@svenroth-ai/shipwright 0.27.0 → 0.29.0

package/server/dist/core/session-file/evidence.js

@@ -0,0 +1,201 @@
+/*
+ * Session evidence for GET /tasks/:id/session-file: which absolute paths did
+ * THIS session itself touch or name? A path is evidenced when
+ *   1. it is an Output (Write/Edit/NotebookEdit/MultiEdit target, incl. its
+ *      subagents) per core/session-info, or
+ *   2. it is named, as a whole path, in a chat text block or in a tool_use
+ *      input of the session JSONL.
+ * tool_result bodies, attachments and thinking are NEVER evidence: they quote
+ * arbitrary file content and command output, not the session's intent.
+ *
+ * Stateless (CLAUDE.md rule 4): every call is a fresh bounded positional scan
+ * via scanLines; the only cache is session-info's pure per-file memo.
+ * Read-only (DO-NOT #1). A whole-path match means the char before is not a path
+ * character and the char after does not continue the path, so a mention of a
+ * directory never evidences its children and `/a/b` never evidences `/a/b.txt`.
+ */
+import path from "node:path";
+import { scanLines } from "../session-info/line-scan.js";
+import { SESSION_SCAN_BYTES, readSessionInfo } from "../session-info/session-info.js";
+const CI = process.platform === "win32";
+/** Comparison key: Windows paths are case-insensitive and may use either slash. */
+export const evidenceKey = (p) => (CI ? p.replace(/\//g, "\\").toLowerCase() : p);
+// Before-set: '=' is left out on purpose so `--out=/x/y.md` still evidences /x/y.md.
+// ')' '}' '*' ':' end shell expressions / remote specs (`$(pwd)/x`, `host:/x`): the path after them is a suffix, not a mention.
+const BEFORE_BAD = /[\p{L}\p{N}_\-./\x5c~+@%#$)}*:]/u;
+// '~', '+', '@', '%', '#', '$', '=' are valid filename characters: they continue a path, never end it.
+// (A space inside a quoted filename stays ambiguous; the extension allowlist bounds that residual.)
+const AFTER_BAD = /[\p{L}\p{N}_\-/\x5c~+@%#$=]/u;
+const MAX_STRINGS_PER_LINE = 2000;
+const MAX_DEPTH = 8;
+/** True when `hay` names `needle` as a complete path (see file header). */
+export function mentionsWholePath(hay, needle) {
+    if (!needle)
+        return false;
+    const h = CI ? hay.replace(/\//g, "\\").toLowerCase() : hay;
+    const n = evidenceKey(needle);
+    for (let i = h.indexOf(n); i !== -1; i = h.indexOf(n, i + 1)) {
+        const before = i > 0 ? h[i - 1] : "";
+        if (before && BEFORE_BAD.test(before))
+            continue;
+        const end = i + n.length;
+        const after = h[end] ?? "";
+        if (after && AFTER_BAD.test(after))
+            continue;
+        // A '.' ends a sentence, unless it starts an extension ("a.txt" vs "a.txt.bak").
+        if (after === "." && h[end + 1] !== undefined && AFTER_BAD.test(h[end + 1]))
+            continue;
+        return true;
+    }
+    return false;
+}
+function collectStrings(v, out, depth = 0) {
+    if (out.length >= MAX_STRINGS_PER_LINE || depth > MAX_DEPTH)
+        return;
+    if (typeof v === "string")
+        out.push(v);
+    else if (Array.isArray(v))
+        for (const x of v)
+            collectStrings(x, out, depth + 1);
+    else if (v && typeof v === "object")
+        for (const x of Object.values(v))
+            collectStrings(x, out, depth + 1);
+}
+// Command output AND harness-generated wrappers the CLI echoes into user records: none of it is something the
+// user typed or the assistant chose to name (a file or background agent could smuggle a path through them).
+const OUTPUT_SECTIONS = [
+    "bash-stdout", "bash-stderr", "local-command-stdout", "local-command-stderr", "command-stdout", "command-stderr",
+    "system-reminder", "task-notification", "user-prompt-submit-hook", "tool-use-error",
+];
+/** Drop `<name>…</name>` sections (command output echoed into user records) by plain string search. */
+function stripSections(text, names) {
+    let out = text;
+    for (const name of names) {
+        const open = `<${name}>`;
+        const close = `</${name}>`;
+        for (let s = out.indexOf(open); s !== -1; s = out.indexOf(open)) {
+            const e = out.indexOf(close, s);
+            out = out.slice(0, s) + (e === -1 ? "" : out.slice(e + close.length));
+        }
+    }
+    return out;
+}
+/** Text a user could have SEEN or the assistant DID: chat text + tool_use inputs. Never command output or injected meta. */
+function evidenceStrings(rec) {
+    if (rec.type !== "user" && rec.type !== "assistant")
+        return [];
+    if (rec.isMeta === true || rec.isCompactSummary === true)
+        return [];
+    // A user record that answers a tool call (or carries its structured result) is tool output, not a prompt.
