@tangle-network/agent-runtime 0.94.3 → 0.94.4

package/dist/{chunk-6SIVHKNH.js → chunk-NSXVEWZT.js}

@@ -8,7 +8,7 @@ import {
   DELEGATION_STATUS_DESCRIPTION,
   DELEGATION_STATUS_INPUT_SCHEMA,
   DELEGATION_STATUS_TOOL_NAME
-} from "./chunk-FDJFHWLD.js";
+} from "./chunk-MDJJHYNQ.js";
 
 // src/mcp/openai-tools.ts
 function buildTool(name, description, parameters) {
@@ -45,4 +45,4 @@ export {
   mcpToolsForRuntimeMcp,
   mcpToolsForRuntimeMcpSubset
 };
-//# sourceMappingURL=chunk-6SIVHKNH.js.map
+//# sourceMappingURL=chunk-NSXVEWZT.js.map

package/dist/{chunk-OXQHAHOM.js → chunk-QUYOHVN7.js}

@@ -5,13 +5,13 @@ import {
   definePersona,
   runPersonified,
   worktreeFanout
-} from "./chunk-7PSFJTJZ.js";
+} from "./chunk-SDR45ZQB.js";
 import {
   runAnalystLoop
 } from "./chunk-ZQZX77MM.js";
 import {
   createExecutorRegistry
-} from "./chunk-FDJFHWLD.js";
+} from "./chunk-MDJJHYNQ.js";
 import {
   ConfigError
 } from "./chunk-YEJR7IXO.js";
@@ -196,4 +196,4 @@ export {
   runLoopRunnerCli,
   parseLoopRunnerArgv
 };
-//# sourceMappingURL=chunk-OXQHAHOM.js.map
+//# sourceMappingURL=chunk-QUYOHVN7.js.map

package/dist/{chunk-2GHZEULG.js → chunk-RRHPT3CQ.js}

@@ -574,6 +574,7 @@ for path in dict.fromkeys(paths):
   return {
     cliVersion,
     executableSha256: opts.executableSha256,
+    requestedPromptSha256: sha256(prompt),
     effectivePromptSha256: sha256(renderedPrompt),
     nonPromptArgsSha256: sha256(JSON.stringify(nonPromptArgs)),
     controlledConfigSha256: opts.controlledConfigSha256,
@@ -1092,4 +1093,4 @@ export {
   runLocalHarness,
   parseCodexTokenUsage
 };
-//# sourceMappingURL=chunk-2GHZEULG.js.map
+//# sourceMappingURL=chunk-RRHPT3CQ.js.map

