@rosetears/aili-pi 0.1.0 → 0.1.3

package/scripts/sync-global-skills.mjs

@@ -0,0 +1,134 @@
+import { cp, lstat, readdir, rename, rm } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { randomUUID } from "node:crypto";
+
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const PACKAGE_NAME_PATH = ["@rosetears", "aili-pi"];
+
+async function directoryEntry(path) {
+  try {
+    const info = await lstat(path);
+    if (info.isSymbolicLink()) return "other";
+    return info.isDirectory() ? "directory" : "other";
+  } catch (error) {
+    if (error?.code === "ENOENT") return "missing";
+    throw error;
+  }
+}
+
+async function skillNames(sourceRoot) {
+  const entries = await readdir(sourceRoot, { withFileTypes: true });
+  const names = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
+    const skillFile = join(sourceRoot, entry.name, "SKILL.md");
+    try {
+      const info = await lstat(skillFile);
+      if (info.isFile() && !info.isSymbolicLink()) names.push(entry.name);
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error;
+    }
+  }
+  return names.sort((left, right) => left.localeCompare(right));
+}
+
+function temporaryPath(parent, name, purpose) {
+  return join(parent, `.${name}.aili-pi-${purpose}-${process.pid}-${randomUUID()}`);
+}
+
+/** True only for the two locations owned by Pi's package manager. */
+export function isPiManagedNpmPackageRoot(packageRoot, home = homedir()) {
+  const expectedRoots = [
+    join(home, ".pi", "agent", "npm", "node_modules", ...PACKAGE_NAME_PATH),
+    join(home, ".pi", "npm", "node_modules", ...PACKAGE_NAME_PATH),
+  ].map((path) => resolve(path));
+  return expectedRoots.includes(resolve(packageRoot));
+}
+
+/**
+ * Replace only existing, real skill directories that have the same name as an
+ * embedded AILI snapshot skill. Unmatched user skills and package-only skills
+ * are intentionally left alone.
+ */
+export async function syncExistingGlobalSkills(options = {}) {
+  const packageRoot = resolve(options.packageRoot ?? PACKAGE_ROOT);
+  const home = resolve(options.home ?? homedir());
+  const sourceRoot = join(packageRoot, "skills");
+  const targetRoot = join(home, ".agents", "skills");
+  const sourceNames = await skillNames(sourceRoot);
+  const rootKind = await directoryEntry(targetRoot);
+  if (rootKind === "missing") {
+    return { scanned: sourceNames.length, updated: [], skippedMissing: sourceNames, skippedUnsafe: [] };
+  }
+  if (rootKind !== "directory") {
+    throw new Error(`refusing to sync skills through a non-directory or symlink target: ${targetRoot}`);
+  }
+
+  const matched = [];
+  const skippedMissing = [];
+  const skippedUnsafe = [];
+  for (const name of sourceNames) {
+    const targetKind = await directoryEntry(join(targetRoot, name));
+    if (targetKind === "directory") matched.push(name);
+    else if (targetKind === "missing") skippedMissing.push(name);
+    else skippedUnsafe.push(name);
+  }
+
+  const stages = new Map();
+  try {
+    for (const name of matched) {
+      const stage = temporaryPath(targetRoot, name, "stage");
+      await cp(join(sourceRoot, name), stage, { recursive: true, errorOnExist: true, force: false });
+      stages.set(name, stage);
+    }
+
+    const updated = [];
+    for (const name of matched) {
+      const target = join(targetRoot, name);
+      const stage = stages.get(name);
+      const previous = temporaryPath(targetRoot, name, "previous");
+      let movedPrevious = false;
+      try {
+        await rename(target, previous);
+        movedPrevious = true;
+        await rename(stage, target);
+        stages.delete(name);
+        await rm(previous, { recursive: true, force: true });
+        updated.push(name);
+      } catch (error) {
+        if (movedPrevious) {
+          const targetKind = await directoryEntry(target);
+          if (targetKind === "missing") await rename(previous, target).catch(() => undefined);
+        }
+        throw error;
+      } finally {
+        await rm(previous, { recursive: true, force: true });
+      }
+    }
+
+    return { scanned: sourceNames.length, updated, skippedMissing, skippedUnsafe };
+  } finally {
+    await Promise.all([...stages.values()].map((path) => rm(path, { recursive: true, force: true })));
+  }
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.length > 1 || (args.length === 1 && args[0] !== "--if-pi-managed")) {
+    throw new Error("usage: sync-global-skills.mjs [--if-pi-managed]");
+  }
+  if (args[0] === "--if-pi-managed" && !isPiManagedNpmPackageRoot(PACKAGE_ROOT)) {
+    console.log("AILI skills: global sync skipped outside a Pi-managed npm package root");
+    return;
+  }
+  const report = await syncExistingGlobalSkills();
+  console.log(
+    `AILI skills: scanned=${report.scanned} updated=${report.updated.length} unchanged=${report.skippedMissing.length + report.skippedUnsafe.length}`,
+  );
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  await main();
+}

