@songsid/agend 2.3.0 → 2.3.2-beta.1

package/dist/session-oom.js

@@ -2,6 +2,32 @@
 import { execFile } from "./child-process.js";
 import { readFile, readlink } from "node:fs/promises";
 import { basename } from "node:path";
+import { t } from "./locale.js";
+/** Positive dominance proof only. A selected victim is not necessarily the allocator. */
+function validOomEvidence(value) {
+    const e = value;
+    if (!e || e.policy !== 2 || e.scope !== "global"
+        || ![e.ramPages, e.victimRssPages, e.victimAnonKiB, e.victimTotalRssKiB, e.largestOtherRssPages]
+            .every(n => Number.isSafeInteger(n) && n >= 0)
+        || !e.ramPages || !e.victimRssPages || !e.victimTotalRssKiB
+        || e.victimRssPages > e.ramPages || e.victimAnonKiB > e.victimTotalRssKiB)
+        return false;
+    const pageKiB = e.victimTotalRssKiB / e.victimRssPages;
+    return [4, 16, 64].some(unit => Math.abs(pageKiB - unit) <= unit * 0.05);
+}
+export function selfOomEvidence(value) {
+    if (!validOomEvidence(value))
+        return false;
+    const e = value;
+    // Both table and RAM use pages. Scaling by the kill-line anonymous fraction
+    // avoids assuming 4-KiB pages on arm64, or mistaking file RSS for anon RSS.
+    const anonPages = e.victimRssPages * (e.victimAnonKiB / e.victimTotalRssKiB);
+    return anonPages >= e.ramPages / 2 && anonPages >= 2 * e.largestOtherRssPages;
+}
+export function describeSelfOom(e) {
+    const anonPages = e.victimRssPages * (e.victimAnonKiB / e.victimTotalRssKiB);
+    return t("inst.session_oom_proof", Math.floor(100 * anonPages / e.ramPages), e.largestOtherRssPages ? (anonPages / e.largestOtherRssPages).toFixed(1) : "∞");
+}
 const MAX_PROC_BYTES = 16_384;
 const LAUNCHERS = new Set(["bash", "dash", "sh", "zsh", "fish", "env", "busybox"]);
 async function text(path) {
@@ -76,19 +102,102 @@ export async function observeCliOomIdentity(panePid, binaryName, proc = "/proc")
 }
 export function parseKernelOoms(output) {
     const records = [];
+    let beganAt = 0, ramPages = 0, table = false, header = null, invalid = false;
+    let tasks = new Map();
+    let context = "";
+    const reset = () => { beganAt = ramPages = 0; table = invalid = false; header = null; tasks = new Map(); context = ""; };
     for (const line of output.split("\n")) {
         if (!line.trim())
             continue;
         try {
             const row = JSON.parse(line);
-            if (row._TRANSPORT !== "kernel" || typeof row.MESSAGE !== "string")
+            if (row._TRANSPORT !== "kernel")
+                continue;
+            if (typeof row.MESSAGE !== "string") {
+                invalid = true;
                 continue;
-            const victim = /(?:Out of memory|Memory cgroup out of memory): Killed process (\d+) \(([^)]+)\)/.exec(row.MESSAGE);
+            }
             const at = Number(row.__REALTIME_TIMESTAMP) / 1000;
-            if (victim && Number.isFinite(at) && at > 0)
-                records.push({ pid: Number(victim[1]), comm: victim[2], at });
+            if (!Number.isFinite(at) || at <= 0) {
+                reset();
+                continue;
+            }
+            const msg = row.MESSAGE;
+            if (msg.includes("invoked oom-killer:")) {
+                reset();
+                beganAt = at;
+            }
+            const ram = /^\s*(\d+) pages RAM\s*$/.exec(msg);
+            if (ram) {
+                if (ramPages && ramPages !== Number(ram[1]))
+                    invalid = true;
+                ramPages = Number(ram[1]);
+            }
+            if (msg === "Tasks state (memory values in pages):") {
+                if (table)
+                    invalid = true;
+                table = true;
+            }
+            // Linux 6.8 added per-kind RSS columns. Match the declared layout before
+            // reading rows; unknown/reordered columns must not hide a larger task.
