@seawork/server 1.0.22-rc.3 → 2.0.2-rc.6

package/dist/server/server/library/hub-install.js

@@ -0,0 +1,263 @@
+import { createHash } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { mkdir, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { pipeline } from "node:stream/promises";
+import { Readable } from "node:stream";
+import { extract as tarExtract } from "tar";
+import { parseHubManifest } from "@seawork/hub-schema";
+import { CLAUDE_HUB_SKILL_PREFIX, CODEX_HUB_SKILL_PREFIX, } from "./library-types.js";
+/** Slug used as the library.skills key + on-disk dir suffix for a hub-installed skill. */
+export function hubIdToSlug(hubId) {
+    return hubId.replace("/", "-");
+}
+const DOWNLOAD_TIMEOUT_MS = 60000;
+export async function fetchAndExtract(spec, opts = {}) {
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    const workDir = await mkdtemp(join(tmpdir(), "seawork-hub-install-"));
+    const tarballPath = join(workDir, "skill.tar.gz");
+    const extractDir = join(workDir, "extract");
+    const cleanup = async () => {
+        await rm(workDir, { recursive: true, force: true });
+    };
+    // Download
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), DOWNLOAD_TIMEOUT_MS);
+        try {
+            const res = await fetchImpl(spec.tarballUrl, { signal: controller.signal });
+            if (!res.ok || !res.body) {
+                await cleanup();
+                return {
+                    kind: "error",
+                    code: "download-failed",
+                    message: `HTTP ${res.status} ${res.statusText} from ${spec.tarballUrl}`,
+                };
+            }
+            // Stream body to disk while computing sha256
+            const hash = createHash("sha256");
+            const out = createWriteStream(tarballPath);
+            const nodeStream = Readable.fromWeb(res.body);
+            nodeStream.on("data", (chunk) => hash.update(chunk));
+            await pipeline(nodeStream, out);
+            const actual = hash.digest("hex");
+            if (actual.toLowerCase() !== spec.tarballSha256.toLowerCase()) {
+                await cleanup();
+                return {
+                    kind: "error",
+                    code: "checksum-failed",
+                    message: `expected sha256=${spec.tarballSha256}, got ${actual}`,
+                };
+            }
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    catch (err) {
+        await cleanup();
+        return {
+            kind: "error",
+            code: "download-failed",
+            message: err instanceof Error ? err.message : String(err),
+        };
+    }
+    // Extract. Only allow regular files and directories: symlinks/hardlinks in a
+    // malicious tarball (e.g. `claude/SKILL.md -> ../../.ssh/id_ed25519`) would let
+    // the later readFile() follow the link out of extractDir despite resolveInside's
+    // string check, so we drop them at unpack time. `preservePaths: false` (default)
+    // already strips absolute paths and `..`; this closes the symlink hole too.
+    try {
+        await mkdir(extractDir, { recursive: true });
+        await tarExtract({
+            file: tarballPath,
+            cwd: extractDir,
+            // @types/tar mistypes the extract filter's entry as fs.Stats; at runtime
+            // it's a tar ReadEntry whose `type` is the archive entry kind string.
+            filter: (_path, entry) => {
+                const type = entry.type;
+                return type === "File" || type === "Directory";
+            },
+        });
+    }
+    catch (err) {
+        await cleanup();
+        return {
+            kind: "error",
+            code: "extract-failed",
+            message: err instanceof Error ? err.message : String(err),
+        };
+    }
+    // Tarball roots vary; find the directory containing manifest.json. We look one level
+    // deep so both a flat archive and a single-top-dir archive (the conventional layout) work.
