@scotthuang/agent-knock-knock 0.13.16 → 0.13.18

package/dist/src/terminal-watch-terminal-identity.js

@@ -0,0 +1,380 @@
+/** Exact terminal identity and validated Watch command inputs. */
+import { assertAutomaticActivityWatchIdentity } from "./terminal-watch-send-activity.js";
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { paginatedWatchProcessMatches } from "./codex-paginated-watch.js";
+import { rolloutFileIdentityMatches } from "./terminal-binding-authority.js";
+import { sameTerminalControlEvidenceIncarnation, terminalControlEvidence } from "./terminal-control-ref.js";
+import { isTerminalActivityWatch, isUserExplicitFallbackWatch } from "./terminal-watch-store.js";
+import { isRecord, nonBlankString as stringValue } from "./value-guards.js";
+export function assertSameUserExplicitFallbackTerminal(expected, observed) {
+    if (requiredString(observed.id, "terminal id") !== expected.conversationId ||
+        terminalAgent(observed) !== expected.agent ||
+        positiveInteger(observed.pid, "terminal PID") !== expected.pid ||
+        !isRecord(observed.terminal_control) ||
+        !sameTerminalControlEvidenceIncarnation(expected.terminalControl, observed.terminal_control)) {
+        throw new Error("terminal changed before the user-explicit fallback Watch anchor was captured");
+    }
+}
+export function assertPreparedFallbackTerminal(prepared, observed) {
+    if (requiredString(observed.id, "terminal id") !== prepared.terminalId ||
+        terminalAgent(observed) !== prepared.agent ||
+        positiveInteger(observed.pid, "terminal PID") !== prepared.pid ||
+        !isRecord(observed.terminal_control) ||
+        !sameTerminalControlEvidenceIncarnation(prepared.terminalEndpoint, observed.terminal_control)) {
+        throw new Error("terminal changed before the user-explicit fallback Watch was attached");
+    }
+    if (isTerminalActivityWatch(prepared)) {
+        assertAutomaticActivityWatchIdentity(prepared.anchor, observed, terminalWorkspace(observed), prepared.terminalIdentity.workspace);
+    }
+}
+export async function exactTerminalForWatch(terminalId, options, dependencies) {
+    const observation = await dependencies.observeExactTerminal({
+        options,
+        terminalId
+    });
+    if (observation.state === "unavailable") {
+        throw new Error("authoritative observation of the exact terminal is temporarily " +
+            "unavailable; retry after refreshing AKK list");
+    }
+    if (observation.state === "absent") {
+        throw new Error(`expected exact terminal ${terminalId}; observed none`);
+    }
+    return observation;
+}
+function bindingTokenForWatch(terminal) {
+    return requiredSha256(terminal.lifecycle_binding_token, "current terminal binding token");
+}
+export function bestEffortBindingTokenForWatch(terminal) {
+    try {
+        return { token: bindingTokenForWatch(terminal) };
+    }
+    catch {
+        const terminalControl = terminalControlForWatch(terminal);
+        return {
+            token: sha256({
+                schema: "agent-knock-knock/terminal-watch-observation-binding",
+                version: 1,
+                terminal_id: requiredString(terminal.id, "terminal id"),
+                agent: terminalAgent(terminal),
+                pid: positiveInteger(terminal.pid, "terminal PID"),
+                endpoint: terminalControlEvidence(terminalControl),
+                process_uuid: stringValue(terminal.native_agent_process_uuid) ?? null,
+                process_birth: stringValue(terminal.native_agent_process_birth) ?? null
+            }),
+            warning: "lifecycle_binding_token_unavailable: Watch used read-only terminal/process observation identity"
+        };
+    }
+}
+export function terminalActivityState(terminal) {
+    const state = stringValue(terminal.activity_state);
+    return state === "awaiting_approval" || state === "working" ||
+        state === "idle"
+        ? state
+        : "unknown";
+}
+export function sameManualWatchTarget(watch, agent, terminal, anchor) {
+    return watch.status === "active" &&
+        watch.agent === agent &&
+        watch.terminal.terminal_id === terminal.terminal_id &&
+        watch.terminal.workspace === terminal.workspace &&
+        sameTerminalControlEvidenceIncarnation(watch.terminal.terminal_endpoint, terminal.terminal_endpoint) &&
+        sameManualWatchAnchorTarget(watch.anchor, anchor);
+}
+function sameManualWatchAnchorTarget(left, right) {
+    if (left.schema !== right.schema)
+        return false;
+    if (left.schema === "agent-knock-knock/codex-paginated-task-anchor" && right.schema === left.schema) {
+        return samePaginatedWatchTask(left, right);
+    }
+    if (left.schema ===
+        "agent-knock-knock/codex-human-started-active-task-anchor" &&
+        right.schema === left.schema) {
+        return left.turn_id === right.turn_id &&
+            left.process_uuid === right.process_uuid &&
+            left.process_birth === right.process_birth &&
+            left.rollout.device === right.rollout.device &&
+            left.rollout.inode === right.rollout.inode;
+    }
+    if (left.schema ===
+        "agent-knock-knock/claude-human-started-active-task-anchor" &&
+        right.schema === left.schema) {
+        return sameClaudeWatchTask(left, right);
+    }
+    if (left.schema === "agent-knock-knock/terminal-activity-watch-anchor" &&
+        right.schema === left.schema) {
+        return left.origin === right.origin &&
+            left.request_hash === right.request_hash &&
+            left.pid === right.pid &&
+            optionalIdentityCompatible(left.native_process_uuid, right.native_process_uuid) &&
+            optionalIdentityCompatible(left.native_process_birth, right.native_process_birth);
+    }
+    return left.anchor_fingerprint === right.anchor_fingerprint;
+}
+function sameClaudeWatchTask(left, right) {
+    return left.prompt_uuid === right.prompt_uuid &&
+        left.pid === right.pid &&
