@songsid/agend 2.1.4 → 2.1.5-beta.2

package/dist/login-controller.js

@@ -0,0 +1,450 @@
+/**
+ * Remote `/login` in web-terminal mode (v2.1.5, design docs/design/login-relay-v2).
+ *
+ * The fleet starts ONE command (`<backend> login`, optionally preceded by a
+ * deterministic pre-command such as `kiro-cli logout`) in a dedicated tmux
+ * server and opens a time-boxed, token-gated browser terminal onto that pane
+ * (src/web-terminal.ts). The human drives whatever TUI the CLI shows; the
+ * fleet only observes the pane to post the device URL/code, judge success and
+ * restart the backend's instances afterwards. Zero LLM involvement.
+ *
+ * Authorization surface owned here (sol reviews this as a new surface):
+ *   - admin-only, re-checked inside start() — callers are not trusted
+ *   - one login/install window fleet-wide, claimed SYNCHRONOUSLY before the
+ *     first await (LoginWindowLock, shared with relay login and install)
+ *   - only flows reviewed as having no shell escape (`noShellEscape: true`)
+ *     may open a terminal; per-requester rate limit 3 starts / 5 min
+ *   - every start goes through a risk confirmation button (design §3.2); the
+ *     kiro variant also states that the CLI will be logged out first
+ *   - the link (no secret) goes to the requesting chat; the one-time access
+ *     token goes ONLY to the requester privately (adapter.sendDirect). If the
+ *     private route fails the token is never posted in the channel: the
+ *     admin gets a requester-only "resend" button. If neither the link nor a
+ *     token route can be delivered, the session is cancelled — never left
+ *     half-delivered.
+ *   - errors from secret-bearing sends are logged as name/code only; every
+ *     step is audited to the event log without token/cookie/URL secrets
+ *   - fleet shutdown cancels the active session and waits for the confirmed
+ *     tmux kill (no orphaned login CLI)
+ */
+import { homedir } from "node:os";
+import { LOGIN_BACKEND_ALIASES, LOGIN_FLOWS, checkAuthStatus } from "./login-flows.js";
+import { t } from "./locale.js";
+import { MAX_TTL_MS, TmuxTerminalBackend, WebTerminalSession, } from "./web-terminal.js";
+import { WebTerminalHttpServer } from "./web-terminal-http.js";
+export const LOGIN_TOKEN_RESEND_PREFIX = "login-token:";
+export const DEFAULT_WEB_TERMINAL_TTL_MINUTES = 10;
+/** Design §3.1: a requester may create at most this many sessions per window. */
+export const START_RATE_LIMIT = 3;
+export const START_RATE_WINDOW_MS = 5 * 60_000;
+/**
+ * Describe an error from a secret-bearing operation WITHOUT trusting anything
+ * the error carries (sol B2/B3): message, name and code are all
+ * provider-controlled and any of them may echo the payload (the token). Only
+ * a bounded, errno-like code survives; everything else is a constant.
+ */
+const KNOWN_ERRNO = new Set([
+    "EPIPE", "ECONNRESET", "ECONNREFUSED", "ETIMEDOUT", "ENOTFOUND", "EAI_AGAIN", "ENETUNREACH", "EHOSTUNREACH",
+    "EACCES", "EPERM", "ENOENT", "ECONNABORTED", "ERR_NETWORK", "ABORT_ERR", "ETELEGRAM", "UND_ERR_CONNECT_TIMEOUT",
+]);
+function safeErr(err) {
+    const code = err?.code;
+    if (typeof code === "number" && Number.isFinite(code))
+        return { errorKind: "error", errno: code };
+    // Exact set only — a shape-based allowlist overlaps the token's own shape (sol round 3 B2).
+    if (typeof code === "string" && KNOWN_ERRNO.has(code))
+        return { errorKind: "error", errno: code };
+    return { errorKind: "error" };
+}
+export class LoginController {
+    deps;
+    active = null;
+    /** True between shutdown() and reopen(): no new work is accepted. */
+    stopping = false;
+    /**
+     * Monotonic: incremented by every shutdown(), never rolled back by reopen().
+     * A continuation captures it at start and treats any change as "the world
+     * I started in is gone" — so a stopAll→startAll cannot resurrect old work.
+     */
+    shutdownGeneration = 0;
+    backendFactory = new TmuxTerminalBackend();
+    startTimes = new Map();
+    constructor(deps) {
+        this.deps = deps;
+    }
+    isActive() { return this.active !== null; }
+    get activeBackend() { return this.active?.backend ?? null; }
+    /** Configured mode; web is the default, relay is the 2.1.5-only rollback. */
+    mode() {
+        return this.deps.fleetConfig()?.login?.mode === "relay" ? "relay" : "web";
+    }
+    /**
+     * Start a web-terminal login. Returns a status line, or null when the
+     * confirmation buttons were posted instead (every start is confirmed once;
+     * the button calls back with skipAuthCheck + tokenPresent).
