@tangle-network/agent-runtime 0.95.0 → 0.97.0

package/dist/chunk-DHCHL6OG.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/improvement/agentic-generator.ts"],"sourcesContent":["/**\n *\n * `agenticGenerator` — the full-agentic `CandidateGenerator`: the\n * `shots=N, sandbox=on` setting of the one `improvementDriver`. It runs a real\n * coding harness (claude / codex / opencode) inside the candidate worktree the\n * driver already created, letting the agent read the codebase + the research\n * report and make the change in place. The driver then commits the worktree\n * into a `CodeSurface`.\n *\n * Mechanism: identical to the proven Phase-2.8 in-process executor — spawn the\n * harness as a subprocess with `cwd` = the worktree, on the same filesystem,\n * so edits land in place (no sandbox-mount round-trip). `runLocalHarness` is\n * the verified primitive. The OUTER sandbox is the improvement loop's own\n * execution context; the generator does not nest a second sandbox per\n * candidate (which would reintroduce a host↔sandbox worktree-transport\n * problem that does not need solving here).\n *\n * `maxShots` is the DEPTH dial — a multi-shot verify-in-session loop, NOT the\n * kernel `runLoop`. Each shot runs one full harness session in the (persistent)\n * worktree; between shots the loop refines based on what the last shot produced:\n *   - empty tree   → \"you changed nothing, make the edits\" → retry\n *   - dirty + `verify` fails → feed the verifier's failure into the next shot\n *       (the worktree persists, so the harness RESUMES atop its own failing\n *       edits with the error in hand — no `--resume` session plumbing needed,\n *       and harness-agnostic across claude/codex/opencode)\n *   - dirty + `verify` ok (or no verifier configured) → return the candidate\n * A candidate that never verifies within `maxShots` is discarded (`applied:\n * false`), never shipped — if you configured a verifier, a non-passing tree is\n * not a candidate. With no verifier the legacy behavior holds: first dirty shot\n * is the candidate.\n *\n * @experimental\n */\n\nimport { spawnSync } from 'node:child_process'\nimport { createHash } from 'node:crypto'\nimport { existsSync, readFileSync, rmSync } from 'node:fs'\nimport { join, resolve, sep } from 'node:path'\nimport type {\n  AnalystFinding,\n  CostLedgerHandle,\n  CostReceipt,\n  CostReceiptInput,\n  MaximumCharge,\n} from '@tangle-network/agent-eval'\nimport type { AgentProfile, ReasoningEffort } from '@tangle-network/agent-interface'\nimport {\n  applyWorkspacePlan,\n  materializeProfile,\n  type WorkspacePlan,\n  type WorkspacePlanReceipt,\n} from '@tangle-network/agent-profile-materialize'\nimport {\n  type CodexExecutionEvidence,\n  type CodexTokenUsage,\n  harnessInvocation,\n  type LocalHarness,\n  type LocalHarnessResult,\n  runLocalHarness,\n} from '../mcp/local-harness'\nimport type { CandidateGenerator } from './improvement-driver'\n\nconst RAW_TRACE_ANALYST_ID = 'raw-trace-distiller'\nconst RAW_TRACE_AREA = 'raw-trace-context'\nconst RAW_TRACE_DIAGNOSIS_PATH = '.improve/raw-trace-diagnosis.md'\n\n/** Dedicated ephemeral root for generic author-profile files. Every declared\n * file must live below this root so cleanup cannot alter candidate-owned files. */\nexport const AGENTIC_PROFILE_RESOURCE_ROOT = '.agent-runtime-profile-resources'\n\n/** Outcome of verifying a candidate worktree. `feedback` (compiler errors,\n *  failing test output) is fed into the next shot when `ok` is false. */\nexport interface VerifyResult {\n  ok: boolean\n  feedback?: string\n}\n\n/** Verifies the edited worktree. Sync or async; throws only on a setup fault\n *  (a candidate that fails verification returns `{ok:false}`, it does not\n *  throw). */\nexport type Verifier = (worktreePath: string) => Promise<VerifyResult> | VerifyResult\n\nexport interface AgenticGeneratorShotReceipt {\n  readonly generation: number | null\n  readonly candidateIndex: number | null\n  /** One-based shot number within this candidate. */\n  readonly shot: number\n  readonly maxShots: number\n  readonly harness: LocalHarness\n  readonly model: string | null\n  readonly reasoningEffort: ReasoningEffort | null\n  readonly promptSha256: `sha256:${string}`\n  readonly startedAt: string\n  readonly completedAt: string\n  readonly durationMs: number\n  readonly exitCode: number | null\n  readonly timedOut: boolean\n  readonly killedBySignal: NodeJS.Signals | null\n  readonly stdoutBytes: number | null\n  readonly stdoutSha256: `sha256:${string}` | null\n  readonly stderrBytes: number | null\n  readonly stderrSha256: `sha256:${string}` | null\n  readonly usage: CodexTokenUsage | null\n  /** Digest of the exact profile-file workspace plan applied for this shot. */\n  readonly profileWorkspacePlanDigest: string | null\n  readonly profileWorkspaceFileCount: number\n  /** Shared run-ledger call id for this exact shot. */\n  readonly costCallId: string | null\n  /** Whether dollars came from the provider, the pricing table, or are unknown. */\n  readonly costBasis: 'provider-reported' | 'estimated-pricing' | 'unknown'\n  readonly costUsd: number | null\n  /** True only for a provider-reported amount, never for a pricing estimate. */\n  readonly costUsdKnown: boolean\n  readonly evidence: CodexExecutionEvidence | null\n  readonly error: { readonly name: string; readonly message: string } | null\n}\n\n/** Frozen exact harness result for an author shot: full streams, process state,\n *  token usage, and execution-policy evidence.\n *  The `onShotCompleted` callback receives `null` when execution failed before\n *  the harness returned. */\nexport type AgenticGeneratorShotExecution = Readonly<\n  Omit<LocalHarnessResult, 'usage' | 'evidence'> & {\n    readonly usage?: Readonly<CodexTokenUsage>\n    readonly evidence?: Readonly<Omit<CodexExecutionEvidence, 'readDeniedPaths' | 'policy'>> & {\n      readonly readDeniedPaths: ReadonlyArray<string>\n      readonly policy: Readonly<CodexExecutionEvidence['policy']>\n    }\n  }\n>\n\n/** Worktree decision emitted before a completed shot is retried, accepted, or\n *  discarded. The callback runs while `worktreePath` is still available, so\n *  callers can persist the exact diff. */\nexport type AgenticGeneratorShotDisposition =\n  | {\n      readonly kind: 'clean'\n      readonly worktreePath: string\n    }\n  | {\n      readonly kind: 'rejected'\n      readonly worktreePath: string\n      readonly stage: 'raw-trace-evidence' | 'verification'\n      readonly feedback: string | null\n    }\n  | {\n      readonly kind: 'accepted'\n      readonly worktreePath: string\n      readonly verified: boolean\n    }\n  | {\n      readonly kind: 'setup-error'\n      readonly worktreePath: string\n      readonly stage: 'worktree-inspection' | 'raw-trace-evidence' | 'verification'\n      readonly error: { readonly name: string; readonly message: string }\n    }\n\nexport interface AgenticGeneratorOptions {\n  /** Local coding harness to run in the worktree. Default `claude`. */\n  harness?: LocalHarness\n  /** Author profile rendered through the canonical harness mapper. Required\n   *  for reproducible Codex so model and reasoning settings are explicit. */\n  profile?: AgentProfile\n  /** Run Codex with isolated configuration, exact prompt evidence, and required\n   *  terminal token usage. Requires `harness: 'codex'` and `profile`. */\n  codexReproducible?: boolean\n  /** Absolute paths reproducible Codex must not read. A function can derive\n   *  candidate-specific paths after the driver creates its worktree. */\n  codexReadDeniedPaths?: ReadonlyArray<string> | ((worktreePath: string) => ReadonlyArray<string>)\n  /** Awaited once for every attempted author shot, including process failures.\n   *  The second argument preserves the exact harness result, including stdout\n   *  and stderr, before worktree inspection or verification can reject the\n   *  shot. Throwing aborts the candidate so evidence persistence fails closed. */\n  onShotCompleted?: (\n    receipt: AgenticGeneratorShotReceipt,\n    execution: AgenticGeneratorShotExecution | null,\n  ) => void | Promise<void>\n  /** Awaited after worktree inspection and before the shot is accepted,\n   *  retried, or discarded. Throwing aborts the candidate. */\n  onShotDisposition?: (\n    receipt: AgenticGeneratorShotReceipt,\n    disposition: AgenticGeneratorShotDisposition,\n  ) => void | Promise<void>\n  /** Optional hard upper bound passed to the run-wide CostLedger before each\n   *  author shot. This MUST be enforced by the provider or executor; a planning\n   *  estimate is not an admissible bound. Omit for an uncapped ledger. A capped\n   *  ledger rejects before model dispatch when this is absent. */\n  maximumCharge?: MaximumCharge\n  /** Per-shot wall-clock timeout (ms). Default = `runLocalHarness` default (5m). */\n  timeoutMs?: number\n  /** Build the harness task prompt from the report + findings. Override for\n   *  domain phrasing; the default turns findings into a concrete coder task. */\n  buildPrompt?: (args: { report: unknown; findings: AnalystFinding[] }) => string\n  /** Verify the worktree after each dirtying shot. When set, a candidate that\n   *  fails verification is NOT returned — the failure feeds the next shot\n   *  (verify-in-session), up to `maxShots`; a candidate that never verifies is\n   *  discarded (`applied:false`), never shipped. Omitted ⇒ legacy behavior:\n   *  the first dirty shot is the candidate. See `commandVerifier`. */\n  verify?: Verifier\n  /** Test seam — inject the harness runner (defaults to `runLocalHarness`). */\n  runHarness?: typeof runLocalHarness\n  /** Test seam — inject the worktree-dirty check (defaults to `git status`). */\n  isDirty?: (worktreePath: string) => boolean\n}\n\n/** Full-agentic `CandidateGenerator` (the `shots=N, sandbox=on` setting): run a real coding harness inside the candidate worktree so the agent makes the change in place. */\nexport function agenticGenerator(opts: AgenticGeneratorOptions = {}): CandidateGenerator {\n  const harness = opts.harness ?? 