveJob(updated);
+        this.scheduler.schedule(updated, (j) => this.onJobTrigger(j));
+        logger.info(`[Daemon] Enabled job ${jobId}`);
+    }
+    /** Disables a job. Unschedules it but preserves files. */
+    async disableJob(jobId) {
+        const job = loadJob(jobId);
+        if (!job)
+            throw new Error(`Job not found: ${jobId}`);
+        const updated = { ...job, enabled: false };
+        await saveJob(updated);
+        this.scheduler.unschedule(jobId);
+        logger.info(`[Daemon] Disabled job ${jobId}`);
+    }
+    /** Reloads a job definition from disk and reschedules it. */
+    // eslint-disable-next-line @typescript-eslint/require-await -- must be async to satisfy ControlRequestHandler interface
+    async reloadJob(jobId) {
+        const job = loadJob(jobId);
+        if (!job)
+            throw new Error(`Job not found: ${jobId}`);
+        this.scheduler.unschedule(jobId);
+        if (job.enabled) {
+            this.scheduler.schedule(job, (j) => this.onJobTrigger(j));
+            const nextRun = this.scheduler.getNextRun(jobId);
+            logger.info(`[Daemon] Reloaded job ${jobId}: rescheduled (next: ${nextRun?.toISOString() ?? 'unknown'})`);
+        }
+        else {
+            logger.info(`[Daemon] Reloaded job ${jobId}: disabled, not scheduled`);
+        }
+    }
+    /** Re-runs policy compilation for an existing job. */
+    async recompileJob(jobId) {
+        const job = loadJob(jobId);
+        if (!job)
+            throw new Error(`Job not found: ${jobId}`);
+        await compileTaskPolicy(job.taskConstitution, getJobDir(jobId));
+        logger.info(`[Daemon] Recompiled policy for job ${jobId}`);
+    }
+    /**
+     * Manually triggers a job run (for testing).
+     * Does not affect the cron schedule.
+     */
+    async runJobNow(jobId) {
+        const job = loadJob(jobId);
+        if (!job)
+            throw new Error(`Job not found: ${jobId}`);
+        return this.executeJob(job);
+    }
+    /** Lists all jobs with their schedules and last run status. */
+    listJobs() {
+        const jobs = loadAllJobs();
+        return jobs.map((job) => ({
+            job,
+            nextRun: this.scheduler.getNextRun(job.id),
+            lastRun: loadRecentRuns(job.id, 1)[0],
+            isRunning: this.activeJobRuns.has(job.id),
+        }));
+    }
+    /** Returns a status snapshot for the control socket. */
+    getStatus() {
+        const jobs = loadAllJobs();
+        const enabledJobs = jobs.filter((j) => j.enabled);
+        // Find the earliest next fire time across all scheduled jobs
+        let nextFireTime = null;
+        for (const job of enabledJobs) {
+            const nextRun = this.scheduler.getNextRun(job.id);
+            if (nextRun && (nextFireTime === null || nextRun < nextFireTime)) {
+                nextFireTime = nextRun;
+            }
+        }
+        const uptimeSeconds = this.startTime ? (Date.now() - this.startTime.getTime()) / 1000 : 0;
+        return {
+            uptimeSeconds,
+            jobs: {
+                total: jobs.length,
+                enabled: enabledJobs.length,
+                running: this.activeJobRuns.size,
+            },
+            signalConnected: this.signalDaemon !== null,
+            nextFireTime,
+        };
+    }
+    // -----------------------------------------------------------------------
+    // Job execution
+    // -----------------------------------------------------------------------
+    /**
+     * Called when a scheduled job fires.
+     * Checks for overlap, creates a session, and runs the job.