+            if (/^\[\s*pid\s*\]/.test(msg)) {
+                const columns = /^\[\s*pid\s*\]\s+uid\s+tgid\s+total_vm\s+rss\s+(rss_anon\s+rss_file\s+rss_shmem\s+)?pgtables_bytes\s+swapents\s+oom_score_adj\s+name\s*$/.exec(msg);
+                if (!table || header || !columns)
+                    invalid = true;
+                else
+                    header = columns[1] ? "rss-columns" : "legacy";
+            }
+            if (table && /^\[\s*\d/.test(msg)) {
+                // comm is the rest of the line, not a word (e.g. "tmux: server").
+                const task = (header === "rss-columns"
+                    ? /^\[\s*(\d+)\]\s+\d+\s+\d+\s+\d+\s+(\d+)\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+-?\d+\s+(.+?)\s*$/
+                    : /^\[\s*(\d+)\]\s+\d+\s+\d+\s+\d+\s+(\d+)\s+\d+\s+\d+\s+-?\d+\s+(.+?)\s*$/).exec(msg);
+                if (!header || !task)
+                    invalid = true;
+                else {
+                    const pid = Number(task[1]), rss = Number(task[2]), comm = task[3];
+                    const old = tasks.get(pid);
+                    if (old && (old.rss !== rss || old.comm !== comm))
+                        invalid = true;
+                    if (!Number.isSafeInteger(rss) || (!old && tasks.size >= 4096))
+                        invalid = true;
+                    else
+                        tasks.set(pid, { rss, comm });
+                }
+            }
+            if (msg.startsWith("oom-kill:")) {
+                if (context)
+                    invalid = true;
+                context = msg;
+            }
+            const victim = /^(Out of memory|Memory cgroup out of memory): Killed process (\d+) \(([^)]+)\)/.exec(msg);
+            if (!victim)
+                continue;
+            const pid = Number(victim[2]), comm = victim[3];
+            const record = { pid, comm, at, attribution: "unknown" };
+            const own = tasks.get(pid);
+            const rss = /anon-rss:(\d+)kB, file-rss:(\d+)kB, shmem-rss:(\d+)kB/.exec(msg);
+            // Only one complete, unconstrained report. Shared fleet/container memcg
+            // exhaustion cannot identify an individual instance as the cause.
+            if (beganAt && at >= beganAt && at - beganAt <= 10_000 && !invalid && ramPages && table && header && own?.comm === comm && rss
+                && context.startsWith("oom-kill:constraint=CONSTRAINT_NONE,") && context.includes(",global_oom,")
+                && context.includes(`,task=${comm},pid=${pid},`) && victim[1] === "Out of memory") {
+                const evidence = { policy: 2, scope: "global", ramPages, victimRssPages: own.rss,
+                    victimAnonKiB: Number(rss[1]), victimTotalRssKiB: Number(rss[1]) + Number(rss[2]) + Number(rss[3]),
+                    largestOtherRssPages: Math.max(0, ...[...tasks].filter(([other]) => other !== pid).map(([, task]) => task.rss)) };
+                if (validOomEvidence(evidence) && evidence.largestOtherRssPages >= 2 * own.rss)
+                    record.attribution = "collateral";
+                if (selfOomEvidence(evidence)) {
+                    record.attribution = "self";
+                    record.evidence = evidence;
+                }
+            }
+            records.push(record);
+            reset();
+        }
+        catch {
+            invalid = true; /* a lost task row may hide the actual hog */
         }
-        catch { /* unreadable or incomplete evidence is not proof */ }
     }
     return records;
 }
@@ -98,9 +207,12 @@ function recentKernelOoms() {
     if (pending)
         return pending;
     pending = new Promise(resolve => {
+        // Project away optional machine/host metadata (journal cursors stay).