+     */
+    async start(backendArg, chat, opts = {}) {
+        const backend = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
+        const flow = LOGIN_FLOWS[backend];
+        if (!flow)
+            return t("login.unsupported", backendArg);
+        if (flow.remoteLogin === "unsupported") {
+            this.audit("declined_unsupported", { backend, requester: chat.userId ?? null });
+            return t("login.remote_unsupported_agent_cli", backend, flow.command);
+        }
+        if (this.stopping)
+            return t("login.web_shutting_down");
+        const generation = this.shutdownGeneration;
+        // Authorization is decided HERE, not by whoever called us.
+        if (!chat.userId || !this.deps.isFleetAdmin(chat.userId, chat.adapterId)) {
+            this.audit("denied", { backend, requester: chat.userId ?? null, adapterId: chat.adapterId });
+            return t("permission.denied");
+        }
+        const cfg = this.deps.fleetConfig();
+        if (cfg?.web_terminal?.enabled === false)
+            return t("login.web_disabled");
+        if (flow.noShellEscape !== true) {
+            this.audit("flow_not_allowed", { backend, requester: chat.userId });
+            return t("login.web_flow_not_allowed", backend);
+        }
+        if (!this.admitRate(chat.userId)) {
+            this.audit("rate_limited", { backend, requester: chat.userId });
+            return t("login.web_rate_limited", String(START_RATE_LIMIT), String(START_RATE_WINDOW_MS / 60_000));
+        }
+        // Reserve the fleet-wide window NOW, before any await (sol B1). From here
+        // on the claim is owned by this region: every exit releases it unless it
+        // was transferred to a published session (`transferred`), and every
+        // resumption after an await re-checks that the claim is still current —
+        // a fleet shutdown in between must stop us (sol round 2 B1/B2).
+        const claim = this.deps.claimWindow(backend);
+        if (!claim)
+            return this.deps.windowBusyMessage();
+        let transferred = false;
+        try {
+            return await this.startClaimed(flow, backend, chat, opts, cfg, claim, generation, () => { transferred = true; });
+        }
+        finally {
+            if (!transferred)
+                this.deps.releaseWindow(claim);
+        }
+    }
+    /** The fence every continuation applies after an await: stopping, a newer shutdown generation, or a lost claim. */
+    stale(generation, claim) {
+        return this.stopping || this.shutdownGeneration !== generation || (claim !== null && !this.deps.isClaimCurrent(claim));
+    }
+    async startClaimed(flow, backend, chat, opts, cfg, claim, generation, markTransferred) {
+        if (!opts.skipAuthCheck) {
+            // First pass: find out whether the CLI still holds a token, then ask for
+            // the explicit go-ahead (design §3.2). The button re-enters with the
+            // answer; the window is released (by the caller's finally) meanwhile.
+            let tokenPresent = false;
+            if (flow.authCheck)
+                tokenPresent = (await (this.deps.checkAuth ?? checkAuthStatus)(flow.authCheck)) === "valid";
+            if (this.stale(generation, claim))
+                return t("login.web_shutting_down");
+            this.deps.releaseWindow(claim); // nothing runs until the button is pressed
+            const logoutFirst = tokenPresent && flow.preCommand?.when === "token-present";
+            try {
+                await this.deps.postButtons({
+                    prefix: "login-confirm:",
+                    instanceName: backend,
+                    chat,
+                    message: logoutFirst
+                        ? `${t("login.web_confirm", backend)}\n${t("login.still_valid_precommand", backend, flow.preCommand.command)}`
+                        : t("login.web_confirm", backend),
+                    choices: [
+                        { action: tokenPresent ? "go-relogin" : "go", label: t("login.web_confirm_go") },
+                        { action: "cancel", label: t("login.relogin_cancel") },
+                    ],
+                    expiredText: t("buttons.stale"),
+                });
+            }
+            catch (err) {
+                this.deps.logger.warn({ ...safeErr(err), backend }, "Failed to post login confirmation");
+                return t("login.failed", backend, t("login.web_confirm_failed"));
+            }
+            if (this.stale(generation, null)) {
+                // The prompt went out while (or after) we stopped. It cannot be
+                // withdrawn from here; a click on it starts a FRESH start() that runs
+                // every check again (admin, allowlist, rate, claim, generation).
