@rubytech/create-maxy-code 0.1.286 → 0.1.288

package/payload/platform/scripts/__tests__/prompt-optimiser-audit.test.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Reconciliation audit for the per-turn directive store (Task 746). For each
+# session it emits `[prompt-optimiser-audit] session=<id> injected=<N> stored=<M>`
+# (N = breadcrumb lines, M = content files) and names any breadcrumb whose
+# file= path is missing on disk (the precise silent loss).
+set -u
+SCRIPT="$(cd "$(dirname "$0")/.." && pwd)/prompt-optimiser-audit.sh"
+[[ -x "$SCRIPT" ]] || { echo "FAIL: $SCRIPT not executable" >&2; exit 1; }
+PASS=0; FAIL=0
+
+LD=$(mktemp -d)
+mkdir -p "$LD/prompt-optimiser-directives/sessA"
+f1="$LD/prompt-optimiser-directives/sessA/100-11.txt"; printf 'one' > "$f1"
+f2="$LD/prompt-optimiser-directives/sessA/101-12.txt"; printf 'two' > "$f2"
+crumb="$LD/prompt-optimiser-directive.log"
+printf 'T [prompt-optimiser-directive] injected len=3 sha256=x file=%s session=sessA\n' "$f1" >> "$crumb"
+printf 'T [prompt-optimiser-directive] injected len=3 sha256=y file=%s session=sessA\n' "$f2" >> "$crumb"
+
+# Healthy: 2 breadcrumbs, 2 files.
+out=$(bash "$SCRIPT" --log-dir "$LD" sessA 2>/dev/null)
+if printf '%s' "$out" | grep -q "\[prompt-optimiser-audit\] session=sessA injected=2 stored=2"; then
+  echo "PASS: healthy session reconciles injected==stored"; PASS=$((PASS+1))
+else
+  echo "FAIL: healthy reconcile wrong: $out" >&2; FAIL=$((FAIL+1))
+fi
+
+# Leak: delete one content file -> injected=2 stored=1 + a missing-file line.
+rm -f "$f2"
+out=$(bash "$SCRIPT" --log-dir "$LD" sessA 2>/dev/null)
+if printf '%s' "$out" | grep -q "session=sessA injected=2 stored=1" \
+   && printf '%s' "$out" | grep -q "missing-file=$f2"; then
+  echo "PASS: deleted file flagged as leak (injected>stored + missing-file)"; PASS=$((PASS+1))
+else
+  echo "FAIL: leak not flagged: $out" >&2; FAIL=$((FAIL+1))
+fi
+
+# No argument -> walks every session in the breadcrumb log.
+printf 'T [prompt-optimiser-directive] injected len=1 sha256=z file=- session=sessB\n' >> "$crumb"
+out=$(bash "$SCRIPT" --log-dir "$LD" 2>/dev/null)
+if printf '%s' "$out" | grep -q "session=sessA " && printf '%s' "$out" | grep -q "session=sessB "; then
+  echo "PASS: no-arg mode walks all sessions"; PASS=$((PASS+1))
+else
+  echo "FAIL: no-arg mode missed a session: $out" >&2; FAIL=$((FAIL+1))
+fi
+# An explicitly-named session with no breadcrumbs reconciles cleanly to 0==0 on
+# a single line (regression: grep -c's exit-1 must not double-emit "0\n0").
+out=$(bash "$SCRIPT" --log-dir "$LD" sessZ 2>/dev/null); rc=$?
+nlines=$(printf '%s\n' "$out" | grep -c 'session=sessZ injected=')
+if [[ "$rc" -eq 0 ]] \
+   && printf '%s' "$out" | grep -Fqx "[prompt-optimiser-audit] session=sessZ injected=0 stored=0" \
+   && [[ "$nlines" -eq 1 ]]; then
+  echo "PASS: empty named session -> single clean injected=0 stored=0, rc=0"; PASS=$((PASS+1))
+else
+  echo "FAIL: empty named session mis-reported (rc=$rc lines=$nlines out=$out)" >&2; FAIL=$((FAIL+1))
+fi
+rm -rf "$LD"
+
+echo "----"; echo "PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/scripts/__tests__/resume-tunnel.test.sh

@@ -1,5 +1,8 @@
 #!/usr/bin/env bash
-# Tests for resume-tunnel.sh scope-based spawn path (Task 602).
+# Tests for resume-tunnel.sh supervised-service spawn path (Task 602 + Task 757).
+# Task 602 decoupled the connector into its own transient unit under
+# cloudflared.slice; Task 757 changed that unit from a --scope (no restart
+# policy) to a --service with Restart=always and --no-autoupdate.
 # Stubs systemd-run, systemctl, and cloudflared binaries via a fake $PATH entry.
 set -uo pipefail
 
@@ -80,10 +83,12 @@ exit 0
 SH
   chmod +x "$bin_dir/systemctl"
 