'claude'\n  if (opts.codexReproducible && harness !== 'codex') {\n    throw new Error(\"agenticGenerator: codexReproducible requires harness 'codex'\")\n  }\n  if (opts.codexReproducible && !opts.profile) {\n    throw new Error('agenticGenerator: codexReproducible requires an explicit author profile')\n  }\n  if (opts.codexReadDeniedPaths && !opts.codexReproducible) {\n    throw new Error('agenticGenerator: codexReadDeniedPaths requires codexReproducible')\n  }\n  if (opts.maximumCharge && !opts.codexReproducible) {\n    throw new Error('agenticGenerator: maximumCharge requires codexReproducible')\n  }\n  const profileResourcePlan = opts.codexReproducible\n    ? authorProfileResourcePlan(opts.profile as AgentProfile)\n    : null\n  const buildPrompt = opts.buildPrompt ?? defaultBuildPrompt\n  const run = opts.runHarness ?? runLocalHarness\n  const dirty = opts.isDirty ?? worktreeDirty\n  const verify = opts.verify\n\n  return {\n    kind: `agentic:${harness}`,\n    // The seed repo + (in rawTraceContext mode) the raw-trace filesystem context\n    // are the change signal — an agentic coder proposes from them even when the\n    // distiller yielded zero findings. Without this, the improvementDriver's\n    // empty-findings guard short-circuits and generates ZERO candidates on the\n    // first (and, for a single-generation run, only) proposal round.\n    proposesWithoutFindings: true,\n    async generate({\n      worktreePath,\n      report,\n      findings,\n      maxShots,\n      signal,\n      generation,\n      candidateIndex,\n      costLedger,\n      costPhase,\n    }) {\n      let reproducibleCostLedger: CostLedgerHandle | undefined\n      if (opts.codexReproducible) {\n        if (!costLedger) {\n          throw new Error(\n            'agenticGenerator: reproducible Codex requires the run-wide CostLedger supplied by agent-eval',\n          )\n        }\n        reproducibleCostLedger = costLedger\n      }\n      const basePrompt = appendProfileResourcePaths(\n        buildPrompt({ report, findings }),\n        profileResourcePlan,\n      )\n      const needsRawTraceEvidence = requiresRawTraceEvidence(findings)\n      const shots = Math.max(1, maxShots)\n      // Feedback appended to the base prompt for the NEXT shot — empty on shot 0.\n      let attemptNote = ''\n\n      for (let shot = 0; shot < shots; shot++) {\n        if (signal.aborted) break\n        const taskPrompt = attemptNote ? `${basePrompt}\\n\\n${attemptNote}` : basePrompt\n        const invocation = opts.profile\n          ? harnessInvocation(harness, opts.profile, taskPrompt, {\n              dangerouslySkipPermissions: harness === 'claude',\n              ...(opts.codexReproducible ? { codexReproducible: true } : {}),\n            })\n          : undefined\n        const exactPrompt = invocation?.prompt ?? taskPrompt\n        const readDeniedPaths =\n          typeof opts.codexReadDeniedPaths === 'function'\n            ? opts.codexReadDeniedPaths(worktreePath)\n            : opts.codexReadDeniedPaths\n        const startedAt = new Date()\n        let harnessResult: LocalHarnessResult | null = null\n        let profileWorkspaceReceipt: WorkspacePlanReceipt | null = null\n        let costReceipt: CostReceipt | null = null\n        let costCallId: string | null = null\n        let shotError: Error | null = null\n        try {\n          const execute = async (executionSignal: AbortSignal): Promise<LocalHarnessResult> => {\n            harnessResult = await withAuthorProfileResources(\n              profileResourcePlan,\n              worktreePath,\n              async (receipt) => {\n                profileWorkspaceReceipt = receipt\n                const result = await run({\n                  harness,\n                  cwd: worktreePath,\n                  taskPrompt,\n                  ...(invocation\n                    ? { invocation: { command: invocation.command, args: invocation.args } }\n                    : {}),\n                  // The candidate worktree is isolated and must be editable without an\n                  // interactive permission prompt. Other runLocalHarness callers remain\n                  // permission-safe by default.\n                  dangerouslySkipPermissions: harness === 'claude',\n                  ...(opts.codexReproducible ? { codexReproducible: true } : {}),\n                  ...(readDeniedPaths ? { codexReadDeniedPaths: readDeniedPaths } : {}),\n                  timeoutMs: opts.timeoutMs,\n                  signal: executionSignal,\n                })\n                // Assign before profile cleanup so a cleanup failure still\n                // settles the model usage already returned by the harness.\n                harnessResult = result\n                return result\n              },\n            )\n            const failure = shotFailure(harnessResult, exactPrompt, opts.codexReproducible === true)\n            if (failure) throw failure\n            return harnessResult\n          }\n\n          if (reproducibleCostLedger) {\n            const model = opts.profile?.model?.default\n            if (!model) {\n              throw new Error('agenticGenerator: reproducible Codex requires profile.model.default')\n            }\n            const paid = await reproducibleCostLedger.runPaidCall({\n              channel: 'driver',\n              phase: costPhase ?? 'search.proposal',\n              actor: `agentic-generator:${harness}`,\n              model,\n              tags: {\n                generation: String(generation ?? -1),\n                candidateIndex: String(candidateIndex ?? -1),\n                shot: String(shot + 1),\n              },\n              signal,\n              ...(opts.maximumCharge ? { maximumCharge: opts.maximumCharge } : {}),\n              execute,\n              receipt: (result) => costReceiptFromHarness(result, model),\n              receiptFromError: () =>\n                harnessResult?.usage ? costReceiptFromHarness(harnessResult, model) : undefined,\n            })\n            costCallId = paid.callId ?? null\n            costReceipt = paid.receipt ?? null\n            if (!paid.succeeded) throw paid.error\n            harnessResult = paid.value\n          } else {\n            harnessResult = await execute(signal)\n          }\n        } catch (cause) {\n          shotError = cause instanceof Error ? cause : new Error(String(cause))\n        }\n        const execution = shotExecutionSnapshot(harnessResult)\n        const receipt = shotReceipt({\n          generation,\n          candidateIndex,\n          shot,\n          maxShots: shots,\n          harness,\n          profile: opts.profile,\n          prompt: exactPrompt,\n          startedAt,\n          completedAt: new Date(),\n          result: execution,\n          profileWorkspaceReceipt,\n          costCallId,\n          costReceipt,\n          error: shotError,\n        })\n        await emitShotReceipt(opts.onShotCompleted, receipt, execution, shotError)\n\n        if (!execution) {\n          throw new Error('agenticGenerator: author shot completed without a harness result')\n        }\n\n        let worktreeChanged: boolean\n        try {\n          worktreeChanged = dirty(worktreePath)\n        } catch (cause) {\n          return rethrowShotSetupError(\n            opts.onShotDisposition,\n            receipt,\n            worktreePath,\n            'worktree-inspection',\n            cause,\n          )\n        }\n\n        // The worktree IS the signal: no edits ⇒ tell the next shot to act.\n        if (!worktreeChanged) {\n          await emitShotDisposition(opts.onShotDisposition, receipt, {\n            kind: 'clean',\n            worktreePath,\n          })\n          attemptNote = EMPTY_TREE_NOTE\n          continue\n        }\n\n        if (needsRawTraceEvidence) {\n          let problem: string | null\n          try {\n            problem = rawTraceEvidenceProblem(worktreePath, findings)\n          } catch (cause) {\n            return rethrowShotSetupError(\n              opts.onShotDisposition,\n              receipt,\n              worktreePath,\n              'raw-trace-evidence',\n              cause,\n            )\n          }\n          if (problem) {\n            await emitShotDisposition(opts.onShotDisposition, receipt, {\n              kind: 'rejected',\n              worktreePath,\n              stage: 'raw-trace-evidence',\n              feedback: problem,\n            })\n            attemptNote = problem\n            continue\n          }\n        }\n\n        // Dirty: with no verifier the diff IS the candidate (we trust the diff,\n        // not the harness's stdout). With a verifier the candidate must pass it.\n        if (!verify) {\n          await emitShotDisposition(opts.onShotDisposition, receipt, {\n            kind: 'accepted',\n            worktreePath,\n            verified: false,\n          })\n          return { applied: true, summary: summarize(findings) }\n        }\n        let result: VerifyResult\n        try {\n          result = await verify(worktreePath)\n        } catch (cause) {\n          return rethrowShotSetupError(\n            opts.onShotDisposition,\n            receipt,\n            worktreePath,\n            'verification',\n            cause,\n          )\n        }\n        if (result.ok) {\n          await emitShotDisposition(opts.onShotDisposition, receipt, {\n            kind: 'accepted',\n            worktreePath,\n            verified: true,\n          })\n          return { applied: true, summary: summarize(findings) }\n        }\n        await emitShotDisposition(opts.onShotDisposition, receipt, {\n          kind: 'rejected',\n          worktreePath,\n          stage: 'verification',\n          feedback: result.feedback ?? null,\n        })\n        // Dirty but failing — resume next shot atop these edits with the error.