@stigmer/runner 0.1.0-dev.20261017020314.g644422724c27

package/dist/shared/approval-policy.js

@@ -0,0 +1,375 @@
+/**
+ * The approval default — harness-agnostic.
+ *
+ * Stigmer asks before a shell command and an MCP tool whose server marks it
+ * destructive (`DiscoveredTool.destructive_hint`, recorded at connect from
+ * the tool's own MCP annotation). A built-in file write or delete asks only
+ * in a turn whose file review is on and whose workspace cannot capture it
+ * (no git tree, no storage for CAS): with review off (the default; the
+ * session's `file_review` switch) the edit simply flows, and with review on
+ * a capturable edit flows and is offered for Keep or Undo after the turn
+ * (`shared/filereview/capture.ts` `deriveCaptureMode`). Either way a
+ * secret-like path the git substrate would not hold is refused outright
+ * (`filereview/secret-paths.ts`). Nothing else asks by default. An agent's
+ * hooks (`shared/hooks/`) answer before the default: a hook that decides a
+ * call replaces the default for it, so a hook decides which tools ask too,
+ * and an agent that wants "ask before every edit" writes a PreToolUse hook
+ * that asks on a write. Two runtime layers then clear an approval that would
+ * be asked:
+ *  - Active approval leases, SCOPED: the pre-armed spec.auto_approve_all is a
+ *    whole-run global bypass, while an interactive APPROVE_ALL ("approve all
+ *    of this kind") grants a run-lifetime lease for only that action's scope
+ *    (its built-in category, its MCP server, or one hook's asks on one tool).
+ *    See {@link ActiveLeases}.
+ *  - The unattended mode resolves an asked call as a skip.
+ *
+ * What a tool may be called at all is a separate question, the agent's tool
+ * lists (`tool-lists.ts`), enforced ahead of this default on both engines.
+ *
+ * Used by both ExecuteCursor (hook-deny model) and ExecuteDeepAgent
+ * (middleware interruptOn model) to determine which tools need approval.
+ */
+import { ApprovalMode } from "@stigmer/apis/ai/stigmer/agentic/run/v1/enum_pb";
+import { SENSITIVE_ARG_KEYS } from "./args-preview.js";
+import { toolApprovalCategory } from "./tool-kind.js";
+import { extractFilePath } from "./file-tools.js";
+import { ApprovalPolicySource } from "../gen/turn/ai/stigmer/runner/turn/v1/enum_pb.js";
+/** The key a hook lease is held under: the hook (`""` for the agent's own block), the tool's server and its bound name. */
+export function hookLeaseKey(hook, server, tool) {
+    return JSON.stringify([hook, server, tool]);
+}
+/**
+ * Reduce a single tool call to the scope its APPROVE_ALL would lease — the
+ * rule the server's grant applies to name a lease (a grant's event carries
+ * the result, which {@link deriveActiveLeases} reads), kept here so the
+ * cross-edition lease-scope corpus (apis/testdata/hitl/lease-scope) proves
+ * the runner's reading agrees with it.
+ *
+ * A row a hook asked for (source HOOK) leases that hook's asks on that tool
+ * and nothing else. Otherwise the MCP server slug takes precedence over the
+ * built-in category and is used RAW (the server's identity, not
+ * case-folded), matching the server's `deriveLeaseScope` byte for byte. The
+ * category lookup reuses {@link toolApprovalCategory}, the shared oracle, so
+ * a built-in resolves to write/delete/shell (read-only built-ins are ungated
+ * and return `undefined`).
+ */
+export function deriveLeaseScope(row) {
+    const { name: toolName, mcpServerSlug } = row;
+    if (row.approvalPolicySource === ApprovalPolicySource.HOOK) {
+        return { kind: "hook", hook: row.approvalPolicyHook, tool: toolName, server: mcpServerSlug };
+    }
+    if (mcpServerSlug) {
+        return { kind: "server", server: mcpServerSlug };
+    }
+    const category = toolApprovalCategory(toolName);
+    if (category) {
+        return { kind: "category", category };
+    }
+    return undefined;
+}
+const LEASABLE_CATEGORIES = new Set(["write", "delete", "shell"]);
+/**
+ * Derive the active approval leases for a turn from the run's grants.