+    if (rec.type === "user" && (rec.toolUseResult !== undefined || rec.sourceToolUseID !== undefined))
+        return [];
+    const msg = rec.message;
+    const content = msg?.content;
+    const out = [];
+    if (typeof content === "string")
+        out.push(stripSections(content, OUTPUT_SECTIONS));
+    else if (Array.isArray(content)) {
+        for (const b of content) {
+            if (!b || typeof b !== "object")
+                continue;
+            if (b.type === "text" && typeof b.text === "string")
+                out.push(stripSections(b.text, OUTPUT_SECTIONS));
+            else if (b.type === "tool_use")
+                collectStrings(b.input, out);
+        }
+    }
+    return out;
+}
+/** Cheap raw-line pre-filter token: the basename, unless JSON could have escaped it. */
+function prefilterToken(candidate) {
+    const base = path.win32.basename(candidate.replace(/\//g, "\\"));
+    if (!base || [...base].some((ch) => ch === '"' || ch === "\x5c" || ch.charCodeAt(0) < 32))
+        return null;
+    return CI ? base.toLowerCase() : base;
+}
+/**
+ * Scans are serialized process-wide: each is synchronous JSON work over up to 48 MB, and a burst of
+ * concurrent requests must queue rather than starve the event loop (terminal WS, transcript polls).
+ * A promise chain, not a cache - nothing is remembered between requests (CLAUDE.md rule 4).
+ */
+let scanQueue = Promise.resolve();
+const SCAN_TIMEOUT_MS = 20_000;
+const MAX_PENDING_SCANS = 8;
+let pendingScans = 0;
+export function findSessionEvidence(sessionUuid, loc, candidates, deps = {}) {
+    // Bounded backlog: a burst of unevidenced requests must not queue unbounded full scans (fail closed, incomplete).
+    if (pendingScans >= MAX_PENDING_SCANS)
+        return Promise.resolve({ found: new Set(), incomplete: true });
+    pendingScans++;
+    const release = () => {
+        pendingScans--;
+    };
+    // The backlog slot is held until the scan itself has stopped, not merely until the caller stopped waiting
+    // (a timed-out scan keeps running, so releasing on timeout would let stalled scans pile up past the cap).
+    const run = scanQueue.then(() => {
+        const scan = scanForEvidence(sessionUuid, loc, candidates, deps);
+        void scan.then(release, release);
+        return withTimeout(scan);
+    });
+    scanQueue = run.catch(() => undefined);
+    return run;
+}
+/** A stalled read must not hold the queue forever: give up (fail closed, incomplete) and move on. */
+function withTimeout(p) {
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve({ found: new Set(), incomplete: true }), SCAN_TIMEOUT_MS);
+    });
+    return Promise.race([p, timeout]).finally(() => clearTimeout(timer));
+}
+async function scanForEvidence(sessionUuid, loc, candidates, deps) {
+    const found = new Set();
+    let incomplete = false;
+    if (!loc || candidates.length === 0)
+        return { found, incomplete };
+    const wanted = new Map(candidates.map((c) => [evidenceKey(c), c]));
+    try {
+        const info = await readSessionInfo(sessionUuid, loc, deps.infoDeps);
+        for (const o of info.outputs)
+            if (wanted.has(evidenceKey(o.path)))
+                found.add(evidenceKey(o.path));
+    }
+    catch {
+        /* fall through to the raw scan; never widen access on error */
+    }
+    const tokens = candidates.map(prefilterToken);
+    const pending = () => candidates.filter((c) => !found.has(evidenceKey(c)));
+    const onLine = (line) => {
+        if (pending().length === 0)
+            return;
+        if (!line.includes('"user"') && !line.includes('"assistant"'))
+            return;
+        const probe = CI ? line.toLowerCase() : line;
+        const live = candidates.filter((c, i) => !found.has(evidenceKey(c)) && (tokens[i] === null || probe.includes(tokens[i])));
+        if (live.length === 0)
+            return;
+        let rec;
+        try {
+            const parsed = JSON.parse(line);
+            if (!parsed || typeof parsed !== "object")
+                return;
+            rec = parsed;
+        }
+        catch {
+            return;
+        }
+        const strings = evidenceStrings(rec);
+        for (const c of live)
+            if (strings.some((s) => mentionsWholePath(s, c)))
+                found.add(evidenceKey(c));
+    };
+    try {
+        incomplete = (await scanLines(loc.path, SESSION_SCAN_BYTES, onLine)).truncated;
+    }
+    catch {
+        /* unreadable session: only what structured outputs already proved */
+        incomplete = true;
+    }
+    return { found, incomplete };
+}
+//# sourceMappingURL=evidence.js.map

