@taliesinb/mash 0.0.0-stage → 0.1.0

package/dist/src/behaviors/types.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Behavior definitions: what an executable WOULD read, write, delete,
+ * execute or connect to, given its argv — without running it.
+ *
+ * A behavior receives abstract argv ({@link AValue}s). At runtime every value
+ * is concrete; during static analysis some are unknown. Definitions should be
+ * conservative: when an argument they need is unknown they still report the
+ * effect with the unknown path (the policy then answers `unknown`), and set
+ * `complete: false` when they cannot tell what the command does at all.
+ */
+import type { AValue, HoleType } from '../analysis/value.ts';
+import type { Effect } from '../policy/effects.ts';
+export type StdinKind = 'pipe' | 'file' | 'null' | 'terminal' | 'unknown';
+export interface Invocation {
+    /** Basename of argv[0]. */
+    name: string;
+    /** Full argv (argv[0] included). */
+    argv: AValue[];
+    /** Working directory (absolute). */
+    cwd: AValue;
+    /** Environment lookup (exported variables). */
+    env(name: string): AValue | undefined;
+    stdin: StdinKind;
+    /**
+     * Static analysis only: did the snippet (possibly) write this concrete path
+     * before this command? Then the file's current contents (a script to
+     * follow) are not what the command will see.
+     */
+    mayHaveChanged?(path: string): boolean;
+}
+export interface OutputInfo {
+    /** Type of the command's stdout (as captured by `$(...)`, trailing newlines stripped). */
+    type: HoleType;
+    /** For `path` outputs: a directory the output lies under. */
+    under?: string;
+    /** Output is a list of lines, each of `type`. */
+    lines?: boolean;
+    /** Exactly known output (e.g. `pwd`, `basename` of a literal). */
+    value?: AValue;
+}
+/** Where nested script text came from (for effect provenance). */
+export interface ScriptInfo {
+    /** The script file (absolute), when the text was read from one. */
+    file?: string;
+}
+export interface BehaviorResult {
+    effects: Effect[];
+    /** Does the command read stdin? Lets the VM avoid pumping stdin into commands that never read it. */
+    readsStdin?: boolean | 'maybe';
+    stdout?: OutputInfo;
+    /** False when the definition could not determine all effects (unknown flags, opaque arguments). */
+    complete?: boolean;
+    /** Free-form notes for reports. */
+    notes?: string[];
+}
+export interface Behavior {
+    /** Command basenames this definition handles. */
+    names: string[];
+    summary?: string;
+    analyze(inv: Invocation, h: BehaviorHelpers): BehaviorResult;
+}
+export interface ParsedArgs {
+    /** Short and long flags seen, by canonical name (value `true` or the option argument). */
+    flags: Map<string, AValue | true>;
+    /** Repeated options (`-e x -e y`), in order. */
+    multi: Map<string, AValue[]>;
+    operands: AValue[];
+    /** Arguments whose role could not be determined (unknown values that might be options). */
+    ambiguous: AValue[];
+    /** Flags not in the spec. */
+    unknownFlags: string[];
+}
+export interface ArgSpec {
+    /** Short flags without arguments, e.g. `'rfiv'`. */
+    short?: string;
+    /** Short flags taking an argument, e.g. `'tS'`. */
+    shortWithArg?: string;
+    /**
+     * Long options: name → takes an argument? A number is how many arguments
+     * it takes (`--cropOffset y x`: 2; the last one is recorded). Values may also
+     * be an alias (`'=r'` maps to short `r`).