-  # Stub systemd-run: logs its --unit= and --slice= args, optionally writes connection line.
+  # Stub systemd-run: echoes every arg (so tests can assert the unit name, slice,
+  # restart properties, and the connector argv), optionally writes connection line.
   cat > "$bin_dir/systemd-run" <<SH
 #!/bin/bash
 for arg in "\$@"; do
+  echo "[stub] arg=\$arg"
   case "\$arg" in
     --unit=*) echo "[stub] unit=\${arg#--unit=}" ;;
     --slice=*) echo "[stub] slice=\${arg#--slice=}" ;;
@@ -120,7 +125,7 @@ case_skip_when_scope_active() {
   if [[ $rc -ne 0 ]]; then
     echo "  expected exit 0, got $rc"; return 1
   fi
-  if ! echo "$log_content" | grep -q "already running.*scope.*cloudflared-maxy-code"; then
+  if ! echo "$log_content" | grep -q "already running.*service.*cloudflared-maxy-code.service"; then
     echo "  skip branch missing expected log line"
     echo "$log_content"
     return 1
@@ -149,8 +154,8 @@ case_spawn_succeeds() {
   if [[ $rc -ne 0 ]]; then
     echo "  expected exit 0, got $rc"; return 1
   fi
-  if ! echo "$log_content" | grep -q "spawned scope=cloudflared-maxy-code.scope"; then
-    echo "  missing spawned scope log line"; echo "$log_content"; return 1
+  if ! echo "$log_content" | grep -q "spawned service=cloudflared-maxy-code.service"; then
+    echo "  missing spawned service log line"; echo "$log_content"; return 1
   fi
   if ! echo "$log_content" | grep -q "tunnel verified"; then
     echo "  missing tunnel verified log line"; echo "$log_content"; return 1
@@ -186,7 +191,7 @@ case_spawn_no_connection() {
   return 0
 }
 
-# CASE 4: scope unit name derived correctly from configDir (.real-agent → cloudflared-real-agent.scope)
+# CASE 4: service unit name derived correctly from configDir (.real-agent → cloudflared-real-agent.service)
 case_scope_unit_name_from_config_dir() {
   local root
   root=$(mktemp -d /tmp/resume-tunnel-test-XXXXXX)
@@ -207,8 +212,8 @@ case_scope_unit_name_from_config_dir() {
   if [[ $rc -ne 0 ]]; then
     echo "  expected exit 0, got $rc"; return 1
   fi
-  if ! echo "$log_content" | grep -q "spawned scope=cloudflared-real-agent.scope"; then
-    echo "  scope unit name not derived correctly from .real-agent"
+  if ! echo "$log_content" | grep -q "spawned service=cloudflared-real-agent.service"; then
+    echo "  service unit name not derived correctly from .real-agent"
     echo "$log_content"; return 1
   fi
   return 0
@@ -240,11 +245,43 @@ case_slice_flag_present() {
   return 0
 }
 
-run_case "skip when scope active" case_skip_when_scope_active
+# CASE 6: supervision contract — Restart=always, crash-loop limits, --no-autoupdate,
+# and the unit is a .service (Task 757), all reaching systemd-run.
+case_supervision_contract() {
+  local root
+  root=$(mktemp -d /tmp/resume-tunnel-test-XXXXXX)
+  setup "$root" ".maxy-code" "inactive" "yes"
+
+  local log="$root/home/.maxy-code/logs/cloudflared.log"
+
+  HOME="$root/home" \
+  PATH="$root/bin:$PATH" \
+  MAXY_PLATFORM_ROOT="$root/platform_root" \
+    bash "$RESUME"
+
+  local log_content
+  log_content=$(cat "$log" 2>/dev/null || echo "")
+  cleanup "$root"
+
+  local missing=""
+  echo "$log_content" | grep -q "\[stub\] arg=--unit=cloudflared-maxy-code.service" || missing="$missing unit=.service"
+  echo "$log_content" | grep -q "\[stub\] arg=Restart=always" || missing="$missing Restart=always"
+  echo "$log_content" | grep -q "\[stub\] arg=StartLimitIntervalSec=300" || missing="$missing StartLimitIntervalSec"
+  echo "$log_content" | grep -q "\[stub\] arg=StartLimitBurst=5" || missing="$missing StartLimitBurst"
+  echo "$log_content" | grep -q "\[stub\] arg=--no-autoupdate" || missing="$missing --no-autoupdate"
+  if [[ -n "$missing" ]]; then
+    echo "  systemd-run argv missing:$missing"
+    echo "$log_content"; return 1
+  fi
+  return 0
+}
+
+run_case "skip when service active" case_skip_when_scope_active
 run_case "spawn succeeds and logs verified" case_spawn_succeeds
 run_case "spawn with no connection logs ERROR exits 0" case_spawn_no_connection
-run_case "scope unit name derived from configDir" case_scope_unit_name_from_config_dir
+run_case "service unit name derived from configDir" case_scope_unit_name_from_config_dir
 run_case "slice flag passed to systemd-run" case_slice_flag_present
+run_case "supervision contract: restart-always + no-autoupdate + .service" case_supervision_contract
 