+ *
+ * The scoped successor to the former all-or-nothing hasApproveAllDecision:
+ * instead of "any APPROVE_ALL anywhere disables the whole gate", each grant
+ * a person gave ("approve all") leases only the class its event names: one
+ * hook's asks on one tool, an MCP server's tools, or a built-in category
+ * (read-only tools are never gated, so a built-in lease is always
+ * write/delete/shell). A category word the runner does not know leases
+ * nothing.
+ *
+ * The grants are the run's, read from the session's log at the
+ * reinvocation (`harness/approval-answers.ts`), so a lease granted on any
+ * call, root or sub-agent, applies run-wide (bounded by its scope); a fresh
+ * turn has none. Both harnesses take the result through the runtime, so the
+ * contract is defined in exactly one place. `autoApproveAll` is the run's
+ * pre-armed `spec.auto_approve_all`, the one unscoped bypass.
+ */
+export function deriveActiveLeases(grants, autoApproveAll) {
+    const categories = new Set();
+    const servers = new Set();
+    const hooks = new Set();
+    for (const grant of grants) {
+        if (grant.hook !== undefined)
+            hooks.add(hookLeaseKey(grant.hook, grant.server, grant.tool));
+        else if (grant.server !== "")
+            servers.add(grant.server);
+        else if (LEASABLE_CATEGORIES.has(grant.category))
+            categories.add(grant.category);
+    }
+    return { global: autoApproveAll, categories, servers, hooks };
+}
+/**
+ * Whether this execution runs in UNATTENDED approval mode
+ * (`status.approval_mode`): the lane the turn came through — a schedule, a
+ * Slack or WhatsApp channel, a chat link's guest — has no approver, so a gated tool is
+ * resolved as an automatic skip (the model is told to adapt) instead of
+ * pausing the execution for a decision that can never arrive.
+ *
+ * The mode is a fact of the lane, recorded by the control plane at create;
+ * the request carries none, so a caller can never switch a turn's gates to
+ * skipping. Anything but UNATTENDED (INTERACTIVE, and UNSPECIFIED on a record
+ * written before the field existed) pauses for a decision: the safe default
+ * is the one that asks.
+ *
+ * The mode changes HOW a gate resolves, never WHAT is gated: the default
+ * below is identical in both modes. Both harnesses read the
+ * mode through this one helper (the native gate skips instead of
+ * interrupting; the Cursor hook records a non-pausing "unattended" denial),
+ * so the surfaces can never diverge on what "unattended" means.
+ */
+export function isUnattendedApprovalMode(execution) {
+    return execution.status?.approvalMode === ApprovalMode.UNATTENDED;
+}
+/**
+ * The tool-result text for an unattended auto-skip — ONE definition for both
+ * harnesses (the native gate returns it as the skip ToolMessage; the Cursor
+ * turn boundary backfills it onto stamped SKIPPED rows), so the transcript
+ * reads identically wherever the skip happened. Deliberately instructs
+ * plain-language adaptation with NO tool/approval vocabulary reaching the end
+ * user (the channel/guest anti-leak posture).
+ */
+export function unattendedSkipMessage(toolName) {
+    return (`Tool '${toolName}' requires an approval that is not available in ` +
+        `this conversation, so it was skipped automatically. Do not retry ` +
+        `it or attempt a workaround. Adapt your plan, and explain to the ` +
+        `user in plain language what you could not do and what they can ` +
+        `do instead — never mention tools, approvals, or platform ` +
+        `mechanics.`);
+}
+/**
+ * Monotonic identifier of the policy-engine logic that produced a decision,
+ * persisted on `ToolCall.policy_engine_version`. Bumped when the approval
+ * semantics change so decisions made by different engine versions remain
+ * distinguishable in audits. "default-1" was the first engine with no per-tool
+ * policies: the default alone decided, from the tool's category or its
+ * server's destructive annotation. "hooks-1" is the first in which an
+ * agent's hooks answer before the default. "hooks-2" is the first in which a
+ * built-in file write or delete flows unasked when the turn's file review is
+ * off (stigmer#1471).