+     */
+    long?: Record<string, boolean | number | string>;
+    /** Short flags (in `shortWithArg`) taking more than one argument: `{ c: 2 }`. The last one is recorded. */
+    arity?: Record<string, number>;
+    /** Single-dash long options (`-layout`, `-show_entries x`): `-word` is looked up in `long` first, then parsed as short flags. */
+    longSingle?: boolean;
+    /** Stop option parsing at the first operand (like POSIX getopt; default false = GNU permutation). */
+    posix?: boolean;
+    /** Accept `-<digits>` (`head -20`) as this flag with the digits as its value. */
+    numeric?: string;
+}
+export interface BehaviorHelpers {
+    /** Resolve a (possibly relative) path argument against the invocation's cwd. */
+    resolve(p: AValue): AValue;
+    /** GNU-style argument parsing over abstract values. */
+    parseArgs(args: AValue[], spec: ArgSpec): ParsedArgs;
+    /** Analyze a nested command (xargs, find -exec, env, timeout, sudo...). */
+    subcommand(argv: AValue[], opts?: {
+        stdin?: StdinKind;
+        cwd?: AValue;
+    }): BehaviorResult;
+    /** Analyze a shell script string (bash -c, sh -c, eval); `info.file` names the script file it was read from. */
+    script(source: AValue, positional?: AValue[], info?: ScriptInfo): BehaviorResult;
+    /** Home directory, if known. */
+    home(): AValue | undefined;
+    /**
+     * Hint what an argument *is* when no effect says so: a search pattern
+     * (grep, find -name) or program text (sed/awk/jq programs, `python -c`).
+     * Used for display (syntax highlighting, summaries); no effect on policy.
+     */
+    role(value: AValue, role: ArgRole): void;
+}
+/**
+ * What an argument is, for display. `dir`/`file` come from effects;
+ * `pattern`/`code`/`subcommand` from {@link BehaviorHelpers.role} (and a
+ * table of tools with subcommands in roles.ts).
+ */
+export type ArgRole = 'dir' | 'file' | 'pattern' | 'code' | 'cmd' | 'subcommand';
+//# sourceMappingURL=types.d.ts.map

package/dist/src/behaviors/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/behaviors/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAElD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;AAEzE,MAAM,WAAW,UAAU;IACzB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,oCAAoC;IACpC,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,+CAA+C;IAC/C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,KAAK,EAAE,SAAS,CAAA;IAChB;;;;OAIG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CACvC;AAED,MAAM,WAAW,UAAU;IACzB,0FAA0F;IAC1F,IAAI,EAAE,QAAQ,CAAA;IACd,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,qGAAqG;IACrG,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,eAAe,GAAG,cAAc,CAAA;CAC7D;AAED,MAAM,WAAW,UAAU;IACzB,0FAA0F;IAC1F,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAA;IACjC,gDAAgD;IAChD,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,6BAA6B;IAC7B,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB;AAED,MAAM,WAAW,OAAO;IACtB,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,CAAA;IAChD,2GAA2G;IAC3G,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,iIAAiI;IACjI,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,qGAAqG;IACrG,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1B,uDAAuD;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,GAAG,UAAU,CAAA;IACpD,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,SAAS,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,cAAc,CAAA;IACtF,gHAAgH;IAChH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,cAAc,CAAA;IAChF,gCAAgC;IAChC,IAAI,IAAI,MAAM,GAAG,SAAS,CAAA;IAC1B;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;CACzC;AAED;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,YAAY,CAAA"}

package/dist/src/behaviors/types.js

@@ -0,0 +1,12 @@
+/**
+ * Behavior definitions: what an executable WOULD read, write, delete,
+ * execute or connect to, given its argv — without running it.
+ *
+ * A behavior receives abstract argv ({@link AValue}s). At runtime every value
+ * is concrete; during static analysis some are unknown. Definitions should be
+ * conservative: when an argument they need is unknown they still report the
+ * effect with the unknown path (the policy then answers `unknown`), and set
+ * `complete: false` when they cannot tell what the command does at all.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/behaviors/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/behaviors/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/src/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * mash — a bash virtual machine for agent harnesses.