package/src/runtime/credential-guard.ts

@@ -0,0 +1,58 @@
+import type { ExtensionAPI, ToolCallEventResult } from "@earendil-works/pi-coding-agent";
+import { homedir } from "node:os";
+import { isProtectedCredentialPath } from "./path-boundaries.js";
+
+const FILE_TOOLS = new Set(["read", "write", "edit", "ls", "grep", "find"]);
+
+function normalizeShellCandidate(value: string): string {
+  return value
+    .trim()
+    .replace(/^['"`]+|['"`]+$/g, "")
+    .replaceAll("$HOME", homedir())
+    .replace(/^~(?=\/|$)/, homedir());
+}
+
+/**
+ * Conservatively finds path-shaped shell words, including arguments embedded
+ * in `bash -c` strings. A false positive only blocks a credential-like path;
+ * a false negative must never be treated as an allow decision elsewhere.
+ */
+export function bashMentionsCredentialPath(command: string): boolean {
+  const candidates = command
+    .replace(/\\([\s'"`])/g, "$1")
+    .split(/[\s;|&(){}<>]+/)
+    .flatMap((part) => part.split(/["'`]/))
+    .map(normalizeShellCandidate)
+    .filter(Boolean);
+  return candidates.some((candidate) => isProtectedCredentialPath(candidate));
+}
+
+export async function isProtectedChildPath(cwd: string, path: string): Promise<boolean> {
+  // The predicate deliberately checks lexical credential names. Resolving a
+  // caller-selected external root is unnecessary for this hard denial and
+  // avoids treating a missing path as permission to read it later.
+  void cwd;
+  return isProtectedCredentialPath(normalizeShellCandidate(path));
+}
+
+/**
+ * This extension is injected by the AILI generic subagent wrapper for every
+ * child run. It is intentionally independent of caller-supplied role, cwd,
+ * sandbox, or extension settings and blocks only credential-path access.
+ */
+export default function registerCredentialGuard(pi: ExtensionAPI): void {
+  pi.on("tool_call", async (event): Promise<ToolCallEventResult | undefined> => {
+    try {
+      const input = event.input as Record<string, unknown>;
+      if (FILE_TOOLS.has(event.toolName) && typeof input.path === "string" && await isProtectedChildPath(process.cwd(), input.path)) {
+        return { block: true, reason: "AILI child denied credential/auth/private-key path access" };
+      }
+      if (event.toolName === "bash" && typeof input.command === "string" && bashMentionsCredentialPath(input.command)) {
+        return { block: true, reason: "AILI child denied credential/auth/private-key path access in bash" };
+      }
+      return undefined;
+    } catch {
+      return { block: true, reason: "AILI child denied credential-path classification failure" };
+    }
+  });
+}

package/src/runtime/doctor.ts

@@ -41,7 +41,7 @@ export async function runDoctor(
     });
     results.push({ id: "package", status: dependencyState ? "PASS" : "ERROR", evidence: `version=${packageJson.version ?? "unverified"}; node=${packageJson.engines?.node ?? "unverified"}; native_dependencies=${dependencyState ? "exact" : "drift"}` });
     const resources = [...(packageJson.pi?.extensions ?? []), ...(packageJson.pi?.prompts ?? []), ...(packageJson.pi?.skills ?? [])];
-    results.push({ id: "package.resources", status: resources.length === 8 ? "PASS" : "ERROR", evidence: `declared=${resources.length}` });
+    results.push({ id: "package.resources", status: resources.length === 11 ? "PASS" : "ERROR", evidence: `declared=${resources.length}` });
   } catch (error) {
     results.push({ id: "package", status: "ERROR", evidence: boundedError(error) });
   }

package/src/runtime/index.ts

@@ -2,14 +2,14 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { RuntimeComponent } from "./contracts.js";
 import { registerRoseContext } from "./rose-context.js";
 import { registerDoctor } from "./doctor.js";
-import { registerAiliTask } from "./subagents.js";
+import { registerSubagent } from "./subagents.js";
 import { registerNativeIntegrations } from "./native-integrations.js";
 import { registerGlobalResourceCommand } from "./global-resources.js";
 
 export const runtimeComponents: readonly RuntimeComponent[] = [
   { id: "rose-context", availability: "available", register: registerRoseContext },
   { id: "lifecycle-routing", availability: "available" },
-  { id: "task-runtime", availability: "available", register: registerAiliTask },
+  { id: "task-runtime", availability: "available", register: registerSubagent },
   { id: "native-integrations", availability: "available", register: registerNativeIntegrations },
   { id: "global-resources", availability: "available", register: registerGlobalResourceCommand },
   { id: "capability-registry", availability: "available" },

package/src/runtime/path-boundaries.ts

@@ -53,7 +53,7 @@ function isMissingPathError(error: unknown): boolean {
   return error instanceof Error && "code" in error && (error as NodeJS.ErrnoException).code === "ENOENT";
 }
 