+        // Leave room for all 4096 task rows
+        // plus the report's stack/Mem-Info and other recent kernel messages.
         try {
-            execFile("journalctl", ["--kernel", "--boot=0", "--since=-5min", "--no-pager", "--output=json", "--lines=256",
-                "--grep=(Out of memory|Memory cgroup out of memory): Killed process"], { encoding: "utf8", timeout: 1000, maxBuffer: 256 * 1024, killSignal: "SIGKILL" }, (error, stdout) => resolve(error ? null : parseKernelOoms(stdout)));
+            execFile("journalctl", ["--kernel", "--boot=0", "--since=-5min", "--no-pager", "--output=json",
+                "--output-fields=MESSAGE,_TRANSPORT,__REALTIME_TIMESTAMP", "--lines=8192"], { encoding: "utf8", timeout: 1000, maxBuffer: 8 * 1024 * 1024, killSignal: "SIGKILL" }, (error, stdout) => resolve(error ? null : parseKernelOoms(stdout)));
         }
         catch {
             resolve(null);

package/dist/session-oom.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-oom.js","sourceRoot":"","sources":["../src/session-oom.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAIrC,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AACnF,KAAK,UAAU,IAAI,CAAC,IAAY;IAC9B,IAAI,CAAC;QAAC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAClI,CAAC;AACD,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,OAAO,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAI,GAAG,OAAO;IAC7F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChG,IAAI,GAAG,GAAG,OAAO,EAAE,MAAM,GAAkB,IAAI,CAAC;IAChD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,SAAS,CAAC,CAAC;QACnD,2EAA2E;QAC3E,MAAM,EAAE,GAAG,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,CAAC;YAAC,IAAI,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,GAAG,SAAS,CAAC,KAAK,kBAAkB;gBAAE,OAAO,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YAAC,UAAU,GAAG,QAAQ,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC1H,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3G,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,SAAS,GAAG,WAAW,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC;QAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAAE,SAAS;YAC7E,MAAM,MAAM,GAAG,iFAAiF,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnH,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;YACnD,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;QAAC,MAAM,CAAC,CAAC,oDAAoD,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI,OAAO,GAAuC,IAAI,CAAC;AACvD,4FAA4F;AAC5F,SAAS,gBAAgB;IACvB,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,GAAG,IAAI,OAAO,CAAqB,OAAO,CAAC,EAAE;QAClD,IAAI,CAAC;YAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa;gBACjH,oEAAoE,CAAC,EACvE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EACjF,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QACtE,MAAM,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IAC1B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAwB,EAAE,IAAY;IAClE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,MAAM,IAAI,cAAc,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,0EAA0E;QAC1E,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAA+B,EAAE,MAAc,EAAE,IAAI,GAAG,OAAO;IACnG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,IAAI,MAAM,GAAG,QAAQ,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;WAC7E,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC;AAClE,CAAC;AAGD,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,QAAgC,EAAE,GAAkB,EAAE,SAAkB;IAC7G,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC"}
+{"version":3,"file":"session-oom.js","sourceRoot":"","sources":["../src/session-oom.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,CAAC,EAAE,MAAM,aAAa,CAAC;AAahC,yFAAyF;AACzF,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,CAAC,GAAG,KAA+B,CAAC;IAC1C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;WAC3C,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,oBAAoB,CAAC;aAC7F,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;WAC7C,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,iBAAiB;WACxD,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAC1F,MAAM,OAAO,GAAG,CAAC,CAAC,iBAAiB,GAAG,CAAC,CAAC,cAAc,CAAC;IACvD,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC;AAC3E,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC;IAChB,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,SAAS,GAAG,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7E,OAAO,SAAS,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC;AAChF,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,CAAkB;IAChD,MAAM,SAAS,GAAG,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7E,OAAO,CAAC,CAAC,wBAAwB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC/J,CAAC;AACD,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AACnF,KAAK,UAAU,IAAI,CAAC,IAAY;IAC9B,IAAI,CAAC;QAAC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAClI,CAAC;AACD,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,OAAO,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAI,GAAG,OAAO;IAC7F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChG,IAAI,GAAG,GAAG,OAAO,EAAE,MAAM,GAAkB,IAAI,CAAC;IAChD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,SAAS,CAAC,CAAC;QACnD,2EAA2E;QAC3E,MAAM,EAAE,GAAG,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,CAAC;YAAC,IAAI,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,GAAG,SAAS,CAAC,KAAK,kBAAkB;gBAAE,OAAO,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YAAC,UAAU,GAAG,QAAQ,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC1H,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3G,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,SAAS,GAAG,WAAW,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC;QAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,MAAM,GAAoC,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IAC9G,IAAI,KAAK,GAAG,IAAI,GAAG,EAAyC,CAAC;IAC7D,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,OAAO,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACzH,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,GAAG,CAAC,UAAU,KAAK,QAAQ;gBAAE,SAAS;YAC1C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,SAAS;YAAC,CAAC;YAClE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAAC,KAAK,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC3D,MAAM,GAAG,GAAW,GAAG,CAAC,OAAO,CAAC;YAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAAC,KAAK,EAAE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;YAAC,CAAC;YACnE,MAAM,GAAG,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,GAAG,EAAE,CAAC;gBAAC,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAAE,OAAO,GAAG,IAAI,CAAC;gBAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YACpG,IAAI,GAAG,KAAK,uCAAuC,EAAE,CAAC;gBAAC,IAAI,KAAK;oBAAE,OAAO,GAAG,IAAI,CAAC;gBAAC,KAAK,GAAG,IAAI,CAAC;YAAC,CAAC;YACjG,yEAAyE;YACzE,uEAAuE;YACvE,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,0IAA0I,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrK,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,CAAC,OAAO;oBAAE,OAAO,GAAG,IAAI,CAAC;;oBAC5C,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtD,CAAC;YACD,IAAI,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,kEAAkE;gBAClE,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa;oBACpC,CAAC,CAAC,2FAA2F;oBAC7F,CAAC,CAAC,yEAAyE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;oBAAE,OAAO,GAAG,IAAI,CAAC;qBAChC,CAAC;oBACJ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;oBACpE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC3B,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;wBAAE,OAAO,GAAG,IAAI,CAAC;oBAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;wBAAE,OAAO,GAAG,IAAI,CAAC;;wBAC1E,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAAC,IAAI,OAAO;oBAAE,OAAO,GAAG,IAAI,CAAC;gBAAC,OAAO,GAAG,GAAG,CAAC;YAAC,CAAC;YAChF,MAAM,MAAM,GAAG,gFAAgF,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1G,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACjD,MAAM,MAAM,GAAc,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;YACpE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,uDAAuD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9E,wEAAwE;YACxE,kEAAkE;YAClE,IAAI,OAAO,IAAI,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,OAAO,IAAI,MAAM,IAAI,CAAC,OAAO,IAAI,QAAQ,IAAI,KAAK,IAAI,MAAM,IAAI,GAAG,EAAE,IAAI,KAAK,IAAI,IAAI,GAAG;mBACzH,OAAO,CAAC,UAAU,CAAC,sCAAsC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;mBAC9F,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,QAAQ,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;gBACpF,MAAM,QAAQ,GAAoB,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,GAAG;oBAC/F,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAClG,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACpH,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,oBAAoB,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG;oBAAE,MAAM,CAAC,WAAW,GAAG,YAAY,CAAC;gBAClH,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAAC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC;oBAAC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBAAC,CAAC;YAC7F,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,CAAC,6CAA6C;QAAC,CAAC;IAC3E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI,OAAO,GAAuC,IAAI,CAAC;AACvD,4FAA4F;AAC5F,SAAS,gBAAgB;IACvB,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,GAAG,IAAI,OAAO,CAAqB,OAAO,CAAC,EAAE;QAClD,sEAAsE;QACtE,oCAAoC;QACpC,qEAAqE;QACrE,IAAI,CAAC;YAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe;gBAClG,yDAAyD,EAAE,cAAc,CAAC,EAC5E,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EACtF,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