@smthrs/std 0.0.0-stage → 1.0.0-rc.12

package/dist/esm/Checkpoints.js

@@ -0,0 +1,396 @@
+/**
+ * Pinned trees, and the scratch checkouts a call runs against.
+ *
+ * A checkpoint is a **value**: minting one changes nothing about the workspace,
+ * and running a call against one leaves the live tree exactly as it stands.
+ * That is the whole of what it buys. Before it existed, the only way a run
+ * could answer "did this command fail before my change" was to undo the change
+ * — and the journals price that exactly. On `sympy__sympy-13878` the r95repl
+ * lane applied one byte-identical 4,789-character patch **five times**, four of
+ * those applications preceded by `git checkout -- sympy/stats/crv_types.py`,
+ * because a clean fails-before proof required reverting the very work it was
+ * meant to prove.
+ *
+ * This module is the host half of `@smthrs/harness`'s `ctx.checkpoint()` and
+ * `ctx.call(flow, input, { at })`. The harness owns the surface, the identity,
+ * the bound and the refusals; nothing in it knows what a tree is. This owns the
+ * two host operations that need one:
+ *
+ * - {@link Checkpoints.capture} records the working tree under an id, and
+ * - {@link Checkpoints.materialize} gives that tree back as a directory for the
+ *   length of one call.
+ *
+ * ## The git binding, and the container constraint it is shaped by
+ *
+ * {@link layerGit} records a checkpoint with `git stash create`, then names the
+ * commit it prints in this repository's own git config rather than with a ref —
+ * see {@link configSection} for why a ref would hand the agent its own edit back
+ * as history. `stash create` is the one git command
+ * that records the working tree and changes nothing else: it does not move the
+ * worktree and does not touch the stash ref. It runs against a shadow
+ * `GIT_DIR` over a copy of the workspace index (see `internal/GitWorktree.ts`),
+ * so it never writes the repository's index and never runs a program the
+ * workspace's `.git` names. That matters more than it sounds. The agent runs `git` in this same
+ * workspace and its own `git diff` is the run's evidence, so a capture that
+ * staged into the real index would be the harness editing the evidence while
+ * recording it. A tree with nothing to record prints nothing, and the
+ * checkpoint is then `HEAD` — which is exactly what the tree is.
+ *
+ * Untracked files are not in the recorded tree, which matches how the rig
+ * captures a patch: `capture-patch.sh` drops paths that did not exist when the
+ * agent started, so a checkpoint holds what a patch would hold.
+ *
+ * The materialization is a detached checkout at `<root>/.flows-checkpoints/<id>-<lease>`
+ * — **inside** the workspace, which looks wrong and is the only thing that
+ * works. A benchmark check runs through `docker exec` inside `/testbed`, and
+ * `/testbed` is a bind mount of the live workspace. A scratch checkout anywhere
+ * else on the host is simply not visible to the container, so the call would run
+ * against a path that does not exist. Placed under the workspace it is visible
+ * at the same subpath under the mount, needs no second mount, and needs no
+ * change to how the rig starts its container. `TestRun`'s `against: "base"`
+ * reached the same conclusion first and this reuses its shape;
+ * `evals/swebench/run-instance.sh` excludes the directory from patch capture for
+ * the same reason it excludes `.flows-test-base`.
+ *
+ * The checkout is added and removed around **one call**, which is stricter than
+ * the frame lifetime the design asks for and much simpler: there is no cache to
+ * invalidate, no id to leak, and a checkpoint used by three calls pays three
+ * checkouts rather than risking one stale directory. A run that reuses a
+ * checkpoint across frames simply re-materializes it, because the ref is what
+ * persists.
+ *
+ * ## What can be pointed at a checkpoint, and what cannot
+ *
+ * {@link relocate} is the closed answer, and `Relocate.ts` owns it. That half
+ * knows the input shapes of `bash`, `read`, `ls`, `grep` and `glob`; this half
+ * knows git. They change for different reasons, so they are different modules,
+ * and {@link relocate} is re-exported here because the harness reaches the whole
+ * feature through this one.
+ *
+ * @since 1.0.0
+ */
+import { ChildProcessSpawner } from "@smthrs/kernel/ChildProcessSpawner";
+import { Context, Effect, Layer, Schema } from "effect";
+import * as Container from "./Container.js";
+import * as Exec from "./internal/Exec.js";
+import { GitWorktree } from "./internal/GitWorktree.js";
+import { withoutTrailingSlash } from "./internal/Paths.js";
+import * as Prune from "./internal/Prune.js";
+import * as StdError from "./StdError.js";
+import * as TestRunner from "./TestRunner.js";
+/**
+ * The id naming the tree a run opened on.
+ *
+ * It is not minted: the host either recorded one before the agent started or it
+ * did not. {@link layerGit} resolves it to {@link TestRunner.captureBase} and
+ * then to `HEAD`, which is the same precedence `TestRun` uses for the same
+ * question — so a workspace that has one answer for a baseline has one answer
+ * for both.
+ *
+ * @category constants
+ * @since 1.0.0
+ */
+export const baseId = "base";
+/**
+ * The directory checkpoints are materialized into, relative to the repository
+ * root and therefore also relative to a container's view of it.
+ *
+ * @category constants
+ * @since 1.0.0
+ */
+export const scratchDirectory = Prune.checkpointScratch;
+/**
+ * The git-config section {@link layerGit} records minted checkpoints under.
+ *
+ * Config and **not a ref**, and that is the whole of the decision. A ref is
+ * history: `git log --all` lists it, `git show` prints it, and `git log --all
+ * -S` searches it — so a checkpoint named by a ref would hand an agent a commit
+ * containing its own edit and let it read that back as if it were upstream
+ * work. That exact class cost the measured program real money before the rig
+ * moved jj's store out of the workspace (`evals/swebench/run-instance.sh`:
+ * django-13346 applied two of its own snapshots as a fake fix), and a ref here
+ * would reintroduce it one wave later.
+ *
+ * The commit object itself is unreferenced. It stays alive for the life of the
+ * run — nothing in a run prunes — and a checkout by id works perfectly well,
+ * which is measured in `CheckpointsFixture.test.ts`. So the tree is reachable
+ * by id and no command that walks refs can reach it:
+ * `git log`, `git log --all`, `git log -S` and `git show <ref>` all answer
+ * exactly as they did before the capture.
+ *
+ * One command still sees it, measured rather than argued in
+ * `CheckpointsFixture.test.ts`: `git fsck` reports it as a dangling commit,
+ * because that is what an unreferenced commit is. A checkout is a standalone
+ * repository, not a worktree of this one, so `git log --all` does not list it
+ * even while a call runs in it. It is not reachable by a name that looks like project history, and the cell
+ * contract's environment section says outright that a dangling commit is this
+ * harness holding the agent's own tree — which is the half of the django-13346
+ * lesson that a store cannot enforce.
+ *
+ * @category constants
+ * @since 1.0.0
+ */
+export const configSection = "flows-checkpoint";
+/**
+ * One tree this run has pinned.