-function isProtectedCredentialPath(path: string): boolean {
+export function isProtectedCredentialPath(path: string): boolean {
   const normalized = path.replaceAll("\\", "/").toLowerCase();
   const basename = normalized.split("/").at(-1) ?? "";
   if (/^\.env(?:\..+)?$/.test(basename)) return true;

package/src/runtime/registry.ts

@@ -148,7 +148,11 @@ export async function validateLiveVerification(): Promise<string[]> {
       implementation?: Record<string, string>;
     }>("manifests/live-verification.json");
     if (evidence.schemaVersion !== 1 || evidence.platform !== "linux" || evidence.piVersion !== "0.81.1" || evidence.status !== "passed") errors.push("live verification: identity is incomplete or non-pass");
-    if (evidence.probes?.length !== 2 || evidence.probes.some((probe) => probe.status !== "passed") || evidence.probes.find((probe) => probe.id === "code-scout-read-package")?.changedFiles !== 0) errors.push("live verification: required probes are missing, non-pass, or mutated files");
+    const genericProbe = evidence.probes?.find((probe) => probe.id === "generic-agentless-read-package");
+    const credentialProbe = evidence.probes?.find((probe) => probe.id === "generic-credential-guard");
+    if (evidence.probes?.length !== 3 || evidence.probes.some((probe) => probe.status !== "passed") || genericProbe?.changedFiles !== 0 || credentialProbe?.changedFiles !== 0) {
+      errors.push("live verification: required probes are missing, non-pass, or mutated files");
+    }
     for (const [filePath, expected] of Object.entries(evidence.implementation ?? {})) {
       const content = await readFile(new URL(filePath, ROOT), "utf8");
       const actual = createHash("sha256").update(content).digest("hex");
@@ -167,7 +171,7 @@ export async function validateProvenance(): Promise<string[]> {
     const provenance = await json<{ schemaVersion: number; sources: Array<{ name: string; revision: string; license: string; status: string; repository: string; sourceFiles: string[]; symbols: string[]; localChanges: string[]; verification: string[] }> }>("manifests/provenance.json");
     const sbom = await json<{ spdxVersion?: string; packages?: Array<{ SPDXID?: string; name?: string; licenseDeclared?: string }> }>("manifests/sbom.json");
     const notices = await readFile(new URL("THIRD_PARTY_NOTICES.md", ROOT), "utf8");
-    if (provenance.schemaVersion !== 1 || provenance.sources.length !== 5) errors.push("provenance: expected five schema-v1 source records");
+    if (provenance.schemaVersion !== 1 || provenance.sources.length !== 6) errors.push("provenance: expected six schema-v1 source records");
     const names = new Set<string>();
     for (const source of provenance.sources) {
       if (!source.name || names.has(source.name)) errors.push(`provenance: duplicate or missing source ${source.name}`);

