@quickchatai/pi-quickreview 0.0.0-stage → 1.1.0

package/dist/src/engine/toolfence.js

@@ -0,0 +1,378 @@
+// The in-process file tools' fence. The SDK session's read, grep, find,
+// ls, edit and write tools run inside the Node process that holds the GitHub
+// token and the login, as the run uid, so a path they are given must not lead
+// to the places that hold them:
+//
+//   /proc/*        the token holder's own environ, mem, cmdline and fds
+//   /run/qcr-in    where the caller staged the token (read once and unlinked,
+//                  but the mount is the caller's)
+//   the agent dir  the run's login copy, models and settings
+//   credentials    the secrets dirs (the App key, the webhook secret, the
+//                  OpenViking keys), the IPC run dirs and the sessions'
+//                  ovcli.conf (credentialPaths)
+//
+// The model's bash runs as another uid (tooluid.ts) and so cannot reach them;
+// these tools can. Plain path matching is not enough: bash, as the tool uid,
+// can plant a symlink in the worktree that points at a fenced path. So the
+// fence resolves the target first: the real path of the file, or, for one that
+// does not exist yet (a write), of its parent directory, following a dangling
+// final symlink too (a write follows it). Both the path as given and the
+// resolved one must be clear of the fence.
+//
+// The tools are built with pi's own `operations` hook, so each file is opened
+// by this module: a read opens the file first and checks what the descriptor
+// really is (/proc/self/fd), so a symlink swapped in after the path check
+// still lands on a refusal. grep and find hand their search root to ripgrep
+// and fd, which pi starts itself as the run uid and do not follow symlinks;
+// those two are checked before the tool runs: the root, and that no fenced
+// path lies below it.
+import { constants, lstatSync, readlinkSync, realpathSync } from "node:fs";
+import { mkdir, open, stat, readdir, access } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { defaultSecretPathContext } from "../../extensions/bash-guard.js";
+/** What no file tool may reach, besides the run's agent dirs. `/qcr-login` is
+ * where the wrapper and the Action mount the owner's login volume: its
+ * auth.json holds the long-lived refresh token and is group-readable by the
+ * run uid, whose group the in-process file tools (unlike the tool uid's bash)
+ * keep. */
+export const FENCED_PATHS = ["/proc", "/dev/fd", "/run/qcr-in", "/qcr-login"];
+/** The directories `env` names as the login's source: the process's own pi
+ * agent dir (`PI_CODING_AGENT_DIR`, which a review copies into its private
+ * agent dir) and the scan's `QCR_SCAN_AUTH_SRC`. The round's copy is the
+ * host's agent dir, fenced separately. */
+export function loginSourceDirs(env) {
+    return ["PI_CODING_AGENT_DIR", "QCR_SCAN_AUTH_SRC"]
+        .map((k) => env[k]?.trim())
+        .filter((v) => v !== undefined && v !== "" && isAbsolute(v));
+}
+/**
+ * The credentials an `env` points at, which no file tool may reach:
+ *
+ *   - every secrets dir this install could be using: the App's private key, the
+ *     webhook secret and the OpenViking keys live there. The list is the bash
+ *     guard's own (`defaultSecretPathContext`, which mirrors the install
+ *     locator: `$QCR_SECRETS_MOUNT`, the container mount, `$QC_SECRETS_DIR`,
+ *     `<config home>/secrets`, a `[github] secrets_dir` read from
+ *     `$QCR_CONFIG`, and the legacy dir), so the shell belt and this fence
+ *     name the same places;
+ *   - the daemon's IPC run dirs (the socket and the capability launch files);
+ *   - the memory CLI config the env names (`OPENVIKING_CLI_CONFIG_FILE`, the
+ *     sessions' ovcli.conf): it holds the reviewer key, which the in-process
+ *     memory extension reads itself and the model has no use for.
+ *
+ * Our own code reads these with plain fs calls, never through the tools, so
+ * fencing them takes nothing away from it. Every absolute path, deduplicated;
+ * a path that does not exist is fenced lexically and by its resolved prefix.