 echo ""
 echo "Results: $PASS passed, $FAIL failed"

package/payload/platform/scripts/installer-device-verify.sh

@@ -229,11 +229,82 @@ REMOTE
   CHECK_RC=$?
   set -e
 
-  if [[ $CHECK_RC -eq 0 ]]; then
-    echo "OK    $NAME — CDP banner present" | tee -a "$SUMMARY_LOG"
-  else
+  if [[ $CHECK_RC -ne 0 ]]; then
     echo "FAIL  $NAME — CDP banner missing (rc=$CHECK_RC, see $SUMMARY_LOG)" | tee -a "$SUMMARY_LOG"
     FAILED=1
+    continue
+  fi
+
+  # Step 3 — standing Samba socket audit (Task 755). Reconcile the *actual*
+  # listening sockets against the bind invariant, independent of any install
+  # log, so this catches a drifted or re-opened box as well as a fresh
+  # mis-provision. Two assertions:
+  #   • smbd (TCP :445/:139) listens only on loopback or a private LAN address.
+  #     A public or wildcard (0.0.0.0 / [::] / public IP) listener is internet
+  #     exposure — the BSI-reported defect. Private LAN listeners are expected
+  #     on a Pi (LAN+loopback); loopback-only is expected on a cloud box. The
+  #     private-vs-public test mirrors isPrivateIPv4() in samba-provision.ts.
+  #   • nmbd is not active (the NetBIOS DDoS-reflection service is never run).
+  # Matched by port, so no root is needed to read process names.
+  #
+  # Loaded via `read -d ''` rather than `$(cat <<…)`: the audit body contains a
+  # `case` and process substitution, whose parens break bash 3.2's command-
+  # substitution scanner (operators may run this script from a macOS bash 3.2).
+  # The body itself runs on the device's modern bash over ssh.
+  IFS= read -r -d '' SOCKET_AUDIT <<'REMOTE' || true
+set -uo pipefail
+
+is_private_v4() {
+  local ip="$1" a b _rest
+  IFS=. read -r a b _rest <<<"$ip"
+  [[ "$a" =~ ^[0-9]+$ && "$b" =~ ^[0-9]+$ ]] || return 1
+  (( a == 10 )) && return 0
+  (( a == 172 && b >= 16 && b <= 31 )) && return 0
+  (( a == 192 && b == 168 )) && return 0
+  (( a == 100 && b >= 64 && b <= 127 )) && return 0
+  (( a == 169 && b == 254 )) && return 0
+  return 1
+}
+
+BAD=""
+while read -r localaddr; do
+  [[ -z "$localaddr" ]] && continue
+  host="${localaddr%:*}"                  # strip :port
+  host="${host#'['}"; host="${host%']'}"  # strip IPv6 brackets (quoted: '[' is a glob class)
+  case "$host" in
+    127.*|::1) continue ;;             # loopback — allowed
+  esac
+  if [[ "$host" == *.*.*.* ]] && is_private_v4 "$host"; then
+    continue                           # private IPv4 LAN (Pi) — allowed
+  fi
+  BAD+="$localaddr"$'\n'
+done < <(ss -tuln 2>/dev/null | awk '{print $5}' | grep -E ':(445|139)$' || true)
+
+NMBD=$(systemctl is-active nmbd 2>/dev/null || true)
+FAIL=0
+if [[ -n "${BAD//$'\n'/}" ]]; then
+  echo "smbd-exposed-listener:"
+  printf '%s' "$BAD"
+  FAIL=1
+fi
+if [[ "$NMBD" == "active" ]]; then
+  echo "nmbd-active"
+  FAIL=1
+fi
+[[ $FAIL -eq 0 ]] && echo "socket-audit-ok smbd=loopback-or-private nmbd=$NMBD"
+exit $FAIL
+REMOTE
+
+  set +e
+  run_ssh "$TARGET" "$PASS" "$SOCKET_AUDIT" >>"$SUMMARY_LOG" 2>&1
+  AUDIT_RC=$?
+  set -e
+
+  if [[ $AUDIT_RC -eq 0 ]]; then
+    echo "OK    $NAME — CDP banner present; smbd loopback/LAN-only, nmbd inactive" | tee -a "$SUMMARY_LOG"
+  else
+    echo "FAIL  $NAME — Samba socket audit failed (rc=$AUDIT_RC, see $SUMMARY_LOG)" | tee -a "$SUMMARY_LOG"
+    FAILED=1
   fi
 done
 