+                this.audit("stale_confirmation", { backend, requester: chat.userId });
+            }
+            return null;
+        }
+        const userId = chat.userId;
+        const command = this.buildCommand(flow, opts.tokenPresent === true);
+        const ttlMs = this.ttlMs(cfg);
+        const spec = {
+            kind: "login",
+            backend,
+            command,
+            cwd: process.env.HOME ?? homedir(),
+            ttlMs,
+            observe: {
+                urlPattern: flow.urlPattern,
+                codePattern: flow.codePattern,
+                successPattern: flow.successPattern,
+                failures: flow.failures,
+            },
+            requester: { adapterId: chat.adapterId, userId, chatId: chat.chatId, threadId: chat.threadId },
+        };
+        const logger = this.deps.logger;
+        const entry = {
+            claim, session: null, http: null, backend, chat,
+            requesterUserId: userId, url: "", tokenDelivered: false, silent: false,
+        };
+        const events = {
+            onHint: (url, code) => this.sendHint(chat, backend, url, code),
+            onDone: async (result) => {
+                this.releaseEntry(entry);
+                if (!entry.silent)
+                    await this.reportDone(chat, backend, result);
+            },
+            onAudit: (event, fields) => this.audit(event.replace(/^web_terminal_/, ""), fields),
+        };
+        // A throwing factory must not leak the claim: the caller's finally covers
+        // it because `markTransferred` is only called once the entry is published.
+        entry.session = (this.deps.createSession ?? ((s, e, l) => new WebTerminalSession(s, e, this.backendFactory, l)))(spec, events, logger);
+        this.active = entry;
+        markTransferred(); // from here the entry owns the claim (onDone/abort/shutdown release it)
+        this.noteStart(userId);
+        try {
+            await entry.session.start();
+            if (this.stale(generation, claim))
+                return this.abort(entry, t("login.web_shutting_down"), "fleet shutdown");
+            const http = (this.deps.createHttp ?? ((s, l, o) => new WebTerminalHttpServer(s, l, o)))(entry.session, logger, {
+                bind: cfg?.web_terminal?.bind,
+                hostname: cfg?.hostname || "localhost",
+            });
+            entry.http = http;
+            entry.url = (await http.listen()).url;
+            if (this.stale(generation, claim))
+                return this.abort(entry, t("login.web_shutting_down"), "fleet shutdown");
+        }
+        catch (err) {
+            return this.abort(entry, t("login.failed", backend, err.message), "startup failed");
+        }
+        // Delivery is part of starting: a link nobody received, or a token that
+        // reached neither the requester nor a resend button, means the session
+        // must not stay open (sol M1). A shutdown landing during any of these
+        // awaits aborts instead of announcing a terminal that no longer exists.
+        if (this.stale(generation, claim))
+            return this.abort(entry, t("login.web_shutting_down"), "fleet shutdown");
+        if (!(await this.sendLink(entry, Math.round(ttlMs / 60_000), command))) {
+            return this.abort(entry, t("login.failed", backend, t("login.web_link_failed")), "link delivery failed");
+        }
+        if (this.stale(generation, claim))
+            return this.abort(entry, t("login.web_shutting_down"), "fleet shutdown");
+        if (!(await this.sendToken(entry, { offerResend: true }))) {
+            return this.abort(entry, t("login.failed", backend, t("login.web_token_failed")), "token delivery failed");
+        }
+        if (this.stale(generation, claim))
+            return this.abort(entry, t("login.web_shutting_down"), "fleet shutdown");
+        return t("login.web_started", backend);
+    }
+    /** `/login cancel` in web mode. */
+    async cancel() {
+        if (!this.active)
+            return t("login.no_session");
+        const backend = this.active.backend;
+        await this.active.session.cancel("cancelled");
+        return t("login.cancelled", backend);
+    }
+    /**
+     * Fleet shutdown: end the active session and wait for the confirmed tmux
+     * kill (sol B3). Pre-active continuations (a start parked in its pre-check)
+     * are fenced by the lock being closed by FleetManager before this call —
+     * they observe !isClaimCurrent and stop without posting or starting.
+     */
+    async shutdown() {
+        this.stopping = true;
+        this.shutdownGeneration++;
+        const entry = this.active;
+        if (!entry)
+            return;
+        entry.silent = true;
+        // No timer race here: cancel() is single-flight and bounded by the
+        // engine's own per-op timeouts (abort → ≤1 more 10 s stage → confirmed
+        // kill ≤31 s). Releasing ownership early would let the fleet exit while
+        // the dedicated tmux server is still being torn down.
+        await entry.session.cancel("fleet shutdown").catch(err => this.deps.logger.warn(safeErr(err), "web login shutdown failed"));
+        await entry.http?.close().catch(() => { });
+        this.releaseEntry(entry);
+    }
+    /** In-process restart after shutdown(): accept work again. */
+    reopen() { this.stopping = false; }
+    /** The "resend token" button: only the requester, only while the token is unredeemed. */
+    async resendToken(requesterUserId) {
+        const entry = this.active;
+        if (!entry)
+            return t("login.no_session");
+        if (!requesterUserId || requesterUserId !== entry.requesterUserId) {
+            this.audit("token_resend_denied", { backend: entry.backend, requester: requesterUserId ?? null });
+            return t("permission.denied");
+        }
+        if (entry.session.peekAccessToken() === null)
+            return t("login.web_token_already_used");
+        const ok = await this.sendToken(entry, { offerResend: false, isResend: true });
+        if (ok)
+            return t("login.web_token_resent");
+        // The one recovery route failed too: do not leave a token-less session
+        // holding the fleet-wide window until TTL (sol M1). Close it now.
