@songsid/agend 2.3.5-alpha.4 → 2.3.5-alpha.5

package/dist/agent-runtime-change.d.ts

@@ -29,8 +29,9 @@ export declare const AgentRuntimeChangeInput: z.ZodObject<{
         pane: "pane";
     }>>;
     startNewConversation: z.ZodLiteral<true>;
+    credentialProfile: z.ZodOptional<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>;
 }, z.core.$strict>;
-export declare const GENERAL_USES_LOCATION_SWITCH = "General is moved from Settings \u2192 Agent defaults \u2192 General location, not from Runtime settings";
+export declare const GENERAL_USES_LOCATION_SWITCH = "General is moved from Settings \u2192 Shared agent settings \u2192 General location, not from Runtime settings";
 export type AgentRuntimeTarget = z.infer<typeof AgentRuntimeChangeInput>;
 export interface PreparedAgentRuntime {
     config: InstanceConfig;
@@ -69,6 +70,7 @@ export declare class AgentRuntimeChanges {
         general: boolean;
         adapter: "exec" | "pane";
         sandbox: "read-only" | "workspace-write";
+        credentialProfile: string | undefined;
     };
     change(name: string, raw: unknown, authorized: () => boolean): Promise<unknown>;
 }

package/dist/agent-runtime-change.js

@@ -1,6 +1,8 @@
 /** Administrator-only moves of one Fleet identity. Provider sessions never cross machines or providers. */
 import { z } from "zod";
 import { settingsFingerprint } from "./settings-transaction.js";
+import { validCredentialProfileName } from "./runtime-credential-profiles.js";
+import { isWindowsInstance, nativeCredentialProfile } from "./native-instance-registry.js";
 export const AgentRuntimeChangeInput = z.object({
     requestId: z.string().uuid(), expectedRevision: z.string().regex(/^[a-f0-9]{64}$/),
     runtime: z.enum(["wsl", "windows"]), machineId: z.string().uuid().optional(),
@@ -8,13 +10,17 @@ export const AgentRuntimeChangeInput = z.object({
     model: z.string().max(160).default(""), directory: z.string().max(1024).default(""),
     sandbox: z.enum(["read-only", "workspace-write"]).default("read-only"),
     adapter: z.enum(["exec", "pane"]).default("exec"), startNewConversation: z.literal(true),
+    /** A NAME only (a Claude sign-in kept on the chosen Runtime computer). Never a path: the Runtime maps it to its own folder. */
+    credentialProfile: z.string().max(64).refine(validCredentialProfileName, "Invalid credential profile name").optional(),
 }).strict().superRefine((value, ctx) => {
+    if (value.credentialProfile && (value.runtime !== "windows" || !value.machineId || value.backend !== "claude-code"))
+        ctx.addIssue({ code: "custom", message: "A credential profile is a Claude Code sign-in kept on a paired Runtime computer" });
     if (value.runtime === "wsl" && (value.machineId || value.adapter !== "exec"))
         ctx.addIssue({ code: "custom", message: "Choose the Fleet host for a WSL/Linux agent" });
     if (value.runtime === "windows" && value.adapter === "pane" && !['codex', 'claude-code'].includes(value.backend))
         ctx.addIssue({ code: "custom", message: "Persistent Windows terminals support Codex and Claude Code" });
 });
-export const GENERAL_USES_LOCATION_SWITCH = "General is moved from Settings → Agent defaults → General location, not from Runtime settings";
+export const GENERAL_USES_LOCATION_SWITCH = "General is moved from Settings → Shared agent settings → General location, not from Runtime settings";
 export class AgentRuntimeChanges {
     host;
     attempts = new Map();
@@ -29,13 +35,19 @@ export class AgentRuntimeChanges {
         const backend = config.backend || this.host.defaults()?.backend || "claude-code";
         return { revision: settingsFingerprint([config, this.host.defaults(), this.host.generation(name), this.host.epoch(name)]),
             runtime: config.runtime === "windows" ? "windows" : "wsl", machineId: config.machine_id, backend, backendState: this.host.backendState?.(name, backend),
-            directory: config.working_directory, model: config.model ?? "", general: this.isGeneral(name, config), adapter: config.native_adapter ?? "exec", sandbox: config.native_sandbox ?? "read-only" };
+            directory: config.working_directory, model: config.model ?? "", general: this.isGeneral(name, config), adapter: config.native_adapter ?? "exec", sandbox: config.native_sandbox ?? "read-only",
+            credentialProfile: (() => { try {
+                return isWindowsInstance(config) ? nativeCredentialProfile(config) : undefined;
+            }
+            catch {
+                return undefined;
+            } })() };
     }
     change(name, raw, authorized) {
         const target = AgentRuntimeChangeInput.parse(raw), digest = settingsFingerprint(target), old = this.attempts.get(name);
         if (!authorized())
             throw Error("Runtime change requires a current dashboard administrator");
-        // General's location has its own journalled switch (Agent defaults → General location, #3036): it holds deliveries,
+        // General's location has its own journalled switch (Shared agent settings → General location, #3036): it holds deliveries,
         // confirms the old host exited and clears the Linux-only fields. This path does none of that, so it is not offered.