+ */
+export function credentialPaths(...envs) {
+    const out = new Set();
+    for (const env of envs) {
+        const ctx = defaultSecretPathContext(env, "/");
+        for (const d of [...ctx.dirs, ...(ctx.runDirs ?? [])])
+            out.add(d);
+        const ovcli = env["OPENVIKING_CLI_CONFIG_FILE"]?.trim();
+        if (ovcli !== undefined && isAbsolute(ovcli))
+            out.add(resolve(ovcli));
+    }
+    return [...out];
+}
+/** The names of the file tools behind the fence. */
+export const FENCED_TOOLS = ["read", "grep", "find", "ls", "edit", "write"];
+/** A path the fence refuses; `message` is what the model reads. */
+export class ToolFenceError extends Error {
+    constructor(path) {
+        super(`${path}: access refused (it leads into a fenced path)`);
+        this.name = "ToolFenceError";
+    }
+}
+const MAX_LINKS = 40;
+function within(path, root) {
+    return path === root || path.startsWith(root.endsWith("/") ? root : root + "/");
+}
+/** The real path of `p`, which need not exist: the longest existing prefix is
+ * resolved, and a dangling symlink is followed to where it would lead. */
+function realOrIntended(p, links = 0) {
+    if (links > MAX_LINKS)
+        throw new Error(`${p}: too many levels of symbolic links`);
+    try {
+        return realpathSync(p);
+    }
+    catch (e) {
+        if (e.code !== "ENOENT")
+            throw e;
+    }
+    const parent = dirname(p);
+    if (parent === p)
+        return p;
+    let link;
+    try {
+        if (lstatSync(p).isSymbolicLink())
+            link = readlinkSync(p);
+    }
+    catch {
+        // not there at all
+    }
+    const base = realOrIntended(parent, links + 1);
+    if (link !== undefined)
+        return realOrIntended(resolve(base, link), links + 1);
+    return join(base, basename(p));
+}
+/** A fence over the fixed paths and the given directories. */
+export function createToolFence(o = {}) {
+    const roots = () => {
+        const out = new Set();
+        for (const r of [...FENCED_PATHS, ...(o.dirs ?? [])]) {
+            out.add(r);
+            try {
+                out.add(realpathSync(r));
+            }
+            catch {
+                // not there: the lexical form is all there is
+            }
+        }
+        return [...out];
+    };
+    const fenced = (p) => roots().some((r) => within(p, r));
+    return {
+        check(path) {
+            const abs = resolve(path);
+            let real;
+            try {
+                real = realOrIntended(abs);
+            }
+            catch (e) {
+                // A path that cannot be resolved cannot be shown clear of the fence.
+                if (e instanceof ToolFenceError)
+                    throw e;
+                throw new ToolFenceError(path);
+            }
+            if (fenced(abs) || fenced(real))
+                throw new ToolFenceError(path);
+        },
+        checkTree(path) {
+            this.check(path);
+            const abs = resolve(path);
+            const real = realOrIntended(abs);
+            if (roots().some((r) => within(r, abs) || within(r, real)))
+                throw new ToolFenceError(path);
+        },
+        checkOpened(fd, path) {
+            let real;
+            try {
+                real = realpathSync(`/proc/self/fd/${fd}`);
+            }
+            catch {
+                return;
+            }
+            if (fenced(real))
+                throw new ToolFenceError(path);
+        },
+        checkWrite(path) {
+            this.check(path);
+            const guard = o.protectedWrite;
+            if (guard === undefined)
+                return;
+            const abs = resolve(path);
+            let real;
+            try {
+                real = realOrIntended(abs);
+            }
+            catch {
+                throw new ToolFenceError(path);
+            }
+            if (real !== abs && guard(real))
+                throw new ToolFenceError(path);
+        },
+        checkWriteOpened(fd, path) {
+            this.checkOpened(fd, path);
+            const guard = o.protectedWrite;
+            if (guard === undefined)
+                return;
+            let real;
+            try {
+                real = realpathSync(`/proc/self/fd/${fd}`);
+            }
+            catch {
+                return;
+            }
+            if (real !== resolve(path) && guard(real))
+                throw new ToolFenceError(path);
+        },
+    };
+}
+// ---- the paths as pi reads them -------------------------------------------------
+// pi's UNICODE_SPACES (utils/paths.js): the no-break and typographic spaces
+const SPACE_CODES = [
+    0x00a0,
+    ...Array.from({ length: 11 }, (_, i) => 0x2000 + i),
+    0x202f,
+    0x205f,
+    0x3000,
+];
+const UNICODE_SPACES = new RegExp(`[${SPACE_CODES.map((c) => String.fromCharCode(c)).join("")}]`, "g");
+/** A tool's `path` argument as pi resolves it (utils/paths.js resolvePath with
+ * unicode spaces and the `@` prefix normalised, `~` and file: URLs expanded).