+        return this.abort(entry, t("login.web_token_resend_failed", entry.backend), "token resend failed");
+    }
+    // ── Internals ──
+    admitRate(userId) {
+        const now = (this.deps.now ?? Date.now)();
+        const recent = (this.startTimes.get(userId) ?? []).filter(ts => now - ts < START_RATE_WINDOW_MS);
+        this.startTimes.set(userId, recent);
+        return recent.length < START_RATE_LIMIT;
+    }
+    noteStart(userId) {
+        const now = (this.deps.now ?? Date.now)();
+        this.startTimes.set(userId, [...(this.startTimes.get(userId) ?? []), now]);
+    }
+    releaseEntry(entry) {
+        if (this.active === entry)
+            this.active = null; // identity guard: never clear a newer owner
+        this.deps.releaseWindow(entry.claim);
+    }
+    /** Startup/delivery failure: end the session quietly and hand the caller the one report. */
+    async abort(entry, report, detail) {
+        entry.silent = true;
+        if (entry.session.state === "running") {
+            await entry.session.cancel(detail).catch(err => this.deps.logger.warn(safeErr(err), "web login abort failed"));
+        }
+        await entry.http?.close().catch(() => { });
+        this.releaseEntry(entry);
+        this.audit("aborted", { backend: entry.backend, requester: entry.requesterUserId, detail });
+        return report;
+    }
+    buildCommand(flow, tokenPresent) {
+        const pre = flow.preCommand;
+        const runPre = pre && (pre.when === "always" || (pre.when === "token-present" && tokenPresent));
+        return runPre ? `${pre.command}; ${flow.command}` : flow.command;
+    }
+    ttlMs(cfg) {
+        const minutes = cfg?.web_terminal?.ttl_minutes ?? DEFAULT_WEB_TERMINAL_TTL_MINUTES;
+        const clamped = Math.min(Math.max(1, Math.floor(minutes)), MAX_TTL_MS / 60_000);
+        return clamped * 60_000;
+    }
+    /** The link carries no secret: it may go to the requesting chat. Returns delivery success. */
+    async sendLink(entry, ttlMinutes, command) {
+        const { chat } = entry;
+        const text = t("login.web_link", entry.backend, String(ttlMinutes), command, entry.url);
+        try {
+            await chat.adapter.sendText(chat.chatId, text, { threadId: chat.threadId, disablePreview: true });
+            this.audit("link_sent", { backend: entry.backend, requester: entry.requesterUserId, host: hostOf(entry.url) });
+            return true;
+        }
+        catch (err) {
+            this.deps.logger.warn({ ...safeErr(err), backend: entry.backend }, "Failed to deliver web terminal link");
+            this.audit("link_failed", { backend: entry.backend, requester: entry.requesterUserId, ...safeErr(err) });
+            return false;
+        }
+    }
+    /**
+     * The access token goes ONLY to the requester, privately. Never into the
+     * channel: if the private route fails, offer a resend button instead.
+     * Returns true when the token was delivered OR the resend button was posted.
+     */
+    async sendToken(entry, o) {
+        const { chat } = entry;
+        const token = entry.session.peekAccessToken();
+        if (token === null)
+            return true; // already redeemed: nothing to deliver
+        const body = chat.adapter.type === "telegram"
+            ? `${escapeHtml(t("login.web_token", entry.backend))}\n<tg-spoiler>${escapeHtml(token)}</tg-spoiler>`
+            : `${t("login.web_token", entry.backend)}\n\`${token}\``;
+        if (typeof chat.adapter.sendDirect === "function") {
+            try {
+                await chat.adapter.sendDirect(entry.requesterUserId, body, {
+                    format: chat.adapter.type === "telegram" ? "html" : "text",
+                    disablePreview: true,
+                });
+                entry.tokenDelivered = true;
+                this.audit(o.isResend ? "token_resent" : "token_sent", { backend: entry.backend, requester: entry.requesterUserId, via: "dm" });
+                return true;
+            }
+            catch (err) {
+                // Never the message: a provider error may echo the payload (the token).