package/payload/platform/scripts/prompt-optimiser-audit.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# prompt-optimiser-audit.sh — reconcile per-turn directive-injection breadcrumbs
+# against the stored content files (Task 746). A missing content write emits no
+# error on its own, so this standing check is the leak detector: for each
+# session it prints
+#   [prompt-optimiser-audit] session=<id> injected=<N> stored=<M>
+# where N is the count of breadcrumb injection lines and M is the count of
+# content files. N != M is the leak signature. Every breadcrumb whose file=
+# path is absent on disk is named on its own `missing-file=` line.
+#
+# Usage:
+#   prompt-optimiser-audit.sh [--log-dir <dir>] [<session_id>]
+# With no <session_id> it walks every session that appears in the breadcrumb
+# log. --log-dir overrides the resolved account logs dir (used by tests); the
+# default resolves the single account's logs dir, the same dir the hook writes.
+#
+# Exit codes:
+#   0  every reported session reconciles (injected == stored)
+#   1  at least one session leaks (injected != stored)
+#   2  no log dir could be resolved
+set -uo pipefail
+
+LOG_DIR=""
+SESSION=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --log-dir) LOG_DIR="$2"; shift 2 ;;
+    *) SESSION="$1"; shift ;;
+  esac
+done
+
+# Resolve the account logs dir when not overridden: {installDir}/data/accounts/*/logs.
+if [ -z "$LOG_DIR" ]; then
+  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  PLATFORM_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+  INSTALL_DIR="$(dirname "$PLATFORM_ROOT")"
+  for d in "$INSTALL_DIR"/data/accounts/*/logs; do
+    [ -d "$d" ] && LOG_DIR="$d" && break
+  done
+fi
+if [ -z "$LOG_DIR" ] || [ ! -d "$LOG_DIR" ]; then
+  echo "[prompt-optimiser-audit] no-log-dir resolved=${LOG_DIR:-<none>}" >&2
+  exit 2
+fi
+
+CRUMB="$LOG_DIR/prompt-optimiser-directive.log"
+STORE_ROOT="$LOG_DIR/prompt-optimiser-directives"
+
+# Sessions to report: the explicit arg, else every distinct non-"?" session in
+# the breadcrumb log (the breadcrumb's session= is always the last field).
+sessions() {
+  if [ -n "$SESSION" ]; then
+    echo "$SESSION"; return
+  fi
+  [ -f "$CRUMB" ] || return
+  grep -o 'session=[^ ]*$' "$CRUMB" 2>/dev/null | cut -d= -f2 | grep -v '^?$' | sort -u
+}
+
+rc=0
+while IFS= read -r sid; do
+  [ -n "$sid" ] || continue
+  injected=0
+  # grep -c prints a count AND exits 1 on zero matches, so a `|| echo 0` would
+  # double-emit "0\n0"; capture the count and default an empty/unreadable file.
+  if [ -f "$CRUMB" ]; then
+    injected=$(grep -c "session=$sid\$" "$CRUMB" 2>/dev/null)
+    injected=${injected:-0}
+  fi
+  stored=0
+  [ -d "$STORE_ROOT/$sid" ] && stored=$(find "$STORE_ROOT/$sid" -maxdepth 1 -name '*.txt' 2>/dev/null | wc -l | tr -d ' ')
+  echo "[prompt-optimiser-audit] session=$sid injected=$injected stored=$stored"
+  [ "$injected" != "$stored" ] && rc=1
+  # Name every breadcrumb whose stored file is absent.
+  if [ -f "$CRUMB" ]; then
+    grep "session=$sid\$" "$CRUMB" 2>/dev/null | grep -o 'file=[^ ]*' | cut -d= -f2- | while IFS= read -r f; do
+      [ "$f" = "-" ] && continue
+      [ -e "$f" ] || echo "[prompt-optimiser-audit] session=$sid missing-file=$f"
+    done
+  fi
+done < <(sessions)
+
+exit "$rc"

package/payload/platform/scripts/resume-tunnel.sh

@@ -1,9 +1,15 @@
 #!/bin/bash
 # resume-tunnel.sh — Resume the Cloudflare tunnel on brand-service start.
 #
-# Spawns cloudflared into its own transient systemd scope (cloudflared-<brand>.scope)
+# Spawns cloudflared into its own transient systemd SERVICE (cloudflared-<brand>.service)
 # under cloudflared.slice, completely decoupled from the brand service's cgroup.
-# A brand-service restart can no longer reap the tunnel. Task 602.
+# A brand-service restart can no longer reap the tunnel (Task 602's cgroup
+# decoupling). The unit is a Restart=always service (Task 757), so systemd
+# resurrects the connector on ANY exit — crash, OOM, manual kill — and the
+# connector runs with --no-autoupdate so it never replaces itself; the binary
+# version is installer-owned. This is still the single spawner: only the unit
+# type changed from a transient --scope (no restart policy) to a supervised
+# --service. No second spawner is introduced.
 #
 # Called as ExecStartPre in maxy.service. All failures exit 0 — this script must
 # never prevent maxy.service from starting.
@@ -49,16 +55,16 @@ if [ -z "$TUNNEL_ID" ]; then
   exit 0
 fi
 