QACtE,MAAM,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IAC1B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAwB,EAAE,IAAY;IAClE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,MAAM,IAAI,cAAc,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,0EAA0E;QAC1E,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAA+B,EAAE,MAAc,EAAE,IAAI,GAAG,OAAO;IACnG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,IAAI,MAAM,GAAG,QAAQ,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;WAC7E,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC;AAClE,CAAC;AAGD,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,QAAgC,EAAE,GAAkB,EAAE,SAAkB;IAC7G,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC"}

package/dist/settings-api.d.ts

@@ -49,6 +49,27 @@ export interface SettingsApiContext extends AppShellContext {
         count: number;
         durable: boolean;
     };
+    /** #2348 delta §5: one audit entry per person whose granted agents changed with a save (event log, the Log tab). */
+    noteGuestGrantChange?(change: {
+        by: string | null;
+        via: "direct" | "confirmed";
+        account: string;
+        added: string[];
+        removed: string[];
+        endedSessions: number;
+    }): void;
+    /** #2348: the people AgEnD has seen in chat (the Guests picker), never a fleet admin or a bot. */
+    guestPeople?(): unknown;
+    /** #2348: why an account may not be granted (not seen in chat, a fleet admin, an unknown connection), or null. */
+    guestGrantRefusal?(adapterId: string, userId: string): string | null;
+    /** #2348: an admin's "Send sign-in code": DM only; the outcome as the Settings card shows it. */
+    sendGuestCodeByAdmin?(owner: {
+        adapterId: string;
+        userId: string;
+    }, by: string, current?: () => boolean): Promise<{
+        status: number;
+        body: Record<string, unknown>;
+    }>;
     /** #1939 S2a: Settings → Web → Web authority — what is in force, the actions to pick from, and the revocation. */
     webAuthorityOverview?(): unknown;
     revokeWebAuthority?(): {
@@ -75,7 +96,7 @@ export interface SettingsApiContext extends AppShellContext {
      *  and team places dropped, its fleet.yaml entry removed. Absent in unit contexts that only exercise CRUD. */
     removeInstance?(name: string, authorization: ExplicitInstanceRemoval, execution?: SettingsExecution): Promise<void>;
     /** Phase 2b: an operator wake that respects the warm hard cap (FleetManager.explicitWake). */
-    explicitWake?(name: string, timeoutMs?: number): Promise<void>;
+    explicitWake?(name: string, timeoutMs?: number, retryStoppedSession?: boolean): Promise<void>;
     restartClassicInstanceFromSettings?(instanceName: string, changedFields?: string[], execution?: SettingsExecution): Promise<void>;
     captureClassicSettingsRestoration?(instanceName: string, changedFields: string[], execution?: SettingsExecution): () => Promise<void>;
     /** Present on a real fleet; absent in unit contexts that only exercise CRUD. */
@@ -90,6 +111,11 @@ export interface SettingsApiContext extends AppShellContext {
     /** Non-null when the running config and fleet.yaml disagree on a
      * startup-only key, in which case a restart cannot clear the fleet row. */
     fleetSignatureMismatchKeys?(): string[] | null;
+    /** #2347: saved changes waiting for an AgEnD restart, and the apply job a restart can be asked for. */
+    settingsRestartPending?(): {
+        keys: string[];
+        job_id: string | null;
+    } | null;
     /** #2346: whether a connection added now starts at once (another one is running), or needs AgEnD restarted. */
     connectionsStartLive?(): boolean;
     /** #1005/#1021: a Discord connection's server emojis, from each server its

package/dist/settings-api.js

@@ -1,7 +1,7 @@
 import { PUBLIC_TUNNEL_SECRET_ID, PUBLIC_TUNNEL_TOKEN_HINT } from "./public-tunnel-config.js";
 import { withSpawnHoldReply } from "./spawn-hold-reply.js";
 import { normalizeSettingsInstancePatch, removesInstanceOverride } from "./settings-instance-patch.js";
-import { settingsRequestExecution, settingsRequestLocalAdmin, settingsWrite } from "./settings-request-capability.js";
+import { isSettingsReplay, settingsRequestExecution, settingsRequestLocalAdmin, settingsWrite } from "./settings-request-capability.js";
 import { noteSettingsWrite, settingsUndo, undoSettingsPaths } from "./settings-transaction.js";
 import { readBoundedWebBody } from "./web-body.js";
 import { gatewayRequestContext } from "./web-request-context.js";
@@ -210,6 +210,12 @@ export function handleSettingsRequest(req, res, url, ctx) {
         });
         return true;
     }
+    // #2347: what the app-wide "Restart now" banner reads — small, so every page can ask after a Save settles.