+ * `home` is the home pi expands `~` against, as the host resolved it; without
+ * one a `~` path cannot be shown clear of the fence and is refused. */
+export function toolPath(input, cwd, home) {
+    let p = input.replace(UNICODE_SPACES, " ");
+    if (p.startsWith("@"))
+        p = p.slice(1);
+    if ((p === "~" || p.startsWith("~/")) && home === undefined)
+        throw new ToolFenceError(input);
+    if (p === "~")
+        p = home;
+    else if (p.startsWith("~/"))
+        p = join(home, p.slice(2));
+    else if (/^file:\/\//.test(p))
+        p = fileURLToPath(p);
+    return isAbsolute(p) ? resolve(p) : resolve(cwd, p);
+}
+// ---- the operations ---------------------------------------------------------------
+const MIME_SNIFF_BYTES = 4100;
+/** Opens `path` for reading, checks what was opened, and gives the handle. */
+async function openChecked(fence, path, flags) {
+    fence.check(path);
+    const fh = await open(path, flags);
+    try {
+        fence.checkOpened(fh.fd, path);
+    }
+    catch (e) {
+        await fh.close();
+        throw e;
+    }
+    return fh;
+}
+async function readChecked(fence, path) {
+    const fh = await openChecked(fence, path, constants.O_RDONLY);
+    try {
+        return await fh.readFile();
+    }
+    finally {
+        await fh.close();
+    }
+}
+async function writeChecked(fence, path, content) {
+    // No truncation at open: nothing is cut before the descriptor is known to be
+    // clear — of the fence, and of a protected target a symlink led it to (a link
+    // swapped in after the path check still lands on a refusal here).
+    fence.checkWrite(path);
+    const fh = await open(path, constants.O_WRONLY | constants.O_CREAT);
+    try {
+        fence.checkWriteOpened(fh.fd, path);
+    }
+    catch (e) {
+        await fh.close();
+        throw e;
+    }
+    try {
+        await fh.truncate(0);
+        await fh.writeFile(content, "utf-8");
+    }
+    finally {
+        await fh.close();
+    }
+}
+function readOperations(fence, sniff) {
+    return {
+        readFile: (p) => readChecked(fence, p),
+        access: async (p) => {
+            fence.check(p);
+            await access(p, constants.R_OK);
+        },
+        detectImageMimeType: async (p) => {
+            if (sniff === null)
+                return null;
+            const fh = await openChecked(fence, p, constants.O_RDONLY);
+            try {
+                const buf = Buffer.alloc(MIME_SNIFF_BYTES);
+                const { bytesRead } = await fh.read(buf, 0, MIME_SNIFF_BYTES, 0);
+                return sniff(buf.subarray(0, bytesRead)) ?? null;
+            }
+            finally {
+                await fh.close();
+            }
+        },
+    };
+}
+function editOperations(fence) {
+    return {
+        readFile: (p) => readChecked(fence, p),
+        writeFile: (p, content) => writeChecked(fence, p, content),
+        access: async (p) => {
+            fence.check(p);
+            await access(p, constants.R_OK | constants.W_OK);
+        },
+    };
+}
+function writeOperations(fence) {
+    return {
+        writeFile: (p, content) => writeChecked(fence, p, content),
+        mkdir: async (dir) => {
+            fence.checkWrite(dir);
+            await mkdir(dir, { recursive: true });
+        },
+    };
+}
+function grepOperations(fence) {
+    return {
+        isDirectory: async (p) => {
+            fence.check(p);
+            return (await stat(p)).isDirectory();
+        },
+        readFile: async (p) => (await readChecked(fence, p)).toString("utf-8"),
+    };
+}
+function lsOperations(fence) {
+    const checked = (f) => async (p) => {
+        fence.check(p);
+        return f(p);
+    };
+    return {
+        exists: async (p) => {
+            fence.check(p);
+            try {
+                await access(p);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        stat: checked((p) => stat(p)),
+        readdir: checked((p) => readdir(p)),
+    };
+}
+/** The `operations` of each file tool that takes them, every file opened through
+ * the fence. `sniff` tells images from their first bytes; without it a file is
+ * always read as text. find has none: it starts fd on its search root. */
+export function fencedOperations(fence, sniff) {
+    return {
+        read: readOperations(fence, sniff),
+        grep: grepOperations(fence),
+        ls: lsOperations(fence),
+        edit: editOperations(fence),
+        write: writeOperations(fence),
+    };
+}
+/** `def` with a check of its `path` argument ahead of its execution: the
+ * refusal says what it is, and the tools that start ripgrep and fd (which
+ * `operations` does not reach) are covered. */
+export function guardedTool(def, fence, cwd, home) {
+    const run = def.execute;
+    return {
+        ...def,
+        execute: (id, params, signal, onUpdate, ctx) => {
+            const given = params.path;
+            const root = toolPath(typeof given === "string" && given !== "" ? given : ".", ctx?.cwd || cwd, home);
+            // grep and find walk the whole tree under the root.