+ *
+ * `ref` is the store's own name for it. Nothing above this module interprets
+ * it; it travels so the journal says which tree a checkpointed call read.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export class Snapshot extends Schema.Class("@smthrs/std/Checkpoints/Snapshot")({
+    id: Schema.String,
+    ref: Schema.String
+}) {
+}
+/**
+ * The {@link Checkpoints} service tag.
+ *
+ * @category services
+ * @since 1.0.0
+ */
+export const Checkpoints = Context.Service("@smthrs/std/Checkpoints");
+/**
+ * Builds a store from its two operations.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export const make = (service) => Checkpoints.of(service);
+/**
+ * The refusal a host with nowhere to pin a tree answers with.
+ *
+ * @category errors
+ * @since 1.0.0
+ */
+export const unavailable = (id) => new StdError.StdError({
+    code: "provider_unavailable",
+    message: `This host pins no trees, so it holds no checkpoint "${id}". Take the reading on the live tree instead.`
+});
+/**
+ * Builds a store for a host that pins nothing.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export const makeNoop = () => make({
+    capture: (id) => Effect.fail(unavailable(id)),
+    materialize: (id) => Effect.fail(unavailable(id))
+});
+/**
+ * Provides {@link makeNoop}.
+ *
+ * @category layers
+ * @since 1.0.0
+ */
+export const layerNoop = Layer.succeed(Checkpoints, makeNoop());
+const failed = (message, code = "command_failed") => new StdError.StdError({ code, message });
+/**
+ * A checkpoint id, restricted to what can safely become a git-config key and a
+ * directory name. No dots: a dot would split the config key into another
+ * subsection.
+ */
+const namable = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
+/**
+ * Builds the git-backed store.
+ *
+ * Every git command that records or checks out a tree runs against a shadow
+ * `GIT_DIR` the harness owns, never the workspace's `.git`, which the agent
+ * can write; see `internal/GitWorktree.ts`. The capture reads a copy of the
+ * workspace index, so the agent's own index is untouched: its `git diff` is the
+ * run's evidence and must not move because the harness recorded something.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export const makeGit = (options) => Effect.gen(function* () {
+    const spawner = yield* ChildProcessSpawner;
+    // The host opens the repository before any agent runs. Its `.git` is the
+    // agent's to write, so what it names later can never choose another store.
+    const opened = yield* Effect.exit(GitWorktree.open(withoutTrailingSlash(options.root)).pipe(Effect.provideService(ChildProcessSpawner, spawner)));
+    return gitStore(options, spawner, opened);
+});
+/**
+ * The store itself, with the spawner it runs git through already resolved.
+ *
+ * Resolving it here rather than threading it through {@link Checkpoints} keeps
+ * the service's own requirement empty, which is what lets a browser host bind
+ * {@link layerNoop} against the identical interface — the same shape
+ * `TestRunner` and `Container` take.
+ */
+const gitStore = (options, spawner, opened) => {
+    const spawn = (effect) => Effect.provideService(effect, ChildProcessSpawner, spawner);
+    const root = withoutTrailingSlash(options.root);
+    /** The repository the host opened, refused once the workspace names another. */
+    const repositoryOf = Effect.gen(function* () {
+        const bound = yield* opened;
+        const current = yield* GitWorktree.open(root);
+        if (current.toplevel !== bound.toplevel || current.common !== bound.common || current.index !== bound.index ||
+            current.objectFormat !== bound.objectFormat) {
+            return yield* Effect.fail(failed(`${root} now names another git repository than the one this run opened.`, "permission_denied"));
+        }
+        return current;
+    });
+    const guestRoot = options.cwd === undefined ? root : withoutTrailingSlash(options.cwd);
+    const keyOf = (id) => `${configSection}.${id}`;
+    const baseRefs = options.baseRef === undefined ? [TestRunner.captureBase, "HEAD"] : [options.baseRef];
+    /**
+     * The commit one id names.
+     *
+     * `base` is the one id nobody mints, so it is resolved from refs — the same
+     * precedence `TestRun` uses. Every other id was recorded by {@link capture}
+     * into this repository's config file, which is where a checkpoint is named
+     * *without* becoming history. See {@link configSection}.
+     */
+    const commitOf = (repository, id) => Effect.gen(function* () {
+        if (id === baseId)
+            return (yield* GitWorktree.resolveCommit(root, baseRefs)).commit;
+        const found = yield* GitWorktree.config(repository, ["--get", keyOf(id)]);
+        const commit = found.stdout.trim();
+        if (found.exitCode !== 0 || commit === "") {
+            return yield* Effect.fail(failed(`No checkpoint is stored under ${id} in ${root}. Take the reading on the live tree instead.`, "not_found"));
+        }
+        return commit;
+    });
+    const capture = (id) => spawn(Effect.gen(function* () {
+        if (!namable.test(id)) {
+            return yield* Effect.fail(failed(`A checkpoint id must match ${namable.source}; ${id} does not.`, "invalid_input"));
+        }
+        const repository = yield* repositoryOf;
+        const commit = yield* GitWorktree.withShadow(repository, (shadow) => Effect.gen(function* () {
+            const head = (yield* GitWorktree.resolveCommit(root, ["HEAD"])).commit;
+            yield* shadow.adoptIndex;
+            const pinned = yield* shadow.git(["update-ref", "--no-deref", "HEAD", head]);
+            if (pinned.exitCode !== 0) {
+                return yield* Effect.fail(failed(`Could not record the working tree: ${pinned.stderr.trim()}`));
+            }
+            const recorded = yield* shadow.git(["stash", "create", `flows checkpoint ${id}`], root);
+            if (recorded.exitCode !== 0) {
+                return yield* Effect.fail(failed(`Could not record the working tree: ${recorded.stderr.trim()}`));
+            }
+            // Nothing to record means the working tree IS the commit it is on, so
+            // that commit is the checkpoint. `stash create` says so by printing
+            // nothing, which is not an error and must not be read as one.
+            return recorded.stdout.trim() === "" ? head : recorded.stdout.trim();
+        }));
+        const named = yield* GitWorktree.config(repository, [keyOf(id), commit]);
+        if (named.exitCode !== 0) {
+            return yield* Effect.fail(failed(`Could not name the checkpoint: ${named.stderr.trim()}`));
+        }
+        return new Snapshot({ id, ref: commit });
+    }));
+    const materialize = (id, use) => Effect.gen(function* () {
+        if (!namable.test(id)) {
+            return yield* Effect.fail(failed(`A checkpoint id must match ${namable.source}; ${id} does not.`, "invalid_input"));
+        }
+        const repository = yield* spawn(repositoryOf);
+        const commit = yield* spawn(commitOf(repository, id));
+        const context = yield* Effect.context();
+        return yield* GitWorktree.withDetachedWorktree(repository, `${scratchDirectory}/${id}`, commit, (host) => use({ id, host, guest: `${guestRoot}${host.slice(root.length)}`, root, guestRoot }).pipe(Effect.provideContext(context))).pipe(Effect.provideService(ChildProcessSpawner, spawner));
+    });
+    return make({ capture, materialize });
+};
+/**
+ * Provides {@link makeGit}.