+     */
+    async onJobTrigger(job) {
+        // Check overlap
+        if (this.activeJobRuns.has(job.id)) {
+            const msg = `[Daemon] Skipping job ${job.id}: previous run still active (session #${this.activeJobRuns.get(job.id)})`;
+            logger.warn(msg);
+            this.signalDaemon
+                ?.sendSignalMessage(`Skipped job "${job.name}": previous run still in progress.`)
+                .catch(() => { });
+            return;
+        }
+        try {
+            await this.executeJob(job);
+        }
+        catch (err) {
+            logger.warn(`[Daemon] Job ${job.id} failed: ${String(err)}`);
+        }
+    }
+    /**
+     * Executes a job: creates a session with the job's workspace and
+     * per-job policy, runs it to completion, and records the outcome.
+     */
+    async executeJob(job) {
+        const startedAt = new Date().toISOString();
+        const workspace = job.workspace ?? getJobWorkspaceDir(job.id);
+        const globalConfig = loadConfig();
+        // Validate custom workspace paths against sandbox containment rules.
+        // Default job workspace dirs are safe (under ~/.ironcurtain/jobs/), but
+        // user-provided workspace fields in job.json could be arbitrary paths.
+        if (job.workspace) {
+            try {
+                validateWorkspacePath(job.workspace, globalConfig.protectedPaths);
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                logger.warn(`[Daemon] Job ${job.id} has invalid workspace: ${message}`);
+                const record = {
+                    startedAt,
+                    completedAt: new Date().toISOString(),
+                    outcome: { kind: 'error', message: `Invalid workspace: ${message}` },
+                    budget: { totalTokens: 0, stepCount: 0, elapsedSeconds: 0, estimatedCostUsd: 0 },
+                    summary: null,
+                    escalationsEncountered: 0,
+                    escalationsApproved: 0,
+                    discardedChanges: null,
+                };
+                saveRunRecord(job.id, record);
+                return record;
+            }
+        }
+        // Sync git repo if configured
+        let discardedChanges = null;
+        if (job.gitRepo) {
+            logger.info(`[Daemon] Syncing repo for job ${job.id}...`);
+            discardedChanges = syncGitRepo(job.gitRepo, workspace);
+            if (discardedChanges) {
+                logger.info(`[Daemon] Discarded local changes in job ${job.id}:\n${discardedChanges}`);
+            }
+            logger.info(`[Daemon] Repo synced for job ${job.id}`);
+        }
+        const patchedConfig = buildCronSessionConfig(globalConfig, job);
+        const jobGeneratedDir = getJobGeneratedDir(job.id);
+        // Build system prompt augmentation
+        const augmentation = buildCronSystemPromptAugmentation({
+            taskDescription: job.taskDescription,
+            workspacePath: workspace,
+        });
+        // Create the headless transport
+        const transport = new HeadlessTransport({ taskMessage: job.taskDescription });
+        // Track escalation counts for this run
+        let escalationsEncountered = 0;
+        let escalationsApproved = 0;
+        // Create the session with per-job policy and escalation handler.
+        // Auto-approver is disabled: cron sessions have no interactive user
+        // context, so intent-matching against a user message is meaningless.