+                this.deps.logger.warn({ ...safeErr(err), backend: entry.backend }, "web terminal token DM failed");
+            }
+        }
+        entry.tokenDelivered = false;
+        this.audit("token_dm_failed", { backend: entry.backend, requester: entry.requesterUserId });
+        if (!o.offerResend)
+            return false;
+        try {
+            await this.deps.postButtons({
+                prefix: LOGIN_TOKEN_RESEND_PREFIX,
+                instanceName: entry.backend,
+                chat,
+                message: t("login.web_token_dm_failed"),
+                choices: [{ action: "resend", label: t("login.web_resend") }],
+                expiredText: t("buttons.stale"),
+            });
+            return true;
+        }
+        catch (err) {
+            this.deps.logger.warn({ ...safeErr(err), backend: entry.backend }, "Failed to post token resend button");
+            return false;
+        }
+    }
+    /** Device URL (+ code) observed in the pane: same spoiler treatment as before. Errors logged without the message. */
+    async sendHint(chat, backend, url, code) {
+        const codeLine = code ? `\n${t("login.auth_code", code)}` : "";
+        try {
+            if (chat.adapter.type === "telegram") {
+                await chat.adapter.sendText(chat.chatId, `${escapeHtml(t("login.auth_hint", backend))}\n<tg-spoiler>${escapeHtml(url)}${escapeHtml(codeLine)}</tg-spoiler>`, { threadId: chat.threadId, format: "html" });
+            }
+            else {
+                await chat.adapter.sendText(chat.chatId, `${t("login.auth_hint", backend)}\n${url}${codeLine}`, { threadId: chat.threadId });
+            }
+        }
+        catch (err) {
+            this.deps.logger.warn({ ...safeErr(err), backend }, "Failed to deliver login URL");
+        }
+    }
+    async reportDone(chat, backend, result) {
+        let text;
+        if (result.ok) {
+            const { woken, restarted } = await this.deps.recoverBackendInstances(backend);
+            const none = t("login.none");
+            text = t("login.success", backend, woken.length ? woken.join(", ") : none, restarted.length ? restarted.join(", ") : none);
+        }
+        else if (result.reason === "cancel" && result.detail === "cancelled") {
+            text = ""; // the cancel command's own reply already announced this
+        }
+        else {
+            text = t("login.failed", backend, result.detail);
+            if (result.suggest === "relogin")
+                text += `\n${t("login.web_suggest_relogin")}`;
+            else if (result.suggest === "check-args")
+                text += `\n${t("login.web_suggest_check_args")}`;
+        }
+        if (result.cleanupFailed)
+            text += `${text ? "\n" : ""}${t("login.web_cleanup_failed", backend)}`;
+        if (!text)
+            return;
+        await chat.adapter.sendText(chat.chatId, text, { threadId: chat.threadId }).catch(() => { });
+    }
+    audit(event, fields) {
+        try {
+            this.deps.eventLog()?.insert("login", `login_web_${event}`, fields);
+        }
+        catch { /* never break the flow */ }
+    }
+}
+function escapeHtml(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function hostOf(url) {
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return "?";
+    }
+}
+//# sourceMappingURL=login-controller.js.map

package/dist/login-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-controller.js","sourceRoot":"","sources":["../src/login-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,eAAe,EAAwD,MAAM,kBAAkB,CAAC;AAC7I,OAAO,EAAE,CAAC,EAAE,MAAM,aAAa,CAAC;AAEhC,OAAO,EACL,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,GAEpD,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAA+B,MAAM,wBAAwB,CAAC;AAE5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAc,CAAC;AACxD,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AACnD,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,MAAM,CAAC;AA6D/C;;;;;GAKG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc;IAC3G,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,yBAAyB;CAChH,CAAC,CAAC;AACH,SAAS,OAAO,CAAC,GAAY;IAC3B,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;IACtD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClG,4FAA4F;IAC5F,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClG,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,OAAO,eAAe;IAaG;IAZrB,MAAM,GAAuB,IAAI,CAAC;IAC1C,qEAAqE;IAC7D,QAAQ,GAAG,KAAK,CAAC;IACzB;;;;OAIG;IACK,kBAAkB,GAAG,CAAC,CAAC;IACd,cAAc,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAC3C,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE1D,YAA6B,IAAyB;QAAzB,SAAI,GAAJ,IAAI,CAAqB;IAAG,CAAC;IAE1D,QAAQ,KAAc,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;IACpD,IAAI,aAAa,KAAoB,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;IAE3E,6EAA6E;IAC7E,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,IAAe,EAAE,OAA0B,EAAE;QAC3E,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC5F,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;YAChF,OAAO,CAAC,CAAC,oCAAoC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAC3C,2DAA2D;QAC3D,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YAC7F,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,GAAG,EAAE,YAAY,EAAE,OAAO,KAAK,KAAK;YAAE,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,4BAA4B,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC,wBAAwB,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,oBAAoB,GAAG,MAAM,CAAC,CAAC,CAAC;QACtG,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjD,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW;gBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,mHAAmH;IAC3G,KAAK,CAAC,UAAkB,EAAE,KAA8B;QAC9D,OAAO,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,kBAAkB,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACzH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,IAAe,EAAE,OAAe,EAAE,IAAe,EAAE,IAAuB,EAAE,GAAuB,EACnG,KAAuB,EAAE,UAAkB,EAAE,eAA2B;QAExE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,yEAAyE;YACzE,qEAAqE;YACrE,sEAAsE;YACtE,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,IAAI,IAAI,CAAC,SAAS;gBAAE,YAAY,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,OAAO,CAAC;YAChH,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC,yBAAyB,CAAC,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAuB,2CAA2C;YACjG,MAAM,WAAW,GAAG,YAAY,IAAI,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,eAAe,CAAC;YAC9E,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;oBAC1B,MAAM,EAAE,gBAAgB;oBACxB,YAAY,EAAE,OAAO;oBACrB,IAAI;oBACJ,OAAO,EAAE,WAAW;wBAClB,CAAC,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,8BAA8B,EAAE,OAAO,EAAE,IAAI,CAAC,UAAW,CAAC,OAAO,CAAC,EAAE;wBAC/G,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC;oBACnC,OAAO,EAAE;wBACP,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,sBAAsB,CAAC,EAAE;wBAChF,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,sBAAsB,CAAC,EAAE;qBACvD;oBACD,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,mCAAmC,CAAC,CAAC;gBACzF,OAAO,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;gBACjC,gEAAgE;gBAChE,sEAAsE;gBACtE,iEAAiE;gBACjE,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAoB;YAC5B,IAAI,EAAE,OAAO;YACb,OAAO;YACP,OAAO;YACP,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE;YAClC,KAAK;YACL,OAAO,EAAE;gBACP,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB;YACD,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;SAC/F,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAChC,MAAM,KAAK,GAAgB;YACzB,KAAK,EAAE,OAAO,EAAE,IAAqC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;YAChF,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;SACvE,CAAC;QACF,MAAM,MAAM,GAAsB;YAChC,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC;YAC9D,MAAM,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;gBACrB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC;SACpF,CAAC;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACvI,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,eAAe,EAAE,CAAC,CAAsC,wEAAwE;QAChI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEvB,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC5G,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE;gBAC9G,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI;gBAC7B,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,WAAW;aACvC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC;YACtC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC9G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,cAAc,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACjG,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC5G,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC5G,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC5G,OAAO,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QACpC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACpB,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,2BAA2B,CAAC,CAAC,CAAC;QAC5H,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAkC,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,8DAA8D;IAC9D,MAAM,KAAW,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC;IAEzC,yFAAyF;IACzF,KAAK,CAAC,WAAW,CAAC,eAAmC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACzC,IAAI,CAAC,eAAe,IAAI,eAAe,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,IAAI,IAAI,EAAE,CAAC,CAAC;YAClG,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,8BAA8B,CAAC,CAAC;QACvF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,IAAI,EAAE;YAAE,OAAO,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC3C,uEAAuE;QACvE,kEAAkE;QAClE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,+BAA+B,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACrG,CAAC;IAED,kBAAkB;IAEV,SAAS,CAAC,MAAc;QAC9B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,oBAAoB,CAAC,CAAC;QACjG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC,MAAM,GAAG,gBAAgB,CAAC;IAC1C,CAAC;IAEO,SAAS,CAAC,MAAc;QAC9B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC;IAEO,YAAY,CAAC,KAAkB;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAU,4CAA4C;QACpG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,4FAA4F;IACpF,KAAK,CAAC,KAAK,CAAC,KAAkB,EAAE,MAAc,EAAE,MAAc;QACpE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAA0B,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5F,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,YAAY,CAAC,IAAe,EAAE,YAAqB;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,YAAY,CAAC,CAAC,CAAC;QAChG,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,GAAuB;QACnC,MAAM,OAAO,GAAG,GAAG,EAAE,YAAY,EAAE,WAAW,IAAI,gCAAgC,CAAC;QACnF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC;QAChF,OAAO,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,8FAA8F;IACtF,KAAK,CAAC,QAAQ,CAAC,KAAkB,EAAE,UAAkB,EAAE,OAAe;QAC5E,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACxF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YAClG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/G,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,qCAAqC,CAAC,CAAC;YAC1G,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzG,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,SAAS,CAAC,KAAkB,EAAE,CAA+C;QACzF,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAA0B,uCAAuC;QACjG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;YAC3C,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,iBAAiB,UAAU,CAAC,KAAK,CAAC,eAAe;YACrG,CAAC,CAAC,GAAG,CAAC,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC;QAC3D,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE;oBACzD,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;oBAC1D,cAAc,EAAE,IAAI;iBACrB,CAAC,CAAC;gBACH,