+    if (method === "GET" && path === "/api/settings/restart-pending") {
+        const pending = ctx.settingsRestartPending?.() ?? null;
+        json(res, 200, pending ? { pending: true, keys: pending.keys, job_id: pending.job_id } : { pending: false });
+        return true;
+    }
     if (method === "GET" && path === "/api/settings/fleet") {
         json(res, 200, redactInlineSecrets(ctx.fleetConfig ?? {}));
         return true;
@@ -703,7 +709,7 @@ export function handleSettingsRequest(req, res, url, ctx) {
         let held = false;
         const operation = withSpawnHoldReply(async (message) => { held = true; json(res, 202, { ok: true, held: true, message, name }); }, () => action === "pause"
             ? ctx.lifecycle.pause(name)
-            : ctx.explicitWake ? ctx.explicitWake(name, 30_000) : ctx.lifecycle.wake(name, 30_000));
+            : ctx.explicitWake ? ctx.explicitWake(name, 30_000, true) : ctx.lifecycle.wake(name, 30_000));
         operation.then(() => { if (!held)
             json(res, 200, { ok: true, name, status: action === "pause" ? "paused" : "running" }); })
             .catch(err => { if (!held)
@@ -727,6 +733,60 @@ export function handleSettingsRequest(req, res, url, ctx) {
         json(res, 200, ctx.guestOverview());
         return true;
     }
+    // #2348: the picker's people (GET) and an admin's "Send sign-in code" (POST: a DM to an applied grant's account, once
+    // a minute per account — a code is not a settings change: the grant it needs was already confirmed). Never over the
+    // public link; the caller asked again after the body, as the sign-out below.
+    if (path === "/api/settings/guests/people" && method === "GET") {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "guest_settings_not_over_public_link" });
+            return true;
+        }
+        if (!ctx.guestPeople) {
+            json(res, 404, { error: "not available" });
+            return true;
+        }
+        if (!guestSettingsCaller(req, url, ctx)) {
+            json(res, 401, { error: "not authorized" });
+            return true;
+        }
+        res.setHeader("Cache-Control", "no-store");
+        json(res, 200, ctx.guestPeople());
+        return true;
+    }
+    if (path === "/api/settings/guests/send-code" && method === "POST") {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "guest_settings_not_over_public_link" });
+            return true;
+        }
+        if (!ctx.sendGuestCodeByAdmin) {
+            json(res, 404, { error: "not available" });
+            return true;
+        }
+        const caller = guestSettingsCaller(req, url, ctx);
+        if (!caller) {
+            json(res, 401, { error: "not authorized" });
+            return true;
+        }
+        readBody(req, 4096).then(async (buf) => {
+            if (!permitWebContinuation(req, res, ctx))
+                return;
+            if (guestSettingsCaller(req, url, ctx) !== caller)
+                return json(res, 401, { error: "no longer authorized" });
+            let body;
+            try {
+                body = JSON.parse(buf.toString("utf-8"));
+            }
+            catch {
+                return json(res, 400, { error: "invalid JSON" });
+            }
+            if (typeof body?.adapterId !== "string" || !body.adapterId || typeof body.userId !== "string" || !body.userId)
+                return json(res, 400, { error: "adapterId and userId required" });
+            // #2365 review: the initiating admin's session, asked again after every wait inside the issuance.
+            const out = await ctx.sendGuestCodeByAdmin({ adapterId: body.adapterId, userId: body.userId }, caller, () => guestSettingsCaller(req, url, ctx) === caller);
+            json(res, out.status, out.body);
+        }).catch(() => json(res, 400, { error: "bad request" }));
+        return true;
+    }
     if (path === "/api/settings/guests/revoke" && method === "POST") {
         if (gatewayRequestContext(req)) {
             json(res, 403, { error: "guest_settings_not_over_public_link" });
@@ -835,6 +895,9 @@ export function handleSettingsRequest(req, res, url, ctx) {
                 }
             }
             const { session: sessionPatch, terminal: terminalPatch } = parsed;
+            // #2499 review: who is saving, asked now, before the save — a session policy saved with it can end this very session
+            // (a shorter sign-in time), and the audit must still name who did it. A confirmation's replay is no one's: null.