+ */
+export const POLICY_ENGINE_VERSION = "hooks-2";
+/**
+ * Map the runner-internal {@link PolicySource} to the persisted proto
+ * {@link ApprovalPolicySource}. `undefined` (a call that needed no approval —
+ * a read-only built-in, an MCP tool its server does not mark destructive)
+ * maps to UNSPECIFIED, so the persisted field is left at its default exactly
+ * as an unclassified `tool_kind` is. The 1:1 mapping keeps the runner's union
+ * and the proto enum from drifting (asserted by the cross-edition corpus).
+ */
+export function toProtoPolicySource(source) {
+    switch (source) {
+        case "auto_approve_all":
+            return ApprovalPolicySource.AUTO_APPROVE_ALL;
+        case "approval_lease":
+            return ApprovalPolicySource.APPROVAL_LEASE;
+        case "builtin_category":
+            return ApprovalPolicySource.BUILTIN_CATEGORY;
+        case "annotation_destructive_tighten":
+            return ApprovalPolicySource.ANNOTATION_DESTRUCTIVE_TIGHTEN;
+        case "unattended_skip":
+            return ApprovalPolicySource.UNATTENDED_SKIP;
+        case "hook":
+            return ApprovalPolicySource.HOOK;
+        case "file_capture":
+        case "file_review_off":
+            // A flowing file edit is never persisted on a gated tool call (the file
+            // tool is not gated — it has no WAITING_APPROVAL row); its source exists
+            // only on the audit receipt. Map to UNSPECIFIED for the proto-persisted field.
+            return ApprovalPolicySource.UNSPECIFIED;
+        case undefined:
+            return ApprovalPolicySource.UNSPECIFIED;
+    }
+}
+/** The key {@link McpApprovalDefault.destructive} is keyed by: server and tool, never the bare name. */
+export function mcpToolKey(serverSlug, toolName) {
+    return `${serverSlug}/${toolName}`;
+}
+/** Build the turn's {@link McpApprovalDefault} from what its servers listed and its leases. */
+export function buildMcpApprovalDefault(listing, leases) {
+    return {
+        destructive: new Set(listing.destructive.map(({ server, tool }) => mcpToolKey(server, tool))),
+        unlisted: new Set(listing.unlisted),
+        leasedServers: leases.servers,
+    };
+}
+/** Nothing listed yet: the leases alone, before an engine reads its tools' marks. */
+export const NOTHING_LISTED = { listed: [], destructive: [], unlisted: [] };
+/**
+ * Derive the authorization provenance — what decided this tool's approval —
+ * for persisting on `ToolCall.approval_policy_source`.
+ *
+ * The read-side twin of {@link resolveToolApproval}: it answers for EVERY
+ * tool (gated or not), so the StatusBuilders can stamp provenance on the
+ * tool call exactly where they stamp `tool_kind`.
+ *
+ * Precedence:
+ * 1. The whole-run global bypass (pre-armed auto_approve_all) governs
+ *    everything — it is *why* anything ran ungated, so it wins.
+ * 2. MCP tool: a leased server reads approval_lease; a destructive tool
+ *    reads annotation_destructive_tighten; any other MCP tool needed no
+ *    approval and reads `undefined`.
+ * 3. Built-in: a mutating category is governed (leased → approval_lease, else
+ *    builtin_category); a read-only built-in reads `undefined`.
+ */
+export function resolveApprovalProvenance(toolName, serverSlug, mcpDefault, leasedCategories, globalBypass) {
+    if (globalBypass)
+        return "auto_approve_all";
+    if (serverSlug) {
+        if (mcpDefault.leasedServers.has(serverSlug))
+            return "approval_lease";
+        if (mcpDefault.destructive.has(mcpToolKey(serverSlug, toolName)))
+            return "annotation_destructive_tighten";
+        if (mcpDefault.unlisted.has(serverSlug))
+            return "annotation_destructive_tighten";
+        return undefined;
+    }
+    const category = toolApprovalCategory(toolName);
+    if (!category)
+        return undefined;
+    if (leasedCategories.has(category))
+        return "approval_lease";
+    return "builtin_category";
+}
+/**
+ * Resolve {{args.field}} placeholders in an approval message using the
+ * tool's actual arguments.