package/dist/chunk-RRHPT3CQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mcp/codex-diagnostics.ts","../src/mcp/local-harness.ts"],"sourcesContent":["import { constants } from 'node:fs'\nimport { open } from 'node:fs/promises'\nimport { stripVTControlCharacters } from 'node:util'\n\n/** Bounded, credential-redacted process context attached when reproducible Codex output fails\n * validation. The process still fails closed; this only preserves enough evidence to diagnose it. */\nexport interface CodexExecutionFailureDiagnostic {\n  exitCode: number | null\n  killedBySignal: NodeJS.Signals | null\n  timedOut: boolean\n  durationMs: number\n  stdout: string\n  stderr: string\n  stdoutTruncated: boolean\n  stderrTruncated: boolean\n}\n\n/** Thrown when reproducible Codex exits without one valid terminal usage event. */\nexport class CodexExecutionDiagnosticError extends Error {\n  readonly code = 'CODEX_EXECUTION_DIAGNOSTIC'\n\n  constructor(\n    readonly reason: string,\n    readonly diagnostic: CodexExecutionFailureDiagnostic,\n    cause?: unknown,\n  ) {\n    super(\n      `runLocalHarness: reproducible Codex execution failed: ${reason}; diagnostic=${JSON.stringify(diagnostic)}`,\n      { cause },\n    )\n    this.name = 'CodexExecutionDiagnosticError'\n  }\n}\n\nconst CODEX_FAILURE_STREAM_MAX_CHARS = 4096\nconst CODEX_AUTH_MAX_BYTES = 1024 * 1024\nconst CODEX_REDACTED = '<REDACTED_CREDENTIAL>'\nexport const codexSensitiveEnvironmentName = /(TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL|AUTH|COOKIE)/i\n\nexport function createCodexExecutionDiagnosticError(opts: {\n  reason: string\n  exitCode: number | null\n  killedBySignal: NodeJS.Signals | null\n  timedOut: boolean\n  durationMs: number\n  stdout: string\n  stderr: string\n  codexHome: string | undefined\n  redactionValues: string[]\n  cause: unknown\n}): CodexExecutionDiagnosticError {\n  const redact = (value: string) =>\n    redactCodexDiagnostic(value, opts.codexHome, opts.redactionValues)\n  const boundedStdout = boundCodexDiagnostic(redact(opts.stdout))\n  const boundedStderr = boundCodexDiagnostic(redact(opts.stderr))\n  const diagnostic: CodexExecutionFailureDiagnostic = {\n    exitCode: opts.exitCode,\n    killedBySignal: opts.killedBySignal,\n    timedOut: opts.timedOut,\n    durationMs: opts.durationMs,\n    stdout: boundedStdout.value,\n    stderr: boundedStderr.value,\n    stdoutTruncated: boundedStdout.truncated,\n    stderrTruncated: boundedStderr.truncated,\n  }\n  const safeReason = boundCodexDiagnostic(redact(opts.reason), 1024).value\n  return new CodexExecutionDiagnosticError(\n    safeReason,\n    diagnostic,\n    redactCodexErrorCause(opts.cause, safeReason, redact),\n  )\n}\n\nexport function redactCodexHome(value: string, codexHome: string | undefined): string {\n  return codexHome ? value.replaceAll(codexHome, '<ISOLATED_CODEX_HOME>') : value\n}\n\nexport function collectCodexDiagnosticRedactionValues(\n  env: NodeJS.ProcessEnv,\n  authText: string,\n): string[] {\n  const values = Object.entries(env)\n    .filter(\n      ([name, value]) => codexSensitiveEnvironmentName.test(name) && typeof value === 'string',\n    )\n    .map(([, value]) => value as string)\n  try {\n    collectStringLeaves(JSON.parse(authText), values)\n  } catch {\n    // Invalid auth JSON is diagnosed by Codex; generic credential patterns still redact it.\n  }\n  const encoded = values\n    .filter((value) => value.length >= 8)\n    .flatMap((value) => [\n      Buffer.from(value, 'utf8').toString('base64'),\n      Buffer.from(value, 'utf8').toString('base64url'),\n      encodeURIComponent(value),\n      JSON.stringify(value).slice(1, -1),\n    ])\n  return [...new Set([...values, ...encoded])]\n}\n\nexport async function readCodexAuthRedactionText(path: string): Promise<string> {\n  const handle = await open(path, constants.O_RDONLY | constants.O_NONBLOCK)\n  try {\n    const stats = await handle.stat()\n    if (!stats.isFile() || !Number.isSafeInteger(stats.size) || stats.size > CODEX_AUTH_MAX_BYTES) {\n      throw new Error('Codex auth.json must be a regular file no larger than 1 MiB')\n    }\n    const buffer = Buffer.alloc(stats.size)\n    let offset = 0\n    while (offset < buffer.length) {\n      const { bytesRead } = await handle.read(buffer, offset, buffer.length - offset, offset)\n      if (bytesRead === 0) break\n      offset += bytesRead\n    }\n    return buffer.subarray(0, offset).toString('utf8')\n  } finally {\n    await handle.close()\n  }\n}\n\nfunction boundCodexDiagnostic(\n  value: string,\n  maxChars = CODEX_FAILURE_STREAM_MAX_CHARS,\n): { value: string; truncated: boolean } {\n  if (value.length <= maxChars) return { value, truncated: false }\n  const marker = '\\n<... OUTPUT TRUNCATED ...>\\n'\n  const contentChars = maxChars - marker.length\n  const headChars = Math.floor(contentChars / 2)\n  const tailChars = contentChars - headChars\n  return {\n    value: `${value.slice(0, headChars)}${marker}${value.slice(-tailChars)}`,\n    truncated: true,\n  }\n}\n\nfunction redactCodexDiagnostic(\n  value: string,\n  codexHome: string | undefined,\n  protectedValues: ReadonlyArray<string>,\n): string {\n  let redacted = redactCodexHome(stripVTControlCharacters(value), codexHome)\n  const exactValues = [...new Set(protectedValues.filter((item) => item.length >= 6))].sort(\n    (a, b) => b.length - a.length,\n  )\n  for (const secret of exactValues) redacted = redacted.replaceAll(secret, CODEX_REDACTED)\n  redacted = redacted\n    .replace(/(\\bBearer\\s+)[A-Za-z0-9._~+/=-]{6,}/gi, `$1${CODEX_REDACTED}`)\n    .replace(/\\b(?:sk|rk|pk)-[A-Za-z0-9._-]{8,}\\b/g, CODEX_REDACTED)\n    .replace(/\\beyJ[A-Za-z0-9_-]{6,}\\.[A-Za-z0-9_-]{6,}\\.[A-Za-z0-9_-]{6,}\\b/g, CODEX_REDACTED)\n    .replace(\n      /((?:[\"']?(?:api[-_]?key|access[-_]?token|refresh[-_]?token|id[-_]?token|client[-_]?secret|private[-_]?key|session[-_]?(?:id|token)|secret|password|passwd|authorization|credential|cookie)[\"']?)\\s*[:=]\\s*)([\"'])[^\"'\\r\\n]*\\2/gi,\n      `$1$2${CODEX_REDACTED}$2`,\n    )\n    .replace(\n      /((?:[\"']?(?:api[-_]?key|access[-_]?token|refresh[-_]?token|id[-_]?token|client[-_]?secret|private[-_]?key|session[-_]?(?:id|token)|secret|password|passwd|authorization|credential|cookie)[\"']?)\\s*[:=]\\s*)([^\\s,;}]+)/gi,\n      `$1${CODEX_REDACTED}`,\n    )\n  for (const secret of exactValues) redacted = redacted.replaceAll(secret, CODEX_REDACTED)\n  return redacted\n}\n\nfunction redactCodexErrorCause(\n  cause: unknown,\n  safeReason: string,\n  redact: (value: string) => string,\n): Error | undefined {\n  if (!(cause instanceof Error)) return undefined\n  const safeCause = new Error(safeReason)\n  safeCause.name = cause.name\n  if (cause.stack) safeCause.stack = boundCodexDiagnostic(redact(cause.stack)).value\n  return safeCause\n}\n\nfunction collectStringLeaves(value: unknown, output: string[]): void {\n  if (typeof value === 'string') {\n    output.push(value)\n    return\n  }\n  if (Array.isArray(value)) {\n    for (const item of value) collectStringLeaves(item, output)\n    return\n  }\n  if (value !== null && typeof value === 'object') {\n    for (const item of Object.values(value)) collectStringLeaves(item, output)\n  }\n}\n","/**\n *\n * Subprocess wrappers for the local coding-harness CLIs installed in the\n * sandbox image (claude-code, codex, opencode). Used by the in-process\n * delegation executor (`createInProcessExecutor`) so a delegated coding task\n * spawns a real harness on a real git worktree instead of provisioning a\n * sibling sandbox.\n *\n * All harness invocations:\n *   - run with `cwd` set to the worktree\n *   - inherit env from the parent (the MCP server inside the sandbox has\n *     the harness's auth already)\n *   - capture stdout/stderr\n *   - support cancellation via AbortSignal\n *   - enforce a wall-clock timeout\n *\n * @experimental\n */\n\nimport { type ChildProcess, spawn } from 'node:child_process'\nimport { createHash, randomUUID } from 'node:crypto'\nimport { constants, createReadStream } from 'node:fs'\nimport {\n  access,\n  chmod,\n  copyFile,\n  mkdir,\n  mkdtemp,\n  open,\n  readFile,\n  realpath,\n  rm,\n  symlink,\n  writeFile,\n} from 'node:fs/promises'\nimport { homedir, tmpdir } from 'node:os'\nimport { basename, delimiter, dirname, isAbsolute, join, resolve, sep } from 'node:path'\nimport type { AgentProfile } from '@tangle-network/agent-interface'\nimport {\n  codexSensitiveEnvironmentName,\n  collectCodexDiagnosticRedactionValues,\n  createCodexExecutionDiagnosticError,\n  readCodexAuthRedactionText,\n  redactCodexHome,\n} from './codex-diagnostics'\n\nexport type { CodexExecutionFailureDiagnostic } from './codex-diagnostics'\nexport { CodexExecutionDiagnosticError } from './codex-diagnostics'\n\n/** Local coding harness available inside the sandbox. */\nexport type LocalHarness = 'claude' | 'codex' | 'opencode'\n\ntype ReasoningEffort = NonNullable<NonNullable<AgentProfile['model']>['reasoningEffort']>\n\nconst codexReasoningEffort: Record<ReasoningEffort, string> = {\n  none: 'none',\n  minimal: 'minimal',\n  low: 'low',\n  medium: 'medium',\n  high: 'high',\n  xhigh: 'xhigh',\n  ultracode: 'xhigh',\n}\n\nfunction codexReasoningArgs(reasoningEffort: ReasoningEffort): string[] {\n  const mapped = codexReasoningEffort[reasoningEffort]\n  if (mapped === undefined) {\n    throw new Error(\n      `harnessInvocation: unsupported Codex reasoning effort ${String(reasoningEffort)}`,\n    )\n  }\n  return ['-c', `model_reasoning_effort=\"${mapped}\"`]\n}\n\n/**\n * Default per-harness command + arg shape. `buildArgs` takes ONLY the task prompt and\n * emits the prompt-only invocation (no model, no system prompt) — the safe default shape\n * the in-process executor's `streamPrompt` drives. `modelArgs` maps a resolved model to\n * the harness's selector flag (every supported harness takes `-m <model>`). The §1.5\n * profile-aware mapper `harnessInvocation` composes these to thread the full\n * supervisor-authored profile (systemPrompt + model) into argv.\n */\nconst HARNESS_INVOCATIONS: Record<\n  LocalHarness,\n  {\n    command: string\n    buildArgs: (taskPrompt: string) => string[]\n    /** Map a resolved model to the harness's model-selector flag. */\n    modelArgs: (model: string) => string[]\n    /** Map portable reasoning effort when the harness exposes a native control. */\n    reasoningArgs?: (reasoningEffort: ReasoningEffort) => string[]\n  }\n> = {\n  claude: {\n    command: 'claude',\n    // `-p` IS headless/print mode; the old `--headless` flag was removed from the CLI.\n    // Permission bypass is an explicit per-run opt-in below, never the public default.\n    buildArgs: (taskPrompt) => ['-p', taskPrompt],\n    modelArgs: (model) => ['-m', model],\n  },\n  codex: {\n    command: 'codex',\n    buildArgs: (taskPrompt) => ['exec', taskPrompt],\n    modelArgs: (model) => ['-m', model],\n    reasoningArgs: codexReasoningArgs,\n  },\n  opencode: {\n    command: 'opencode',\n    buildArgs: (taskPrompt) => ['run', taskPrompt],\n    modelArgs: (model) => ['-m', model],\n  },\n}\n\n/** Result of mapping an `AgentProfile` + task prompt onto a harness invocation. */\nexport interface HarnessInvocation {\n  command: string\n  args: string[]\n}\n\nexport interface HarnessInvocationOptions {\n  /** Allow an unattended Claude process to edit its isolated candidate worktree.\n   *  Ignored by harnesses that do not use Claude's permission prompt. */\n  dangerouslySkipPermissions?: boolean\n  /** Run Codex with benchmark-safe process controls and JSONL usage output.\n   *  Valid only for the Codex harness. */\n  codexReproducible?: boolean\n}\n\nconst CODEX_REPRODUCIBLE_ARGS = [\n  '--ephemeral',\n  '--ignore-rules',\n  '--json',\n  '-c',\n  'approval_policy=\"never\"',\n  '-c',\n  'web_search=\"disabled\"',\n  '-c',\n  'project_doc_max_bytes=0',\n  '-c',\n  'skills.include_instructions=false',\n  '-c',\n  'include_apps_instructions=false',\n  '--disable',\n  'tool_suggest',\n  '-c',\n  'features.multi_agent_v2.root_agent_usage_hint_text=\"\"',\n  '-c',\n  'features.multi_agent_v2.subagent_usage_hint_text=\"\"',\n  '-c',\n  'features.multi_agent_v2.multi_agent_mode_hint_text=\"\"',\n  '--strict-config',\n] as const\n\nfunction buildHarnessArgs(\n  harness: LocalHarness,\n  taskPrompt: string,\n  options: HarnessInvocationOptions = {},\n): string[] {\n  const args = HARNESS_INVOCATIONS[harness].buildArgs(taskPrompt)\n  if (harness === 'claude' && options.dangerouslySkipPermissions) {\n    args.push('--dangerously-skip-permissions')\n  }\n  if (options.codexReproducible) {\n    if (harness !== 'codex') {\n      throw new Error('harnessInvocation: codexReproducible requires the Codex harness')\n    }\n    args.push(...CODEX_REPRODUCIBLE_ARGS)\n  }\n  return args\n}\n\n/**\n * Map a supervisor-authored `AgentProfile` + the per-task prompt onto a concrete harness\n * `command` + `args` (the §1.5 fix). UNLIKE the prompt-only `HARNESS_INVOCATIONS.buildArgs`\n * — which drops both the authored model and the system prompt — this threads the FULL\n * profile payload into argv:\n *\n *  - `profile.prompt.systemPrompt` → the PROMPT channel: a portable, harness-agnostic\n *    default that prepends the system prompt above the task prompt (`<system>\\n\\n<task>`),\n *    so the authored standing instructions reach EVERY harness (none of the three CLIs\n *    expose a portable replace-system-prompt flag for a one-shot non-interactive run).\n *  - `profile.prompt.instructions[]` → appended prompt sections in authored order.\n *  - `profile.model.default` → the harness's `-m <model>` selector.\n *\n * The task prompt alone is the floor; an empty/absent profile yields exactly the legacy\n * `buildArgs(taskPrompt)` shape so existing callers are byte-identical.\n */\nexport function harnessInvocation(\n  harness: LocalHarness,\n  profile: AgentProfile,\n  taskPrompt: string,\n  options: HarnessInvocationOptions = {},\n): HarnessInvocation {\n  const invocation = HARNESS_INVOCATIONS[harness]\n  if (!invocation) {\n    throw new Error(`harnessInvocation: unknown harness ${String(harness)}`)\n  }\n\n  if (options.codexReproducible) {\n    const model = profile.model?.default\n    if (typeof model !== 'string' || model.trim().length === 0) {\n      throw new Error('harnessInvocation: codexReproducible requires profile.model.default')\n    }\n    if (profile.model?.reasoningEffort === undefined) {\n      throw new Error('harnessInvocation: codexReproducible requires profile.model.reasoningEffort')\n    }\n  }\n\n  const systemPrompt = profile.prompt?.systemPrompt\n  const instructions = profile.prompt?.instructions\n  if (\n    instructions !== undefined &&\n    (!Array.isArray(instructions) ||\n      instructions.some((instruction) => typeof instruction !== 'string'))\n  ) {\n    throw new Error('harnessInvocation: profile.prompt.instructions must be an array of strings')\n  }\n  const promptSections = [\n    ...(typeof systemPrompt === 'string' && systemPrompt.trim().length > 0 ? [systemPrompt] : []),\n    ...(instructions?.filter((instruction) => instruction.trim().length > 0) ?? []),\n    taskPrompt,\n  ]\n  const composedPrompt = promptSections.join('\\n\\n')\n\n  const args = buildHarnessArgs(harness, composedPrompt, options)\n\n  const model = profile.model?.default\n  if (typeof model === 'string' && model.length > 0) {\n    args.push(...invocation.modelArgs(model))\n  }\n\n  const reasoningEffort = profile.model?.reasoningEffort\n  if (reasoningEffort !== undefined && invocation.reasoningArgs) {\n    args.push(...invocation.reasoningArgs(reasoningEffort))\n  }\n\n  return { command: invocation.command, args }\n}\n\n/** @experimental */\nexport interface RunLocalHarnessOptions {\n  harness: LocalHarness\n  /** Working directory for the subprocess (typically a worktree path). */\n  cwd: string\n  /** Prompt forwarded as the harness CLI's task argument. */\n  taskPrompt: string\n  /**\n   * Pre-built command + args (e.g. from `harnessInvocation` so the full authored\n   * `AgentProfile` — systemPrompt + model — reaches the harness). When set it OVERRIDES the\n   * default prompt-only `buildArgs(taskPrompt)` path; `command` defaults to the harness's\n   * default binary when only `args` is supplied. When absent the legacy prompt-only shape\n   * is used unchanged.\n   */\n  invocation?: { command?: string; args: ReadonlyArray<string> }\n  /** Allow autonomous Claude edits without an interactive permission prompt.