@sema-agent/server 1.185.0

package/deploy/sema-up/smoke.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# sema cloud smoke 的 service 半场(§3d:装后即验+可随时手动跑;全绿才算"部署成功")。
+# 两种用法:
+#   本机 project 模式: smoke.sh --project=NAME            (全套:数据面直验+引擎)
+#   远程 URL 模式:     smoke.sh --url=http://host:8090 --token=T   (引擎面:health/auth/真任务)
+# 每项 OK/FAIL 一行;FAIL 带原因+建议(§3d-2 报错规范);exit 0=全绿。
+set -u
+
+PROJECT="" URL="" TOKEN=""
+for a in "$@"; do case "$a" in
+  --project=*) PROJECT="${a#*=}" ;;
+  --url=*) URL="${a#*=}" ;;
+  --token=*) TOKEN="${a#*=}" ;;
+esac; done
+
+FAILS=0
+ok()   { printf '[OK  ] %s\n' "$1"; }
+fail() { printf '[FAIL] %s — %s\n      ↳ 建议:%s\n' "$1" "$2" "$3"; FAILS=$((FAILS+1)); }
+
+if [ -n "$PROJECT" ]; then
+  ENVF="$HOME/.sema-up/$PROJECT/.env"
+  [ -r "$ENVF" ] || { echo "找不到 $ENVF(先跑 sema-up.sh)"; exit 1; }
+  . "$ENVF"
+  TOKEN="${TOKEN:-${SERVICE_AUTH_TOKEN:-}}"
+  # 引擎面只在带 agent 的档默认探(data-center 没有引擎,探 8090 必假红);--url 显式给了照跑
+  case "${DEPLOY_PROFILE:-full-single}" in
+    full-single|local-plus) URL="${URL:-http://127.0.0.1:${SERVER_PORT:-8090}}" ;;
+  esac
+
+  # 数据面直验按容器在场性闸:local-plus/外接 PG/外接 S3 时对应容器不存在,不该假红
+  HAS_PG=false; docker ps --format '{{.Names}}' 2>/dev/null | grep -qx "${PROJECT}-pg-1" && HAS_PG=true
+  HAS_S3=false; docker ps --format '{{.Names}}' 2>/dev/null | grep -qx "${PROJECT}-minio-1" && HAS_S3=true
+  if $HAS_PG; then
+  # ① PG:连通+durable 前提(SHOW 一个调优参数=配置真生效)
+  SB=$(docker exec "${PROJECT}-pg-1" psql -U sema -d sema -tAc "SHOW shared_buffers" 2>/dev/null)
+  [ -n "$SB" ] && ok "PG 连通(shared_buffers=$SB)" || fail "PG" "容器不可达或未就绪" "docker compose -p $PROJECT logs pg"
+  # ② PG 读写往返(临时表,不留痕)
+  RW=$(docker exec "${PROJECT}-pg-1" psql -U sema -d sema -tAc "CREATE TEMP TABLE _smoke(v int); INSERT INTO _smoke VALUES (7); SELECT v FROM _smoke" 2>/dev/null | tail -1)
+  [ "$RW" = "7" ] && ok "PG 读写往返" || fail "PG 读写" "写入/读回失败" "看 PG 日志与磁盘空间"
+  fi
+  if $HAS_S3; then
+  # ③ S3:put/get/rm 往返(§3c 外接校验同款动作)
+  # --entrypoint sh:minio/mc 镜像 entrypoint 是 mc,直接给 sh -c 会拼成 "mc sh -c"(真机验出);
+  # 哨兵判定(cat 回读值核对后 echo),不依赖各 mc 子命令的输出行为
+  S3RT=$(docker run --rm --entrypoint sh --network "${PROJECT}_default" -e MC_HOST_x="http://sema:${MINIO_PASSWORD}@minio:9000" "${MC_IMAGE:-minio/mc:latest}" -c 'echo smoke > /tmp/s && mc cp /tmp/s x/blobs/_smoke >/dev/null && [ "$(mc cat x/blobs/_smoke)" = smoke ] && mc rm x/blobs/_smoke >/dev/null && echo S3_ROUNDTRIP_OK' 2>/dev/null | tail -1)
+  [ "$S3RT" = "S3_ROUNDTRIP_OK" ] && ok "S3 put/get/rm 往返" || fail "S3" "对象读写失败" "docker compose -p $PROJECT logs minio"
+  # ③b 三个约定桶逐个点名(data-center 验收:ls 行数≠桶名对——错桶也会凑数)
+  BKTS=$(docker run --rm --entrypoint sh --network "${PROJECT}_default" -e MC_HOST_x="http://sema:${MINIO_PASSWORD}@minio:9000" "${MC_IMAGE:-minio/mc:latest}" -c 'for b in workspaces blobs backups; do mc ls "x/$b" >/dev/null 2>&1 && printf "%s " "$b"; done' 2>/dev/null)
+  [ "$BKTS" = "workspaces blobs backups " ] && ok "桶就绪(workspaces/blobs/backups)" || fail "桶" "缺桶:应有 workspaces/blobs/backups,实有 ${BKTS:-无}" "重跑 sema-up.sh(建桶幂等)"
+  fi
+  # 外接数据面(--pg-url/--s3-endpoint):有 endpoint 就远程直验(证书不校验)
+  if [ -n "${AGENT_PG_HOST:-}" ] && ! $HAS_PG && [ "${DEPLOY_PROFILE:-}" != "local-plus" ]; then
+    EPG=$(docker run --rm "${PG_IMAGE:-postgres:17}" psql "postgres://${AGENT_PG_USER:-sema}:${PG_PASSWORD}@${AGENT_PG_HOST}:${AGENT_PG_PORT:-5432}/${AGENT_PG_DATABASE:-sema}" -tAc 'select 1' 2>/dev/null | tail -1)
+    [ "$EPG" = "1" ] && ok "外接 PG 连通(${AGENT_PG_HOST})" || fail "外接 PG" "select 1 失败" "核对端点/凭据/网络(容器出网)"
+  fi
+  if [ -n "${AGENT_MINIO_ENDPOINT:-}" ] && ! $HAS_S3 && [ "${DEPLOY_PROFILE:-}" != "local-plus" ]; then
+    ES3=$(docker run --rm --entrypoint sh -e MC_HOST_x="$(printf '%s' "$AGENT_MINIO_ENDPOINT" | sed "s#://#://${AGENT_MINIO_USER:-sema}:${MINIO_PASSWORD}@#")" "${MC_IMAGE:-minio/mc:latest}" -c 'mc --insecure ls x/ >/dev/null 2>&1 && echo OK' 2>/dev/null | tail -1)