+        const session = await createSession({
+            mode: this.mode,
+            config: patchedConfig,
+            workspacePath: workspace,
+            policyDir: jobGeneratedDir,
+            systemPromptAugmentation: augmentation,
+            disableAutoApprove: true,
+            onEscalation: (request) => {
+                escalationsEncountered++;
+                this.handleCronEscalation(request, job);
+            },
+            onEscalationResolved: (_id, decision) => {
+                if (decision === 'approved')
+                    escalationsApproved++;
+                const label = this.activeJobRuns.get(job.id);
+                if (label !== undefined) {
+                    this.sessionManager.clearPendingEscalation(label);
+                }
+            },
+            onEscalationExpired: () => {
+                const label = this.activeJobRuns.get(job.id);
+                if (label !== undefined) {
+                    this.sessionManager.clearPendingEscalation(label);
+                }
+            },
+        });
+        // Register in session manager
+        const source = { kind: 'cron', jobId: job.id, jobName: job.name };
+        const label = this.sessionManager.register(session, transport, source);
+        this.activeJobRuns.set(job.id, label);
+        logger.info(`[Daemon] Started job ${job.id} as session #${label}`);
+        let outcome;
+        try {
+            await transport.run(session);
+            outcome = { kind: 'success' };
+        }
+        catch (err) {
+            if (err instanceof BudgetExhaustedError) {
+                outcome = { kind: 'budget_exhausted', dimension: err.dimension };
+            }
+            else {
+                outcome = { kind: 'error', message: err instanceof Error ? err.message : String(err) };
+            }
+        }
+        // Build run record
+        const completedAt = new Date().toISOString();
+        const budgetStatus = session.getBudgetStatus();
+        const summary = this.readLastRunSummary(workspace);
+        const record = {
+            startedAt,
+            completedAt,
+            outcome,
+            budget: {
+                totalTokens: budgetStatus.totalTokens,
+                stepCount: budgetStatus.stepCount,
+                elapsedSeconds: budgetStatus.elapsedSeconds,
+                estimatedCostUsd: budgetStatus.estimatedCostUsd,
+            },
+            summary,
+            escalationsEncountered,
+            escalationsApproved,
+            discardedChanges,
+        };
+        // Save run record
+        saveRunRecord(job.id, record);
+        // Notify via Signal if configured
+        if (job.notifyOnCompletion && this.signalDaemon) {
+            const outcomeStr = outcome.kind === 'success'
+                ? 'Completed'
+                : outcome.kind === 'budget_exhausted'
+                    ? `Budget exhausted: ${outcome.dimension}`
+                    : `Error: ${outcome.message}`;
+            const notify = `[cron: ${job.name}] ${outcomeStr} (${budgetStatus.elapsedSeconds.toFixed(0)}s, $${budgetStatus.estimatedCostUsd.toFixed(2)})`;
+            const notifyMsg = summary ? `${notify}\n${summary.slice(0, 500)}` : notify;
+            this.signalDaemon.sendSignalMessage(notifyMsg).catch(() => { });
+        }
+        // Cleanup
+        this.activeJobRuns.delete(job.id);
+        await this.sessionManager.end(label);
+        logger.info(`[Daemon] Job ${job.id} completed: ${outcome.kind}`);
+        return record;
+    }
+    // -----------------------------------------------------------------------
+    // Escalation handling for cron sessions
+    // -----------------------------------------------------------------------
+    handleCronEscalation(request, job) {
+        const label = this.activeJobRuns.get(job.id);
+        if (label === undefined)
+            return;
+        this.sessionManager.setPendingEscalation(label, request.escalationId);
+        if (job.notifyOnEscalation && this.signalDaemon) {
+            const banner = [
+                `[#${label} cron: ${job.name}] Escalation: ${request.serverName}/${request.toolName}`,
+                `Reason: "${request.reason}"`,
+                `Reply: approve #${label} / deny #${label}`,
+            ].join('\n');
+            this.signalDaemon.sendSignalMessage(banner).catch(() => { });
+        }
+        else {
+            // Auto-deny when Signal is not configured
+            const managed = this.sessionManager.get(label);
+            managed?.session.resolveEscalation(request.escalationId, 'denied').catch(() => { });
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Signal integration
+    // -----------------------------------------------------------------------
+    async startSignalDaemon() {
+        const { resolveSignalConfig } = await import('../signal/signal-config.js');
+        const { SignalBotDaemon } = await import('../signal/signal-bot-daemon.js');
+        const { createSignalContainerManager } = await import('../signal/signal-container.js');
+        const { createDockerManager } = await import('../docker/docker-manager.js');
+        const userConfig = loadUserConfig();
+        const signalConfig = resolveSignalConfig(userConfig);
+        if (!signalConfig) {
+            throw new Error('Signal is not configured. Run: ironcurtain setup-signal');
+        }
+        process.stderr.write('Starting Signal transport...\n');
+        const docker = createDockerManager();
+        const containerManager = createSignalContainerManager(docker, signalConfig.container);
+        const signalDaemon = new SignalBotDaemon({
+            config: signalConfig,
+            containerManager,
+            mode: this.mode,
+            sessionManager: this.sessionManager,
+        });
+        // Await the connection phase (starts Docker, health check, WebSocket).