package/src/runtime/rem-head.txt

@@ -0,0 +1,38 @@
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡜⢠⢾⢿⣸⠃⡆⢸⠀⠀⠀⡁⠀⠀⠀⠀⠀⢀⢦⢸⡑⢮⣑⢺⣽⣮⢍⣛⣧⢯⡹⣍⢯⣙⢏⠿⣎⡭⢻⣌⣷⢩⠯⡽⣙⡻⢦⢹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣾⣿⣿⣿⢻⣿⢧⣈⣻⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡸⢠⡟⡿⡆⡇⠸⠀⠸⠀⠀⠀⡁⠀⠀⣠⠆⡆⡜⣸⢼⢩⠲⡜⢢⣷⢿⣮⡱⢎⡷⣧⡙⢮⠜⣮⡙⠽⣾⡡⢿⡜⣏⠳⣍⠣⣝⢫⢧⢻⣿⣮⠱⡩⢿⣏⣿⣿⣿⡿⢿⣿⣿⢿⣿⢿⣿⣿⠚⠛⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣰⠃⡾⢹⢇⣹⠀⢂⡄⣘⠀⠀⠀⡅⢀⢠⢃⠞⣸⠰⣹⡼⣧⢛⡜⢣⢽⣾⣿⣧⣛⠼⣹⢮⡙⡞⡴⣩⠳⣍⢿⣚⣷⢭⡛⣬⠳⣌⢻⡞⣯⣿⣿⡱⣙⢬⣻⣿⢻⣿⣿⣷⣮⢽⣻⢿⡜⣿⣿⣧⠀⠘⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⡇⣸⠣⣸⢸⡏⠀⡞⠀⣇⠀⢀⡞⡇⡜⢢⢍⠺⣐⠳⡘⣗⣿⡇⢎⡱⢊⣿⣿⣿⣿⣜⡱⢎⢿⣜⡱⢣⡛⡜⣎⢿⣽⣎⠷⣡⠟⣬⢣⢿⣻⢿⣿⣷⡩⣶⣿⣿⣧⢻⣿⣿⣿⣿⣿⣞⣿⣿⣯⢿⣇⠀⣘⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⢡⡏⢰⡟⢸⡇⠀⠃⡄⣷⠀⡏⡔⣯⠘⡥⢎⢣⢃⠯⡔⣻⢼⢿⢢⡱⣉⢾⣳⠘⢿⣿⡷⣍⠞⡼⢷⡫⣜⠵⣊⡎⢿⣿⡳⢥⡛⡴⣋⠾⣟⡧⢿⣽⢷⣿⣿⡞⣷⣫⢿⣿⣿⣿⣟⢿⣿⣷⣯⣿⣿⡄⢋⣸⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡏⣼⠁⢸⡇⢸⡇⡀⢸⠡⢼⡒⡱⠌⣷⣉⠖⡭⢲⡉⠖⣱⢸⡞⣿⣇⠲⢥⣊⢿⡆⡈⠙⢿⣝⡻⣜⡣⢟⣮⡝⣲⣙⢎⢿⣏⢧⡝⡲⣍⠞⣧⣿⣩⣿⣿⠿⣿⣿⣿⢧⣯⣿⣿⣞⣿⣿⣿⣿⣿⡿⣿⣷⣤⣀⣻⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣇⡏⠀⢸⡇⢸⡇⡜⢢⡙⢼⣣⠱⡉⢾⡤⢋⡔⢣⠜⡱⢌⡒⣻⢻⣷⡝⣢⠞⡸⣷⢡⠀⠀⠉⠳⣍⡟⣾⣔⡻⢧⣚⠼⣪⣿⡗⢮⠵⣎⢏⢿⣹⡦⢽⣻⣯⡽⣷⡿⣿⡿⡿⢿⣯⣞⡿⣝⣿⣞⣿⣿⣿⡌⠉⠻⣧⡀⠀⠀⠀⠀⠀⠀⠀⣀⣀⣀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡠⠊⠉⠉⠑⠀⠀⠤⢄⡀⠀⠀⢸⣻⠁⢀⣼⡇⢼⡗⣌⠣⡜⣸⣧⢣⠑⡘⣷⡡⢚⠤⣋⠴⢣⠱⣚⣿⣟⣷⡡⢞⣥⣿⣶⡤⠖⠒⠒⠚⠓⠧⣫⢟⣷⣽⣣⢇⣿⣿⡩⢞⡜⢮⣹⢿⣏⠾⣿⣿⣿⣞⣿⣿⣷⣏⢯⣿⣯⣿⠽⣾⣧⢟⣿⣿⣇⠀⠀⣿⠹⡆⠀⠀⠀⠠⣶⣻⡹⣼⡽⠃⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢰⡋⠀⠀⠀⢀⠠⠀⠂⢀⢠⠃⠀⠀⣿⣹⢀⡼⡰⣯⢘⣿⠤⡓⢬⠐⣿⡆⡍⢒⣻⣧⢩⠒⡥⢎⡣⡝⡤⢻⡽⣿⣿⠽⣋⠜⣳⡄⠀⠀⠀⠀⣀⣀⣈⠙⠲⢭⡻⢿⣾⣿⣱⢫⡜⢧⢺⡟⣧⡟⣿⣿⠟⠋⠀⣀⣀⡈⠙⢾⣿⣝⢿⣽⡷⣯⣿⣿⣿⠀⠀⣹⠆⢻⡄⠀⠀⠀⠀⠈⠉⠉⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠙⠒⠦⣤⣀⡐⣀⠖⠁⠀⠀⠀⣿⣼⠚⡥⡑⢿⣂⢿⡧⡙⢆⠩⢼⣷⡌⢣⠼⣿⣧⢹⠰⢣⡱⢎⡱⢣⢻⣿⣯⢷⡈⢞⡰⢳⡀⠴⢊⣉⣤⣴⣶⣶⣦⣤⣽⣛⡻⢿⣧⠳⡜⣭⢺⣏⣷⡹⣿⡇⠀⡴⠋⠀⠀⠈⠢⡀⢹⣿⣷⣝⣿⣵⣿⣿⣿⡄⠀⣼⠁⠸⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠁⠀⠀⠀⠀⢰⣿⡏⡱⢢⣹⡞⣳⢺⣷⢉⡜⢌⡚⣿⣯⠒⣌⢻⣯⣧⡙⢦⡑⢎⡱⢍⡖⠦⢿⣧⢻⡔⣌⠣⢳⣴⣿⣿⣿⣿⣿⣿⠿⢿⣿⣿⣿⣿⣿⡱⣉⠦⣹⢶⣏⢷⣿⡇⢰⢥⣀⠀⠀⠀⠀⠱⡈⣿⣞⣿⣿⣛⣿⣿⣿⡇⠀⡾⠀⠀⣿⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣟⡧⣑⣳⠃⠀⢸⡆⣿⠆⡜⢢⠜⡹⡿⣷⣸⣮⢿⣯⣷⡂⣍⠲⡘⢢⠜⢣⡍⣿⣧⠙⢦⠩⣽⣿⡿⢛⣿⣿⣿⣿⣷⣶⣿⡄⠙⣿⣿⠶⢥⠚⣼⢻⣏⢾⡻⡇⡞⠳⣌⠱⣄⠐⠀⠀⡇