@shuyhere/takotako 0.0.1

package/dist/providers/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/providers/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,kFAAkF;IAClF,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,8EAA8E;IAC9E,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CAAC;IAChC,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,gEAAgE;AAChE,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IACzB,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,qDAAqD;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;CAC5C;AAED,4DAA4D;AAC5D,MAAM,WAAW,QAAQ;IACvB,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,0DAA0D;IAC1D,IAAI,EAAE,OAAO,CAAC;IACd,iEAAiE;IACjE,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,yEAAyE;IACzE,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACxB,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAID;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAQ;IACvB,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC;IAEX;;;;;;;;OAQG;IACH,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAEjD;;;;OAIG;IACH,MAAM,IAAI,SAAS,EAAE,CAAC;IAEtB;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;CACvC"}

package/dist/providers/provider.js

@@ -0,0 +1,22 @@
+/**
+ * Provider — inference engine trait.
+ *
+ * Every LLM backend (Anthropic, OpenAI, LiteLLM, etc.) implements this
+ * interface. The agent loop calls `chat()` and streams back `ChatChunk`s.
+ *
+ * Providers handle:
+ * - Model routing via `provider/model` refs (e.g. 'anthropic/claude-sonnet-4-6')
+ * - API key rotation and failover
+ * - Streaming-first responses via AsyncIterable
+ * - Message format conversion to/from provider-specific APIs
+ *
+ * @example
+ * ```typescript
+ * const provider = new AnthropicProvider();
+ * for await (const chunk of provider.chat({ model: 'claude-sonnet-4-6', messages, stream: true })) {
+ *   if (chunk.text) process.stdout.write(chunk.text);
+ * }
+ * ```
+ */
+export {};
+//# sourceMappingURL=provider.js.map

package/dist/providers/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/providers/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG"}

package/dist/sandbox/config.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Sandbox configuration types.
+ *
+ * Controls how tool execution is isolated:
+ * - mode: when to sandbox (off, non-main sessions, or all)
+ * - scope: container lifecycle (per-session, per-agent, or shared)
+ * - workspaceAccess: how the workspace is mounted (none, read-only, read-write)
+ * - docker: container image, network, binds, setup
+ */
+/** When to sandbox tool execution. */
+export type SandboxMode = 'off' | 'non-main' | 'all';
+/** Container lifecycle scope. */
+export type SandboxScope = 'session' | 'agent' | 'shared';
+/** How the workspace is mounted inside the container. */
+export type WorkspaceAccess = 'none' | 'ro' | 'rw';
+/** Docker-specific configuration for the sandbox container. */
+export interface DockerConfig {
+    /** Container image (default: 'tako-sandbox:bookworm-slim'). */
+    image?: string;
+    /** Docker network (default: 'none' — no egress). */
+    network?: string;
+    /** Additional bind mounts (host:container format). */
+    binds?: string[];
+    /** Shell command to run inside the container after creation. */
+    setupCommand?: string;
+    /** User to run commands as inside the container. */
+    user?: string;
+}
+/** Full sandbox configuration. */
+export interface SandboxConfig {
+    /** When to sandbox: 'off' disables, 'non-main' sandboxes spawned sessions, 'all' sandboxes everything. */
+    mode: SandboxMode;
+    /** Container lifecycle scope. */
+    scope: SandboxScope;
+    /** How the workspace is mounted. */
+    workspaceAccess: WorkspaceAccess;
+    /** Docker container settings. */
+    docker?: DockerConfig;
+}
+/** Default sandbox config (off — no sandboxing). */
+export declare const DEFAULT_SANDBOX_CONFIG: SandboxConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/sandbox/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/sandbox/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,sCAAsC;AACtC,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,UAAU,GAAG,KAAK,CAAC;AAErD,iCAAiC;AACjC,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE1D,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B,0GAA0G;IAC1G,IAAI,EAAE,WAAW,CAAC;IAClB,iCAAiC;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,oCAAoC;IACpC,eAAe,EAAE,eAAe,CAAC;IACjC,iCAAiC;IACjC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,EAAE,aAQpC,CAAC"}