+ *
+ * - `parse` → span-preserving AST (`./parser/ast.ts`)
+ * - `Machine.analyze` → static effect analysis and pre-flight policy verdict
+ * - `Machine.run` → policy-checked streaming execution with trace events and hooks
+ * - behavior definitions → predicted effects of executables (`./behaviors`)
+ */
+export * as AST from './parser/ast.ts';
+export { parse, ParseError, lineColumn, literalOf, staticWordValue } from './parser/parser.ts';
+export { Machine, type MachineOptions, type RunOptions, type RunResult } from './machine.ts';
+export * from './trace/events.ts';
+export type { Channel, ChannelKind, DataListener } from './vm/io.ts';
+export * from './policy/policy.ts';
+export * from './policy/effects.ts';
+export * from './behaviors/index.ts';
+export * from './analysis/value.ts';
+export { analyzeScript, analyzeSource, type AnalysisReport, type CommandSite, type Violation, type VariableInfo, type AnalyzeOptions } from './analysis/analyze.ts';
+export { defaultSpawn, type SpawnFn, type SpawnRequest } from './vm/external.ts';
+export type { FdPassing } from './vm/fifo.ts';
+export { ProgressTracker, type ProgressSnapshot } from './trace/progress.ts';
+export { format, printScript, type FormatOptions, type FormatResult } from './printer/print.ts';
+export { formatHtml, printScriptHtml, attachHtmlHandlers, HTML_CSS, HTML_SCRIPT, type HtmlOptions, type HtmlResult } from './printer/html.ts';
+export { summarize, summarizeScript, type SummaryOptions, type SummaryResult } from './printer/summary.ts';
+export { argRoles, lexicalRole } from './behaviors/roles.ts';
+export type { ArgRole } from './behaviors/types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAA;AACtC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAC9F,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAC5F,cAAc,mBAAmB,CAAA;AACjC,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACpE,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACnK,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAChF,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC/F,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC7I,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC1G,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/src/index.js

@@ -0,0 +1,24 @@
+/**
+ * mash — a bash virtual machine for agent harnesses.
+ *
+ * - `parse` → span-preserving AST (`./parser/ast.ts`)
+ * - `Machine.analyze` → static effect analysis and pre-flight policy verdict
+ * - `Machine.run` → policy-checked streaming execution with trace events and hooks
+ * - behavior definitions → predicted effects of executables (`./behaviors`)
+ */
+export * as AST from "./parser/ast.js";
+export { parse, ParseError, lineColumn, literalOf, staticWordValue } from "./parser/parser.js";
+export { Machine } from "./machine.js";
+export * from "./trace/events.js";
+export * from "./policy/policy.js";
+export * from "./policy/effects.js";
+export * from "./behaviors/index.js";
+export * from "./analysis/value.js";
+export { analyzeScript, analyzeSource } from "./analysis/analyze.js";
+export { defaultSpawn } from "./vm/external.js";
+export { ProgressTracker } from "./trace/progress.js";
+export { format, printScript } from "./printer/print.js";
+export { formatHtml, printScriptHtml, attachHtmlHandlers, HTML_CSS, HTML_SCRIPT } from "./printer/html.js";
+export { summarize, summarizeScript } from "./printer/summary.js";
+export { argRoles, lexicalRole } from "./behaviors/roles.js";
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAA;AACtC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAC9F,OAAO,EAAE,OAAO,EAAwD,MAAM,cAAc,CAAA;AAC5F,cAAc,mBAAmB,CAAA;AAEjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAiG,MAAM,uBAAuB,CAAA;AACnK,OAAO,EAAE,YAAY,EAAmC,MAAM,kBAAkB,CAAA;AAEhF,OAAO,EAAE,eAAe,EAAyB,MAAM,qBAAqB,CAAA;AAC5E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAyC,MAAM,oBAAoB,CAAA;AAC/F,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAqC,MAAM,mBAAmB,CAAA;AAC7I,OAAO,EAAE,SAAS,EAAE,eAAe,EAA2C,MAAM,sBAAsB,CAAA;AAC1G,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/src/integrations/deepsea.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Adapter for the DeepSea / DeepSeek agent harness (the `deepsea-harness` repo).
+ *
+ * Dependency-free: the harness types are mirrored structurally so this file
+ * can be copied into a harness package (e.g. a `dsh-bash-mash` executor that
+ * registers `ctx.shell`) without importing mash's internals.
+ *
+ * Layering with the harness's existing confinement:
+ * - mash checks every command (and redirection) against the policy BEFORE it
+ *   runs, and rejects whole snippets that would definitely violate it;
+ * - each external command mash spawns is still wrapped by `ctx.sandbox.confine`
+ *   (seatbelt / bwrap / landlock / ACL), so anything mash cannot see
+ *   (an interpreter's own file writes) remains confined by the OS.
+ */
+import type { Policy } from '../policy/policy.ts';
+import { describeEffect } from '../policy/effects.ts';
+import type { SpawnFn } from '../vm/external.ts';
+import { type MachineOptions } from '../machine.ts';
+import type { AnalysisReport } from '../analysis/analyze.ts';
+import type { TraceEvent } from '../trace/events.ts';
+/** Mirrors `SandboxExecutionPolicy` from `@deepseek-ai/dsh-sandbox`. */
+export interface HarnessSandboxPolicy {
+    mode: 'read-only' | 'workspace-write' | 'danger-full-access';
+    workspaceRoot: string;
+    additionalWritableRoots?: readonly string[];
+    sessionId?: string;
+}
+/** Mirrors `SandboxProvider.confine` (the `ctx.sandbox` service). */
+export type ConfineFn = (argv: readonly string[], policy: HarnessSandboxPolicy & {
+    mode: 'read-only' | 'workspace-write';
+}, signal?: AbortSignal) => Promise<{
+    argv: string[];
+}>;
+/**
+ * Map the harness policy onto a mash policy, with optional mash-only
+ * restrictions. Harness defaults: `rm -f` of a path that does not exist is a
+ * no-op, not a violation (`missingDeletes: 'allow'`; existence is re-checked
+ * at runtime just before each delete).
+ */
+export declare function fromHarnessPolicy(p: HarnessSandboxPolicy, extra?: Partial<Policy>): Policy;
+/**
+ * A spawn function that confines every external command through the
+ * harness sandbox provider (per command, instead of once around `bash -c`).
+ */
+export declare function confiningSpawn(confine: ConfineFn, policy: HarnessSandboxPolicy, signal?: AbortSignal): SpawnFn;
+export interface PreflightResult {
+    /** `reject`: refuse the tool call; `check-at-runtime`: run with per-step enforcement; `allow`. */
+    verdict: AnalysisReport['verdict'];
+    /** Model-facing explanation (one line per definite violation). */
+    message: string;
+    report: AnalysisReport;
+}
+/**
+ * Static pre-flight for the `bash` tool: call before executing a snippet and
+ * return `message` as the tool error when `verdict === 'reject'`.
+ */
+export declare function preflight(command: string, opts: {
+    cwd: string;
+    policy: HarnessSandboxPolicy;
+    env?: Record<string, string>;
+    extra?: Partial<Policy>;
+}): PreflightResult;
+/** Mirrors the parts of `ShellRunResult` a tool renders. */
+export interface HarnessRunResult {
+    exitCode: number | null;
+    signal: NodeJS.Signals | null;
+    timedOut: boolean;
+    aborted: boolean;
+    timeoutMs: number;
+    stdout: {
+        text: string;
+        truncated: boolean;
+    };
+    stderr: {
+        text: string;
+        truncated: boolean;
+    };
+    sandbox: {
+        mode: HarnessSandboxPolicy['mode'];
+        denied: boolean;
+    };
+    /** mash extras: pre-flight report and runtime denials. */
+    mash: {
+        preflight: AnalysisReport;
+        denials: {
+            argv: string[];
+            reason: string;
+        }[];
+    };
+}
+export interface HarnessRunOptions {
+    command: string;
+    workdir: string;
+    timeoutMs: number;
+    policy: HarnessSandboxPolicy;
+    env?: Record<string, string>;
+    stdin?: string;
+    signal?: AbortSignal;
+    stdoutMaxBytes?: number;
+    confine?: ConfineFn;
+    /** Live trace events (tool-card progress, stream previews). */
+    onEvent?: (e: TraceEvent) => void;
+    /** Machine options to override (hooks, denyUnknown, ...). */
+    machine?: Partial<MachineOptions>;
+    /**
+     * When mash cannot parse the snippet (unsupported syntax such as extglob):
+     * `bash` runs it with real (confined) bash instead — the current harness
+     * behavior; `error` returns a syntax error. Default `bash`.