+    const manifestPath = await findManifestPath(extractDir);
+    if (!manifestPath) {
+        await cleanup();
+        return {
+            kind: "error",
+            code: "extract-failed",
+            message: "manifest.json not found in tarball (expected at root or first subdirectory)",
+        };
+    }
+    let manifest;
+    try {
+        const raw = JSON.parse(await readFile(manifestPath.full, "utf8"));
+        const parsed = parseHubManifest(raw);
+        if (parsed.kind !== "ok") {
+            await cleanup();
+            const detail = parsed.kind === "invalid"
+                ? parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
+                : `unsupported schemaVersion ${parsed.found} (this daemon supports ${parsed.supported})`;
+            return { kind: "error", code: "extract-failed", message: `manifest.json invalid: ${detail}` };
+        }
+        manifest = parsed.value;
+    }
+    catch (err) {
+        await cleanup();
+        return {
+            kind: "error",
+            code: "extract-failed",
+            message: `failed to read manifest.json: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    opts.logger?.debug({ hubId: manifest.id, version: manifest.version, root: manifestPath.dir }, "hub install: tarball extracted");
+    return { kind: "ok", extractDir: manifestPath.dir, manifest, cleanup };
+}
+/**
+ * Full hub install pipeline: download + verify + extract + (conflict check) +
+ * persist into the Library registry. The Library's own sync writes to disk.
+ */
+export async function installHubSkill(opts) {
+    const result = await fetchAndExtract({ tarballUrl: opts.tarballUrl, tarballSha256: opts.tarballSha256 }, { logger: opts.logger, fetchImpl: opts.fetchImpl });
+    if (result.kind === "error") {
+        return { kind: "error", code: result.code, message: result.message };
+    }
+    const slug = hubIdToSlug(opts.hubId);
+    // Conflict detection: if a non-hub skill with the same slug already exists in
+    // the registry, refuse. The user might have created it themselves.
+    const library = await opts.store.load();
+    const existing = library.skills?.[slug];
+    if (existing && existing.source !== "hub") {
+        await result.cleanup();
+        return { kind: "conflict", slug, conflictingName: slug };
+    }
+    try {
+        const claudeContent = await readSkillFile(result.extractDir, opts.claudeSkillPath);
+        const codexContent = await readSkillFile(result.extractDir, opts.codexSkillPath);
+        const entry = {
+            content: claudeContent,
+            contentCodex: codexContent === claudeContent ? undefined : codexContent,
+            providers: ["claude", "codex"],
+            autoAttach: true,
+            source: "hub",
+            updatedAt: new Date().toISOString(),
+            hub: {
+                hubId: opts.hubId,
+                version: opts.version,
+                tarballSha256: opts.tarballSha256,
+                installedAt: new Date().toISOString(),
+            },
+        };
+        await opts.store.upsertSkill(slug, entry);
+        await result.cleanup();
+        return {
+            kind: "installed",
+            slug,
+            installedPaths: {
+                claude: `${opts.claudeHomeDir ?? "~/.claude"}/skills/${CLAUDE_HUB_SKILL_PREFIX}${slug}/SKILL.md`,
+                codex: `${opts.codexHomeDir ?? "~/.codex"}/skills/${CODEX_HUB_SKILL_PREFIX}${slug}/SKILL.md`,
+            },
+            entry,
+        };
+    }
+    catch (err) {
+        await result.cleanup();
+        return {
+            kind: "error",
+            code: "write-failed",
+            message: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+/**
+ * Remove a hub-installed skill. Returns "not-installed" if it isn't registered
+ * as hub-installed (we never touch user-owned skills).
+ */
+export async function uninstallHubSkill(opts) {
+    const slug = hubIdToSlug(opts.hubId);
+    try {
+        const library = await opts.store.load();
+        const entry = library.skills?.[slug];
+        if (!entry || entry.source !== "hub") {
+            return { kind: "not-installed" };
+        }
+        await opts.store.delete("skill", slug);
+        return { kind: "uninstalled", slug };
+    }
+    catch (err) {
+        return { kind: "error", message: err instanceof Error ? err.message : String(err) };
+    }
+}
+/**
+ * Resolve a manifest-supplied skill path against the extracted tarball dir and
+ * assert it stays inside. The daemon re-fetches the tarball and trusts whatever
+ * paths the manifest carries, so a malicious/compromised tarball could set
+ * `claudeSkillPath: "../../.ssh/id_ed25519"` (or an absolute path) and make the
+ * daemon read arbitrary local files into the skill registry. This is the
+ * authoritative check — schema validation (hub-schema) is only defense-in-depth.