         if (this.isGeneral(name, this.host.config(name)))
             throw Error(GENERAL_USES_LOCATION_SWITCH);

package/dist/agent-runtime-change.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-runtime-change.js","sourceRoot":"","sources":["../src/agent-runtime-change.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,gBAAgB,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAChF,OAAO,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACzE,OAAO,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAC,OAAO,EAAC,UAAU,EAAC,UAAU,EAAC,aAAa,EAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IACzF,KAAK,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjF,OAAO,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACpE,OAAO,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,oBAAoB,EAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CACtF,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;IACnC,IAAG,KAAK,CAAC,OAAO,KAAG,KAAK,IAAE,CAAC,KAAK,CAAC,SAAS,IAAE,KAAK,CAAC,OAAO,KAAG,MAAM,CAAC;QAAC,GAAG,CAAC,QAAQ,CAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,6CAA6C,EAAC,CAAC,CAAC;IACxJ,IAAG,KAAK,CAAC,OAAO,KAAG,SAAS,IAAE,KAAK,CAAC,OAAO,KAAG,MAAM,IAAE,CAAC,CAAC,OAAO,EAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAC,GAAG,CAAC,QAAQ,CAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,4DAA4D,EAAC,CAAC,CAAC;AAC5M,CAAC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAC,+FAA+F,CAAC;AAmB1I,MAAM,OAAO,mBAAmB;IAED,IAAI;IADzB,QAAQ,GAAC,IAAI,GAAG,EAA4E,CAAC;IACrG,YAA6B,IAA2B;oBAA3B,IAAI;IAAyB,CAAC;IACnD,SAAS,CAAC,IAAW,EAAC,MAA+B,IAAE,OAAO,MAAM,EAAE,aAAa,KAAG,IAAI,IAAE,IAAI,KAAG,SAAS,CAAC,CAAA,CAAC;IACtH,QAAQ,CAAC,IAAW;QAClB,MAAM,MAAM,GAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAA,IAAG,CAAC,MAAM;YAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAC,MAAM,CAAC,OAAO,IAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAkC,EAAE,OAAO,IAAE,aAAa,CAAC;QAC5G,OAAO,EAAC,QAAQ,EAAC,mBAAmB,CAAC,CAAC,MAAM,EAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAClH,OAAO,EAAC,MAAM,CAAC,OAAO,KAAG,SAAS,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,KAAK,EAAC,SAAS,EAAC,MAAM,CAAC,UAAU,EAAC,OAAO,EAAC,YAAY,EAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,EAAC,OAAO,CAAC;YAC1I,SAAS,EAAC,MAAM,CAAC,iBAAiB,EAAC,KAAK,EAAC,MAAM,CAAC,KAAK,IAAE,EAAE,EAAC,OAAO,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAC,MAAM,CAAC,EAAC,OAAO,EAAC,MAAM,CAAC,cAAc,IAAE,MAAM,EAAC,OAAO,EAAC,MAAM,CAAC,cAAc,IAAE,WAAW,EAAC,CAAC;IACpL,CAAC;IACD,MAAM,CAAC,IAAW,EAAC,GAAW,EAAC,UAAsB;QACnD,MAAM,MAAM,GAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAC,MAAM,GAAC,mBAAmB,CAAC,MAAM,CAAC,EAAC,GAAG,GAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/G,IAAG,CAAC,UAAU,EAAE;YAAC,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC1F,oHAAoH;QACpH,oHAAoH;QACpH,IAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACzF,IAAG,GAAG,EAAE,EAAE,KAAG,MAAM,CAAC,SAAS,EAAC,CAAC;YAAA,IAAG,GAAG,CAAC,MAAM,KAAG,MAAM;gBAAC,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAAA,OAAO,GAAG,CAAC,MAAM,CAAC;QAAA,CAAC;QACrI,IAAG,GAAG,EAAE,OAAO;YAAC,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACtF,IAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAG,MAAM,CAAC,gBAAgB;YAAC,MAAM,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC1I,mGAAmG;QACnG,MAAM,OAAO,GAAC,EAAC,EAAE,EAAC,MAAM,CAAC,SAAS,EAAC,MAAM,EAAC,OAAO,EAAC,IAAI,EAAC,MAAM,EAAC,IAAmC,EAAC,CAAC;QACnG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAC,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,MAAM,GAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAE,EAAE,CAAA,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAA,EAAE;YAC9E,IAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAG,MAAM,CAAC,gBAAgB;gBAAC,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAChI,MAAM,MAAM,GAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAE,EAAC,QAAQ,GAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAA,IAAI,KAAK,GAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAC,OAAO,GAAC,KAAK,EAAC,QAAuC,CAAC;YAC3M,MAAM,OAAO,GAAC,GAAE,EAAE;gBAChB,IAAG,OAAO;oBAAC,OAAO,KAAK,CAAC;gBACxB,IAAG,CAAC,UAAU,EAAE,IAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAG,MAAM,IAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAG,KAAK,IAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAG,QAAQ,IAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAG,KAAK;oBAAC,OAAO,GAAC,IAAI,CAAC;gBACvO,OAAO,CAAC,OAAO,CAAC;YAClB,CAAC,CAAC;YACF,IAAG,CAAC,OAAO,EAAE;gBAAC,MAAM,KAAK,CAAC,4EAA4E,CAAC,CAAC;YACxG,IAAI,WAAgC,EAAC,KAAK,GAAC,KAAK,CAAC;YACjD,IAAG,CAAC;gBACF,QAAQ,GAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,OAAO,CAAC,CAAC;gBAC7D,IAAG,CAAC,OAAO,EAAE;oBAAC,MAAM,KAAK,CAAC,wEAAwE,CAAC,CAAC;gBACpG,8GAA8G;gBAC9G,KAAK,EAAE,CAAC;gBAAA,MAAM,IAAI,EAAE,CAAC;gBACrB,IAAG,CAAC,OAAO,EAAE;oBAAC,MAAM,KAAK,CAAC,iEAAiE,CAAC,CAAC;gBAC7F,IAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAC,MAAM,CAAC;oBAAC,MAAM,KAAK,CAAC,oEAAoE,CAAC,CAAC;gBAC1H,IAAG,CAAC,OAAO,EAAE;oBAAC,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;gBACxF,IAAG,MAAM,CAAC,OAAO,KAAG,KAAK;oBAAC,WAAW,GAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC7E,IAAG,CAAC,OAAO,EAAE;oBAAC,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAAA,KAAK,GAAC,IAAI,CAAC;gBACvD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACxB,OAAO,EAAC,EAAE,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAC,MAAM,CAAC,OAAO,EAAC,SAAS,EAAC,MAAM,CAAC,SAAS,EAAC,OAAO,EAAC,MAAM,CAAC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,gBAAgB,EAAC,IAAI,EAAC,CAAC;YACrI,CAAC;YAAA,OAAM,KAAK,EAAC,CAAC;gBACZ,IAAG,CAAC,KAAK,EAAC,CAAC;oBAAA,WAAW,EAAE,EAAE,CAAC;oBAAA,QAAQ,EAAE,OAAO,EAAE,CAAC;gBAAA,CAAC;gBAChD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAE,EAAE,GAAC,OAAO,CAAC,OAAO,GAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"agent-runtime-change.js","sourceRoot":"","sources":["../src/agent-runtime-change.