⢹⣾⢿⣿⣿⣯⣿⣿⡇⢠⠃⠀⠀⣿⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⠟⢳⠀⠀⠀⠀⢸⣿⣷⢠⢿⠀⠀⠈⡧⣹⡗⣌⢣⢎⡱⢻⣿⣯⠰⡩⢧⡙⢿⣤⠣⣙⢢⠙⢦⡘⡜⢯⣷⡀⠛⠭⠖⠋⢸⣿⢿⣋⡿⠯⡟⣹⡇⢠⠋⣿⡘⠦⡙⣼⣿⡹⣾⣇⠃⣧⠤⠼⠃⠈⠢⣌⣠⠇⣼⣿⣿⣻⣿⣿⢿⣿⡷⠎⠀⠀⢰⡿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢿⠀⠈⠇⠀⠀⠀⢸⣽⢻⡌⣿⠀⠀⠀⢳⡔⢿⣌⠲⡌⣵⢏⢻⡽⣷⡠⢍⢳⡌⠻⣷⣈⠦⣙⠢⢜⣰⡭⠟⠙⠀⠀⠀⠀⠀⠻⣮⠉⠂⢀⣀⡿⠗⠙⠀⣽⢌⢣⡑⣾⣷⣽⡿⠁⠀⢿⣀⡤⣖⠒⢄⠀⠀⢠⣿⣾⣿⣿⣿⡿⠀⣿⣿⣄⠀⠀⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠸⡀⠀⠘⡄⠀⠀⠘⣾⠘⣷⢹⡄⠀⠀⠘⣇⠎⣿⡰⡽⢃⠎⣌⠿⣟⣷⣎⡴⡙⣦⡌⠻⢷⡦⠗⠋⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠛⠋⠉⠀⠀⠀⠀⠀⣿⢈⢦⡵⡿⠑⠋⠀⠀⠀⠈⣏⡧⠀⠙⠘⣀⠤⠞⠷⣿⣿⣿⣿⡇⠠⢿⠘⣟⣆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢣⠀⠀⠰⡄⠀⠀⣿⡇⢻⣞⣧⠀⠀⠀⢹⡎⡜⢿⡡⣉⠖⣩⣾⣿⣿⣿⢿⣿⣷⡿⠷⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢿⡾⠝⠋⠀⠀⠀⠀⠀⣠⠏⢉⠠⢄⡶⠋⠁⠀⠀⢀⣼⣿⢟⡿⠀⠀⡜⠀⠸⡞⣆⠀⠀⠀⠠⠷⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢆⠀⠀⠘⡄⠀⢸⡇⠜⣿⣻⡄⠀⠀⠀⢻⡰⣉⢷⣌⢲⣿⡟⣸⡏⣿⡿⣿⣿⣇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣧⠴⠃⡠⠊⠀⠀⠀⠀⣰⣿⣿⠏⣼⠃⠀⢠⠇⠀⠀⢻⠟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢆⠀⠀⠘⢆⠀⣷⠐⢿⣿⣷⠀⠀⠀⠈⣿⣔⣊⢻⣿⣿⣴⠞⢻⣟⢻⠜⠀⡹⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⠞⠁⠀⠀⠀⢀⣾⣿⣿⠋⢠⠃⠀⠀⠊⠀⠀⣀⠬⠤⠤⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢆⠀⠀⠀⠣⡈⣇⠀⢻⣿⡄⠀⠀⠀⢸⣿⣷⣆⣻⣿⠟⠢⢀⠙⢻⠶⠊⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⣿⣿⠋⠀⠀⠀⠀⢠⣾⣿⡿⠁⡰⠁⠀⠀⠀⡠⠔⠉⠀⠀⠀⠀⣸⠆⠀⠀⠀⠀⠀⠀⠀⠀⠀⡀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠣⡀⠀⠀⠑⢜⢧⡀⠻⣿⠀⠀⠀⠀⢿⣺⣻⢿⡀⠀⠀⠈⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣸⣿⣿⠃⠀⠀⠀⠀⢠⣿⣿⠏⠀⠀⠀⠀⢀⠴⠊⠀⠀⠀⠀⢀⡠⠚⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠁⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⡄⠀⠀⠈⠫⣷⣤⡹⣇⠀⠀⠀⠘⣷⢿⣾⡽⢦⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⠤⡴⠖⠚⠓⠓⢦⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⣿⣿⠏⠀⠀⠀⠀⢠⣿⡿⠁⠀⠀⠀⢀⠔⠁⠀⠀⠀⠀⢀⠔⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠤⢄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⢄⠀⠀⠀⠈⠙⢛⡋⠀⠀⠀⠀⠺⣿⣞⣿⣯⣿⣦⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