package/server/dist/core/session-file/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../../src/core/session-file/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAwB,MAAM,iCAAiC,CAAC;AAG5G,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AACxC,mFAAmF;AACnF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG,qFAAqF;AACrF,gIAAgI;AAChI,MAAM,UAAU,GAAG,kCAAkC,CAAC;AACtD,uGAAuG;AACvG,oGAAoG;AACpG,MAAM,SAAS,GAAG,8BAA8B,CAAC;AACjD,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,MAAc;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5D,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,IAAI,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QAChD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACzB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAC7C,iFAAiF;QACjF,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAE,CAAC;YAAE,SAAS;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,CAAU,EAAE,GAAa,EAAE,KAAK,GAAG,CAAC;IAC1D,IAAI,GAAG,CAAC,MAAM,IAAI,oBAAoB,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO;IACpE,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAClC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,KAAK,MAAM,CAAC,IAAI,CAAC;YAAE,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;SAC3E,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,8GAA8G;AAC9G,4GAA4G;AAC5G,MAAM,eAAe,GAAG;IACtB,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,gBAAgB;IAChH,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,gBAAgB;CACpF,CAAC;AAEF,uGAAuG;AACvG,SAAS,aAAa,CAAC,IAAY,EAAE,KAAe;IAClD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,IAAI,GAAG,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,IAAI,GAAG,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAChC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4HAA4H;AAC5H,SAAS,eAAe,CAAC,GAA4B;IACnD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACpE,0GAA0G;IAC1G,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7G,MAAM,GAAG,GAAG,GAAG,CAAC,OAA8C,CAAC;IAC/D,MAAM,OAAO,GAAG,GAAG,EAAE,OAAO,CAAC;IAC7B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;SAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,OAAoC,EAAE,CAAC;YACrD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;iBACjG,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;gBAAE,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wFAAwF;AACxF,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACvG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAqBD;;;;GAIG;AACH,IAAI,SAAS,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;AAEpD,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,GAAyB,EACzB,UAAoB,EACpB,OAAqB,EAAE;IAEvB,kHAAkH;IAClH,IAAI,YAAY,IAAI,iBAAiB;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACtG,YAAY,EAAE,CAAC;IACf,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,YAAY,EAAE,CAAC;IACjB,CAAC,CAAC;IACF,0GAA0G;IAC1G,0GAA0G;IAC1G,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;QAC9B,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACjE,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,SAAS,WAAW,CAAC,CAA0B;IAC7C,IAAI,KAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;QACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,WAAmB,EACnB,GAAyB,EACzB,UAAoB,EACpB,IAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAQ,EAAE;QACpC,IAAI,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACnC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO;QACtE,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;QAC3H,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO;YAClD,GAAG,GAAG,MAAiC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC,CAAC;IACF,IAAI,CAAC;QACH,UAAU,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC"}