+        left.agent_started_at_ms === right.agent_started_at_ms &&
+        left.device === right.device &&
+        left.inode === right.inode;
+}
+function samePaginatedWatchTask(left, right) {
+    return left.native_thread_id === right.native_thread_id && left.turn_id === right.turn_id &&
+        left.process_uuid === right.process_uuid && left.process_birth === right.process_birth &&
+        left.origin === right.origin && left.codex_home === right.codex_home;
+}
+function optionalIdentityCompatible(left, right) {
+    return left === undefined || right === undefined || left === right;
+}
+export function safeDiagnostic(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.replace(/[\r\n\0]+/gu, " ").trim().slice(0, 500) ||
+        "unknown provider observation error";
+}
+export function terminalControlForWatch(terminal) {
+    if (!isRecord(terminal.terminal_control)) {
+        throw new Error("the exact terminal has no terminal control authority");
+    }
+    return terminal.terminal_control;
+}
+export function terminalWatchCandidateMatchesLiveContext(watch, terminal) {
+    if (!terminalMatchesWatch(terminal, watch))
+        return false;
+    if (watch.anchor.schema === "agent-knock-knock/codex-paginated-task-anchor") {
+        return paginatedWatchProcessMatches(terminal, watch.anchor);
+    }
+    const sessionId = stringValue(terminal.native_agent_session_id);
+    if (watch.anchor.schema ===
+        "agent-knock-knock/codex-human-started-active-task-anchor") {
+        return sessionId?.toLowerCase() === watch.anchor.native_thread_id &&
+            rolloutFileIdentityMatches(terminal.native_agent_rollout, watch.anchor.rollout);
+    }
+    if (watch.anchor.schema ===
+        "agent-knock-knock/codex-user-explicit-fallback-watch-anchor") {
+        const checkpoint = watch.observation_checkpoint;
+        return "schema" in checkpoint &&
+            checkpoint.schema ===
+                "agent-knock-knock/codex-user-explicit-fallback-watch-checkpoint" &&
+            checkpoint.accepted_identity !== undefined &&
+            sessionId?.toLowerCase() === checkpoint.accepted_identity.native_thread_id &&
+            rolloutFileIdentityMatches(terminal.native_agent_rollout, checkpoint.accepted_identity.rollout);
+    }
+    if (watch.anchor.schema ===
+        "agent-knock-knock/claude-human-started-active-task-anchor") {
+        return sessionId === watch.anchor.session_id;
+    }
+    if (watch.anchor.schema ===
+        "agent-knock-knock/claude-user-explicit-fallback-watch-anchor") {
+        return sessionId === watch.anchor.transcript_anchor.session_id;
+    }
+    return false;
+}
+export async function currentTerminalForWatch(watch, options, dependencies) {
+    return dependencies.observeExactTerminal({
+        options,
+        terminalId: watch.terminal.terminal_id
+    });
+}
+export function terminalMatchesWatch(terminal, watch) {
+    try {
+        return terminalAgent(terminal) === watch.agent &&
+            requiredString(terminal.id, "terminal id") ===
+                watch.terminal.terminal_id &&
+            terminalWorkspace(terminal) === watch.terminal.workspace &&
+            isRecord(terminal.terminal_control) &&
+            sameTerminalControlEvidenceIncarnation(terminal.terminal_control, watch.terminal.terminal_endpoint);
+    }
+    catch {
+        return false;
+    }
+}
+export function terminalActivityWatchIdentityMatch(terminal, watch) {
+    try {
+        if (!isTerminalActivityWatch(watch) ||
+            terminalAgent(terminal) !== watch.agent ||
+            requiredString(terminal.id, "terminal id") !==
+                watch.terminal.terminal_id ||
+            terminalWorkspace(terminal) !== watch.terminal.workspace ||
+            positiveInteger(terminal.pid, "terminal PID") !== watch.anchor.pid) {
+            return "mismatch";
+        }
+        if (!isRecord(terminal.terminal_control)) {
+            return "unavailable";
+        }
+        if (!sameTerminalControlEvidenceIncarnation(terminal.terminal_control, watch.terminal.terminal_endpoint)) {
+            return "mismatch";
+        }
+        const processUuid = stringValue(terminal.native_agent_process_uuid);
+        const processBirth = stringValue(terminal.native_agent_process_birth);
+        if ((watch.anchor.native_process_uuid !== undefined && !processUuid) ||
+            (watch.anchor.native_process_birth !== undefined && !processBirth)) {
+            return "unavailable";
+        }
+        return (watch.anchor.native_process_uuid !== undefined &&
+            processUuid !== watch.anchor.native_process_uuid) || (watch.anchor.native_process_birth !== undefined &&
+            processBirth !== watch.anchor.native_process_birth)
+            ? "mismatch"
+            : "match";
+    }
+    catch {
+        return "unavailable";
+    }
+}
+export function terminalMatchesUserExplicitFallbackWatch(terminal, watch) {
+    try {
+        if (!isUserExplicitFallbackWatch(watch) ||
+            terminalAgent(terminal) !== watch.agent ||
+            requiredString(terminal.id, "terminal id") !==
+                watch.terminal.terminal_id ||
+            terminalWorkspace(terminal) !== watch.terminal.workspace ||
+            !isRecord(terminal.terminal_control) ||
+            !sameTerminalControlEvidenceIncarnation(terminal.terminal_control, watch.terminal.terminal_endpoint)) {
+            return false;
+        }
+        if (watch.anchor.schema ===
+            "agent-knock-knock/codex-user-explicit-fallback-watch-anchor") {
+            return requiredString(terminal.native_agent_process_uuid, "Codex process UUID") === watch.anchor.acceptance_anchor.process_uuid &&
+                requiredString(terminal.native_agent_process_birth, "Codex process birth") === watch.anchor.acceptance_anchor.process_birth;
+        }
+        return watch.anchor.schema ===
+            "agent-knock-knock/claude-user-explicit-fallback-watch-anchor" &&