+ *
+ * @category layers
+ * @since 1.0.0
+ */
+export const layerGit = (options) => Layer.effect(Checkpoints)(makeGit(options));
+/**
+ * `$1` is the id. Records the working tree with `stash create` over a copy of
+ * the index, names the commit in config as {@link makeGit} does, and prints it.
+ */
+const pinScript = [
+    "set -e",
+    "cd \"$(git rev-parse --show-toplevel)\"",
+    "copy=$(mktemp -d)",
+    "trap 'rm -rf -- \"$copy\"' EXIT",
+    "index=$(git rev-parse --git-path index)",
+    "if [ -e \"$index\" ]; then cp -p -- \"$index\" \"$copy/index\"; fi",
+    "commit=$(GIT_INDEX_FILE=\"$copy/index\" git -c user.name=flows -c user.email=flows@localhost stash create \"flows checkpoint $1\")",
+    "[ -n \"$commit\" ] || commit=$(git rev-parse --verify 'HEAD^{commit}')",
+    `git config "${configSection}.$1" "$commit"`,
+    "printf '%s\\n' \"$commit\""
+].join("\n");
+/**
+ * `$1` is the id, `$2` the lease. Checks the tree out at
+ * `<top>/.flows-checkpoints/<id>-<lease>` in a repository of its own whose
+ * objects are the workspace's, and prints the top and the checkout.
+ */
+const checkoutScript = [
+    "set -e",
+    "top=$(git rev-parse --show-toplevel)",
+    "cd \"$top\"",
+    "common=$(cd \"$(git rev-parse --git-common-dir)\" && pwd -P)",
+    `if [ "$1" = ${baseId} ]; then`,
+    `  commit=$(git rev-parse --verify --quiet '${TestRunner.captureBase}^{commit}' || git rev-parse --verify --quiet 'HEAD^{commit}') || { echo "No commit resolves from ${TestRunner.captureBase} or HEAD in $top." >&2; exit 1; }`,
+    "else",
+    `  commit=$(git config --get "${configSection}.$1") || { echo "No checkpoint is stored under $1 in $top. Take the reading on the live tree instead." >&2; exit 1; }`,
+    "fi",
+    `dir="$top/${scratchDirectory}/$1-$2"`,
+    "trap 'rm -rf -- \"$dir\"' EXIT",
+    `mkdir -p -- "$top/${scratchDirectory}"`,
+    "git init --quiet \"$dir\"",
+    "printf '%s/objects\\n' \"$common\" > \"$dir/.git/objects/info/alternates\"",
+    "git -C \"$dir\" checkout --quiet --detach \"$commit\"",
+    "trap - EXIT",
+    "printf '%s\\n%s\\n' \"$top\" \"$dir\""
+].join("\n");
+/**
+ * Builds the store for a host whose `bash` runs in one container.
+ *
+ * The repository is the container's, so every git command runs there, through
+ * the same {@link Container.Container} transport `bash` takes. The host store
+ * looked in the CLI's own directory instead and refused every `at` in 112 of
+ * 123 trials of the 2026-10-14 SWE-bench Pro run. This keeps that store's
+ * shape: a checkpoint is a `stash create` commit named in config, and a tree
+ * is checked out under the repository for one call, so a relocated `bash`
+ * call keeps its subdirectory and still finds what the workspace installs
+ * beside it. That git may run what the repository configures, but only inside
+ * the container the agent already commands.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.8
+ */
+export const makeContainer = (options) => Effect.gen(function* () {
+    const spawner = yield* ChildProcessSpawner;
+    const transport = yield* Container.Container;
+    const sh = (script, args) => transport.exec({
+        container: options.container,
+        file: "sh",
+        args: ["-c", script, "sh", ...args],
+        cwd: options.cwd,
+        stdin: false
+    }).pipe(Effect.flatMap((plan) => Exec.exec(plan.file, { args: plan.args, env: plan.env }).pipe(Effect.mapError((error) => Exec.toStdError(plan.file, error)))), Effect.flatMap((result) => result.exitCode === 0
+        ? Effect.succeed(result.stdout.trim().split("\n"))
+        : Effect.fail(failed(`git in container ${options.container} failed: ${result.stderr.trim()}`))), Effect.provideService(ChildProcessSpawner, spawner));
+    const named = (id) => namable.test(id)
+        ? Effect.void
+        : Effect.fail(failed(`A checkpoint id must match ${namable.source}; ${id} does not.`, "invalid_input"));
+    return make({
+        capture: (id) => named(id).pipe(Effect.andThen(sh(pinScript, [id])), Effect.map(([commit]) => new Snapshot({ id, ref: commit }))),
+        materialize: (id, use) => named(id).pipe(Effect.andThen(Effect.acquireUseRelease(sh(checkoutScript, [id, globalThis.crypto.randomUUID()]), ([root, checkout]) => use({ id, host: checkout, guest: checkout, root: root, guestRoot: root }), ([, checkout]) => sh("rm -rf -- \"$1\"", [checkout]).pipe(Effect.catch((error) => Effect.logWarning("could not remove a scratch checkout").pipe(Effect.annotateLogs({ path: checkout, reason: error.message })))))))
+    });
+});
+/**
+ * Provides {@link makeContainer}.
+ *
+ * @category layers
+ * @since 1.0.0-rc.8
+ */
+export const layerContainer = (options) => Layer.effect(Checkpoints)(makeContainer(options));
+/**
+ * Rewrites one call's input so the call runs against a materialized checkpoint.
+ *
+ * Re-exported from {@link Relocate}, which owns the table of flows and fields
+ * this rewrite is driven by. It is exported here because the harness reaches the
+ * whole checkpoint feature through this module.