+     */
+    onParseError?: 'bash' | 'error';
+}
+/**
+ * Run a `bash` tool call the way `ctx.shell.execute(spec).result()` would,
+ * but through mash: static pre-flight, per-command enforcement, optional
+ * per-command OS confinement, and a live event stream.
+ */
+export declare function runForHarness(o: HarnessRunOptions): Promise<HarnessRunResult>;
+/** One-line description of a trace event, for tool-card progress lines. */
+export declare function describeEvent(e: TraceEvent): string | null;
+export { describeEffect };
+//# sourceMappingURL=deepsea.d.ts.map

package/dist/src/integrations/deepsea.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deepsea.d.ts","sourceRoot":"","sources":["../../../src/integrations/deepsea.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAW,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEpD,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAA;IAC5D,aAAa,EAAE,MAAM,CAAA;IACrB,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,qEAAqE;AACrE,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,oBAAoB,GAAG;IAAE,IAAI,EAAE,WAAW,GAAG,iBAAiB,CAAA;CAAE,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAA;AAEhL;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,GAAE,OAAO,CAAC,MAAM,CAAM,GAAG,MAAM,CAS9F;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAQ9G;AAED,MAAM,WAAW,eAAe;IAC9B,kGAAkG;IAClG,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAA;IAClC,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,cAAc,CAAA;CACvB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,GAAG,eAAe,CAkBtK;AAED,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;IAC7B,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAA;IAC5C,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAA;IAC5C,OAAO,EAAE;QAAE,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;IAChE,0DAA0D;IAC1D,IAAI,EAAE;QAAE,SAAS,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAA;CACnF;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,oBAAoB,CAAA;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,CAAA;IACjC,6DAA6D;IAC7D,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IACjC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqEnF;AAwCD,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAO1D;AAED,OAAO,EAAE,cAAc,EAAE,CAAA"}

package/dist/src/integrations/deepsea.js

@@ -0,0 +1,199 @@
+/**
+ * Adapter for the DeepSea / DeepSeek agent harness (the `deepsea-harness` repo).
+ *
+ * Dependency-free: the harness types are mirrored structurally so this file
+ * can be copied into a harness package (e.g. a `dsh-bash-mash` executor that
+ * registers `ctx.shell`) without importing mash's internals.
+ *
+ * Layering with the harness's existing confinement:
+ * - mash checks every command (and redirection) against the policy BEFORE it
+ *   runs, and rejects whole snippets that would definitely violate it;
+ * - each external command mash spawns is still wrapped by `ctx.sandbox.confine`
+ *   (seatbelt / bwrap / landlock / ACL), so anything mash cannot see
+ *   (an interpreter's own file writes) remains confined by the OS.
+ */
+import { spawn } from 'node:child_process';
+import { describeEffect } from "../policy/effects.js";
+import { Machine } from "../machine.js";
+import { ParseError } from "../parser/parser.js";
+/**
+ * Map the harness policy onto a mash policy, with optional mash-only
+ * restrictions. Harness defaults: `rm -f` of a path that does not exist is a
+ * no-op, not a violation (`missingDeletes: 'allow'`; existence is re-checked
+ * at runtime just before each delete).