+            positiveInteger(terminal.pid, "Claude PID") ===
+                watch.anchor.transcript_anchor.pid;
+    }
+    catch {
+        return false;
+    }
+}
+export function terminalWatchIdentity(terminal, bindingToken) {
+    const terminalControl = terminal.terminal_control;
+    return {
+        terminal_id: requiredString(terminal.id, "terminal id"),
+        terminal_endpoint: terminalControlEvidence(terminalControl),
+        workspace: terminalWorkspace(terminal),
+        binding_token: bindingToken
+    };
+}
+export function codexIdentity(terminal) {
+    if (!isRecord(terminal.native_agent_rollout)) {
+        throw new Error("Codex terminal has no exact rollout identity");
+    }
+    return {
+        sessionId: requiredString(terminal.native_agent_session_id, "Codex native thread id"),
+        processUuid: requiredString(terminal.native_agent_process_uuid, "Codex process UUID"),
+        processBirth: requiredString(terminal.native_agent_process_birth, "Codex process birth"),
+        rollout: {
+            fd: requiredString(terminal.native_agent_rollout.fd, "Codex rollout fd"),
+            device: requiredString(terminal.native_agent_rollout.device, "Codex rollout device"),
+            inode: requiredString(terminal.native_agent_rollout.inode, "Codex rollout inode"),
+            path: requiredString(terminal.native_agent_rollout.path, "Codex rollout path")
+        }
+    };
+}
+export function codexIdentityForWatch(watch) {
+    if (watch.agent !== "codex" ||
+        watch.anchor.schema !==
+            "agent-knock-knock/codex-human-started-active-task-anchor") {
+        throw new Error("terminal Watch has no Codex identity");
+    }
+    return {
+        sessionId: watch.anchor.native_thread_id,
+        processUuid: watch.anchor.process_uuid,
+        processBirth: watch.anchor.process_birth,
+        rollout: watch.anchor.rollout
+    };
+}
+export function terminalAgent(terminal) {
+    const agent = stringValue(terminal.agent);
+    if (agent !== "codex" && agent !== "claude") {
+        throw new Error("terminal Watch supports only Codex or Claude Code");
+    }
+    return agent;
+}
+export function terminalWorkspace(terminal) {
+    const workspace = requiredString(terminal.workspace ?? terminal.cwd, "terminal workspace");
+    if (!path.isAbsolute(workspace)) {
+        throw new Error("terminal workspace must be absolute");
+    }
+    return path.resolve(workspace);
+}
+export function requiredWatchId(value) {
+    const watchId = requiredString(value, "--watch");
+    if (!/^terminal-watch-[A-Za-z0-9._:-]+$/u.test(watchId)) {
+        throw new Error("--watch must be an exact Terminal Watch id");
+    }
+    return watchId;
+}
+export function requiredString(value, label) {
+    const result = stringValue(value);
+    if (!result || result.includes("\0")) {
+        throw new Error(`${label} is required`);
+    }
+    return result;
+}
+export function requiredSha256(value, label) {
+    const result = requiredString(value, label);
+    if (!/^[a-f0-9]{64}$/u.test(result)) {
+        throw new Error(`${label} must be exactly 64 lowercase ASCII hexadecimal characters`);
+    }
+    return result;
+}
+export function requiredTimestamp(value, label) {
+    const result = requiredString(value, label);
+    if (!Number.isFinite(Date.parse(result))) {
+        throw new Error(`${label} must be a valid timestamp`);
+    }
+    return result;
+}
+export function parseWatchInteractionResponse(value) {
+    const serialized = requiredString(value, "--response-json");
+    try {
+        const parsed = JSON.parse(serialized);
+        if (!isRecord(parsed)) {
+            throw new Error("response must be an object");
+        }
+        return parsed;
+    }
+    catch (error) {
+        throw new Error(`--response-json is invalid: ${safeDiagnostic(error)}`);
+    }
+}
+export function assertWatchControllerSession(watch, requestedValue) {
+    const requested = stringValue(requestedValue);
+    if (!requested || requested !== watch.openclaw_session) {
+        throw new Error(`terminal Watch ${watch.watch_id} belongs to a different controller session; no terminal input was sent`);
+    }
+}
+export function requiredExecutableWatchInteraction(watch, interactionId, expectedFingerprint) {
+    if (watch.status !== "active") {
+        throw new Error(`terminal Watch ${watch.watch_id} is ${watch.status}`);
+    }
+    const interaction = watch.current_interaction;
+    if (watch.interaction_policy !== "respond_when_exact" ||
+        !interaction ||
+        interaction.aggregate.state !== "pending" ||
+        interaction.projection.interaction_id !== interactionId ||
+        interaction.projection.prompt_fingerprint !== expectedFingerprint ||
+        interaction.projection.response_authority !== "executable" ||
+        !interaction.projection.capabilities.respond) {
+        throw new Error("terminal Watch has no matching executable interaction offer; refresh status");
+    }
+    return interaction;
+}
+export function positiveInteger(value, label) {
+    const result = Number(value);
+    if (!Number.isSafeInteger(result) || result <= 0) {
+        throw new Error(`${label} must be a positive integer`);
+    }
+    return result;
+}
+export function positiveMinutes(value, fallback) {
+    const result = value === undefined ? fallback : Number(value);
+    if (!Number.isFinite(result) || result <= 0) {
+        throw new Error("--hard-timeout-minutes must be a positive number");
+    }
+    return result;
+}
+export function sha256(value) {
+    return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+//# sourceMappingURL=terminal-watch-terminal-identity.js.map