-# Derive scope unit name: strip leading dot from CONFIG_DIR.
-# .maxy-code → cloudflared-maxy-code.scope
+# Derive service unit name: strip leading dot from CONFIG_DIR.
+# .maxy-code → cloudflared-maxy-code.service
 BRAND="${CONFIG_DIR#.}"
-SCOPE_UNIT="cloudflared-${BRAND}.scope"
+SERVICE_UNIT="cloudflared-${BRAND}.service"
 
-# Liveness check: query the scope unit state, not a recorded PID.
-# The scope is owned by user-systemd, fully outside the brand service's cgroup.
-if systemctl --user is-active "$SCOPE_UNIT" >/dev/null 2>&1; then
-  SCOPE_PID=$(systemctl --user show "$SCOPE_UNIT" --property=MainPID --value 2>/dev/null || echo "unknown")
-  log "Tunnel already running (scope $SCOPE_UNIT active, MainPID $SCOPE_PID) — skipping resume"
+# Liveness check: query the service unit state, not a recorded PID.
+# The service is owned by user-systemd, fully outside the brand service's cgroup.
+if systemctl --user is-active "$SERVICE_UNIT" >/dev/null 2>&1; then
+  SERVICE_PID=$(systemctl --user show "$SERVICE_UNIT" --property=MainPID --value 2>/dev/null || echo "unknown")
+  log "Tunnel already running (service $SERVICE_UNIT active, MainPID $SERVICE_PID) — skipping resume"
   exit 0
 fi
 
@@ -82,26 +88,37 @@ log "Resuming tunnel $TUNNEL_ID for $DOMAIN..."
 mkdir -p "$LOG_DIR"
 LOG_OFFSET=$(wc -c < "$LOG_FILE" 2>/dev/null | awk '{print $1+0}' || echo 0)
 
-# Spawn into a transient scope under cloudflared.slice.
-# The scope is owned by user-systemd, not by the brand service's cgroup.
-# systemd-run --scope blocks until cloudflared exits (it is the scope leader),
-# so we background it. $? after & is always 0 (fork success); the verification
-# gate below detects actual spawn failures via connection timeout.
-# stdout/stderr of cloudflared append to LOG_FILE via the redirect.
+# Spawn into a SUPERVISED transient service under cloudflared.slice (Task 757).
+# Unlike a --scope (no restart policy), a Restart=always service is resurrected
+# by systemd on ANY exit — crash, OOM, manual kill. --no-autoupdate stops the
+# connector replacing its own binary, so the version stays installer-owned.
+# StartLimitIntervalSec/StartLimitBurst trip a genuinely broken binary to
+# `failed` instead of looping forever (5 starts within 300s → failed).
+# A service's stdout/stderr go to the journal, not this shell, so route them to
+# LOG_FILE via StandardOutput/StandardError=append so the verification gate
+# below and the operator's cloudflared.log keep working. systemd-run returns
+# once the unit is active (it does not block for the process lifetime), so there
+# is no shell child to background. --quiet suppresses systemd-run's "Running as
+# unit:" line; the trailing redirect only captures any error output it prints.
 systemd-run \
   --user \
-  --scope \
   --quiet \
-  --unit="$SCOPE_UNIT" \
+  --unit="$SERVICE_UNIT" \
   --slice=cloudflared \
+  -p Restart=always \
+  -p RestartSec=2 \
+  -p StartLimitIntervalSec=300 \
+  -p StartLimitBurst=5 \
   -p TimeoutStopSec=15 \
+  -p "StandardOutput=append:$LOG_FILE" \
+  -p "StandardError=append:$LOG_FILE" \
   -- \
-  "$CLOUDFLARED_BIN" --origincert "$CERT_PATH" --config "$CONFIG_PATH" tunnel run \
-  >> "$LOG_FILE" 2>&1 &
+  "$CLOUDFLARED_BIN" --no-autoupdate --origincert "$CERT_PATH" --config "$CONFIG_PATH" tunnel run \
+  >> "$LOG_FILE" 2>&1
 
-# Log spawn receipt so the operator can distinguish the scoped path from legacy nohup.
-SCOPE_PID=$(systemctl --user show "$SCOPE_UNIT" --property=MainPID --value 2>/dev/null || echo "unknown")
-log "spawned scope=$SCOPE_UNIT slice=cloudflared main-pid=$SCOPE_PID"
+# Log spawn receipt so the operator can distinguish the supervised path from legacy nohup.
+SERVICE_PID=$(systemctl --user show "$SERVICE_UNIT" --property=MainPID --value 2>/dev/null || echo "unknown")
+log "spawned service=$SERVICE_UNIT slice=cloudflared main-pid=$SERVICE_PID"
 