+ *
+ * Placeholder syntax matches the proto-documented format:
+ * - {{args.field_name}} — replaced with the argument value
+ * - {{tool_name}} — replaced with the tool name
+ * - Missing fields are replaced with "<unknown>"
+ * - A secret-keyed field ({@link SENSITIVE_ARG_KEYS}) is replaced with
+ *   "[REDACTED]" (stigmer#1119): the message is stored on the row and shown on
+ *   the approval card, which must carry no more than the redacted preview.
+ *   Every approval message in the runner, native and Cursor alike, resolves
+ *   here, so this is the one place the rule applies to it.
+ */
+export function resolveApprovalMessage(template, toolName, args) {
+    return template
+        .replace(/\{\{tool_name\}\}/g, toolName)
+        .replace(/\{\{args\.(\w+)\}\}/g, (_match, field) => {
+        if (SENSITIVE_ARG_KEYS.has(field.toLowerCase()))
+            return "[REDACTED]";
+        const value = args[field];
+        if (value === undefined || value === null)
+            return "<unknown>";
+        if (typeof value === "string")
+            return value;
+        return JSON.stringify(value);
+    });
+}
+// ── The gate's decision ─────────────────────────────────────────────
+/**
+ * THE approval-message template per mutating built-in category — the one
+ * table both harnesses word their approval cards from (since #1097).
+ * Keyed by category (not raw tool name) so every alias of a mutation renders
+ * one message. It is read only through {@link resolveBuiltInApprovalMessage},
+ * which the native gate (`resolveToolApproval`), the Cursor translator's `gate`
+ * and the Cursor boundary's denied-call message all call, so the three can
+ * never word a card differently.
+ *
+ * Until then the Cursor harness carried a table of its own and the two differed
+ * by a word — `shell` read "Run command" there and "Execute command" here.
+ * Unified on the plainer word: a user reads "Run command" and knows
+ * what is being asked.
+ */
+export const CATEGORY_APPROVAL_MESSAGE = {
+    write: "Write file: {{args.path}}",
+    delete: "Delete: {{args.path}}",
+    shell: "Run command: {{args.command}}",
+};
+/**
+ * THE approval-card message for a built-in tool of either harness taxonomy, or
+ * `undefined` when the tool is not a gated built-in.
+ *
+ * The `{{args.path}}` a file card reads is filled from `extractFilePath`
+ * (`file-tools.ts`), the one home of "which argument names the file" across
+ * both taxonomies: deepagents' file tools and the Cursor hook send
+ * `file_path`, the Cursor stream sends `path`. Resolving the raw args instead
+ * rendered a gated native write as "Write file: <unknown>" (#1112). The
+ * template keeps its one placeholder, so the table stays harness-neutral.
+ */
+export function resolveBuiltInApprovalMessage(toolName, args) {
+    const category = toolApprovalCategory(toolName);
+    return category ? resolveCategoryApprovalMessage(category, toolName, args) : undefined;
+}
+function resolveCategoryApprovalMessage(category, toolName, args) {
+    return resolveApprovalMessage(CATEGORY_APPROVAL_MESSAGE[category], toolName, categoryTemplateArgs(category, args));
+}
+/** The args a category's template resolves against: a file card reads the file from wherever its taxonomy names it. */
+function categoryTemplateArgs(category, args) {
+    switch (category) {
+        case "write":
+        case "delete": {
+            const path = extractFilePath(args);
+            return path === null ? args : { ...args, path };
+        }
+        case "shell":
+            return args;
+        default: {
+            const exhaustive = category;
+            throw new Error(`categoryTemplateArgs: unknown approval category ${String(exhaustive)}`);
+        }
+    }
+}
+/**
+ * THE approval decision for one tool call — the function the native gate
+ * (`middleware/approval-gate.ts`) interrupts on. A held call reaches the
+ * transcript only through that interrupt (`approval_proposed`), so the row can
+ * never disagree with the gate about whether a call waits (since #1097). Its
+ * read-side twin is {@link resolveApprovalProvenance}.
+ *
+ * MCP tools: a leased server's tool passes as approval_lease; a tool its
+ * server marks destructive asks, as annotation_destructive_tighten; every
+ * other MCP tool passes. Only an explicit `destructiveHint: true` asks, so a
+ * server that annotates nothing gates nothing — the server is the one that
+ * knows what its tools do.