package/dist/src/terminal-watch-terminal-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-watch-terminal-identity.js","sourceRoot":"","sources":["../../src/terminal-watch-terminal-identity.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,OAAO,EAAE,oCAAoC,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAE1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,OAAO,EAEL,sCAAsC,EACtC,uBAAuB,EACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAM5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,cAAc,IAAI,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAS5E,MAAM,UAAU,sCAAsC,CACpD,QAAyC,EACzC,QAAiC;IAEjC,IACE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC,KAAK,QAAQ,CAAC,cAAc;QACtE,aAAa,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,KAAK;QAC1C,eAAe,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,QAAQ,CAAC,GAAG;QAC9D,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACpC,CAAC,sCAAsC,CACrC,QAAQ,CAAC,eAAe,EACxB,QAAQ,CAAC,gBAAiD,CAC3D,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,QAA2C,EAC3C,QAAiC;IAEjC,IACE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC,KAAK,QAAQ,CAAC,UAAU;QAClE,aAAa,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,KAAK;QAC1C,eAAe,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,QAAQ,CAAC,GAAG;QAC9D,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACpC,CAAC,sCAAsC,CACrC,QAAQ,CAAC,gBAAgB,EACzB,QAAQ,CAAC,gBAAiD,CAC3D,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,oCAAoC,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAC5D,iBAAiB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,OAAgC,EAChC,YAA0C;IAE1C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,oBAAoB,CAAC;QAC1D,OAAO;QACP,UAAU;KACX,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,iEAAiE;YACjE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAiC;IAEjC,OAAO,cAAc,CACnB,QAAQ,CAAC,uBAAuB,EAChC,gCAAgC,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,QAAiC;IAEjC,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO;YACL,KAAK,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,sDAAsD;gBAC9D,OAAO,EAAE,CAAC;gBACV,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;gBACvD,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC;gBAC9B,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAClD,QAAQ,EAAE,uBAAuB,CAAC,eAAe,CAAC;gBAClD,YAAY,EAAE,WAAW,CAAC,QAAQ,CAAC,yBAAyB,CAAC,IAAI,IAAI;gBACrE,aAAa,EAAE,WAAW,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI,IAAI;aACxE,CAAC;YACF,OAAO,EACL,iGAAiG;SACpG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAiC;IAEjC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO,KAAK,KAAK,mBAAmB,IAAI,KAAK,KAAK,SAAS;QACvD,KAAK,KAAK,MAAM;QAClB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAoB,EACpB,KAAmB,EACnB,QAAuC,EACvC,MAA2B;IAE3B,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAC9B,KAAK,CAAC,KAAK,KAAK,KAAK;QACrB,KAAK,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QACnD,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QAC/C,sCAAsC,CACpC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAChC,QAAQ,CAAC,iBAAiB,CAC3B;QACD,2BAA2B,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAyB,EACzB,KAA0B;IAE1B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,+CAA+C,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACpG,OAAO,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,IACE,IAAI,CAAC,MAAM;QACT,0DAA0D;QAC5D,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YACnC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;YACxC,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAC1C,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,CAAC;IACD,IACE,IAAI,CAAC,MAAM;QACT,2DAA2D;QAC7D,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAC5B,CAAC;QACD,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,IACE,IAAI,CAAC,MAAM,KAAK,kDAAkD;QAClE,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YACjC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;YACxC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;YACtB,0BAA0B,CACxB,IAAI,CAAC,mBAAmB,EACxB,KAAK,CAAC,mBAAmB,CAC1B;YACD,0BAA0B,CACxB,IAAI,CAAC,oBAAoB,EACzB,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC,kBAAkB,KAAK,KAAK,CAAC,kBAAkB,CAAC;AAC9D,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAA2G,EAC3G,KAAkB;IAEhB,OAAO,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QAC3C,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QACtB,IAAI,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;QACtD,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC5B,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;AACjC,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA8B,EAAE,KAA+B;IAC3F,OAAO,IAAI,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QACvF,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QACtF,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;AAC3E,CAAC;AAED,SAAS,0BAA0B,CACjC,IAAwB,EACxB,KAAyB;IAEzB,OAAO,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC7D,oCAAoC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAiC;IAEjC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAC,gBAAiD,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,KAAoB,EACpB,QAAiC;IAEjC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,+CAA+C,EAAE,CAAC;QAC5E,OAAO,4BAA4B,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAChE,IACE,KAAK,CAAC,MAAM,CAAC,MAAM;QACjB,0DAA0D,EAC5D,CAAC;QACD,OAAO,SAAS,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,CAAC,gBAAgB;YAC/D,0BAA0B,CACxB,QAAQ,CAAC,oBAAoB,EAC7B,KAAK,CAAC,MAAM,CAAC,OAAO,CACrB,CAAC;IACN,CAAC;IACD,IACE,KAAK,CAAC,MAAM,CAAC,MAAM;QACjB,6DAA6D,EAC/D,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,sBAAsB,CAAC;QAChD,OAAO,QAAQ,IAAI,UAAU;YAC3B,UAAU,CAAC,MAAM;gBACf,iEAAiE;YACnE,UAAU,CAAC,iBAAiB,KAAK,SAAS;YAC1C,SAAS,EAAE,WAAW,EAAE,KAAK,UAAU,CAAC,iBAAiB,CAAC,gBAAgB;YAC1E,0BAA0B,CACxB,QAAQ,CAAC,oBAAoB,EAC7B,UAAU,CAAC,iBAAiB,CAAC,OAAO,CACrC,CAAC;IACN,CAAC;IACD,IACE,KAAK,CAAC,MAAM,CAAC,MAAM;QACjB,2DAA2D,EAC7D,CAAC;QACD,OAAO,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;IAC/C,CAAC;IACD,IACE,KAAK,CAAC,MAAM,CAAC,MAAM;QACjB,8DAA8D,EAChE,CAAC;QACD,OAAO,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAoB,EACpB,OAAgC,EAChC,YAA0C;IAE1C,OAAO,YAAY,CAAC,oBAAoB,CAAC;QACvC,OAAO;QACP,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAiC,EACjC,KAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,KAAK;YAC5C,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;gBACxC,KAAK,CAAC,QAAQ,CAAC,WAAW;YAC5B,iBAAiB,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS;YACxD,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,sCAAsC,CACpC,QAAQ,CAAC,gBAAiD,EAC1D,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CACjC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,kCAAkC,CAChD,QAAiC,EACjC,KAAoB;IAEpB,IAAI,CAAC;QACH,IACE,CAAC,uBAAuB,CAAC,KAAK,CAAC;YAC/B,aAAa,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,KAAK;YACvC,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;gBACxC,KAAK,CAAC,QAAQ,CAAC,WAAW;YAC5B,iBAAiB,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS;YACxD,eAAe,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG,EAClE,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACzC,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,sCAAsC,CACzC,QAAQ,CAAC,gBAAiD,EAC1D,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CACjC,EAAE,CAAC;YACF,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QACtE,IACE,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC;YAChE,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,EAClE,CAAC;YACD,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,OAAO,CACL,KAAK,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAC9C,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,mBAAmB,CACjD,IAAI,CACH,KAAK,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS;YAC/C,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,oBAAoB,CACnD;YACC,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,QAAiC,EACjC,KAAoB;IAEpB,IAAI,CAAC;QACH,IACE,CAAC,2BAA2B,CAAC,KAAK,CAAC;YACnC,aAAa,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,KAAK;YACvC,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;gBACxC,KAAK,CAAC,QAAQ,CAAC,WAAW;YAC5B,iBAAiB,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS;YACxD,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACpC,CAAC,sCAAsC,CACrC,QAAQ,CAAC,gBAAiD,EAC1D,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CACjC,EACD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IACE,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,6DAA6D,EAC/D,CAAC;YACD,OAAO,cAAc,CACnB,QAAQ,CAAC,yBAAyB,EAClC,oBAAoB,CACrB,KAAK,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY;gBAC/C,cAAc,CACZ,QAAQ,CAAC,0BAA0B,EACnC,qBAAqB,CACtB,KAAK,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM;YACtB,8DAA8D;YAChE,eAAe,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;gBACzC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAiC,EACjC,YAAoB;IAEpB,MAAM,eAAe,GAAG,QAAQ,CAAC,gBAAsC,CAAC;IACxE,OAAO;QACL,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;QACvD,iBAAiB,EAAE,uBAAuB,CAAC,eAAe,CAAC;QAC3D,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QACtC,aAAa,EAAE,YAAY;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,QAAiC;IAEjC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,cAAc,CACvB,QAAQ,CAAC,uBAAuB,EAChC,wBAAwB,CACzB;QACD,WAAW,EAAE,cAAc,CACzB,QAAQ,CAAC,yBAAyB,EAClC,oBAAoB,CACrB;QACD,YAAY,EAAE,cAAc,CAC1B,QAAQ,CAAC,0BAA0B,EACnC,qBAAqB,CACtB;QACD,OAAO,EAAE;YACP,EAAE,EAAE,cAAc,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,EAAE,kBAAkB,CAAC;YACxE,MAAM,EAAE,cAAc,CACpB,QAAQ,CAAC,oBAAoB,CAAC,MAAM,EACpC,sBAAsB,CACvB;YACD,KAAK,EAAE,cAAc,CACnB,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EACnC,qBAAqB,CACtB;YACD,IAAI,EAAE,cAAc,CAClB,QAAQ,CAAC,oBAAoB,CAAC,IAAI,EAClC,oBAAoB,CACrB;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAoB;IAEpB,IACE,KAAK,CAAC,KAAK,KAAK,OAAO;QACvB,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,0DAA0D,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB;QACxC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACtC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;QACxC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAiC;IAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAiC;IACjE,MAAM,SAAS,GAAG,cAAc,CAC9B,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,EAClC,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,KAAa;IAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,KAAa;IAC1D,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,4DAA4D,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,KAAa;IAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,+BAA+B,cAAc,CAAC,KAAK,CAAC,EAAE,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,KAAoB,EACpB,cAAuB;IAEvB,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,kBAAkB,KAAK,CAAC,QAAQ,wEAAwE,CACzG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAoB,EACpB,aAAqB,EACrB,mBAA2B;IAE3B,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,QAAQ,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB,CAAC;IAC9C,IACE,KAAK,CAAC,kBAAkB,KAAK,oBAAoB;QACjD,CAAC,WAAW;QACZ,WAAW,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS;QACzC,WAAW,CAAC,UAAU,CAAC,cAAc,KAAK,aAAa;QACvD,WAAW,CAAC,UAAU,CAAC,kBAAkB,KAAK,mBAAmB;QACjE,WAAW,CAAC,UAAU,CAAC,kBAAkB,KAAK,YAAY;QAC1D,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,KAAa;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,QAAgB;IAC9D,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC"}

package/docs/codex-0.160.0-compatibility.md

@@ -0,0 +1,126 @@
+# Codex CLI 0.160.0 compatibility
+
+This review follows the official stable `rust-v0.160.0` release (2026-10-01),
+not the `0.162.0-alpha` channel. AKK 0.13.18 also reviews the 0.159.3
+foreground client because already-running clients can share the upgraded
+0.160.0 app-server.
+
+## Contract review
+
+The native binaries generate byte-identical experimental TypeScript schemas
+across 0.159.2, 0.159.3, and 0.160.0 (875 files), and byte-identical JSON
+schemas between 0.159.3 and 0.160.0 (440 files). The official source comparison
+also preserves paginated history, thread/turn identity, request-user-input,
+and async-answer wire shapes. Runtime response validation remains required;
+schema equality alone does not authorize a native write.