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChI,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;QACD,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,CAAC,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC1B,MAAM,EAAE,yBAAyB;gBACjC,YAAY,EAAE,KAAK,CAAC,OAAO;gBAC3B,IAAI;gBACJ,OAAO,EAAE,CAAC,CAAC,2BAA2B,CAAC;gBACvC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC7D,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC;aAChC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,oCAAoC,CAAC,CAAC;YACzG,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,qHAAqH;IAC7G,KAAK,CAAC,QAAQ,CAAC,IAAe,EAAE,OAAe,EAAE,GAAW,EAAE,IAAmB;QACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EACrC,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,iBAAiB,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,eAAe,EAClH,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,iBAAiB,EAAE,OAAO,CAAC,KAAK,GAAG,GAAG,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/H,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,6BAA6B,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAe,EAAE,OAAe,EAAE,MAAyB;QAClF,IAAI,IAAY,CAAC;QACjB,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YAC7B,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7H,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACvE,IAAI,GAAG,EAAE,CAAC,CAA8C,wDAAwD;QAClH,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;gBAAE,IAAI,IAAI,KAAK,CAAC,CAAC,2BAA2B,CAAC,EAAE,CAAC;iBAC3E,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY;gBAAE,IAAI,IAAI,KAAK,CAAC,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAC7F,CAAC;QACD,IAAI,MAAM,CAAC,aAAa;YAAE,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,0BAA0B,EAAE,OAAO,CAAC,EAAE,CAAC;QACjG,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAmB,CAAC,CAAC,CAAC;IAC/G,CAAC;IAEO,KAAK,CAAC,KAAa,EAAE,MAA+B;QAC1D,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,aAAa,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACnH,CAAC;CACF;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC;QAAC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,CAAC;IAAC,CAAC;AACzD,CAAC"}

package/dist/login-flows.d.ts

@@ -4,9 +4,18 @@
  * Every command, menu label, prompt, and success string here was verified
  * against the installed CLI (`--help` output or strings extracted from the
  * release binary) rather than written from memory:
- *   - codex:  `codex login --device-auth`, success "Successfully logged in"
- *   - grok:   `grok login --device-auth`, success "Login successful!"
- *   - kiro:   `kiro-cli login --use-device-flow`; free/pro selector is the
+ *   - codex:  `codex login --device-auth`, success "Successfully logged in".
+ *             The flag is KEPT on purpose (live-verified codex 0.153.4,
+ *             headless): plain `codex login` starts a callback server on the
+ *             HOST's localhost:1455 and waits for a browser redirect the
+ *             admin's browser can never deliver; codex itself prints "On a
+ *             remote or headless machine? Use `codex login --device-auth`".
+ *             The flag is hidden from `--help` but still accepted.
+ *   - grok:   `grok login` — plain login already IS device-code on grok 1.0.5
+ *             (identical output to `--device-auth`), success "Login successful!"
+ *   - kiro:   `kiro-cli login` (plain, per user request): shows the four-way
+ *             selector incl. "Your Organization"; Identity Center is device-code
+ *             regardless of `--use-device-flow` (live-verified 2.21.1). The
  *             arrow-key menu "Select login method" with exactly the four
  *             options below; Identity Center then asks "Enter Start URL" /
  *             "Enter Region"; success "Logged in successfully"/"Logged in with"
@@ -57,6 +66,35 @@ export interface LoginFlow {
     successPattern: RegExp;
     /** Hard cap for the whole login session. */
     timeoutMs: number;
+    /**
+     * Deterministic shell command run in the same window right before `command`
+     * (`pre; command`). `token-present`: only when the auth pre-check said the
+     * CLI still holds a token and the admin confirmed a re-login — kiro refuses
+     * `login` outright while any token record exists (live-verified 2.21.1).
+     */
+    preCommand?: {
+        command: string;
+        when: "always" | "token-present";
+    };
+    /** Known failure strings in the dead pane → human wording + suggested next step (web mode). */
+    failures?: Array<{
+        pattern: RegExp;
+        message: string;
+        suggest?: "relogin" | "check-args" | "retry";
+    }>;
+    /**
+     * Explicit allowlist for the web terminal (design §2.3/§3): set only after a
+     * human reviewed that this CLI's login TUI offers no shell escape. A flow
+     * without it never gets a browser terminal — the scope guarantee "one
+     * command, no shell" depends on it.
+     */
+    noShellEscape?: true;
+    /**
+     * Remote /login is declined outright for this backend (every mode), with a
+     * user-facing reason. Kept in LOGIN_FLOWS only for authCheck /
+     * loginScreenPattern, which the daemon still uses.
+     */
+    remoteLogin?: "unsupported";
 }
 /**
  * Cheap auth probes for backends that do not have an AgEnD-managed /login

package/dist/login-flows.js

@@ -4,9 +4,18 @@
  * Every command, menu label, prompt, and success string here was verified
  * against the installed CLI (`--help` output or strings extracted from the
  * release binary) rather than written from memory:
- *   - codex:  `codex login --device-auth`, success "Successfully logged in"
- *   - grok:   `grok login --device-auth`, success "Login successful!"
- *   - kiro:   `kiro-cli login --use-device-flow`; free/pro selector is the
+ *   - codex:  `codex login --device-auth`, success "Successfully logged in".