package/server/dist/core/session-file/probe.d.ts

@@ -0,0 +1,16 @@
+import { type AccessArgs } from "./access.js";
+export declare const MAX_PROBE_PATHS = 40;
+export type ProbeReason = "not_found" | "not_a_file" | "not_previewable" | "unavailable";
+export interface ProbeResult {
+    openable: boolean;
+    reason?: ProbeReason;
+}
+export interface ProbeArgs extends Pick<AccessArgs, "roots" | "findEvidence"> {
+    paths: string[];
+    /** The viewer can only render allow-listed types (same MIME allowlist as the read route). */
+    /** The Viewer refuses files above this size (413); probe them as not openable too. */
+    maxBytes?: number;
+    previewable: (absolute: string) => boolean;
+}
+export declare function probeOpenable(args: ProbeArgs): Promise<ProbeResult[]>;
+//# sourceMappingURL=probe.d.ts.map

package/server/dist/core/session-file/probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../../src/core/session-file/probe.ts"],"names":[],"mappings":"AAaA,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAIvF,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,YAAY,GAAG,iBAAiB,GAAG,aAAa,CAAC;AACzF,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,SAAU,SAAQ,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,cAAc,CAAC;IAC3E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,6FAA6F;IAC7F,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;CAC5C;AAyBD,wBAAsB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAsB3E"}

package/server/dist/core/session-file/probe.js

@@ -0,0 +1,63 @@
+/*
+ * Batched "can this path be opened?" probe behind POST /tasks/:id/session-file/probe.
+ *
+ * The verdict comes from the SAME decision core as the read route (decideSessionFileAccess: realpath
+ * path-guard inside the project root, session evidence outside it, sensitive-location denylist) plus a
+ * handle-based regular-file check. It answers yes/no and a coarse reason ONLY: never content, never a
+ * listing, and a path the session may not see (unevidenced, sensitive, traversal, symlink escape) is
+ * reported as the generic "unavailable" so the probe is no existence oracle beyond the read route.
+ * Read-only (DO-NOT #1); stateless (rule 4): nothing is remembered between calls.
+ */
+import path from "node:path";
+import { decideSessionFileAccess, MAX_PATH_CHARS } from "./access.js";
+import { evidenceKey } from "./evidence.js";
+import { probeRegularFile } from "./safe-read.js";
+export const MAX_PROBE_PATHS = 40;
+function lexicallyInside(roots, abs) {
+    return roots.some((r) => {
+        const rel = path.relative(path.resolve(r), abs);
+        return rel === "" || (rel !== ".." && !rel.startsWith(".." + path.sep) && !path.isAbsolute(rel));
+    });
+}
+/** One evidence scan for the whole batch instead of one per path (a scan is a pass over up to 48 MB). */
+function batchedEvidence(args) {
+    const wanted = args.paths
+        .filter((p) => p && p.length <= MAX_PATH_CHARS && !p.includes("\0") && path.isAbsolute(p))
+        .map((p) => path.resolve(p))
+        .filter((abs) => !lexicallyInside(args.roots, abs));
+    const keys = new Set(wanted.map(evidenceKey));
+    let first = null;
+    return async (candidates) => {
+        if (wanted.length === 0 || !candidates.every((c) => keys.has(evidenceKey(c))))
+            return args.findEvidence(candidates);
+        first ??= args.findEvidence([...new Set(wanted)]);
+        const batch = await first;
+        return { found: new Set(candidates.map(evidenceKey).filter((k) => batch.found.has(k))), incomplete: batch.incomplete };
+    };
+}
+export async function probeOpenable(args) {
+    const findEvidence = batchedEvidence(args);
+    const out = [];
+    for (const requested of args.paths) {
+        const d = await decideSessionFileAccess({ roots: args.roots, requested, findEvidence });
+        if (!d.ok) {
+            out.push({ openable: false, reason: d.status === 404 ? "not_found" : "unavailable" });
+            continue;
+        }
+        if (!args.previewable(d.absolute)) {
+            out.push({ openable: false, reason: "not_previewable" });
+            continue;
+        }
+        const f = await probeRegularFile(d.absolute, args.maxBytes);
+        if (f.kind === "too_large") {
+            out.push({ openable: false, reason: "not_previewable" });
+            continue;
+        }
+        if (f.kind === "file")
+            out.push({ openable: true });
+        else
+            out.push({ openable: false, reason: f.kind === "not_found" ? "not_found" : f.kind === "not_a_file" ? "not_a_file" : "unavailable" });
+    }
+    return out;
+}
+//# sourceMappingURL=probe.js.map

package/server/dist/core/session-file/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../../src/core/session-file/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAmB,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAgBlC,SAAS,eAAe,CAAC,KAAe,EAAE,GAAW;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,SAAS,eAAe,CAAC,IAAe;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,cAAc,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;SACzF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SAC3B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9C,IAAI,KAAK,GAAgE,IAAI,CAAC;IAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,EAAE;QAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACpH,KAAK,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;IACzH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAe;IACjD,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,MAAM,uBAAuB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YACtF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;;YAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/server/dist/core/session-file/safe-read.d.ts

@@ -0,0 +1,33 @@
+export type SafeReadResult = {
+    kind: "ok";
+    bytes: Buffer;
+} | {
+    kind: "not_found";
+} | {
+    kind: "not_a_file";
+} | {
+    kind: "too_large";
+    size: number;
+} | {
+    kind: "error";
+    detail: string;
+};
+export type RegularFileProbe = {
+    kind: "file";
+} | {
+    kind: "not_found";
+} | {
+    kind: "not_a_file";
+} | {
+    kind: "too_large";
+} | {
+    kind: "error";
+};
+/**
+ * Existence probe for ONE already-authorised, realpath'd path: a single open, the verdict taken from the
+ * handle (js/file-system-race), nothing read. Same swap guards as readRegularFileCapped.
+ */
+export declare function probeRegularFile(p: string, maxBytes?: number): Promise<RegularFileProbe>;
+/** `p` MUST be the output of realpath(): anything else is treated as an ancestor swap and refused. */
+export declare function readRegularFileCapped(p: string, maxBytes: number): Promise<SafeReadResult>;
+//# sourceMappingURL=safe-read.d.ts.map

package/server/dist/core/session-file/safe-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-read.d.ts","sourceRoot":"","sources":["../../../src/core/session-file/safe-read.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE7I;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuB9F;AAED,sGAAsG;AACtG,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAiChG"}