+ *
+ * Built-in/platform tools: gate exactly the mutating categories through the
+ * shared tool taxonomy — fail-CLOSED for the mutating set (write/edit/delete/shell
+ * require approval), fail-open for read-only and unclassified built-ins. A
+ * run-lifetime category lease (the user chose "approve all <category>" earlier
+ * in this run) auto-approves every built-in of that category for the rest of
+ * the run — the scoped successor to auto-approve-all.
+ */
+export function resolveToolApproval(toolName, serverSlug, args, mcpDefault, leasedCategories) {
+    if (serverSlug) {
+        if (mcpDefault.leasedServers.has(serverSlug)) {
+            return { requiresApproval: false, message: "", source: "approval_lease" };
+        }
+        if (mcpDefault.destructive.has(mcpToolKey(serverSlug, toolName))) {
+            return {
+                requiresApproval: true,
+                message: resolveApprovalMessage(DESTRUCTIVE_MCP_APPROVAL_MESSAGE, toolName, args),
+                source: "annotation_destructive_tighten",
+            };
+        }
+        if (mcpDefault.unlisted.has(serverSlug)) {
+            return {
+                requiresApproval: true,
+                message: resolveApprovalMessage(UNLISTED_MCP_APPROVAL_MESSAGE, toolName, args),
+                source: "annotation_destructive_tighten",
+            };
+        }
+        return { requiresApproval: false, message: "", source: undefined };
+    }
+    const category = toolApprovalCategory(toolName);
+    if (category) {
+        if (leasedCategories.has(category)) {
+            return { requiresApproval: false, message: "", source: "approval_lease" };
+        }
+        return {
+            requiresApproval: true,
+            message: resolveCategoryApprovalMessage(category, toolName, args),
+            source: "builtin_category",
+        };
+    }
+    return { requiresApproval: false, message: "", source: undefined };
+}
+/** The approval-card message for an MCP tool its server marks destructive. */
+export const DESTRUCTIVE_MCP_APPROVAL_MESSAGE = "Execute {{tool_name}}";
+/** The question for a tool of a server whose tools could not be listed, so whether it is destructive is unknown. */
+export const UNLISTED_MCP_APPROVAL_MESSAGE = "Execute {{tool_name}} (its server's tools could not be listed this turn, so whether it changes anything is unknown)";
+//# sourceMappingURL=approval-policy.js.map

package/dist/shared/approval-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-policy.js","sourceRoot":"","sources":["../../src/shared/approval-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAA6B,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAyDxF,2HAA2H;AAC3H,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc,EAAE,IAAY;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC;IAC9C,IAAI,GAAG,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,IAAI,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAiBD,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA4B,EAAE,cAAuB;IACtF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;aACvF,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aACnD,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,QAAgC,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAc;IACrD,OAAO,SAAS,CAAC,MAAM,EAAE,YAAY,KAAK,YAAY,CAAC,UAAU,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,CACL,SAAS,QAAQ,kDAAkD;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,2DAA2D;QAC3D,YAAY,CACb,CAAC;AACJ,CAAC;AAqBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAgC;IAClE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,kBAAkB;YACrB,OAAO,oBAAoB,CAAC,gBAAgB,CAAC;QAC/C,KAAK,gBAAgB;YACnB,OAAO,oBAAoB,CAAC,cAAc,CAAC;QAC7C,KAAK,kBAAkB;YACrB,OAAO,oBAAoB,CAAC,gBAAgB,CAAC;QAC/C,KAAK,gCAAgC;YACnC,OAAO,oBAAoB,CAAC,8BAA8B,CAAC;QAC7D,KAAK,iBAAiB;YACpB,OAAO,oBAAoB,CAAC,eAAe,CAAC;QAC9C,KAAK,MAAM;YACT,OAAO,oBAAoB,CAAC,IAAI,CAAC;QACnC,KAAK,cAAc,CAAC;QACpB,KAAK,iBAAiB;YACpB,wEAAwE;YACxE,yEAAyE;YACzE,+EAA+E;YAC/E,OAAO,oBAAoB,CAAC,WAAW,CAAC;QAC1C,KAAK,SAAS;YACZ,OAAO,oBAAoB,CAAC,WAAW,CAAC;IAC5C,CAAC;AACH,CAAC;AAsBD,wGAAwG;AACxG,MAAM,UAAU,UAAU,CAAC,UAAkB,EAAE,QAAgB;IAC7D,OAAO,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