+ */
+function resolveInside(extractDir, relPath) {
+    if (isAbsolute(relPath) || /^[a-zA-Z]:/.test(relPath) || relPath.includes("\\")) {
+        throw new Error(`skill path must be relative and inside the tarball: ${relPath}`);
+    }
+    const root = resolve(extractDir);
+    const target = resolve(root, relPath);
+    const rel = relative(root, target);
+    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+        throw new Error(`skill path escapes the tarball: ${relPath}`);
+    }
+    return target;
+}
+/**
+ * Read a manifest-supplied skill file from the extracted tarball. Two layers:
+ * resolveInside() rejects absolute/`..` string paths, then realpath() resolves
+ * any symlinks and re-checks the boundary — so even if a symlink slips past the
+ * unpack-time filter, a link pointing outside extractDir is rejected before its
+ * target is read. realpath also rejects non-existent paths (ENOENT) by throwing.
+ */
+async function readSkillFile(extractDir, relPath) {
+    const target = resolveInside(extractDir, relPath);
+    const root = await realpath(resolve(extractDir));
+    const realTarget = await realpath(target);
+    const rel = relative(root, realTarget);
+    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+        throw new Error(`skill path escapes the tarball: ${relPath}`);
+    }
+    return readFile(realTarget, "utf8");
+}
+async function findManifestPath(root) {
+    const { readdir, stat } = await import("node:fs/promises");
+    const top = join(root, "manifest.json");
+    try {
+        if ((await stat(top)).isFile())
+            return { full: top, dir: root };
+    }
+    catch {
+        // not at root, try one level deeper
+    }
+    const entries = await readdir(root);
+    for (const entry of entries) {
+        const subDir = join(root, entry);
+        const candidate = join(subDir, "manifest.json");
+        try {
+            if ((await stat(candidate)).isFile())
+                return { full: candidate, dir: subDir };
+        }
+        catch {
+            // skip
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=hub-install.js.map

package/dist/server/server/library/hub-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-install.js","sourceRoot":"","sources":["../../../../src/server/library/hub-install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,KAAK,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAoB,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAE5B,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,mBAAmB,GAAG,KAAM,CAAC;AAoBnC,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAkB,EAClB,OAAsD,EAAE;IAExD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC;IAEF,WAAW;IACX,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACzB,MAAM,OAAO,EAAE,CAAC;gBAChB,OAAO;oBACL,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,SAAS,IAAI,CAAC,UAAU,EAAE;iBACxE,CAAC;YACJ,CAAC;YACD,6CAA6C;YAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAa,CAAC,CAAC;YACvD,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,MAAM,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC9D,MAAM,OAAO,EAAE,CAAC;gBAChB,OAAO;oBACL,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,mBAAmB,IAAI,CAAC,aAAa,SAAS,MAAM,EAAE;iBAChE,CAAC;YACJ,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,UAAU,CAAC;YACf,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,UAAU;YACf,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBACvB,MAAM,IAAI,GAAI,KAAsC,CAAC,IAAI,CAAC;gBAC1D,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW,CAAC;YACjD,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,qFAAqF;IACrF,2FAA2F;IAC3F,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,6EAA6E;SACvF,CAAC;IACJ,CAAC;IAED,IAAI,QAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,OAAO,EAAE,CAAC;YAChB,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,KAAK,SAAS;gBACvB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChF,CAAC,CAAC,6BAA6B,MAAM,CAAC,KAAK,0BAA0B,MAAM,CAAC,SAAS,GAAG,CAAC;YAC7F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,MAAM,EAAE,EAAE,CAAC;QAChG,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC7F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,KAAK,CAChB,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,EAAE,EACzE,gCAAgC,CACjC,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACzE,CAAC;AAiCD