+ *
+ * @category conversions
+ * @since 1.0.0
+ */
+export { relocate } from "./Relocate.js";
+//# sourceMappingURL=Checkpoints.js.map

package/dist/esm/Checkpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Checkpoints.js","sourceRoot":"","sources":["../../src/Checkpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAa,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAClE,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAmB,MAAM,2BAA2B,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAA;AAC5C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AACzC,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAA;AAE5B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,iBAAiB,CAAA;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAA;AAE/C;;;;;;;;GAQG;AACH,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,KAAK,CAAW,kCAAkC,CAAC,CAAC;IACvF,EAAE,EAAE,MAAM,CAAC,MAAM;IACjB,GAAG,EAAE,MAAM,CAAC,MAAM;CACnB,CAAC;CAAG;AAqDL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAA8C,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;AAEhH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAoB,EAAe,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;AAElF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAU,EAAqB,EAAE,CAC3D,IAAI,QAAQ,CAAC,QAAQ,CAAC;IACpB,IAAI,EAAE,sBAAsB;IAC5B,OAAO,EAAE,uDAAuD,EAAE,+CAA+C;CAClH,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAgB,EAAE,CACxC,IAAI,CAAC;IACH,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7C,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;CAClD,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAA6B,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAA;AAiCzF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,OAAsB,gBAAgB,EAAqB,EAAE,CAC5F,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;AAE1C;;;;GAIG;AACH,MAAM,OAAO,GAAG,4BAA4B,CAAA;AAE5C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,OAAmB,EACqC,EAAE,CAC1D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAC/B,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAC/G,CAAA;IACD,OAAO,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;AAC3C,CAAC,CAAC,CAAA;AAEJ;;;;;;;GAOG;AACH,MAAM,QAAQ,GAAG,CACf,OAAmB,EACnB,OAAuC,EACvC,MAAgD,EACnC,EAAE;IACf,MAAM,KAAK,GAAG,CAAO,MAAgD,EAAuB,EAAE,CAC5F,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/C,gFAAgF;IAChF,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAA;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,IACE,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YACvG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAC3C,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,MAAM,CAAC,GAAG,IAAI,iEAAiE,EAAE,mBAAmB,CAAC,CACtG,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtF,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,GAAG,aAAa,IAAI,EAAE,EAAE,CAAA;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAErG;;;;;;;OAOG;IACH,MAAM,QAAQ,GAAG,CAAC,UAAsB,EAAE,EAAU,EAAE,EAAE,CACtD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,EAAE,KAAK,MAAM;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QACnF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACzE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,MAAM,CACJ,iCAAiC,EAAE,OAAO,IAAI,8CAA8C,EAC5F,WAAW,CACZ,CACF,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAA;IAEJ,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE,CAC7B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,MAAM,CAAC,8BAA8B,OAAO,CAAC,MAAM,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,CACzF,CAAA;QACH,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YACtE,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAA;YACxB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;YACjG,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;YACvF,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,sCAAsC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;YACnG,CAAC;YACD,sEAAsE;YACtE,oEAAoE;YACpE,8DAA8D;YAC9D,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QACtE,CAAC,CAAC,CAAC,CAAA;QACL,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;QACxE,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,kCAAkC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QAC5F,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAC,CAAA;IAEL,MAAM,WAAW,GAAG,CAClB,EAAU,EACV,GAA2D,EACf,EAAE,CAC9C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,MAAM,CAAC,8BAA8B,OAAO,CAAC,MAAM,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,CACzF,CAAA;QACH,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAA;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAK,CAAA;QAC1C,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,oBAAoB,CAC5C,UAAU,EACV,GAAG,gBAAgB,IAAI,EAAE,EAAE,EAC3B,MAAM,EACN,CAAC,IAAI,EAAE,EAAE,CACP,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CACtF,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAC/B,CACJ,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEJ,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;AACvC,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAmB,EAAwD,EAAE,CACpG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;AAe7C;;;GAGG;AACH,MAAM,SAAS,GAAG;IAChB,QAAQ;IACR,yCAAyC;IACzC,mBAAmB;IACnB,iCAAiC;IACjC,yCAAyC;IACzC,oEAAoE;IACpE,oIAAoI;IACpI,wEAAwE;IACxE,eAAe,aAAa,gBAAgB;IAC5C,4BAA4B;CAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ;;;;GAIG;AACH,MAAM,cAAc,GAAG;IACrB,QAAQ;IACR,sCAAsC;IACtC,aAAa;IACb,8DAA8D;IAC9D,eAAe,MAAM,UAAU;IAC/B,8CAA8C,UAAU,CAAC,WAAW,oGAAoG,UAAU,CAAC,WAAW,mCAAmC;IACjO,MAAM;IACN,gCAAgC,aAAa,uHAAuH;IACpK,IAAI;IACJ,aAAa,gBAAgB,SAAS;IACtC,gCAAgC;IAChC,qBAAqB,gBAAgB,GAAG;IACxC,2BAA2B;IAC3B,4EAA4E;IAC5E,uDAAuD;IACvD,aAAa;IACb,uCAAuC;CACxC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,OAAyB,EACqD,EAAE,CAChF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAA;IAC5C,MAAM,EAAE,GAAG,CAAC,MAAc,EAAE,IAA2B,EAAE,EAAE,CACzD,SAAS,CAAC,IAAI,CAAC;QACb,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACnC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,KAAK;KACb,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAC9D,CACF,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,QAAQ,KAAK,CAAC;QACnB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,OAAO,CAAC,SAAS,YAAY,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACjG,EACD,MAAM,CAAC,cAAc,CAAC,mBAAmB,EAAE,OAAO,CAAC,CACpD,CAAA;IACH,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACd,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,8BAA8B,OAAO,CAAC,MAAM,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,CAAA;IAC3G,OAAO,IAAI,CAAC;QACV,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CACd,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CACZ,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EACnC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,MAAO,EAAE,CAAC,CAAC,CAC7D;QACH,WAAW,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CACvB,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CACpD,EAAE,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,EACxD,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAS,EAAE,KAAK,EAAE,QAAS,EAAE,IAAI,EAAE,IAAK,EAAE,SAAS,EAAE,IAAK,EAAE,CAAC,EACnG,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CACf,EAAE,CAAC,kBAAkB,EAAE,CAAC,QAAS,CAAC,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,UAAU,CAAC,qCAAqC,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAC/D,CACF,CACF,CACJ,CAAC,CAAC;KACN,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAyB,EACmD,EAAE,CAC9E,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA;AAEnD;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAmB,MAAM,eAAe,CAAA","sourcesContent":["/**\n * Pinned trees, and the scratch checkouts a call runs against.