CACrC,OAAuB,EACvB,MAAoB;IAEpB,OAAO;QACL,WAAW,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7F,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;QACnC,aAAa,EAAE,MAAM,CAAC,OAAO;KAC9B,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAmB,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAE5F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,UAAkB,EAClB,UAA8B,EAC9B,gBAAmD,EACnD,YAAqB;IAErB,IAAI,YAAY;QAAE,OAAO,kBAAkB,CAAC;IAE5C,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,gBAAgB,CAAC;QACtE,IAAI,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAAE,OAAO,gCAAgC,CAAC;QAC1G,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,gCAAgC,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC5D,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,QAAgB,EAChB,IAA6B;IAE7B,OAAO,QAAQ;SACZ,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC;SACvC,OAAO,CAAC,sBAAsB,EAAE,CAAC,MAAM,EAAE,KAAa,EAAE,EAAE;QACzD,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,YAAY,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,WAAW,CAAC;QAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACP,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAyC;IAC7E,KAAK,EAAE,2BAA2B;IAClC,MAAM,EAAE,uBAAuB;IAC/B,KAAK,EAAE,+BAA+B;CACvC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAgB,EAChB,IAA6B;IAE7B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,QAAQ,CAAC,CAAC,CAAC,8BAA8B,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,8BAA8B,CACrC,QAA8B,EAC9B,QAAgB,EAChB,IAA6B;IAE7B,OAAO,sBAAsB,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AACrH,CAAC;AAED,uHAAuH;AACvH,SAAS,oBAAoB,CAAC,QAA8B,EAAE,IAA6B;IACzF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;QAClD,CAAC;QACD,KAAK,OAAO;YACV,OAAO,IAAI,CAAC;QACd,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;AACH,CAAC;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,UAAkB,EAClB,IAA6B,EAC7B,UAA8B,EAC9B,gBAAmD;IAEnD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO;gBACL,gBAAgB,EAAE,IAAI;gBACtB,OAAO,EAAE,sBAAsB,CAAC,gCAAgC,EAAE,QAAQ,EAAE,IAAI,CAAC;gBACjF,MAAM,EAAE,gCAAgC;aACzC,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,gBAAgB,EAAE,IAAI;gBACtB,OAAO,EAAE,sBAAsB,CAAC,6BAA6B,EAAE,QAAQ,EAAE,IAAI,CAAC;gBAC9E,MAAM,EAAE,gCAAgC;aACzC,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO;YACL,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE,8BAA8B,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC;YACjE,MAAM,EAAE,kBAAkB;SAC3B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACrE,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gCAAgC,GAAG,uBAAuB,CAAC;AAExE,oHAAoH;AACpH,MAAM,CAAC,MAAM,6BAA6B,GACxC,qHAAqH,CAAC"}

package/dist/shared/archive-mount.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Archive mount mechanics — the one copy of how a pushed archive (a skill's,
+ * a plugin's) travels to the runner and lands as a directory tree.
+ *
+ * Both archives share one blob driver and one download lane on the server,
+ * so the runner's half is shared too: a skill mount (`skill-mount.ts`) and a
+ * plugin mount (`plugin-mount.ts`) each keep only what is their own (the
+ * skill's `SKILL.md` and hash marker; the plugin's content-addressed cache
+ * and its tamper guard) and call these for the rest:
+ *
+ * - {@link downloadArchive}: mint a download URL first and fetch over HTTP,
+ *   so the archive's full size is deliverable; fall back to the unary RPC,
+ *   capped by the gRPC message limit, only when the server predates the
+ *   lane (`Unimplemented`), or runs without one where the transport says
+ *   its mint answers so (an Eval's, `FailedPrecondition`).
+ * - {@link resetDirectory} then {@link writeArchiveEntries}: a mount is
+ *   rebuilt from scratch, so a file the new content no longer carries never
+ *   lingers, and every entry must resolve inside the mount.
+ * - {@link archiveFileMode}: the ZIP layer is mode-blind (path and bytes
+ *   only, `zip-extract.ts`), so the executable bit is inferred: a script
+ *   extension, or a file that opens with `#!`. Claude Code plugins run
+ *   extensionless scripts directly (`hooks/check`, `bin/tool`), so the
+ *   shebang is the signal that matters for them; skills gain it too.