+        // Throws if the container won't start or health check times out.
+        await signalDaemon.connect();
+        this.signalDaemon = signalDaemon;
+        // Run the blocking event loop in the background (blocks until shutdown)
+        signalDaemon.run().catch((err) => {
+            logger.warn(`[Daemon] Signal daemon exited: ${String(err)}`);
+            this.signalDaemon = null;
+        });
+    }
+    // -----------------------------------------------------------------------
+    // Helpers
+    // -----------------------------------------------------------------------
+    async startControlSocket() {
+        const handler = {
+            getStatus: () => this.getStatus(),
+            addJob: (job) => this.addJob(job),
+            removeJob: (jobId) => this.removeJob(jobId),
+            enableJob: (jobId) => this.enableJob(jobId),
+            disableJob: (jobId) => this.disableJob(jobId),
+            recompileJob: (jobId) => this.recompileJob(jobId),
+            reloadJob: (jobId) => this.reloadJob(jobId),
+            runJobNow: (jobId) => this.runJobNow(jobId),
+            listJobs: () => this.listJobs(),
+        };
+        this.controlSocket = new ControlSocketServer(handler);
+        try {
+            await this.controlSocket.start();
+        }
+        catch (err) {
+            logger.warn(`[Daemon] Failed to start control socket: ${err instanceof Error ? err.message : String(err)}`);
+            this.controlSocket = null;
+        }
+    }
+    readLastRunSummary(workspace) {
+        const summaryPath = resolve(workspace, 'last-run.md');
+        if (!existsSync(summaryPath))
+            return null;
+        try {
+            const content = readFileSync(summaryPath, 'utf-8');
+            return content.length > 2000 ? content.slice(0, 2000) + '...' : content;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=ironcurtain-daemon.js.map

package/dist/daemon/ironcurtain-daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ironcurtain-daemon.js","sourceRoot":"","sources":["../../src/daemon/ironcurtain-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,cAAc,EAA2B,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGvF,OAAO,EAAE,cAAc,EAAsB,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAsB,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC/G,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAiD,MAAM,qBAAqB,CAAC;AAYzG;;GAEG;AACH,SAAS,sBAAsB,CAAC,YAA+B,EAAE,GAAkB;IACjF,MAAM,UAAU,GAAG;QACjB,GAAG,oBAAoB;QACvB,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;KAC/B,CAAC;IAEF,MAAM,iBAAiB,GAAuB;QAC5C,GAAG,YAAY,CAAC,UAAU;QAC1B,cAAc,EAAE;YACd,GAAG,YAAY,CAAC,UAAU,CAAC,cAAc;YACzC,GAAG,UAAU;SACd;KACF,CAAC;IAEF,OAAO;QACL,GAAG,YAAY;QACf,UAAU,EAAE,iBAAiB;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,iBAAiB;IACX,IAAI,CAAc;IAClB,QAAQ,CAAU;IAClB,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IACtC,SAAS,CAAgB;IAE1C,4DAA4D;IACpD,SAAS,GAAgB,IAAI,CAAC;IAEtC,wEAAwE;IACvD,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3D,mDAAmD;IAC3C,aAAa,GAA+B,IAAI,CAAC;IAEzD,8DAA8D;IACtD,YAAY,GAAoE,IAAI,CAAC;IAE7F,kCAAkC;IAC1B,WAAW,GAAwB,IAAI,CAAC;IAEhD,YAAY,OAAiC;QAC3C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAE5B,6DAA6D;QAC7D,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE1D,6CAA6C;QAC7C,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAEhC,qCAAqC;QACrC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,MAAM,YAAY,WAAW,CAAC,MAAM,UAAU,CAAC,CAAC;QAEpF,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAClD,MAAM,CAAC,IAAI,CAAC,0BAA0B,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,QAAQ,WAAW,OAAO,EAAE,WAAW,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC;YAClH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,mCAAmC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5G,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1D,CAAC;QAED,uBAAuB;QACvB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,QAAQ;QACZ,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAEzC,sDAAsD;QACtD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAClC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,2CAA2C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAE/B,gFAAgF;QAChF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACrC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,wCAAwC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QAC5C,MAAM,OAAO,CAAC,UAAU,CACtB,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACxB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,iEAAiE;QACjE,MAAM,CAAC,QAAQ,EAAE,CAAC;QAElB,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,0EAA0E;IAC1E,6CAA6C;IAC7C,0EAA0E;IAE1E;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,GAAkB;QAC7B,8CAA8C;QAC9C,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;YAClC,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QAED,0BAA0B;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9D,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,8BAA8B;QAC9B,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,iCAAiC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAC1D,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,yBAAyB;QACzB,MAAM,CAAC,IAAI,CAAC,0CAA0C,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACnE,MAAM,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAEjE,sBAAsB;QACtB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAEnB,sBAAsB;QACtB,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,EAAE,yBAAyB,OAAO,EAAE,WAAW,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,SAAS,CAAC,KAAY;QAC1B,yBAAyB;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC3C,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACjC,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,SAAS,CAAC,KAAY;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1C,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,UAAU,CAAC,KAAY;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,6DAA6D;IAC7D,wHAAwH;IACxH,KAAK,CAAC,SAAS,CAAC,KAAY;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAErD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEjC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,wBAAwB,OAAO,EAAE,WAAW,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,2BAA2B,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,YAAY,CAAC,KAAY;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAErD,MAAM,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,KAAY;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,+DAA+D;IAC/D,QAAQ;QAMN,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,GAAG;YACH,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAC,CAAC;IACN,CAAC;IAED,wDAAwD;IACxD,SAAS;QACP,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAElD,6DAA6D;QAC7D,IAAI,YAAY,GAAgB,IAAI,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC;gBACjE,YAAY,GAAG,OAAO,CAAC;YACzB,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1F,OAAO;YACL,aAAa;YACb,IAAI,EAAE;gBACJ,KAAK,EAAE,IAAI,CAAC,MAAM;gBAClB,OAAO,EAAE,WAAW,CAAC,MAAM;gBAC3B,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI;aACjC;YACD,eAAe,EAAE,IAAI,CAAC,YAAY,KAAK,IAAI;YAC3C,YAAY;SACb,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,gBAAgB;IAChB,0EAA0E;IAE1E;;;OAGG;IACK,KAAK,CAAC,YAAY,CAAC,GAAkB;QAC3C,gBAAgB;QAChB,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,yBAAyB,GAAG,CAAC,EAAE,yCAAyC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC;YACtH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,CAAC,YAAY;gBACf,EAAE,iBAAiB,CAAC,gBAAgB,GAAG,CAAC,IAAI,oCAAoC,CAAC;iBAChF,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,EAAE,YAAY,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU,CAAC,GAAkB;QACzC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;QAElC,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,EAAE,2BAA2B,OAAO,EAAE,CAAC,CAAC;gBACxE,MAAM,MAAM,GAAc;oBACxB,SAAS;oBACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACrC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,EAAE,EAAE;oBACpE,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE;oBAChF,OAAO,EAAE,IAAI;oBACb,sBAAsB,EAAE,CAAC;oBACzB,mBAAmB,EAAE,CAAC;oBACtB,gBAAgB,EAAE,IAAI;iBACvB,CAAC;gBACF,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC9B,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,gBAAgB,GAAkB,IAAI,CAAC;QAC3C,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,iCAAiC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAC1D,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACvD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,2CAA2C,GAAG,CAAC,EAAE,MAAM,gBAAgB,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,aAAa,GAAG,sBAAsB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,eAAe,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEnD,mCAAmC;QACnC,MAAM,YAAY,GAAG,iCAAiC,CAAC;YACrD,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;QAEH,gCAAgC;QAChC,MAAM,SAAS,GAAG,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;QAE9E,uCAAuC;QACvC,IAAI,sBAAsB,GAAG,CAAC,CAAC;QAC/B,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAE5B,iEAAiE;QACjE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;YAClC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