\n *\n * A checkpoint is a **value**: minting one changes nothing about the workspace,\n * and running a call against one leaves the live tree exactly as it stands.\n * That is the whole of what it buys. Before it existed, the only way a run\n * could answer \"did this command fail before my change\" was to undo the change\n * — and the journals price that exactly. On `sympy__sympy-13878` the r95repl\n * lane applied one byte-identical 4,789-character patch **five times**, four of\n * those applications preceded by `git checkout -- sympy/stats/crv_types.py`,\n * because a clean fails-before proof required reverting the very work it was\n * meant to prove.\n *\n * This module is the host half of `@smthrs/harness`'s `ctx.checkpoint()` and\n * `ctx.call(flow, input, { at })`. The harness owns the surface, the identity,\n * the bound and the refusals; nothing in it knows what a tree is. This owns the\n * two host operations that need one:\n *\n * - {@link Checkpoints.capture} records the working tree under an id, and\n * - {@link Checkpoints.materialize} gives that tree back as a directory for the\n *   length of one call.\n *\n * ## The git binding, and the container constraint it is shaped by\n *\n * {@link layerGit} records a checkpoint with `git stash create`, then names the\n * commit it prints in this repository's own git config rather than with a ref —\n * see {@link configSection} for why a ref would hand the agent its own edit back\n * as history. `stash create` is the one git command\n * that records the working tree and changes nothing else: it does not move the\n * worktree and does not touch the stash ref. It runs against a shadow\n * `GIT_DIR` over a copy of the workspace index (see `internal/GitWorktree.ts`),\n * so it never writes the repository's index and never runs a program the\n * workspace's `.git` names. That matters more than it sounds. The agent runs `git` in this same\n * workspace and its own `git diff` is the run's evidence, so a capture that\n * staged into the real index would be the harness editing the evidence while\n * recording it. A tree with nothing to record prints nothing, and the\n * checkpoint is then `HEAD` — which is exactly what the tree is.\n *\n * Untracked files are not in the recorded tree, which matches how the rig\n * captures a patch: `capture-patch.sh` drops paths that did not exist when the\n * agent started, so a checkpoint holds what a patch would hold.\n *\n * The materialization is a detached checkout at `<root>/.flows-checkpoints/<id>-<lease>`\n * — **inside** the workspace, which looks wrong and is the only thing that\n * works. A benchmark check runs through `docker exec` inside `/testbed`, and\n * `/testbed` is a bind mount of the live workspace. A scratch checkout anywhere\n * else on the host is simply not visible to the container, so the call would run\n * against a path that does not exist. Placed under the workspace it is visible\n * at the same subpath under the mount, needs no second mount, and needs no\n * change to how the rig starts its container. `TestRun`'s `against: \"base\"`\n * reached the same conclusion first and this reuses its shape;\n * `evals/swebench/run-instance.sh` excludes the directory from patch capture for\n * the same reason it excludes `.flows-test-base`.\n *\n * The checkout is added and removed around **one call**, which is stricter than\n * the frame lifetime the design asks for and much simpler: there is no cache to\n * invalidate, no id to leak, and a checkpoint used by three calls pays three\n * checkouts rather than risking one stale directory. A run that reuses a\n * checkpoint across frames simply re-materializes it, because the ref is what\n * persists.\n *\n * ## What can be pointed at a checkpoint, and what cannot\n *\n * {@link relocate} is the closed answer, and `Relocate.ts` owns it. That half\n * knows the input shapes of `bash`, `read`, `ls`, `grep` and `glob`; this half\n * knows git. They change for different reasons, so they are different modules,\n * and {@link relocate} is re-exported here because the harness reaches the whole\n * feature through this one.\n *\n * @since 1.0.0\n */\n\nimport { ChildProcessSpawner } from \"@smthrs/kernel/ChildProcessSpawner\"\nimport { Context, Effect, type Exit, Layer, Schema } from \"effect\"\nimport * as Container from \"./Container.ts\"\nimport * as Exec from \"./internal/Exec.ts\"\nimport { GitWorktree, type Repository } from \"./internal/GitWorktree.ts\"\nimport { withoutTrailingSlash } from \"./internal/Paths.ts\"\nimport * as Prune from \"./internal/Prune.ts\"\nimport * as StdError from \"./StdError.ts\"\nimport * as TestRunner from \"./TestRunner.ts\"\n\n/**\n * The id naming the tree a run opened on.\n *\n * It is not minted: the host either recorded one before the agent started or it\n * did not. {@link layerGit} resolves it to {@link TestRunner.captureBase} and\n * then to `HEAD`, which is the same precedence `TestRun` uses for the same\n * question — so a workspace that has one answer for a baseline has one answer\n * for both.\n *\n * @category constants\n * @since 1.0.0\n */\nexport const baseId = \"base\"\n\n/**\n * The directory checkpoints are materialized into, relative to the repository\n * root and therefore also relative to a container's view of it.\n *\n * @category constants\n * @since 1.0.0\n */\nexport const scratchDirectory = Prune.checkpointScratch\n\n/**\n * The git-config section {@link layerGit} records minted checkpoints under.\n *\n * Config and **not a ref**, and that is the whole of the decision. A ref is\n * history: `git log --all` lists it, `git show` prints it, and `git log --all\n * -S` searches it — so a checkpoint named by a ref would hand an agent a commit\n * containing its own edit and let it read that back as if it were upstream\n * work. That exact class cost the measured program real money before the rig\n * moved jj's store out of the workspace (`evals/swebench/run-instance.sh`:\n * django-13346 applied two of its own snapshots as a fake fix), and a ref here\n * would reintroduce it one wave later.\n *\n * The commit object itself is unreferenced. It stays alive for the life of the\n * run — nothing in a run prunes — and a checkout by id works perfectly well,\n * which is measured in `CheckpointsFixture.test.ts`. So the tree is reachable\n * by id and no command that walks refs can reach it:\n * `git log`, `git log --all`, `git log -S` and `git show <ref>` all answer\n * exactly as they did before the capture.\n *\n * One command still sees it, measured rather than argued in\n * `CheckpointsFixture.test.ts`: `git fsck` reports it as a dangling commit,\n * because that is what an unreferenced commit is. A checkout is a standalone\n * repository, not a worktree of this one, so `git log --all` does not list it\n * even while a call runs in it. It is not reachable by a name that looks like project history, and the cell\n * contract's environment section says outright that a dangling commit is this\n * harness holding the agent's own tree — which is the half of the django-13346\n * lesson that a store cannot enforce.\n *\n * @category constants\n * @since 1.0.0\n */\nexport const configSection = \"flows-checkpoint\"\n\n/**\n * One tree this run has pinned.\n *\n * `ref` is the store's own name for it. Nothing above this module interprets\n * it; it travels so the journal says which tree a checkpointed call read.\n *\n * @category models\n * @since 1.0.0\n */\nexport class Snapshot extends Schema.Class<Snapshot>(\"@smthrs/std/Checkpoints/Snapshot\")({\n  id: Schema.String,\n  ref: Schema.String\n}) {}\n\n/**\n * A tree handed back as a directory, for the length of one call.