\n   *  Use only when `cwd` is an isolated candidate worktree. */\n  dangerouslySkipPermissions?: boolean\n  /** Isolate Codex from ambient configuration/instructions and require JSONL token usage.\n   *  The invocation should come from `harnessInvocation(..., { codexReproducible: true })`. */\n  codexReproducible?: boolean\n  /** Absolute host paths that reproducible Codex must not read. The normalized set is compiled\n   *  into the controlled permission profile and its digest is returned in execution evidence. */\n  codexReadDeniedPaths?: ReadonlyArray<string>\n  /** Wall-clock kill deadline (ms). Default 5 min. Subprocess SIGTERMed on expiry. */\n  timeoutMs?: number\n  /** Caller cancellation. SIGTERM is sent on abort. */\n  signal?: AbortSignal\n  /** Override env (defaults to inheriting from the parent). */\n  env?: NodeJS.ProcessEnv\n  /**\n   * Test seam — inject a custom spawner so unit tests can mock the\n   * subprocess without touching the OS. Defaults to node's `child_process.spawn`.\n   */\n  spawn?: (\n    command: string,\n    args: ReadonlyArray<string>,\n    opts: {\n      cwd: string\n      env: NodeJS.ProcessEnv\n      stdio: 'pipe'\n      detached: boolean\n    },\n  ) => ChildProcess\n  /** Test seam for locating the native Codex executable before it is staged in the worktree. */\n  resolveCodexExecutable?: (command: string, env: NodeJS.ProcessEnv) => Promise<string>\n}\n\n/** Exact aggregate usage emitted by Codex's terminal `turn.completed` JSONL event. */\nexport interface CodexTokenUsage {\n  inputTokens: number\n  cachedInputTokens: number\n  outputTokens: number\n  reasoningOutputTokens: number\n}\n\n/** Isolation settings asserted before a reproducible Codex run is allowed to start. */\nexport interface CodexExecutionPolicy {\n  sessionPersistence: 'ephemeral'\n  userConfig: false\n  rules: false\n  projectInstructions: false\n  skillInstructions: false\n  appInstructions: false\n  toolSuggestions: false\n  multiAgentInstructions: false\n  sandbox: 'workspace-write'\n  permissionProfile: 'agent_runtime_reproducible'\n  approvalPolicy: 'never'\n  shellNetwork: false\n  webSearch: false\n  serviceTier: 'default'\n  shellEnvironment: 'core-filtered'\n  loginShell: false\n  credentialsReadable: false\n  hostHomeReadable: false\n  procEnvironment: 'private-sanitized'\n  sensitiveEnvironmentNamesVisible: false\n  parentRepoRead: false\n  gitMetadata: false\n  temporaryDirectory: 'workspace-private'\n  stagedExecutable: 'static-elf-read-only'\n  callerReadDeniedPaths: 'enforced'\n  containerSockets: false\n}\n\n/** Zero-model-call evidence for the exact Codex process about to run. */\nexport interface CodexExecutionEvidence {\n  cliVersion: string\n  executableSha256: string\n  /** SHA-256 of the exact composed prompt argument proved present in the rendered prompt. */\n  requestedPromptSha256: string\n  effectivePromptSha256: string\n  nonPromptArgsSha256: string\n  controlledConfigSha256: string\n  /** Sorted normalized paths compiled into the permission profile. */\n  readDeniedPaths: string[]\n  readDeniedPathsSha256: string\n  readDeniedPathCount: number\n  policy: CodexExecutionPolicy\n}\n\n/** @experimental */\nexport interface LocalHarnessResult {\n  /** OS exit code. `null` when killed before exit. */\n  exitCode: number | null\n  /** Concatenated stdout. */\n  stdout: string\n  /** Concatenated stderr. */\n  stderr: string\n  /** Set when the process exited via signal (timeout / abort). */\n  killedBySignal: NodeJS.Signals | null\n  /** Wall-clock duration ms (spawn → exit). */\n  durationMs: number\n  /** Set when timeoutMs elapsed before exit. */\n  timedOut: boolean\n  /** Present for a reproducible Codex run; parsed from the real terminal JSONL event. */\n  usage?: CodexTokenUsage\n  /** Present for reproducible Codex runs; generated and checked before model execution. */\n  evidence?: CodexExecutionEvidence\n}\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60 * 1000\nconst processKillGraceMs = 250\n\n/**\n * Spawn a local coding harness CLI as a subprocess + collect its output.\n *\n * NOT responsible for parsing the harness's output or extracting a diff —\n * the in-process executor's `streamPrompt` orchestrates `git diff` against\n * the worktree after this resolves. This function is intentionally narrow:\n * spawn, wait, capture, return.\n *\n * Fails loud — throws when:\n *   - `cwd` doesn't exist (subprocess emits ENOENT; surfaced as Error)\n *   - the harness binary is not on PATH (ENOENT)\n *\n * Does NOT throw when:\n *   - the subprocess exits non-zero (`result.exitCode` carries the code)\n *   - the subprocess is aborted / timed out (`result.killedBySignal` /\n *     `result.timedOut` carries the reason)\n *\n * @experimental\n */\nexport async function runLocalHarness(\n  options: RunLocalHarnessOptions,\n): Promise<LocalHarnessResult> {\n  const { harness, cwd, taskPrompt } = options\n  if (options.codexReproducible && harness !== 'codex') {\n    throw new Error('runLocalHarness: codexReproducible requires the Codex harness')\n  }\n  if (options.codexReproducible && process.platform !== 'linux') {\n    throw new Error('runLocalHarness: codexReproducible currently requires Linux')\n  }\n  if (options.codexReadDeniedPaths !== undefined && !options.codexReproducible) {\n    throw new Error('runLocalHarness: codexReadDeniedPaths requires codexReproducible')\n  }\n  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS\n  const spawnImpl = options.spawn ?? spawn\n\n  const invocation = HARNESS_INVOCATIONS[harness]\n  if (!invocation) {\n    throw new Error(`runLocalHarness: unknown harness ${String(harness)}`)\n  }\n\n  const startedAt = Date.now()\n  const requestedCommand = options.invocation?.command ?? invocation.command\n  const args = options.invocation\n    ? [...options.invocation.args]\n    : buildHarnessArgs(harness, taskPrompt, options)\n  if (options.codexReproducible) assertCodexReproducibleInvocation(requestedCommand, args)\n\n  const baseEnv = options.env ?? process.env\n  const isolated = options.codexReproducible\n    ? await isolateCodexHome({\n        baseEnv,\n        cwd,\n        command: requestedCommand,\n        readDeniedPaths: options.codexReadDeniedPaths ?? [],\n        resolveExecutable: options.resolveCodexExecutable ?? resolveCodexNativeExecutable,\n      })\n    : {\n        env: baseEnv,\n        command: requestedCommand,\n        cleanup: async () => undefined,\n        controlledConfigSha256: '',\n        executableSha256: '',\n        readDeniedPathsSha256: '',\n        readDeniedPathCount: 0,\n        readDeniedPaths: [] as string[],\n        diagnosticRedactionValues: [] as string[],\n        ambientAuth: '',\n        isolatedAuth: '',\n        writeProbe: '',\n        stagedWriteProbe: '',\n        deniedProbePaths: [] as string[],\n      }\n  const env = isolated.env\n  const command = isolated.command\n  if (options.codexReproducible) assertCodexReproducibleInvocation(command, args)\n\n  try {\n    const evidence = options.codexReproducible\n      ? await collectCodexExecutionEvidence({\n          command,\n          args,\n          cwd,\n          env,\n          spawn: spawnImpl,\n          controlledConfigSha256: isolated.controlledConfigSha256,\n          executableSha256: isolated.executableSha256,\n          readDeniedPathsSha256: isolated.readDeniedPathsSha256,\n          readDeniedPathCount: isolated.readDeniedPathCount,\n          readDeniedPaths: isolated.readDeniedPaths,\n          ambientAuth: isolated.ambientAuth,\n          isolatedAuth: isolated.isolatedAuth,\n          writeProbe: isolated.writeProbe,\n          stagedWriteProbe: isolated.stagedWriteProbe,\n          deniedProbePaths: isolated.deniedProbePaths,\n          ...(options.signal ? { signal: options.signal } : {}),\n        })\n      : undefined\n    return await new Promise<LocalHarnessResult>((resolve, reject) => {\n      let child: ChildProcess\n      try {\n        child = spawnImpl(command, args, {\n          cwd,\n          env,\n          stdio: 'pipe',\n          detached: process.platform !== 'win32',\n        })\n      } catch (err) {\n        reject(err instanceof Error ? err : new Error(String(err)))\n        return\n      }\n\n      // The harness takes its task as an argv arg, not on stdin. Leaving stdin\n      // OPEN makes a non-TTY `opencode run` (and likely the other harnesses)\n      // BLOCK forever waiting on input — zero output, SIGTERM at the wall cap,\n      // empty patch -> \"no candidate passed validation\". Close stdin so the\n      // subprocess sees EOF and proceeds (the `cliExecutor` leaf does the same).\n      child.stdin?.end()\n\n      let stdout = ''\n      let stderr = ''\n      let timedOut = false\n      let settled = false\n      let forceKillTimer: ReturnType<typeof setTimeout> | null = null\n      let terminationStarted = false\n\n      const terminate = () => {\n        if (terminationStarted) return\n        terminationStarted = true\n        signalProcessTree(child, 'SIGTERM')\n        forceKillTimer = setTimeout(() => signalProcessTree(child, 'SIGKILL'), processKillGraceMs)\n        forceKillTimer.unref?.()\n      }\n\n      const timer =\n        timeoutMs > 0\n          ? setTimeout(() => {\n              timedOut = true\n              terminate()\n            }, timeoutMs)\n          : null\n      if (timer && typeof (timer as { unref?: () => void }).unref === 'function') {\n        ;(timer as { unref: () => void }).unref()\n      }\n\n      const onAbort = () => {\n        terminate()\n      }\n      if (options.signal) {\n        if (options.signal.aborted) onAbort()\n        else options.signal.addEventListener('abort', onAbort, { once: true })\n      }\n\n      child.stdout?.on('data', (chunk) => {\n        stdout += String(chunk)\n      })\n      child.stderr?.on('data', (chunk) => {\n        stderr += String(chunk)\n      })\n\n      const finalize = (result: LocalHarnessResult) => {\n        if (settled) return\n        settled = true\n        if (timer) clearTimeout(timer)\n        if (forceKillTimer) clearTimeout(forceKillTimer)\n        options.signal?.removeEventListener('abort', onAbort)\n        resolve(result)\n      }\n\n      child.on('error', (err) => {\n        if (settled) return\n        settled = true\n        if (timer) clearTimeout(timer)\n        if (forceKillTimer) clearTimeout(forceKillTimer)\n        options.signal?.removeEventListener('abort', onAbort)\n        reject(err)\n      })\n\n      child.on('close', (code, signal) => {\n        const durationMs = Date.now() - startedAt\n        try {\n          const usage = options.codexReproducible ? parseCodexTokenUsage(stdout) : undefined\n          finalize({\n            exitCode: code,\n            stdout,\n            stderr: redactCodexHome(stderr, env.CODEX_HOME),\n            killedBySignal: signal,\n            durationMs,\n            timedOut,\n            ...(usage ? { usage } : {}),\n            ...(evidence ? { evidence } : {}),\n          })\n        } catch (err) {\n          if (settled) return\n          settled = true\n          if (timer) clearTimeout(timer)\n          if (forceKillTimer) clearTimeout(forceKillTimer)\n          options.signal?.removeEventListener('abort', onAbort)\n          const reason = err instanceof Error ? err.message : String(err)\n          reject(\n            options.codexReproducible\n              ? createCodexExecutionDiagnosticError({\n                  reason,\n                  exitCode: code,\n                  killedBySignal: signal,\n                  timedOut,\n                  durationMs,\n                  stdout,\n                  stderr,\n                  codexHome: env.CODEX_HOME,\n                  redactionValues: isolated.diagnosticRedactionValues,\n                  cause: err,\n                })\n              : err instanceof Error\n                ? err\n                : new Error(reason),\n          )\n        }\n      })\n    })\n  } finally {\n    await isolated.cleanup()\n  }\n}\n\nconst CODEX_EXECUTION_POLICY: CodexExecutionPolicy = {\n  sessionPersistence: 'ephemeral',\n  userConfig: false,\n  rules: false,\n  projectInstructions: false,\n  skillInstructions: false,\n  appInstructions: false,\n  toolSuggestions: false,\n  multiAgentInstructions: false,\n  sandbox: 'workspace-write',\n  permissionProfile: 'agent_runtime_reproducible',\n  approvalPolicy: 'never',\n  shellNetwork: false,\n  webSearch: false,\n  serviceTier: 'default',\n  shellEnvironment: 'core-filtered',\n  loginShell: false,\n  credentialsReadable: false,\n  hostHomeReadable: false,\n  procEnvironment: 'private-sanitized',\n  sensitiveEnvironmentNamesVisible: false,\n  parentRepoRead: false,\n  gitMetadata: false,\n  temporaryDirectory: 'workspace-private',\n  stagedExecutable: 'static-elf-read-only',\n  callerReadDeniedPaths: 'enforced',\n  containerSockets: false,\n}\n\nconst FORBIDDEN_CODEX_PROMPT_MARKERS = [\n  '<skills_instructions>',\n  '# AGENTS.md instructions',\n  '<apps_instructions>',\n  '<recommended_plugins>',\n  '<multi_agent_mode>',\n  'You are `/root`, the primary agent',\n] as const\n\nasync function collectCodexExecutionEvidence(opts: {\n  command: string\n  args: string[]\n  cwd: string\n  env: NodeJS.ProcessEnv\n  spawn: NonNullable<RunLocalHarnessOptions['spawn']>\n  controlledConfigSha256: string\n  readDeniedPaths: string[]\n  executableSha256: string\n  readDeniedPathsSha256: string\n  readDeniedPathCount: number\n  ambientAuth: string\n  isolatedAuth: string\n  writeProbe: string\n  stagedWriteProbe: string\n  deniedProbePaths: string[]\n  signal?: AbortSignal\n}): Promise<CodexExecutionEvidence> {\n  assertCodexReproducibleInvocation(opts.command, opts.args)\n  const prompt = opts.args[1]\n  if (opts.args[0] !== 'exec' || typeof prompt !== 'string' || prompt.length === 0) {\n    throw new Error('runLocalHarness: reproducible Codex invocation must be codex exec <prompt>')\n  }\n  const cliVersion = (await runCodexProbe(opts, ['--version'])).stdout.trim()\n  if (!/^codex-cli \\d+\\.\\d+\\.\\d+(?:[-+].+)?$/.test(cliVersion)) {\n    throw new Error(\n      `runLocalHarness: unexpected Codex CLI version output ${JSON.stringify(cliVersion)}`,\n    )\n  }\n\n  const hiddenEnvironmentChecks = [\n    'CODEX_HOME',\n    'CODEX_ACCESS_TOKEN',\n    'CODEX_API_KEY',\n    'OPENAI_API_KEY',\n  ]\n    .map((name) => `test -z \"\\${${name}:-}\"`)\n    .join(' && ')\n  const sandboxProof = [\n    hiddenEnvironmentChecks,\n    'test -r .',\n    '! test -r .git',\n    'touch \"$1\"',\n    'rm \"$1\"',\n    'staged_dir=$(dirname \"$2\")',\n    'test -x \"$staged_dir/codex\"',\n    '! chmod 700 \"$staged_dir\" 2>/dev/null',\n    '! rm \"$staged_dir/codex\" 2>/dev/null',\n    '! touch \"$2\" 2>/dev/null',\n    'shift 2',\n    'for path in \"$@\"; do ! test -r \"$path\" || exit 1; done',\n    'touch \"$TMPDIR/.agent-runtime-tmp-proof\"',\n    'rm \"$TMPDIR/.agent-runtime-tmp-proof\"',\n  ].join(' && ')\n  await runCodexProbe(opts, [\n    'sandbox',\n    '-P',\n    CODEX_PERMISSION_PROFILE,\n    '-C',\n    opts.cwd,\n    'sh',\n    '-c',\n    sandboxProof,\n    'sh',\n    opts.writeProbe,\n    opts.stagedWriteProbe,\n    ...opts.deniedProbePaths,\n  ])\n  await runCodexProbe(opts, [\n    'sandbox',\n    '-P',\n    CODEX_PERMISSION_PROFILE,\n    '-C',\n    opts.cwd,\n    'python3',\n    '-c',\n    `import os,re\npattern=re.compile(br'(TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL|AUTH|COOKIE|CODEX_HOME)', re.I)\npaths=('/proc/1/environ', '/proc/self/environ', f'/proc/{os.getppid()}/environ')\nfor path in dict.fromkeys(paths):\n data=open(path,'rb').read().split(b'\\\\0')\n names=(item.split(b'=',1)[0] for item in data if b'=' in item)\n assert not any(pattern.search(name) for name in names), path`,\n  ])\n  await runCodexProbe(opts, [\n    'sandbox',\n    '-P',\n    CODEX_PERMISSION_PROFILE,\n    '-C',\n    opts.cwd,\n    'python3',\n    '-c',\n    'import socket,sys\\nfor path in sys.argv[1:]:\\n s=socket.socket(socket.AF_UNIX)\\n try: s.connect(path)\\n except OSError: continue\\n raise SystemExit(1)',\n    '/var/run/docker.sock',\n    '/run/docker.sock',\n    '/var/run/containerd/containerd.sock',\n    '/run/containerd/containerd.sock',\n  ])\n\n  const debugArgs = codexPromptDebugArgs(opts.args, prompt)\n  const renderedPrompt = (await runCodexProbe(opts, debugArgs)).stdout\n  let parsedPrompt: unknown\n  try {\n    parsedPrompt = JSON.parse(renderedPrompt)\n  } catch {\n    throw new Error('runLocalHarness: codex debug prompt-input returned invalid JSON')\n  }\n  if (!Array.isArray(parsedPrompt) || !jsonTextContains(parsedPrompt, prompt)) {\n    throw new Error('runLocalHarness: Codex prompt evidence did not contain the exact task prompt')\n  }\n  const promptContextWithoutTask = JSON.stringify(redactJsonText(parsedPrompt, prompt))\n  for (const marker of FORBIDDEN_CODEX_PROMPT_MARKERS) {\n    if (promptContextWithoutTask.includes(marker)) {\n      throw new Error(`runLocalHarness: Codex prompt evidence contains forbidden marker ${marker}`)\n    }\n  }\n  for (const marker of ['<permissions instructions>', '<environment_context>']) {\n    if (!renderedPrompt.includes(marker)) {\n      throw new Error(`runLocalHarness: Codex prompt evidence is missing required marker ${marker}`)\n    }\n  }\n\n  const nonPromptArgs = [\n    'codex',\n    ...opts.args.map((arg, index) => (index === 1 ? '<PROMPT>' : arg)),\n  ]\n  return {\n    cliVersion,\n    executableSha256: opts.executableSha256,\n    requestedPromptSha256: sha256(prompt),\n    effectivePromptSha256: sha256(renderedPrompt),\n    nonPromptArgsSha256: sha256(JSON.stringify(nonPromptArgs)),\n    controlledConfigSha256: opts.controlledConfigSha256,\n    readDeniedPathsSha256: opts.readDeniedPathsSha256,\n    readDeniedPathCount: opts.readDeniedPathCount,\n    readDeniedPaths: [...opts.readDeniedPaths],\n    policy: { ...CODEX_EXECUTION_POLICY },\n  }\n}\n\nfunction assertCodexReproducibleInvocation(command: string, args: string[]): void {\n  const executable = basename(command)\n  if (executable !