,eAAe;YAC1B,wBAAwB,EAAE,YAAY;YACtC,kBAAkB,EAAE,IAAI;YACxB,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;gBACxB,sBAAsB,EAAE,CAAC;gBACzB,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;YACD,oBAAoB,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;gBACtC,IAAI,QAAQ,KAAK,UAAU;oBAAE,mBAAmB,EAAE,CAAC;gBACnD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YACD,mBAAmB,EAAE,GAAG,EAAE;gBACxB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,8BAA8B;QAC9B,MAAM,MAAM,GAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACjF,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAEtC,MAAM,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,EAAE,gBAAgB,KAAK,EAAE,CAAC,CAAC;QAEnE,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBACxC,OAAO,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzF,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAc;YACxB,SAAS;YACT,WAAW;YACX,OAAO;YACP,MAAM,EAAE;gBACN,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,SAAS,EAAE,YAAY,CAAC,SAAS;gBACjC,cAAc,EAAE,YAAY,CAAC,cAAc;gBAC3C,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;aAChD;YACD,OAAO;YACP,sBAAsB;YACtB,mBAAmB;YACnB,gBAAgB;SACjB,CAAC;QAEF,kBAAkB;QAClB,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE9B,kCAAkC;QAClC,IAAI,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAChD,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,kBAAkB;oBACnC,CAAC,CAAC,qBAAqB,OAAO,CAAC,SAAS,EAAE;oBAC1C,CAAC,CAAC,UAAU,OAAO,CAAC,OAAO,EAAE,CAAC;YAEpC,MAAM,MAAM,GAAG,UAAU,GAAG,CAAC,IAAI,KAAK,UAAU,KAAK,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9I,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3E,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,UAAU;QACV,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAErC,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,EAAE,eAAe,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0EAA0E;IAC1E,wCAAwC;IACxC,0EAA0E;IAElE,oBAAoB,CAAC,OAA0B,EAAE,GAAkB;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAEhC,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAEtE,IAAI,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG;gBACb,KAAK,KAAK,UAAU,GAAG,CAAC,IAAI,iBAAiB,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE;gBACrF,YAAY,OAAO,CAAC,MAAM,GAAG;gBAC7B,mBAAmB,KAAK,YAAY,KAAK,EAAE;aAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/C,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,qBAAqB;IACrB,0EAA0E;IAElE,KAAK,CAAC,iBAAiB;QAC7B,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC3E,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC3E,MAAM,EAAE,4BAA4B,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;QACvF,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAE5E,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,YAAY,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QAEtF,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC;YACvC,MAAM,EAAE,YAAY;YACpB,gBAAgB;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;QAE7B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QAEjC,wEAAwE;QACxE,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACxC,MAAM,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,UAAU;IACV,0EAA0E;IAElE,KAAK,CAAC,kBAAkB;QAC9B,MAAM,OAAO,GAA0B;YACrC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE;YACjC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACjC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAc,CAAC;YACpD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAc,CAAC;YACpD,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAc,CAAC;YACtD,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAc,CAAC;YAC1D,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAc,CAAC;YACpD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAc,CAAC;YACpD,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE;SAChC,CAAC;QAEF,IAAI,CAAC,aAAa,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,SAAiB;QAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/docker/adapters/claude-code.js

@@ -13,6 +13,7 @@
  */
 import { anthropicProvider, claudePlatformProvider, anthropicOAuthProvider, claudePlatformOAuthProvider, } from '../provider-config.js';
 import { buildSystemPrompt } from '../../session/prompts.js';
+import { buildResizePtyScript, buildCheckPtySizeScript, buildNetworkSection, buildPolicySection, buildAttributionSection, } from './shared-scripts.js';
 const CLAUDE_CODE_IMAGE = 'ironcurtain-claude-code:latest';
 function buildDockerEnvironmentPrompt(context) {
     return `## Docker Environment
@@ -37,9 +38,7 @@ tools for all subsequent file operations on the cloned/written files.