 # Post-spawn connection verification gate.
 # Polls only new log content (from LOG_OFFSET onwards) to avoid false positives
@@ -127,16 +144,16 @@ done
 if [ "$VERIFIED" -eq 1 ]; then
   ELAPSED=$(( $(date +%s) - VERIFY_START ))
   CONN_COUNT=$(tail -c "+$((LOG_OFFSET + 1))" "$LOG_FILE" 2>/dev/null | grep -c "Registered tunnel connection" || echo "?")
-  log "tunnel verified scope=$SCOPE_UNIT connections=$CONN_COUNT ms=$(( ELAPSED * 1000 ))"
+  log "tunnel verified service=$SERVICE_UNIT connections=$CONN_COUNT ms=$(( ELAPSED * 1000 ))"
 else
-  log "ERROR: tunnel scope started but no edge connection within ${VERIFY_DEADLINE}s — scope=$SCOPE_UNIT"
+  log "ERROR: tunnel service started but no edge connection within ${VERIFY_DEADLINE}s — service=$SERVICE_UNIT"
 fi
 
-# Update state file: keep pid/startedAt for observability, add scopeUnit as control signal.
+# Update state file: keep pid/startedAt for observability, add serviceUnit as control signal.
 NEW_STATE=$(echo "$STATE" | jq \
-  --arg unit "$SCOPE_UNIT" \
+  --arg unit "$SERVICE_UNIT" \
   --argjson ts "$(date +%s)000" \
-  '.scopeUnit = $unit | .startedAt = $ts' 2>/dev/null || echo "")
+  '.serviceUnit = $unit | .startedAt = $ts' 2>/dev/null || echo "")
 
 if [ -n "$NEW_STATE" ] && echo "$NEW_STATE" > "$STATE_FILE.tmp" 2>/dev/null && mv "$STATE_FILE.tmp" "$STATE_FILE" 2>/dev/null; then
   :

package/payload/platform/services/whatsapp-channel/dist/notification.d.ts

@@ -16,16 +16,34 @@ export interface InboundPayload {
      *  mirror of platform/ui's MediaRef — this package never cross-imports it. */
     media: MediaInbound[];
 }
+/**
+ * Task 753 — the standing select-and-dispatch instruction prepended to every
+ * channel turn. The inbound message is demoted to payload and the turn becomes
+ * a routing question: pick the owning specialist (dispatch via the Agent tool),
+ * else load the owning skill, else answer directly. Freestyle inline authoring
+ * is the `direct` floor, reached only when nothing owns the work — which is why
+ * a greeting/confirmation needs no separate skip: it falls through to `direct`.
+ * Exported so the unit tests assert the exact wrapped shape.
+ */
+export declare const REFRAME_PREFIX: string;
+/** Task 753 — the reframe decision for one inbound: the wrapped `content` the
+ *  agent receives, and `payloadBytes`, the byte length of the inner payload
+ *  (message + woven media notes, excluding the wrapper) for the observability
+ *  line. */
+export interface ComposedInbound {
+    content: string;
+    payloadBytes: number;
+}
 /**
  * Shape an inbound WhatsApp payload as a Claude Code channel notification.
  *
- * The event carries ONLY the message text — no `meta`. The sender, session id,
- * and WhatsApp message id are all held server-side (the reply is pinned to the
- * server's fixed sender), so none of it needs to reach the model's context.
- * Two reasons: (1) data minimisation — the operator's phone number is never
- * handed to Claude; (2) a bare event (just the text, like the fakechat demo)
- * gives the agent nothing to narrate, so it answers the message instead of
- * announcing "incoming message from +44 …".
+ * The event carries ONLY the reframed message text — no `meta`. The sender,
+ * session id, and WhatsApp message id are all held server-side (the reply is
+ * pinned to the server's fixed sender), so none of it needs to reach the
+ * model's context. Two reasons: (1) data minimisation — the operator's phone
+ * number is never handed to Claude; (2) a bare event gives the agent nothing to
+ * narrate, so it acts on the message instead of announcing "incoming message
+ * from +44 …".
  */
 export declare function buildInboundNotification(p: InboundPayload): {
     method: "notifications/claude/channel";
@@ -33,6 +51,15 @@ export declare function buildInboundNotification(p: InboundPayload): {
         content: string;
     };
 };
+/**
+ * Task 753 — wrap the composed payload in {@link REFRAME_PREFIX} so the agent
+ * routes the request instead of authoring it inline. Every channel turn is
+ * wrapped — there is no deterministic trivia-skip (operator decision): a
+ * greeting is handled by the cascade's `direct` branch, not by a pre-classifier
+ * here. Returns the wrapped `content` plus `payloadBytes` (the inner payload's
+ * byte length) for the channel server's `[reframe]` observability line.
+ */
+export declare function composeAdminContent(p: InboundPayload): ComposedInbound;
 /**
  * Defence in depth: this server serves exactly one sender. Even though the
  * gateway only streams that sender's messages, refuse anything else before
@@ -51,6 +78,18 @@ export declare function buildReplyPostBody(mySenderId: string, text: string): {
     senderId: string;
     text: string;
 };
+/**
+ * Build the body for POST /wa-channel/reply-document — the file-reply the
+ * channel server posts when the agent calls the `reply-document` tool. Like the
+ * text reply, the senderId is the server's fixed sender (from spawn env), never
+ * model-supplied, so a compromised turn cannot redirect a document to a
+ * different recipient. The caption is omitted entirely when absent.
+ */
+export declare function buildReplyDocumentPostBody(mySenderId: string, files: string[], caption?: string): {
+    senderId: string;
+    files: string[];
+    caption?: string;
+};
 /**
  * Build the body for POST /wa-channel/received — the receipt ack the channel
  * server sends after it has emitted a drained inbound to the agent. It confirms