\n        attemptNote = failureNote(result.feedback)\n      }\n\n      // Shots exhausted: no verified candidate (or, sans verifier, no edits).\n      return { applied: false, summary: '' }\n    },\n  }\n}\n\nfunction authorProfileResourcePlan(profile: AgentProfile): WorkspacePlan | null {\n  const resources = profile.resources\n  if (!resources) return null\n  const unsupportedKinds = [\n    resources.tools?.length ? 'tools' : null,\n    resources.skills?.length ? 'skills' : null,\n    resources.agents?.length ? 'agents' : null,\n  ].filter((kind): kind is string => kind !== null)\n  if (unsupportedKinds.length > 0) {\n    throw new Error(\n      `agenticGenerator: reproducible Codex author resources support files only; unsupported: ${unsupportedKinds.join(', ')}`,\n    )\n  }\n  if (!resources.files || resources.files.length === 0) return null\n\n  const plan = materializeProfile(\n    {\n      name: profile.name,\n      resources: { files: resources.files },\n    },\n    'codex',\n  )\n  if (plan.unsupported.length > 0) {\n    throw new Error(\n      `agenticGenerator: author profile files could not be materialized: ${plan.unsupported.map((item) => item.reason).join('; ')}`,\n    )\n  }\n  if (Object.keys(plan.env).length > 0 || plan.flags.length > 0) {\n    throw new Error(\n      'agenticGenerator: generic author profile files unexpectedly changed spawn values',\n    )\n  }\n\n  const virtualRoot = resolve('/', AGENTIC_PROFILE_RESOURCE_ROOT)\n  const seen = new Set<string>()\n  for (const file of plan.files) {\n    const target = resolve('/', file.relPath)\n    if (!target.startsWith(`${virtualRoot}${sep}`)) {\n      throw new Error(\n        `agenticGenerator: author profile file must be below ${AGENTIC_PROFILE_RESOURCE_ROOT}: ${file.relPath}`,\n      )\n    }\n    if (seen.has(target)) {\n      throw new Error(`agenticGenerator: duplicate author profile file path: ${file.relPath}`)\n    }\n    seen.add(target)\n  }\n  return plan\n}\n\nfunction appendProfileResourcePaths(prompt: string, plan: WorkspacePlan | null): string {\n  if (!plan) return prompt\n  return [\n    prompt,\n    '',\n    'Profile resource files available for this shot:',\n    ...plan.files.map((file) => `- ${file.relPath}`),\n  ].join('\\n')\n}\n\nasync function withAuthorProfileResources<T>(\n  plan: WorkspacePlan | null,\n  worktreePath: string,\n  run: (receipt: WorkspacePlanReceipt | null) => Promise<T>,\n): Promise<T> {\n  if (!plan) return run(null)\n\n  const rootPath = resolve(worktreePath, AGENTIC_PROFILE_RESOURCE_ROOT)\n  if (existsSync(rootPath)) {\n    throw new Error(\n      `agenticGenerator: ephemeral author profile root already exists: ${AGENTIC_PROFILE_RESOURCE_ROOT}`,\n    )\n  }\n\n  let value: T | undefined\n  let primaryError: unknown\n  try {\n    const receipt = applyWorkspacePlan(plan, worktreePath)\n    value = await run(receipt)\n  } catch (cause) {\n    primaryError = cause\n  }\n\n  let cleanupError: unknown\n  try {\n    rmSync(rootPath, { recursive: true, force: true })\n    if (existsSync(rootPath)) {\n      throw new Error(\n        `agenticGenerator: ephemeral author profile root survived cleanup: ${AGENTIC_PROFILE_RESOURCE_ROOT}`,\n      )\n    }\n  } catch (cause) {\n    cleanupError = cause\n  }\n\n  if (primaryError !== undefined && cleanupError !== undefined) {\n    throw new AggregateError(\n      [primaryError, cleanupError],\n      'agenticGenerator: author shot and profile resource cleanup both failed',\n    )\n  }\n  if (primaryError !== undefined) throw primaryError\n  if (cleanupError !== undefined) throw cleanupError\n  return value as T\n}\n\nasync function emitShotReceipt(\n  callback: AgenticGeneratorOptions['onShotCompleted'],\n  receipt: AgenticGeneratorShotReceipt,\n  execution: AgenticGeneratorShotExecution | null,\n  primaryError: Error | null,\n): Promise<void> {\n  try {\n    await callback?.(receipt, execution)\n  } catch (callbackError) {\n    if (primaryError !== null) {\n      throw new AggregateError(\n        [primaryError, callbackError],\n        'agenticGenerator: author shot failed and its receipt could not be persisted',\n      )\n    }\n    throw callbackError\n  }\n  if (primaryError !== null) throw primaryError\n}\n\nasync function emitShotDisposition(\n  callback: AgenticGeneratorOptions['onShotDisposition'],\n  receipt: AgenticGeneratorShotReceipt,\n  disposition: AgenticGeneratorShotDisposition,\n): Promise<void> {\n  await callback?.(receipt, disposition)\n}\n\nasync function rethrowShotSetupError(\n  callback: AgenticGeneratorOptions['onShotDisposition'],\n  receipt: AgenticGeneratorShotReceipt,\n  worktreePath: string,\n  stage: Extract<AgenticGeneratorShotDisposition, { kind: 'setup-error' }>['stage'],\n  cause: unknown,\n): Promise<never> {\n  const error = cause instanceof Error ? cause : new Error(String(cause))\n  try {\n    await emitShotDisposition(callback, receipt, {\n      kind: 'setup-error',\n      worktreePath,\n      stage,\n      error: { name: error.name, message: error.message },\n    })\n  } catch (callbackError) {\n    throw new AggregateError(\n      [cause, callbackError],\n      'agenticGenerator: shot processing failed and its worktree disposition could not be persisted',\n    )\n  }\n  throw cause\n}\n\nfunction shotExecutionSnapshot(\n  result: LocalHarnessResult | null,\n): AgenticGeneratorShotExecution | null {\n  if (result === null) return null\n  const usage = result.usage ? Object.freeze({ ...result.usage }) : undefined\n  const evidence = result.evidence\n    ? Object.freeze({\n        ...result.evidence,\n        readDeniedPaths: Object.freeze([...result.evidence.readDeniedPaths]),\n        policy: Object.freeze({ ...result.evidence.policy }),\n      })\n    : undefined\n  return Object.freeze({\n    exitCode: result.exitCode,\n    stdout: result.stdout,\n    stderr: result.stderr,\n    killedBySignal: result.killedBySignal,\n    durationMs: result.durationMs,\n    timedOut: result.timedOut,\n    ...(usage ? { usage } : {}),\n    ...(evidence ? { evidence } : {}),\n  })\n}\n\nfunction shotReceipt(input: {\n  readonly generation: number | undefined\n  readonly candidateIndex: number | undefined\n  readonly shot: number\n  readonly maxShots: number\n  readonly harness: LocalHarness\n  readonly profile: AgentProfile | undefined\n  readonly prompt: string\n  readonly startedAt: Date\n  readonly completedAt: Date\n  readonly result: AgenticGeneratorShotExecution | null\n  readonly profileWorkspaceReceipt: WorkspacePlanReceipt | null\n  readonly costCallId: string | null\n  readonly costReceipt: CostReceipt | null\n  readonly error: unknown\n}): AgenticGeneratorShotReceipt {\n  const error = input.error\n    ? {\n        name: input.error instanceof Error ? input.error.name : 'Error',\n        message: input.error instanceof Error ? input.error.message : String(input.error),\n      }\n    : null\n  const result = input.result\n  const costBasis = costBasisFor(input.costReceipt)\n  return {\n    generation: input.generation ?? null,\n    candidateIndex: input.candidateIndex ?? null,\n    shot: input.shot + 1,\n    maxShots: input.maxShots,\n    harness: input.harness,\n    model: input.profile?.model?.default ?? null,\n    reasoningEffort: input.profile?.model?.reasoningEffort ?? null,\n    promptSha256: sha256(input.prompt),\n    startedAt: input.startedAt.toISOString(),\n    completedAt: input.completedAt.toISOString(),\n    durationMs: result?.durationMs ?? input.completedAt.getTime() - input.startedAt.getTime(),\n    exitCode: result?.exitCode ?? null,\n    timedOut: result?.timedOut ?? false,\n    killedBySignal: result?.killedBySignal ?? null,\n    stdoutBytes: result ? Buffer.byteLength(result.stdout) : null,\n    stdoutSha256: result ? sha256(result.stdout) : null,\n    stderrBytes: result ? Buffer.byteLength(result.stderr) : null,\n    stderrSha256: result ? sha256(result.stderr) : null,\n    usage: result?.usage ? { ...result.usage } : null,\n    profileWorkspacePlanDigest: input.profileWorkspaceReceipt?.workspacePlanDigest ?? null,\n    profileWorkspaceFileCount: input.profileWorkspaceReceipt?.written.length ?? 0,\n    costCallId: input.costCallId,\n    costBasis,\n    costUsd: costBasis === 'unknown' ? null : (input.costReceipt?.costUsd ?? null),\n    costUsdKnown: costBasis === 'provider-reported',\n    evidence: result?.evidence\n      ? {\n          ...result.evidence,\n          readDeniedPaths: [...result.evidence.readDeniedPaths],\n          policy: { ...result.evidence.policy },\n        }\n      : null,\n    error,\n  }\n}\n\nfunction costBasisFor(receipt: CostReceipt | null): AgenticGeneratorShotReceipt['costBasis'] {\n  if (receipt === null || receipt.costUnknown) return 'unknown'\n  return receipt.actualCostUsd === undefined ? 'estimated-pricing' : 'provider-reported'\n}\n\nfunction shotFailure(\n  result: LocalHarnessResult,\n  exactPrompt: string,\n  codexReproducible: boolean,\n): Error | null {\n  if (result.timedOut) {\n    return new Error('agenticGenerator: author shot timed out')\n  }\n  if (result.killedBySignal) {\n    return new Error(`agenticGenerator: author shot was killed by ${result.killedBySignal}`)\n  }\n  if (result.exitCode !== 0) {\n    return new Error(`agenticGenerator: author shot exited with code ${String(result.exitCode)}`)\n  }\n  if (!codexReproducible) return null\n  if (!result.usage || !result.evidence) {\n    return new Error(\n      'agenticGenerator: reproducible Codex shot completed without usage or execution evidence',\n    )\n  }\n  const expectedPromptSha256 = sha256(exactPrompt).slice('sha256:'.length)\n  if (result.evidence.requestedPromptSha256 !