 When cloning repos, use ${context.workspaceDir} as the target directory
 (e.g. \`${context.workspaceDir}/repo-name\`).
 
-### Network
-The container has NO direct internet access. All HTTP requests and
-git operations MUST go through the sandbox tools via \`execute_code\`.
+${buildNetworkSection('the sandbox tools via `execute_code`')}
 
 IMPORTANT: Your built-in server-side web search tool (WebSearch) is DISABLED
 and will NOT work — it is stripped by the security proxy. You MUST use the
@@ -51,15 +50,9 @@ To search the web:
 To fetch a URL:
   \`const page = tools.fetch_http_fetch({ url: "https://example.com" });\`
 
-### Policy Enforcement
-Every tool call through \`execute_code\` is evaluated against security policy rules:
-- **Allowed**: proceeds automatically
-- **Denied**: blocked -- do NOT retry denied operations
-- **Escalated**: requires human approval -- you will receive the result once approved
+${buildPolicySection('tool call through `execute_code`')}
 
-### Attribution
-When adding attribution lines (e.g. Co-Authored-By, "Generated with"), include
-"running under IronCurtain" alongside the tool name.
+${buildAttributionSection()}
 `;
 }
 export const claudeCodeAdapter = {
@@ -102,42 +95,9 @@ exec claude --dangerously-skip-permissions \\
   --mcp-config /etc/ironcurtain/claude-mcp-config.json \\
   --append-system-prompt "$IRONCURTAIN_SYSTEM_PROMPT"
 `;
-        // Helper script to resize the PTY that Claude Code is actually running on.
-        // docker exec stty targets a transient exec session PTY, not socat's PTY.
-        // If Claude hasn't started yet, we exit silently — start-claude.sh sets
-        // the initial size from env vars, so no fallback is needed.
-        // Diagnostic output goes to stderr (captured by host-side logger).
-        const resizeScript = `#!/bin/bash
-# Called from the host via: docker exec <cid> /etc/ironcurtain/resize-pty.sh <cols> <rows>
-COLS=$1
-ROWS=$2
-
-CLAUDE_PID=$(pgrep -x claude | head -1)
-if [ -z "$CLAUDE_PID" ]; then
-  echo "no-claude" >&2
-  exit 0
-fi
-
-PTS=$(readlink /proc/$CLAUDE_PID/fd/0 2>/dev/null)
-if [ -z "$PTS" ] || ! [ -e "$PTS" ]; then
-  echo "no-pty pid=$CLAUDE_PID pts=$PTS" >&2
-  exit 0
-fi
-
-stty -F "$PTS" cols "$COLS" rows "$ROWS" 2>/dev/null
-RC=$?
-kill -WINCH "$CLAUDE_PID" 2>/dev/null
-echo "ok pid=$CLAUDE_PID pts=$PTS stty=$RC \${COLS}x\${ROWS}" >&2
-`;
-        // Helper script to report the current PTY size for host-side verification.
-        const checkSizeScript = `#!/bin/bash
-# Returns "rows cols" of the container PTY
-CLAUDE_PID=$(pgrep -x claude | head -1)
-if [ -z "$CLAUDE_PID" ]; then echo "0 0"; exit 0; fi
-PTS=$(readlink /proc/$CLAUDE_PID/fd/0 2>/dev/null)
-if [ -z "$PTS" ] || ! [ -e "$PTS" ]; then echo "0 0"; exit 0; fi
-stty -F "$PTS" size 2>/dev/null || echo "0 0"
-`;
+        // Helper scripts for PTY resize — use shared generators parameterized by process name.
+        const resizeScript = buildResizePtyScript('claude');
+        const checkSizeScript = buildCheckPtySizeScript('claude');
         return [
             { path: 'start-claude.sh', content: startScript, mode: 0o755 },
             { path: 'resize-pty.sh', content: resizeScript, mode: 0o755 },