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAE3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,gBAAgB,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAChF,OAAO,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACzE,OAAO,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAC,OAAO,EAAC,UAAU,EAAC,UAAU,EAAC,aAAa,EAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IACzF,KAAK,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjF,OAAO,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACpE,OAAO,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,oBAAoB,EAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACrF,+HAA+H;IAC/H,iBAAiB,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CACrH,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;IACnC,IAAG,KAAK,CAAC,iBAAiB,IAAE,CAAC,KAAK,CAAC,OAAO,KAAG,SAAS,IAAE,CAAC,KAAK,CAAC,SAAS,IAAE,KAAK,CAAC,OAAO,KAAG,aAAa,CAAC;QAAC,GAAG,CAAC,QAAQ,CAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,iFAAiF,EAAC,CAAC,CAAC;IACjO,IAAG,KAAK,CAAC,OAAO,KAAG,KAAK,IAAE,CAAC,KAAK,CAAC,SAAS,IAAE,KAAK,CAAC,OAAO,KAAG,MAAM,CAAC;QAAC,GAAG,CAAC,QAAQ,CAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,6CAA6C,EAAC,CAAC,CAAC;IACxJ,IAAG,KAAK,CAAC,OAAO,KAAG,SAAS,IAAE,KAAK,CAAC,OAAO,KAAG,MAAM,IAAE,CAAC,CAAC,OAAO,EAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAC,GAAG,CAAC,QAAQ,CAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,4DAA4D,EAAC,CAAC,CAAC;AAC5M,CAAC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAC,sGAAsG,CAAC;AAmBjJ,MAAM,OAAO,mBAAmB;IAED,IAAI;IADzB,QAAQ,GAAC,IAAI,GAAG,EAA4E,CAAC;IACrG,YAA6B,IAA2B;oBAA3B,IAAI;IAAyB,CAAC;IACnD,SAAS,CAAC,IAAW,EAAC,MAA+B,IAAE,OAAO,MAAM,EAAE,aAAa,KAAG,IAAI,IAAE,IAAI,KAAG,SAAS,CAAC,CAAA,CAAC;IACtH,QAAQ,CAAC,IAAW;QAClB,MAAM,MAAM,GAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAA,IAAG,CAAC,MAAM;YAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAC,MAAM,CAAC,OAAO,IAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAkC,EAAE,OAAO,IAAE,aAAa,CAAC;QAC5G,OAAO,EAAC,QAAQ,EAAC,mBAAmB,CAAC,CAAC,MAAM,EAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAClH,OAAO,EAAC,MAAM,CAAC,OAAO,KAAG,SAAS,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,KAAK,EAAC,SAAS,EAAC,MAAM,CAAC,UAAU,EAAC,OAAO,EAAC,YAAY,EAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,EAAC,OAAO,CAAC;YAC1I,SAAS,EAAC,MAAM,CAAC,iBAAiB,EAAC,KAAK,EAAC,MAAM,CAAC,KAAK,IAAE,EAAE,EAAC,OAAO,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAC,MAAM,CAAC,EAAC,OAAO,EAAC,MAAM,CAAC,cAAc,IAAE,MAAM,EAAC,OAAO,EAAC,MAAM,CAAC,cAAc,IAAE,WAAW;YAC9K,iBAAiB,EAAC,CAAC,GAAE,EAAE,GAAC,IAAG,CAAC;gBAAA,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAA,CAAC,CAAA,uBAAuB,CAAC,MAAM,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC;gBAAA,OAAO,SAAS,CAAC;YAAA,CAAC,CAAA,CAAC,CAAC,EAAE,EAAC,CAAC;IAC1I,CAAC;IACD,MAAM,CAAC,IAAW,EAAC,GAAW,EAAC,UAAsB;QACnD,MAAM,MAAM,GAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAC,MAAM,GAAC,mBAAmB,CAAC,MAAM,CAAC,EAAC,GAAG,GAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/G,IAAG,CAAC,UAAU,EAAE;YAAC,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC1F,2HAA2H;QAC3H,oHAAoH;QACpH,IAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACzF,IAAG,GAAG,EAAE,EAAE,KAAG,MAAM,CAAC,SAAS,EAAC,CAAC;YAAA,IAAG,GAAG,CAAC,MAAM,KAAG,MAAM;gBAAC,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAAA,OAAO,GAAG,CAAC,MAAM,CAAC;QAAA,CAAC;QACrI,IAAG,GAAG,EAAE,OAAO;YAAC,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACtF,IAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAG,MAAM,CAAC,gBAAgB;YAAC,MAAM,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC1I,mGAAmG;QACnG,MAAM,OAAO,GAAC,EAAC,EAAE,EAAC,MAAM,CAAC,SAAS,EAAC,MAAM,EAAC,OAAO,EAAC,IAAI,EAAC,MAAM,EAAC,IAAmC,EAAC,CAAC;QACnG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAC,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,MAAM,GAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAE,EAAE,CAAA,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAA,EAAE;YAC9E,IAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAG,MAAM,CAAC,gBAAgB;gBAAC,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAChI,MAAM,MAAM,GAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAE,EAAC,QAAQ,GAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAA,IAAI,KAAK,GAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAC,OAAO,GAAC,KAAK,EAAC,QAAuC,CAAC;YAC3M,MAAM,OAAO,GAAC,GAAE,EAAE;gBAChB,IAAG,OAAO;oBAAC,OAAO,KAAK,CAAC;gBACxB,IAAG,CAAC,UAAU,EAAE,IAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAG,MAAM,IAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAG,KAAK,IAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAG,QAAQ,IAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAG,KAAK;oBAAC,OAAO,GAAC,IAAI,CAAC;gBACvO,OAAO,CAAC,OAAO,CAAC;YAClB,CAAC,CAAC;YACF,IAAG,CAAC,OAAO,EAAE;gBAAC,MAAM,KAAK,CAAC,4EAA4E,CAAC,CAAC;YACxG,IAAI,WAAgC,EAAC,KAAK,GAAC,KAAK,CAAC;YACjD,IAAG,CAAC;gBACF,QAAQ,GAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,OAAO,CAAC,CAAC;gBAC7D,IAAG,CAAC,OAAO,EAAE;oBAAC,MAAM,KAAK,CAAC,wEAAwE,CAAC,CAAC;gBACpG,8GAA8G;gBAC9G,KAAK,EAAE,CAAC;gBAAA,MAAM,IAAI,EAAE,CAAC;gBACrB,IAAG,CAAC,OAAO,EAAE;oBAAC,MAAM,KAAK,CAAC,iEAAiE,CAAC,CAAC;gBAC7F,IAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAC,MAAM,CAAC;oBAAC,MAAM,KAAK,CAAC,oEAAoE,CAAC,CAAC;gBAC1H,IAAG,CAAC,OAAO,EAAE;oBAAC,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;gBACxF,IAAG,MAAM,CAAC,OAAO,KAAG,KAAK;oBAAC,WAAW,GAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC7E,IAAG,CAAC,OAAO,EAAE;oBAAC,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAAA,KAAK,GAAC,IAAI,CAAC;gBACvD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACxB,OAAO,EAAC,EAAE,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAC,MAAM,CAAC,OAAO,EAAC,SAAS,EAAC,MAAM,CAAC,SAAS,EAAC,OAAO,EAAC,MAAM,CAAC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,gBAAgB,EAAC,IAAI,EAAC,CAAC;YACrI,CAAC;YAAA,OAAM,KAAK,EAAC,CAAC;gBACZ,IAAG,CAAC,KAAK,EAAC,CAAC;oBAAA,WAAW,EAAE,EAAE,CAAC;oBAAA,QAAQ,EAAE,OAAO,EAAE,CAAC;gBAAA,CAAC;gBAChD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAE,EAAE,GAAC,OAAO,CAAC,OAAO,GAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;CACF"}