+ *
+ * Extracted from `skill-mount.ts` when the plugin mount arrived, so the two
+ * mounts cannot drift.
+ */
+import { Code } from "@connectrpc/connect";
+import type { ZipFileEntry } from "./zip-extract.js";
+/** The two ways a server hands out an archive's bytes, by storage key. */
+export interface ArchiveTransport {
+    /** Mint an HTTP download URL; throws `Unimplemented` on a server that predates the lane. */
+    readonly mintDownloadUrl: (artifactStorageKey: string) => Promise<{
+        readonly url: string;
+        readonly sizeBytes: bigint;
+    }>;
+    /** The unary fallback, capped by the server's gRPC message limit. */
+    readonly fetchUnary: (artifactStorageKey: string) => Promise<{
+        readonly artifact: Uint8Array;
+    }>;
+    /**
+     * The answers to the mint that mean "no transfer lane here, read
+     * inline"; absent, `Unimplemented` alone (a server that predates the
+     * lane). The Eval lane also answers `FailedPrecondition` when the server
+     * runs without one.
+     */
+    readonly inlineOn?: readonly Code[];
+}
+/**
+ * Download an archive's bytes, transfer lane first (#675). `undefined` when
+ * the server holds no bytes for the key.
+ */
+export declare function downloadArchive(transport: ArchiveTransport, artifactStorageKey: string): Promise<Uint8Array | undefined>;
+/** The mode an archive entry is written with: 0755 for a script, 0644 otherwise. */
+export declare function archiveFileMode(path: string, content: Uint8Array): number;
+/** Remove a mount directory and create it empty. */
+export declare function resetDirectory(dir: string): Promise<void>;
+/**
+ * The absolute path an entry lands at inside `dir`, or a thrown error when
+ * it would escape. The server refuses traversal at push; this is the
+ * runner's own defence in depth.
+ */
+export declare function entryPathIn(dir: string, entryPath: string, label: string): string;
+/**
+ * Write every entry under `dir`, each with {@link archiveFileMode}. `label`
+ * names the archive in a refusal ("skill artifact", "plugin archive").
+ */
+export declare function writeArchiveEntries(dir: string, entries: readonly ZipFileEntry[], label: string): Promise<void>;

package/dist/shared/archive-mount.js

@@ -0,0 +1,108 @@
+/**
+ * Archive mount mechanics — the one copy of how a pushed archive (a skill's,
+ * a plugin's) travels to the runner and lands as a directory tree.
+ *
+ * Both archives share one blob driver and one download lane on the server,
+ * so the runner's half is shared too: a skill mount (`skill-mount.ts`) and a
+ * plugin mount (`plugin-mount.ts`) each keep only what is their own (the
+ * skill's `SKILL.md` and hash marker; the plugin's content-addressed cache
+ * and its tamper guard) and call these for the rest:
+ *
+ * - {@link downloadArchive}: mint a download URL first and fetch over HTTP,
+ *   so the archive's full size is deliverable; fall back to the unary RPC,
+ *   capped by the gRPC message limit, only when the server predates the
+ *   lane (`Unimplemented`), or runs without one where the transport says
+ *   its mint answers so (an Eval's, `FailedPrecondition`).
+ * - {@link resetDirectory} then {@link writeArchiveEntries}: a mount is
+ *   rebuilt from scratch, so a file the new content no longer carries never
+ *   lingers, and every entry must resolve inside the mount.
+ * - {@link archiveFileMode}: the ZIP layer is mode-blind (path and bytes
+ *   only, `zip-extract.ts`), so the executable bit is inferred: a script
+ *   extension, or a file that opens with `#!`. Claude Code plugins run
+ *   extensionless scripts directly (`hooks/check`, `bin/tool`), so the
+ *   shebang is the signal that matters for them; skills gain it too.
+ *
+ * Extracted from `skill-mount.ts` when the plugin mount arrived, so the two
+ * mounts cannot drift.
+ */
+import { agentFs } from "./agent-fs.js";
+import { dirname, extname, resolve } from "node:path";
+import { ConnectError, Code } from "@connectrpc/connect";
+/**
+ * Download an archive's bytes, transfer lane first (#675). `undefined` when
+ * the server holds no bytes for the key.