== expectedPromptSha256) {\n    return new Error(\n      'agenticGenerator: reproducible Codex prompt evidence does not match the exact authored prompt',\n    )\n  }\n  return null\n}\n\nfunction costReceiptFromHarness(result: LocalHarnessResult, model: string): CostReceiptInput {\n  if (!result.usage) {\n    throw new Error('agenticGenerator: author shot did not report terminal token usage')\n  }\n  return {\n    model,\n    inputTokens: result.usage.inputTokens - result.usage.cachedInputTokens,\n    outputTokens: result.usage.outputTokens,\n    ...(result.usage.cachedInputTokens > 0 ? { cachedTokens: result.usage.cachedInputTokens } : {}),\n  }\n}\n\nfunction sha256(value: string): `sha256:${string}` {\n  return `sha256:${createHash('sha256').update(value).digest('hex')}`\n}\n\n/** Turn the analyst's findings (+ optional report) into a concrete coder task. */\nfunction defaultBuildPrompt(args: { report: unknown; findings: AnalystFinding[] }): string {\n  const lines: string[] = [\n    'You are improving this codebase based on an evaluation analysis.',\n    'Make the smallest set of edits that addresses the findings below, then stop.',\n    'Do not change unrelated code. Do not commit — leave changes in the working tree.',\n    '',\n    'Findings:',\n  ]\n  for (const f of args.findings) {\n    const where = f.subject ? ` [${f.subject}]` : ''\n    lines.push(`- (${f.severity})${where} ${f.claim}`)\n    if (f.recommended_action) lines.push(`    → ${f.recommended_action}`)\n  }\n  if (requiresRawTraceEvidence(args.findings)) {\n    lines.push(\n      '',\n      'Raw trace evidence requirement:',\n      `- Inspect at least one raw trace path named above before editing.`,\n      `- Write ${RAW_TRACE_DIAGNOSIS_PATH} in this worktree.`,\n      '- Include the exact trace path(s) inspected, the failure mechanism, and the code change made.',\n      '- A candidate without this file, or with only this file changed, is discarded.',\n    )\n  }\n  return lines.join('\\n')\n}\n\nconst EMPTY_TREE_NOTE =\n  'NOTE: your previous attempt left the working tree unchanged. Make the concrete file edits now.'\n\n/** Next-shot feedback when the worktree is dirty but failed verification. The\n *  edits persist on disk, so the harness resumes atop them — tell it to fix in\n *  place, not start over. Verifier detail is truncated to keep the prompt bounded. */\nfunction failureNote(feedback?: string): string {\n  const detail = feedback?.trim()\n  return [\n    'NOTE: your edits are in the working tree but verification FAILED.',\n    'Fix the problem in place — build on your existing edits, do not revert them.',\n    detail ? `Verifier output:\\n${truncate(detail, 4000)}` : 'No verifier detail was captured.',\n  ].join('\\n')\n}\n\nfunction rawTraceEvidenceProblem(worktreePath: string, findings: AnalystFinding[]): string | null {\n  const changedPaths = worktreeChangedPaths(worktreePath)\n  const substantive = changedPaths.filter((path) => path !== RAW_TRACE_DIAGNOSIS_PATH)\n  if (substantive.length === 0) {\n    return [\n      `NOTE: raw-trace mode requires a real code/config edit in addition to ${RAW_TRACE_DIAGNOSIS_PATH}.`,\n      'Your previous attempt only changed the diagnosis artifact. Inspect the cited traces and make the causal code change.',\n    ].join('\\n')\n  }\n\n  const diagnosisPath = join(worktreePath, RAW_TRACE_DIAGNOSIS_PATH)\n  if (!existsSync(diagnosisPath)) {\n    return [\n      `NOTE: raw-trace mode requires ${RAW_TRACE_DIAGNOSIS_PATH}.`,\n      'Before retrying, inspect at least one cited spans.jsonl/cached-result.json/artifact path, then write the diagnosis file with the exact path, failure mechanism, and code change.',\n    ].join('\\n')\n  }\n\n  const body = readFileSync(diagnosisPath, 'utf8')\n  const evidencePaths = traceEvidencePaths(findings)\n  if (evidencePaths.length > 0 && !evidencePaths.some((path) => body.includes(path))) {\n    return [\n      `${RAW_TRACE_DIAGNOSIS_PATH} exists, but it does not cite any exact raw trace path from the findings.`,\n      `Cite at least one of these inspected paths exactly: ${evidencePaths.slice(0, 5).join(', ')}`,\n    ].join('\\n')\n  }\n\n  return null\n}\n\nfunction requiresRawTraceEvidence(findings: AnalystFinding[]): boolean {\n  return findings.some((finding) => {\n    const f = finding as unknown as Record<string, unknown>\n    return f.analyst_id === RAW_TRACE_ANALYST_ID || f.area === RAW_TRACE_AREA\n  })\n}\n\nfunction traceEvidencePaths(findings: AnalystFinding[]): string[] {\n  const out: string[] = []\n  for (const finding of findings) {\n    const refs = (finding as unknown as { evidence_refs?: unknown }).evidence_refs\n    if (!Array.isArray(refs)) continue\n    for (const ref of refs) {\n      if (!ref || typeof ref !== 'object') continue\n      const uri = (ref as { uri?: unknown }).uri\n      if (typeof uri === 'string' && uri.length > 0) out.push(uri)\n    }\n  }\n  return [...new Set(out)]\n}\n\n/** A `Verifier` that runs a command in the worktree: exit 0 ⇒ ok, any other\n *  exit ⇒ failed with stdout+stderr as feedback. The common case — verify by\n *  `tsc --noEmit`, `pnpm build`, or a test command. A timeout is treated as a\n *  FAILED candidate (a change that hangs the build is a bad change); a missing\n *  binary or spawn fault throws (a setup bug, not a failed candidate — no\n *  silent fallback). */\nexport function commandVerifier(\n  command: string,\n  args: string[] = [],\n  timeoutMs = 300_000,\n): Verifier {\n  return (worktreePath: string): VerifyResult => {\n    const result = spawnSync(command, args, {\n      cwd: worktreePath,\n      encoding: 'utf-8',\n      timeout: timeoutMs,\n    })\n    if (result.signal) {\n      return {\n        ok: false,\n        feedback: `verifier '${command}' killed by ${result.signal} (likely timeout after ${timeoutMs}ms)`,\n      }\n    }\n    if (result.error) {\n      const code = (result.error as NodeJS.ErrnoException).code\n      if (code === 'ENOENT') {\n        throw new Error(\n          `commandVerifier: '${command}' not found in PATH (setup bug, not a failed candidate)`,\n        )\n      }\n      throw new Error(`commandVerifier: '${command}' failed to spawn: ${result.error.message}`)\n    }\n    if (result.status === 0) return { ok: true }\n    const out = `${result.stdout ?? ''}${result.stderr ?? ''}`.trim()\n    return { ok: false, feedback: out.length > 0 ? out : `exit ${result.status}` }\n  }\n}\n\n/** A one-line summary for the commit message, derived from the findings. */\nfunction summarize(findings: AnalystFinding[]): string {\n  if (findings.length === 0) return 'agentic improvement'\n  if (findings.length === 1) return `agentic: ${truncate(findings[0]!.claim, 64)}`\n  return `agentic: ${findings.length} findings addressed`\n}\n\nfunction truncate(s: string, n: number): string {\n  return s.length <= n ? s : `${s.slice(0, n - 1)}…`\n}\n\n/** Non-empty `git status --porcelain` ⇒ the harness changed the worktree.\n *  Fails loud: the worktree is a fresh checkout, so a git error here means\n *  something is genuinely broken (git missing, corrupt index, killed mid-run).\n *  Folding that into `false` would silently discard a candidate and mask the\n *  real failure — forbidden by the no-silent-fallbacks doctrine. */\nfunction worktreeDirty(worktreePath: string): boolean {\n  return worktreeChangedPaths(worktreePath).length > 0\n}\n\nfunction worktreeChangedPaths(worktreePath: string): string[] {\n  const result = spawnSync('git', ['status', '--porcelain', '--untracked-files=all'], {\n    cwd: worktreePath,\n    encoding: 'utf-8',\n  })\n  if (result.error) {\n    throw new Error(\n      `agenticGenerator: git status failed to spawn in ${worktreePath}: ${result.error.message}`,\n    )\n  }\n  if (result.status !== 0) {\n    throw new Error(\n      `agenticGenerator: git status exited ${result.status} in ${worktreePath}: ${result.stderr.trim()}`,\n    )\n  }\n  return result.stdout\n    .split('\\n')\n    .map((line) => line.trim())\n    .filter((line) => line.length > 0)\n    .map((line) => line.slice(3).trim())\n}\n"],"mappings":";;;;;;AAkCA,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,YAAY,cAAc,cAAc;AACjD,SAAS,MAAM,SAAS,WAAW;AASnC;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAWP,IAAM,uBAAuB;AAC7B,IAAM,iBAAiB;AACvB,IAAM,2BAA2B;AAI1B,IAAM,gCAAgC;AA0ItC,SAAS,iBAAiB,OAAgC,CAAC,GAAuB;AACvF,QAAM,UAAU,KAAK,WAAW;AAChC,MAAI,KAAK,qBAAqB,YAAY,SAAS;AACjD,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,MAAI,KAAK,qBAAqB,CAAC,KAAK,SAAS;AAC3C,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AACA,MAAI,KAAK,wBAAwB,CAAC,KAAK,mBAAmB;AACxD,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,MAAI,KAAK,iBAAiB,CAAC,KAAK,mBAAmB;AACjD,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,sBAAsB,KAAK,oBAC7B,0BAA0B,KAAK,OAAuB,IACtD;AACJ,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,MAAM,KAAK,cAAc;AAC/B,QAAM,QAAQ,KAAK,WAAW;AAC9B,QAAM,SAAS,KAAK;AAEpB,SAAO;AAAA,IACL,MAAM,WAAW,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMxB,yBAAyB;AAAA,IACzB,MAAM,SAAS;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,GAAG;AACD,UAAI;AACJ,UAAI,KAAK,mBAAmB;AAC1B,YAAI,CAAC,YAAY;AACf,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AACA,iCAAyB;AAAA,MAC3B;AACA,YAAM,aAAa;AAAA,QACjB,YAAY,EAAE,QAAQ,SAAS,CAAC;AAAA,QAChC;AAAA,MACF;AACA,YAAM,wBAAwB,yBAAyB,QAAQ;AAC/D,YAAM,QAAQ,KAAK,IAAI,GAAG,QAAQ;AAElC,UAAI,cAAc;AAElB,eAAS,OAAO,GAAG,OAAO,OAAO,QAAQ;AACvC,YAAI,OAAO,QAAS;AACpB,cAAM,aAAa,cAAc,GAAG,UAAU;AAAA;AAAA,EAAO,WAAW,KAAK;AACrE,cAAM,aAAa,KAAK,UACpB,kBAAkB,SAAS,KAAK,SAAS,YAAY;AAAA,UACnD,4BAA4B,YAAY;AAAA,UACxC,GAAI,KAAK,oBAAoB,EAAE,mBAAmB,KAAK,IAAI,CAAC;AAAA,QAC9D,CAAC,IACD;AACJ,cAAM,cAAc,YAAY,UAAU;AAC1C,cAAM,kBACJ,OAAO,KAAK,yBAAyB,aACjC,KAAK,qBAAqB,YAAY,IACtC,KAAK;AACX,cAAM,YAAY,oBAAI,KAAK;AAC3B,YAAI,gBAA2C;AAC/C,YAAI,0BAAuD;AAC3D,YAAI,cAAkC;AACtC,YAAI,aAA4B;AAChC,YAAI,YAA0B;AAC9B,YAAI;AACF,gBAAM