+
+The 0.160.0 macOS Option-key hint no longer contains a plus sign:
+`⌥↑ to answer`, `⌥↓ main prompt`, and `⌥↑ next question`. AKK uses a distinct
+async UI profile for this grammar. Older frontends retain their old spelling;
+unknown or mixed keymaps remain non-executable. The native status reader
+accepts both closed display spellings without granting input authority.
+
+Native model, permission, questionnaire, and status profiles cover 0.159.3 and
+0.160.0. The new projectless `Workspace (granular)` default is represented as
+`workspace_granular`, a current-only state. Its actual native picker offers
+three standard presets with no current marker. AKK may select a freshly
+advertised preset; it never treats granular as Ask for approval, exposes it as
+a selectable target, or accepts arbitrary custom/granular labels. New status cards may omit reasoning summaries on server connections;
+this field is not an identity requirement. Plan footer hints remain display
+information, not task identity.
+
+Exact audited interaction pairs are:
+
+| Foreground CLI | app-server | Basis |
+| --- | --- | --- |
+| 0.159.3 | 0.159.3 | Identical protocol and reviewed source; regression tests |
+| 0.159.3 | 0.160.0 | Shared-backend upgrade pair; native verification below |
+| 0.160.0 | 0.160.0 | Current stable pair; native verification below |
+
+Existing audited older pairs remain available. The reverse 0.160.0/0.159.3
+pair, 0.159.2/0.160.0, and unreviewed later pairs do not gain answer authority.
+Read-only contract negotiation continues to support compatible newer backends;
+a changed backend can retain exact observation, but withdraws an executable
+question offer until its own fresh authority is established.
+
+## Verification
+
+On 2026-10-04, isolated macOS tmux sessions ran the actual 0.159.3/0.160.0
+and 0.160.0/0.160.0 foreground/backend combinations. Every launch used the
+existing `mycodes` wrapper; an owned PATH shim selected the old executable for
+the mixed pair. No user terminal or shared daemon was restarted.
+
+Both pairs passed two real model turns each, through built production adapters:
+
+- Discover the exact process and pane; capture a fresh native status/thread.
+- Send once, prove exact native request acceptance, and attach an automatic
+  paginated task Watch.
+- Attach another exact Watch while the same async task is working.
+- Receive the async question callback; answer once to that exact turn, then
+  prove the matching durable user-message/question ID.
+- Receive and answer a native Plan-mode blocking question; prove the canonical
+  function output before treating its answer as confirmed.
+- Prove the exact native turn completed with the requested nonce and answer;
+  repeated reconciliation delivers exactly one completion callback per Watch.
+
+A separate real 0.160.0 pane passed native `/status` identity, model catalog
+inspection without changing its model/effort, and permission discovery followed
+by Ask for approval → Full Access (including native confirmation) → Ask for
+approval. Every permission result was confirmed against the same thread and
+fresh status/menu, with `defaults_changed=false`. The initial read-only state
+was not selectable in this platform's picker; cleanup retained the final
+standard preset only in the disposable test session.
+
+The final candidate also passed the production permission APIs starting from
+an actual `Workspace (granular)` session: discovery returned only the three
+standard choices, followed by granular → Full Access → Ask for approval. Both
+changes had fresh same-thread status/menu confirmation and unchanged defaults;
+model and effort remained unchanged. The prior invalidated Watch stayed
+invalidated throughout, and no task was resent or revived.
+
+Callbacks were collected at the production Watch transport boundary in a local
+sink. This proves AKK callback generation/deduplication, not delivery to an
+external chat service. The live terminal used the `shift+arrow` keymap; the new
+macOS Option spelling and Plan-cycle hint have official-source and regression
+coverage, not live-keymap coverage. Herdr transport, remote endpoints, other
+platforms, native model-setting commits, and command approval prompts were not
+newly exercised live in this review.
+
+An initial isolated attempt exposed the existing strict cwd boundary: macOS
+`/var/...` was later persisted as `/private/var/...`, so its Watch was correctly
+invalidated and was not revived or resent. Passing runs used physical canonical
+workspace paths from launch. Launching through other symlink paths can still
+encounter this conservative identity limitation.
+
+`npm run test:fast` passed 2,464 tests; type checking, build, and architecture
+validation passed. The immediate pre-publication `npm run test:release` gate
+passed 2,979 tests, isolated OpenClaw 2026.9.1 compatibility (24 tools,
+callback delivery, install/update/uninstall), ClawHub runtime validation, and
+publication dry-run. The general native lifecycle smoke was not run because
+paginated new/resume remains outside the supported path; the targeted native
+proof above covers this release's actual task and permission paths.
+
+## Retained boundaries
+
+- Ordinary List/Status reads live terminal activity. Without an existing exact
+  anchor it does not invent a native task identity, type `/status`, or create a
+  Watch. A same-workspace history guess cannot prove task completion.
+- Exact Send/Watch preparation uses the existing locked native status
+  transaction, then validates the native thread, turn, request, and durable
+  completion. Compatible reads do not bypass input-owning modal or styled
+  Composer checks.
+- A first Watch on an already-blocking question without a prior task anchor
+  remains activity-only/manual-response. Safe fallback is explicitly labeled
+  `terminal_activity`; idle is not proof of task completion.
+- Paginated managed session-only dispatch and native new/resume remain outside
+  this adapter. The upstream permission-resume changes do not enable them.
+- No existing user TUI or shared daemon needs to restart for installation.
+  Updating the CLI changes future launches; running processes retain their
+  loaded version. Explicit restarts must preserve the wrapper and exact UUID.