== 'codex' && executable !== 'codex.exe') {\n    throw new Error('runLocalHarness: reproducible Codex invocation must use the Codex executable')\n  }\n  const prompt = args[1]\n  const expectedPrefix = ['exec', prompt, ...CODEX_REPRODUCIBLE_ARGS]\n  const hasExactPrefix = expectedPrefix.every((arg, index) => args[index] === arg)\n  const tail = args.slice(expectedPrefix.length)\n  const validModel =\n    tail[0] === '-m' &&\n    typeof tail[1] === 'string' &&\n    tail[1].length > 0 &&\n    !tail[1].startsWith('-')\n  const validReasoning =\n    tail[2] === '-c' &&\n    typeof tail[3] === 'string' &&\n    /^model_reasoning_effort=\"(?:none|minimal|low|medium|high|xhigh)\"$/.test(tail[3])\n  if (!hasExactPrefix || tail.length !== 4 || !validModel || !validReasoning) {\n    throw new Error(\n      'runLocalHarness: reproducible Codex invocation does not match the required isolated argv',\n    )\n  }\n}\n\nfunction codexPromptDebugArgs(execArgs: string[], prompt: string): string[] {\n  const debugArgs = ['debug', 'prompt-input']\n  for (let index = 2; index < execArgs.length; index += 1) {\n    const arg = execArgs[index]\n    const value = execArgs[index + 1]\n    if (arg === '-c' && value !== undefined) {\n      debugArgs.push('-c', value)\n      index += 1\n    } else if (arg === '--disable' && value !== undefined) {\n      debugArgs.push('--disable', value)\n      index += 1\n    } else if (arg === '-m' && value !== undefined) {\n      debugArgs.push('-c', `model=${JSON.stringify(value)}`)\n      index += 1\n    } else if (arg === '-s' && value !== undefined) {\n      debugArgs.push('-c', `sandbox_mode=${JSON.stringify(value)}`)\n      index += 1\n    }\n  }\n  debugArgs.push(prompt)\n  return debugArgs\n}\n\nfunction runCodexProbe(\n  opts: {\n    command: string\n    cwd: string\n    env: NodeJS.ProcessEnv\n    spawn: NonNullable<RunLocalHarnessOptions['spawn']>\n    signal?: AbortSignal\n  },\n  args: string[],\n): Promise<{ stdout: string; stderr: string }> {\n  return new Promise((resolve, reject) => {\n    let child: ChildProcess\n    try {\n      child = opts.spawn(opts.command, args, {\n        cwd: opts.cwd,\n        env: opts.env,\n        stdio: 'pipe',\n        detached: process.platform !== 'win32',\n      })\n    } catch (err) {\n      reject(err instanceof Error ? err : new Error(String(err)))\n      return\n    }\n    child.stdin?.end()\n    let stdout = ''\n    let stderr = ''\n    let settled = false\n    let forceKillTimer: ReturnType<typeof setTimeout> | null = null\n    const timer = setTimeout(() => {\n      signalProcessTree(child, 'SIGTERM')\n      forceKillTimer = setTimeout(() => signalProcessTree(child, 'SIGKILL'), processKillGraceMs)\n      forceKillTimer.unref?.()\n    }, 10_000)\n    timer.unref?.()\n    const onAbort = () => {\n      signalProcessTree(child, 'SIGTERM')\n      if (!forceKillTimer) {\n        forceKillTimer = setTimeout(() => signalProcessTree(child, 'SIGKILL'), processKillGraceMs)\n        forceKillTimer.unref?.()\n      }\n    }\n    if (opts.signal) {\n      if (opts.signal.aborted) onAbort()\n      else opts.signal.addEventListener('abort', onAbort, { once: true })\n    }\n    child.stdout?.on('data', (chunk) => {\n      stdout += String(chunk)\n    })\n    child.stderr?.on('data', (chunk) => {\n      stderr += String(chunk)\n    })\n    child.on('error', (err) => {\n      if (settled) return\n      settled = true\n      clearTimeout(timer)\n      if (forceKillTimer) clearTimeout(forceKillTimer)\n      opts.signal?.removeEventListener('abort', onAbort)\n      reject(err)\n    })\n    child.on('close', (code, signal) => {\n      if (settled) return\n      settled = true\n      clearTimeout(timer)\n      if (forceKillTimer) clearTimeout(forceKillTimer)\n      opts.signal?.removeEventListener('abort', onAbort)\n      if (code !== 0) {\n        const safeStderr = redactCodexHome(stderr, opts.env.CODEX_HOME)\n        reject(\n          new Error(\n            `runLocalHarness: Codex evidence probe failed (exit ${String(code)}, signal ${String(signal)}): ${safeStderr.trim()}`,\n          ),\n        )\n        return\n      }\n      resolve({ stdout, stderr })\n    })\n  })\n}\n\nfunction sha256(value: string): string {\n  return createHash('sha256').update(value).digest('hex')\n}\n\nfunction jsonTextContains(value: unknown, needle: string): boolean {\n  if (typeof value === 'string') return value.includes(needle)\n  if (Array.isArray(value)) return value.some((item) => jsonTextContains(item, needle))\n  if (isRecord(value)) return Object.values(value).some((item) => jsonTextContains(item, needle))\n  return false\n}\n\nfunction redactJsonText(value: unknown, text: string): unknown {\n  if (typeof value === 'string') return value.replaceAll(text, '')\n  if (Array.isArray(value)) return value.map((item) => redactJsonText(item, text))\n  if (isRecord(value)) {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, item]) => [key, redactJsonText(item, text)]),\n    )\n  }\n  return value\n}\n\nconst CODEX_AUTH_ENV = ['CODEX_ACCESS_TOKEN', 'CODEX_API_KEY', 'OPENAI_API_KEY'] as const\n\nconst CODEX_PERMISSION_PROFILE = 'agent_runtime_reproducible'\n\nasync function isolateCodexHome(opts: {\n  baseEnv: NodeJS.ProcessEnv\n  cwd: string\n  command: string\n  readDeniedPaths: ReadonlyArray<string>\n  resolveExecutable: (command: string, env: NodeJS.ProcessEnv) => Promise<string>\n}): Promise<{\n  env: NodeJS.ProcessEnv\n  command: string\n  cleanup: () => Promise<void>\n  controlledConfigSha256: string\n  executableSha256: string\n  readDeniedPaths: string[]\n  readDeniedPathsSha256: string\n  readDeniedPathCount: number\n  diagnosticRedactionValues: string[]\n  ambientAuth: string\n  isolatedAuth: string\n  writeProbe: string\n  stagedWriteProbe: string\n  deniedProbePaths: string[]\n}> {\n  const isolatedHome = await mkdtemp(join(tmpdir(), 'agent-runtime-codex-'))\n  await chmod(isolatedHome, 0o700)\n  let workspaceTemp = ''\n  let stagedExecutableDir = ''\n  let ownsStagedExecutableDir = false\n  let writeProbe = ''\n  const cleanup = async () => {\n    if (ownsStagedExecutableDir) {\n      await chmod(stagedExecutableDir, 0o700).catch(() => undefined)\n    }\n    await Promise.all([\n      ...(writeProbe ? [rm(writeProbe, { force: true })] : []),\n      ...(workspaceTemp ? [rm(workspaceTemp, { recursive: true, force: true })] : []),\n      ...(ownsStagedExecutableDir\n        ? [rm(stagedExecutableDir, { recursive: true, force: true })]\n        : []),\n      rm(isolatedHome, { recursive: true, force: true }),\n    ])\n  }\n  try {\n    const readDeniedPaths = await normalizeReadDeniedPaths(opts.readDeniedPaths)\n    const candidateRoot = await realpath(opts.cwd)\n    writeProbe = join(candidateRoot, `.agent-runtime-write-proof-${randomUUID()}`)\n    const stagedPath = join(candidateRoot, '.agent-runtime-bin')\n    if (\n      readDeniedPaths.some(\n        (path) =>\n          isSameOrDescendant(candidateRoot, path) ||\n          isSameOrDescendant(stagedPath, path) ||\n          isSameOrDescendant(path, stagedPath),\n      )\n    ) {\n      throw new Error(\n        'runLocalHarness: codexReadDeniedPaths cannot contain the candidate root or staged executable',\n      )\n    }\n    const nativeExecutable = await opts.resolveExecutable(opts.command, opts.baseEnv)\n    if (!(await isStaticElfExecutable(nativeExecutable))) {\n      throw new Error(\n        'runLocalHarness: reproducible Codex mode requires a statically linked Linux Codex ELF',\n      )\n    }\n    const sourceExecutableSha256 = await sha256File(nativeExecutable)\n\n    stagedExecutableDir = stagedPath\n    try {\n      await mkdir(stagedExecutableDir, { mode: 0o700 })\n      ownsStagedExecutableDir = true\n    } catch (err) {\n      throw new Error(\n        `runLocalHarness: candidate-private .agent-runtime-bin must not already exist: ${String((err as NodeJS.ErrnoException).code ?? err)}`,\n      )\n    }\n    const stagedExecutable = join(stagedExecutableDir, 'codex')\n    await copyFile(nativeExecutable, stagedExecutable, constants.COPYFILE_FICLONE)\n    await chmod(stagedExecutable, 0o500)\n    const executableSha256 = await sha256File(stagedExecutable)\n    if (\n      executableSha256 !== sourceExecutableSha256 ||\n      !(await isStaticElfExecutable(stagedExecutable))\n    ) {\n      throw new Error('runLocalHarness: staged Codex executable digest mismatch')\n    }\n    await chmod(stagedExecutableDir, 0o500)\n\n    workspaceTemp = await mkdtemp(join(candidateRoot, '.agent-runtime-tmp-'))\n    await chmod(workspaceTemp, 0o700)\n    const ambientHome = resolve(opts.baseEnv.CODEX_HOME?.trim() || join(homedir(), '.codex'))\n    const ambientAuth = join(ambientHome, 'auth.json')\n    const isolatedAuth = join(isolatedHome, 'auth.json')\n    let authText = ''\n    try {\n      await access(ambientAuth, constants.R_OK)\n      authText = await readCodexAuthRedactionText(ambientAuth)\n      await symlink(ambientAuth, isolatedAuth)\n    } catch (err) {\n      throw new Error(\n        `runLocalHarness: reproducible Codex mode requires readable auth.json: ${String((err as NodeJS.ErrnoException).code ?? err)}`,\n      )\n    }\n    const deniedHostRoots = [homedir(), opts.baseEnv.HOME?.trim(), ambientHome]\n      .filter((path): path is string => Boolean(path))\n      .map((path) => resolve(path))\n      .filter((path, index, paths) => paths.indexOf(path) === index)\n    const controlledConfig = codexControlledConfig({\n      ambientTmp: opts.baseEnv.TMPDIR?.trim() || tmpdir(),\n      deniedHostRoots,\n      workspaceTemp,\n      stagedExecutableDir,\n      readDeniedPaths,\n    })\n    await writeFile(join(isolatedHome, 'config.toml'), controlledConfig, { mode: 0o600 })\n    const env = { ...opts.baseEnv }\n    for (const name of Object.keys(env)) {\n      if (\n        codexSensitiveEnvironmentName.test(name) ||\n        CODEX_AUTH_ENV.some((authName) => authName === name)\n      ) {\n        delete env[name]\n      }\n    }\n    env.CODEX_HOME = isolatedHome\n    const home = homedir()\n    const deniedProbePaths = [\n      ...deniedHostRoots,\n      ambientAuth,\n      isolatedAuth,\n      join(home, '.claude', '.credentials.json'),\n      join(home, '.claude.json'),\n      join(home, '.local', 'share', 'opencode', 'auth.json'),\n      join(home, '.agents'),\n      join(home, 'Documents'),\n      join(home, 'Downloads'),\n      join(home, '.npm'),\n      join(home, 'code'),\n      ...readDeniedPaths,\n    ].filter((path, index, paths) => paths.indexOf(path) === index)\n    return {\n      env,\n      command: stagedExecutable,\n      cleanup,\n      controlledConfigSha256: sha256(controlledConfig),\n      executableSha256,\n      readDeniedPaths,\n      readDeniedPathsSha256: sha256(JSON.stringify(readDeniedPaths)),\n      readDeniedPathCount: readDeniedPaths.length,\n      diagnosticRedactionValues: collectCodexDiagnosticRedactionValues(opts.baseEnv, authText),\n      ambientAuth,\n      isolatedAuth,\n      writeProbe,\n      stagedWriteProbe: join(stagedExecutableDir, 'write-proof'),\n      deniedProbePaths,\n    }\n  } catch (err) {\n    await cleanup()\n    throw err\n  }\n}\n\nfunction codexControlledConfig(opts: {\n  ambientTmp: string\n  deniedHostRoots: string[]\n  workspaceTemp: string\n  stagedExecutableDir: string\n  readDeniedPaths: string[]\n}): string {\n  const rules = new Map<string, 'deny' | 'read' | 'write'>()\n  const broadDeniedPaths = minimalPathRoots([\n    ...opts.deniedHostRoots.map((path) => resolve(path)),\n    tmpdir(),\n    opts.ambientTmp,\n    '/proc',\n    '/run/docker',\n    '/run/containerd',\n  ])\n  for (const path of broadDeniedPaths) {\n    rules.set(path, 'deny')\n  }\n  const workspaceRoot = dirname(opts.workspaceTemp)\n  for (const path of opts.readDeniedPaths) {\n    const alreadyDenied = broadDeniedPaths.some((root) => isSameOrDescendant(path, root))\n    if (!alreadyDenied || isSameOrDescendant(path, workspaceRoot)) rules.set(path, 'deny')\n  }\n  if (!rules.has(opts.workspaceTemp)) rules.set(opts.workspaceTemp, 'write')\n  if (!rules.has(opts.stagedExecutableDir)) rules.set(opts.stagedExecutableDir, 'read')\n  const filesystemRules = [...rules]\n    .sort(([a], [b]) => a.localeCompare(b))\n    .map(([path, access]) => `${JSON.stringify(path)} = ${JSON.stringify(access)}`)\n    .join('\\n')\n  return `default_permissions = \"${CODEX_PERMISSION_PROFILE}\"\napproval_policy = \"never\"\nallow_login_shell = false\nservice_tier = \"default\"\n\n[shell_environment_policy]\ninherit = \"core\"\nignore_default_excludes = false\nexclude = [\"^CODEX_HOME$\", \"(?i).*TOKEN.*\", \"(?i).*KEY.*\", \"(?i).*SECRET.*\", \"(?i).*PASSWORD.*\", \"(?i).*CREDENTIAL.*\", \"(?i).*AUTH.*\", \"(?i).*COOKIE.*\"]\nset = { TMPDIR = ${JSON.stringify(opts.workspaceTemp)} }\n\n[permissions.${CODEX_PERMISSION_PROFILE}.filesystem]\n\":minimal\" = \"read\"\n${filesystemRules}\n\":slash_tmp\" = \"deny\"\n\n[permissions.${CODEX_PERMISSION_PROFILE}.filesystem.\":workspace_roots\"]\n\".\" = \"write\"\n\".git\" = \"deny\"\n\n[permissions.${CODEX_PERMISSION_PROFILE}.network]\nenabled = false\n\n[permissions.${CODEX_PERMISSION_PROFILE}.network.unix_sockets]\n\"/var/run/docker.sock\" = \"deny\"\n\"/run/docker.sock\" = \"deny\"\n\"/var/run/containerd/containerd.sock\" = \"deny\"\n\"/run/containerd/containerd.sock\" = \"deny\"\n`\n}\n\nfunction isSameOrDescendant(path: string, root: string): boolean {\n  const normalizedPath = resolve(path)\n  const normalizedRoot = resolve(root)\n  return normalizedPath === normalizedRoot || normalizedPath.startsWith(`${normalizedRoot}${sep}`)\n}\n\nfunction minimalPathRoots(paths: ReadonlyArray<string>): string[] {\n  const ordered = [...new Set(paths.map((path) => resolve(path)))].sort(\n    (a, b) => a.length - b.length || a.localeCompare(b),\n  )\n  return ordered.filter(\n    (path, index) => !ordered.slice(0, index).some((root) => isSameOrDescendant(path, root)),\n  )\n}\n\nasync function normalizeReadDeniedPaths(paths: ReadonlyArray<string>): Promise<string[]> {\n  if (!Array.isArray(paths)) {\n    throw new Error('runLocalHarness: codexReadDeniedPaths must be an array of absolute paths')\n  }\n  const normalized = new Set<string>()\n  for (const path of paths) {\n    if (typeof path !