+ *             The flag is KEPT on purpose (live-verified codex 0.153.4,
+ *             headless): plain `codex login` starts a callback server on the
+ *             HOST's localhost:1455 and waits for a browser redirect the
+ *             admin's browser can never deliver; codex itself prints "On a
+ *             remote or headless machine? Use `codex login --device-auth`".
+ *             The flag is hidden from `--help` but still accepted.
+ *   - grok:   `grok login` — plain login already IS device-code on grok 1.0.5
+ *             (identical output to `--device-auth`), success "Login successful!"
+ *   - kiro:   `kiro-cli login` (plain, per user request): shows the four-way
+ *             selector incl. "Your Organization"; Identity Center is device-code
+ *             regardless of `--use-device-flow` (live-verified 2.21.1). The
  *             arrow-key menu "Select login method" with exactly the four
  *             options below; Identity Center then asks "Enter Start URL" /
  *             "Enter Region"; success "Logged in successfully"/"Logged in with"
@@ -43,7 +52,10 @@ const GENERIC_URL = /https:\/\/[^\s"'<>\])]+/;
 const STANDALONE_DEVICE_CODE = /^\s*([A-Z0-9]{4,10}-[A-Z0-9]{4,10})\s*$/m;
 export const LOGIN_FLOWS = {
     "codex": {
+        noShellEscape: true, // login TUI reviewed: menu/prompts/device code only, no shell
         backend: "codex",
+        // Keep --device-auth: plain login needs a browser redirect to THIS host's
+        // localhost:1455, which a remote admin's browser cannot deliver (see header).
         command: "codex login --device-auth",
         authCheck: { argv: ["codex", "login", "status"] },
         loginScreenPattern: /Sign in with ChatGPT/,
@@ -52,8 +64,9 @@ export const LOGIN_FLOWS = {
         timeoutMs: LOGIN_TIMEOUT_MS,
     },
     "grok": {
+        noShellEscape: true, // login TUI reviewed: menu/prompts/device code only, no shell
         backend: "grok",
-        command: "grok login --device-auth",
+        command: "grok login",
         authCheck: { argv: ["grok", "models"] },
         loginScreenPattern: /Run `grok login`/,
         // Binary template is "enter code: $CODE"; the standalone form is a fallback.
@@ -62,8 +75,9 @@ export const LOGIN_FLOWS = {
         timeoutMs: LOGIN_TIMEOUT_MS,
     },
     "kiro-cli": {
+        noShellEscape: true, // login TUI reviewed: menu/prompts/device code only, no shell
         backend: "kiro-cli",
-        command: "kiro-cli login --use-device-flow",
+        command: "kiro-cli login",
         authCheck: { argv: ["kiro-cli", "whoami", "--format", "json"] },
         loginScreenPattern: /Select login method/,
         menu: {
@@ -76,8 +90,18 @@ export const LOGIN_FLOWS = {
         codePattern: /Code:\s*([A-Z0-9][A-Z0-9-]{3,})/,
         successPattern: /Logged in successfully|Logged in with /,
         timeoutMs: LOGIN_TIMEOUT_MS,
+        // kiro-cli 2.21.1 (live-verified): any stored token record — even an
+        // expired one with a refresh token — makes `login` exit 1 with "Already
+        // logged in"; only `logout` clears it. The saved Identity Center start
+        // URL/region survive logout and pre-fill the prompts in the terminal.
+        preCommand: { command: "kiro-cli logout", when: "token-present" },
+        failures: [
+            { pattern: /Already logged in, please logout/, message: "kiro-cli still holds a token — use Re-login (it logs out first)", suggest: "relogin" },
+            { pattern: /error: dispatch failure/, message: "Identity Center rejected the request — check the Start URL and Region", suggest: "check-args" },
+        ],
     },
     "claude-code": {
+        noShellEscape: true, // login TUI reviewed: menu/prompts/device code only, no shell
         backend: "claude-code",
         command: "claude auth login",
         authCheck: { argv: ["claude", "auth", "status"], validPattern: /"loggedIn":\s*true/ },
@@ -87,6 +111,14 @@ export const LOGIN_FLOWS = {
         timeoutMs: LOGIN_TIMEOUT_MS,
     },
     "antigravity": {
+        // Remote login is UNSUPPORTED (user decision, v2.1.5): bare `agy` is the
+        // full agent CLI (tools, permission prompts, MCP) and has no isolated
+        // login sub-command — "logging in" means running the whole agent, which
+        // violates the web terminal's "one login command, no shell" boundary.
+        // /login agy is declined in every mode (no relay fallback) until upstream
+        // ships a dedicated login command. authCheck / loginScreenPattern stay for
+        // the daemon's own use.
+        remoteLogin: "unsupported",
         backend: "antigravity",
         command: "agy",
         authCheck: { argv: ["agy", "models"] },