,UAAU,OAAO,oBAA8D;AACnF,4BAAgB,MAAM;AAAA,cACpB;AAAA,cACA;AAAA,cACA,OAAOA,aAAY;AACjB,0CAA0BA;AAC1B,sBAAMC,UAAS,MAAM,IAAI;AAAA,kBACvB;AAAA,kBACA,KAAK;AAAA,kBACL;AAAA,kBACA,GAAI,aACA,EAAE,YAAY,EAAE,SAAS,WAAW,SAAS,MAAM,WAAW,KAAK,EAAE,IACrE,CAAC;AAAA;AAAA;AAAA;AAAA,kBAIL,4BAA4B,YAAY;AAAA,kBACxC,GAAI,KAAK,oBAAoB,EAAE,mBAAmB,KAAK,IAAI,CAAC;AAAA,kBAC5D,GAAI,kBAAkB,EAAE,sBAAsB,gBAAgB,IAAI,CAAC;AAAA,kBACnE,WAAW,KAAK;AAAA,kBAChB,QAAQ;AAAA,gBACV,CAAC;AAGD,gCAAgBA;AAChB,uBAAOA;AAAA,cACT;AAAA,YACF;AACA,kBAAM,UAAU,YAAY,eAAe,aAAa,KAAK,sBAAsB,IAAI;AACvF,gBAAI,QAAS,OAAM;AACnB,mBAAO;AAAA,UACT;AAEA,cAAI,wBAAwB;AAC1B,kBAAM,QAAQ,KAAK,SAAS,OAAO;AACnC,gBAAI,CAAC,OAAO;AACV,oBAAM,IAAI,MAAM,qEAAqE;AAAA,YACvF;AACA,kBAAM,OAAO,MAAM,uBAAuB,YAAY;AAAA,cACpD,SAAS;AAAA,cACT,OAAO,aAAa;AAAA,cACpB,OAAO,qBAAqB,OAAO;AAAA,cACnC;AAAA,cACA,MAAM;AAAA,gBACJ,YAAY,OAAO,cAAc,EAAE;AAAA,gBACnC,gBAAgB,OAAO,kBAAkB,EAAE;AAAA,gBAC3C,MAAM,OAAO,OAAO,CAAC;AAAA,cACvB;AAAA,cACA;AAAA,cACA,GAAI,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,cAClE;AAAA,cACA,SAAS,CAACA,YAAW,uBAAuBA,SAAQ,KAAK;AAAA,cACzD,kBAAkB,MAChB,eAAe,QAAQ,uBAAuB,eAAe,KAAK,IAAI;AAAA,YAC1E,CAAC;AACD,yBAAa,KAAK,UAAU;AAC5B,0BAAc,KAAK,WAAW;AAC9B,gBAAI,CAAC,KAAK,UAAW,OAAM,KAAK;AAChC,4BAAgB,KAAK;AAAA,UACvB,OAAO;AACL,4BAAgB,MAAM,QAAQ,MAAM;AAAA,UACtC;AAAA,QACF,SAAS,OAAO;AACd,sBAAY,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,QACtE;AACA,cAAM,YAAY,sBAAsB,aAAa;AACrD,cAAM,UAAU,YAAY;AAAA,UAC1B;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU;AAAA,UACV;AAAA,UACA,SAAS,KAAK;AAAA,UACd,QAAQ;AAAA,UACR;AAAA,UACA,aAAa,oBAAI,KAAK;AAAA,UACtB,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,cAAM,gBAAgB,KAAK,iBAAiB,SAAS,WAAW,SAAS;AAEzE,YAAI,CAAC,WAAW;AACd,gBAAM,IAAI,MAAM,kEAAkE;AAAA,QACpF;AAEA,YAAI;AACJ,YAAI;AACF,4BAAkB,MAAM,YAAY;AAAA,QACtC,SAAS,OAAO;AACd,iBAAO;AAAA,YACL,KAAK;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAGA,YAAI,CAAC,iBAAiB;AACpB,gBAAM,oBAAoB,KAAK,mBAAmB,SAAS;AAAA,YACzD,MAAM;AAAA,YACN;AAAA,UACF,CAAC;AACD,wBAAc;AACd;AAAA,QACF;AAEA,YAAI,uBAAuB;AACzB,cAAI;AACJ,cAAI;AACF,sBAAU,wBAAwB,cAAc,QAAQ;AAAA,UAC1D,SAAS,OAAO;AACd,mBAAO;AAAA,cACL,KAAK;AAAA,cACL;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,SAAS;AACX,kBAAM,oBAAoB,KAAK,mBAAmB,SAAS;AAAA,cACzD,MAAM;AAAA,cACN;AAAA,cACA,OAAO;AAAA,cACP,UAAU;AAAA,YACZ,CAAC;AACD,0BAAc;AACd;AAAA,UACF;AAAA,QACF;AAIA,YAAI,CAAC,QAAQ;AACX,gBAAM,oBAAoB,KAAK,mBAAmB,SAAS;AAAA,YACzD,MAAM;AAAA,YACN;AAAA,YACA,UAAU;AAAA,UACZ,CAAC;AACD,iBAAO,EAAE,SAAS,MAAM,SAAS,UAAU,QAAQ,EAAE;AAAA,QACvD;AACA,YAAI;AACJ,YAAI;AACF,mBAAS,MAAM,OAAO,YAAY;AAAA,QACpC,SAAS,OAAO;AACd,iBAAO;AAAA,YACL,KAAK;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,IAAI;AACb,gBAAM,oBAAoB,KAAK,mBAAmB,SAAS;AAAA,YACzD,MAAM;AAAA,YACN;AAAA,YACA,UAAU;AAAA,UACZ,CAAC;AACD,iBAAO,EAAE,SAAS,MAAM,SAAS,UAAU,QAAQ,EAAE;AAAA,QACvD;AACA,cAAM,oBAAoB,KAAK,mBAAmB,SAAS;AAAA,UACzD,MAAM;AAAA,UACN;AAAA,UACA,OAAO;AAAA,UACP,UAAU,OAAO,YAAY;AAAA,QAC/B,CAAC;AAED,sBAAc,YAAY,OAAO,QAAQ;AAAA,MAC3C;AAGA,aAAO,EAAE,SAAS,OAAO,SAAS,GAAG;AAAA,IACvC;AAAA,EACF;AACF;AAEA,SAAS,0BAA0B,SAA6C;AAC9E,QAAM,YAAY,QAAQ;AAC1B,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,mBAAmB;AAAA,IACvB,UAAU,OAAO,SAAS,UAAU;AAAA,IACpC,UAAU,QAAQ,SAAS,WAAW;AAAA,IACtC,UAAU,QAAQ,SAAS,WAAW;AAAA,EACxC,EAAE,OAAO,CAAC,SAAyB,SAAS,IAAI;AAChD,MAAI,iBAAiB,SAAS,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR,0FAA0F,iBAAiB,KAAK,IAAI,CAAC;AAAA,IACvH;AAAA,EACF;AACA,MAAI,CAAC,UAAU,SAAS,UAAU,MAAM,WAAW,EAAG,QAAO;AAE7D,QAAM,OAAO;AAAA,IACX;AAAA,MACE,MAAM,QAAQ;AAAA,MACd,WAAW,EAAE,OAAO,UAAU,MAAM;AAAA,IACtC;AAAA,IACA;AAAA,EACF;AACA,MAAI,KAAK,YAAY,SAAS,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR,qEAAqE,KAAK,YAAY,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,IAC7H;AAAA,EACF;AACA,MAAI,OAAO,KAAK,KAAK,GAAG,EAAE,SAAS,KAAK,KAAK,MAAM,SAAS,GAAG;AAC7D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,QAAQ,KAAK,6BAA6B;AAC9D,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,QAAQ,KAAK,OAAO;AAC7B,UAAM,SAAS,QAAQ,KAAK,KAAK,OAAO;AACxC,QAAI,CAAC,OAAO,WAAW,GAAG,WAAW,GAAG,GAAG,EAAE,GAAG;AAC9C,YAAM,IAAI;AAAA,QACR,uDAAuD,6BAA6B,KAAK,KAAK,OAAO;AAAA,MACvG;AAAA,IACF;AACA,QAAI,KAAK,IAAI,MAAM,GAAG;AACpB,YAAM,IAAI,MAAM,yDAAyD,KAAK,OAAO,EAAE;AAAA,IACzF;AACA,SAAK,IAAI,MAAM;AAAA,EACjB;AACA,SAAO;AACT;AAEA,SAAS,2BAA2B,QAAgB,MAAoC;AACtF,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,KAAK,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,OAAO,EAAE;AAAA,EACjD,EAAE,KAAK,IAAI;AACb;AAEA,eAAe,2BACb,MACA,cACA,KACY;AACZ,MAAI,CAAC,KAAM,QAAO,IAAI,IAAI;AAE1B,QAAM,WAAW,QAAQ,cAAc,6BAA6B;AACpE,MAAI,WAAW,QAAQ,GAAG;AACxB,UAAM,IAAI;AAAA,MACR,mEAAmE,6BAA6B;AAAA,IAClG;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,mBAAmB,MAAM,YAAY;AACrD,YAAQ,MAAM,IAAI,OAAO;AAAA,EAC3B,SAAS,OAAO;AACd,mBAAe;AAAA,EACjB;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACjD,QAAI,WAAW,QAAQ,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,qEAAqE,6BAA6B;AAAA,MACpG;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,mBAAe;AAAA,EACjB;AAEA,MAAI,iBAAiB,UAAa,iBAAiB,QAAW;AAC5D,UAAM,IAAI;AAAA,MACR,CAAC,cAAc,YAAY;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,MAAI,iBAAiB,OAAW,OAAM;AACtC,MAAI,iBAAiB,OAAW,OAAM;AACtC,SAAO;AACT;AAEA,eAAe,gBACb,UACA,SACA,WACA,cACe;AACf,MAAI;AACF,UAAM,WAAW,SAAS,SAAS;AAAA,EACrC,SAAS,eAAe;AACtB,QAAI,iBAAiB,MAAM;AACzB,YAAM,IAAI;AAAA,QACR,CAAC,cAAc,aAAa;AAAA,QAC5B;AAAA,MACF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,MAAI,iBAAiB,KAAM,OAAM;AACnC;AAEA,eAAe,oBACb,UACA,SACA,aACe;AACf,QAAM,WAAW,SAAS,WAAW;AACvC;AAEA,eAAe,sBACb,UACA,SACA,cACA,OACA,OACgB;AAChB,QAAM,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACtE,MAAI;AACF,UAAM,oBAAoB,UAAU,SAAS;AAAA,MAC3C,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,OAAO,EAAE,MAAM,MAAM,MAAM,SAAS,MAAM,QAAQ;AAAA,IACpD,CAAC;AAAA,EACH,SAAS,eAAe;AACtB,UAAM,IAAI;AAAA,MACR,CAAC,OAAO,aAAa;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACA,QAAM;AACR;AAEA,SAAS,sBACP,QACsC;AACtC,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,QAAQ,OAAO,QAAQ,OAAO,OAAO,EAAE,GAAG,OAAO,MAAM,CAAC,IAAI;AAClE,QAAM,WAAW,OAAO,WACpB,OAAO,OAAO;AAAA,IACZ,GAAG,OAAO;AAAA,IACV,iBAAiB,OAAO,OAAO,CAAC,GAAG,OAAO,SAAS,eAAe,CAAC;AAAA,IACnE,QAAQ,OAAO,OAAO,EAAE,GAAG,OAAO,SAAS,OAAO,CAAC;AAAA,EACrD,CAAC,IACD;AACJ,SAAO,OAAO,OAAO;AAAA,IACnB,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,gBAAgB,OAAO;AAAA,IACvB,YAAY,OAAO;AAAA,IACnB,UAAU,OAAO;AAAA,IACjB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,EACjC,CAAC;AACH;AAEA,SAAS,YAAY,OAeW;AAC9B,QAAM,QAAQ,MAAM,QAChB;AAAA,IACE,MAAM,MAAM,iBAAiB,QAAQ,MAAM,MAAM,OAAO;AAAA,IACxD,SAAS,MAAM,iBAAiB,QAAQ,MAAM,MAAM,UAAU,OAAO,MAAM,KAAK;AAAA,EAClF,IACA;AACJ,QAAM,SAAS,MAAM;AACrB,QAAM,YAAY,aAAa,MAAM,WAAW;AAChD,SAAO;AAAA,IACL,YAAY,MAAM,cAAc;AAAA,IAChC,gBAAgB,MAAM,kBAAkB;AAAA,IACxC,MAAM,MAAM,OAAO;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,OAAO,MAAM,SAAS,OAAO,WAAW;AAAA,IACxC,iBAAiB,MAAM,SAAS,OAAO,mBAAmB;AAAA,IAC1D,cAAc,OAAO,MAAM,MAAM;AAAA,IACjC,WAAW,MAAM,UAAU,YAAY;AAAA,IACvC,aAAa,MAAM,YAAY,YAAY;AAAA,IAC3C,YAAY,QAAQ,cAAc,MAAM,YAAY,QAAQ,IAAI,MAAM,UAAU,QAAQ;AAAA,IACxF,UAAU,QAAQ,YAAY;AAAA,IAC9B,UAAU,QAAQ,YAAY;AAAA,IAC9B,gBAAgB,QAAQ,kBAAkB;AAAA,IAC1C,aAAa,SAAS,OAAO,WAAW,OAAO,MAAM,IAAI;AAAA,IACzD,cAAc,SAAS,OAAO,OAAO,MAAM,IAAI;AAAA,IAC/C,aAAa,SAAS,OAAO,WAAW,OAAO,MAAM,IAAI;AAAA,IACzD,cAAc,SAAS,OAAO,OAAO,MAAM,IAAI;AAAA,IAC/C,OAAO,QAAQ,QAAQ,EAAE,GAAG,OAAO,MAAM,IAAI;AAAA,IAC7C,4BAA4B,MAAM,yBAAyB,uBAAuB;AAAA,IAClF,2BAA2B,MAAM,yBAAyB,QAAQ,UAAU;AAAA,IAC5E,YAAY,MAAM;AAAA,IAClB;AAAA,IACA,SAAS,cAAc,YAAY,OAAQ,MAAM,aAAa,WAAW;AAAA,IACzE,cAAc,cAAc;AAAA,IAC5B,UAAU,QAAQ,WACd;AAAA,MACE,GAAG,OAAO;AAAA,MACV,iBAAiB,CAAC,GAAG,OAAO,SAAS,eAAe;AAAA,MACpD,QAAQ,EAAE,GAAG,OAAO,SAAS,OAAO;AAAA,IACtC,IACA;AAAA,IACJ;AAAA,EACF;AACF;AAEA,SAAS,aAAa,SAAuE;AAC3F,MAAI,YAAY,QAAQ,QAAQ,YAAa,QAAO;AACpD,SAAO,QAAQ,kBAAkB,SAAY,sBAAsB;AACrE;AAEA,SAAS,YACP,QACA,aACA,mBACc;AACd,MAAI,OAAO,UAAU;AACnB,WAAO,IAAI,MAAM,yCAAyC;AAAA,EAC5D;AACA,MAAI,OAAO,gBAAgB;AACzB,WAAO,IAAI,MAAM,+CAA+C,OAAO,cAAc,EAAE;AAAA,EACzF;AACA,MAAI,OAAO,aAAa,GAAG;AACzB,WAAO,IAAI,MAAM,kDAAkD,OAAO,OAAO,QAAQ,CAAC,EAAE;AAAA,EAC9F;AACA,MAAI,CAAC,kBAAmB,QAAO;AAC/B,MAAI,CAAC,OAAO,SAAS,CAAC,OAAO,UAAU;AACrC,WAAO,IAAI;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,QAAM,uBAAuB,OAAO,WAAW,EAAE,MAAM,UAAU,MAAM;AACvE,MAAI,OAAO,SAAS,0BAA0B,sBAAsB;AAClE,WAAO,IAAI;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,uBAAuB,QAA4B,OAAiC;AAC3F,MAAI,CAAC,OAAO,OAAO;AACjB,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,OAAO,MAAM,cAAc,OAAO,MAAM;AAAA,IACrD,cAAc,OAAO,MAAM;AAAA,IAC3B,GAAI,OAAO,MAAM,oBAAoB,IAAI,EAAE,cAAc,OAAO,MAAM,kBAAkB,IAAI,CAAC;AAAA,EAC/F;AACF;AAEA,SAAS,OAAO,OAAmC;AACjD,SAAO,UAAU,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AACnE;AAGA,SAAS,mBAAmB,MAA+D;AACzF,QAAM,QAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,aAAW,KAAK,KAAK,UAAU;AAC7B,UAAM,QAAQ,EAAE,UAAU,KAAK,EAAE,OAAO,MAAM;AAC9C,UAAM,KAAK,MAAM,EAAE,QAAQ,IAAI,KAAK,IAAI,EAAE,KAAK,EAAE;AACjD,QAAI,EAAE,mBAAoB,OAAM,KAAK,cAAS,EAAE,kBAAkB,EAAE;AAAA,EACtE;AACA,MAAI,yBAAyB,KAAK,QAAQ,GAAG;AAC3C,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,wBAAwB;AAAA,MACnC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,IAAM,kBACJ;AAKF,SAAS,YAAY,UAA2B;AAC9C,QAAM,SAAS,UAAU,KAAK;AAC9B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS;AAAA,EAAqB,SAAS,QAAQ,GAAI,CAAC,KAAK;AAAA,EAC3D,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,wBAAwB,cAAsB,UAA2C;AAChG,QAAM,eAAe,qBAAqB,YAAY;AACtD,QAAM,cAAc,aAAa,OAAO,CAAC,SAAS,SAAS,wBAAwB;AACnF,MAAI,YAAY,WAAW,GAAG;AAC5B,WAAO;AAAA,MACL,wEAAwE,wBAAwB;AAAA,MAChG;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AAEA,QAAM,gBAAgB,KAAK,cAAc,wBAAwB;AACjE,MAAI,CAAC,WAAW,aAAa,GAAG;AAC9B,WAAO;AAAA,MACL,iCAAiC,wBAAwB;AAAA,MACzD;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AAEA,QAAM,OAAO,aAAa,eAAe,MAAM;AAC/C,QAAM,gBAAgB,mBAAmB,QAAQ;AACjD,MAAI,cAAc,SAAS,KAAK,CAAC,cAAc,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,GAAG;AAClF,WAAO;AAAA,MACL,GAAG,wBAAwB;AAAA,MAC3B,uDAAuD,cAAc,