package/dist/agent-workspace.d.ts

@@ -0,0 +1,93 @@
+export declare const WORKSPACE_LIMITS: Readonly<{
+    fileBytes: number;
+    diffBytes: number;
+    diffFiles: 500;
+    /** One file's share of the diff: a bigger one is listed as "too large to show" (the others still fit). */
+    fileDiffBytes: number;
+    dirEntries: 1000;
+    untrackedDiffFiles: 50;
+    gitTimeoutMs: 10000;
+}>;
+/** Whether a path (relative, `/`-separated) is hidden: any part a hidden directory, or its name a secret-looking file. */
+export declare function isHiddenPath(rel: string): boolean;
+export type WorkspaceRefusal = "not_found" | "not_a_directory" | "outside" | "hidden" | "symlink" | "not_a_file" | "invalid";
+export declare class WorkspaceError extends Error {
+    readonly code: WorkspaceRefusal;
+    constructor(code: WorkspaceRefusal);
+}
+export interface WorkspaceRoot {
+    root: string;
+    state: string | null;
+}
+/** The agent's folder (realpath) and AgEnD's state directory, when it is inside the folder. */
+export declare function workspaceRoot(workingDirectory: string, agendHome: string): Promise<WorkspaceRoot>;
+/**
+ * A request's relative path → its place under the root, refused when it is not plainly inside: no absolute path, no
+ * `..`, no NUL or control characters; and no part of it (or the place itself, via realpath) outside the root or in
+ * AgEnD's state. `allowRoot`: the empty path is the root itself (a directory listing).
+ */
+export declare function placeOf(ws: WorkspaceRoot, rel: unknown, allowRoot?: boolean): Promise<{
+    abs: string;
+    rel: string;
+}>;
+export interface WorkspaceChange {
+    path: string;
+    status: string;
+    adds: number | null;
+    dels: number | null;
+    binary: boolean;
+    hidden: boolean;
+    untracked: boolean;
+    tooLarge?: boolean;
+}
+export interface WorkspaceChanges {
+    repo: boolean;
+    branch: string | null;
+    files: WorkspaceChange[];
+    patch: string;
+    cut: {
+        files: boolean;
+        bytes: boolean;
+    };
+    hiddenCount: number;
+}
+/**
+ * Changes: git status plus the diff of everything uncommitted against HEAD (staged and unstaged together, P1), and the
+ * untracked files git does not ignore, as additions. Hidden files are listed without their diff.
+ */
+export declare function workspaceChanges(ws: WorkspaceRoot): Promise<WorkspaceChanges>;
+export interface WorkspaceEntry {
+    name: string;
+    type: "dir" | "file" | "symlink" | "other";
+    size: number | null;
+    hidden: boolean;
+}
+/** One directory's entries (directories first, then names), gitignored ones left out in a repository. */
+export declare function workspaceList(ws: WorkspaceRoot, rel: unknown): Promise<{
+    path: string;
+    entries: WorkspaceEntry[];
+    cut: boolean;
+}>;
+export type WorkspaceFile = {
+    kind: "text";
+    path: string;
+    size: number;
+    text: string;
+} | {
+    kind: "image";
+    path: string;
+    size: number;
+    mime: string;
+} | {
+    kind: "binary" | "too_large";
+    path: string;
+    size: number;
+};
+/** A file as the viewer shows it: text (UTF-8, up to 1 MiB), an image (served raw by `workspaceImage`), or why not. */
+export declare function workspaceFile(ws: WorkspaceRoot, rel: unknown): Promise<WorkspaceFile>;
+/** An image's bytes for the viewer's <img> (a known image extension only, at most 8 MiB). */
+export declare function workspaceImage(ws: WorkspaceRoot, rel: unknown): Promise<{
+    mime: string;
+    bytes: Buffer;
+}>;
+export declare const workspaceName: (rel: string) => string;

package/dist/agent-workspace.js

@@ -0,0 +1,353 @@
+/**
+ * #3153 P1: a read-only look at an agent's working directory, for the web's Files / Changes side panel.
+ *
+ * - **Scope:** only the agent's configured `working_directory` (realpath). Every path is resolved and must stay under
+ *   it. A symlink is listed but never followed (its target is neither read nor described). `..`, absolute paths, NUL
+ *   and device or FIFO files are refused. AgEnD's own state directory is never shown, even inside the folder.
+ * - **Secrets:** a fixed deny-list by name (`.env*`, keys, certificates, credential and secret files, `.git`, `.ssh`,
+ *   …). Such a file is listed as hidden; its contents are never read or sent, and its diff is left out.
+ * - **Limits:**
+ *   - a file over 1 MiB is not read;
+ *   - the diff stops at 2 MiB or 500 files;
+ *   - a directory lists at most 1,000 entries;
+ *   - git runs with a timeout and a byte cap.
+ *   Every cut is said, never silent.
+ * - **git:** only read-only commands (`status`, `diff`, `ls-files`, `check-ignore`, `rev-parse`), never a pager, with
+ *   `GIT_OPTIONAL_LOCKS=0` (no index refresh), and with fsmonitor, external diff and textconv switched off. Nothing in
+ *   the folder is executed by this module, and nothing is written.