package/payload/platform/services/whatsapp-channel/dist/notification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notification.d.ts","sourceRoot":"","sources":["../src/notification.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAA;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAA;IAChB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAA;IACnB;;;kFAG8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,cAAc;;;;;EAOzD;AA0BD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAEvG;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAE3C;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC/B,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,GAChF,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED;;;;gCAIgC;AAChC,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAMrE"}
+{"version":3,"file":"notification.d.ts","sourceRoot":"","sources":["../src/notification.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAA;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAA;IAChB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAA;IACnB;;;kFAG8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,QAIY,CAAA;AAEvC;;;YAGY;AACZ,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,cAAc;;;;;EAOzD;AA0BD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,cAAc,GAAG,eAAe,CAMtE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAEvG;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,CAAC,EAAE,MAAM,GACf;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAIzD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAE3C;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC/B,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,GAChF,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED;;;;gCAIgC;AAChC,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAMrE"}

package/payload/platform/services/whatsapp-channel/dist/notification.js

@@ -1,22 +1,35 @@
 // Pure helpers for the WhatsApp channel server. No MCP SDK import here, so
 // these can be unit-tested without the SDK installed and so the server's
 // transport wiring (server.ts) stays separable from its message shaping.
+/**
+ * Task 753 — the standing select-and-dispatch instruction prepended to every
+ * channel turn. The inbound message is demoted to payload and the turn becomes
+ * a routing question: pick the owning specialist (dispatch via the Agent tool),
+ * else load the owning skill, else answer directly. Freestyle inline authoring
+ * is the `direct` floor, reached only when nothing owns the work — which is why
+ * a greeting/confirmation needs no separate skip: it falls through to `direct`.
+ * Exported so the unit tests assert the exact wrapped shape.
+ */
+export const REFRAME_PREFIX = 'Choose the installed specialist that owns this request and dispatch it with the Agent tool. ' +
+    'If no specialist fits, load the owning skill. ' +
+    'If neither fits (a greeting, a quick question, a confirmation, a direct continuation), just answer. ' +
+    'Then carry it out. Request follows:';
 /**
  * Shape an inbound WhatsApp payload as a Claude Code channel notification.
  *
- * The event carries ONLY the message text — no `meta`. The sender, session id,
- * and WhatsApp message id are all held server-side (the reply is pinned to the
- * server's fixed sender), so none of it needs to reach the model's context.
- * Two reasons: (1) data minimisation — the operator's phone number is never
- * handed to Claude; (2) a bare event (just the text, like the fakechat demo)
- * gives the agent nothing to narrate, so it answers the message instead of
- * announcing "incoming message from +44 …".
+ * The event carries ONLY the reframed message text — no `meta`. The sender,
+ * session id, and WhatsApp message id are all held server-side (the reply is
+ * pinned to the server's fixed sender), so none of it needs to reach the
+ * model's context. Two reasons: (1) data minimisation — the operator's phone
+ * number is never handed to Claude; (2) a bare event gives the agent nothing to
+ * narrate, so it acts on the message instead of announcing "incoming message
+ * from +44 …".
  */
 export function buildInboundNotification(p) {
     return {
         method: 'notifications/claude/channel',
         params: {
-            content: composeAdminContent(p),
+            content: composeAdminContent(p).content,
         },
     };
 }
@@ -30,7 +43,7 @@ export function buildInboundNotification(p) {
  * `p.text`. Only the `/tmp` file paths are added to Claude's context — never
  * the sender number, preserving the data-minimisation invariant above.
  */
-function composeAdminContent(p) {
+function composePayload(p) {
     const openable = (p.media ?? []).filter((m) => m.type !== 'audio');
     if (openable.length === 0)
         return p.text;
@@ -41,6 +54,21 @@ function composeAdminContent(p) {
     const body = notes.join('\n\n');
     return caption ? `${caption}\n\n${body}` : body;
 }
+/**
+ * Task 753 — wrap the composed payload in {@link REFRAME_PREFIX} so the agent
+ * routes the request instead of authoring it inline. Every channel turn is
+ * wrapped — there is no deterministic trivia-skip (operator decision): a
+ * greeting is handled by the cascade's `direct` branch, not by a pre-classifier
+ * here. Returns the wrapped `content` plus `payloadBytes` (the inner payload's
+ * byte length) for the channel server's `[reframe]` observability line.
+ */
+export function composeAdminContent(p) {
+    const payload = composePayload(p);
+    return {
+        content: `${REFRAME_PREFIX}\n\n${payload}`,
+        payloadBytes: Buffer.byteLength(payload, 'utf8'),
+    };
+}
 /**
  * Defence in depth: this server serves exactly one sender. Even though the
  * gateway only streams that sender's messages, refuse anything else before
@@ -58,6 +86,18 @@ export function acceptsSender(mySenderId, p) {
 export function buildReplyPostBody(mySenderId, text) {
     return { senderId: mySenderId, text };
 }
+/**
+ * Build the body for POST /wa-channel/reply-document — the file-reply the
+ * channel server posts when the agent calls the `reply-document` tool. Like the
+ * text reply, the senderId is the server's fixed sender (from spawn env), never
+ * model-supplied, so a compromised turn cannot redirect a document to a
+ * different recipient. The caption is omitted entirely when absent.
+ */
+export function buildReplyDocumentPostBody(mySenderId, files, caption) {
+    return caption !== undefined
+        ? { senderId: mySenderId, files, caption }
+        : { senderId: mySenderId, files };
+}
 /**
  * Build the body for POST /wa-channel/received — the receipt ack the channel
  * server sends after it has emitted a drained inbound to the agent. It confirms