+    [ "$ES3" = "OK" ] && ok "外接 S3 连通(${AGENT_MINIO_ENDPOINT})" || fail "外接 S3" "ls 失败" "核对 endpoint/密钥(--insecure 已忽略证书)"
+  fi
+  # ④a 配置中心(registry=true 时)
+  if [ "${REGISTRY_ENABLED:-false}" = "true" ]; then
+    RC=$(curl -m5 -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${REGISTRY_PORT:-3000}/api/healthz")
+    [ "$RC" = "200" ] && ok "配置中心 healthz(store 可达)" || fail "配置中心" "healthz HTTP $RC(200=store 可达;503=store 挂)" "docker compose -p $PROJECT logs registry"
+  fi
+  # ④b Gitea(git=provision 时):healthz + token 真 API 往返
+  if [ "${GIT_MODE:-none}" = "provision" ]; then
+    GC=$(curl -m5 -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${GIT_HTTP_PORT:-3300}/api/healthz")
+    [ "$GC" = "200" ] && ok "Gitea healthz" || fail "Gitea" "healthz HTTP $GC" "docker compose -p $PROJECT logs git"
+    if [ -n "${GIT_ADMIN_TOKEN:-}" ]; then
+      GU=$(curl -m5 -s -H "Authorization: token $GIT_ADMIN_TOKEN" "http://127.0.0.1:${GIT_HTTP_PORT:-3300}/api/v1/user" | python3 -c 'import json,sys
+try: print(json.load(sys.stdin).get("login",""))
+except Exception: print("")' 2>/dev/null)
+      [ "$GU" = "${GIT_ADMIN_USER:-sema}" ] && ok "Gitea API token(user=$GU)" || fail "Gitea token" "token 验证失败" "token 可能被手动吊销;删 .env 的 GIT_ADMIN_TOKEN 行后重跑 sema-up.sh 再生成"
+    fi
+  fi
+fi
+
+if [ -n "$URL" ]; then
+  # ④ /health
+  H=$(curl -m5 -s "$URL/health" | head -c 200)
+  case "$H" in *'"status":"ok"'*) ok "/health($URL)" ;; *) fail "/health" "无响应或非 ok:${H:-空}" "服务没起/端口不对/防火墙;docker logs 或 systemctl 看进程" ;; esac
+  if [ -n "$TOKEN" ]; then
+    # ⑤ auth 门:无 token 必须 401(部署安全底线)
+    C=$(curl -m5 -s -o /dev/null -w '%{http_code}' -X POST "$URL/v1/tasks" -H "Content-Type: application/json" -d '{}')
+    [ "$C" = "401" ] && ok "auth 门(无 token=401)" || fail "auth 门" "无 token 返回 $C(应 401)" "SERVICE_AUTH_TOKEN 未生效=公网裸奔,立刻查 env"
+    # ⑥ 真任务 1-turn(同时是模型面探针:402=余额,401/403=key,超时=网关不通——欠费实验收编)
+    R=$(curl -m 120 -s -X POST "$URL/v1/tasks" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"objective":"请只回答:ok"}')
+    ST=$(printf '%s' "$R" | python3 -c 'import json,sys
+try: d=json.load(sys.stdin); print(d.get("status",""), "|", str(d.get("error") or d.get("result"))[:120])
+except Exception: print("parse-fail |", "")' 2>/dev/null)
+    case "$ST" in
+      completed*) ok "真任务 1-turn(模型面通)" ;;
+      *nsufficient*|*402*) fail "真任务" "模型 API 余额耗尽(402)" "充值或换 MODEL_API_KEY;余额恢复后重跑 smoke" ;;
+      *401*|*403*) fail "真任务" "模型 API key 无效" "检查 MODEL_API_KEY" ;;
+      *) fail "真任务" "status=${ST:-无响应}" "docker logs 看 done 帧 errorMessage(引擎会全文上流)" ;;
+    esac
+  fi
+fi
+
+[ $FAILS -eq 0 ] && { echo "✅ smoke 全绿"; exit 0; } || { echo "⛔ $FAILS 项失败"; exit 1; }

package/deploy/sema-up/stack/compose.dataroot.yaml

@@ -0,0 +1,16 @@
+# DATA_ROOT 覆盖层:数据卷落指定大盘(多盘机自动选大容量盘/--data-root 显式指)。
+# 只在 sema-up.sh 判定 DATA_ROOT 生效时以第二个 -f 叠加;目录由 Layer 0 预建。
+# ⚠ 只在首装选定(存 .env,不随重跑漂移)——换盘=先 --teardown-volumes 再重装迁数据。
+volumes:
+  pgdata:
+    driver: local
+    driver_opts: { type: none, o: bind, device: "${DATA_ROOT_DIR:?}/pgdata" }
+  miniodata:
+    driver: local
+    driver_opts: { type: none, o: bind, device: "${DATA_ROOT_DIR:?}/miniodata" }
+  registrydata:
+    driver: local
+    driver_opts: { type: none, o: bind, device: "${DATA_ROOT_DIR:?}/registrydata" }
+  gitdata:
+    driver: local
+    driver_opts: { type: none, o: bind, device: "${DATA_ROOT_DIR:?}/gitdata" }

package/deploy/sema-up/stack/compose.yaml

@@ -0,0 +1,155 @@
+# sema-stack 单机 Layer 1 清单(DEPLOY-OVERSEAS-PILOT §3 Layer 1,由 sema-up.sh 驱动,不手工 up)。
+# compose profiles 映射部署形态:
+#   data-center  → profiles: data(PG+MinIO+建桶)[+ registry][+ git]
+#   full-single  → data + agent(sema-server)[+ registry][+ git]
+#   local-plus   → agent(数据面在远端,PG_HOST/MINIO_ENDPOINT 指过去)
+# 所有参数来自同目录 .env(sema-up.sh 生成;缺 .env 直接 up 会 fail-loud——这是有意的)。
+# 📌 镜像引用=修改点(clay 待拍稳定 tag/分发源):PG_IMAGE/MINIO_IMAGE/MC_IMAGE/GITEA_IMAGE
+#    有公共默认;SEMA_SERVER_IMAGE/SEMA_REGISTRY_IMAGE 必须显式给(GHCR/Docker Hub 公开仓,匿名可拉;
+#    SWR 已弃用 2026-07-13,CN 兜底=内网 Gitea registry)。