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAyB;IAC7D,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAClE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CACnD,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAErC,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1C,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACnF,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAEjF,MAAM,KAAK,GAAsB;YAC/B,OAAO,EAAE,aAAa;YACtB,YAAY,EAAE,YAAY,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY;YACvE,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YAC9B,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,EAAE;gBACH,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACtC;SACF,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QAEvB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,cAAc,EAAE;gBACd,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,WAAW,uBAAuB,GAAG,IAAI,WAAW;gBAChG,KAAK,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,UAAU,WAAW,sBAAsB,GAAG,IAAI,WAAW;aAC7F;YACD,KAAK;SACN,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAGvC;IAKC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACtF,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,UAAkB,EAAE,OAAe;IACxD,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,uDAAuD,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAE,OAAe;IAC9D,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/server/server/library/hub-test-run.d.ts

@@ -0,0 +1,81 @@
+import type { Logger } from "pino";
+import type { AgentClient } from "../agent/agent-sdk-types.js";
+import { type HubFetchSpec } from "./hub-install.js";
+/** Temp-dir prefix so a startup sweeper can reclaim leaked sandboxes. */
+export declare const TEST_RUN_PREFIX = "seawork-hub-testrun-";
+export interface TestRunChunk {
+    kind: "assistant" | "reasoning" | "tool";
+    text?: string;
+    toolName?: string;
+    toolSummary?: string;
+}
+export interface RunHubTestOpts {
+    hubId: string;
+    spec: HubFetchSpec;
+    prompt: string;
+    codexClient: AgentClient;
+    /** Override the codex model; defaults to the client's default-listed model. */
+    model?: string;
+    logger?: Logger;
+    onChunk: (chunk: TestRunChunk) => void;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+}
+export type RunHubTestResult = {
+    kind: "completed";
+    finalText: string;
+} | {
+    kind: "canceled";
+} | {
+    kind: "error";
+    code: "download-failed" | "checksum-failed" | "extract-failed" | "spawn-failed" | "timeout" | "run-failed";
+    message: string;
+};
+export declare function runHubTest(opts: RunHubTestOpts): Promise<RunHubTestResult>;
+export interface HubTestRunStartMessage {
+    type: "hub_test_run_start_request";
+    requestId: string;
+    hubId: string;
+    tarballUrl: string;
+    tarballSha256: string;
+    prompt: string;
+}
+export interface HubTestRunChunkMessage {
+    type: "hub_test_run_chunk";
+    requestId: string;
+    kind: "assistant" | "reasoning" | "tool";
+    text?: string;
+    toolName?: string;
+    toolSummary?: string;
+}
+export interface HubTestRunDoneMessage {
+    type: "hub_test_run_done_response";
+    requestId: string;
+    status: "completed" | "canceled" | "error" | "not-implemented";
+    finalText?: string;
+    code?: "download-failed" | "checksum-failed" | "extract-failed" | "spawn-failed" | "timeout" | "run-failed" | "not-implemented";
+    message?: string;
+}
+export interface HubTestRunContext {
+    codexClient: AgentClient;
+    logger?: Logger;
+    emitChunk: (chunk: HubTestRunChunkMessage) => void;
+    /** Shared map so a cancel request can abort the matching in-flight run. */
+    inFlight: Map<string, AbortController>;
+    /** Max concurrent test runs across this session. */
+    maxConcurrent?: number;
+}
+export declare function handleHubTestRunStart(msg: HubTestRunStartMessage, ctx: HubTestRunContext): Promise<HubTestRunDoneMessage>;
+/** Abort an in-flight test run. No-op if the requestId is unknown. */
+export declare function handleHubTestRunCancel(requestId: string, inFlight: Map<string, AbortController>): void;
+/**
+ * Reclaim test-run sandboxes left behind by a daemon crash mid-run. Normal runs
+ * clean up in their own `finally`; this is the backstop. Called once at startup.
+ * Only removes dirs older than `maxAgeMs` so it never races a live run.