+ *
+ * Callers (web-api.ts) decide who may ask: the fleet's local admin session only.
+ */
+import { execFile } from "./child-process.js";
+import { constants as fsConstants } from "node:fs";
+import { lstat, open, readdir, realpath } from "node:fs/promises";
+import { basename, extname, isAbsolute, join, resolve, sep } from "node:path";
+export const WORKSPACE_LIMITS = Object.freeze({
+    fileBytes: 1024 * 1024,
+    diffBytes: 2 * 1024 * 1024,
+    diffFiles: 500,
+    /** One file's share of the diff: a bigger one is listed as "too large to show" (the others still fit). */
+    fileDiffBytes: 256 * 1024,
+    dirEntries: 1000,
+    untrackedDiffFiles: 50,
+    gitTimeoutMs: 10_000,
+});
+const IMAGE_TYPES = { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".webp": "image/webp" };
+const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+/** Names whose contents never leave the machine through this view (fixed in P1, #3153). Lowercase compare. */
+const HIDDEN_DIRS = new Set([".git", ".ssh", ".aws", ".gnupg", ".kube", ".docker", ".azure", ".config", ".agend", ".claude", ".codex", ".kiro"]);
+const HIDDEN_FILES = new Set([".npmrc", ".netrc", ".pypirc", ".git-credentials", ".pgpass", "credentials", "credentials.json", "auth.json", "secrets.json",
+    "id_rsa", "id_dsa", "id_ecdsa", "id_ed25519", "known_hosts", "authorized_keys", ".htpasswd",
+    // Fable on #3158: tool credentials and shell histories (a history holds whatever was typed, tokens included).
+    ".envrc", ".vault-token", ".s3cfg", ".boto", "kubeconfig", ".kubeconfig", "terraform.tfstate", "terraform.tfstate.backup"]);
+/** Whether a path (relative, `/`-separated) is hidden: any part a hidden directory, or its name a secret-looking file. */
+export function isHiddenPath(rel) {
+    const parts = rel.split("/").filter(Boolean);
+    for (const p of parts.slice(0, -1))
+        if (HIDDEN_DIRS.has(p.toLowerCase()))
+            return true;
+    const name = (parts[parts.length - 1] ?? "").toLowerCase();
+    if (HIDDEN_DIRS.has(name) || HIDDEN_FILES.has(name))
+        return true;
+    if (/^\.env(?:$|[.-])/.test(name) || /^id_(?:rsa|dsa|ecdsa|ed25519)/.test(name))
+        return true;
+    if (/\.(?:pem|key|p12|p8|pfx|jks|keystore|kdbx|asc|gpg|ppk|token|env|tfvars|tfstate)$/.test(name) || /\.tfstate\./.test(name))
+        return true;
+    if (/^service[-_]?account.*\.json$/.test(name) || /^\.[a-z0-9]*_?history$/.test(name) || /^\.?kubeconfig(?:[.-]|$)/.test(name))
+        return true;
+    if (/(?:^|[._-])(?:secret|secrets|credential|credentials|password|passwords|private[-_]?key)(?:[._-]|$)/.test(name))
+        return true;
+    return false;
+}
+export class WorkspaceError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+const under = (path, root) => path === root || path.startsWith(root.endsWith(sep) ? root : root + sep);
+/** The agent's folder (realpath) and AgEnD's state directory, when it is inside the folder. */
+export async function workspaceRoot(workingDirectory, agendHome) {
+    if (typeof workingDirectory !== "string" || !isAbsolute(workingDirectory))
+        throw new WorkspaceError("not_a_directory");
+    let root;
+    try {
+        root = await realpath(workingDirectory);
+    }
+    catch {
+        throw new WorkspaceError("not_found");
+    }
+    const st = await lstat(root).catch(() => null);
+    if (!st || !st.isDirectory())
+        throw new WorkspaceError("not_a_directory");
+    let state = null;
+    try {
+        const s = await realpath(agendHome);
+        if (under(s, root))
+            state = s;
+    }
+    catch { /* no state directory */ }
+    return { root, state };
+}
+/**
+ * A request's relative path → its place under the root, refused when it is not plainly inside: no absolute path, no
+ * `..`, no NUL or control characters; and no part of it (or the place itself, via realpath) outside the root or in
+ * AgEnD's state. `allowRoot`: the empty path is the root itself (a directory listing).
+ */
+export async function placeOf(ws, rel, allowRoot = false) {
+    if (typeof rel !== "string" || rel.length > 4096 || /[\u0000-\u001f\u007f\\]/.test(rel))
+        throw new WorkspaceError("invalid");
+    if (rel === "" || rel === "/") {
+        if (allowRoot)
+            return { abs: ws.root, rel: "" };
+        throw new WorkspaceError("invalid");
+    }
+    if (isAbsolute(rel) || rel.startsWith("/"))
+        throw new WorkspaceError("outside");
+    const clean = rel.replace(/\/+$/g, "");
+    if (clean.split("/").some((p) => p === "" || p === "." || p === ".."))
+        throw new WorkspaceError("outside");
+    const abs = resolve(ws.root, clean);
+    if (!under(abs, ws.root))
+        throw new WorkspaceError("outside");
+    // Every parent must be a real directory under the root (a symlinked directory is never walked through).
+    let at = ws.root;
+    for (const part of clean.split("/").slice(0, -1)) {
+        at = join(at, part);
+        const st = await lstat(at).catch(() => null);
+        if (!st)
+            throw new WorkspaceError("not_found");
+        if (st.isSymbolicLink())
+            throw new WorkspaceError("symlink");
+        if (!st.isDirectory())
+            throw new WorkspaceError("not_a_directory");
+    }
+    if (ws.state && under(abs, ws.state))
+        throw new WorkspaceError("hidden");
+    return { abs, rel: clean };
+}
+// ── git ──
+function git(root, args, maxBytes) {
+    return new Promise((done) => {
+        const child = execFile("git", ["-C", root, "-c", "core.fsmonitor=false", "-c", "core.untrackedCache=false", "-c", "core.pager=cat",
+            "-c", "diff.external=", "-c", "color.ui=false", ...args], { encoding: "buffer", timeout: WORKSPACE_LIMITS.gitTimeoutMs, maxBuffer: maxBytes, windowsHide: true,
+            env: { ...process.env, GIT_OPTIONAL_LOCKS: "0", GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_NOSYSTEM: "1", LC_ALL: "C" } }, (err, stdout) => {
+            const out = Buffer.isBuffer(stdout) ? stdout : Buffer.alloc(0);
+            const e = err;
+            if (e && e.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") {
+                done({ ok: true, out, cut: true });
+                return;
+            }
+            // `git diff --no-index` answers 1 when the files differ: that is its success.