package/server/dist/core/session-file/safe-read.js

@@ -0,0 +1,103 @@
+/*
+ * Read ONE regular file with a single open and every check on the open handle
+ * (CodeQL js/file-system-race: a path-based stat followed by a read lets the
+ * file change in between). Read-only (CLAUDE.md DO-NOT #1).
+ *   - O_NOFOLLOW (POSIX) refuses a symlink planted at the final component;
+ *     O_NONBLOCK keeps a FIFO from blocking the open.
+ *   - fh.stat() must say regular file, within `maxBytes`.
+ *   - Windows has no O_NOFOLLOW: a post-open lstat must agree (not a symlink,
+ *     same dev+ino as the handle actually opened).
+ *   - O_NOFOLLOW guards only the LAST component: after the open, the path must
+ *     still resolve to ITSELF (callers pass an already-realpath'd path), which
+ *     catches an ancestor directory swapped for a link since authorization.
+ *     Portable handle-anchored traversal does not exist in Node; this narrows
+ *     the window rather than closing it (recorded residual risk).
+ * No directory is ever listed; a directory fails the isFile() check.
+ */
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+const FLAGS = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+/**
+ * Existence probe for ONE already-authorised, realpath'd path: a single open, the verdict taken from the
+ * handle (js/file-system-race), nothing read. Same swap guards as readRegularFileCapped.
+ */
+export async function probeRegularFile(p, maxBytes) {
+    let fh;
+    try {
+        fh = await open(p, FLAGS);
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return { kind: "not_found" };
+        if (code === "ELOOP" || code === "EISDIR")
+            return { kind: "not_a_file" };
+        return { kind: "error" };
+    }
+    try {
+        const st = await fh.stat({ bigint: true });
+        if (!st.isFile())
+            return { kind: "not_a_file" };
+        if ((await realpath(p)) !== p)
+            return { kind: "not_a_file" };
+        const link = await lstat(p, { bigint: true });
+        if (link.isSymbolicLink() || link.dev !== st.dev || link.ino !== st.ino)
+            return { kind: "not_a_file" };
+        if (maxBytes !== undefined && st.size > BigInt(maxBytes))
+            return { kind: "too_large" };
+        return { kind: "file" };
+    }
+    catch {
+        return { kind: "error" };
+    }
+    finally {
+        await fh.close().catch(() => { });
+    }
+}
+/** `p` MUST be the output of realpath(): anything else is treated as an ancestor swap and refused. */
+export async function readRegularFileCapped(p, maxBytes) {
+    let fh;
+    try {
+        fh = await open(p, FLAGS);
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT")
+            return { kind: "not_found" };
+        // ELOOP (symlink under O_NOFOLLOW), EISDIR, EACCES/EPERM: nothing readable here.
+        if (code === "ELOOP" || code === "EISDIR")
+            return { kind: "not_a_file" };
+        return { kind: "error", detail: String(code ?? err).slice(0, 80) };
+    }
+    try {
+        const st = await fh.stat({ bigint: true });
+        if (!st.isFile())
+            return { kind: "not_a_file" };
+        if (st.size > BigInt(maxBytes))
+            return { kind: "too_large", size: Number(st.size) };
+        // realpath on BOTH sides of the lstat narrows the swap-and-restore window (no O_NOFOLLOW on Windows).
+        if ((await realpath(p)) !== p)
+            return { kind: "not_a_file" };
+        const link = await lstat(p, { bigint: true });
+        if (link.isSymbolicLink() || link.dev !== st.dev || link.ino !== st.ino)
+            return { kind: "not_a_file" };
+        if ((await realpath(p)) !== p)
+            return { kind: "not_a_file" };
+        const buf = Buffer.alloc(Number(st.size));
+        let off = 0;
+        while (off < buf.length) {
+            const { bytesRead } = await fh.read(buf, off, buf.length - off, off);
+            if (bytesRead === 0)
+                break;
+            off += bytesRead;
+        }
+        return { kind: "ok", bytes: buf.subarray(0, off) };
+    }
+    catch (err) {
+        return { kind: "error", detail: String(err?.code ?? err).slice(0, 80) };
+    }
+    finally {
+        await fh.close().catch(() => { });
+    }
+}
+//# sourceMappingURL=safe-read.js.map

package/server/dist/core/session-file/safe-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-read.js","sourceRoot":"","sources":["../../../src/core/session-file/safe-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;AAW7F;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,CAAS,EAAE,QAAiB;IACjE,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC1E,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACvG,IAAI,QAAQ,KAAK,SAAS,IAAI,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACvF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,CAAS,EAAE,QAAgB;IACrE,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACpD,iFAAiF;QACjF,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAChD,IAAI,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACpF,sGAAsG;QACtG,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACvG,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;YACrE,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM;YAC3B,GAAG,IAAI,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAE,GAA6B,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACrG,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC"}

package/server/dist/core/session-file/sensitive.d.ts

@@ -0,0 +1,5 @@
+type Scope = "project" | "outside";
+/** True when `p` (any separator style, any case) names a credential-bearing location in `scope`. */
+export declare function isSensitivePath(p: string, scope?: Scope): boolean;
+export {};
+//# sourceMappingURL=sensitive.d.ts.map

package/server/dist/core/session-file/sensitive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive.d.ts","sourceRoot":"","sources":["../../../src/core/session-file/sensitive.ts"],"names":[],"mappings":"AAcA,KAAK,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;AAiBnC,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,GAAE,KAAiB,GAAG,OAAO,CAiB5E"}