+ */
+export declare function sweepLeakedTestRuns(opts?: {
+    maxAgeMs?: number;
+    logger?: Logger;
+}): Promise<void>;
+//# sourceMappingURL=hub-test-run.d.ts.map

package/dist/server/server/library/hub-test-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-test-run.d.ts","sourceRoot":"","sources":["../../../../src/server/library/hub-test-run.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAgC,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEnF,yEAAyE;AACzE,eAAO,MAAM,eAAe,yBAAyB,CAAC;AAItD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,WAAW,CAAC;IACzB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IACE,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EACA,iBAAiB,GACjB,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,SAAS,GACT,YAAY,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,wBAAsB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8HhF;AAMD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,4BAA4B,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,4BAA4B,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,OAAO,GAAG,iBAAiB,CAAC;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EACD,iBAAiB,GACjB,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,SAAS,GACT,YAAY,GACZ,iBAAiB,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,IAAI,CAAC;IACnD,2EAA2E;IAC3E,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvC,oDAAoD;IACpD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,sBAAsB,EAC3B,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,qBAAqB,CAAC,CA6ChC;AAED,sEAAsE;AACtE,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GACrC,IAAI,CAEN;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAChD,OAAO,CAAC,IAAI,CAAC,CAuBf"}

package/dist/server/server/library/hub-test-run.js

@@ -0,0 +1,237 @@
+// Hub "test run": load a single hub skill into a throwaway sandbox and run one
+// prompt against it, streaming output back, then delete the sandbox. The skill
+// is dropped into `<tempCwd>/.codex/skills/<name>/` and the agent's cwd is set to
+// `<tempCwd>` — Codex discovers project-relative skills there (verified), so we
+// never touch the user's ~/.codex or their installed skills. Nothing is written
+// to the LibraryStore or the provider session ledger (the session is internal
+// and never registered with AgentManager).
+import { cp, mkdir, mkdtemp, readdir, rm, stat } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fetchAndExtract, hubIdToSlug } from "./hub-install.js";
+/** Temp-dir prefix so a startup sweeper can reclaim leaked sandboxes. */
+export const TEST_RUN_PREFIX = "seawork-hub-testrun-";
+const DEFAULT_TIMEOUT_MS = 120000;
+export async function runHubTest(opts) {
+    const { hubId, spec, prompt, codexClient, logger, onChunk, signal } = opts;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    if (signal?.aborted)
+        return { kind: "canceled" };
+    // 1. Download + verify + extract the tarball (reuses install path).
+    const extracted = await fetchAndExtract(spec, { logger, fetchImpl: opts.fetchImpl });
+    if (extracted.kind === "error") {
+        return { kind: "error", code: extracted.code, message: extracted.message };
+    }
+    const { extractDir, manifest, cleanup: cleanupTarball } = extracted;
+    // 2. Build a sandbox cwd and drop the codex skill into <cwd>/.codex/skills/<slug>/.
+    const sandboxCwd = await mkdtemp(join(tmpdir(), TEST_RUN_PREFIX));
+    const skillSrcDir = join(extractDir, dirname(manifest.codexSkillPath)); // e.g. extract/codex
+    const slug = hubIdToSlug(hubId);
+    const skillDestDir = join(sandboxCwd, ".codex", "skills", slug);
+    const cleanupAll = async () => {
+        await rm(sandboxCwd, { recursive: true, force: true }).catch(() => { });
+        await cleanupTarball().catch(() => { });
+    };
+    let session;
+    let unsubscribe;
+    try {
+        await mkdir(dirname(skillDestDir), { recursive: true });
+        await cp(skillSrcDir, skillDestDir, { recursive: true });
+        if (signal?.aborted) {
+            await cleanupAll();
+            return { kind: "canceled" };
+        }
+        // 3. Spawn an internal, non-interactive, read-only Codex session in the sandbox.
+        //    modeId "read-only" gives a read-only sandbox; we override approvalPolicy
+        //    to "never" so the unattended run never blocks on a permission prompt.
+        //    The model is resolved from the daemon's configured codex models (the
+        //    gateway-accepted default) unless the caller passed one explicitly.