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,IAC7F,EAAE,KAAK,IAAI;AAAA,EACb;AAEA,SAAO;AACT;AAEA,SAAS,yBAAyB,UAAqC;AACrE,SAAO,SAAS,KAAK,CAAC,YAAY;AAChC,UAAM,IAAI;AACV,WAAO,EAAE,eAAe,wBAAwB,EAAE,SAAS;AAAA,EAC7D,CAAC;AACH;AAEA,SAAS,mBAAmB,UAAsC;AAChE,QAAM,MAAgB,CAAC;AACvB,aAAW,WAAW,UAAU;AAC9B,UAAM,OAAQ,QAAmD;AACjE,QAAI,CAAC,MAAM,QAAQ,IAAI,EAAG;AAC1B,eAAW,OAAO,MAAM;AACtB,UAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AACrC,YAAM,MAAO,IAA0B;AACvC,UAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,EAAG,KAAI,KAAK,GAAG;AAAA,IAC7D;AAAA,EACF;AACA,SAAO,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;AACzB;AAQO,SAAS,gBACd,SACA,OAAiB,CAAC,GAClB,YAAY,KACF;AACV,SAAO,CAAC,iBAAuC;AAC7C,UAAM,SAAS,UAAU,SAAS,MAAM;AAAA,MACtC,KAAK;AAAA,MACL,UAAU;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AACD,QAAI,OAAO,QAAQ;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,UAAU,aAAa,OAAO,eAAe,OAAO,MAAM,0BAA0B,SAAS;AAAA,MAC/F;AAAA,IACF;AACA,QAAI,OAAO,OAAO;AAChB,YAAM,OAAQ,OAAO,MAAgC;AACrD,UAAI,SAAS,UAAU;AACrB,cAAM,IAAI;AAAA,UACR,qBAAqB,OAAO;AAAA,QAC9B;AAAA,MACF;AACA,YAAM,IAAI,MAAM,qBAAqB,OAAO,sBAAsB,OAAO,MAAM,OAAO,EAAE;AAAA,IAC1F;AACA,QAAI,OAAO,WAAW,EAAG,QAAO,EAAE,IAAI,KAAK;AAC3C,UAAM,MAAM,GAAG,OAAO,UAAU,EAAE,GAAG,OAAO,UAAU,EAAE,GAAG,KAAK;AAChE,WAAO,EAAE,IAAI,OAAO,UAAU,IAAI,SAAS,IAAI,MAAM,QAAQ,OAAO,MAAM,GAAG;AAAA,EAC/E;AACF;AAGA,SAAS,UAAU,UAAoC;AACrD,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,MAAI,SAAS,WAAW,EAAG,QAAO,YAAY,SAAS,SAAS,CAAC,EAAG,OAAO,EAAE,CAAC;AAC9E,SAAO,YAAY,SAAS,MAAM;AACpC;AAEA,SAAS,SAAS,GAAW,GAAmB;AAC9C,SAAO,EAAE,UAAU,IAAI,IAAI,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;AACjD;AAOA,SAAS,cAAc,cAA+B;AACpD,SAAO,qBAAqB,YAAY,EAAE,SAAS;AACrD;AAEA,SAAS,qBAAqB,cAAgC;AAC5D,QAAM,SAAS,UAAU,OAAO,CAAC,UAAU,eAAe,uBAAuB,GAAG;AAAA,IAClF,KAAK;AAAA,IACL,UAAU;AAAA,EACZ,CAAC;AACD,MAAI,OAAO,OAAO;AAChB,UAAM,IAAI;AAAA,MACR,mDAAmD,YAAY,KAAK,OAAO,MAAM,OAAO;AAAA,IAC1F;AAAA,EACF;AACA,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI;AAAA,MACR,uCAAuC,OAAO,MAAM,OAAO,YAAY,KAAK,OAAO,OAAO,KAAK,CAAC;AAAA,IAClG;AAAA,EACF;AACA,SAAO,OAAO,OACX,MAAM,IAAI,EACV,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAChC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC;AACvC;","names":["receipt","result"]}

package/dist/chunk-EP6RVHMX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/mcp/codex-diagnostics.ts","../src/mcp/local-harness.ts"],"sourcesContent":["import { constants } from 'node:fs'\nimport { open } from 'node:fs/promises'\nimport { stripVTControlCharacters } from 'node:util'\n\n/** Bounded, credential-redacted process context attached when reproducible Codex output fails\n * validation. The process still fails closed; this only preserves enough evidence to diagnose it. */\nexport interface CodexExecutionFailureDiagnostic {\n  exitCode: number | null\n  killedBySignal: NodeJS.Signals | null\n  timedOut: boolean\n  durationMs: number\n  stdout: string\n  stderr: string\n  stdoutTruncated: boolean\n  stderrTruncated: boolean\n}\n\n/** Thrown when reproducible Codex exits without one valid terminal usage event. */\nexport class CodexExecutionDiagnosticError extends Error {\n  readonly code = 'CODEX_EXECUTION_DIAGNOSTIC'\n\n  constructor(\n    readonly reason: string,\n    readonly diagnostic: CodexExecutionFailureDiagnostic,\n    cause?: unknown,\n  ) {\n    super(\n      `runLocalHarness: reproducible Codex execution failed: ${reason}; diagnostic=${JSON.stringify(diagnostic)}`,\n      { cause },\n    )\n    this.name = 'CodexExecutionDiagnosticError'\n  }\n}\n\nconst CODEX_FAILURE_STREAM_MAX_CHARS = 4096\nconst CODEX_AUTH_MAX_BYTES = 1024 * 1024\nconst CODEX_REDACTED = '<REDACTED_CREDENTIAL>'\nexport const codexSensitiveEnvironmentName = /(TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL|AUTH|COOKIE)/i\n\nexport function createCodexExecutionDiagnosticError(opts: {\n  reason: string\n  exitCode: number | null\n  killedBySignal: NodeJS.Signals | null\n  timedOut: boolean\n  durationMs: number\n  stdout: string\n  stderr: string\n  codexHome: string | undefined\n  redactionValues: string[]\n  cause: unknown\n}): CodexExecutionDiagnosticError {\n  const redact = (value: string) =>\n    redactCodexDiagnostic(value, opts.codexHome, opts.redactionValues)\n  const boundedStdout = boundCodexDiagnostic(redact(opts.stdout))\n  const boundedStderr = boundCodexDiagnostic(redact(opts.stderr))\n  const diagnostic: CodexExecutionFailureDiagnostic = {\n    exitCode: opts.exitCode,\n    killedBySignal: opts.killedBySignal,\n    timedOut: opts.timedOut,\n    durationMs: opts.durationMs,\n    stdout: boundedStdout.value,\n    stderr: boundedStderr.value,\n    stdoutTruncated: boundedStdout.truncated,\n    stderrTruncated: boundedStderr.truncated,\n  }\n  const safeReason = boundCodexDiagnostic(redact(opts.reason), 1024).value\n  return new CodexExecutionDiagnosticError(\n    safeReason,\n    diagnostic,\n    redactCodexErrorCause(opts.cause, safeReason, redact),\n  )\n}\n\nexport function redactCodexHome(value: string, codexHome: string | undefined): string {\n  return codexHome ? value.replaceAll(codexHome, '<ISOLATED_CODEX_HOME>') : value\n}\n\nexport function collectCodexDiagnosticRedactionValues(\n  env: NodeJS.ProcessEnv,\n  authText: string,\n): string[] {\n  const values = Object.entries(env)\n    .filter(\n      ([name, value]) => codexSensitiveEnvironmentName.test(name) && typeof value === 'string',\n    )\n    .map(([, value]) => value as string)\n  try {\n    collectStringLeaves(JSON.parse(authText), values)\n  } catch {\n    // Invalid auth JSON is diagnosed by Codex; generic credential patterns still redact it.\n  }\n  const encoded = values\n    .filter((value) => value.length >= 8)\n    .flatMap((value) => [\n      Buffer.from(value, 'utf8').toString('base64'),\n      Buffer.from(value, 'utf8').toString('base64url'),\n      encodeURIComponent(value),\n      JSON.stringify(value).slice(1, -1),\n    ])\n  return [...new Set([...values, ...encoded])]\n}\n\nexport async function readCodexAuthRedactionText(path: string): Promise<string> {\n  const handle = await open(path, constants.O_RDONLY | constants.O_NONBLOCK)\n  try {\n    const stats = await handle.stat()\n    if (!stats.isFile() || !Number.isSafeInteger(stats.size) || stats.size > CODEX_AUTH_MAX_BYTES) {\n      throw new Error('Codex auth.json must be a regular file no larger than 1 MiB')\n    }\n    const buffer = Buffer.alloc(stats.size)\n    let offset = 0\n    while (offset < buffer.length) {\n      const { bytesRead } = await handle.read(buffer, offset, buffer.length - offset, offset)\n      if (bytesRead === 0) break\n      offset += bytesRead\n    }\n    return buffer.subarray(0, offset).toString('utf8')\n  } finally {\n    await handle.close()\n  }\n}\n\nfunction boundCodexDiagnostic(\n  value: string,\n  maxChars = CODEX_FAILURE_STREAM_MAX_CHARS,\n): { value: string; truncated: boolean } {\n  if (value.length <= maxChars) return { value, truncated: false }\n  const marker = '\\n<... OUTPUT TRUNCATED ...>\\n'\n  const contentChars = maxChars - marker.length\n  const headChars = Math.floor(contentChars / 2)\n  const tailChars = contentChars - headChars\n  return {\n    value: `${value.slice(0, headChars)}${marker}${value.slice(-tailChars)}`,\n    truncated: true,\n  }\n}\n\nfunction redactCodexDiagnostic(\n  value: string,\n  codexHome: string | undefined,\n  protectedValues: ReadonlyArray<string>,\n): string {\n  let redacted = redactCodexHome(stripVTControlCharacters(value), codexHome)\n  const exactValues = [...new Set(protectedValues.filter((item) => item.length >= 6))].sort(\n    (a, b) => b.length - a.length,\n  )\n  for (const secret of exactValues) redacted = redacted.replaceAll(secret, CODEX_REDACTED)\n  redacted = redacted\n    .replace(/(\\bBearer\\s+)[A-Za-z0-9._~+/=-]{6,}/gi, `$1${CODEX_REDACTED}`)\n    .replace(/\\b(?:sk|rk|pk)-[A-Za-z0-9._-]{8,}\\b/g, CODEX_REDACTED)\n    .replace(/\\beyJ[A-Za-z0-9_-]{6,}\\.[A-Za-z0-9_-]{6,}\\.[A-Za-z0-9_-]{6,}\\b/g, CODEX_REDACTED)\n    .replace(\n      /((?:[\"']?(?:api[-_]?key|access[-_]?token|refresh[-_]?token|id[-_]?token|client[-_]?secret|private[-_]?key|session[-_]?(?:id|token)|secret|password|passwd|authorization|credential|cookie)[\"']?)\\s*[:=]\\s*)([\"'])[^\"'\\r\\n]*\\2/gi,\n      `$1$2${CODEX_REDACTED}$2`,\n    )\n    .replace(\n      /((?:[\"']?(?:api[-_]?key|access[-_]?token|refresh[-_]?token|id[-_]?token|client[-_]?secret|private[-_]?key|session[-_]?(?:id|token)|secret|password|passwd|authorization|credential|cookie)[\"']?)\\s*[:=]\\s*)([^\\s,;}]+)/gi,\n      `$1${CODEX_REDACTED}`,\n    )\n  for (const secret of exactValues) redacted = redacted.replaceAll(secret, CODEX_REDACTED)\n  return redacted\n}\n\nfunction redactCodexErrorCause(\n  cause: unknown,\n  safeReason: string,\n  redact: (value: string) => string,\n): Error | undefined {\n  if (!(cause instanceof Error)) return undefined\n  const safeCause = new Error(safeReason)\n  safeCause.name = cause.name\n  if (cause.stack) safeCause.stack = boundCodexDiagnostic(redact(cause.stack)).value\n  return safeCause\n}\n\nfunction collectStringLeaves(value: unknown, output: string[]): void {\n  if (typeof value === 'string') {\n    output.push(value)\n    return\n  }\n  if (Array.isArray(value)) {\n    for (const item of value) collectStringLeaves(item, output)\n    return\n  }\n  if (value !== null && typeof value === 'object') {\n    for (const item of Object.values(value)) collectStringLeaves(item, output)\n  }\n}\n","/**\n *\n * Subprocess wrappers for the local coding-harness CLIs installed in the\n * sandbox image (claude-code, codex, opencode). Used by the in-process\n * delegation executor (`createInProcessExecutor`) so a delegated coding task\n * spawns a real harness on a real git worktree instead of provisioning a\n * sibling sandbox.