package/server/dist/core/session-file/sensitive.js

@@ -0,0 +1,52 @@
+/*
+ * Defence in depth for the session-file route: a path that lives in a
+ * credential-bearing location is refused even when the session evidences it.
+ * The extension allowlist (MIME_BY_EXTENSION) already refuses most key
+ * material; these lists cover the text-shaped secrets that slip through it.
+ *
+ *   "project" scope  — a SMALL list of unmistakable secret names, checked on
+ *                      the project-relative path (so ordinary project files such
+ *                      as locales/en/auth.json or .vscode/mcp.json keep working).
+ *   "outside" scope  — the broad list: a file outside the project is only ever
+ *                      served on session evidence, so false positives are cheap.
+ * Best-effort blocklist, not a boundary: the evidence gate is the boundary.
+ */
+const PROJECT_DIRS = new Set([".ssh", ".gnupg", ".aws"]);
+const PROJECT_NAMES = new Set([".npmrc", ".netrc", ".pypirc", ".git-credentials", ".credentials.json", ".claude.json", "known_hosts", "authorized_keys"]);
+const OUTSIDE_DIRS = new Set([
+    ...PROJECT_DIRS, ".kube", ".azure", ".docker", ".git", "gh", "gcloud", "terraform.d", ".vault", ".config", ".cargo", ".m2",
+    "configstore", ".vercel", ".netlify", ".supabase", "github cli", ".pulumi", ".codex", ".gemini", ".wrangler", ".fly",
+]);
+const OUTSIDE_NAMES = new Set([
+    ...PROJECT_NAMES, "credentials", ".vault-token", "hosts.yml", "application_default_credentials.json", "credentials.tfrc.json",
+    "mcp.json", "credentials.toml", "auth.json", ".yarnrc.yml", "ngrok.yml", "kaggle.json", "oauth_creds.json", "settings.local.json", "token.json", "secrets.json", "secret.json", "consolehost_history.txt", "serviceaccount.json",
+]);
+const KEY_NAME = /^id_(rsa|dsa|ecdsa|ed25519)/;
+// Cloud / OAuth credential files with variable names (service-account-prod.json, client_secret_123.json, *-adminsdk-*.json).
+const CRED_JSON = /^(service[-_]?account.*|client[-_]secret.*|.*-adminsdk-.*)\.json$/;
+/** True when `p` (any separator style, any case) names a credential-bearing location in `scope`. */
+export function isSensitivePath(p, scope = "outside") {
+    const parts = p
+        .replaceAll("\x5c", "/")
+        .split("/")
+        .filter((s) => s.length > 0)
+        .map((s) => s.toLowerCase());
+    if (parts.length === 0)
+        return scope === "outside";
+    const base = parts[parts.length - 1];
+    const dirs = parts.slice(0, -1);
+    if (base.startsWith(".env") || base.endsWith(".env"))
+        return true;
+    if (KEY_NAME.test(base) || (scope === "outside" && CRED_JSON.test(base)))
+        return true;
+    // .git/config can carry a token in a remote URL or an extraheader; the rest of .git stays ordinary in project scope.
+    if (scope === "project" && (base === "config" || base === "config.worktree") && dirs.includes(".git"))
+        return true;
+    if ((scope === "project" ? PROJECT_NAMES : OUTSIDE_NAMES).has(base))
+        return true;
+    if (dirs.some((seg) => (scope === "project" ? PROJECT_DIRS : OUTSIDE_DIRS).has(seg)))
+        return true;
+    // Claude's own settings carry env blocks with API keys.
+    return scope === "outside" && dirs.includes(".claude") && base.startsWith("settings");
+}
+//# sourceMappingURL=sensitive.js.map