+            const auditBy = parsed.guests?.grants !== undefined && !isSettingsReplay(req) ? guestSettingsCaller(req, url, ctx) : null;
             const changes = [];
             const web = { ...cfg.web };
             let webTerminal = cfg.web_terminal;
@@ -890,6 +953,16 @@ export function handleSettingsRequest(req, res, url, ctx) {
             }
             // #1920 phase 3: guest sign-in (Settings → Web sign-ins → Guests); widening it is confirmed (settings-change.ts).
             if (parsed.guests) {
+                // #2348: a new grant names someone AgEnD has seen in chat, on a connection of this fleet, who is not a fleet admin
+                // (admins sign in as admins). One already granted may be edited or removed whatever the list says now.
+                for (const [key, grant] of Object.entries(parsed.guests.grants ?? {})) {
+                    if (grant === null || (cfg.web?.guests?.grants && Object.hasOwn(cfg.web.guests.grants, key)))
+                        continue;
+                    const at = key.indexOf(":");
+                    const refused = ctx.guestGrantRefusal ? ctx.guestGrantRefusal(key.slice(0, at), key.slice(at + 1)) : "guest grants are not available";
+                    if (refused)
+                        return json(res, 400, { error: refused, key: "guest_grant_refused", account: key });
+                }
                 const applied = applyGuestsPatch(cfg.web?.guests, parsed.guests);
                 if (applied.next)
                     web.guests = applied.next;
@@ -934,6 +1007,39 @@ export function handleSettingsRequest(req, res, url, ctx) {
             if (parsed.canvasWorker !== undefined && (previous.web?.experimental?.canvas_worker === true) !== parsed.canvasWorker) {
                 ctx.canvasWorkerSettingChanged?.();
             }
+            // #2348: a grant taken away (or emptied) ends that person's guest access now — sessions, an outstanding code, and
+            // remembered browsers — not at their next request. A narrowed grant keeps its sessions; they see less from now on.
+            const ended = new Map();
+            for (const [key, grant] of Object.entries(parsed.guests?.grants ?? {})) {
+                if (grant !== null && grant.instances.length)
+                    continue;
+                const at = key.indexOf(":");
+                try {
+                    ended.set(key, ctx.revokeGuestWebSessions?.({ adapterId: key.slice(0, at), userId: key.slice(at + 1) })?.count ?? 0);
+                }
+                catch (err) {
+                    ctx.logger.warn({ err }, "settings: could not end a removed guest's sessions");
+                }
+            }
+            // #2348 delta §5: every grant change is audited, widening (confirmed in General, replayed here) or narrowing (at
+            // once) alike: who, how, the agents added and taken away. Agent names only; never message content. Shown under
+            // Recent changes in Settings → Guests (guestOverview), never to a guest or over the public link.
+            if (parsed.guests?.grants !== undefined && ctx.noteGuestGrantChange) {
+                const was = previous.web?.guests?.grants ?? {}, now = cfg.web?.guests?.grants ?? {};
+                const by = auditBy, via = isSettingsReplay(req) ? "confirmed" : "direct";
+                for (const key of new Set([...Object.keys(was), ...Object.keys(now)])) {
+                    const a = new Set(Object.hasOwn(was, key) ? was[key].instances : []), b = new Set(Object.hasOwn(now, key) ? now[key].instances : []);
+                    const added = [...b].filter((n) => !a.has(n)), removed = [...a].filter((n) => !b.has(n));
+                    if (!added.length && !removed.length)
+                        continue;
+                    try {
+                        ctx.noteGuestGrantChange({ by, via, account: key, added, removed, endedSessions: ended.get(key) ?? 0 });
+                    }
+                    catch (err) {
+                        ctx.logger.warn({ err }, "settings: could not audit a guest grant change");
+                    }
+                }
+            }
             json(res, 200, { ok: true, warnings: saveWarnings(before, after) });
         }).catch(() => json(res, 400, { error: "bad request" }));
         return true;