\n *\n * All harness invocations:\n *   - run with `cwd` set to the worktree\n *   - inherit env from the parent (the MCP server inside the sandbox has\n *     the harness's auth already)\n *   - capture stdout/stderr\n *   - support cancellation via AbortSignal\n *   - enforce a wall-clock timeout\n *\n * @experimental\n */\n\nimport { type ChildProcess, spawn } from 'node:child_process'\nimport { createHash, randomUUID } from 'node:crypto'\nimport { constants, createReadStream } from 'node:fs'\nimport {\n  access,\n  chmod,\n  copyFile,\n  mkdir,\n  mkdtemp,\n  open,\n  readFile,\n  realpath,\n  rm,\n  symlink,\n  writeFile,\n} from 'node:fs/promises'\nimport { homedir, tmpdir } from 'node:os'\nimport { basename, delimiter, dirname, isAbsolute, join, resolve, sep } from 'node:path'\nimport type { AgentProfile } from '@tangle-network/agent-interface'\nimport {\n  codexSensitiveEnvironmentName,\n  collectCodexDiagnosticRedactionValues,\n  createCodexExecutionDiagnosticError,\n  readCodexAuthRedactionText,\n  redactCodexHome,\n} from './codex-diagnostics'\n\nexport type { CodexExecutionFailureDiagnostic } from './codex-diagnostics'\nexport { CodexExecutionDiagnosticError } from './codex-diagnostics'\n\n/** Local coding harness available inside the sandbox. */\nexport type LocalHarness = 'claude' | 'codex' | 'opencode'\n\ntype ReasoningEffort = NonNullable<NonNullable<AgentProfile['model']>['reasoningEffort']>\n\nconst codexReasoningEffort: Record<ReasoningEffort, string> = {\n  none: 'none',\n  minimal: 'minimal',\n  low: 'low',\n  medium: 'medium',\n  high: 'high',\n  xhigh: 'xhigh',\n  ultracode: 'xhigh',\n}\n\nfunction codexReasoningArgs(reasoningEffort: ReasoningEffort): string[] {\n  const mapped = codexReasoningEffort[reasoningEffort]\n  if (mapped === undefined) {\n    throw new Error(\n      `harnessInvocation: unsupported Codex reasoning effort ${String(reasoningEffort)}`,\n    )\n  }\n  return ['-c', `model_reasoning_effort=\"${mapped}\"`]\n}\n\n/**\n * Default per-harness command + arg shape. `buildArgs` takes ONLY the task prompt and\n * emits the prompt-only invocation (no model, no system prompt) — the safe default shape\n * the in-process executor's `streamPrompt` drives. `modelArgs` maps a resolved model to\n * the harness's selector flag (every supported harness takes `-m <model>`). The §1.5\n * profile-aware mapper `harnessInvocation` composes these to thread the full\n * supervisor-authored profile (systemPrompt + model) into argv.\n */\nconst HARNESS_INVOCATIONS: Record<\n  LocalHarness,\n  {\n    command: string\n    buildArgs: (taskPrompt: string) => string[]\n    /** Map a resolved model to the harness's model-selector flag. */\n    modelArgs: (model: string) => string[]\n    /** Map portable reasoning effort when the harness exposes a native control. */\n    reasoningArgs?: (reasoningEffort: ReasoningEffort) => string[]\n  }\n> = {\n  claude: {\n    command: 'claude',\n    // `-p` IS headless/print mode; the old `--headless` flag was removed from the CLI.\n    // Permission bypass is an explicit per-run opt-in below, never the public default.\n    buildArgs: (taskPrompt) => ['-p', taskPrompt],\n    modelArgs: (model) => ['-m', model],\n  },\n  codex: {\n    command: 'codex',\n    buildArgs: (taskPrompt) => ['exec', taskPrompt],\n    modelArgs: (model) => ['-m', model],\n    reasoningArgs: codexReasoningArgs,\n  },\n  opencode: {\n    command: 'opencode',\n    buildArgs: (taskPrompt) => ['run', taskPrompt],\n    modelArgs: (model) => ['-m', model],\n  },\n}\n\n/** Result of mapping an `AgentProfile` + task prompt onto a harness invocation. */\nexport interface HarnessInvocation {\n  command: string\n  args: string[]\n  /** Exact profile-composed prompt carried by the invocation. */\n  prompt: string\n}\n\nexport interface HarnessInvocationOptions {\n  /** Allow an unattended Claude process to edit its isolated candidate worktree.\n   *  Ignored by harnesses that do not use Claude's permission prompt. */\n  dangerouslySkipPermissions?: boolean\n  /** Run Codex with benchmark-safe process controls and JSONL usage output.\n   *  Valid only for the Codex harness. */\n  codexReproducible?: boolean\n}\n\nconst CODEX_REPRODUCIBLE_ARGS = [\n  '--ephemeral',\n  '--ignore-rules',\n  '--json',\n  '-c',\n  'approval_policy=\"never\"',\n  '-c',\n  'web_search=\"disabled\"',\n  '-c',\n  'project_doc_max_bytes=0',\n  '-c',\n  'skills.include_instructions=false',\n  '-c',\n  'include_apps_instructions=false',\n  '--disable',\n  'tool_suggest',\n  '-c',\n  'features.multi_agent_v2.root_agent_usage_hint_text=\"\"',\n  '-c',\n  'features.multi_agent_v2.subagent_usage_hint_text=\"\"',\n  '-c',\n  'features.multi_agent_v2.multi_agent_mode_hint_text=\"\"',\n  '--strict-config',\n] as const\n\nfunction buildHarnessArgs(\n  harness: LocalHarness,\n  taskPrompt: string,\n  options: HarnessInvocationOptions = {},\n): string[] {\n  const args = HARNESS_INVOCATIONS[harness].buildArgs(taskPrompt)\n  if (harness === 'claude' && options.dangerouslySkipPermissions) {\n    args.push('--dangerously-skip-permissions')\n  }\n  if (options.codexReproducible) {\n    if (harness !== 'codex') {\n      throw new Error('harnessInvocation: codexReproducible requires the Codex harness')\n    }\n    args.push(...CODEX_REPRODUCIBLE_ARGS)\n  }\n  return args\n}\n\n/**\n * Map a supervisor-authored `AgentProfile` + the per-task prompt onto a concrete harness\n * `command` + `args` (the §1.5 fix). UNLIKE the prompt-only `HARNESS_INVOCATIONS.buildArgs`\n * — which drops both the authored model and the system prompt — this threads the FULL\n * profile payload into argv:\n *\n *  - `profile.prompt.systemPrompt` → the PROMPT channel: a portable, harness-agnostic\n *    default that prepends the system prompt above the task prompt (`<system>\\n\\n<task>`),\n *    so the authored standing instructions reach EVERY harness (none of the three CLIs\n *    expose a portable replace-system-prompt flag for a one-shot non-interactive run).\n *  - `profile.prompt.instructions[]` → appended prompt sections in authored order.\n *  - `profile.model.default` → the harness's `-m <model>` selector.\n *\n * The task prompt alone is the floor; an empty/absent profile yields exactly the legacy\n * `buildArgs(taskPrompt)` shape so existing callers are byte-identical.\n */\nexport function harnessInvocation(\n  harness: LocalHarness,\n  profile: AgentProfile,\n  taskPrompt: string,\n  options: HarnessInvocationOptions = {},\n): HarnessInvocation {\n  const invocation = HARNESS_INVOCATIONS[harness]\n  if (!invocation) {\n    throw new Error(`harnessInvocation: unknown harness ${String(harness)}`)\n  }\n\n  if (options.codexReproducible) {\n    const model = profile.model?.default\n    if (typeof model !== 'string' || model.trim().length === 0) {\n      throw new Error('harnessInvocation: codexReproducible requires profile.model.default')\n    }\n    if (profile.model?.reasoningEffort === undefined) {\n      throw new Error('harnessInvocation: codexReproducible requires profile.model.reasoningEffort')\n    }\n  }\n\n  const systemPrompt = profile.prompt?.systemPrompt\n  const instructions = profile.prompt?.instructions\n  if (\n    instructions !== undefined &&\n    (!Array.isArray(instructions) ||\n      instructions.some((instruction) => typeof instruction !== 'string'))\n  ) {\n    throw new Error('harnessInvocation: profile.prompt.instructions must be an array of strings')\n  }\n  const promptSections = [\n    ...(typeof systemPrompt === 'string' && systemPrompt.trim().length > 0 ? [systemPrompt] : []),\n    ...(instructions?.filter((instruction) => instruction.trim().length > 0) ?? []),\n    taskPrompt,\n  ]\n  const composedPrompt = promptSections.join('\\n\\n')\n\n  const args = buildHarnessArgs(harness, composedPrompt, options)\n\n  const model = profile.model?.default\n  if (typeof model === 'string' && model.length > 0) {\n    args.push(...invocation.modelArgs(model))\n  }\n\n  const reasoningEffort = profile.model?.reasoningEffort\n  if (reasoningEffort !== undefined && invocation.reasoningArgs) {\n    args.push(...invocation.reasoningArgs(reasoningEffort))\n  }\n\n  return { command: invocation.command, args, prompt: composedPrompt }\n}\n\n/** @experimental */\nexport interface RunLocalHarnessOptions {\n  harness: LocalHarness\n  /** Working directory for the subprocess (typically a worktree path). */\n  cwd: string\n  /** Prompt forwarded as the harness CLI's task argument. */\n  taskPrompt: string\n  /**\n   * Pre-built command + args (e.g. from `harnessInvocation` so the full authored\n   * `AgentProfile` — systemPrompt + model — reaches the harness). When set it OVERRIDES the\n   * default prompt-only `buildArgs(taskPrompt)` path; `command` defaults to the harness's\n   * default binary when only `args` is supplied. When absent the legacy prompt-only shape\n   * is used unchanged.\n   */\n  invocation?: { command?: string; args: ReadonlyArray<string> }\n  /** Allow autonomous Claude edits without an interactive permission prompt.\n   *  Use only when `cwd` is an isolated candidate worktree. */\n  dangerouslySkipPermissions?: boolean\n  /** Isolate Codex from ambient configuration/instructions and require JSONL token usage.\n   *  The invocation should come from `harnessInvocation(..., { codexReproducible: true })`. */\n  codexReproducible?: boolean\n  /** Absolute host paths that reproducible Codex must not read. The normalized set is compiled\n   *  into the controlled permission profile and its digest is returned in execution evidence. */\n  codexReadDeniedPaths?: ReadonlyArray<string>\n  /** Wall-clock kill deadline (ms). Default 5 min. Subprocess SIGTERMed on expiry. */\n  timeoutMs?: number\n  /** Caller cancellation. SIGTERM is sent on abort. */\n  signal?: AbortSignal\n  /** Override env (defaults to inheriting from the parent). */\n  env?: NodeJS.ProcessEnv\n  /**\n   * Test seam — inject a custom spawner so unit tests can mock the\n   * subprocess without touching the OS. Defaults to node's `child_process.spawn`.