== 'string' || path.length === 0 || path.includes('\\0') || !isAbsolute(path)) {\n      throw new Error('runLocalHarness: codexReadDeniedPaths must contain absolute paths')\n    }\n    const absolute = resolve(path)\n    normalized.add(absolute)\n    try {\n      normalized.add(await realpath(absolute))\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err\n    }\n  }\n  return [...normalized].sort()\n}\n\nasync function resolveCodexNativeExecutable(\n  command: string,\n  env: NodeJS.ProcessEnv,\n): Promise<string> {\n  const candidates =\n    command.includes(sep) || isAbsolute(command)\n      ? [resolve(command)]\n      : (env.PATH ?? '')\n          .split(delimiter)\n          .filter(Boolean)\n          .map((entry) => join(entry, command))\n  const seen = new Set<string>()\n  for (const candidate of candidates) {\n    let resolved: string\n    try {\n      await access(candidate, constants.X_OK)\n      resolved = await realpath(candidate)\n    } catch {\n      continue\n    }\n    if (seen.has(resolved)) continue\n    seen.add(resolved)\n    if (await isStaticElfExecutable(resolved)) return resolved\n    const packageRoot = await findCodexPackageRoot(resolved)\n    if (!packageRoot) continue\n    const bundled = await findBundledCodexExecutable(packageRoot)\n    if (bundled) return bundled\n  }\n  throw new Error(\n    'runLocalHarness: could not resolve the native Codex executable from the requested command',\n  )\n}\n\nasync function findCodexPackageRoot(file: string): Promise<string | undefined> {\n  let cursor = dirname(file)\n  while (true) {\n    try {\n      const parsed = JSON.parse(await readFile(join(cursor, 'package.json'), 'utf8')) as {\n        name?: unknown\n      }\n      if (parsed.name === '@openai/codex') return cursor\n    } catch {\n      // Keep walking; PATH wrappers commonly live outside the package directory.\n    }\n    const parent = dirname(cursor)\n    if (parent === cursor) return undefined\n    cursor = parent\n  }\n}\n\nasync function findBundledCodexExecutable(packageRoot: string): Promise<string | undefined> {\n  const target = linuxCodexTarget()\n  const candidates = [\n    join(\n      packageRoot,\n      'node_modules',\n      '@openai',\n      target.packageName,\n      'vendor',\n      target.triple,\n      'bin',\n      'codex',\n    ),\n    join(packageRoot, 'vendor', target.triple, 'bin', 'codex'),\n  ]\n  for (const executable of candidates) {\n    if (await isStaticElfExecutable(executable)) return executable\n  }\n  return undefined\n}\n\nfunction linuxCodexTarget(): { packageName: string; triple: string } {\n  if (process.platform !== 'linux') {\n    throw new Error('runLocalHarness: reproducible Codex mode requires Linux')\n  }\n  if (process.arch === 'x64') {\n    return { packageName: 'codex-linux-x64', triple: 'x86_64-unknown-linux-musl' }\n  }\n  if (process.arch === 'arm64') {\n    return { packageName: 'codex-linux-arm64', triple: 'aarch64-unknown-linux-musl' }\n  }\n  throw new Error(`runLocalHarness: unsupported Linux architecture ${process.arch}`)\n}\n\nasync function isStaticElfExecutable(path: string): Promise<boolean> {\n  let handle: Awaited<ReturnType<typeof open>> | undefined\n  try {\n    await access(path, constants.X_OK)\n    handle = await open(path, 'r')\n    const header = Buffer.alloc(64)\n    const { bytesRead } = await handle.read(header, 0, header.length, 0)\n    if (\n      bytesRead !== header.length ||\n      !header.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])) ||\n      header[4] !== 2 ||\n      header[5] !== 1\n    ) {\n      return false\n    }\n    const programHeaderOffset = Number(header.readBigUInt64LE(32))\n    const programHeaderSize = header.readUInt16LE(54)\n    const programHeaderCount = header.readUInt16LE(56)\n    const expectedMachine = process.arch === 'x64' ? 62 : process.arch === 'arm64' ? 183 : -1\n    if (\n      ![2, 3].includes(header.readUInt16LE(16)) ||\n      header.readUInt16LE(18) !== expectedMachine ||\n      !Number.isSafeInteger(programHeaderOffset) ||\n      programHeaderOffset < 64 ||\n      programHeaderSize < 56 ||\n      programHeaderSize > 1024 ||\n      programHeaderCount === 0 ||\n      programHeaderCount > 1024\n    ) {\n      return false\n    }\n    const tableSize = programHeaderSize * programHeaderCount\n    const table = Buffer.alloc(tableSize)\n    const tableRead = await handle.read(table, 0, tableSize, programHeaderOffset)\n    if (tableRead.bytesRead !== tableSize) return false\n    for (let index = 0; index < programHeaderCount; index += 1) {\n      const type = table.readUInt32LE(index * programHeaderSize)\n      if (type === 3) return false\n    }\n    return true\n  } catch {\n    return false\n  } finally {\n    await handle?.close()\n  }\n}\n\nfunction sha256File(path: string): Promise<string> {\n  return new Promise((resolveDigest, reject) => {\n    const hash = createHash('sha256')\n    const stream = createReadStream(path)\n    stream.on('error', reject)\n    stream.on('data', (chunk) => hash.update(chunk))\n    stream.on('end', () => resolveDigest(hash.digest('hex')))\n  })\n}\n\nfunction signalProcessTree(child: ChildProcess, signal: NodeJS.Signals): void {\n  if (process.platform !== 'win32' && typeof child.pid === 'number') {\n    try {\n      process.kill(-child.pid, signal)\n      return\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ESRCH') return\n    }\n  }\n  try {\n    child.kill(signal)\n  } catch {\n    // The process may have exited between the timer and signal delivery.\n  }\n}\n\n/** Parse and validate the one terminal usage event emitted by `codex exec --json`. */\nexport function parseCodexTokenUsage(stdout: string): CodexTokenUsage {\n  const completed: unknown[] = []\n  for (const [index, line] of stdout.split(/\\r?\\n/).entries()) {\n    if (line.trim().length === 0) continue\n    let event: unknown\n    try {\n      event = JSON.parse(line)\n    } catch {\n      throw new Error(`runLocalHarness: Codex JSONL line ${index + 1} is not valid JSON`)\n    }\n    if (isRecord(event) && event.type === 'turn.completed') completed.push(event)\n  }\n  if (completed.length !== 1) {\n    throw new Error(\n      `runLocalHarness: expected exactly one Codex turn.completed usage event, received ${completed.length}`,\n    )\n  }\n  const event = completed[0]\n  if (!isRecord(event) || !isRecord(event.usage)) {\n    throw new Error('runLocalHarness: Codex turn.completed event is missing usage')\n  }\n  const usage = event.usage\n  const inputTokens = naturalNumber(usage.input_tokens, 'input_tokens')\n  const cachedInputTokens = naturalNumber(usage.cached_input_tokens, 'cached_input_tokens')\n  const outputTokens = naturalNumber(usage.output_tokens, 'output_tokens')\n  const reasoningOutputTokens = naturalNumber(\n    usage.reasoning_output_tokens,\n    'reasoning_output_tokens',\n  )\n  if (cachedInputTokens > inputTokens) {\n    throw new Error('runLocalHarness: Codex cached_input_tokens exceeds input_tokens')\n  }\n  if (reasoningOutputTokens > outputTokens) {\n    throw new Error('runLocalHarness: Codex reasoning_output_tokens exceeds output_tokens')\n  }\n  return { inputTokens, cachedInputTokens, outputTokens, reasoningOutputTokens }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\nfunction naturalNumber(value: unknown, field: string): number {\n  if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {\n    throw new Error(`runLocalHarness: Codex usage.${field} must be a non-negative safe integer`)\n  }\n  return value\n}\n"],"mappings":";AAAA,SAAS,iBAAiB;AAC1B,SAAS,YAAY;AACrB,SAAS,gCAAgC;AAgBlC,IAAM,gCAAN,cAA4C,MAAM;AAAA,EAGvD,YACW,QACA,YACT,OACA;AACA;AAAA,MACE,yDAAyD,MAAM,gBAAgB,KAAK,UAAU,UAAU,CAAC;AAAA,MACzG,EAAE,MAAM;AAAA,IACV;AAPS;AACA;AAOT,SAAK,OAAO;AAAA,EACd;AAAA,EATW;AAAA,EACA;AAAA,EAJF,OAAO;AAalB;AAEA,IAAM,iCAAiC;AACvC,IAAM,uBAAuB,OAAO;AACpC,IAAM,iBAAiB;AAChB,IAAM,gCAAgC;AAEtC,SAAS,oCAAoC,MAWlB;AAChC,QAAM,SAAS,CAAC,UACd,sBAAsB,OAAO,KAAK,WAAW,KAAK,eAAe;AACnE,QAAM,gBAAgB,qBAAqB,OAAO,KAAK,MAAM,CAAC;AAC9D,QAAM,gBAAgB,qBAAqB,OAAO,KAAK,MAAM,CAAC;AAC9D,QAAM,aAA8C;AAAA,IAClD,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,IACf,YAAY,KAAK;AAAA,IACjB,QAAQ,cAAc;AAAA,IACtB,QAAQ,cAAc;AAAA,IACtB,iBAAiB,cAAc;AAAA,IAC/B,iBAAiB,cAAc;AAAA,EACjC;AACA,QAAM,aAAa,qBAAqB,OAAO,KAAK,MAAM,GAAG,IAAI,EAAE;AACnE,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA,sBAAsB,KAAK,OAAO,YAAY,MAAM;AAAA,EACtD;AACF;AAEO,SAAS,gBAAgB,OAAe,WAAuC;AACpF,SAAO,YAAY,MAAM,WAAW,WAAW,uBAAuB,IAAI;AAC5E;AAEO,SAAS,sCACd,KACA,UACU;AACV,QAAM,SAAS,OAAO,QAAQ,GAAG,EAC9B;AAAA,IACC,CAAC,CAAC,MAAM,KAAK,MAAM,8BAA8B,KAAK,IAAI,KAAK,OAAO,UAAU;AAAA,EAClF,EACC,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAe;AACrC,MAAI;AACF,wBAAoB,KAAK,MAAM,QAAQ,GAAG,MAAM;AAAA,EAClD,QAAQ;AAAA,EAER;AACA,QAAM,UAAU,OACb,OAAO,CAAC,UAAU,MAAM,UAAU,CAAC,EACnC,QAAQ,CAAC,UAAU;AAAA,IAClB,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,QAAQ;AAAA,IAC5C,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AAAA,IAC/C,mBAAmB,KAAK;AAAA,IACxB,KAAK,UAAU,KAAK,EAAE,MAAM,GAAG,EAAE;AAAA,EACnC,CAAC;AACH,SAAO,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC;AAC7C;AAEA,eAAsB,2BAA2B,MAA+B;AAC9E,QAAM,SAAS,MAAM,KAAK,MAAM,UAAU,WAAW,UAAU,UAAU;AACzE,MAAI;AACF,UAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,QAAI,CAAC,MAAM,OAAO,KAAK,CAAC,OAAO,cAAc,MAAM,IAAI,KAAK,MAAM,OAAO,sBAAsB;AAC7F,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,UAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AACtC,QAAI,SAAS;AACb,WAAO,SAAS,OAAO,QAAQ;AAC7B,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK,QAAQ,QAAQ,OAAO,SAAS,QAAQ,MAAM;AACtF,UAAI,cAAc,EAAG;AACrB,gBAAU;AAAA,IACZ;AACA,WAAO,OAAO,SAAS,GAAG,MAAM,EAAE,SAAS,MAAM;AAAA,EACnD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,SAAS,qBACP,OACA,WAAW,gCAC4B;AACvC,MAAI,MAAM,UAAU,SAAU,QAAO,EAAE,OAAO,WAAW,MAAM;AAC/D,QAAM,SAAS;AACf,QAAM,eAAe,WAAW,OAAO;AACvC,QAAM,YAAY,KAAK,MAAM,eAAe,CAAC;AAC7C,QAAM,YAAY,eAAe;AACjC,SAAO;AAAA,IACL,OAAO,GAAG,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC;AAAA,IACtE,WAAW;AAAA,EACb;AACF;AAEA,SAAS,sBACP,OACA,WACA,iBACQ;AACR,MAAI,WAAW,gBAAgB,yBAAyB,KAAK,GAAG,SAAS;AACzE,QAAM,cAAc,CAAC,GAAG,IAAI,IAAI,gBAAgB,OAAO,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE;AAAA,IACnF,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE;AAAA,EACzB;AACA,aAAW,UAAU,YAAa,YAAW,SAAS,WAAW,QAAQ,cAAc;AACvF,aAAW,SACR,QAAQ,yCAAyC,KAAK,cAAc,EAAE,EACtE,QAAQ,wCAAwC,cAAc,EAC9D,QAAQ,mEAAmE,cAAc,EACzF;AAAA,IACC;AAAA,IACA,OAAO,cAAc;AAAA,EACvB,EACC;AAAA,IACC;AAAA,IACA,KAAK,cAAc;AAAA,EACrB;AACF,aAAW,UAAU,YAAa,YAAW,SAAS,WAAW,QAAQ,cAAc;AACvF,SAAO;AACT;AAEA,SAAS,sBACP,OACA,YACA,QACmB;AACnB,MAAI,EAAE,iBAAiB,OAAQ,QAAO;AACtC,QAAM,YAAY,IAAI,MAAM,UAAU;AACtC,YAAU,OAAO,MAAM;AACvB,MAAI,MAAM,MAAO,WAAU,QAAQ,qBAAqB,OAAO,MAAM,KAAK,CAAC,EAAE;AAC7E,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAgB,QAAwB;AACnE,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,KAAK,KAAK;AACjB;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,QAAQ,MAAO,qBAAoB,MAAM,MAAM;AAC1D;AAAA,EACF;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,eAAW,QAAQ,OAAO,OAAO,KAAK,EAAG,qBAAoB,MAAM,MAAM;AAAA,EAC3E;AACF;;;ACxKA,SAA4B,aAAa;AACzC,SAAS,YAAY,kBAAkB;AACvC,SAAS,aAAAA,YAAW,wBAAwB;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS,cAAc;AAChC,SAAS,UAAU,WAAW,SAAS,YAAY,MAAM,SAAS,WAAW;AAkB7E,IAAM,uBAAwD;AAAA,EAC5D,MAAM;AAAA,EACN,SAAS;AAAA,EACT,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAO;AAAA,EACP,WAAW;AACb;AAEA,SAAS,mBAAmB,iBAA4C;AACtE,QAAM,SAAS,qBAAqB,eAAe;AACnD,MAAI,WAAW,QAAW;AACxB,UAAM,IAAI;AAAA,MACR,yDAAyD,OAAO,eAAe,CAAC;AAAA,IAClF;AAAA,EACF;AACA,SAAO,CAAC,MAAM,2BAA2B,MAAM,GAAG;AACpD;AAUA,IAAM,sBAUF;AAAA,EACF,QAAQ;AAAA,IACN,SAAS;AAAA;AAAA;AAAA,IAGT,WAAW,CAAC,eAAe,CAAC,MAAM,UAAU;AAAA,IAC5C,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK;AAAA,EACpC;AAAA,EACA,OAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,eAAe,CAAC,QAAQ,UAAU;AAAA,IAC9C,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK;AAAA,IAClC,eAAe;AAAA,EACjB;AAAA,EACA,UAAU;AAAA,IACR,SAAS;AAAA,IACT,WAAW,CAAC,eAAe,CAAC,OAAO,UAAU;AAAA,IAC7C,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK;AAAA,EACpC;AACF;AAiBA,IAAM,0BAA0B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,iBACP,SACA,YACA,UAAoC,CAAC,GAC3B;AACV,QAAM,OAAO,oBAAoB,OAAO,EAAE,UAAU,UAAU;AAC9D,MAAI,YAAY,YAAY,QAAQ,4BAA4B;AAC9D,SAAK,KAAK,gCAAgC;AAAA,EAC5C;AACA,MAAI,QAAQ,mBAAmB;AAC7B,QAAI,YAAY,SAAS;AACvB,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AACA,SAAK,KAAK,GAAG,uBAAuB;AAAA,EACtC;AACA,SAAO;AACT;AAkBO,SAAS,kBACd,SACA,SACA,YACA,UAAoC,CAAC,GAClB;AACnB,QAAM,aAAa,oBAAoB,OAAO;AAC9C,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,sCAAsC,OAAO,OAAO,CAAC,EAAE;AAAA,EACzE;AAEA,MAAI,QAAQ,mBAAmB;AAC7B,UAAMC,SAAQ,QAAQ,OAAO;AAC7B,QAAI,OAAOA,WAAU,YAAYA,OAAM,KAAK,EAAE,WAAW,GAAG;AAC1D,YAAM,IAAI,MAAM,qEAAqE;AAAA,IACvF;AACA,QAAI,QAAQ,OAAO,oBAAoB,QAAW;AAChD,YAAM,IAAI,MAAM,6EAA6E;AAAA,IAC/F;AAAA,EACF;AAEA,QAAM,eAAe,QAAQ,QAAQ;AACrC,QAAM,eAAe,QAAQ,QAAQ;AACrC,MACE,iBAAiB,WAChB,CAAC,MAAM,QAAQ,YAAY,KAC1B,aAAa,KAAK,CAAC,gBAAgB,OAAO,gBAAgB,QAAQ,IACpE;AACA,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,iBAAiB;AAAA,IACrB,GAAI,OAAO,iBAAiB,YAAY,aAAa,KAAK,EAAE,SAAS,IAAI,CAAC,YAAY,IAAI,CAAC;AAAA,IAC3F,GAAI,cAAc,OAAO,CAAC,gBAAgB,YAAY,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;AAAA,IAC7E;AAAA,EACF;AACA,QAAM,iBAAiB,eAAe,KAAK,MAAM;AAEjD,QAAM,OAAO,iBAAiB,SAAS,gBAAgB,OAAO;AAE9D,QAAM,QAAQ,QAAQ,OAAO;AAC7B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,SAAK,KAAK,GAAG,WAAW,UAAU,KAAK,CAAC;AAAA,EAC1C;AAEA,QAAM,kBAAkB,QAAQ,OAAO;AACvC,MAAI,oBAAoB,UAAa,WAAW,eAAe;AAC7D,SAAK,KAAK,GAAG,WAAW,cAAc,eAAe,CAAC;AAAA,EACxD;AAEA,SAAO,EAAE,SAAS,WAAW,SAAS,KAAK;AAC7C;AA4HA,IAAM,qBAAqB,IAAI,KAAK;AACpC,IAAM,qBAAqB;AAqB3B,eAAsB,gBACpB,SAC6B;AAC7B,QAAM,EAAE,SAAS,KAAK,WAAW,IAAI;AACrC,MAAI,QAAQ,qBAAqB,YAAY,SAAS;AACpD,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MAAI,QAAQ,qBAAqB,QAAQ,aAAa,SAAS;AAC7D,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,MAAI,QAAQ,yBAAyB,UAAa,CAAC,QAAQ,mBAAmB;AAC5E,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,YAAY,QAAQ,SAAS;AAEnC,QAAM,aAAa,oBAAoB,OAAO;AAC9C,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,oCAAoC,OAAO,OAAO,CAAC,EAAE;AAAA,EACvE;AAEA,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,mBAAmB,QAAQ,YAAY,WAAW,WAAW;AACnE,QAAM,OAAO,QAAQ,aACjB,CAAC,GAAG,QAAQ,WAAW,IAAI,IAC3B,iBAAiB,SAAS,YAAY,OAAO;AACjD,MAAI,QAAQ,kBAAmB,mCAAkC,kBAAkB,IAAI;AAEvF,QAAM,UAAU,QAAQ,OAAO,QAAQ;AACvC,QAAM,WAAW,QAAQ,oBACrB,MAAM,iBAAiB;AAAA,IACrB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,iBAAiB,QAAQ,wBAAwB,CAAC;AAAA,IAClD,mBAAmB,QAAQ,0BAA0B;AAAA,EACvD,CAAC,IACD;AAAA,IACE,KAAK;AAAA,IACL,SAAS;AAAA,IACT,SAAS,YAAY;AAAA,IACrB,wBAAwB;AAAA,IACxB,kBAAkB;AAAA,IAClB,uBAAuB;AAAA,IACvB,qBAAqB;AAAA,IACrB,iBAAiB,CAAC;AAAA,IAClB,2BAA2B,CAAC;AAAA,IAC5B,aAAa;AAAA,IACb,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,kBAAkB,CAAC;AAAA,EACrB;AACJ,QAAM,MAAM,SAAS;AACrB,QAAM,UAAU,SAAS;AACzB,MAAI,QAAQ,kBAAmB,mCAAkC,SAAS,IAAI;AAE9E,MAAI;AACF,UAAM,WAAW,QAAQ,oBACrB,MAAM,8BAA8B;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP,wBAAwB,SAAS;AAAA,MACjC,kBAAkB,SAAS;AAAA,MAC3B,uBAAuB,SAAS;AAAA,MAChC,qBAAqB,SAAS;AAAA,MAC9B,iBAAiB,SAAS;AAAA,MAC1B,aAAa,SAAS;AAAA,MACtB,cAAc,SAAS;AAAA,MACvB,YAAY,SAAS;AAAA,MACrB,kBAAkB,SAAS;AAAA,MAC3B,kBAAkB,SAAS;AAAA,MAC3B,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD,CAAC,IACD;AACJ,WAAO,MAAM,IAAI,QAA4B,CAACC,UAAS,WAAW;AAChE,UAAI;AACJ,UAAI;AACF,gBAAQ,UAAU,SAAS,MAAM;AAAA,UAC/B;AAAA,UACA;AAAA,UACA,OAAO;AAAA,UACP,UAAU,QAAQ,aAAa;AAAA,QACjC,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,eAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAC1D;AAAA,MACF;AAOA,YAAM,OAAO,IAAI;AAEjB,UAAI,SAAS;AACb,UAAI,SAAS;AACb,UAAI,WAAW;AACf,UAAI,UAAU;AACd,UAAI,iBAAuD;AAC3D,UAAI,qBAAqB;AAEzB,YAAM,YAAY,MAAM;AACtB,YAAI,mBAAoB;AACxB,6BAAqB;AACrB,0BAAkB,OAAO,SAAS;AAClC,yBAAiB,WAAW,MAAM,kBAAkB,OAAO,SAAS,GAAG,kBAAkB;AACzF,uBAAe,QAAQ;AAAA,MACzB;AAEA,YAAM,QACJ,YAAY,IACR,WAAW,MAAM;AACf,mBAAW;AACX,kBAAU;AAAA,MACZ,GAAG,SAAS,IACZ;AACN,UAAI,SAAS,OAAQ,MAAiC,UAAU,YAAY;AAC1E;AAAC,QAAC,MAAgC,MAAM;AAAA,MAC1C;AAEA,YAAM,UAAU,MAAM;AACpB,kBAAU;AAAA,MACZ;AACA,UAAI,QAAQ,QAAQ;AAClB,YAAI,QAAQ,OAAO,QAAS,SAAQ;AAAA,YAC/B,SAAQ,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,MACvE;AAEA,YAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU;AAClC,kBAAU,OAAO,KAAK;AAAA,MACxB,CAAC;AACD,YAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU;AAClC,kBAAU,OAAO,KAAK;AAAA,MACxB,CAAC;AAED,YAAM,WAAW,CAAC,WAA+B;AAC/C,YAAI,QAAS;AACb,kBAAU;AACV,YAAI,MAAO,cAAa,KAAK;AAC7B,YAAI,eAAgB,cAAa,cAAc;AAC/C,gBAAQ,QAAQ,oBAAoB,SAAS,OAAO;AACpD,QAAAA,SAAQ,MAAM;AAAA,MAChB;AAEA,YAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,YAAI,QAAS;AACb,kBAAU;AACV,YAAI,MAAO,cAAa,KAAK;AAC7B,YAAI,eAAgB,cAAa,cAAc;AAC/C,gBAAQ,QAAQ,oBAAoB,SAAS,OAAO;AACpD,eAAO,GAAG;AAAA,MACZ,CAAC;AAED,YAAM,GAAG,SAAS,CAAC,MAAM,WAAW;AAClC,cAAM,aAAa,KAAK,IAAI,IAAI;AAChC,YAAI;AACF,gBAAM,QAAQ,QAAQ,oBAAoB,qBAAqB,MAAM,IAAI;AACzE,mBAAS;AAAA,YACP,UAAU;AAAA,YACV;AAAA,YACA,QAAQ,gBAAgB,QAAQ,IAAI,UAAU;AAAA,YAC9C,gBAAgB;AAAA,YAChB;AAAA,YACA;AAAA,YACA,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,YACzB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,UACjC,CAAC;AAAA,QACH,SAAS,KAAK;AACZ,cAAI,QAAS;AACb,oBAAU;AACV,cAAI,MAAO,cAAa,KAAK;AAC7B,cAAI,eAAgB,cAAa,cAAc;AAC/C,kBAAQ,QAAQ,oBAAoB,SAAS,OAAO;AACpD,gBAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC9D;AAAA,YACE,QAAQ,oBACJ,oCAAoC;AAAA,cAClC;AAAA,cACA,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA,WAAW,IAAI;AAAA,cACf,iBAAiB,SAAS;AAAA,cAC1B,OAAO;AAAA,YACT,CAAC,IACD,eAAe,QACb,MACA,IAAI,MAAM,MAAM;AAAA,UACxB;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,UAAM,SAAS,QAAQ;AAAA,EACzB;AACF;AAEA,IAAM,yBAA+C;AAAA,EACnD,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,wBAAwB;AAAA,EACxB,SAAS;AAAA,EACT,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,WAAW;AAAA,EACX,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,kCAAkC;AAAA,EAClC,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,kBAAkB;AACpB;AAEA,IAAM,iCAAiC;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,eAAe,8BAA8B,MAiBT;AAClC,oCAAkC,KAAK,SAAS,KAAK,IAAI;AACzD,QAAM,SAAS,KAAK,KAAK,CAAC;AAC1B,MAAI,KAAK,KAAK,CAAC,MAAM,UAAU,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AAChF,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,MAAM,cAAc,MAAM,CAAC,WAAW,CAAC,GAAG,OAAO,KAAK;AAC1E,MAAI,CAAC,uCAAuC,KAAK,UAAU,GAAG;AAC5D,UAAM,IAAI;AAAA,MACR,wDAAwD,KAAK,UAAU,UAAU,CAAC;AAAA,IACpF;AAAA,EACF;AAEA,QAAM,0BAA0B;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACG,IAAI,CAAC,SAAS,eAAe,IAAI,MAAM,EACvC,KAAK,MAAM;AACd,QAAM,eAAe;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,MAAM;AACb,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AAAA,IACL,GAAG,KAAK;AAAA,EACV,CAAC;AACD,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOF,CAAC;AACD,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,YAAY,qBAAqB,KAAK,MAAM,MAAM;AACxD,QAAM,kBAAkB,MAAM,cAAc,MAAM,SAAS,GAAG;AAC9D,MAAI;AACJ,MAAI;AACF,mBAAe,KAAK,MAAM,cAAc;AAAA,EAC1C,QAAQ;AACN,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,MAAI,CAAC,MAAM,QAAQ,YAAY,KAAK,CAAC,iBAAiB,cAAc,MAAM,GAAG;AAC3E,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AACA,QAAM,2BAA2B,KAAK,UAAU,eAAe,cAAc,MAAM,CAAC;AACpF,aAAW,UAAU,gCAAgC;AACnD,QAAI,yBAAyB,SAAS,MAAM,GAAG;AAC7C,YAAM,IAAI,MAAM,oEAAoE,MAAM,EAAE;AAAA,IAC9F;AAAA,EACF;AACA,aAAW,UAAU,CAAC,8BAA8B,uBAAuB,GAAG;AAC5E,QAAI,CAAC,eAAe,SAAS,MAAM,GAAG;AACpC,YAAM,IAAI,MAAM,qEAAqE,MAAM,EAAE;AAAA,IAC/F;AAAA,EACF;AAEA,QAAM,gBAAgB;AAAA,IACpB;AAAA,IACA,GAAG,KAAK,KAAK,IAAI,CAAC,KAAK,UAAW,UAAU,IAAI,aAAa,GAAI;AAAA,EACnE;AACA,SAAO;AAAA,IACL;AAAA,IACA,kBAAkB,KAAK;AAAA,IACvB,uBAAuB,OAAO,MAAM;AAAA,IACpC,uBAAuB,OAAO,cAAc;AAAA,IAC5C,qBAAqB,OAAO,KAAK,UAAU,aAAa,CAAC;AAAA,IACzD,wBAAwB,KAAK;AAAA,IAC7B,uBAAuB,KAAK;AAAA,IAC5B,qBAAqB,KAAK;AAAA,IAC1B,iBAAiB,CAAC,GAAG,KAAK,eAAe;AAAA,IACzC,QAAQ,EAAE,GAAG,uBAAuB;AAAA,EACtC;AACF;AAEA,SAAS,kCAAkC,SAAiB,MAAsB;AAChF,QAAM,aAAa,SAAS,OAAO;AACnC,MAAI,eAAe,WAAW,eAAe,aAAa;AACxD,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AACA,QAAM,SAAS,KAAK,CAAC;AACrB,QAAM,iBAAiB,CAAC,QAAQ,QAAQ,GAAG,uBAAuB;AAClE,QAAM,iBAAiB,eAAe,MAAM,CAAC,KAAK,UAAU,KAAK,KAAK,MAAM,GAAG;AAC/E,QAAM,OAAO,KAAK,MAAM,eAAe,MAAM;AAC7C,QAAM,aACJ,KAAK,CAAC,MAAM,QACZ,OAAO,KAAK,CAAC,MAAM,YACnB,KAAK,CAAC,EAAE,SAAS,KACjB,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG;AACzB,QAAM,iBACJ,KAAK,CAAC,MAAM,QACZ,OAAO,KAAK,CAAC,MAAM,YACnB,oEAAoE,KAAK,KAAK,CAAC,CAAC;AAClF,MAAI,CAAC,kBAAkB,KAAK,WAAW,KAAK,CAAC,cAAc,CAAC,gBAAgB;AAC1E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,UAAoB,QAA0B;AAC1E,QAAM,YAAY,CAAC,SAAS,cAAc;AAC1C,WAAS,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS,GAAG;AACvD,UAAM,MAAM,SAAS,KAAK;AAC1B,UAAM,QAAQ,SAAS,QAAQ,CAAC;AAChC,QAAI,QAAQ,QAAQ,UAAU,QAAW;AACvC,gBAAU,KAAK,MAAM,KAAK;AAC1B,eAAS;AAAA,IACX,WAAW,QAAQ,eAAe,UAAU,QAAW;AACrD,gBAAU,KAAK,aAAa,KAAK;AACjC,eAAS;AAAA,IACX,WAAW,QAAQ,QAAQ,UAAU,QAAW;AAC9C,gBAAU,KAAK,MAAM,SAAS,KAAK,UAAU,KAAK,CAAC,EAAE;AACrD,eAAS;AAAA,IACX,WAAW,QAAQ,QAAQ,UAAU,QAAW;AAC9C,gBAAU,KAAK,MAAM,gBAAgB,KAAK,UAAU,KAAK,CAAC,EAAE;AAC5D,eAAS;AAAA,IACX;AAAA,EACF;AACA,YAAU,KAAK,MAAM;AACrB,SAAO;AACT;AAEA,SAAS,cACP,MAOA,MAC6C;AAC7C,SAAO,IAAI,QAAQ,CAACA,UAAS,WAAW;AACtC,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,KAAK,SAAS,MAAM;AAAA,QACrC,KAAK,KAAK;AAAA,QACV,KAAK,KAAK;AAAA,QACV,OAAO;AAAA,QACP,UAAU,QAAQ,aAAa;AAAA,MACjC,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,aAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAC1D;AAAA,IACF;AACA,UAAM,OAAO,IAAI;AACjB,QAAI,SAAS;AACb,QAAI,SAAS;AACb,QAAI,UAAU;AACd,QAAI,iBAAuD;AAC3D,UAAM,QAAQ,WAAW,MAAM;AAC7B,wBAAkB,OAAO,SAAS;AAClC,uBAAiB,WAAW,MAAM,kBAAkB,OAAO,SAAS,GAAG,kBAAkB;AACzF,qBAAe,QAAQ;AAAA,IACzB,GAAG,GAAM;AACT,UAAM,QAAQ;AACd,UAAM,UAAU,MAAM;AACpB,wBAAkB,OAAO,SAAS;AAClC,UAAI,CAAC,gBAAgB;AACnB,yBAAiB,WAAW,MAAM,kBAAkB,OAAO,SAAS,GAAG,kBAAkB;AACzF,uBAAe,QAAQ;AAAA,MACzB;AAAA,IACF;AACA,QAAI,KAAK,QAAQ;AACf,UAAI,KAAK,OAAO,QAAS,SAAQ;AAAA,UAC5B,MAAK,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,IACpE;AACA,UAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU;AAClC,gBAAU,OAAO,KAAK;AAAA,IACxB,CAAC;AACD,UAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU;AAClC,gBAAU,OAAO,KAAK;AAAA,IACxB,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,KAAK;AAClB,UAAI,eAAgB,cAAa,cAAc;AAC/C,WAAK,QAAQ,oBAAoB,SAAS,OAAO;AACjD,aAAO,GAAG;AAAA,IACZ,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,MAAM,WAAW;AAClC,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,KAAK;AAClB,UAAI,eAAgB,cAAa,cAAc;AAC/C,WAAK,QAAQ,oBAAoB,SAAS,OAAO;AACjD,UAAI,SAAS,GAAG;AACd,cAAM,aAAa,gBAAgB,QAAQ,KAAK,IAAI,UAAU;AAC9D;AAAA,UACE,IAAI;AAAA,YACF,sDAAsD,OAAO,IAAI,CAAC,YAAY,OAAO,MAAM,CAAC,MAAM,WAAW,KAAK,CAAC;AAAA,UACrH;AAAA,QACF;AACA;AAAA,MACF;AACA,MAAAA,SAAQ,EAAE,QAAQ,OAAO,CAAC;AAAA,IAC5B,CAAC;AAAA,EACH,CAAC;AACH;AAEA,SAAS,OAAO,OAAuB;AACrC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAEA,SAAS,iBAAiB,OAAgB,QAAyB;AACjE,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,SAAS,MAAM;AAC3D,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,KAAK,CAAC,SAAS,iBAAiB,MAAM,MAAM,CAAC;AACpF,MAAI,SAAS,KAAK,EAAG,QAAO,OAAO,OAAO,KAAK,EAAE,KAAK,CAAC,SAAS,iBAAiB,MAAM,MAAM,CAAC;AAC9F,SAAO;AACT;AAEA,SAAS,eAAe,OAAgB,MAAuB;AAC7D,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,WAAW,MAAM,EAAE;AAC/D,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,eAAe,MAAM,IAAI,CAAC;AAC/E,MAAI,SAAS,KAAK,GAAG;AACnB,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,eAAe,MAAM,IAAI,CAAC,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAM,iBAAiB,CAAC,sBAAsB,iBAAiB,gBAAgB;AAE/E,IAAM,2BAA2B;AAEjC,eAAe,iBAAiB,MAqB7B;AACD,QAAM,eAAe,MAAM,QAAQ,KAAK,OAAO,GAAG,sBAAsB,CAAC;AACzE,QAAM,MAAM,cAAc,GAAK;AAC/B,MAAI,gBAAgB;AACpB,MAAI,sBAAsB;AAC1B,MAAI,0BAA0B;AAC9B,MAAI,aAAa;AACjB,QAAM,UAAU,YAAY;AAC1B,QAAI,yBAAyB;AAC3B,YAAM,MAAM,qBAAqB,GAAK,EAAE,MAAM,MAAM,MAAS;AAAA,IAC/D;AACA,UAAM,QAAQ,IAAI;AAAA,MAChB,GAAI,aAAa,CAAC,GAAG,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC;AAAA,MACtD,GAAI,gBAAgB,CAAC,GAAG,eAAe,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC;AAAA,MAC7E,GAAI,0BACA,CAAC,GAAG,qBAAqB,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,CAAC,IAC1D,CAAC;AAAA,MACL,GAAG,cAAc,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IACnD,CAAC;AAAA,EACH;AACA,MAAI;AACF,UAAM,kBAAkB,MAAM,yBAAyB,KAAK,eAAe;AAC3E,UAAM,gBAAgB,MAAM,SAAS,KAAK,GAAG;AAC7C,iBAAa,KAAK,eAAe,8BAA8B,WAAW,CAAC,EAAE;AAC7E,UAAM,aAAa,KAAK,eAAe,oBAAoB;AAC3D,QACE,gBAAgB;AAAA,MACd,CAAC,SACC,mBAAmB,eAAe,IAAI,KACtC,mBAAmB,YAAY,IAAI,KACnC,mBAAmB,MAAM,UAAU;AAAA,IACvC,GACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,mBAAmB,MAAM,KAAK,kBAAkB,KAAK,SAAS,KAAK,OAAO;AAChF,QAAI,CAAE,MAAM,sBAAsB,gBAAgB,GAAI;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,yBAAyB,MAAM,WAAW,gBAAgB;AAEhE,0BAAsB;AACtB,QAAI;AACF,YAAM,MAAM,qBAAqB,EAAE,MAAM,IAAM,CAAC;AAChD,gCAA0B;AAAA,IAC5B,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,iFAAiF,OAAQ,IAA8B,QAAQ,GAAG,CAAC;AAAA,MACrI;AAAA,IACF;AACA,UAAM,mBAAmB,KAAK,qBAAqB,OAAO;AAC1D,UAAM,SAAS,kBAAkB,kBAAkBC,WAAU,gBAAgB;AAC7E,UAAM,MAAM,kBAAkB,GAAK;AACnC,UAAM,mBAAmB,MAAM,WAAW,gBAAgB;AAC1D,QACE,qBAAqB,0BACrB,CAAE,MAAM,sBAAsB,gBAAgB,GAC9C;AACA,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AACA,UAAM,MAAM,qBAAqB,GAAK;AAEtC,oBAAgB,MAAM,QAAQ,KAAK,eAAe,qBAAqB,CAAC;AACxE,UAAM,MAAM,eAAe,GAAK;AAChC,UAAM,cAAc,QAAQ,KAAK,QAAQ,YAAY,KAAK,KAAK,KAAK,QAAQ,GAAG,QAAQ,CAAC;AACxF,UAAM,cAAc,KAAK,aAAa,WAAW;AACjD,UAAM,eAAe,KAAK,cAAc,WAAW;AACnD,QAAI,WAAW;AACf,QAAI;AACF,YAAM,OAAO,aAAaA,WAAU,IAAI;AACxC,iBAAW,MAAM,2BAA2B,WAAW;AACvD,YAAM,QAAQ,aAAa,YAAY;AAAA,IACzC,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,yEAAyE,OAAQ,IAA8B,QAAQ,GAAG,CAAC;AAAA,MAC7H;AAAA,IACF;AACA,UAAM,kBAAkB,CAAC,QAAQ,GAAG,KAAK,QAAQ,MAAM,KAAK,GAAG,WAAW,EACvE,OAAO,CAAC,SAAyB,QAAQ,IAAI,CAAC,EAC9C,IAAI,CAAC,SAAS,QAAQ,IAAI,CAAC,EAC3B,OAAO,CAAC,MAAM,OAAO,UAAU,MAAM,QAAQ,IAAI,MAAM,KAAK;AAC/D,UAAM,mBAAmB,sBAAsB;AAAA,MAC7C,YAAY,KAAK,QAAQ,QAAQ,KAAK,KAAK,OAAO;AAAA,MAClD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,UAAU,KAAK,cAAc,aAAa,GAAG,kBAAkB,EAAE,MAAM,IAAM,CAAC;AACpF,UAAM,MAAM,EAAE,GAAG,KAAK,QAAQ;AAC9B,eAAW,QAAQ,OAAO,KAAK,GAAG,GAAG;AACnC,UACE,8BAA8B,KAAK,IAAI,KACvC,eAAe,KAAK,CAAC,aAAa,aAAa,IAAI,GACnD;AACA,eAAO,IAAI,IAAI;AAAA,MACjB;AAAA,IACF;AACA,QAAI,aAAa;AACjB,UAAM,OAAO,QAAQ;AACrB,UAAM,mBAAmB;AAAA,MACvB,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA,KAAK,MAAM,WAAW,mBAAmB;AAAA,MACzC,KAAK,MAAM,cAAc;AAAA,MACzB,KAAK,MAAM,UAAU,SAAS,YAAY,WAAW;AAAA,MACrD,KAAK,MAAM,SAAS;AAAA,MACpB,KAAK,MAAM,WAAW;AAAA,MACtB,KAAK,MAAM,WAAW;AAAA,MACtB,KAAK,MAAM,MAAM;AAAA,MACjB,KAAK,MAAM,MAAM;AAAA,MACjB,GAAG;AAAA,IACL,EAAE,OAAO,CAAC,MAAM,OAAO,UAAU,MAAM,QAAQ,IAAI,MAAM,KAAK;AAC9D,WAAO;AAAA,MACL;AAAA,MACA,SAAS;AAAA,MACT;AAAA,MACA,wBAAwB,OAAO,gBAAgB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,uBAAuB,OAAO,KAAK,UAAU,eAAe,CAAC;AAAA,MAC7D,qBAAqB,gBAAgB;AAAA,MACrC,2BAA2B,sCAAsC,KAAK,SAAS,QAAQ;AAAA,MACvF;AAAA,MACA;AAAA,MACA;AAAA,MACA,kBAAkB,KAAK,qBAAqB,aAAa;AAAA,MACzD;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,QAAQ;AACd,UAAM;AAAA,EACR;AACF;AAEA,SAAS,sBAAsB,MAMpB;AACT,QAAM,QAAQ,oBAAI,IAAuC;AACzD,QAAM,mBAAmB,iBAAiB;AAAA,IACxC,GAAG,KAAK,gBAAgB,IAAI,CAAC,SAAS,QAAQ,IAAI,CAAC;AAAA,IACnD,OAAO;AAAA,IACP,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,aAAW,QAAQ,kBAAkB;AACnC,UAAM,IAAI,MAAM,MAAM;AAAA,EACxB;AACA,QAAM,gBAAgB,QAAQ,KAAK,aAAa;AAChD,aAAW,QAAQ,KAAK,iBAAiB;AACvC,UAAM,gBAAgB,iBAAiB,KAAK,CAAC,SAAS,mBAAmB,MAAM,IAAI,CAAC;AACpF,QAAI,CAAC,iBAAiB,mBAAmB,MAAM,aAAa,EAAG,OAAM,IAAI,MAAM,MAAM;AAAA,EACvF;AACA,MAAI,CAAC,MAAM,IAAI,KAAK,aAAa,EAAG,OAAM,IAAI,KAAK,eAAe,OAAO;AACzE,MAAI,CAAC,MAAM,IAAI,KAAK,mBAAmB,EAAG,OAAM,IAAI,KAAK,qBAAqB,MAAM;AACpF,QAAM,kBAAkB,CAAC,GAAG,KAAK,EAC9B,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EACrC,IAAI,CAAC,CAAC,MAAMC,OAAM,MAAM,GAAG,KAAK,UAAU,IAAI,CAAC,MAAM,KAAK,UAAUA,OAAM,CAAC,EAAE,EAC7E,KAAK,IAAI;AACZ,SAAO,0BAA0B,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBASxC,KAAK,UAAU,KAAK,aAAa,CAAC;AAAA;AAAA,eAEtC,wBAAwB;AAAA;AAAA,EAErC,eAAe;AAAA;AAAA;AAAA,eAGF,wBAAwB;AAAA;AAAA;AAAA;AAAA,eAIxB,wBAAwB;AAAA;AAAA;AAAA,eAGxB,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAMvC;AAEA,SAAS,mBAAmB,MAAc,MAAuB;AAC/D,QAAM,iBAAiB,QAAQ,IAAI;AACnC,QAAM,iBAAiB,QAAQ,IAAI;AACnC,SAAO,mBAAmB,kBAAkB,eAAe,WAAW,GAAG,cAAc,GAAG,GAAG,EAAE;AACjG;AAEA,SAAS,iBAAiB,OAAwC;AAChE,QAAM,UAAU,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE;AAAA,IAC/D,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC;AAAA,EACpD;AACA,SAAO,QAAQ;AAAA,IACb,CAAC,MAAM,UAAU,CAAC,QAAQ,MAAM,GAAG,KAAK,EAAE,KAAK,CAAC,SAAS,mBAAmB,MAAM,IAAI,CAAC;AAAA,EACzF;AACF;AAEA,eAAe,yBAAyB,OAAiD;AACvF,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AACA,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,QAAQ,OAAO;AACxB,QAAI,OAAO,SAAS,YAAY,KAAK,WAAW,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,IAAI,GAAG;AAC7F,YAAM,IAAI,MAAM,mEAAmE;AAAA,IACrF;AACA,UAAM,WAAW,QAAQ,IAAI;AAC7B,eAAW,IAAI,QAAQ;AACvB,QAAI;AACF,iBAAW,IAAI,MAAM,SAAS,QAAQ,CAAC;AAAA,IACzC,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU,OAAM;AAAA,IAC9D;AAAA,EACF;AACA,SAAO,CAAC,GAAG,UAAU,EAAE,KAAK;AAC9B;AAEA,eAAe,6BACb,SACA,KACiB;AACjB,QAAM,aACJ,QAAQ,SAAS,GAAG,KAAK,WAAW,OAAO,IACvC,CAAC,QAAQ,OAAO,CAAC,KAChB,IAAI,QAAQ,IACV,MAAM,SAAS,EACf,OAAO,OAAO,EACd,IAAI,CAAC,UAAU,KAAK,OAAO,OAAO,CAAC;AAC5C,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,aAAa,YAAY;AAClC,QAAI;AACJ,QAAI;AACF,YAAM,OAAO,WAAWD,WAAU,IAAI;AACtC,iBAAW,MAAM,SAAS,SAAS;AAAA,IACrC,QAAQ;AACN;AAAA,IACF;AACA,QAAI,KAAK,IAAI,QAAQ,EAAG;AACxB,SAAK,IAAI,QAAQ;AACjB,QAAI,MAAM,sBAAsB,QAAQ,EAAG,QAAO;AAClD,UAAM,cAAc,MAAM,qBAAqB,QAAQ;AACvD,QAAI,CAAC,YAAa;AAClB,UAAM,UAAU,MAAM,2BAA2B,WAAW;AAC5D,QAAI,QAAS,QAAO;AAAA,EACtB;AACA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAe,qBAAqB,MAA2C;AAC7E,MAAI,SAAS,QAAQ,IAAI;AACzB,SAAO,MAAM;AACX,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,MAAM,SAAS,KAAK,QAAQ,cAAc,GAAG,MAAM,CAAC;AAG9E,UAAI,OAAO,SAAS,gBAAiB,QAAO;AAAA,IAC9C,QAAQ;AAAA,IAER;AACA,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,WAAW,OAAQ,QAAO;AAC9B,aAAS;AAAA,EACX;AACF;AAEA,eAAe,2BAA2B,aAAkD;AAC1F,QAAM,SAAS,iBAAiB;AAChC,QAAM,aAAa;AAAA,IACjB;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,IACA,KAAK,aAAa,UAAU,OAAO,QAAQ,OAAO,OAAO;AAAA,EAC3D;AACA,aAAW,cAAc,YAAY;AACnC,QAAI,MAAM,sBAAsB,UAAU,EAAG,QAAO;AAAA,EACtD;AACA,SAAO;AACT;AAEA,SAAS,mBAA4D;AACnE,MAAI,QAAQ,aAAa,SAAS;AAChC,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,MAAI,QAAQ,SAAS,OAAO;AAC1B,WAAO,EAAE,aAAa,mBAAmB,QAAQ,4BAA4B;AAAA,EAC/E;AACA,MAAI,QAAQ,SAAS,SAAS;AAC5B,WAAO,EAAE,aAAa,qBAAqB,QAAQ,6BAA6B;AAAA,EAClF;AACA,QAAM,IAAI,MAAM,mDAAmD,QAAQ,IAAI,EAAE;AACnF;AAEA,eAAe,sBAAsB,MAAgC;AACnE,MAAI;AACJ,MAAI;AACF,UAAM,OAAO,MAAMA,WAAU,IAAI;AACjC,aAAS,MAAME,MAAK,MAAM,GAAG;AAC7B,UAAM,SAAS,OAAO,MAAM,EAAE;AAC9B,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK,QAAQ,GAAG,OAAO,QAAQ,CAAC;AACnE,QACE,cAAc,OAAO,UACrB,CAAC,OAAO,SAAS,GAAG,CAAC,EAAE,OAAO,OAAO,KAAK,CAAC,KAAM,IAAM,IAAM,EAAI,CAAC,CAAC,KACnE,OAAO,CAAC,MAAM,KACd,OAAO,CAAC,MAAM,GACd;AACA,aAAO;AAAA,IACT;AACA,UAAM,sBAAsB,OAAO,OAAO,gBAAgB,EAAE,CAAC;AAC7D,UAAM,oBAAoB,OAAO,aAAa,EAAE;AAChD,UAAM,qBAAqB,OAAO,aAAa,EAAE;AACjD,UAAM,kBAAkB,QAAQ,SAAS,QAAQ,KAAK,QAAQ,SAAS,UAAU,MAAM;AACvF,QACE,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,OAAO,aAAa,EAAE,CAAC,KACxC,OAAO,aAAa,EAAE,MAAM,mBAC5B,CAAC,OAAO,cAAc,mBAAmB,KACzC,sBAAsB,MACtB,oBAAoB,MACpB,oBAAoB,QACpB,uBAAuB,KACvB,qBAAqB,MACrB;AACA,aAAO;AAAA,IACT;AACA,UAAM,YAAY,oBAAoB;AACtC,UAAM,QAAQ,OAAO,MAAM,SAAS;AACpC,UAAM,YAAY,MAAM,OAAO,KAAK,OAAO,GAAG,WAAW,mBAAmB;AAC5E,QAAI,UAAU,cAAc,UAAW,QAAO;AAC9C,aAAS,QAAQ,GAAG,QAAQ,oBAAoB,SAAS,GAAG;AAC1D,YAAM,OAAO,MAAM,aAAa,QAAQ,iBAAiB;AACzD,UAAI,SAAS,EAAG,QAAO;AAAA,IACzB;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,UAAM,QAAQ,MAAM;AAAA,EACtB;AACF;AAEA,SAAS,WAAW,MAA+B;AACjD,SAAO,IAAI,QAAQ,CAAC,eAAe,WAAW;AAC5C,UAAM,OAAO,WAAW,QAAQ;AAChC,UAAM,SAAS,iBAAiB,IAAI;AACpC,WAAO,GAAG,SAAS,MAAM;AACzB,WAAO,GAAG,QAAQ,CAAC,UAAU,KAAK,OAAO,KAAK,CAAC;AAC/C,WAAO,GAAG,OAAO,MAAM,cAAc,KAAK,OAAO,KAAK,CAAC,CAAC;AAAA,EAC1D,CAAC;AACH;AAEA,SAAS,kBAAkB,OAAqB,QAA8B;AAC5E,MAAI,QAAQ,aAAa,WAAW,OAAO,MAAM,QAAQ,UAAU;AACjE,QAAI;AACF,cAAQ,KAAK,CAAC,MAAM,KAAK,MAAM;AAC/B;AAAA,IACF,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,QAAS;AAAA,IACvD;AAAA,EACF;AACA,MAAI;AACF,UAAM,KAAK,MAAM;AAAA,EACnB,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,qBAAqB,QAAiC;AACpE,QAAM,YAAuB,CAAC;AAC9B,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,MAAM,OAAO,EAAE,QAAQ,GAAG;AAC3D,QAAI,KAAK,KAAK,EAAE,WAAW,EAAG;AAC9B,QAAIC;AACJ,QAAI;AACF,MAAAA,SAAQ,KAAK,MAAM,IAAI;AAAA,IACzB,QAAQ;AACN,YAAM,IAAI,MAAM,qCAAqC,QAAQ,CAAC,oBAAoB;AAAA,IACpF;AACA,QAAI,SAASA,MAAK,KAAKA,OAAM,SAAS,iBAAkB,WAAU,KAAKA,MAAK;AAAA,EAC9E;AACA,MAAI,UAAU,WAAW,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,oFAAoF,UAAU,MAAM;AAAA,IACtG;AAAA,EACF;AACA,QAAM,QAAQ,UAAU,CAAC;AACzB,MAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,MAAM,KAAK,GAAG;AAC9C,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,QAAM,QAAQ,MAAM;AACpB,QAAM,cAAc,cAAc,MAAM,cAAc,cAAc;AACpE,QAAM,oBAAoB,cAAc,MAAM,qBAAqB,qBAAqB;AACxF,QAAM,eAAe,cAAc,MAAM,eAAe,eAAe;AACvE,QAAM,wBAAwB;AAAA,IAC5B,MAAM;AAAA,IACN;AAAA,EACF;AACA,MAAI,oBAAoB,aAAa;AACnC,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,MAAI,wBAAwB,cAAc;AACxC,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,SAAO,EAAE,aAAa,mBAAmB,cAAc,sBAAsB;AAC/E;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,cAAc,OAAgB,OAAuB;AAC5D,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,MAAM,gCAAgC,KAAK,sCAAsC;AAAA,EAC7F;AACA,SAAO;AACT;","names":["constants","open","model","resolve","constants","access","open","event"]}