+            if (def.name === "grep" || def.name === "find")
+                fence.checkTree(root);
+            else
+                fence.check(root);
+            return run(id, params, signal, onUpdate, ctx);
+        },
+    };
+}
+//# sourceMappingURL=toolfence.js.map

package/dist/src/engine/toolfence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolfence.js","sourceRoot":"","sources":["../../../src/engine/toolfence.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,6EAA6E;AAC7E,8EAA8E;AAC9E,gCAAgC;AAChC,EAAE;AACF,wEAAwE;AACxE,8EAA8E;AAC9E,kDAAkD;AAClD,6DAA6D;AAC7D,0EAA0E;AAC1E,wEAAwE;AACxE,gDAAgD;AAChD,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,8EAA8E;AAC9E,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,sBAAsB;AACtB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAiB,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AASzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E;;;;WAIW;AACX,MAAM,CAAC,MAAM,YAAY,GAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AAEjG;;;0CAG0C;AAC1C,MAAM,UAAU,eAAe,CAAC,GAAsB;IACpD,OAAO,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAAC,GAAG,IAAyB;IAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAGrF,mEAAmE;AACnE,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,IAAY;QACtB,KAAK,CAAC,GAAG,IAAI,gDAAgD,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,SAAS,MAAM,CAAC,IAAY,EAAE,IAAY;IACxC,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAClF,CAAC;AAED;0EAC0E;AAC1E,SAAS,cAAc,CAAC,CAAS,EAAE,KAAK,GAAG,CAAC;IAC1C,IAAI,KAAK,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3B,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;YAAE,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAoBD,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAC7B,IAUI,EAAE;IAEN,MAAM,KAAK,GAAG,GAAa,EAAE;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACX,IAAI,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,qEAAqE;gBACrE,IAAI,CAAC,YAAY,cAAc;oBAAE,MAAM,CAAC,CAAC;gBACzC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC;QACD,SAAS,CAAC,IAAI;YACZ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7F,CAAC;QACD,WAAW,CAAC,EAAE,EAAE,IAAI;YAClB,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,YAAY,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,UAAU,CAAC,IAAI;YACb,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,CAAC,CAAC,cAAc,CAAC;YAC/B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC;QACD,gBAAgB,CAAC,EAAE,EAAE,IAAI;YACvB,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,cAAc,CAAC;YAC/B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,YAAY,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AAEpF,4EAA4E;AAC5E,MAAM,WAAW,GAAG;IAClB,MAAM;IACN,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACnD,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC;AACF,MAAM,cAAc,GAAG,IAAI,MAAM,CAC/B,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAC9D,GAAG,CACJ,CAAC;AAEF;;;uEAGuE;AACvE,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,GAAW,EAAE,IAAa;IAChE,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAK,GAAG;QAAE,CAAC,GAAG,IAAK,CAAC;SACpB,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,IAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;SACpD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,sFAAsF;AAEtF,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAK9B,8EAA8E;AAC9E,KAAK,UAAU,WAAW,CAAC,KAAgB,EAAE,IAAY,EAAE,KAAa;IACtE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAgB,EAAE,IAAY;IACvD,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAgB,EAAE,IAAY,EAAE,OAAe;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,kEAAkE;IAClE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB,EAAE,KAA0B;IAClE,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAClB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC/B,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBAC3C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;gBACjE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC;YACnD,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB;IACtC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,SAAS,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC;QAC1D,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAClB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAgB;IACvC,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC;QAC1D,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB;IACtC,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACvB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACf,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAgB;IACpC,MAAM,OAAO,GACX,CAAI,CAA8B,EAAE,EAAE,CACtC,KAAK,EAAE,CAAS,EAAE,EAAE;QAClB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACf,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACd,CAAC,CAAC;IACJ,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAClB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;0EAE0E;AAC1E,MAAM,UAAU,gBAAgB,CAC9B,KAAgB,EAChB,KAA0B;IAQ1B,OAAO;QACL,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC;QAClC,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC;QAC3B,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC;QACvB,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC;QAC3B,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;+CAE+C;AAC/C,MAAM,UAAU,WAAW,CACzB,GAAmB,EACnB,KAAgB,EAChB,GAAW,EACX,IAAa;IAEb,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;IACxB,OAAO;QACL,GAAG,GAAG;QACN,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;YAC7C,MAAM,KAAK,GAAI,MAA6B,CAAC,IAAI,CAAC;YAClD,MAAM,IAAI,GAAG,QAAQ,CACnB,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EACvD,GAAG,EAAE,GAAG,IAAI,GAAG,EACf,IAAI,CACL,CAAC;YACF,oDAAoD;YACpD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;gBAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;;gBACjE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;KACgB,CAAC;AACtB,CAAC"}

package/dist/src/engine/tooluid.d.ts

@@ -0,0 +1,128 @@
+import type { BashOperations } from "@earendil-works/pi-coding-agent";
+/** The names the image's entrypoint sets when the model's tools must run as
+ * another uid than this process. */
+export declare const TOOL_UID_ENVS: readonly ["QCR_TOOL_UID", "QCR_TOOL_GID", "QCR_TOOL_UID_REQUIRED"];
+/** The uid and gid the model's tools run as: non-zero numeric ids. */
+export interface ToolIds {
+    uid: string;
+    gid: string;
+}
+/** What the environment says about the tool uid: the ids to run the tools as, or
+ * null where nothing asks for a separation, or why none can be made. Where the
+ * ids are named they win, whatever else is set. */
+export declare function toolIdsOf(env: NodeJS.ProcessEnv): ToolIds | {
+    refused: string;
+} | null;
+/** setpriv's switches for the tool uid: its uid and gid with no supplementary
+ * groups, no capability, and no way to gain one. Does not include `--`. */
+export declare function setprivSwitches(ids: ToolIds): string[];
+/** How a child that runs the model's tools is started: through setpriv where the
+ * image asks for the tool uid, unchanged where nothing does, refused where the
+ * entrypoint could not arrange it. */
+export declare function toolIsolation(bin: string, argv: string[], procEnv?: NodeJS.ProcessEnv): {
+    bin: string;
+    argv: string[];
+    isolated: boolean;
+} | {
+    refused: string;
+};
+/** The gate in front of a host that runs the model's tools.
+ *
+ * A host that starts them itself through the tool uid (`isolated`: the SDK
+ * runtime's bash, a debug round's pi) passes where the ids are numeric and
+ * non-zero, and is refused where the entrypoint could not arrange the split.
+ *
+ * A host that cannot (its tools are children of a process that runs in this
+ * uid, such as the native lens tool's pi children) refuses wherever the image
+ * asks for the separation, unless the shared uid is accepted. `host` words the
+ * refusal for the caller. */
+export declare function checkToolUid(env: NodeJS.ProcessEnv, host?: {
+    what: string;
+    instead: string;
+    isolated?: boolean;
+}): void;
+/**
+ * Opens `dir` and everything in it to the tool uid's group: group read and
+ * write on files, and group access on directories, each entry handed to the
+ * tool gid (`QCR_TOOL_GID`) where that is not this process's own gid (the
+ * bot's tools run in a gid of their own; the cli's share the run
+ * gid). For a process that runs as the tool uid and needs what the run uid
+ * made private (a debug round's pi reading its agent dir); the owner's bits
+ * stay. Symbolic links are left as they are, and a missing dir is nothing to
+ * share.
+ */
+export declare function shareWithToolGroup(dir: string, env?: NodeJS.ProcessEnv): void;
+/**
+ * The environment a command run as the tool uid needs on top of the one it was
+ * given: git's `safe.directory = *` in the command scope.
+ *
+ * The repositories the model reads (the worktrees, the base clone) belong to the
+ * run uid, and git refuses a repository another uid owns ("dubious ownership").
+ * The image's system config says `*`, but a review session pins git's system
+ * scope off (src/sessions.ts sessionGitConfigPins), and `safe.directory` is read
+ * only from a protected scope: system, global or command. So it rides the
+ * command scope (GIT_CONFIG_COUNT/KEY_n/VALUE_n), appended after any entries the
+ * env already carries, never in place of them. It widens nothing: the
+ * repositories are the run uid's, which the tool uid trusts by construction.