+name: ${SEMA_PROJECT:?run sema-up.sh, do not compose up by hand}
+
+services:
+  # 数据面细分 profile:pg/s3 各自独立(外接第三方 PG/S3 时只起需要的那半;
+  # "data" 别名保留=两个都起,旧口径兼容)
+  pg:
+    image: ${PG_IMAGE:-postgres:17}
+    profiles: ["data", "pg"]
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: sema
+      POSTGRES_PASSWORD: ${PG_PASSWORD:-}
+      POSTGRES_DB: sema
+    # REV-2 §3c 调优:sema-up.sh 按机器规格算出 PG_TUNE_FLAGS(pgtune 公式,SSD 假设)
+    command: postgres ${PG_TUNE_FLAGS}
+    ports:
+      - "${PG_BIND:-127.0.0.1}:${PG_PORT:-5432}:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U sema -d sema"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+  minio:
+    image: ${MINIO_IMAGE:-minio/minio:latest}
+    profiles: ["data", "s3"]
+    restart: unless-stopped
+    # 单机=单盘模式(§3c:显式无冗余;集群形态才上 EC)
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: sema
+      MINIO_ROOT_PASSWORD: ${MINIO_PASSWORD:-}
+    ports:
+      - "${MINIO_BIND:-127.0.0.1}:${MINIO_PORT:-9000}:9000"
+      - "${MINIO_BIND:-127.0.0.1}:${MINIO_CONSOLE_PORT:-9001}:9001"
+    volumes:
+      - miniodata:/data
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+  # 建桶(workspaces/blobs/backups)由 sema-up.sh 装配后执行(一次性动作不进清单:
+  # compose --wait 会把正常退出的 init 容器判失败,且"动作"归 Layer 0、"常驻"归 Layer 1)
+
+  # agent:full-single 时连同栈 pg/minio(默认值);local-plus 时 .env 里 AGENT_PG_HOST 等
+  # 指向远端数据面(depends_on 不适用——local-plus 没有本地 pg,该档由 sema-up.sh 只激活 agent
+  # profile,compose 对未激活服务的 depends_on 自动忽略)。
+  server:
+    image: ${SEMA_SERVER_IMAGE:-}
+    profiles: ["agent"]
+    restart: unless-stopped
+    depends_on:
+      pg:
+        condition: service_healthy
+        required: false   # local-plus:pg 服务不在激活面,依赖按缺席放行
+    environment:
+      PORT: "8090"
+      # 1.123.0 收编:显式 DB_BACKEND=pg 即 durable。SESSION_BACKEND=auto 是旧镜像(<1.123)兜底——
+      # 老版本 pg 不自动强转 durable 会静默 memory(真机验出 session:"memory");auto 新旧版都落 durable(pg)
+      DB_BACKEND: pg
+      SESSION_BACKEND: auto
+      PG_HOST: ${AGENT_PG_HOST:-pg}
+      PG_PORT: ${AGENT_PG_PORT:-5432}
+      PG_USER: ${AGENT_PG_USER:-sema}
+      PG_PASSWORD: ${PG_PASSWORD:-}
+      PG_DATABASE: ${AGENT_PG_DATABASE:-sema}
+      MINIO_ENDPOINT: ${AGENT_MINIO_ENDPOINT:-http://minio:9000}
+      MINIO_ACCESS_KEY: ${AGENT_MINIO_USER:-sema}
+      MINIO_SECRET_KEY: ${MINIO_PASSWORD:-}
+      # 必填校验在 sema-up.sh(compose 对未激活 profile 也做插值,:? 会误伤 data-center 档)
+      SERVICE_AUTH_TOKEN: ${SERVICE_AUTH_TOKEN:-}
+      MODEL_GATEWAY_BASEURL: ${MODEL_GATEWAY_BASEURL:-}
+      MODEL_ID: ${MODEL_ID:-}
+      MODEL_API_KEY: ${MODEL_API_KEY:-}
+      REQUIRE_PRINCIPAL: ${REQUIRE_PRINCIPAL:-false}
+      SANDBOX_PKG_SOURCE: ${SANDBOX_PKG_SOURCE:-}
+      REMOTE_EXEC: ${REMOTE_EXEC:-}
+      E2B_API_KEY: ${E2B_API_KEY:-}
+    ports:
+      - "${SERVER_BIND:-0.0.0.0}:${SERVER_PORT:-8090}:8090"
+
+  # sema-registry 配置中心(MCP/skill/模型配置云同步;管人+云同步一环,可选)。
+  # 镜像=该仓 CI 产物,现行来源=GHCR/Hub(迁移中,SWR 已弃用 2026-07-13;公开仓匿名可拉,
+  # 无需 pull 凭据;CN 兜底=内网 Gitea registry)
+  registry:
+    image: ${SEMA_REGISTRY_IMAGE:-}
+    profiles: ["registry"]
+    restart: unless-stopped
+    environment:
+      NODE_ENV: production
+      CONFIG_STORE: sqlite
+      CONFIG_DB_PATH: /app/data/config.db
+      # 引导管理员必须在该仓 src/lib/auth/admins.ts 白名单里,默认 zhaoheran
+      ADMIN_BOOTSTRAP_USER: ${REGISTRY_ADMIN_USER:-zhaoheran}
+      ADMIN_BOOTSTRAP_PASSWORD: ${REGISTRY_ADMIN_PASSWORD:-}
+      SESSION_SECRET: ${REGISTRY_SESSION_SECRET:-}
+      SERVICE_PULL_TOKEN: ${REGISTRY_PULL_TOKEN:-}
+      # git 面(--git=provision/connect 时 sema-up.sh 填;都空=不启用 OAuth 登录,只有表单登录)
+      GITEA_BASE_URL: ${REGISTRY_GITEA_BASE_URL:-}
+      GITEA_OAUTH_CLIENT_ID: ${REGISTRY_GITEA_OAUTH_ID:-}
+      GITEA_OAUTH_CLIENT_SECRET: ${REGISTRY_GITEA_OAUTH_SECRET:-}
+    ports:
+      - "${REGISTRY_BIND:-0.0.0.0}:${REGISTRY_PORT:-3000}:3000"
+    volumes:
+      - registrydata:/app/data   # SQLite 落盘,重建不丢配置
+    healthcheck:
+      # node 20 自带 fetch;镜像里没有 curl/wget。/api/healthz=真就绪端点(店面 / 是静态页,
+      # store 挂了也 200——config-center 仓 src/app/api/healthz 才探 store 可达)
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 5s
+      timeout: 4s
+      retries: 30
+
+  # 自建 Gitea(--git=provision;git 仓托管,agent 的代码面)。引导管理员/access-token/
+  # OAuth app(接 registry 登录)都是一次性动作,归 Layer 0(sema-up.sh),不进清单。
+  git:
+    image: ${GITEA_IMAGE:-gitea/gitea:1.24}
+    profiles: ["git"]
+    restart: unless-stopped
+    environment:
+      GITEA__security__INSTALL_LOCK: "true"    # 跳过安装向导(无它首访是 setup 页,API 全 405)
+      GITEA__database__DB_TYPE: sqlite3
+      GITEA__server__DOMAIN: ${GIT_DOMAIN:-localhost}
+      GITEA__server__ROOT_URL: http://${GIT_DOMAIN:-localhost}:${GIT_HTTP_PORT:-3300}/
+      GITEA__server__SSH_PORT: ${GIT_SSH_PORT:-2222}   # 对外告知口(clone 地址用);容器内 sshd 还是 22
+      GITEA__service__DISABLE_REGISTRATION: "true"     # 只有引导管理员建的账号,不开放注册
+    ports:
+      - "${GIT_BIND:-0.0.0.0}:${GIT_HTTP_PORT:-3300}:3000"
+      - "${GIT_BIND:-0.0.0.0}:${GIT_SSH_PORT:-2222}:22"
+    volumes:
+      - gitdata:/data   # 仓库+SQLite 持久卷,重建不丢仓
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:3000/api/healthz"]
+      interval: 5s
+      timeout: 4s
+      retries: 30
+
+volumes:
+  pgdata:
+  miniodata:
+  registrydata:
+  gitdata:

package/deploy/sema-up/stack/sema-stack-cluster.yaml

@@ -0,0 +1,189 @@
+# sema-stack(full-cluster 形态,Phase 1b as-built;cluster-up.sh 渲染 __占位符__ 后 apply)
+# 占位符:__MINIO_PW__ __SVC_TOKEN__ __MODEL_KEY__ __MODEL_GATEWAY__ __MODEL_ID__
+#         __SERVER_IMAGE__ __SERVER_PULL_POLICY__(tar 预灌=Never / registry 拉取=IfNotPresent)
+# 前置(cluster-up.sh 负责):Longhorn 默认 SC、kata-deploy(runtimeclass kata-qemu)、CNPG operator 1.30、
+#         runner token 跨 ns 复制成 sema/sema-runner-token-copy、MinIO 建桶 sema-pg-backup
+apiVersion: v1
+kind: Namespace
+metadata: { name: sema }
+---
+apiVersion: v1
+kind: Namespace
+metadata: { name: sema-sandbox }
+---
+# ── 数据面:CNPG 3 实例 HA(REV-2 §3c 调优参数)──────────────────────────────
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata: { name: sema-pg, namespace: sema }
+spec:
+  instances: __PG_INSTANCES__
+  # 反亲和(>=3 机 required,不然调度器把多实例挤同节点——复审实抓 pg-2/pg-3 同机,HA 名不副实;
+  # <3 机 preferred,required 会让副本永久 Pending——单节点 dev 真踩)
+  affinity:
+    enablePodAntiAffinity: true
+    topologyKey: kubernetes.io/hostname
+    podAntiAffinityType: __PG_ANTI_AFFINITY__
+  storage: { size: 100Gi, storageClass: longhorn }
+  bootstrap:
+    initdb: { database: sema, owner: sema }
+  postgresql:
+    parameters:
+      shared_buffers: "8GB"
+      effective_cache_size: "86GB"
+      maintenance_work_mem: "2GB"
+      random_page_cost: "1.1"
+      effective_io_concurrency: "200"
+      checkpoint_completion_target: "0.9"
+      max_parallel_workers: "8"
+  # ⚠ in-tree barman 在 CNPG 1.31 移除——operator 钉 1.30.0;升 operator 前必须先迁 barman-cloud plugin(需 cert-manager)
+  backup:
+    retentionPolicy: 7d
+    barmanObjectStore:
+      destinationPath: s3://sema-pg-backup/
+      endpointURL: http://sema-minio.sema.svc:9000
+      s3Credentials:
+        accessKeyId: { name: sema-minio, key: rootUser }
+        secretAccessKey: { name: sema-minio, key: rootPassword }
+      wal: { compression: gzip }
+---
+# 每日 03:00 UTC 基备(WAL 连续归档另在跑,支持 PITR);bucket sema-pg-backup 需先建(mc mb)
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata: { name: sema-pg-daily, namespace: sema }
+spec:
+  schedule: "0 0 3 * * *"
+  backupOwnerReference: self
+  cluster: { name: sema-pg }
+---
+# ── MinIO(单副本 on Longhorn=盘冗余在下层;集群 EC 形态后续档)────────────────
+apiVersion: v1
+kind: Secret
+metadata: { name: sema-minio, namespace: sema }
+stringData: { rootUser: sema, rootPassword: "__MINIO_PW__" }
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata: { name: sema-minio-data, namespace: sema }
+spec: { accessModes: [ReadWriteOnce], storageClassName: longhorn, resources: { requests: { storage: 200Gi } } }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata: { name: sema-minio, namespace: sema }