package/dist/{chunk-7PSFJTJZ.js → chunk-SDR45ZQB.js}

@@ -13,7 +13,7 @@ import {
   settledToIteration,
   supervise,
   withDriverExecutor
-} from "./chunk-FDJFHWLD.js";
+} from "./chunk-MDJJHYNQ.js";
 import {
   InMemoryResultBlobStore,
   InMemorySpawnJournal
@@ -6339,4 +6339,4 @@ export {
   computeFindingId,
   makeFinding2 as makeFinding
 };
-//# sourceMappingURL=chunk-7PSFJTJZ.js.map
+//# sourceMappingURL=chunk-SDR45ZQB.js.map

package/dist/{chunk-J3XISCCP.js → chunk-ZZE642DF.js}

@@ -1,6 +1,6 @@
 import {
   agenticGenerator
-} from "./chunk-YHK6MLB7.js";
+} from "./chunk-IXIUSPT3.js";
 import {
   assertModelAllowed
 } from "./chunk-ISTDY47H.js";
@@ -532,4 +532,4 @@ export {
   applyImprovementWinnerToProfile,
   improve
 };
-//# sourceMappingURL=chunk-J3XISCCP.js.map
+//# sourceMappingURL=chunk-ZZE642DF.js.map

package/dist/{completion-gate-CDnL2Wws.d.ts → completion-gate-CfX2thvL.d.ts}

@@ -1,4 +1,4 @@
-import { L as LocalHarness, C as CodexTokenUsage, a as CodexExecutionPolicy } from './local-harness-C2HDGiOY.js';
+import { L as LocalHarness, C as CodexTokenUsage, a as CodexExecutionPolicy } from './local-harness-CePtFrwu.js';
 import { c as Executor } from './types-DHLXdLVN.js';
 
 /**
@@ -142,6 +142,8 @@ interface WorktreeHarnessResult {
         cliVersion?: string;
         /** SHA-256 of the native Codex executable staged read-only in the candidate worktree. */
         executableSha256?: string;
+        /** SHA-256 of the exact composed prompt argument proved present in Codex's rendered prompt. */
+        requestedPromptSha256?: string;
         /** SHA-256 of `codex debug prompt-input` output for the exact isolated prompt. */
         effectivePromptSha256?: string;
         /** SHA-256 of the exact executable + argv with prompt content replaced by `<PROMPT>`. */

package/dist/{coordination-DzXsfxre.d.ts → coordination-pOGZuYS7.d.ts}

@@ -5,8 +5,8 @@ import { S as SandboxClient, E as ExecCtx, g as LoopTraceEmitter, e as LoopTrace
 import { BackendType, SandboxEvent, SandboxInstance } from '@tangle-network/sandbox';
 import { AgentEvalError } from '@tangle-network/agent-eval';
 import { b as ToolSpec, c as RuntimeTelemetryOptions, R as RouterConfig } from './sanitize-Dr3SliRC.js';
-import { G as GitRunner, a as WorktreeCheckRunner, D as DeliverableSpec } from './completion-gate-CDnL2Wws.js';
-import { L as LocalHarness } from './local-harness-C2HDGiOY.js';
+import { G as GitRunner, a as WorktreeCheckRunner, D as DeliverableSpec } from './completion-gate-CfX2thvL.js';
+import { L as LocalHarness } from './local-harness-CePtFrwu.js';
 import { ProviderExecutorOptions, AgentEnvironmentProviderRegistry } from './environment-provider.js';
 import { AgentEnvironmentProvider } from '@tangle-network/agent-interface/environment-provider';
 

package/dist/{improve-mrYmy_1e.d.ts → improve-Ciuvu2jh.d.ts}

@@ -1,7 +1,7 @@
 import { Scenario, SelfImproveOptions, SurfaceProposer, SelfImproveResult, MutableSurface } from '@tangle-network/agent-eval/contract';
 import { AgentProfile } from '@tangle-network/agent-interface';
-import { L as LocalHarness } from './local-harness-C2HDGiOY.js';
-import { V as Verifier, C as CandidateGenerator } from './agentic-generator-B7Cyl6cn.js';
+import { L as LocalHarness } from './local-harness-CePtFrwu.js';
+import { V as Verifier, C as CandidateGenerator } from './agentic-generator-CL1q0H91.js';
 