package/dist/sandbox/config.js

@@ -0,0 +1,20 @@
+/**
+ * Sandbox configuration types.
+ *
+ * Controls how tool execution is isolated:
+ * - mode: when to sandbox (off, non-main sessions, or all)
+ * - scope: container lifecycle (per-session, per-agent, or shared)
+ * - workspaceAccess: how the workspace is mounted (none, read-only, read-write)
+ * - docker: container image, network, binds, setup
+ */
+/** Default sandbox config (off — no sandboxing). */
+export const DEFAULT_SANDBOX_CONFIG = {
+    mode: 'off',
+    scope: 'session',
+    workspaceAccess: 'ro',
+    docker: {
+        image: 'tako-sandbox:bookworm-slim',
+        network: 'none',
+    },
+};
+//# sourceMappingURL=config.js.map

package/dist/sandbox/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/sandbox/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuCH,oDAAoD;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,IAAI,EAAE,KAAK;IACX,KAAK,EAAE,SAAS;IAChB,eAAe,EAAE,IAAI;IACrB,MAAM,EAAE;QACN,KAAK,EAAE,4BAA4B;QACnC,OAAO,EAAE,MAAM;KAChB;CACF,CAAC"}

package/dist/sandbox/container.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Docker container operations — create, start, exec, stop, remove.
+ *
+ * Uses shell commands (docker CLI) to avoid a heavy dockerode dependency.
+ * All operations are async and throw on failure.
+ */
+import type { DockerConfig, WorkspaceAccess } from './config.js';
+/** Result of executing a command inside a container. */
+export interface ContainerExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+/** Represents a managed Docker container. */
+export interface ContainerInfo {
+    /** Docker container ID (short hash). */
+    id: string;
+    /** Container name. */
+    name: string;
+    /** Whether the container is currently running. */
+    running: boolean;
+}
+/**
+ * Docker container lifecycle operations.
+ *
+ * Wraps the Docker CLI to create, manage, and remove sandbox containers.
+ * No network by default. Workspace mounted based on access level.
+ */
+export declare class DockerContainer {
+    private containerId;
+    private containerName;
+    private dockerConfig;
+    private workspaceAccess;
+    private workspacePath;
+    constructor(opts: {
+        name: string;
+        dockerConfig: DockerConfig;
+        workspaceAccess: WorkspaceAccess;
+        workspacePath?: string;
+    });
+    /** Check if Docker is available on the host. */
+    static isDockerAvailable(): Promise<boolean>;
+    /** Create and start the container. */
+    create(): Promise<string>;
+    /** Execute a command inside the running container. */
+    exec(command: string, timeout?: number): Promise<ContainerExecResult>;
+    /** Stop the container. */
+    stop(): Promise<void>;
+    /** Remove the container (force). */
+    remove(): Promise<void>;
+    /** Stop and remove the container. */
+    destroy(): Promise<void>;
+    /** Check if the container is running. */
+    isRunning(): Promise<boolean>;
+    /** Get container info. */
+    getInfo(): ContainerInfo | null;
+    /** Get the container ID (null if not created). */
+    getId(): string | null;
+    /** Get the container name. */
+    getName(): string;
+    /**
+     * List all Tako sandbox containers on the host.
+     * Uses the `tako.sandbox=true` label to filter.
+     */
+    static listSandboxContainers(): Promise<ContainerInfo[]>;
+    /**
+     * Remove all Tako sandbox containers.
+     */
+    static cleanupAll(): Promise<number>;
+}
+//# sourceMappingURL=container.d.ts.map

package/dist/sandbox/container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAIjE,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAmE;IACvF,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,aAAa,CAAgB;gBAEzB,IAAI,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,YAAY,CAAC;QAC3B,eAAe,EAAE,eAAe,CAAC;QACjC,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB;IAWD,gDAAgD;WACnC,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC;IASlD,sCAAsC;IAChC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IA4C/B,sDAAsD;IAChD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,MAAe,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwBnF,0BAA0B;IACpB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,oCAAoC;IAC9B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAU7B,qCAAqC;IAC/B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAK9B,yCAAyC;IACnC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAanC,0BAA0B;IAC1B,OAAO,IAAI,aAAa,GAAG,IAAI;IAS/B,kDAAkD;IAClD,KAAK,IAAI,MAAM,GAAG,IAAI;IAItB,8BAA8B;IAC9B,OAAO,IAAI,MAAM;IAIjB;;;OAGG;WACU,qBAAqB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAgB9D;;OAEG;WACU,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;CAW3C"}