+spec:
+  replicas: 1
+  selector: { matchLabels: { app: sema-minio } }
+  template:
+    metadata: { labels: { app: sema-minio } }
+    spec:
+      containers:
+        - name: minio
+          image: minio/minio:latest
+          args: ["server", "/data", "--console-address", ":9001"]
+          env:
+            - { name: MINIO_ROOT_USER, valueFrom: { secretKeyRef: { name: sema-minio, key: rootUser } } }
+            - { name: MINIO_ROOT_PASSWORD, valueFrom: { secretKeyRef: { name: sema-minio, key: rootPassword } } }
+          ports: [{ containerPort: 9000 }, { containerPort: 9001 }]
+          volumeMounts: [{ name: data, mountPath: /data }]
+      volumes: [{ name: data, persistentVolumeClaim: { claimName: sema-minio-data } }]
+---
+apiVersion: v1
+kind: Service
+metadata: { name: sema-minio, namespace: sema }
+spec: { selector: { app: sema-minio }, ports: [{ name: s3, port: 9000 }, { name: console, port: 9001 }] }
+---
+# ── 沙箱 lane RBAC(k8s+kata;测试机同款五动词)────────────────────────────────
+apiVersion: v1
+kind: ServiceAccount
+metadata: { name: sema-runner, namespace: sema-sandbox }
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sema-runner-token
+  namespace: sema-sandbox
+  annotations: { kubernetes.io/service-account.name: sema-runner }
+type: kubernetes.io/service-account-token
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata: { name: sema-runner, namespace: sema-sandbox }
+rules:
+  - apiGroups: [""]
+    resources: [pods]
+    verbs: [get, list, watch, create, delete]
+  - apiGroups: [""]
+    resources: [pods/exec, pods/attach]
+    verbs: [create, get]
+  - apiGroups: [""]
+    resources: [pods/log]
+    verbs: [get]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata: { name: sema-runner, namespace: sema-sandbox }
+roleRef: { apiGroup: rbac.authorization.k8s.io, kind: Role, name: sema-runner }
+subjects: [{ kind: ServiceAccount, name: sema-runner, namespace: sema-sandbox }]
+---
+# ── 引擎(3 副本跨机打散;镜像=节点预灌 sema-server:local,imagePullPolicy Never
+#    ⚠ k3s-uninstall.sh 会连 containerd 镜像一起清,重装过的节点必须补灌)──────────
+apiVersion: v1
+kind: Secret
+metadata: { name: sema-server-env, namespace: sema }
+stringData:
+  SERVICE_AUTH_TOKEN: "__SVC_TOKEN__"
+  MODEL_API_KEY: "__MODEL_KEY__"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata: { name: sema-server, namespace: sema }
+spec:
+  replicas: __SERVER_REPLICAS__
+  selector: { matchLabels: { app: sema-server } }
+  template:
+    metadata: { labels: { app: sema-server } }
+    spec:
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector: { matchLabels: { app: sema-server } }
+      containers:
+        - name: server
+          image: "__SERVER_IMAGE__"
+          imagePullPolicy: __SERVER_PULL_POLICY__
+          ports: [{ containerPort: 8090 }]
+          env:
+            - { name: PORT, value: "8090" }
+            - { name: DB_BACKEND, value: pg }
+            - { name: SESSION_BACKEND, value: auto }
+            - { name: PG_HOST, value: sema-pg-rw.sema.svc }
+            - { name: PG_PORT, value: "5432" }
+            - { name: PG_USER, value: sema }
+            - { name: PG_DATABASE, value: sema }
+            - { name: PG_PASSWORD, valueFrom: { secretKeyRef: { name: sema-pg-app, key: password } } }
+            - { name: MINIO_ENDPOINT, value: "http://sema-minio.sema.svc:9000" }
+            - { name: MINIO_ACCESS_KEY, valueFrom: { secretKeyRef: { name: sema-minio, key: rootUser } } }
+            - { name: MINIO_SECRET_KEY, valueFrom: { secretKeyRef: { name: sema-minio, key: rootPassword } } }
+            - { name: SERVICE_AUTH_TOKEN, valueFrom: { secretKeyRef: { name: sema-server-env, key: SERVICE_AUTH_TOKEN } } }
+            - { name: MODEL_GATEWAY_BASEURL, value: "__MODEL_GATEWAY__" }
+            - { name: MODEL_ID, value: "__MODEL_ID__" }
+            - { name: MODEL_API_KEY, valueFrom: { secretKeyRef: { name: sema-server-env, key: MODEL_API_KEY } } }