+        try {
+            let model = opts.model;
+            if (!model) {
+                const models = await codexClient.listModels().catch(() => []);
+                model = (models.find((m) => m.isDefault) ?? models[0])?.id;
+            }
+            session = await codexClient.createSession({
+                provider: "codex",
+                cwd: sandboxCwd,
+                internal: true,
+                title: "Hub skill test run",
+                modeId: "read-only",
+                ...(model ? { model } : {}),
+                approvalPolicy: "never", // never block on a permission prompt
+                sandboxMode: "read-only", // no writes, no surprises
+                networkAccess: false,
+            });
+        }
+        catch (err) {
+            await cleanupAll();
+            return {
+                kind: "error",
+                code: "spawn-failed",
+                message: err instanceof Error ? err.message : String(err),
+            };
+        }
+        // 4. Stream timeline items back to the caller as they arrive.
+        unsubscribe = session.subscribe((event) => {
+            if (event.type !== "timeline")
+                return;
+            const item = event.item;
+            if (item.type === "assistant_message")
+                onChunk({ kind: "assistant", text: item.text });
+            else if (item.type === "reasoning")
+                onChunk({ kind: "reasoning", text: item.text });
+            else if (item.type === "tool_call")
+                onChunk({ kind: "tool", toolName: item.name, toolSummary: summarizeTool(item) });
+            else if (item.type === "error")
+                onChunk({ kind: "assistant", text: `[error] ${item.message}` });
+        });
+        // 5. Run the prompt with a timeout + cancellation race.
+        const activeSession = session;
+        let timer;
+        let abortListener;
+        const interrupt = () => {
+            void activeSession.interrupt().catch(() => { });
+        };
+        try {
+            const result = await Promise.race([
+                activeSession
+                    .run(prompt)
+                    .then((r) => ({ outcome: "done", finalText: r.finalText })),
+                new Promise((resolve) => {
+                    timer = setTimeout(() => {
+                        interrupt();
+                        resolve({ outcome: "timeout" });
+                    }, timeoutMs);
+                }),
+                new Promise((resolve) => {
+                    if (signal) {
+                        abortListener = () => {
+                            interrupt();
+                            resolve({ outcome: "canceled" });
+                        };
+                        signal.addEventListener("abort", abortListener, { once: true });
+                    }
+                }),
+            ]);
+            if (result.outcome === "timeout")
+                return { kind: "error", code: "timeout", message: `test run exceeded ${timeoutMs}ms` };
+            if (result.outcome === "canceled")
+                return { kind: "canceled" };
+            return { kind: "completed", finalText: result.finalText };
+        }
+        catch (err) {
+            return {
+                kind: "error",
+                code: "run-failed",
+                message: err instanceof Error ? err.message : String(err),
+            };
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            if (signal && abortListener)
+                signal.removeEventListener("abort", abortListener);
+        }
+    }
+    finally {
+        unsubscribe?.();
+        if (session)
+            await session.close().catch(() => { });
+        await cleanupAll();
+    }
+}
+const DEFAULT_MAX_CONCURRENT = 2;
+export async function handleHubTestRunStart(msg, ctx) {
+    const max = ctx.maxConcurrent ?? DEFAULT_MAX_CONCURRENT;
+    if (ctx.inFlight.size >= max) {
+        return {
+            type: "hub_test_run_done_response",
+            requestId: msg.requestId,
+            status: "error",
+            code: "run-failed",
+            message: `too many test runs in flight (max ${max})`,
+        };
+    }
+    const controller = new AbortController();
+    ctx.inFlight.set(msg.requestId, controller);
+    try {
+        const result = await runHubTest({
+            hubId: msg.hubId,
+            spec: { tarballUrl: msg.tarballUrl, tarballSha256: msg.tarballSha256 },
+            prompt: msg.prompt,
+            codexClient: ctx.codexClient,
+            logger: ctx.logger,
+            signal: controller.signal,
+            onChunk: (chunk) => ctx.emitChunk({ type: "hub_test_run_chunk", requestId: msg.requestId, ...chunk }),
+        });
+        if (result.kind === "completed")
+            return {
+                type: "hub_test_run_done_response",
+                requestId: msg.requestId,
+                status: "completed",
+                finalText: result.finalText,
+            };
+        if (result.kind === "canceled")
+            return { type: "hub_test_run_done_response", requestId: msg.requestId, status: "canceled" };
+        return {
+            type: "hub_test_run_done_response",
+            requestId: msg.requestId,
+            status: "error",
+            code: result.code,
+            message: result.message,
+        };
+    }
+    finally {
+        ctx.inFlight.delete(msg.requestId);
+    }
+}
+/** Abort an in-flight test run. No-op if the requestId is unknown. */
+export function handleHubTestRunCancel(requestId, inFlight) {
+    inFlight.get(requestId)?.abort();
+}
+/**
+ * Reclaim test-run sandboxes left behind by a daemon crash mid-run. Normal runs
+ * clean up in their own `finally`; this is the backstop. Called once at startup.