+
+## Sources
+
+- [Official 0.160.0 release](https://github.com/openai/codex/releases/tag/rust-v0.160.0)
+- [Official app-server documentation](https://learn.chatgpt.com/docs/app-server)
+- [0.159.2 to 0.159.3 source comparison](https://github.com/openai/codex/compare/rust-v0.159.2...rust-v0.159.3)
+- [0.159.3 to 0.160.0 source comparison](https://github.com/openai/codex/compare/rust-v0.159.3...rust-v0.160.0)

package/docs/codex-permissions.md

@@ -21,6 +21,14 @@ For example, `ask_for_approval` may be available on a given Codex build. A mode
 reported as current is not necessarily selectable: macOS can report `read_only`
 while omitting it from its menu. Named/custom profiles are not supported.
 
+Codex 0.160.0 can start a local folder outside a project with
+`Workspace (granular)` permissions. AKK reports this as `workspace_granular`,
+which describes the current state only; it cannot be selected. The native menu
+may offer its usual standard modes without marking any of them current. Choose
+an advertised mode to switch from this state. AKK verifies the new mode through
+a fresh status and the reopened menu's current marker on the same native thread.
+Other custom or unknown permission states remain unsupported.
+
 The corresponding tools are:
 
 ```text
@@ -47,7 +55,7 @@ before permission inspection; AKK does not interrupt its task to open the menu.
 
 ## Compatibility and verification
 
-The permission-write profile currently covers Codex 0.159.2 and 0.159.3. It is
+The permission-write profile currently covers Codex 0.159.2, 0.159.3, and 0.160.0. It is
 independent of native model selection, task observation, and interaction-write
 profiles. Unsupported versions, named/custom profiles, disabled or incomplete
 menus, and conflicting native status stop the operation before a permission
@@ -93,3 +101,6 @@ JavaScript files and bundled Skill match the user-tested candidate; only release
 metadata, verification documentation, and an older action-list test changed
 after that candidate. The optional general native lifecycle smoke was not rerun;
 the permission-specific live coverage and remaining limits are listed above.
+
+For the 0.160.0 source review, current native verification, and remaining
+boundaries, see [Codex 0.160.0 compatibility](codex-0.160.0-compatibility.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scotthuang/agent-knock-knock",
-  "version": "0.13.16",
+  "version": "0.13.18",
   "description": "Control local Codex and Claude Code from OpenClaw or compatible controller Hosts through shared terminals.",
   "license": "MIT",
   "type": "module",
@@ -92,7 +92,8 @@
     "docs/codex-0.159.2-compatibility.md",
     "docs/claude-2.1.285-compatibility.md",
     "docs/callback-compatibility.md",
-    "docs/codex-permissions.md"
+    "docs/codex-permissions.md",
+    "docs/codex-0.160.0-compatibility.md"
   ],
   "publishConfig": {
     "access": "public"

package/templates/openclaw-skills/agent-knock-knock/SKILL.md

@@ -117,7 +117,7 @@ Approval attention is notification-only for every Watch: never call an approval
 
 The current integrations register the complete capability-handshake-verified semantic AKK tool catalog and list action-contract v30. Structured OpenClaw, Pi, and DeepSeek Harness Lists use compact projection v1 and point here for the static contract; the CLI keeps the complete operator/debug action contract. Every structured model action carries semantic IDs only; opaque fences, Composer digests, and draft text are derived or retained privately. Watch uses `agent_knock_knock_watch({terminal_id})`, `agent_knock_knock_status({watch_id})`, and `agent_knock_knock_unwatch({watch_id})`; its internal CLI boundary is `watch-terminal`, `watch-status`, `unwatch-terminal`, and `reconcile-watches`.
 
-For Codex permission changes, first call `agent_knock_knock_permission_options({terminal_id})` from the current row’s advertised action. This sends closed `/status` and `/permissions` inspection input but leaves permissions unchanged; the terminal must be idle, its Composer empty, and its physical and native thread identities verifiable. Use `current`, `scope`, and the returned choice descriptions to select the requested or authorized mode. Then call `agent_knock_knock_set_permissions({terminal_id,mode})` using its exact returned semantic ID in the same controller conversation. Full Access is an ordinary option and needs no additional user confirmation. AKK automatically handles its exact native confirmation inside this permission transaction; do not pause to ask the user to confirm Full Access or call generic `approve` for that dialog. Ordinary Send does not change permissions. Only currently displayed built-in modes are supported: do not invent `read_only` when the picker omits it, supply a named/custom profile, or pass commands, labels, menu indexes, keys, tokens, or scope overrides. Changes affect the current session/thread, may be retained on Resume, and leave global defaults unchanged. Send the intended task only after `outcome="changed"` or `"already_effective"` with matching `effective.mode`; `"uncertain"` means stop and do not retry automatically. Refresh the catalog after any change or consumed attempt.
+For Codex permission changes, first call `agent_knock_knock_permission_options({terminal_id})` from the current row’s advertised action. This sends closed `/status` and `/permissions` inspection input but leaves permissions unchanged; the terminal must be idle, its Composer empty, and its physical and native thread identities verifiable. Use `current`, `scope`, and the returned choice descriptions to select the requested or authorized mode. Then call `agent_knock_knock_set_permissions({terminal_id,mode})` using its exact returned semantic ID in the same controller conversation. Full Access is an ordinary option and needs no additional user confirmation. AKK automatically handles its exact native confirmation inside this permission transaction; do not pause to ask the user to confirm Full Access or call generic `approve` for that dialog. Ordinary Send does not change permissions. Codex 0.160 may report `current="workspace_granular"`; this is a current-only native default, not a selectable mode. Select only an ID actually returned in `choices`. Only currently displayed built-in modes are supported: do not invent `read_only` when the picker omits it, supply a named/custom profile, or pass commands, labels, menu indexes, keys, tokens, or scope overrides. Changes affect the current session/thread, may be retained on Resume, and leave global defaults unchanged. Send the intended task only after `outcome="changed"` or `"already_effective"` with matching `effective.mode`; `"uncertain"` means stop and do not retry automatically. Refresh the catalog after any change or consumed attempt.