package/payload/platform/services/whatsapp-channel/dist/notification.js.map

@@ -1 +1 @@
-{"version":3,"file":"notification.js","sourceRoot":"","sources":["../src/notification.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AAsBzE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,CAAiB;IACxD,OAAO;QACL,MAAM,EAAE,8BAAuC;QAC/C,MAAM,EAAE;YACN,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC;SAChC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,CAAiB;IAC5C,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAA;IAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAA;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CACxB,CAAC,CAAC,EAAE,EAAE,CACJ,qBAAqB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE;QACxC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;QAC3C,gDAAgD,CACnD,CAAA;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC/B,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,CAAuB;IACvE,OAAO,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAA;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,IAAY;IACjE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,WAAmB;IAEnB,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA+B,EAC/B,IAAiF;IAEjF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,OAAO,EAAE;YAAE,OAAO,IAAI,CAAA;QAChC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;gCAIgC;AAChC,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAa;IAC3D,MAAM,CAAC,GAAG,IAAsD,CAAA;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAClF,IAAI,CAAC,MAAM;QAAE,OAAO,2BAA2B,MAAM,EAAE,CAAA;IACvD,IAAI,CAAC,EAAE,QAAQ,KAAK,IAAI;QAAE,OAAO,+CAA+C,CAAA;IAChF,OAAO,UAAU,MAAM,EAAE,CAAA;AAC3B,CAAC"}
+{"version":3,"file":"notification.js","sourceRoot":"","sources":["../src/notification.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AAsBzE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GACzB,8FAA8F;IAC9F,gDAAgD;IAChD,sGAAsG;IACtG,qCAAqC,CAAA;AAWvC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,CAAiB;IACxD,OAAO;QACL,MAAM,EAAE,8BAAuC;QAC/C,MAAM,EAAE;YACN,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO;SACxC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,CAAiB;IACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAA;IAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAA;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CACxB,CAAC,CAAC,EAAE,EAAE,CACJ,qBAAqB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE;QACxC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;QAC3C,gDAAgD,CACnD,CAAA;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC/B,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAiB;IACnD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;IACjC,OAAO;QACL,OAAO,EAAE,GAAG,cAAc,OAAO,OAAO,EAAE;QAC1C,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;KACjD,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,CAAuB;IACvE,OAAO,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAA;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,IAAY;IACjE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,KAAe,EACf,OAAgB;IAEhB,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1C,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,WAAmB;IAEnB,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA+B,EAC/B,IAAiF;IAEjF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,OAAO,EAAE;YAAE,OAAO,IAAI,CAAA;QAChC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;gCAIgC;AAChC,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAa;IAC3D,MAAM,CAAC,GAAG,IAAsD,CAAA;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAClF,IAAI,CAAC,MAAM;QAAE,OAAO,2BAA2B,MAAM,EAAE,CAAA;IACvD,IAAI,CAAC,EAAE,QAAQ,KAAK,IAAI;QAAE,OAAO,+CAA+C,CAAA;IAChF,OAAO,UAAU,MAAM,EAAE,CAAA;AAC3B,CAAC"}