\n *\n * `host` is where the process running on this machine finds it. `guest` is\n * where a container finds the same directory, which is the same path when no\n * container is in play. They differ exactly as `TestRunner.Runner`'s `cwd` and\n * `root` differ, and for the same reason: one directory, two names.\n *\n * `root` and `guestRoot` are the workspace itself under those same two names.\n * They travel because a call that named a directory *inside* the workspace has\n * to keep it: a check that runs in `tests/` and is pointed at a checkpoint must\n * run in the checkpoint's `tests/`, not at its top. Silently dropping that\n * subpath is how a baseline comes back failing for a reason nobody chose, which\n * is the one failure a checkpoint exists to make impossible.\n *\n * @category models\n * @since 1.0.0\n */\nexport interface Materialized {\n  readonly id: string\n  readonly host: string\n  readonly guest: string\n  /** The workspace this checkpoint is a tree of, as this machine names it. */\n  readonly root: string\n  /** The workspace as a container names it; the same as {@link Materialized.root} when none does. */\n  readonly guestRoot: string\n}\n\n/**\n * The two host operations a checkpoint needs.\n *\n * @category services\n * @since 1.0.0\n */\nexport interface Checkpoints {\n  /** Records the working tree as it stands, under `id`. */\n  readonly capture: (id: string) => Effect.Effect<Snapshot, StdError.StdError>\n  /**\n   * Hands `id` back as a directory for the length of the effect it wraps.\n   *\n   * Scoped rather than returned, because the directory has to be removed\n   * however the call ends — a benchmark run killed at its wall-clock budget\n   * would otherwise leave a second checkout of the whole repository in a tree\n   * whose diff is the run's answer.\n   */\n  readonly materialize: <A, E, R>(\n    id: string,\n    use: (materialized: Materialized) => Effect.Effect<A, E, R>\n  ) => Effect.Effect<A, E | StdError.StdError, R>\n}\n\n/**\n * The {@link Checkpoints} service tag.\n *\n * @category services\n * @since 1.0.0\n */\nexport const Checkpoints: Context.Service<Checkpoints, Checkpoints> = Context.Service(\"@smthrs/std/Checkpoints\")\n\n/**\n * Builds a store from its two operations.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const make = (service: Checkpoints): Checkpoints => Checkpoints.of(service)\n\n/**\n * The refusal a host with nowhere to pin a tree answers with.\n *\n * @category errors\n * @since 1.0.0\n */\nexport const unavailable = (id: string): StdError.StdError =>\n  new StdError.StdError({\n    code: \"provider_unavailable\",\n    message: `This host pins no trees, so it holds no checkpoint \"${id}\". Take the reading on the live tree instead.`\n  })\n\n/**\n * Builds a store for a host that pins nothing.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const makeNoop = (): Checkpoints =>\n  make({\n    capture: (id) => Effect.fail(unavailable(id)),\n    materialize: (id) => Effect.fail(unavailable(id))\n  })\n\n/**\n * Provides {@link makeNoop}.\n *\n * @category layers\n * @since 1.0.0\n */\nexport const layerNoop: Layer.Layer<Checkpoints> = Layer.succeed(Checkpoints, makeNoop())\n\n/**\n * What {@link layerGit} needs to know about the repository it pins.\n *\n * @category models\n * @since 1.0.0\n */\nexport interface GitOptions {\n  /**\n   * The host path of the git repository whose trees are pinned.\n   *\n   * It is opened when the store is built. A root that was not a repository\n   * then pins nothing, and one whose `.git` later names another repository is\n   * refused with `permission_denied`.\n   */\n  readonly root: string\n  /**\n   * Where a container sees {@link GitOptions.root}, when one does.\n   *\n   * Absent means there is no container, and the guest path of a materialized\n   * checkpoint is then its host path.\n   */\n  readonly cwd?: string | undefined\n  /**\n   * The ref naming the tree the run opened on, for {@link baseId}.\n   *\n   * Absent takes `TestRunner.captureBase` and then `HEAD`, which is the\n   * precedence `TestRun` already uses.\n   */\n  readonly baseRef?: string | undefined\n}\n\nconst failed = (message: string, code: StdError.Code = \"command_failed\"): StdError.StdError =>\n  new StdError.StdError({ code, message })\n\n/**\n * A checkpoint id, restricted to what can safely become a git-config key and a\n * directory name. No dots: a dot would split the config key into another\n * subsection.\n */\nconst namable = /^[A-Za-z0-9][A-Za-z0-9-]*$/\n\n/**\n * Builds the git-backed store.\n *\n * Every git command that records or checks out a tree runs against a shadow\n * `GIT_DIR` the harness owns, never the workspace's `.git`, which the agent\n * can write; see `internal/GitWorktree.ts`. The capture reads a copy of the\n * workspace index, so the agent's own index is untouched: its `git diff` is the\n * run's evidence and must not move because the harness recorded something.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const makeGit = (\n  options: GitOptions\n): Effect.Effect<Checkpoints, never, ChildProcessSpawner> =>\n  Effect.gen(function*() {\n    const spawner = yield* ChildProcessSpawner\n    // The host opens the repository before any agent runs. Its `.git` is the\n    // agent's to write, so what it names later can never choose another store.\n    const opened = yield* Effect.exit(\n      GitWorktree.open(withoutTrailingSlash(options.root)).pipe(Effect.provideService(ChildProcessSpawner, spawner))\n    )\n    return gitStore(options, spawner, opened)\n  })\n\n/**\n * The store itself, with the spawner it runs git through already resolved.\n *\n * Resolving it here rather than threading it through {@link Checkpoints} keeps\n * the service's own requirement empty, which is what lets a browser host bind\n * {@link layerNoop} against the identical interface — the same shape\n * `TestRunner` and `Container` take.\n */\nconst gitStore = (\n  options: GitOptions,\n  spawner: ChildProcessSpawner[\"Service\"],\n  opened: Exit.Exit<Repository, StdError.StdError>\n): Checkpoints => {\n  const spawn = <A, E>(effect: Effect.Effect<A, E, ChildProcessSpawner>): Effect.Effect<A, E> =>\n    Effect.provideService(effect, ChildProcessSpawner, spawner)\n  const root = withoutTrailingSlash(options.root)\n\n  /** The repository the host opened, refused once the workspace names another. */\n  const repositoryOf = Effect.gen(function*() {\n    const bound = yield* opened\n    const current = yield* GitWorktree.open(root)\n    if (\n      current.toplevel !== bound.toplevel || current.common !== bound.common || current.index !== bound.index ||\n      current.objectFormat !== bound.objectFormat\n    ) {\n      return yield* Effect.fail(\n        failed(`${root} now names another git repository than the one this run opened.`, \"permission_denied\")\n      )\n    }\n    return current\n  })\n  const guestRoot = options.cwd === undefined ? root : withoutTrailingSlash(options.cwd)\n  const keyOf = (id: string) => `${configSection}.${id}`\n  const baseRefs = options.baseRef === undefined ? [TestRunner.captureBase, \"HEAD\"] : [options.baseRef]\n\n  /**\n   * The commit one id names.\n   *\n   * `base` is the one id nobody mints, so it is resolved from refs — the same\n   * precedence `TestRun` uses. Every other id was recorded by {@link capture}\n   * into this repository's config file, which is where a checkpoint is named\n   * *without* becoming history. See {@link configSection}.