+ */
+export declare function toolUidEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** The umask a tool-uid command runs under: group-writable files, which is how
+ * the run uid and the tool uid (one gid, two uids) share what either writes. */
+export declare const TOOL_UMASK = 2;
+/** The setpriv the spawner runs, which holds the ambient SETUID/SETGID: an
+ * absolute path in a system dir. A PATH entry the tool uid can write must not
+ * be able to plant the binary the next command runs with those capabilities.
+ * Null where no system dir has one. */
+export declare function trustedSetpriv(exists?: (p: string) => boolean, env?: NodeJS.ProcessEnv): string | null;
+/**
+ * The bot's setid helper, named by `QCR_SETPRIV_BIN`: the image's
+ * own copy of setpriv that carries CAP_SETUID/CAP_SETGID as FILE capabilities
+ * and only a gate group may run (docker/Dockerfile). The always-on bot runs as
+ * its own uid, not root, so `docker exec` into it keeps landing as that uid; it
+ * reaches the tool uid through this helper instead of ambient capabilities
+ * (docker/entrypoint.sh's daemon mode). The model's tools never get it: they run
+ * with no_new_privs, under which a file capability grants nothing, and without
+ * the gate group.
+ *
+ * Trusted only as a root-owned regular file in a root-owned directory, neither
+ * writable by group or others: the run uid must not be able to swap the binary
+ * it hands its capabilities to. Null where the env names none; `refused` where
+ * it names one that fails those checks.
+ */
+export declare function setidHelperOf(env: NodeJS.ProcessEnv, stat?: (p: string) => {
+    uid: number;
+    mode: number;
+    isFile(): boolean;
+    isDirectory(): boolean;
+} | undefined): {
+    path: string;
+} | {
+    refused: string;
+} | null;
+/** The stdio of a command: nothing in, its output out, and each of `inherit`
+ * handed to it at the SAME fd number. Node closes every descriptor a child is
+ * not listed with, so an fd a command (or a script under it) must read has to be
+ * named here. */
+export declare function commandStdio(inherit: readonly number[]): Array<"ignore" | "pipe" | number>;
+/**
+ * The SDK bash tool's execution, with the model's command run as the tool uid.
+ *
+ * The command is `setpriv … -- bash -c <command>` in a process group of its
+ * own, the umask set first (TOOL_UMASK) and git's safe.directory in its env
+ * (toolUidEnv). A timeout or an abort ends that group through setpriv too: the run uid
+ * may not signal a process of another uid (kill(2): the sender's uid must match
+ * the target's real or saved uid, and this process holds no CAP_KILL), so pi's
+ * own kill of the tree would silently do nothing and the command would run on.
+ * The saved uid cannot be left as the run uid to allow it: the tool could then
+ * switch back.
+ *
+ * `inherit` lists descriptors every command gets at the same number (the
+ * bot worker's IPC capability).
+ */
+export declare function isolatedBashOperations(ids: ToolIds, setprivBin?: string, inherit?: readonly number[]): BashOperations;
+/** The same execution with no uid change, for a host whose commands must
+ * inherit descriptors (`inherit`): pi's own local operations start a command
+ * with nothing but stdio. The command runs in a process group of its own, which
+ * a timeout or an abort ends. */
+export declare function inheritingBashOperations(inherit: readonly number[]): BashOperations;
+//# sourceMappingURL=tooluid.d.ts.map

package/dist/src/engine/tooluid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tooluid.d.ts","sourceRoot":"","sources":["../../../src/engine/tooluid.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE;oCACoC;AACpC,eAAO,MAAM,aAAa,oEAAqE,CAAC;AAEhG,sEAAsE;AACtE,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAID;;mDAEmD;AACnD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAiBtF;AAED;2EAC2E;AAC3E,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAStD;AAED;;sCAEsC;AACtC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,MAAM,CAAC,UAAwB,GACvC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAY1E;AAED;;;;;;;;;6BAS6B;AAC7B,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAGxD,GACA,IAAI,CAaN;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAe1F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CASpE;AAED;gFACgF;AAChF,eAAO,MAAM,UAAU,IAAQ,CAAC;AAYhC;;;uCAGuC;AACvC,wBAAgB,cAAc,CAC5B,MAAM,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAoB,EAC3C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAIf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE,CACJ,CAAC,EAAE,MAAM,KACN;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,IAAI,OAAO,CAAC;IAAC,WAAW,IAAI,OAAO,CAAA;CAAE,GAAG,SACvC,GACxC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAiB/C;AAuBD;;;iBAGiB;AACjB,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,CAQ1F;AAmFD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,cAAc,CAsChB;AAED;;;iCAGiC;AACjC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,CAenF"}