+            done({ ok: !e || e.code === 1, out, cut: false });
+        });
+        child.stdin?.end();
+    });
+}
+async function isRepo(root) {
+    const r = await git(root, ["rev-parse", "--is-inside-work-tree"], 4096);
+    return r.ok && r.out.toString("utf8").trim() === "true";
+}
+/**
+ * Changes: git status plus the diff of everything uncommitted against HEAD (staged and unstaged together, P1), and the
+ * untracked files git does not ignore, as additions. Hidden files are listed without their diff.
+ */
+export async function workspaceChanges(ws) {
+    if (!(await isRepo(ws.root)))
+        return { repo: false, branch: null, files: [], patch: "", cut: { files: false, bytes: false }, hiddenCount: 0 };
+    const branchR = await git(ws.root, ["rev-parse", "--abbrev-ref", "HEAD"], 4096);
+    const branch = branchR.ok ? branchR.out.toString("utf8").trim() || null : null;
+    const hasHead = (await git(ws.root, ["rev-parse", "--verify", "-q", "HEAD"], 4096)).out.length > 0;
+    const base = hasHead ? "HEAD" : EMPTY_TREE;
+    const status = await git(ws.root, ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--no-renames"], 4 * 1024 * 1024);
+    const files = [];
+    const entries = status.out.toString("utf8").split("\u0000").filter(Boolean);
+    let cutFiles = false;
+    for (const e of entries) {
+        if (files.length >= WORKSPACE_LIMITS.diffFiles) {
+            cutFiles = true;
+            break;
+        }
+        const code = e.slice(0, 2), path = e.slice(3);
+        if (!path || (ws.state && under(resolve(ws.root, path), ws.state)))
+            continue;
+        const untracked = code === "??";
+        files.push({ path, status: untracked ? "untracked" : code.includes("D") ? "deleted" : code.includes("A") ? "added" : "modified",
+            adds: null, dels: null, binary: false, hidden: isHiddenPath(path), untracked });
+    }
+    // Line counts for tracked changes (numstat: "-\t-" is binary).
+    const numstat = await git(ws.root, ["diff", base, "--numstat", "-z", "--no-renames", "--no-ext-diff", "--no-textconv"], 4 * 1024 * 1024);
+    const counts = new Map();
+    for (const row of numstat.out.toString("utf8").split("\u0000").filter(Boolean)) {
+        const m = /^(-|\d+)\t(-|\d+)\t(.*)$/s.exec(row);
+        if (m)
+            counts.set(m[3], { adds: m[1] === "-" ? null : Number(m[1]), dels: m[2] === "-" ? null : Number(m[2]), binary: m[1] === "-" });
+    }
+    for (const f of files) {
+        const c = counts.get(f.path);
+        if (c)
+            Object.assign(f, c);
+    }
+    // The patch: tracked changes (hidden paths excluded by pathspec), then untracked text files as additions.
+    const visibleTracked = files.filter((f) => !f.untracked && !f.hidden).map((f) => f.path);
+    // Each file's section is kept only within its own share and the whole budget: one huge file never starves the rest.
+    let patch = "", cutBytes = false;
+    const byPath = new Map(files.map((f) => [f.path, f]));
+    const take = (section, f) => {
+        const n = Buffer.byteLength(section);
+        if (n > WORKSPACE_LIMITS.fileDiffBytes) {
+            if (f)
+                f.tooLarge = true;
+            return;
+        }
+        if (Buffer.byteLength(patch) + n > WORKSPACE_LIMITS.diffBytes) {
+            cutBytes = true;
+            if (f)
+                f.tooLarge = true;
+            return;
+        }
+        patch += section;
+    };
+    if (visibleTracked.length) {
+        const r = await git(ws.root, ["diff", base, "--no-color", "--no-ext-diff", "--no-textconv", "--no-renames", "-U3", "--", ...visibleTracked.map((p) => `:(literal)${p}`)], 16 * 1024 * 1024);
+        if (r.cut)
+            cutBytes = true;
+        for (const section of r.out.toString("utf8").split(/(?=^diff --git )/m).filter(Boolean)) {
+            const m = /^diff --git a\/(.*?) b\//.exec(section);
+            take(section, m ? byPath.get(m[1]) : undefined);
+        }
+    }
+    let untrackedShown = 0;
+    for (const f of files) {
+        if (!f.untracked || f.hidden)
+            continue;
+        if (untrackedShown >= WORKSPACE_LIMITS.untrackedDiffFiles) {
+            cutFiles = true;
+            break;
+        }
+        const abs = resolve(ws.root, f.path);
+        const st = await lstat(abs).catch(() => null);
+        if (!st || !st.isFile())
+            continue; // a link or a special file: listed, no diff
+        if (st.size > WORKSPACE_LIMITS.fileDiffBytes) {
+            f.tooLarge = true;
+            continue;
+        }
+        const r = await git(ws.root, ["diff", "--no-index", "--no-color", "--no-ext-diff", "--no-textconv", "--", "/dev/null", f.path], WORKSPACE_LIMITS.fileDiffBytes * 2);
+        const text = r.out.toString("utf8");
+        if (/^Binary files /m.test(text)) {
+            f.binary = true;
+            continue;
+        }
+        f.adds = (text.match(/^\+(?!\+\+)/gm) ?? []).length;
+        f.dels = 0;
+        take(text, f);
+        untrackedShown++;
+    }
+    return { repo: true, branch, files, patch, cut: { files: cutFiles, bytes: cutBytes }, hiddenCount: files.filter((f) => f.hidden).length };
+}
+/** One directory's entries (directories first, then names), gitignored ones left out in a repository. */
+export async function workspaceList(ws, rel) {
+    const place = await placeOf(ws, rel ?? "", true);
+    const st = await lstat(place.abs).catch(() => null);
+    if (!st)
+        throw new WorkspaceError("not_found");
+    if (st.isSymbolicLink())
+        throw new WorkspaceError("symlink");
+    if (!st.isDirectory())
+        throw new WorkspaceError("not_a_directory");
+    if (place.rel && isHiddenPath(place.rel))
+        throw new WorkspaceError("hidden");
+    const names = (await readdir(place.abs)).sort();
+    let ignored = new Set();
+    if (await isRepo(ws.root)) {
+        const candidates = names.map((n) => (place.rel ? `${place.rel}/${n}` : n));
+        if (candidates.length) {
+            const r = await new Promise((done) => {
+                const child = execFile("git", ["-C", ws.root, "-c", "core.fsmonitor=false", "check-ignore", "-z", "--stdin"], { encoding: "buffer", timeout: WORKSPACE_LIMITS.gitTimeoutMs, maxBuffer: 4 * 1024 * 1024, env: { ...process.env, GIT_OPTIONAL_LOCKS: "0", GIT_CONFIG_NOSYSTEM: "1", LC_ALL: "C" } }, (_err, out) => done(Buffer.isBuffer(out) ? out : Buffer.alloc(0)));
+                child.stdin?.end(candidates.join("\u0000") + "\u0000");
+            });
+            ignored = new Set(r.toString("utf8").split("\u0000").filter(Boolean));
+        }
+    }
+    const entries = [];
+    let cut = false;
+    for (const name of names) {
+        const childRel = place.rel ? `${place.rel}/${name}` : name;