+ * Only removes dirs older than `maxAgeMs` so it never races a live run.
+ */
+export async function sweepLeakedTestRuns(opts = {}) {
+    const maxAgeMs = opts.maxAgeMs ?? 60 * 60 * 1000; // 1h
+    const now = Date.now();
+    let entries;
+    try {
+        entries = await readdir(tmpdir());
+    }
+    catch {
+        return;
+    }
+    let removed = 0;
+    for (const name of entries) {
+        if (!name.startsWith(TEST_RUN_PREFIX))
+            continue;
+        const full = join(tmpdir(), name);
+        try {
+            const info = await stat(full);
+            if (now - info.mtimeMs < maxAgeMs)
+                continue;
+            await rm(full, { recursive: true, force: true });
+            removed++;
+        }
+        catch {
+            // best-effort; skip anything we can't stat/remove
+        }
+    }
+    if (removed > 0)
+        opts.logger?.debug({ removed }, "swept leaked hub test-run sandboxes");
+}
+function summarizeTool(item) {
+    const d = item.detail;
+    if (!d)
+        return item.name;
+    if (Array.isArray(d.command))
+        return d.command.join(" ").slice(0, 200);
+    if (typeof d.path === "string")
+        return d.path;
+    return d.type ?? item.name;
+}
+//# sourceMappingURL=hub-test-run.js.map

package/dist/server/server/library/hub-test-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-test-run.js","sourceRoot":"","sources":["../../../../src/server/library/hub-test-run.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,kFAAkF;AAClF,gFAAgF;AAChF,gFAAgF;AAChF,8EAA8E;AAC9E,2CAA2C;AAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAI1C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAqB,MAAM,kBAAkB,CAAC;AAEnF,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAEtD,MAAM,kBAAkB,GAAG,MAAO,CAAC;AAsCnC,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAoB;IACnD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAEvD,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAEjD,oEAAoE;IACpE,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACrF,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC;IAEpE,oFAAoF;IACpF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,qBAAqB;IAC7F,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEhE,MAAM,UAAU,GAAG,KAAK,IAAmB,EAAE;QAC3C,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,IAAI,OAAiC,CAAC;IACtC,IAAI,WAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,UAAU,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC9B,CAAC;QAED,iFAAiF;QACjF,8EAA8E;QAC9E,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC;YACH,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9D,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7D,CAAC;YACD,OAAO,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC;gBACxC,QAAQ,EAAE,OAAO;gBACjB,GAAG,EAAE,UAAU;gBACf,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,oBAAoB;gBAC3B,MAAM,EAAE,WAAW;gBACnB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,cAAc,EAAE,OAAO,EAAE,qCAAqC;gBAC9D,WAAW,EAAE,WAAW,EAAE,0BAA0B;gBACpD,aAAa,EAAE,KAAK;aACrB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,EAAE,CAAC;YACnB,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;YACxC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;gBAAE,OAAO;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACxB,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;gBAAE,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;iBAClF,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;iBAC/E,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;gBAChC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;iBAC9E,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;gBAC5B,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,wDAAwD;QACxD,MAAM,aAAa,GAAG,OAAO,CAAC;QAC9B,IAAI,KAAgD,CAAC;QACrD,IAAI,aAAuC,CAAC;QAC5C,MAAM,SAAS,GAAG,GAAS,EAAE;YAC3B,KAAK,aAAa,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,aAAa;qBACV,GAAG,CAAC,MAAM,CAAC;qBACX,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAe,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;gBACtE,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,EAAE;oBAC9C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;wBACtB,SAAS,EAAE,CAAC;wBACZ,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;oBAClC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAChB,CAAC,CAAC;gBACF,IAAI,OAAO,CAA0B,CAAC,OAAO,EAAE,EAAE;oBAC/C,IAAI,MAAM,EAAE,CAAC;wBACX,aAAa,GAAG,GAAG,EAAE;4BACnB,SAAS,EAAE,CAAC;4BACZ,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;wBACnC,CAAC,CAAC;wBACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAClE,CAAC;gBACH,CAAC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;gBAC9B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,SAAS,IAAI,EAAE,CAAC;YACzF,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU;gBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,MAAM,IAAI,aAAa;gBAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,EAAE,CAAC;QAChB,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnD,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAkDD,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAA2B,EAC3B,GAAsB;IAEtB,MAAM,GAAG,GAAG,GAAG,CAAC,aAAa,IAAI,sBAAsB,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,4BAA4B;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,qCAAqC,GAAG,GAAG;SACrD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE;YACtE,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,KAAK,EAAE,CAAC;SACpF,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;YAC7B,OAAO;gBACL,IAAI,EAAE,4BAA4B;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;YAC5B,OAAO,EAAE,IAAI,EAAE,4BAA4B,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC9F,OAAO;YACL,IAAI,EAAE,4BAA4B;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,QAAsC;IAEtC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA+C,EAAE;IAEjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,SAAS;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ;gBAAE,SAAS;YAC5C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,qCAAqC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,aAAa,CAAC,IAAwC;IAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,MAA0E,CAAC;IAC1F,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IAC9C,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;AAC7B,CAAC"}

package/dist/server/server/library/library-import.d.ts

@@ -0,0 +1,27 @@
+import type { Logger } from "pino";
+import { type LibraryFile } from "./library-types.js";
+/**
+ * Scans ~/.claude.json, ~/.codex/config.toml, ~/.claude/skills/* and Codex
+ * skill discovery paths and merges everything into a single library snapshot.
+ * Name collisions across providers are union-merged (providers list grows,
+ * enabledFor flags both set true).
+ *
+ * Safe to call repeatedly — caller decides whether to persist via LibraryStore.
+ */
+export interface ImportOptions {
+    /** Override ~ for tests. */
+    homeDir?: string;
+    /** cwd used when discovering codex skills (for repo-root walk). */
+    cwd?: string;
+    logger?: Logger;
+}
+export interface ImportResult {
+    library: LibraryFile;
+    importedMcp: number;
+    importedSkills: number;
+    skipped: string[];
+}
+export declare function importExisting(opts?: ImportOptions): Promise<ImportResult>;
+export declare const mergeMcpEntry: (existing: NonNullable<LibraryFile["mcpServers"]>[string] | undefined, incoming: NonNullable<LibraryFile["mcpServers"]>[string]) => NonNullable<LibraryFile["mcpServers"]>[string];
+export declare const mergeSkillEntry: (existing: NonNullable<LibraryFile["skills"]>[string] | undefined, incoming: NonNullable<LibraryFile["skills"]>[string]) => NonNullable<LibraryFile["skills"]>[string];
+//# sourceMappingURL=library-import.d.ts.map

package/dist/server/server/library/library-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"library-import.d.ts","sourceRoot":"","sources":["../../../../src/server/library/library-import.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,EAAiC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAIrF;;;;;;;GAOG;AAEH,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,WAAW,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAsB,cAAc,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAgBpF;AAoKD,eAAO,MAAM,aAAa,GACxB,UAAU,WAAW,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,EACpE,UAAU,WAAW,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KACvD,WAAW,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAiC,CAAC;AAElF,eAAO,MAAM,eAAe,GAC1B,UAAU,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,EAChE,UAAU,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KACnD,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAmC,CAAC"}