package/dist/sandbox/container.js

@@ -0,0 +1,193 @@
+/**
+ * Docker container operations — create, start, exec, stop, remove.
+ *
+ * Uses shell commands (docker CLI) to avoid a heavy dockerode dependency.
+ * All operations are async and throw on failure.
+ */
+import { exec as execCb } from 'node:child_process';
+import { promisify } from 'node:util';
+const execAsync = promisify(execCb);
+/**
+ * Docker container lifecycle operations.
+ *
+ * Wraps the Docker CLI to create, manage, and remove sandbox containers.
+ * No network by default. Workspace mounted based on access level.
+ */
+export class DockerContainer {
+    containerId = null;
+    containerName;
+    dockerConfig;
+    workspaceAccess;
+    workspacePath;
+    constructor(opts) {
+        this.containerName = `tako-sandbox-${opts.name}`;
+        this.dockerConfig = {
+            image: 'tako-sandbox:bookworm-slim',
+            network: 'none',
+            ...opts.dockerConfig,
+        };
+        this.workspaceAccess = opts.workspaceAccess;
+        this.workspacePath = opts.workspacePath ?? null;
+    }
+    /** Check if Docker is available on the host. */
+    static async isDockerAvailable() {
+        try {
+            await execAsync('docker info', { timeout: 5000 });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Create and start the container. */
+    async create() {
+        const args = [
+            'docker', 'create',
+            '--name', this.containerName,
+            '--network', this.dockerConfig.network,
+            '--label', 'tako.sandbox=true',
+        ];
+        // Workspace mount
+        if (this.workspacePath && this.workspaceAccess !== 'none') {
+            const roFlag = this.workspaceAccess === 'ro' ? ':ro' : '';
+            args.push('-v', `${this.workspacePath}:/workspace${roFlag}`);
+            args.push('-w', '/workspace');
+        }
+        // User
+        if (this.dockerConfig.user) {
+            args.push('-u', this.dockerConfig.user);
+        }
+        // Extra bind mounts
+        if (this.dockerConfig.binds) {
+            for (const bind of this.dockerConfig.binds) {
+                args.push('-v', bind);
+            }
+        }
+        // Image + keep-alive command
+        args.push(this.dockerConfig.image, 'sleep', 'infinity');
+        const { stdout } = await execAsync(args.join(' '), { timeout: 30_000 });
+        this.containerId = stdout.trim().slice(0, 12);
+        // Start the container
+        await execAsync(`docker start ${this.containerId}`, { timeout: 10_000 });
+        // Run setup command if provided
+        if (this.dockerConfig.setupCommand) {
+            await this.exec(this.dockerConfig.setupCommand, 30_000);
+        }
+        return this.containerId;
+    }
+    /** Execute a command inside the running container. */
+    async exec(command, timeout = 30_000) {
+        if (!this.containerId) {
+            throw new Error('Container not created');
+        }
+        const escapedCmd = command.replace(/'/g, "'\\''");
+        const dockerCmd = `docker exec ${this.containerId} sh -c '${escapedCmd}'`;
+        try {
+            const { stdout, stderr } = await execAsync(dockerCmd, {
+                timeout,
+                maxBuffer: 1024 * 1024,
+            });
+            return { stdout, stderr, exitCode: 0 };
+        }
+        catch (err) {
+            const e = err;
+            return {
+                stdout: e.stdout ?? '',
+                stderr: e.stderr ?? '',
+                exitCode: e.code ?? 1,
+            };
+        }
+    }
+    /** Stop the container. */
+    async stop() {
+        if (!this.containerId)
+            return;
+        try {
+            await execAsync(`docker stop -t 5 ${this.containerId}`, { timeout: 15_000 });
+        }
+        catch {
+            // Container may already be stopped
+        }
+    }
+    /** Remove the container (force). */
+    async remove() {
+        if (!this.containerId)
+            return;
+        try {
+            await execAsync(`docker rm -f ${this.containerId}`, { timeout: 10_000 });
+        }
+        catch {
+            // Container may already be removed
+        }
+        this.containerId = null;
+    }
+    /** Stop and remove the container. */
+    async destroy() {
+        await this.stop();
+        await this.remove();
+    }
+    /** Check if the container is running. */
+    async isRunning() {
+        if (!this.containerId)
+            return false;
+        try {
+            const { stdout } = await execAsync(`docker inspect -f '{{.State.Running}}' ${this.containerId}`, { timeout: 5000 });
+            return stdout.trim() === 'true';
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Get container info. */
+    getInfo() {
+        if (!this.containerId)
+            return null;
+        return {
+            id: this.containerId,
+            name: this.containerName,
+            running: false, // Caller should use isRunning() for live status
+        };
+    }
+    /** Get the container ID (null if not created). */
+    getId() {
+        return this.containerId;
+    }
+    /** Get the container name. */
+    getName() {
+        return this.containerName;
+    }
+    /**
+     * List all Tako sandbox containers on the host.
+     * Uses the `tako.sandbox=true` label to filter.
+     */
+    static async listSandboxContainers() {
+        try {
+            const { stdout } = await execAsync('docker ps -a --filter "label=tako.sandbox=true" --format "{{.ID}}\\t{{.Names}}\\t{{.State}}"', { timeout: 5000 });
+            if (!stdout.trim())
+                return [];
+            return stdout.trim().split('\n').map((line) => {
+                const [id, name, state] = line.split('\t');
+                return { id, name, running: state === 'running' };
+            });
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Remove all Tako sandbox containers.
+     */
+    static async cleanupAll() {
+        const containers = await DockerContainer.listSandboxContainers();
+        for (const c of containers) {
+            try {
+                await execAsync(`docker rm -f ${c.id}`, { timeout: 10_000 });
+            }
+            catch {
+                // best-effort
+            }
+        }
+        return containers.length;
+    }
+}
+//# sourceMappingURL=container.js.map