\n   */\n  const commitOf = (repository: Repository, id: string) =>\n    Effect.gen(function*() {\n      if (id === baseId) return (yield* GitWorktree.resolveCommit(root, baseRefs)).commit\n      const found = yield* GitWorktree.config(repository, [\"--get\", keyOf(id)])\n      const commit = found.stdout.trim()\n      if (found.exitCode !== 0 || commit === \"\") {\n        return yield* Effect.fail(\n          failed(\n            `No checkpoint is stored under ${id} in ${root}. Take the reading on the live tree instead.`,\n            \"not_found\"\n          )\n        )\n      }\n      return commit\n    })\n\n  const capture = (id: string) =>\n    spawn(Effect.gen(function*() {\n      if (!namable.test(id)) {\n        return yield* Effect.fail(\n          failed(`A checkpoint id must match ${namable.source}; ${id} does not.`, \"invalid_input\")\n        )\n      }\n      const repository = yield* repositoryOf\n      const commit = yield* GitWorktree.withShadow(repository, (shadow) =>\n        Effect.gen(function*() {\n          const head = (yield* GitWorktree.resolveCommit(root, [\"HEAD\"])).commit\n          yield* shadow.adoptIndex\n          const pinned = yield* shadow.git([\"update-ref\", \"--no-deref\", \"HEAD\", head])\n          if (pinned.exitCode !== 0) {\n            return yield* Effect.fail(failed(`Could not record the working tree: ${pinned.stderr.trim()}`))\n          }\n          const recorded = yield* shadow.git([\"stash\", \"create\", `flows checkpoint ${id}`], root)\n          if (recorded.exitCode !== 0) {\n            return yield* Effect.fail(failed(`Could not record the working tree: ${recorded.stderr.trim()}`))\n          }\n          // Nothing to record means the working tree IS the commit it is on, so\n          // that commit is the checkpoint. `stash create` says so by printing\n          // nothing, which is not an error and must not be read as one.\n          return recorded.stdout.trim() === \"\" ? head : recorded.stdout.trim()\n        }))\n      const named = yield* GitWorktree.config(repository, [keyOf(id), commit])\n      if (named.exitCode !== 0) {\n        return yield* Effect.fail(failed(`Could not name the checkpoint: ${named.stderr.trim()}`))\n      }\n      return new Snapshot({ id, ref: commit })\n    }))\n\n  const materialize = <A, E, R>(\n    id: string,\n    use: (materialized: Materialized) => Effect.Effect<A, E, R>\n  ): Effect.Effect<A, E | StdError.StdError, R> =>\n    Effect.gen(function*() {\n      if (!namable.test(id)) {\n        return yield* Effect.fail(\n          failed(`A checkpoint id must match ${namable.source}; ${id} does not.`, \"invalid_input\")\n        )\n      }\n      const repository = yield* spawn(repositoryOf)\n      const commit = yield* spawn(commitOf(repository, id))\n      const context = yield* Effect.context<R>()\n      return yield* GitWorktree.withDetachedWorktree(\n        repository,\n        `${scratchDirectory}/${id}`,\n        commit,\n        (host) =>\n          use({ id, host, guest: `${guestRoot}${host.slice(root.length)}`, root, guestRoot }).pipe(\n            Effect.provideContext(context)\n          )\n      ).pipe(Effect.provideService(ChildProcessSpawner, spawner))\n    })\n\n  return make({ capture, materialize })\n}\n\n/**\n * Provides {@link makeGit}.\n *\n * @category layers\n * @since 1.0.0\n */\nexport const layerGit = (options: GitOptions): Layer.Layer<Checkpoints, never, ChildProcessSpawner> =>\n  Layer.effect(Checkpoints)(makeGit(options))\n\n/**\n * What {@link makeContainer} needs to know about the container it pins in.\n *\n * @category models\n * @since 1.0.0-rc.8\n */\nexport interface ContainerOptions {\n  /** The container `bash` runs in. */\n  readonly container: string\n  /** A directory of the repository inside it; absent is the container's own working directory. */\n  readonly cwd?: string | undefined\n}\n\n/**\n * `$1` is the id. Records the working tree with `stash create` over a copy of\n * the index, names the commit in config as {@link makeGit} does, and prints it.\n */\nconst pinScript = [\n  \"set -e\",\n  \"cd \\\"$(git rev-parse --show-toplevel)\\\"\",\n  \"copy=$(mktemp -d)\",\n  \"trap 'rm -rf -- \\\"$copy\\\"' EXIT\",\n  \"index=$(git rev-parse --git-path index)\",\n  \"if [ -e \\\"$index\\\" ]; then cp -p -- \\\"$index\\\" \\\"$copy/index\\\"; fi\",\n  \"commit=$(GIT_INDEX_FILE=\\\"$copy/index\\\" git -c user.name=flows -c user.email=flows@localhost stash create \\\"flows checkpoint $1\\\")\",\n  \"[ -n \\\"$commit\\\" ] || commit=$(git rev-parse --verify 'HEAD^{commit}')\",\n  `git config \"${configSection}.$1\" \"$commit\"`,\n  \"printf '%s\\\\n' \\\"$commit\\\"\"\n].join(\"\\n\")\n\n/**\n * `$1` is the id, `$2` the lease. Checks the tree out at\n * `<top>/.flows-checkpoints/<id>-<lease>` in a repository of its own whose\n * objects are the workspace's, and prints the top and the checkout.\n */\nconst checkoutScript = [\n  \"set -e\",\n  \"top=$(git rev-parse --show-toplevel)\",\n  \"cd \\\"$top\\\"\",\n  \"common=$(cd \\\"$(git rev-parse --git-common-dir)\\\" && pwd -P)\",\n  `if [ \"$1\" = ${baseId} ]; then`,\n  `  commit=$(git rev-parse --verify --quiet '${TestRunner.captureBase}^{commit}' || git rev-parse --verify --quiet 'HEAD^{commit}') || { echo \"No commit resolves from ${TestRunner.captureBase} or HEAD in $top.\" >&2; exit 1; }`,\n  \"else\",\n  `  commit=$(git config --get \"${configSection}.$1\") || { echo \"No checkpoint is stored under $1 in $top. Take the reading on the live tree instead.\" >&2; exit 1; }`,\n  \"fi\",\n  `dir=\"$top/${scratchDirectory}/$1-$2\"`,\n  \"trap 'rm -rf -- \\\"$dir\\\"' EXIT\",\n  `mkdir -p -- \"$top/${scratchDirectory}\"`,\n  \"git init --quiet \\\"$dir\\\"\",\n  \"printf '%s/objects\\\\n' \\\"$common\\\" > \\\"$dir/.git/objects/info/alternates\\\"\",\n  \"git -C \\\"$dir\\\" checkout --quiet --detach \\\"$commit\\\"\",\n  \"trap - EXIT\",\n  \"printf '%s\\\\n%s\\\\n' \\\"$top\\\" \\\"$dir\\\"\"\n].join(\"\\n\")\n\n/**\n * Builds the store for a host whose `bash` runs in one container.\n *\n * The repository is the container's, so every git command runs there, through\n * the same {@link Container.Container} transport `bash` takes. The host store\n * looked in the CLI's own directory instead and refused every `at` in 112 of\n * 123 trials of the 2026-10-14 SWE-bench Pro run. This keeps that store's\n * shape: a checkpoint is a `stash create` commit named in config, and a tree\n * is checked out under the repository for one call, so a relocated `bash`\n * call keeps its subdirectory and still finds what the workspace installs\n * beside it. That git may run what the repository configures, but only inside\n * the container the agent already commands.\n *\n * @category constructors\n * @since 1.0.0-rc.8\n */\nexport const makeContainer = (\n  options: ContainerOptions\n): Effect.Effect<Checkpoints, never, ChildProcessSpawner | Container.Container> =>\n  Effect.gen(function*() {\n    const spawner = yield* ChildProcessSpawner\n    const transport = yield* Container.Container\n    const sh = (script: string, args: ReadonlyArray<string>) =>\n      transport.exec({\n        container: options.container,\n        file: \"sh\",\n        args: [\"-c\", script, \"sh\", ...args],\n        cwd: options.cwd,\n        stdin: false\n      }).pipe(\n        Effect.flatMap((plan) =>\n          Exec.exec(plan.file, { args: plan.args, env: plan.env }).pipe(\n            Effect.mapError((error) => Exec.toStdError(plan.file, error))\n          )\n        ),\n        Effect.flatMap((result) =>\n          result.exitCode === 0\n            ? Effect.succeed(result.stdout.trim().split(\"\\n\"))\n            : Effect.fail(failed(`git in container ${options.container} failed: ${result.stderr.trim()}`))\n        ),\n        Effect.provideService(ChildProcessSpawner, spawner)\n      )\n    const named = (id: string) =>\n      namable.test(id)\n        ? Effect.void\n        : Effect.fail(failed(`A checkpoint id must match ${namable.source}; ${id} does not.