⡭⠒⠉⠂⠉⠀⠁⠈⠘⡆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣾⣿⣿⡟⠀⠀⠀⠀⢠⠟⣹⣁⠀⠀⢀⠔⠁⠀⠀⠀⠀⢀⡔⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣆⠀⡑⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⠤⠔⠒⠈⢇⠀⠀⠀⠀⠁⠀⠀⠀⠀⠀⠀⠙⣿⣾⣽⣻⣿⠯⠗⠢⠀⠀⠀⠀⠀⠀⢰⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⢰⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠏⣸⣿⡿⠀⠀⠀⠀⢀⠏⠀⠋⠉⠓⡴⠃⠀⠀⠀⠀⠀⡠⠋⠀⠀⠀⠀⠀⠀⠀⠀⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢧⡀⢸⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡖⠉⠀⠀⠤⡔⠒⢺⢦⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⣿⣿⣻⣽⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠦⡀⠀⠀⠀⠀⠀⠀⣠⠏⠀⠀⠀⠀⠀⠀⠀⠀⢠⠞⡡⠎⣼⣿⠁⠀⠀⠀⠀⡎⠀⠀⠀⣠⠊⠀⠀⠀⠀⠀⣠⠊⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢳⡀⠀⠀⢀⠎⠙⠛⠒⠚⠓⠒⠉⠉⠑⢤⡀⠀⠀⠀⠈⣿⣿⣿⡾⣿⣷⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠑⠢⠤⠤⠒⠋⠀⠀⠀⠀⠀⠀⠀⠀⢠⡼⢋⠴⡁⠎⢼⠇⠀⠀⠀⠐⣸⠁⠀⢀⠔⠁⠀⠀⠀⠀⢠⠞⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣦⣠⠋⠘⢄⠀⠀⠳⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠢⣀⡀⠀⢹⣻⣿⣽⣻⣿⣿⣦⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠞⢣⠐⠥⢂⠅⣨⠏⠀⠀⠀⠀⠀⢿⠀⢠⠊⠀⠀⠀⠀⢀⣴⠁⠀⠀⠀⠀⣀⣤⡶⣞⡿⣏⣯⣝⡻⣷⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠙⢦⡀⠈⠳⡀⠀⠀⠑⠒⠰⢢⢶⡄⠀⠀⠀⠀⠀⠀⠉⠛⠉⣷⢺⡽⣿⣧⣽⣿⣿⣷⣦⣤⣄⣀⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣤⢚⠡⡘⠤⢉⢂⣡⡸⠃⠀⠀⠀⠀⠀⠐⠚⡷⠃⠀⠀⠀⠀⢠⠞⠀⠀⢀⣠⣶⠿⣏⣷⡻⣵⣻⢞⡵⢮⡱⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠢⡀⠈⠢⢤⣤⡴⣴⣯⣍⡿⡦⣀⠀⠀⠀⠀⠀⠀⠀⢹⣻⢼⡳⣿⢯⣟⣯⢟⣿⡛⠛⠉⣡⠮⣍⣹⠓⢶⡦⠤⣀⣀⡤⠖⠋⠰⠘⠒⠋⠉⠉⠉⡰⠁⠀⠀⠀⠀⠀⠀⠀⠈⢁⡤⠒⠲⡄⣰⠃⠀⡠⠒⣽⢯⣏⡿⡽⣶⢻⣳⡝⣮⡝⣮⢵⡿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⢀⣀⣀⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⣀⣀⠈⠱⡤⠤⠤⠴⠒⠲⠚⢹⡑⡌⠳⡆⠀⠀⠀⠀⠀⢸⣽⢣⠿⣽⡿⡾⣽⢺⡜⣇⠀⢷⢧⡐⢠⠃⡍⡐⢧⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡠⣄⡜⠁⠀⠀⠀⠀⠀⠀⠀⡠⠖⠁⠀⠀⣴⠘⢧⠔⠉⠀⣸⣟⢮⣗⣻⡽⣞⢯⣓⢾⡱⣞⣥⡿⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⢮⣄⠀⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