+        if (ignored.has(childRel))
+            continue;
+        const abs = join(place.abs, name);
+        if (ws.state && under(abs, ws.state))
+            continue;
+        if (entries.length >= WORKSPACE_LIMITS.dirEntries) {
+            cut = true;
+            break;
+        }
+        const s = await lstat(abs).catch(() => null);
+        if (!s)
+            continue;
+        const type = s.isSymbolicLink() ? "symlink" : s.isDirectory() ? "dir" : s.isFile() ? "file" : "other";
+        entries.push({ name, type, size: type === "file" ? s.size : null, hidden: isHiddenPath(childRel) });
+    }
+    entries.sort((a, b) => (a.type === "dir") === (b.type === "dir") ? (a.name < b.name ? -1 : a.name > b.name ? 1 : 0) : a.type === "dir" ? -1 : 1);
+    return { path: place.rel, entries, cut };
+}
+/** Open a regular file under the root without following a symlink (O_NOFOLLOW), never waiting on a FIFO (O_NONBLOCK). */
+async function openPlain(ws, rel) {
+    const place = await placeOf(ws, rel);
+    if (isHiddenPath(place.rel))
+        throw new WorkspaceError("hidden");
+    const st = await lstat(place.abs).catch(() => null);
+    if (!st)
+        throw new WorkspaceError("not_found");
+    if (st.isSymbolicLink())
+        throw new WorkspaceError("symlink");
+    if (!st.isFile())
+        throw new WorkspaceError("not_a_file");
+    const fh = await open(place.abs, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK | fsConstants.O_NOCTTY).catch(() => { throw new WorkspaceError("not_a_file"); });
+    const fst = await fh.stat();
+    if (!fst.isFile() || fst.ino !== st.ino || fst.dev !== st.dev) {
+        await fh.close();
+        throw new WorkspaceError("not_a_file");
+    }
+    return { place, fh, size: fst.size };
+}
+/** A file as the viewer shows it: text (UTF-8, up to 1 MiB), an image (served raw by `workspaceImage`), or why not. */
+export async function workspaceFile(ws, rel) {
+    const { place, fh, size } = await openPlain(ws, rel);
+    try {
+        const mime = IMAGE_TYPES[extname(place.rel).toLowerCase()];
+        if (mime)
+            return { kind: size > WORKSPACE_LIMITS.fileBytes * 8 ? "too_large" : "image", path: place.rel, size, ...(size > WORKSPACE_LIMITS.fileBytes * 8 ? {} : { mime }) };
+        if (size > WORKSPACE_LIMITS.fileBytes)
+            return { kind: "too_large", path: place.rel, size };
+        const buf = Buffer.alloc(size);
+        const { bytesRead } = await fh.read(buf, 0, size, 0);
+        const bytes = buf.subarray(0, bytesRead);
+        if (bytes.subarray(0, 8192).includes(0))
+            return { kind: "binary", path: place.rel, size };
+        const text = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
+        return { kind: "text", path: place.rel, size, text };
+    }
+    finally {
+        await fh.close();
+    }
+}
+/** An image's bytes for the viewer's <img> (a known image extension only, at most 8 MiB). */
+export async function workspaceImage(ws, rel) {
+    const { place, fh, size } = await openPlain(ws, rel);
+    try {
+        const mime = IMAGE_TYPES[extname(place.rel).toLowerCase()];
+        if (!mime || size > WORKSPACE_LIMITS.fileBytes * 8)
+            throw new WorkspaceError("not_a_file");
+        const buf = Buffer.alloc(size);
+        const { bytesRead } = await fh.read(buf, 0, size, 0);
+        return { mime, bytes: buf.subarray(0, bytesRead) };
+    }
+    finally {
+        await fh.close();
+    }
+}
+export const workspaceName = (rel) => basename(rel);
+//# sourceMappingURL=agent-workspace.js.map

package/dist/agent-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-workspace.js","sourceRoot":"","sources":["../src/agent-workspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,IAAI,GAAG,IAAI;IACtB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;IAC1B,SAAS,EAAE,GAAG;IACd,0GAA0G;IAC1G,aAAa,EAAE,GAAG,GAAG,IAAI;IACzB,UAAU,EAAE,IAAI;IAChB,kBAAkB,EAAE,EAAE;IACtB,YAAY,EAAE,MAAM;CACrB,CAAC,CAAC;AACH,MAAM,WAAW,GAA2B,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AAC7J,MAAM,UAAU,GAAG,0CAA0C,CAAC;AAE9D,8GAA8G;AAC9G,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACjJ,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,aAAa,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc;IACxJ,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW;IAC3F,8GAA8G;IAC9G,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAC9H,0HAA0H;AAC1H,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACtF,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7F,IAAI,kFAAkF,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3I,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5I,IAAI,oGAAoG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjI,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,MAAM,OAAO,cAAe,SAAQ,KAAK;IAAwB,IAAI;IAAzB,YAAqB,IAAsB;QAAI,KAAK,CAAC,IAAI,CAAC,CAAC;oBAAtC,IAAI;IAAmC,CAAC;CAAE;AAE3G,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAGvH,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,gBAAwB,EAAE,SAAiB;IAC7E,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACvH,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;IAAC,CAAC;IACjG,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAC1E,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QAAC,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;IAC9G,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAiB,EAAE,GAAY,EAAE,SAAS,GAAG,KAAK;IAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7H,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QAAC,IAAI,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IACxH,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC3G,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC9D,wGAAwG;IACxG,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,YAAY;AAEZ,SAAS,GAAG,CAAC,IAAY,EAAE,IAAuB,EAAE,QAAgB;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB;YAChI,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,EAC1D,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI;YAClG,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EACrJ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACd,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,CAAC,GAAG,GAA0D,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,mCAAmC,EAAE,CAAC;gBAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACxG,8EAA8E;YAC9E,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAK,CAAwB,CAAC,IAAI,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AACD,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,IAAI,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;AAC1D,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAiB;IACtD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAC9I,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