+            - { name: MODEL_VISION, value: "false" }
+            - { name: SANDBOX_PKG_SOURCE, value: "__PKG_SOURCE__" }
+            - { name: REMOTE_EXEC, value: k8s }
+            - { name: K8S_API_URL, value: "https://kubernetes.default.svc" }
+            - { name: K8S_INSECURE_TLS, value: "true" }
+            - { name: K8S_NAMESPACE, value: sema-sandbox }
+            - { name: K8S_RUNTIME_CLASS, value: kata-qemu }
+            # 默认=公开池 code-node(小巧 git+node+python;clay 拍 2026-07-13,重任务 per-task profile 按需选)——裸 OS 镜像无 pkg-source hook,别退回
+            - { name: K8S_SANDBOX_IMAGE, value: "docker.io/claybobby/code-node:20260707-749ab84f5fdd-786f5ef10ffd" }
+            - { name: K8S_TOKEN, valueFrom: { secretKeyRef: { name: sema-runner-token-copy, key: token } } }
+          readinessProbe: { httpGet: { path: /health, port: 8090 }, initialDelaySeconds: 5, periodSeconds: 5 }
+---
+apiVersion: v1
+kind: Service
+metadata: { name: sema-server, namespace: sema }
+spec:
+  type: NodePort
+  selector: { app: sema-server }
+  ports: [{ port: 8090, targetPort: 8090, nodePort: 30890 }]

package/dist/approval.d.ts

@@ -0,0 +1,27 @@
+import { type ToolPolicy } from "@sema-agent/core";
+import type { ApprovalStore } from "./plugins/store-backend.js";
+export declare function createDurableAskPolicy(opts: {
+    requireApproval: string[];
+    deny?: string[];
+    autoBudget?: number;
+    neverAuto?: string[];
+    exempt?: (canonicalToolName: string) => Promise<boolean>;
+    onExempted?: (canonicalToolName: string, rawToolName: string) => void;
+}): ToolPolicy;
+export interface OaApprovalOptions {
+    store: ApprovalStore;
+    requireApproval: string[];
+    neverAuto?: string[];
+    exempt?: (sessionId: string, canonicalToolName: string) => Promise<boolean>;
+    onExempted?: (sessionId: string, canonicalToolName: string) => void;
+    context: () => {
+        taskId?: string | null;
+        sessionId?: string | null;
+        owner?: string | null;
+    };
+    deny?: string[];
+    pollMs?: number;
+}
+export declare function createOaApprovalPolicy(opts: OaApprovalOptions): ToolPolicy;
+export declare function waitForDecision(store: ApprovalStore, id: string, scope: string | null, signal: AbortSignal | undefined, pollMs: number): Promise<boolean>;
+//# sourceMappingURL=approval.d.ts.map

package/dist/approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../src/approval.ts"],"names":[],"mappings":"AASA,OAAO,EAAmD,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACpG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAQhE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAIrB,MAAM,CAAC,EAAE,CAAC,iBAAiB,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD,UAAU,CAAC,EAAE,CAAC,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACvE,GAAG,UAAU,CAuFb;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,aAAa,CAAC;IAErB,eAAe,EAAE,MAAM,EAAE,CAAC;IAI1B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5E,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,KAAK,IAAI,CAAC;IAEpE,OAAO,EAAE,MAAM;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAE5F,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,UAAU,CAmC1E;AAQD,wBAAsB,eAAe,CACnC,KAAK,EAAE,aAAa,EACpB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAwBlB"}

package/dist/approval.js

@@ -0,0 +1,127 @@
+import { createApprovalPolicy, canonicalToolName, uuidv7 } from "@sema-agent/core";
+export function createDurableAskPolicy(opts) {
+    const require = new Set(opts.requireApproval.map(canonicalToolName));
+    const deny = new Set((opts.deny ?? []).map(canonicalToolName));
+    const neverAuto = new Set((opts.neverAuto ?? []).map(canonicalToolName));
+    const budget = Math.max(0, Math.floor(opts.autoBudget ?? 0));
+    let autoApproved = 0;
+    return {
+        check: (req) => {
+            const toolName = canonicalToolName(req.toolName);
+            if (deny.has(toolName))
+                return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