⠤⠖⠚⠉⠙⠇⠀⠈⠋⠹⣇⠀⠀⠀⠀⠀⠀⠈⡇⠀⠀⠙⠀⠀⠀⠀⠀⣿⡜⣫⣟⣵⠟⠛⢳⠿⠾⣟⡷⡌⠳⣻⡏⠲⣤⠑⢺⡄⠀⠀⢀⡤⢦⠀⣠⠞⢁⣴⡫⠔⠒⠒⠢⢄⠀⢀⡤⠊⠀⠀⠀⢀⣴⠃⠀⠈⢧⡀⠀⢻⣞⢯⡞⣧⢻⡜⣮⢝⣮⢳⢧⣾⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠈⠙⠆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣸⠥⠒⠒⠋⣉⣽⡆⠀⠀⠀⠀⠹⣆⠀⠀⠀⠀⠀⠀⠹⡄⠀⠀⠀⠀⠀⠀⣸⡧⢫⡟⠉⠓⡦⢞⣫⡿⠟⠛⠓⠚⢒⡿⣅⠀⠈⢳⡈⡇⢀⠜⠁⠀⢸⡞⡡⠊⠁⠀⠀⠀⠀⠀⠀⠀⠉⠚⠤⣀⠀⠀⢀⡼⣏⢀⡤⠶⢌⣷⡀⢸⣿⢫⡞⣵⢣⣟⣼⠯⣞⡭⣾⠇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⠀⠠⠄⠀⠀⠠⠀⣤⠀⢀⣸⠤⠔⠂⠙⠋⠀⣇⠀⠀⠀⢨⢐⡽⠙⠢⢄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠂⣿⣷⠛⠶⣦⠟⣱⡿⠉⠀⠀⠀⣀⣀⣀⣬⠾⢆⠀⠀⢳⡿⠃⠀⠀⠀⢀⡼⠀⠀⠀⠀⠀⢀⣀⠀⠀⠀⠀⣀⠀⠀⠉⣷⣩⠖⠋⠉⠀⠀⠈⢧⣿⢻⡜⣧⣻⠼⣛⠭⣎⢻⡜⣼⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠠⠀⠀⠀⠀⢀⠤⠒⠉⠀⠀⠀⠀⠀⠀⠀⠀⢓⠊⠁⠀⠀⠀⠀⠀⠠⠁⡏⠀⠀⢀⣊⡞⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣸⣿⣏⣀⣴⢣⣾⠏⠀⠡⢉⡬⠛⠉⠀⠀⠈⠑⠺⣧⣤⠈⠁⠀⠀⢀⠴⢊⡇⠀⠀⠀⠀⠀⣀⠼⡏⠓⣲⠲⠤⣵⣲⢾⠋⡀⠀⠀⠀⣠⠆⠀⠈⢿⡷⡛⢩⠐⡍⢎⡳⡜⣣⢞⣹⣇⣀⠤⠾⢛⣿⡿⣟⣷⢲⣄⡀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡠⠊⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⠀⠀⠀⠀⠀⠀⠀⢀⠂⡇⠀⢐⣿⡏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⣾⣿⠃⠀⣹⢡⢯⠇⠀⣬⠖⠉⠀⠀⠀⠀⠀⢀⣠⣴⣿⣿⣿⠶⠀⣾⣿⠶⣾⠀⠀⠀⠀⠐⠞⠁⡐⢻⡀⠳⠖⠚⢩⡴⠃⡔⠸⣰⠖⠛⠳⣄⠠⠀⢨⣏⠹⣉⠟⠺⠶⣥⢳⣑⢮⡜⣻⣤⢦⡴⣾⢯⣗⢯⡞⣧⣛⢿⡀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⢠⠎⠀⠀⠀⠀⠀⠀⠀⠀⢀⡠⠔⣲⠀⠀⢸⡄⠀⠀⠀⠀⠀⡤⠀⢸⣇⡴⠋⠸⢀⣀⠠⠤⠤⠢⢤⡤⡀⣀⣤⣶⠏⠉⣩⣿⣿⣟⢻⢡⢏⣎⠴⠋⠀⠀⠀⠀⣀⣤⣴⣾⣿⣿⣿⣿⣿⣿⡆⠀⠰⡀⠀⡇⠀⠀⠀⠀⠀⠀⠀⠁⢼⠆⠀⠀⠀⢯⣠⣼⠥⠞⢁⠀⠀⠀⠉⠃⣴⢋⠆⣓⠰⢊⡑⠦⡈⠝⣯⣾⡽⣽⢿⣶⣽⡿⡹⢎⡿⡜⢧⡹⡚⡇⠀
+⠀⠀⠀⠀⠀⠀⠀⠰⡅⠀⠀⠀⠀⢀⡀⠤⠔⠂⠁⣠⠞⠉⡇⠀⠈⡷⠀⠀⠀⠀⡼⠁⣰⡟⠋⠀⣴⠟⠁⠀⠀⠀⢀⡀⡼⣲⠿⣛⠵⠎⢀⣴⡿⡟⠁⣈⡏⡼⡛⠁⠀⢀⣠⣴⣶⡿⠟⣫⣽⣿⣿⡏⠉⣿⡟⣿⣷⠀⠀⠉⠙⡇⠀⠀⠀⠀⠀⠀⠀⠀⢸⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⠟⡤⢋⠜⡠⢍⢢⠑⢢⠑⡌⡐⢻⡴⣩⢖⡎⢶⣱⣙⢧⡚⣭⠲⣡⢃⢷⡠
+⠀⠀⠀⠀⠀⣀⠤⠤⠽⢭⠉⠉⠉⠀⠀⠀⢀⣴⠞⠋⠀⠀⣇⠀⠀⢿⠀⡀⣀⣨⣵⠞⠁⡀⠠⢼⣧⡦⠶⠖⠚⣻⠉⣼⢳⢋⡞⣱⣮⣶⡿⠋⢀⣧⡵⢻⠀⣧⣧⣶⣿⠿⠛⠋⠀⣰⣾⣿⢿⣿⡟⠀⢰⣿⠇⢻⣿⡄⠀⠀⠀⢣⠀⠀⠀⠀⠀⠀⠀⠀⠈⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠞⣡⠚⡄⢃⠎⡑⠈⠆⡉⢆⠱⢠⠑⠄⢻⡵⢎⣞⢣⡗⡺⣖⡹⢆⡻⢄⠣⢾⡱
+⣀⠀⠠⢊⠉⠀⣀⣠⠖⢹⠆⠀⠀⢀⠠⢔⠛⠁⠀⠀⠀⠀⢻⠀⡀⢾⡈⣭⡵⢾⢥⠀⠐⠀⠀⢸⣆⣠⢴⣴⣫⣇⣼⣏⣴⡿⠿⠟⠛⠉⠀⠀⡏⠉⠉⢹⠀⠻⣿⡍⠤⠒⢀⣠⣾⣿⠏⢡⣾⠟⠀⢀⣿⡿⠀⢸⣿⣧⠀⠀⠀⢸⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣴⠞⡡⢩⠄⠣⠘⠠⠈⠄⠁⠂⠈⠄⠊⠤⢉⡐⠂⣿⡹⣬⠳⡞⡵⣭⣹⠹⡜⡭⢊⡽⠀