+ */
+export function fromHarnessPolicy(p, extra = {}) {
+    return {
+        mode: p.mode,
+        workspaceRoot: p.workspaceRoot,
+        additionalWritableRoots: p.additionalWritableRoots,
+        writableTemp: true,
+        missingDeletes: 'allow',
+        ...extra,
+    };
+}
+/**
+ * A spawn function that confines every external command through the
+ * harness sandbox provider (per command, instead of once around `bash -c`).
+ */
+export function confiningSpawn(confine, policy, signal) {
+    return async (req) => {
+        if (policy.mode === 'danger-full-access') {
+            return spawn(req.file, req.args, { argv0: req.argv0, cwd: req.cwd, env: req.env, stdio: req.stdio });
+        }
+        const { argv } = await confine([req.file, ...req.args], { ...policy, mode: policy.mode }, signal);
+        return spawn(argv[0], argv.slice(1), { cwd: req.cwd, env: req.env, stdio: req.stdio });
+    };
+}
+/**
+ * Static pre-flight for the `bash` tool: call before executing a snippet and
+ * return `message` as the tool error when `verdict === 'reject'`.
+ */
+export function preflight(command, opts) {
+    const m = new Machine({ cwd: opts.cwd, env: opts.env, policy: fromHarnessPolicy(opts.policy, opts.extra) });
+    let report;
+    try {
+        report = m.analyze(command);
+    }
+    catch (e) {
+        if (!(e instanceof ParseError))
+            throw e;
+        // never block on mash's own parsing gaps
+        const r = emptyReport();
+        r.reasons.push(`not analyzed: ${e.message}`);
+        return { verdict: 'check-at-runtime', message: '', report: r };
+    }
+    const message = report.verdict === 'reject'
+        ? `This command was not run: it would definitely violate the ${opts.policy.mode} sandbox policy.\n${report.reasons.map((r) => `- ${r}`).join('\n')}`
+        : report.verdict === 'check-at-runtime'
+            ? `Some steps can only be checked while running:\n${report.violations.slice(0, 8).map((v) => `- line ${v.line}: ${v.effect} (${v.reach})`).join('\n')}`
+            : '';
+    return { verdict: report.verdict, message, report };
+}
+/**
+ * Run a `bash` tool call the way `ctx.shell.execute(spec).result()` would,
+ * but through mash: static pre-flight, per-command enforcement, optional
+ * per-command OS confinement, and a live event stream.
+ */
+export async function runForHarness(o) {
+    const max = o.stdoutMaxBytes ?? 1024 * 1024;
+    const out = [];
+    const err = [];
+    let outBytes = 0;
+    let errBytes = 0;
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), o.timeoutMs);
+    const onAbort = () => ac.abort();
+    o.signal?.addEventListener('abort', onAbort, { once: true });
+    const machine = new Machine({
+        cwd: o.workdir,
+        env: o.env ?? process.env,
+        policy: fromHarnessPolicy(o.policy),
+        stdin: o.stdin ? (async function* () { yield o.stdin; })() : undefined,
+        stdout: (c) => {
+            outBytes += c.length;
+            if (outBytes <= max)
+                out.push(c);
+        },
+        stderr: (c) => {
+            errBytes += c.length;
+            if (errBytes <= max)
+                err.push(c);
+        },
+        spawn: o.confine ? confiningSpawn(o.confine, o.policy, ac.signal) : undefined,
+        background: 'detach',
+        ...o.machine,
+    });
+    if (o.onEvent)
+        machine.on(o.onEvent);
+    let script;
+    try {
+        script = machine.parse(o.command);
+    }
+    catch (e) {
+        if (!(e instanceof ParseError))
+            throw e;
+        clearTimeout(timer);
+        if (o.onParseError === 'error') {
+            return {
+                exitCode: 2, signal: null, timedOut: false, aborted: false, timeoutMs: o.timeoutMs,
+                stdout: { text: '', truncated: false }, stderr: { text: `mash: syntax error: ${e.message}\n`, truncated: false },
+                sandbox: { mode: o.policy.mode, denied: false }, mash: { preflight: emptyReport(), denials: [] },
+            };
+        }
+        return runRealBash(o, e);
+    }
+    const report = machine.analyze(script);
+    const dec = (cs) => Buffer.concat(cs).toString('utf8');
+    if (report.verdict === 'reject') {
+        clearTimeout(timer);
+        const text = `mash: refusing to run: the snippet would definitely violate the sandbox policy\n${report.reasons.map((r) => `  ✗ ${r}\n`).join('')}`;
+        return {
+            exitCode: 126, signal: null, timedOut: false, aborted: false, timeoutMs: o.timeoutMs,