+            if (neverAuto.has(toolName))
+                return { action: "ask", message: `human approval required to run "${req.toolName}"` };
+            if (require.has(toolName)) {
+                const remEarly = req.budget?.resourceRemainingMicroUsd;
+                if (remEarly !== undefined && remEarly <= 0) {
+                    return { action: "ask", message: `durable resource budget exhausted — human approval required to run "${req.toolName}"` };
+                }
+                if (opts.exempt && toolName !== "AskUserQuestion") {
+                    return (async () => {
+                        let exempted = false;
+                        try {
+                            exempted = (await opts.exempt(toolName)) === true;
+                        }
+                        catch {
+                            exempted = false;
+                        }
+                        if (exempted) {
+                            opts.onExempted?.(toolName, req.toolName);
+                            return { action: "allow" };
+                        }
+                        return decideRequired(req, toolName);
+                    })();
+                }
+                return decideRequired(req, toolName);
+            }
+            return { action: "allow" };
+        },
+    };
+    function decideRequired(req, toolName) {
+        const rem = req.budget?.resourceRemainingMicroUsd;
+        if (rem !== undefined && rem <= 0) {
+            return { action: "ask", message: `durable resource budget exhausted — human approval required to run "${req.toolName}"` };
+        }
+        if (toolName !== "AskUserQuestion" && budget > 0 && autoApproved < budget) {
+            autoApproved++;
+            return { action: "allow" };
+        }
+        return { action: "ask", message: `approval required to run "${req.toolName}"` };
+    }
+}
+export function createOaApprovalPolicy(opts) {
+    const pollMs = opts.pollMs ?? 1500;
+    const neverAuto = new Set((opts.neverAuto ?? []).map(canonicalToolName));
+    return createApprovalPolicy({
+        requireApproval: opts.requireApproval,
+        deny: opts.deny,
+        approve: async (req, signal) => {
+            const ctx = opts.context();
+            if (opts.exempt && ctx.sessionId) {
+                const toolName = canonicalToolName(req.toolName);
+                if (toolName !== "AskUserQuestion" && !neverAuto.has(toolName)) {
+                    let exempted = false;
+                    try {
+                        exempted = (await opts.exempt(ctx.sessionId, toolName)) === true;
+                    }
+                    catch {
+                        exempted = false;
+                    }
+                    if (exempted) {
+                        opts.onExempted?.(ctx.sessionId, toolName);
+                        return true;
+                    }
+                }
+            }
+            const id = uuidv7();
+            const scope = ctx.owner ?? null;
+            await opts.store.createPending(id, scope, { ...ctx, toolName: req.toolName, args: req.args });
+            return waitForDecision(opts.store, id, scope, signal, pollMs);
+        },
+    });
+}
+const MAX_POLL_ERRORS = 5;
+export async function waitForDecision(store, id, scope, signal, pollMs) {
+    let consecutiveErrors = 0;
+    for (;;) {
+        if (signal?.aborted) {
+            await store.decide(id, scope, "expired", "task aborted before decision", null).catch(() => undefined);
+            return false;
+        }
+        let s;
+        try {
+            s = await store.getStatus(id, scope);
+            consecutiveErrors = 0;
+        }
+        catch (e) {
+            if (++consecutiveErrors >= MAX_POLL_ERRORS)
+                throw e;
+            await sleepAbortable(pollMs, signal);
+            continue;
+        }
+        if (s?.status === "approved")
+            return true;
+        if (s?.status === "denied" || s?.status === "expired")