package/src/runtime/rose-context.ts

@@ -14,7 +14,7 @@ export function buildRoseAppendix(event: BeforeAgentStartEvent, pi: ExtensionAPI
   const conflictState = conflicts.length === 0
     ? "lifecycle_conflicts=none-observed"
     : `lifecycle_conflicts=non-pass (${conflicts.map((conflict) => conflict.name).join(", ")})`;
-  return `## AILI runtime summary\n- ${projectRuleState(event)}\n- ${conflictState}\n- rose_static_rules=global APPEND_SYSTEM marker resource (not injected by this Extension)\n- task_runtime=pi-subagent adapter (global AILI profiles required; concurrency 2; no resume/chain/background/worktree/recursion)\n- permission_runtime=pi-permission-modes (Default/Plan/Build/YOLO; /perm; Alt+M; sandbox availability is vendor-reported)\n- native_web=pi-web-access complete upstream surface; provider/network/filesystem side effects remain visible to the active permission policy\n- quota_status=pi-quota-status default enabled; its global state is maintained by the upstream extension\n- capability_registry=available; optional or unavailable capability decisions must report SKIP/WARN and must not claim work ran\n- doctor=available (/aili-doctor; current core remains non-pass until required provenance and release evidence pass)`;
+  return `## AILI runtime summary\n- ${projectRuleState(event)}\n- ${conflictState}\n- rose_static_rules=global APPEND_SYSTEM marker resource (not injected by this Extension)\n- task_runtime=generic pinned pi-subagent surface (optional global aili.<role> profiles; async/actions, bounded upstream fan-out, worktree/external cwd, and sandbox configuration available; credential paths remain denied)\n- permission_runtime=pi-permission-modes (Default/Plan/Build/YOLO; /perm; Alt+M; sandbox availability is vendor-reported)\n- native_web=pi-web-access complete upstream surface; provider/network/filesystem side effects remain visible to the active permission policy\n- quota_status=pi-quota-status default enabled; its global state is maintained by the upstream extension\n- capability_registry=available; optional or unavailable capability decisions must report SKIP/WARN and must not claim work ran\n- doctor=available (/aili-doctor; current core remains non-pass until required provenance and release evidence pass)`;
 }
 
 export function registerRoseContext(pi: ExtensionAPI): void {