+            stdout: { text: '', truncated: false }, stderr: { text, truncated: false },
+            sandbox: { mode: o.policy.mode, denied: true }, mash: { preflight: report, denials: [] },
+        };
+    }
+    const r = await machine.run(script, { signal: ac.signal });
+    clearTimeout(timer);
+    o.signal?.removeEventListener('abort', onAbort);
+    const timedOut = ac.signal.aborted && !o.signal?.aborted;
+    return {
+        exitCode: r.status,
+        signal: null,
+        timedOut,
+        aborted: o.signal?.aborted ?? false,
+        timeoutMs: o.timeoutMs,
+        stdout: { text: dec(out), truncated: outBytes > max },
+        stderr: { text: dec(err), truncated: errBytes > max },
+        sandbox: { mode: o.policy.mode, denied: r.denials.length > 0 },
+        mash: { preflight: report, denials: r.denials },
+    };
+}
+function emptyReport() {
+    return { commands: [], variables: [], functions: [], violations: [], verdict: 'check-at-runtime', reasons: [] };
+}
+/** Fallback: the snippet as one `bash -c`, confined as a whole (today's harness behavior). */
+async function runRealBash(o, parseError) {
+    const argv = ['bash', '-c', o.command];
+    const confined = o.confine && o.policy.mode !== 'danger-full-access'
+        ? (await o.confine(argv, { ...o.policy, mode: o.policy.mode }, o.signal)).argv
+        : argv;
+    return new Promise((resolve) => {
+        const child = spawn(confined[0], confined.slice(1), { cwd: o.workdir, env: o.env ?? process.env, stdio: ['pipe', 'pipe', 'pipe'], signal: o.signal });
+        const out = [];
+        const err = [];
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGKILL');
+        }, o.timeoutMs);
+        child.stdout.on('data', (d) => out.push(d));
+        child.stderr.on('data', (d) => err.push(d));
+        child.stdin.on('error', () => { }); // EPIPE when bash exits without reading stdin
+        child.stdin.end(o.stdin ?? '');
+        child.on('error', () => { });
+        child.on('close', (code, signal) => {
+            clearTimeout(timer);
+            const report = emptyReport();
+            report.reasons.push(`not analyzed: ${parseError.message}`);
+            resolve({
+                exitCode: code, signal, timedOut, aborted: o.signal?.aborted ?? false, timeoutMs: o.timeoutMs,
+                stdout: { text: Buffer.concat(out).toString('utf8'), truncated: false },
+                stderr: { text: Buffer.concat(err).toString('utf8'), truncated: false },
+                sandbox: { mode: o.policy.mode, denied: false }, mash: { preflight: report, denials: [] },
+            });
+        });
+    });
+}
+/** One-line description of a trace event, for tool-card progress lines. */
+export function describeEvent(e) {
+    switch (e.type) {
+        case 'command:start': return `$ ${e.argv.join(' ')}`;
+        case 'command:denied': return `⛔ ${e.argv.join(' ')}: ${e.reason}`;
+        case 'loop:iteration': return `↻ ${e.variable ? `${e.variable}=${e.value}` : `iteration ${e.iteration}`}`;
+        default: return null;
+    }
+}
+export { describeEffect };
+//# sourceMappingURL=deepsea.js.map

package/dist/src/integrations/deepsea.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deepsea.js","sourceRoot":"","sources":["../../../src/integrations/deepsea.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,OAAO,EAAE,OAAO,EAAuB,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAehD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAuB,EAAE,QAAyB,EAAE;IACpF,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,uBAAuB,EAAE,CAAC,CAAC,uBAAuB;QAClD,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,OAAO;QACvB,GAAG,KAAK;KACT,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAkB,EAAE,MAA4B,EAAE,MAAoB;IACnG,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;QACtG,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;QACjG,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;IACxF,CAAC,CAAA;AACH,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,IAA0G;IACnJ,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC3G,IAAI,MAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC;YAAE,MAAM,CAAC,CAAA;QACvC,yCAAyC;QACzC,MAAM,CAAC,GAAG,WAAW,EAAE,CAAA;QACvB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;QAC5C,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,QAAQ;QACzC,CAAC,CAAC,6DAA6D,IAAI,CAAC,MAAM,CAAC,IAAI,qBAAqB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpJ,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,kBAAkB;YACrC,CAAC,CAAC,kDAAkD,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACvJ,CAAC,CAAC,EAAE,CAAA;IACR,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AACrD,CAAC;AAsCD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAoB;IACtD,MAAM,GAAG,GAAG,CAAC,CAAC,cAAc,IAAI,IAAI,GAAG,IAAI,CAAA;IAC3C,MAAM,GAAG,GAAiB,EAAE,CAAA;IAC5B,MAAM,GAAG,GAAiB,EAAE,CAAA;IAC5B,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IACtC,CAAC,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,GAAG,EAAE,CAAC,CAAC,OAAO;QACd,GAAG,EAAE,CAAC,CAAC,GAAG,IAAK,OAAO,CAAC,GAA8B;QACrD,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC;QACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,MAAM,CAAC,CAAC,KAAM,CAAA,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QACtE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YACZ,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAA;YACpB,IAAI,QAAQ,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClC,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YACZ,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAA;YACpB,IAAI,QAAQ,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7E,UAAU,EAAE,QAAQ;QACpB,GAAG,CAAC,CAAC,OAAO;KACb,CAAC,CAAA;IACF,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACpC,IAAI,MAAoC,CAAA;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC;YAAE,MAAM,CAAC,CAAA;QACvC,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO;gBACL,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;gBAClF,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC,OAAO,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;gBAChH,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;aACjG,CAAA;QACH,CAAC;QACD,OAAO,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,GAAG,GAAG,CAAC,EAAgB,EAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC5E,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,MAAM,IAAI,GAAG,mFAAmF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAA;QAClJ,OAAO;YACL,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;YACpF,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;YAC1E,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;SACzF,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1D,YAAY,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAA;IACxD,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,MAAM;QAClB,MAAM,EAAE,IAAI;QACZ,QAAQ;QACR,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK;QACnC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,GAAG,GAAG,EAAE;QACrD,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,GAAG,GAAG,EAAE;QACrD,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;QAC9D,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;KAChD,CAAA;AACH,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AACjH,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,WAAW,CAAC,CAAoB,EAAE,UAAsB;IACrE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB;QAClE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAC9E,CAAC,CAAC,IAAI,CAAA;IACR,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;QACrJ,MAAM,GAAG,GAAa,EAAE,CAAA;QACxB,MAAM,GAAG,GAAa,EAAE,CAAA;QACxB,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAA;YACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvB,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAA;QACf,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACnD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACnD,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA,CAAC,8CAA8C;QAChF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QAC9B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,MAAM,GAAG,WAAW,EAAE,CAAA;YAC5B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,OAAO,EAAE,CAAC,CAAA;YAC1D,OAAO,CAAC;gBACN,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;gBAC7F,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;gBACvE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;gBACvE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;aAC1F,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,CAAa;IACzC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,eAAe,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;QACpD,KAAK,gBAAgB,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA;QAClE,KAAK,gBAAgB,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,EAAE,CAAA;QACzG,OAAO,CAAC,CAAC,OAAO,IAAI,CAAA;IACtB,CAAC;AACH,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,CAAA"}