package/dist/sandbox/container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;AAmBpC;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAClB,WAAW,GAAkB,IAAI,CAAC;IAClC,aAAa,CAAS;IACtB,YAAY,CAAmE;IAC/E,eAAe,CAAkB;IACjC,aAAa,CAAgB;IAErC,YAAY,IAKX;QACC,IAAI,CAAC,aAAa,GAAG,gBAAgB,IAAI,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,YAAY,GAAG;YAClB,KAAK,EAAE,4BAA4B;YACnC,OAAO,EAAE,MAAM;YACf,GAAG,IAAI,CAAC,YAAY;SACrB,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC5C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IAClD,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,KAAK,CAAC,iBAAiB;QAC5B,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAa;YACrB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,IAAI,CAAC,aAAa;YAC5B,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO;YACtC,SAAS,EAAE,mBAAmB;SAC/B,CAAC;QAEF,kBAAkB;QAClB,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,eAAe,KAAK,MAAM,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,cAAc,MAAM,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChC,CAAC;QAED,OAAO;QACP,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAED,oBAAoB;QACpB,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAExD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAE9C,sBAAsB;QACtB,MAAM,SAAS,CAAC,gBAAgB,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzE,gCAAgC;QAChC,IAAI,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,UAAkB,MAAM;QAClD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,IAAI,CAAC,WAAW,WAAW,UAAU,GAAG,CAAC;QAE1E,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE;gBACpD,OAAO;gBACP,SAAS,EAAE,IAAI,GAAG,IAAI;aACvB,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0D,CAAC;YACrE,OAAO;gBACL,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;gBACtB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;gBACtB,QAAQ,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO;QAC9B,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,oBAAoB,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO;QAC9B,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,gBAAgB,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;IACtB,CAAC;IAED,yCAAyC;IACzC,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,0CAA0C,IAAI,CAAC,WAAW,EAAE,EAC5D,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,WAAW;YACpB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,OAAO,EAAE,KAAK,EAAE,gDAAgD;SACjE,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,KAAK;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,8BAA8B;IAC9B,OAAO;QACL,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,qBAAqB;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,8FAA8F,EAC9F,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC5C,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU;QACrB,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,qBAAqB,EAAE,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;CACF"}