+ */
+export async function downloadArchive(transport, artifactStorageKey) {
+    let minted;
+    try {
+        minted = await transport.mintDownloadUrl(artifactStorageKey);
+    }
+    catch (err) {
+        if (err instanceof ConnectError && (transport.inlineOn ?? [Code.Unimplemented]).includes(err.code)) {
+            const resp = await transport.fetchUnary(artifactStorageKey);
+            return resp.artifact && resp.artifact.length > 0 ? resp.artifact : undefined;
+        }
+        throw err;
+    }
+    const resp = await fetch(minted.url);
+    if (!resp.ok) {
+        throw new Error(`artifact fetch failed: HTTP ${resp.status} from ${withoutQuery(minted.url)}`);
+    }
+    const bytes = new Uint8Array(await resp.arrayBuffer());
+    if (minted.sizeBytes > 0n && BigInt(bytes.length) !== minted.sizeBytes) {
+        throw new Error(`artifact fetch truncated: got ${bytes.length} bytes, expected ${minted.sizeBytes}`);
+    }
+    return bytes.length > 0 ? bytes : undefined;
+}
+/**
+ * A download URL without its query: a minted URL is a capability, signed in
+ * its query string, and an error that carries it may reach a run's status.
+ */
+function withoutQuery(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.origin}${parsed.pathname}`;
+    }
+    catch {
+        return "the minted download URL";
+    }
+}
+/** Extensions written executable whatever their first bytes say. */
+const SCRIPT_EXTENSIONS = new Set([".sh", ".py", ".js", ".ts", ".rb", ".pl"]);
+/** `#!`, the two bytes that make a file runnable as `./file`. */
+const SHEBANG = [0x23, 0x21];
+/** The mode an archive entry is written with: 0755 for a script, 0644 otherwise. */
+export function archiveFileMode(path, content) {
+    const shebang = content.length >= 2 && content[0] === SHEBANG[0] && content[1] === SHEBANG[1];
+    return shebang || SCRIPT_EXTENSIONS.has(extname(path)) ? 0o755 : 0o644;
+}
+/** Remove a mount directory and create it empty. */
+export async function resetDirectory(dir) {
+    await agentFs().rm(dir, { recursive: true, force: true });
+    await agentFs().mkdir(dir, { recursive: true });
+}
+/**
+ * The absolute path an entry lands at inside `dir`, or a thrown error when
+ * it would escape. The server refuses traversal at push; this is the
+ * runner's own defence in depth.
+ */
+export function entryPathIn(dir, entryPath, label) {
+    const root = resolve(dir);
+    const filePath = resolve(root, entryPath);
+    if (filePath !== root && !filePath.startsWith(root + "/")) {
+        throw new Error(`${label} entry escapes its mount directory: '${entryPath}'`);
+    }
+    return filePath;
+}
+/**
+ * Write every entry under `dir`, each with {@link archiveFileMode}. `label`
+ * names the archive in a refusal ("skill artifact", "plugin archive").
+ */
+export async function writeArchiveEntries(dir, entries, label) {
+    for (const entry of entries) {
+        const filePath = entryPathIn(dir, entry.path, label);
+        await agentFs().mkdir(dirname(filePath), { recursive: true });
+        await agentFs().writeFile(filePath, entry.content, { mode: archiveFileMode(entry.path, entry.content) });
+    }
+}
+//# sourceMappingURL=archive-mount.js.map

package/dist/shared/archive-mount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-mount.js","sourceRoot":"","sources":["../../src/shared/archive-mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAkBzD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAA2B,EAC3B,kBAA0B;IAE1B,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,MAAM,SAAS,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,SAAS,GAAG,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,CAAC,MAAM,oBAAoB,MAAM,CAAC,SAAS,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,yBAAyB,CAAC;IACnC,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9E,iEAAiE;AACjE,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,CAAU,CAAC;AAEtC,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAmB;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9F,OAAO,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACzE,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,MAAM,OAAO,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,SAAiB,EAAE,KAAa;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wCAAwC,SAAS,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAW,EACX,OAAgC,EAChC,KAAa;IAEb,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC"}