 /**
  *

package/dist/index.d.ts

@@ -5,29 +5,29 @@ export { r as AgentAdapter, s as AgentKnowledgeProvider, A as AgentRuntimeEvent,
 export { AgentCandidateCodeSource, AgentCandidateCodeSurfaceSource, AgentCandidateModelGrantActivateInput, AgentCandidateModelGrantClient, AgentCandidateModelGrantReservation, AgentCandidateModelGrantReserveInput, AgentCandidateModelGrantSettleInput, AgentCandidateProfileSource, BuildAgentCandidateBundleInput, CreateProtectedAgentCandidateModelPortOptions, DisposePreparedAgentCandidateOptions, FileAgentCandidateExecutionClaimStore, FileAgentCandidateExecutionClaimStoreOptions, RecoverExpiredAgentCandidateOptions, applyExactAgentProfileDiff, buildAgentCandidateBundle, candidateExecutionClaim, createProtectedAgentCandidateModelPort, disposePreparedAgentCandidateExecution, parseExactAgentProfile, parseExactAgentProfileDiff, persistCandidateOutputArtifact, recoverExpiredAgentCandidateExecution, verifyAgentCandidateBundle } from './candidate-execution/index.js';
 export { d as AgentCandidateArtifactPort, e as AgentCandidateBenchmarkGraderIdentity, f as AgentCandidateBenchmarkGraderPort, A as AgentCandidateBundleInput, g as AgentCandidateContainerPort, h as AgentCandidateExecutionAttemptRecord, i as AgentCandidateExecutionAttemptRef, j as AgentCandidateExecutionClaim, k as AgentCandidateExecutionClaimResult, l as AgentCandidateExecutionClaimStore, m as AgentCandidateExecutionCleanupHandles, n as AgentCandidateExecutionFailureClass, o as AgentCandidateExecutionFinishResult, p as AgentCandidateExecutionLease, q as AgentCandidateExecutionPhase, r as AgentCandidateExecutionPhaseResult, b as AgentCandidateExecutionPorts, s as AgentCandidateExecutionRecoveryEvidence, t as AgentCandidateExecutionStageResult, u as AgentCandidateExecutionTerminalRecord, v as AgentCandidateExecutionTerminalResult, w as AgentCandidateExecutionUsage, x as AgentCandidateExecutorFinalCapture, y as AgentCandidateExecutorMemoryCapture, z as AgentCandidateExecutorPort, B as AgentCandidateExecutorProfileFile, C as AgentCandidateExecutorRequest, D as AgentCandidateExecutorStopRequest, F as AgentCandidateExecutorTaskOutcomeCapture, G as AgentCandidateExecutorWorkspaceFile, H as AgentCandidateExecutorWorkspaceInput, I as AgentCandidateMemoryPort, J as AgentCandidateMemoryResetResult, K as AgentCandidateModelLimits, L as AgentCandidateModelPort, M as AgentCandidateOutputArtifactPort, N as AgentCandidateOutputPurpose, O as AgentCandidateProtectedModelActivation, Q as AgentCandidateProtectedModelCall, R as AgentCandidateProtectedModelReservation, S as AgentCandidateProtectedModelSettlement, T as AgentCandidateProtectedRunCapture, U as AgentCandidateRepositoryPort, V as AgentCandidateRetryRejection, c as AgentCandidateRunFinalization, a as AgentCandidateTaskExecution, W as AgentCandidateVerificationPorts, X as AgentCandidateWorkspacePort, Y as CANDIDATE_TRACE_ENV, Z as CANDIDATE_TRACE_TAGS, _ as CanonicalCandidateDocument, E as ExecutePreparedAgentCandidateOptions, $ as InMemoryAgentCandidateExecutionClaimStore, P as PrepareAgentCandidateExecutionOptions, a0 as PreparedAgentCandidateExecution, a1 as PreparedAgentCandidateInstruction, a2 as PreparedAgentCandidateLaunch, a3 as PreparedAgentCandidateTrace, a4 as ResolvedAgentCandidateContainer, a5 as VerifiedAgentCandidate, a6 as VerifiedAgentCandidateTaskOutcome, a7 as executePreparedAgentCandidate, a8 as prepareAgentCandidateExecution, a9 as sealAgentCandidateBundle } from './prepare-BKxAiUcH.js';
 import { Scenario, ProfileDispatchFn, ProposeContext, SurfaceProposer } from '@tangle-network/agent-eval/campaign';
-import { C as CandidateGenerator } from './agentic-generator-B7Cyl6cn.js';
-export { A as AgenticGeneratorOptions, I as ImprovementDriverOptions, M as ManagedImprovementDriver, V as Verifier, a as VerifyResult, b as agenticGenerator, c as commandVerifier, i as improvementDriver } from './agentic-generator-B7Cyl6cn.js';
-export { c as ImproveCodeOptions, d as ImproveMemoryOptions, a as ImproveOptions, b as ImproveResult, e as ImproveSkillsOptions, I as ImproveSurface, f as applyImprovementWinnerToProfile, i as improve } from './improve-mrYmy_1e.js';
-export { M as McpServeSpec, m as mcpServeVerifier } from './mcp-serve-verifier-C65X30mY.js';
+import { C as CandidateGenerator } from './agentic-generator-CL1q0H91.js';
+export { A as AgenticGeneratorOptions, I as ImprovementDriverOptions, M as ManagedImprovementDriver, V as Verifier, a as VerifyResult, b as agenticGenerator, c as commandVerifier, i as improvementDriver } from './agentic-generator-CL1q0H91.js';
+export { c as ImproveCodeOptions, d as ImproveMemoryOptions, a as ImproveOptions, b as ImproveResult, e as ImproveSkillsOptions, I as ImproveSurface, f as applyImprovementWinnerToProfile, i as improve } from './improve-Ciuvu2jh.js';
+export { M as McpServeSpec, m as mcpServeVerifier } from './mcp-serve-verifier-D7hCZIkT.js';
 import { AgentProfileDiff, AgentProfile as AgentProfile$1 } from '@tangle-network/agent-interface';
 import { Scenario as Scenario$1, SelfImproveOptions } from '@tangle-network/agent-eval/contract';
 import { S as SurfaceImprovementEdit } from './improvement-adapter-BieWeK5J.js';
 import { I as ImprovementAdapter } from './types-BC3bZpH0.js';
 export { AgentKnowledgeReadinessCheckOptions, KnowledgeImprovementJobMeasurement, KnowledgeImprovementJobResult, KnowledgeReadinessCheck, KnowledgeReadinessCheckInput, KnowledgeReadinessCheckResult, RESEARCH_SUPERVISOR_SYSTEM_PROMPT, RunKnowledgeImprovementJobOptions, SupervisedKnowledgeUpdateInput, SupervisedKnowledgeUpdateOptions, SupervisedKnowledgeUpdateResult, SupervisedKnowledgeUpdater, createAgentKnowledgeReadinessCheck, createSupervisedKnowledgeUpdater, formatSupervisedKnowledgeTask, knowledgeReadinessDeliverable, runKnowledgeImprovementJob, runSupervisedKnowledgeUpdate } from './knowledge.js';
-export { D as DELEGATED_LOOP_MODES, a as DelegatedLoopMode, b as DelegatedLoopRegistry, c as DelegatedLoopResult, d as DelegatedLoopRunner, L as LoopRunnerCliArgs, e as LoopRunnerCliResult, R as ResearchLoopResult, f as ResearchLoopRunnerOptions, g as RunDelegatedLoopOptions, V as VetoedFact, W as WorktreeLoopRunnerOptions, h as auditLoopRunner, i as isDelegatedLoopMode, p as parseLoopRunnerArgv, r as researchLoopRunner, j as runDelegatedLoop, k as runLoopRunnerCli, s as selfImproveLoopRunner, w as worktreeLoopRunner } from './loop-runner-bin-z1nz1Wks.js';
+export { D as DELEGATED_LOOP_MODES, a as DelegatedLoopMode, b as DelegatedLoopRegistry, c as DelegatedLoopResult, d as DelegatedLoopRunner, L as LoopRunnerCliArgs, e as LoopRunnerCliResult, R as ResearchLoopResult, f as ResearchLoopRunnerOptions, g as RunDelegatedLoopOptions, V as VetoedFact, W as WorktreeLoopRunnerOptions, h as auditLoopRunner, i as isDelegatedLoopMode, p as parseLoopRunnerArgv, r as researchLoopRunner, j as runDelegatedLoop, k as runLoopRunnerCli, s as selfImproveLoopRunner, w as worktreeLoopRunner } from './loop-runner-bin-B4PwjVaF.js';
 export { m as mcpToolsForRuntimeMcp, a as mcpToolsForRuntimeMcpSubset } from './openai-tools-BMOu1t3A.js';
-export { b0 as EvalRunEvent, b1 as EvalRunGeneration, b2 as EvalRunsExportConfig, b3 as EvalRunsExportResult, b4 as INTELLIGENCE_WIRE_VERSION, b5 as LoopSpanNode, b6 as OtelAttribute, b7 as OtelExportConfig, b8 as OtelExporter, b9 as OtelSpan, ba as RuntimeEventOtelOptions, bb as buildLoopOtelSpans, bc as buildLoopSpanNodes, bd as buildRuntimeEventOtelSpans, be as createOtelExporter, bf as exportEvalRuns, bg as loopEventToOtelSpan } from './coordination-DzXsfxre.js';
+export { b0 as EvalRunEvent, b1 as EvalRunGeneration, b2 as EvalRunsExportConfig, b3 as EvalRunsExportResult, b4 as INTELLIGENCE_WIRE_VERSION, b5 as LoopSpanNode, b6 as OtelAttribute, b7 as OtelExportConfig, b8 as OtelExporter, b9 as OtelSpan, ba as RuntimeEventOtelOptions, bb as buildLoopOtelSpans, bc as buildLoopSpanNodes, bd as buildRuntimeEventOtelSpans, be as createOtelExporter, bf as exportEvalRuns, bg as loopEventToOtelSpan } from './coordination-pOGZuYS7.js';
 import { c as RuntimeTelemetryOptions } from './sanitize-Dr3SliRC.js';
 export { d as RuntimeEventCollector, e as RuntimeStreamEventCollector, S as SanitizedKnowledgeReadinessReport, f as createRuntimeEventCollector, g as createRuntimeStreamEventCollector, s as sanitizeAgentRuntimeEvent, h as sanitizeKnowledgeReadinessReport, i as sanitizeRuntimeStreamEvent } from './sanitize-Dr3SliRC.js';
 import '@tangle-network/sandbox';
-import './local-harness-C2HDGiOY.js';
+import './local-harness-CePtFrwu.js';
 import 'node:child_process';
 import '@tangle-network/agent-knowledge';
-import './supervise-BWFqM8bL.js';
+import './supervise-Y3w878fN.js';
 import './types-DHLXdLVN.js';
-import './completion-gate-CDnL2Wws.js';
+import './completion-gate-CfX2thvL.js';
 import './kb-gate-CwHO0vz6.js';
-import './worktree-fanout-BaD6BDr2.js';
+import './worktree-fanout-DmBvR-_O.js';
 import './substrate-DO2GHNg2.js';
 import './environment-provider.js';
 import '@tangle-network/agent-interface/environment-provider';

package/dist/index.js

@@ -8,7 +8,7 @@ import {
 import {
   mcpToolsForRuntimeMcp,
   mcpToolsForRuntimeMcpSubset
-} from "./chunk-6SIVHKNH.js";
+} from "./chunk-NSXVEWZT.js";
 import {
   DEFAULT_ROUTER_BASE_URL,
   cleanModelId,
@@ -27,14 +27,14 @@ import {
   runLoopRunnerCli,
   selfImproveLoopRunner,
   worktreeLoopRunner
-} from "./chunk-OXQHAHOM.js";
+} from "./chunk-QUYOHVN7.js";
 import "./chunk-SGKPNBXE.js";
 import {
   applyImprovementWinnerToProfile,
   improve,
   improvementDriver,
   rawTraceDistiller
-} from "./chunk-J3XISCCP.js";
+} from "./chunk-ZZE642DF.js";
 import {
   CANDIDATE_TRACE_ENV,
   CANDIDATE_TRACE_TAGS,
@@ -59,7 +59,7 @@ import {
   normalizeBackendStreamEvent,
   nowIso,
   touchSession
-} from "./chunk-7PSFJTJZ.js";
+} from "./chunk-SDR45ZQB.js";
 import "./chunk-ZQZX77MM.js";
 import {
   mcpBuildPrompt,
@@ -69,7 +69,7 @@ import {
 import {
   agenticGenerator,
   commandVerifier
-} from "./chunk-YHK6MLB7.js";
+} from "./chunk-IXIUSPT3.js";
 import {
   RESEARCH_SUPERVISOR_SYSTEM_PROMPT,
   createAgentKnowledgeReadinessCheck,
@@ -78,14 +78,14 @@ import {
   knowledgeReadinessDeliverable,
   runKnowledgeImprovementJob,
   runSupervisedKnowledgeUpdate
-} from "./chunk-EJSELWQY.js";
+} from "./chunk-CHP7TESJ.js";
 import "./chunk-5QOB7H74.js";
 import {
   composeRuntimeHooks,
   defineRuntimeHooks,
   notifyRuntimeDecisionPoint,
   notifyRuntimeHookEvent
-} from "./chunk-FDJFHWLD.js";
+} from "./chunk-MDJJHYNQ.js";
 import "./chunk-DPEUKJRO.js";
 import {
   INTELLIGENCE_WIRE_VERSION,
@@ -105,7 +105,7 @@ import "./chunk-WIPGQ4GT.js";
 import "./chunk-VSWBYWFK.js";
 import "./chunk-3MDZX7YU.js";
 import "./chunk-FVJ7M3DA.js";
-import "./chunk-2GHZEULG.js";
+import "./chunk-RRHPT3CQ.js";
 import {
   AgentEvalError,
   BackendTransportError,

package/dist/intelligence.d.ts

@@ -5,12 +5,12 @@ import { AnalystFinding } from '@tangle-network/agent-eval/analyst';
 import { Scenario, SelfImproveResult } from '@tangle-network/agent-eval/contract';
 import { R as RunAnalystLoopOpts, a as RunAnalystLoopResult } from './types-BC3bZpH0.js';
 import { A as AgentCandidateBundleInput, a as AgentCandidateTaskExecution, b as AgentCandidateExecutionPorts, P as PrepareAgentCandidateExecutionOptions, E as ExecutePreparedAgentCandidateOptions, c as AgentCandidateRunFinalization } from './prepare-BKxAiUcH.js';
-import { I as ImproveSurface, a as ImproveOptions, b as ImproveResult } from './improve-mrYmy_1e.js';
+import { I as ImproveSurface, a as ImproveOptions, b as ImproveResult } from './improve-Ciuvu2jh.js';
 import '@tangle-network/agent-eval';
 import '@tangle-network/sandbox';
-import './local-harness-C2HDGiOY.js';
+import './local-harness-CePtFrwu.js';
 import 'node:child_process';
-import './agentic-generator-B7Cyl6cn.js';
+import './agentic-generator-CL1q0H91.js';
 import '@tangle-network/agent-eval/campaign';
 
 /**

package/dist/intelligence.js

@@ -1,7 +1,7 @@
 import {
   applyImprovementWinnerToProfile,
   improve
-} from "./chunk-J3XISCCP.js";
+} from "./chunk-ZZE642DF.js";
 import {
   assertCandidateProfileBinding,
   canonicalCandidateDigest,
@@ -17,7 +17,7 @@ import {
 import {
   runAnalystLoop
 } from "./chunk-ZQZX77MM.js";
-import "./chunk-YHK6MLB7.js";
+import "./chunk-IXIUSPT3.js";
 import {
   buildLoopOtelSpans,
   buildRuntimeEventOtelSpans,
@@ -27,7 +27,7 @@ import {
 import "./chunk-WIPGQ4GT.js";
 import "./chunk-3MDZX7YU.js";
 import "./chunk-FVJ7M3DA.js";
-import "./chunk-2GHZEULG.js";
+import "./chunk-RRHPT3CQ.js";
 import "./chunk-YEJR7IXO.js";
 import "./chunk-DGUM43GV.js";
 

package/dist/knowledge.d.ts

@@ -1,15 +1,15 @@
 import { KnowledgeReadinessSpec, BuildEvalKnowledgeBundleOptions, KnowledgeBaseQualityOptions, KnowledgeImprovementResult, KnowledgeImprovementOptions } from '@tangle-network/agent-knowledge';
-import { E as ExecutorConfig } from './coordination-DzXsfxre.js';
-import { a as SuperviseOptions, S as SupervisorProfile } from './supervise-BWFqM8bL.js';
+import { E as ExecutorConfig } from './coordination-pOGZuYS7.js';
+import { a as SuperviseOptions, S as SupervisorProfile } from './supervise-Y3w878fN.js';
 import { B as Budget, b as SupervisedResult } from './types-DHLXdLVN.js';
-import { D as DeliverableSpec } from './completion-gate-CDnL2Wws.js';
+import { D as DeliverableSpec } from './completion-gate-CfX2thvL.js';
 import '@tangle-network/agent-interface';
 import './substrate-DO2GHNg2.js';
 import './types-Kjr5W6OF.js';
 import '@tangle-network/agent-eval';
 import '@tangle-network/sandbox';
 import './sanitize-Dr3SliRC.js';
-import './local-harness-C2HDGiOY.js';
+import './local-harness-CePtFrwu.js';
 import 'node:child_process';
 import './environment-provider.js';
 import '@tangle-network/agent-interface/environment-provider';

package/dist/knowledge.js

@@ -6,16 +6,16 @@ import {
   knowledgeReadinessDeliverable,
   runKnowledgeImprovementJob,
   runSupervisedKnowledgeUpdate
-} from "./chunk-EJSELWQY.js";
+} from "./chunk-CHP7TESJ.js";
 import "./chunk-5QOB7H74.js";
-import "./chunk-FDJFHWLD.js";
+import "./chunk-MDJJHYNQ.js";
 import "./chunk-DPEUKJRO.js";
 import "./chunk-ISTDY47H.js";
 import "./chunk-WIPGQ4GT.js";
 import "./chunk-VSWBYWFK.js";
 import "./chunk-3MDZX7YU.js";
 import "./chunk-FVJ7M3DA.js";
-import "./chunk-2GHZEULG.js";
+import "./chunk-RRHPT3CQ.js";
 import "./chunk-YEJR7IXO.js";
 import "./chunk-DGUM43GV.js";
 export {

package/dist/lifecycle.d.ts

@@ -2,9 +2,9 @@ import { AgentProfile } from '@tangle-network/agent-interface';
 import { a as ProfileArtifact, A as ArtifactKind, b as ArtifactStatus, c as ArtifactInput, E as EvalRunner, d as EvalResult, G as GenerateContext, C as CandidateGenerator, e as PromotionVerdict, P as PromotionGate } from './generator-YkAQrOoD.js';
 export { f as ArtifactPayloads, H as HeldOutPromotionGateOptions, M as MarginalLift, g as MeasureMarginalLiftOptions, h as heldOutPromotionGate, m as measureMarginalLift, t as thresholdPromotionGate } from './generator-YkAQrOoD.js';
 import { LlmClientOptions, AnalystFinding } from '@tangle-network/agent-eval';
-import { M as McpServeSpec } from './mcp-serve-verifier-C65X30mY.js';
-import { L as LocalHarness } from './local-harness-C2HDGiOY.js';
-import './agentic-generator-B7Cyl6cn.js';
+import { M as McpServeSpec } from './mcp-serve-verifier-D7hCZIkT.js';
+import { L as LocalHarness } from './local-harness-CePtFrwu.js';
+import './agentic-generator-CL1q0H91.js';
 import '@tangle-network/agent-eval/campaign';
 import 'node:child_process';
 

package/dist/lifecycle.js

@@ -6,8 +6,8 @@ import {
 import {
   agenticGenerator,
   commandVerifier
-} from "./chunk-YHK6MLB7.js";
-import "./chunk-2GHZEULG.js";
+} from "./chunk-IXIUSPT3.js";
+import "./chunk-RRHPT3CQ.js";
 import {
   ValidationError
 } from "./chunk-YEJR7IXO.js";

package/dist/{local-harness-C2HDGiOY.d.ts → local-harness-CePtFrwu.d.ts}

@@ -107,6 +107,8 @@ interface CodexExecutionPolicy {
 interface CodexExecutionEvidence {
     cliVersion: string;
     executableSha256: string;
+    /** SHA-256 of the exact composed prompt argument proved present in the rendered prompt. */
+    requestedPromptSha256: string;
     effectivePromptSha256: string;
     nonPromptArgsSha256: string;
     controlledConfigSha256: string;

package/dist/{loop-runner-bin-z1nz1Wks.d.ts → loop-runner-bin-B4PwjVaF.d.ts}

@@ -3,7 +3,7 @@ import { SelfImproveOptions, SelfImproveResult } from '@tangle-network/agent-eva
 import { R as RunAnalystLoopOpts, a as RunAnalystLoopResult } from './types-BC3bZpH0.js';
 import { F as FactCandidate, C as CreateKbGateOptions } from './kb-gate-CwHO0vz6.js';
 import { B as Budget } from './types-DHLXdLVN.js';
-import { A as AuthoredHarness, W as WinnerStrategy, a as WorktreeFanoutOptions, b as WorktreePatchArtifact } from './worktree-fanout-BaD6BDr2.js';
+import { A as AuthoredHarness, W as WinnerStrategy, a as WorktreeFanoutOptions, b as WorktreePatchArtifact } from './worktree-fanout-DmBvR-_O.js';
 
 /**
  *

package/dist/loop-runner-bin.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-export { L as LoopRunnerCliArgs, e as LoopRunnerCliResult, p as parseLoopRunnerArgv, k as runLoopRunnerCli } from './loop-runner-bin-z1nz1Wks.js';
+export { L as LoopRunnerCliArgs, e as LoopRunnerCliResult, p as parseLoopRunnerArgv, k as runLoopRunnerCli } from './loop-runner-bin-B4PwjVaF.js';
 import '@tangle-network/agent-eval/campaign';
 import '@tangle-network/agent-eval/contract';
 import './types-BC3bZpH0.js';
@@ -9,7 +9,7 @@ import './types-DHLXdLVN.js';
 import '@tangle-network/agent-interface';
 import '@tangle-network/sandbox';
 import './types-Kjr5W6OF.js';
-import './worktree-fanout-BaD6BDr2.js';
-import './completion-gate-CDnL2Wws.js';
-import './local-harness-C2HDGiOY.js';
+import './worktree-fanout-DmBvR-_O.js';
+import './completion-gate-CfX2thvL.js';
+import './local-harness-CePtFrwu.js';
 import 'node:child_process';