package/dist/sandbox/sandbox.d.ts

@@ -0,0 +1,82 @@
+/**
+ * SandboxManager — manages Docker-based sandboxed execution environments.
+ *
+ * Creates and tracks containers keyed by scope (session, agent, or shared).
+ * Routes tool execution through the appropriate container when sandboxing
+ * is active. Falls back to host execution when sandboxing is off or
+ * Docker is unavailable.
+ */
+import { DockerContainer, type ContainerExecResult } from './container.js';
+import type { SandboxConfig, SandboxMode } from './config.js';
+/** Status snapshot of the sandbox system. */
+export interface SandboxStatus {
+    mode: SandboxMode;
+    dockerAvailable: boolean;
+    activeContainers: number;
+    containers: Array<{
+        key: string;
+        id: string | null;
+        name: string;
+        running: boolean;
+    }>;
+}
+/**
+ * SandboxManager — lifecycle management for sandboxed tool execution.
+ *
+ * Usage:
+ * 1. Initialize with config
+ * 2. Call shouldSandbox(sessionId, isMain) to check if a session needs sandboxing
+ * 3. Call getOrCreateContainer(key) to get a container for the session/agent
+ * 4. Call execInSandbox(key, command, timeout) to run commands
+ * 5. Call destroyContainer(key) when session ends
+ * 6. Call shutdown() on process exit
+ */
+export declare class SandboxManager {
+    private config;
+    private containers;
+    private dockerAvailable;
+    constructor(config?: Partial<SandboxConfig>);
+    /** Get the current sandbox mode. */
+    getMode(): SandboxMode;
+    /** Get the full config (read-only snapshot). */
+    getConfig(): Readonly<SandboxConfig>;
+    /** Check if Docker is available (caches result). */
+    checkDocker(): Promise<boolean>;
+    /**
+     * Determine if a given session should be sandboxed.
+     *
+     * @param isMainSession - true for the primary CLI session
+     * @returns true if tool execution should go through a container
+     */
+    shouldSandbox(isMainSession: boolean): boolean;
+    /**
+     * Resolve the container key based on scope.
+     *
+     * - 'session' scope: one container per session
+     * - 'agent' scope: one container per agent (future; uses sessionId for now)
+     * - 'shared' scope: single container for all sandboxed sessions
+     */
+    resolveKey(sessionId: string): string;
+    /**
+     * Get or create a container for the given key.
+     * Returns the DockerContainer instance (already started).
+     */
+    getOrCreateContainer(key: string, workspacePath?: string): Promise<DockerContainer>;
+    /**
+     * Execute a command in the sandbox container for the given key.
+     * The container is created if it doesn't exist yet.
+     */
+    execInSandbox(key: string, command: string, timeout?: number, workspacePath?: string): Promise<ContainerExecResult>;
+    /** Destroy a specific container by key. */
+    destroyContainer(key: string): Promise<void>;
+    /** Get the status of the sandbox system. */
+    getStatus(): Promise<SandboxStatus>;
+    /**
+     * Explain why a tool would be allowed or blocked in sandbox context.
+     * Returns a human-readable explanation string.
+     */
+    explain(toolName: string, isMainSession: boolean): string;
+    /** Shut down all managed containers. */
+    shutdown(): Promise<void>;
+}
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/sandbox/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG9D,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,KAAK,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC,CAAC;CACJ;AAED;;;;;;;;;;GAUG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAAsC;IACxD,OAAO,CAAC,eAAe,CAAwB;gBAEnC,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC;IAI3C,oCAAoC;IACpC,OAAO,IAAI,WAAW;IAItB,gDAAgD;IAChD,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC;IAIpC,oDAAoD;IAC9C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAOrC;;;;;OAKG;IACH,aAAa,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO;IAO9C;;;;;;OAMG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAYrC;;;OAGG;IACG,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAsBzF;;;OAGG;IACG,aAAa,CACjB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,mBAAmB,CAAC;IAK/B,2CAA2C;IACrC,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlD,4CAA4C;IACtC,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAsBzC;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,MAAM;IA0BzD,wCAAwC;IAClC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAWhC"}