+            return false;
+        await sleepAbortable(pollMs, signal);
+    }
+}
+function sleepAbortable(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal?.aborted) {
+            resolve();
+            return;
+        }
+        const onAbort = () => {
+            clearTimeout(timer);
+            resolve();
+        };
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+//# sourceMappingURL=approval.js.map

package/dist/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../src/approval.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,EAAmB,MAAM,kBAAkB,CAAC;AASpG,MAAM,UAAU,sBAAsB,CAAC,IAWtC;IAMC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;IAK7D,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,CAAC,QAAQ,uBAAuB,EAAE,CAAC;YAOzG,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mCAAmC,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;YACnH,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAK1B,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC;gBACvD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;oBAC5C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,uEAAuE,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;gBAC5H,CAAC;gBAKD,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;oBAClD,OAAO,CAAC,KAAK,IAAI,EAAE;wBACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;wBACrB,IAAI,CAAC;4BACH,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,MAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC;wBACrD,CAAC;wBAAC,MAAM,CAAC;4BACP,QAAQ,GAAG,KAAK,CAAC;wBACnB,CAAC;wBACD,IAAI,QAAQ,EAAE,CAAC;4BACb,IAAI,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;4BAC1C,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,CAAC;wBACtC,CAAC;wBACD,OAAO,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBACvC,CAAC,CAAC,EAAE,CAAC;gBACP,CAAC;gBACD,OAAO,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC;KACF,CAAC;IAIF,SAAS,cAAc,CAAC,GAAuC,EAAE,QAAgB;QAY/E,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC;QAClD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,uEAAuE,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5H,CAAC;QAID,IAAI,QAAQ,KAAK,iBAAiB,IAAI,MAAM,GAAG,CAAC,IAAI,YAAY,GAAG,MAAM,EAAE,CAAC;YAC1E,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAsBD,MAAM,UAAU,sBAAsB,CAAC,IAAuB;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACzE,OAAO,oBAAoB,CAAC;QAC1B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAK3B,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjD,IAAI,QAAQ,KAAK,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/D,IAAI,QAAQ,GAAG,KAAK,CAAC;oBACrB,IAAI,CAAC;wBACH,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC;oBACnE,CAAC;oBAAC,MAAM,CAAC;wBACP,QAAQ,GAAG,KAAK,CAAC;oBACnB,CAAC;oBACD,IAAI,QAAQ,EAAE,CAAC;wBACb,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;wBAC3C,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;YAGpB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC;YAChC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9F,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAGD,MAAM,eAAe,GAAG,CAAC,CAAC;AAK1B,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAoB,EACpB,EAAU,EACV,KAAoB,EACpB,MAA+B,EAC/B,MAAc;IAEd,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,SAAS,CAAC;QACR,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,8BAA8B,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAkD,CAAC;QACvD,IAAI,CAAC;YACH,CAAC,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACrC,iBAAiB,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAKX,IAAI,EAAE,iBAAiB,IAAI,eAAe;gBAAE,MAAM,CAAC,CAAC;YACpD,MAAM,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE,MAAM,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,CAAC,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,EAAE,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACpE,MAAM,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,EAAU,EAAE,MAAoB;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC"}