`, \"invalid_input\"))\n    return make({\n      capture: (id) =>\n        named(id).pipe(\n          Effect.andThen(sh(pinScript, [id])),\n          Effect.map(([commit]) => new Snapshot({ id, ref: commit! }))\n        ),\n      materialize: (id, use) =>\n        named(id).pipe(Effect.andThen(Effect.acquireUseRelease(\n          sh(checkoutScript, [id, globalThis.crypto.randomUUID()]),\n          ([root, checkout]) => use({ id, host: checkout!, guest: checkout!, root: root!, guestRoot: root! }),\n          ([, checkout]) =>\n            sh(\"rm -rf -- \\\"$1\\\"\", [checkout!]).pipe(\n              Effect.catch((error) =>\n                Effect.logWarning(\"could not remove a scratch checkout\").pipe(\n                  Effect.annotateLogs({ path: checkout, reason: error.message })\n                )\n              )\n            )\n        )))\n    })\n  })\n\n/**\n * Provides {@link makeContainer}.\n *\n * @category layers\n * @since 1.0.0-rc.8\n */\nexport const layerContainer = (\n  options: ContainerOptions\n): Layer.Layer<Checkpoints, never, ChildProcessSpawner | Container.Container> =>\n  Layer.effect(Checkpoints)(makeContainer(options))\n\n/**\n * Rewrites one call's input so the call runs against a materialized checkpoint.\n *\n * Re-exported from {@link Relocate}, which owns the table of flows and fields\n * this rewrite is driven by. It is exported here because the harness reaches the\n * whole checkpoint feature through this module.\n *\n * @category conversions\n * @since 1.0.0\n */\nexport { relocate, type Relocation } from \"./Relocate.ts\"\n"]}

package/dist/esm/Container.d.ts

@@ -0,0 +1,132 @@
+/**
+ * The host's route into a named container, as an injected transport.
+ *
+ * A task whose interpreter, dependencies, and test runner live in a container
+ * makes every command a nested quoting problem: the agent writes
+ * `docker exec c bash -lc 'cd /testbed && python - <<EOF … EOF'`, and one layer
+ * of that stack eats a quote. The measured cost across the 45-instance program
+ * was twelve failed probes, one instance's single most expensive frame
+ * (astropy-8707, which produced a probe that never ran), and a class of failure
+ * that turns from a broken probe into a broken *edit* the moment the same
+ * quoting reaches a writing command.
+ *
+ * So the transport is the harness's, not the agent's. A caller names the
+ * container and passes its program and payload as data; this service turns that
+ * into the argv the host actually spawns. `docker` and `podman` share the CLI
+ * {@link makeCommand} builds, and a host with a different route supplies its own
+ * {@link make} rather than teaching the agent a new incantation.
+ *
+ * A host that has no container route provides {@link makeNoop}, whose refusal
+ * says so plainly. Nothing here shells out on its own: it only decides an argv,
+ * and `bash` spawns it through the same permission-aware spawner as everything
+ * else.
+ *
+ * @since 1.0.0
+ */
+import { Context, Effect, Layer } from "effect";
+import * as StdError from "./StdError.ts";
+/**
+ * One command to run inside a container.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export interface Request {
+    readonly container: string;
+    readonly file: string;
+    readonly args: ReadonlyArray<string>;
+    readonly cwd?: string | undefined;
+    readonly env?: Record<string, string> | undefined;
+    /** Whether the payload arrives on the program's standard input. */
+    readonly stdin: boolean;
+}
+/**
+ * The argv the host spawns to satisfy a {@link Request}.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export interface Plan {
+    readonly file: string;
+    readonly args: ReadonlyArray<string>;
+    /** Environment overrides for the transport process, never rendered as argv. */
+    readonly env?: Record<string, string> | undefined;
+}
+/**
+ * The one container transport contract.
+ *
+ * @category services
+ * @since 1.0.0
+ */
+export interface Container {
+    readonly exec: (request: Request) => Effect.Effect<Plan, StdError.StdError>;
+}
+/**
+ * The {@link Container} service tag.
+ *
+ * @category services
+ * @since 1.0.0
+ */
+export declare const Container: Context.Service<Container, Container>;
+/**
+ * Builds a container transport from its one operation.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export declare const make: (service: Container) => Container;
+/**
+ * The refusal a host with no container route answers with.
+ *
+ * @category errors
+ * @since 1.0.0
+ */
+export declare const unavailable: (container: string) => StdError.StdError;
+/**
+ * Builds the transport for a host with no container route.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export declare const makeNoop: () => Container;
+/**
+ * Provides {@link makeNoop}.
+ *
+ * @category layers
+ * @since 1.0.0
+ */
+export declare const layerNoop: Layer.Layer<Container>;
+/**
+ * Builds a transport over a `docker exec`-compatible CLI.
+ *
+ * `-i` is attached only when the payload arrives on standard input, because a
+ * container CLI that holds stdin open for a command that never reads it makes
+ * that command hang.
+ *
+ * Requested environment variables never reach the transport process under
+ * their own names. The request's `env` is the caller's, and the transport is a
+ * host program: `PATH`, `LD_PRELOAD`, `DOCKER_HOST` or `XDG_CONFIG_HOME` set on
+ * it would choose what runs on the host. Each value therefore travels in
+ * {@link Plan.env} under `SMITHERS_CONTAINER_ENV_`, is forwarded by that name
+ * (`-e SMITHERS_CONTAINER_ENV_KEY`), and a `sh` inside the container renames it
+ * to `KEY` before `exec`ing the program. Values stay out of the argv. A name
+ * must be a POSIX shell name. A request with `env` therefore requires `sh` in
+ * the container; one without `env` runs the program directly, so an image
+ * without a shell works only for requests that carry no `env`.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export declare const makeCommand: (options?: {
+    readonly program?: string | undefined;
+}) => Container;
+/**
+ * Provides {@link makeCommand}.
+ *
+ * @category layers
+ * @since 1.0.0
+ */
+export declare const layerCommand: (options?: {
+    readonly program?: string | undefined;
+}) => Layer.Layer<Container>;
+//# sourceMappingURL=Container.d.ts.map

package/dist/esm/Container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Container.d.ts","sourceRoot":"","sources":["../../src/Container.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC/C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAEzC;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;IACjD,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;CAClD;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;CAC5E;AAED;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAA4C,CAAA;AAExG;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,SAAS,SAAS,KAAG,SAAkC,CAAA;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,WAAW,MAAM,KAAG,QAAQ,CAAC,QAKrD,CAAA;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,QAAO,SAAqF,CAAA;AAEjH;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAwC,CAAA;AAerF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,KAAG,SAuDjF,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,UAAU;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,KAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CACxD,CAAA"}