package/dist/sandbox/sandbox.js

@@ -0,0 +1,176 @@
+/**
+ * SandboxManager — manages Docker-based sandboxed execution environments.
+ *
+ * Creates and tracks containers keyed by scope (session, agent, or shared).
+ * Routes tool execution through the appropriate container when sandboxing
+ * is active. Falls back to host execution when sandboxing is off or
+ * Docker is unavailable.
+ */
+import { DockerContainer } from './container.js';
+import { DEFAULT_SANDBOX_CONFIG } from './config.js';
+/**
+ * SandboxManager — lifecycle management for sandboxed tool execution.
+ *
+ * Usage:
+ * 1. Initialize with config
+ * 2. Call shouldSandbox(sessionId, isMain) to check if a session needs sandboxing
+ * 3. Call getOrCreateContainer(key) to get a container for the session/agent
+ * 4. Call execInSandbox(key, command, timeout) to run commands
+ * 5. Call destroyContainer(key) when session ends
+ * 6. Call shutdown() on process exit
+ */
+export class SandboxManager {
+    config;
+    containers = new Map();
+    dockerAvailable = null;
+    constructor(config) {
+        this.config = { ...DEFAULT_SANDBOX_CONFIG, ...config };
+    }
+    /** Get the current sandbox mode. */
+    getMode() {
+        return this.config.mode;
+    }
+    /** Get the full config (read-only snapshot). */
+    getConfig() {
+        return { ...this.config };
+    }
+    /** Check if Docker is available (caches result). */
+    async checkDocker() {
+        if (this.dockerAvailable === null) {
+            this.dockerAvailable = await DockerContainer.isDockerAvailable();
+        }
+        return this.dockerAvailable;
+    }
+    /**
+     * Determine if a given session should be sandboxed.
+     *
+     * @param isMainSession - true for the primary CLI session
+     * @returns true if tool execution should go through a container
+     */
+    shouldSandbox(isMainSession) {
+        if (this.config.mode === 'off')
+            return false;
+        if (this.config.mode === 'all')
+            return true;
+        // 'non-main' — only sandbox spawned/non-main sessions
+        return !isMainSession;
+    }
+    /**
+     * Resolve the container key based on scope.
+     *
+     * - 'session' scope: one container per session
+     * - 'agent' scope: one container per agent (future; uses sessionId for now)
+     * - 'shared' scope: single container for all sandboxed sessions
+     */
+    resolveKey(sessionId) {
+        switch (this.config.scope) {
+            case 'shared':
+                return 'shared';
+            case 'agent':
+                return `agent-${sessionId}`;
+            case 'session':
+            default:
+                return `session-${sessionId}`;
+        }
+    }
+    /**
+     * Get or create a container for the given key.
+     * Returns the DockerContainer instance (already started).
+     */
+    async getOrCreateContainer(key, workspacePath) {
+        const existing = this.containers.get(key);
+        if (existing) {
+            const running = await existing.isRunning();
+            if (running)
+                return existing;
+            // Container exists but isn't running — recreate
+            await existing.destroy();
+            this.containers.delete(key);
+        }
+        const container = new DockerContainer({
+            name: key,
+            dockerConfig: this.config.docker ?? {},
+            workspaceAccess: this.config.workspaceAccess,
+            workspacePath,
+        });
+        await container.create();
+        this.containers.set(key, container);
+        return container;
+    }
+    /**
+     * Execute a command in the sandbox container for the given key.
+     * The container is created if it doesn't exist yet.
+     */
+    async execInSandbox(key, command, timeout, workspacePath) {
+        const container = await this.getOrCreateContainer(key, workspacePath);
+        return container.exec(command, timeout);
+    }
+    /** Destroy a specific container by key. */
+    async destroyContainer(key) {
+        const container = this.containers.get(key);
+        if (!container)
+            return;
+        await container.destroy();
+        this.containers.delete(key);
+    }
+    /** Get the status of the sandbox system. */
+    async getStatus() {
+        const dockerAvailable = await this.checkDocker();
+        const containerInfos = [];
+        for (const [key, container] of this.containers) {
+            const running = await container.isRunning();
+            containerInfos.push({
+                key,
+                id: container.getId(),
+                name: container.getName(),
+                running,
+            });
+        }
+        return {