 
 For native model control, first call `agent_knock_knock_model_options({terminal_id})` only from the current terminal row's advertised action. This is explicit current-snapshot authority for one exact physical pane/process: Profiled Codex 0.154.0/0.155.1 may use either one exact current native Session or a verified-zero-rollout pane, where `identify_foreground` is diagnostic rather than a prerequisite; Claude Code still requires one exact current native Session. The pane must have no active Turn, approval, questionnaire/editor, or read-only viewer. It normally requires an idle empty Composer; when List advertises `model_options` for one exact stable profiled Codex 0.154.0/0.155.1 `/model` residual, AKK may continue only that residual into read-only catalog discovery. Show the returned `scope`, current selection, and semantic model/effort catalog to the user. Then call `agent_knock_knock_set_model({terminal_id,model,reasoning_effort})` with an exact required tuple from that same result in the same controller conversation. Codex scope is always `current_and_new_sessions`: a successful selection persists the model and an ordinary effort (including `max`) for future sessions, but `ultra` is current-session-only and Codex chooses a non-Ultra future fallback. Always read `effective` and `new_session_defaults` separately. Claude Code scope is always `current_session`. There is no caller-selectable scope. Never pass a display label, menu index, slash command, raw key, token, or fingerprint. A stale or consumed catalog must be refreshed, and `outcome="uncertain"` must never be retried automatically.
 
@@ -134,7 +134,7 @@ success; never retry an uncertain repair automatically.
 For native status inspection:
 
 1. Use only a current `available_actions.native_inspect({terminal_id,inspection:"status"})` entry. Those semantic arguments are complete; never add a command or authority field.
-2. Regression-tested profiles are Codex 0.146.0/0.146.1/0.147.0/0.148.0/0.149.1/0.150.1/0.151.0/0.153.0/0.153.4/0.154.0/0.155.1/0.158.0/0.159.0/0.159.2 and Claude Code 2.1.218/2.1.226/2.1.237/2.1.251/2.1.259/2.1.263/2.1.266/2.1.267/2.1.285 `inspection="status"`. Other complete `x.y.z` versions remain callable through the generic runtime profile and add a compatibility warning; actual incompatible UI or schema evidence fails at runtime and is not automatically retried. Claude success includes parsing and safely dismissing the newly opened Status panel. The inspection tool does not accept `/status` text or any arbitrary command string. `/usage`, `/cost`, `/stats`, `/usage-credits`, raw `/model`, `/compact`, and arbitrary slash commands remain unavailable; model changes use only the typed model-control tools above. Never automate bare Codex `/usage`: it opens an interactive menu whose later Enter can select an account-side usage-limit reset.
+2. Regression-tested profiles are Codex 0.146.0/0.146.1/0.147.0/0.148.0/0.149.1/0.150.1/0.151.0/0.153.0/0.153.4/0.154.0/0.155.1/0.158.0/0.159.0/0.159.2/0.159.3/0.160.0 and Claude Code 2.1.218/2.1.226/2.1.237/2.1.251/2.1.259/2.1.263/2.1.266/2.1.267/2.1.285 `inspection="status"`. Other complete `x.y.z` versions remain callable through the generic runtime profile and add a compatibility warning; actual incompatible UI or schema evidence fails at runtime and is not automatically retried. Claude success includes parsing and safely dismissing the newly opened Status panel. The inspection tool does not accept `/status` text or any arbitrary command string. `/usage`, `/cost`, `/stats`, `/usage-credits`, raw `/model`, `/compact`, and arbitrary slash commands remain unavailable; model changes use only the typed model-control tools above. Never automate bare Codex `/usage`: it opens an interactive menu whose later Enter can select an account-side usage-limit reset.
 3. Treat this as terminal input even though the native command is read-only. AKK privately derives a fresh binding fence and requires an idle empty composer, exact PID/process/pane/cwd/version identity, and no conflicting Turn, transition, dispatch, approval, or owner.
 4. Codex `/status` requires an exact viewport of at least 80 columns so the full Session UUID can be proven. That pre-UUID gate applies to native inspection, lifecycle, and strict Session operations that must know the UUID before terminal input. Legacy terminal-scoped ordinary tasks may send once and bind from exact native acceptance afterward without running `/status` or failing merely because the pane is narrow. Codex paginated read-contract candidates attempt their separate closed `/status` binding before physical Send. If an exact callback Watch cannot be prepared safely, AKK may prepare terminal-activity observation; report the receipt's actual callback mode and limitation.
 5. The result is valid only when AKK proves one fresh bounded native status result and the pane returns to idle. On an uncertain or unproven submission, do not retry, send Enter, clear the composer, or bypass AKK with raw terminal input.
@@ -236,7 +236,7 @@ Action-name glossary:
 
 - `status`: inspect one terminal, Turn, or Watch; it sends no native slash command.
 - `send`: deliver a new request, or perform the separately advertised immutable `retry_submission` form.
-- `watch` / `unwatch`: create or stop durable terminal observation; Codex 0.158.0/0.159.0/0.159.2 exact creation performs the closed `/status` transaction, while subsequent observation is read-only.
+- `watch` / `unwatch`: create or stop durable terminal observation; Codex 0.158.0/0.159.0/0.159.2/0.159.3/0.160.0 exact creation performs the closed `/status` transaction, while subsequent observation is read-only.
 - `list_resumable_threads`, `new_thread`, and `resume_thread`: inspect or change native thread context through their closed lifecycle protocols.
 - `native_inspect`: run only an advertised closed native inspection such as `status`.
 - `model_options`, `repair_model_control`, and `set_model`: discover the current native catalog, clear only a proven model-control residue, or consume one catalog offer.