package/server/dist/core/session-file/sensitive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive.js","sourceRoot":"","sources":["../../../src/core/session-file/sensitive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE1J,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,GAAG,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK;IAC1H,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM;CACrH,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,GAAG,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,sCAAsC,EAAE,uBAAuB;IAC7H,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,yBAAyB,EAAE,qBAAqB;CACjO,CAAC,CAAC;AACH,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,6HAA6H;AAC7H,MAAM,SAAS,GAAG,mEAAmE,CAAC;AAEtF,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,QAAe,SAAS;IACjE,MAAM,KAAK,GAAG,CAAC;SACZ,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC;SACvB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,KAAK,SAAS,CAAC;IACnD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,qHAAqH;IACrH,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,iBAAiB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnH,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClG,wDAAwD;IACxD,OAAO,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACxF,CAAC"}

package/server/dist/core/session-info/collect.d.ts

@@ -0,0 +1,70 @@
+import type { SessionOutputFile } from "./types.js";
+export interface Notification {
+    /** Timestamp of the record that carried it (to tell a resumed agent from a finished one). */
+    at: string | null;
+    taskId: string;
+    toolUseId: string | null;
+    status: string | null;
+    durationMs: number | null;
+    tokens: number | null;
+    toolUses: number | null;
+}
+export interface AgentToolUse {
+    /** run_in_background: its tool_result is only a launch ack; completion arrives as a task-notification. */
+    background: boolean;
+    prompt: string | null;
+    description: string | null;
+}
+export interface ToolResult {
+    at: string | null;
+    isError: boolean;
+    status: string | null;
+    durationMs: number | null;
+    tokens: number | null;
+    toolUses: number | null;
+}
+export interface Facts {
+    /** tool_use ids with no tool_result yet: a long silent tool call is not a dead agent. */
+    pendingUse: Set<string>;
+    /** tool_use id -> result, for foreground subagents (no task-notification) and failed writes. */
+    toolResults: Map<string, ToolResult>;
+    /** output tool_use id -> output key, so an errored write can be retracted. */
+    outputUses: Map<string, string>;
+    /** Per output key, every write attempt, so a rejected one can be retracted exactly. */
+    outputAttempts: Map<string, {
+        id: string | null;
+        ts: string | null;
+        tool: SessionOutputFile["tool"];
+    }[]>;
+    usage: {
+        tokens: number;
+        model: string | null;
+        at: string | null;
+    } | null;
+    /** Index (line ordinal) of the usage line, to order it against compactions. */
+    usageSeq: number;
+    compactions: {
+        at: string | null;
+        preTokens: number | null;
+        postTokens: number | null;
+        seq: number;
+    }[];
+    bridgeSeen: boolean;
+    outputs: Map<string, SessionOutputFile>;
+    notifications: Map<string, Notification>;
+    agentToolUses: Map<string, AgentToolUse>;
+    firstTs: string | null;
+    lastTs: string | null;
+    lastAssistantText: string | null;
+    model: string | null;
+    seq: number;
+}
+export declare function newFacts(): Facts;
+export declare const TEXT_CAP = 4000;
+export declare function outputKey(p: string): string;
+/** First `<name>…</name>` content, by plain string search — `name` is never a pattern. */
+export declare const tag: (body: string, name: string) => string | null;
+/** Cheap timestamp peek so non-matching lines never reach JSON.parse. */
+export declare function quickTimestamp(line: string): string | null;
+export declare function ingestLine(f: Facts, line: string, agentId: string | null): void;
+//# sourceMappingURL=collect.d.ts.map

package/server/dist/core/session-info/collect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collect.d.ts","sourceRoot":"","sources":["../../../src/core/session-info/collect.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIpD,MAAM,WAAW,YAAY;IAC3B,6FAA6F;IAC7F,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,0GAA0G;IAC1G,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,KAAK;IACpB,yFAAyF;IACzF,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,gGAAgG;IAChG,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,8EAA8E;IAC9E,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uFAAuF;IACvF,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;KAAE,EAAE,CAAC,CAAC;IACzG,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1E,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE;QAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvG,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACxC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,QAAQ,IAAI,KAAK,CAmBhC;AAED,eAAO,MAAM,QAAQ,OAAO,CAAC;AAc7B,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3C;AAYD,0FAA0F;AAC1F,eAAO,MAAM,GAAG,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,MAAM,GAAG,IAOzD,CAAC;AAuBF,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK1D;AAgBD,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAsH/E"}