+            mode: this.config.mode,
+            dockerAvailable,
+            activeContainers: containerInfos.filter((c) => c.running).length,
+            containers: containerInfos,
+        };
+    }
+    /**
+     * Explain why a tool would be allowed or blocked in sandbox context.
+     * Returns a human-readable explanation string.
+     */
+    explain(toolName, isMainSession) {
+        const lines = [];
+        lines.push(`Sandbox explanation for tool "${toolName}":`);
+        lines.push(`  Mode: ${this.config.mode}`);
+        lines.push(`  Session type: ${isMainSession ? 'main' : 'spawned'}`);
+        if (this.config.mode === 'off') {
+            lines.push(`  Result: Tool runs on HOST (sandboxing is off)`);
+        }
+        else if (this.config.mode === 'all') {
+            lines.push(`  Result: Tool runs in SANDBOX (all sessions sandboxed)`);
+        }
+        else {
+            if (isMainSession) {
+                lines.push(`  Result: Tool runs on HOST (main session not sandboxed in "non-main" mode)`);
+            }
+            else {
+                lines.push(`  Result: Tool runs in SANDBOX (non-main session)`);
+            }
+        }
+        lines.push(`  Workspace access: ${this.config.workspaceAccess}`);
+        lines.push(`  Container scope: ${this.config.scope}`);
+        lines.push(`  Docker image: ${this.config.docker?.image ?? 'default'}`);
+        lines.push(`  Network: ${this.config.docker?.network ?? 'none'}`);
+        return lines.join('\n');
+    }
+    /** Shut down all managed containers. */
+    async shutdown() {
+        const promises = [];
+        for (const [key, container] of this.containers) {
+            promises.push(container.destroy().then(() => {
+                this.containers.delete(key);
+            }));
+        }
+        await Promise.all(promises);
+    }
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/sandbox/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/sandbox/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAA4B,MAAM,gBAAgB,CAAC;AAE3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAerD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAc;IACjB,MAAM,CAAgB;IACtB,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAChD,eAAe,GAAmB,IAAI,CAAC;IAE/C,YAAY,MAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,sBAAsB,EAAE,GAAG,MAAM,EAAE,CAAC;IACzD,CAAC;IAED,oCAAoC;IACpC,OAAO;QACL,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED,gDAAgD;IAChD,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,eAAe,GAAG,MAAM,eAAe,CAAC,iBAAiB,EAAE,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,aAAsB;QAClC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAC5C,sDAAsD;QACtD,OAAO,CAAC,aAAa,CAAC;IACxB,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,SAAiB;QAC1B,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1B,KAAK,QAAQ;gBACX,OAAO,QAAQ,CAAC;YAClB,KAAK,OAAO;gBACV,OAAO,SAAS,SAAS,EAAE,CAAC;YAC9B,KAAK,SAAS,CAAC;YACf;gBACE,OAAO,WAAW,SAAS,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,GAAW,EAAE,aAAsB;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC3C,IAAI,OAAO;gBAAE,OAAO,QAAQ,CAAC;YAC7B,gDAAgD;YAChD,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC;YACpC,IAAI,EAAE,GAAG;YACT,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE;YACtC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;YAC5C,aAAa;SACd,CAAC,CAAC;QAEH,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CACjB,GAAW,EACX,OAAe,EACf,OAAgB,EAChB,aAAsB;QAEtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,gBAAgB,CAAC,GAAW;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,SAAS;QACb,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,cAAc,GAAgC,EAAE,CAAC;QAEvD,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC;YAC5C,cAAc,CAAC,IAAI,CAAC;gBAClB,GAAG;gBACH,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE;gBACrB,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE;gBACzB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,eAAe;YACf,gBAAgB,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM;YAChE,UAAU,EAAE,cAAc;SAC3B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAAgB,EAAE,aAAsB;QAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,iCAAiC,QAAQ,IAAI,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,mBAAmB,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAEpE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,IAAI,aAAa,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;YAC5F,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,CAAC,CAAC;QAElE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,QAAQ;QACZ,MAAM,QAAQ,GAAoB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CACX,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;CACF"}