,uBAAuB,EAAE,cAAc,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAChI,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7E,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;YAC7H,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,+DAA+D;IAC/D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IACzI,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyE,CAAC;IAChG,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IACpF,0GAA0G;IAC1G,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzF,oHAAoH;IACpH,IAAI,KAAK,GAAG,EAAE,EAAE,QAAQ,GAAG,KAAK,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,CAA8B,EAAE,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC;gBAAE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC;QACrH,KAAK,IAAI,OAAO,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC5L,IAAI,CAAC,CAAC,GAAG;YAAE,QAAQ,GAAG,IAAI,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACxF,MAAM,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM;YAAE,SAAS;QACvC,IAAI,cAAc,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;QACtF,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,SAAS,CAA0C,4CAA4C;QACxH,IAAI,EAAE,CAAC,IAAI,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC;YAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QACpK,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAChE,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5I,CAAC;AAKD,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAiB,EAAE,GAAY;IACjE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,EAAE,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,IAAI,EAAE,EAAE;gBAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,EAC1G,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EACnL,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC;YAAE,SAAS;QAC/C,IAAI,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;QACzE,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACtG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjJ,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC3C,CAAC;AASD,yHAAyH;AACzH,KAAK,UAAU,SAAS,CAAC,EAAiB,EAAE,GAAY;IACtD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,EAAE,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,GAAG,WAAW,CAAC,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzL,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IAAC,CAAC;IAC5H,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,uHAAuH;AACvH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAiB,EAAE,GAAY;IACjE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,gBAAgB,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,GAAG,gBAAgB,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAmB,CAAC;QAC7L,IAAI,IAAI,GAAG,gBAAgB,CAAC,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC3F,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC1F,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACjC,CAAC;AACD,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAiB,EAAE,GAAY;IAClE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,gBAAgB,CAAC,SAAS,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;QAC3F,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;IACrD,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC"}

package/dist/auth-api.d.ts

@@ -4,6 +4,7 @@ import { type SessionRecord, type SessionTier, type WebSessionStore } from "./we
 import { type WebPeer } from "./authority/web-authority.js";
 import type { GuestLoginCodes, LoginCodeOwner, LoginCodeRecipient, WebLoginCodes } from "./web-login.js";
 import { type ReturningDevice } from "./web-returning-device.js";
+import { type DeviceLoginRequests } from "./web-device-login.js";
 export declare const LOGIN_REFUSED_MESSAGE = "That code did not work \u2014 it may be wrong, expired or already used. Ask for a new one with /web.";
 export declare const LOGIN_PAUSED_MESSAGE = "Too many wrong codes \u2014 sign-in is paused for a few minutes.";
 export interface AuthApiContext {
@@ -101,6 +102,25 @@ export interface AuthApiContext {
     } | {
         kind: "refused";
     }>;
+    /**
+     * Refs #3061 (P2a): the requests of device-code sign-in (web-device-login.ts). With `isWebOnlyFleet()`, what makes
+     * `/auth/device-login*` exist: a fleet with a chat connection, web authorization off, or the public link, answers 404 there.
+     */
+    readonly webDeviceLogins?: DeviceLoginRequests | null;
+    /**
+     * Refs #3061: device-code sign-in is open right now — a web-only fleet with web authorization on (with it off no one
+     * can approve, so nothing is offered). Asked again after the body is read. Absent: not open.
+     */
+    deviceLoginAvailable?(): boolean;
+    /** Refs #3061 (P2b): `web.login_qr` — the sign-in page may draw the QR code of the approve link beside the code. Absent: no. */
+    loginQrEnabled?(): boolean;
+    /**
+     * Refs #3061 (P2b): may this request's admin session end ANOTHER session (`DELETE /auth/sessions/<handle>` of someone
+     * else's, or `DELETE /auth/sessions`)? A web-only fleet answers yes only for its verified owner: a session a one-time
+     * code or a device approval made is not one, and could otherwise sign the owner out. Ending one's own is never asked.
+     * Absent: yes, as it always was (a fleet with a chat connection, and any caller that does not set it).
+     */
+    mayEndOtherSessions?(req: IncomingMessage): boolean;
 }
 export declare const CODE_REQUEST_REFUSED_MESSAGE = "A new code could not be sent. Ask for one with /web.";
 /** True for a name `/assets/` serves. The public link's manifest asks this too: one list, not two. */
@@ -127,6 +147,11 @@ export declare function bypassesWebGate(req: {
         view_access?: string;
     } | undefined;
 } | null | undefined, isViewRead: (path: string) => boolean): boolean;
+/**
+ * AgEnD Hub P1: one public, inert asset by its /assets/ name — what a Hub's own listener serves of the app's static
+ * closure. It reads no cookie, session or request header. Returns false when there is no such asset.
+ */
+export declare function servePublicAsset(res: ServerResponse, name: string): boolean;
 /**
  * The sign-in page. Also what a browser navigation gets from a gated page it has no cookie for. #2910 D5: on a web-only
  * fleet (`webOnly`) its <body> says so, and the page's words lead with `agend web --code` (there is no /web to send).
@@ -134,6 +159,8 @@ export declare function bypassesWebGate(req: {
 export declare function serveSigninPage(res: ServerResponse, status?: number, opts?: {
     webOnly?: boolean;
     outside?: boolean;
+    deviceLogin?: boolean;
+    loginQr?: boolean;
 }): void;
 /**
  * What a guest's browser gets for a page it cannot open (#2399 smoke: the gate's bare JSON before): "members" for a page