\n   */\n  spawn?: (\n    command: string,\n    args: ReadonlyArray<string>,\n    opts: {\n      cwd: string\n      env: NodeJS.ProcessEnv\n      stdio: 'pipe'\n      detached: boolean\n    },\n  ) => ChildProcess\n  /** Test seam for locating the native Codex executable before it is staged in the worktree. */\n  resolveCodexExecutable?: (command: string, env: NodeJS.ProcessEnv) => Promise<string>\n}\n\n/** Exact aggregate usage emitted by Codex's terminal `turn.completed` JSONL event. */\nexport interface CodexTokenUsage {\n  inputTokens: number\n  cachedInputTokens: number\n  outputTokens: number\n  reasoningOutputTokens: number\n}\n\n/** Isolation settings asserted before a reproducible Codex run is allowed to start. */\nexport interface CodexExecutionPolicy {\n  sessionPersistence: 'ephemeral'\n  userConfig: false\n  rules: false\n  projectInstructions: false\n  skillInstructions: false\n  appInstructions: false\n  toolSuggestions: false\n  multiAgentInstructions: false\n  sandbox: 'workspace-write'\n  permissionProfile: 'agent_runtime_reproducible'\n  approvalPolicy: 'never'\n  shellNetwork: false\n  webSearch: false\n  serviceTier: 'default'\n  shellEnvironment: 'core-filtered'\n  loginShell: false\n  credentialsReadable: false\n  hostHomeReadable: false\n  procEnvironment: 'private-sanitized'\n  sensitiveEnvironmentNamesVisible: false\n  parentRepoRead: false\n  gitMetadata: false\n  temporaryDirectory: 'workspace-private'\n  stagedExecutable: 'static-elf-read-only'\n  callerReadDeniedPaths: 'enforced'\n  containerSockets: false\n}\n\n/** Zero-model-call evidence for the exact Codex process about to run. */\nexport interface CodexExecutionEvidence {\n  cliVersion: string\n  executableSha256: string\n  /** SHA-256 of the exact composed prompt argument proved present in the rendered prompt. */\n  requestedPromptSha256: string\n  effectivePromptSha256: string\n  nonPromptArgsSha256: string\n  controlledConfigSha256: string\n  /** Sorted normalized paths compiled into the permission profile. */\n  readDeniedPaths: string[]\n  readDeniedPathsSha256: string\n  readDeniedPathCount: number\n  policy: CodexExecutionPolicy\n}\n\n/** @experimental */\nexport interface LocalHarnessResult {\n  /** OS exit code. `null` when killed before exit. */\n  exitCode: number | null\n  /** Concatenated stdout. */\n  stdout: string\n  /** Concatenated stderr. */\n  stderr: string\n  /** Set when the process exited via signal (timeout / abort). */\n  killedBySignal: NodeJS.Signals | null\n  /** Wall-clock duration ms (spawn → exit). */\n  durationMs: number\n  /** Set when timeoutMs elapsed before exit. */\n  timedOut: boolean\n  /** Present for a reproducible Codex run; parsed from the real terminal JSONL event. */\n  usage?: CodexTokenUsage\n  /** Present for reproducible Codex runs; generated and checked before model execution. */\n  evidence?: CodexExecutionEvidence\n}\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60 * 1000\nconst processKillGraceMs = 250\n\n/**\n * Spawn a local coding harness CLI as a subprocess + collect its output.\n *\n * NOT responsible for parsing the harness's output or extracting a diff —\n * the in-process executor's `streamPrompt` orchestrates `git diff` against\n * the worktree after this resolves. This function is intentionally narrow:\n * spawn, wait, capture, return.\n *\n * Fails loud — throws when:\n *   - `cwd` doesn't exist (subprocess emits ENOENT; surfaced as Error)\n *   - the harness binary is not on PATH (ENOENT)\n *\n * Does NOT throw when:\n *   - the subprocess exits non-zero (`result.exitCode` carries the code)\n *   - the subprocess is aborted / timed out (`result.killedBySignal` /\n *     `result.timedOut` carries the reason)\n *\n * @experimental\n */\nexport async function runLocalHarness(\n  options: RunLocalHarnessOptions,\n): Promise<LocalHarnessResult> {\n  const { harness, cwd, taskPrompt } = options\n  if (options.codexReproducible && harness !== 'codex') {\n    throw new Error('runLocalHarness: codexReproducible requires the Codex harness')\n  }\n  if (options.codexReproducible && process.platform !== 'linux') {\n    throw new Error('runLocalHarness: codexReproducible currently requires Linux')\n  }\n  if (options.codexReadDeniedPaths !== undefined && !options.codexReproducible) {\n    throw new Error('runLocalHarness: codexReadDeniedPaths requires codexReproducible')\n  }\n  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS\n  const spawnImpl = options.spawn ?? spawn\n\n  const invocation = HARNESS_INVOCATIONS[harness]\n  if (!invocation) {\n    throw new Error(`runLocalHarness: unknown harness ${String(harness)}`)\n  }\n\n  const startedAt = Date.now()\n  const requestedCommand = options.invocation?.command ?? invocation.command\n  const args = options.invocation\n    ? [...options.invocation.args]\n    : buildHarnessArgs(harness, taskPrompt, options)\n  if (options.codexReproducible) assertCodexReproducibleInvocation(requestedCommand, args)\n\n  // We spawn the harness with `cwd`, but a harness that resolves its working\n  // directory from `$PWD` rather than `getcwd()` (opencode does; the others may)\n  // inherits the parent's stale `PWD` and edits the WRONG directory — its\n  // worktree diff then comes back empty and the delegation fails with a phantom\n  // \"empty patch\". Pin `PWD` to `cwd` so the harness edits where it was placed.\n  // `baseEnv` feeds both the codex-isolated and the plain spawn paths below, so\n  // pinning it here covers every runLocalHarness consumer.\n  const baseEnv: NodeJS.ProcessEnv = { ...(options.env ?? process.env), PWD: cwd }\n  const isolated = options.codexReproducible\n    ? await isolateCodexHome({\n        baseEnv,\n        cwd,\n        command: requestedCommand,\n        readDeniedPaths: options.codexReadDeniedPaths ?? [],\n        resolveExecutable: options.resolveCodexExecutable ?? resolveCodexNativeExecutable,\n      })\n    : {\n        env: baseEnv,\n        command: requestedCommand,\n        cleanup: async () => undefined,\n        controlledConfigSha256: '',\n        executableSha256: '',\n        readDeniedPathsSha256: '',\n        readDeniedPathCount: 0,\n        readDeniedPaths: [] as string[],\n        diagnosticRedactionValues: [] as string[],\n        ambientAuth: '',\n        isolatedAuth: '',\n        writeProbe: '',\n        stagedWriteProbe: '',\n        deniedProbePaths: [] as string[],\n      }\n  const env = isolated.env\n  const command = isolated.command\n  if (options.codexReproducible) assertCodexReproducibleInvocation(command, args)\n\n  try {\n    const evidence = options.codexReproducible\n      ? await collectCodexExecutionEvidence({\n          command,\n          args,\n          cwd,\n          env,\n          spawn: spawnImpl,\n          controlledConfigSha256: isolated.controlledConfigSha256,\n          executableSha256: isolated.executableSha256,\n          readDeniedPathsSha256: isolated.readDeniedPathsSha256,\n          readDeniedPathCount: isolated.readDeniedPathCount,\n          readDeniedPaths: isolated.readDeniedPaths,\n          ambientAuth: isolated.ambientAuth,\n          isolatedAuth: isolated.isolatedAuth,\n          writeProbe: isolated.writeProbe,\n          stagedWriteProbe: isolated.stagedWriteProbe,\n          deniedProbePaths: isolated.deniedProbePaths,\n          ...(options.signal ? { signal: options.signal } : {}),\n        })\n      : undefined\n    return await new Promise<LocalHarnessResult>((resolve, reject) => {\n      let child: ChildProcess\n      try {\n        child = spawnImpl(command, args, {\n          cwd,\n          env,\n          stdio: 'pipe',\n          detached: process.platform !== 'win32',\n        })\n      } catch (err) {\n        reject(err instanceof Error ? err : new Error(String(err)))\n        return\n      }\n\n      // The harness takes its task as an argv arg, not on stdin. Leaving stdin\n      // OPEN makes a non-TTY `opencode run` (and likely the other harnesses)\n      // BLOCK forever waiting on input — zero output, SIGTERM at the wall cap,\n      // empty patch -> \"no candidate passed validation\". Close stdin so the\n      // subprocess sees EOF and proceeds (the `cliExecutor` leaf does the same).\n      child.stdin?.end()\n\n      let stdout = ''\n      let stderr = ''\n      let timedOut = false\n      let settled = false\n      let forceKillTimer: ReturnType<typeof setTimeout> | null = null\n      let terminationStarted = false\n\n      const terminate = () => {\n        if (terminationStarted) return\n        terminationStarted = true\n        signalProcessTree(child, 'SIGTERM')\n        forceKillTimer = setTimeout(() => signalProcessTree(child, 'SIGKILL'), processKillGraceMs)\n        forceKillTimer.unref?.()\n      }\n\n      const timer =\n        timeoutMs > 0\n          ? setTimeout(() => {\n              timedOut = true\n              terminate()\n            }, timeoutMs)\n          : null\n      if (timer && typeof (timer as { unref?: () => void }).unref === 'function') {\n        ;(timer as { unref: () => void }).unref()\n      }\n\n      const onAbort = () => {\n        terminate()\n      }\n      if (options.signal) {\n        if (options.signal.aborted) onAbort()\n        else options.signal.addEventListener('abort', onAbort, { once: true })\n      }\n\n      child.stdout?.on('data', (chunk) => {\n        stdout += String(chunk)\n      })\n      child.stderr?.on('data', (chunk) => {\n        stderr += String(chunk)\n      })\n\n      const finalize = (result: LocalHarnessResult) => {\n        if (settled) return\n        settled = true\n        if (timer) clearTimeout(timer)\n        if (forceKillTimer) clearTimeout(forceKillTimer)\n        options.signal?.removeEventListener('abort', onAbort)\n        resolve(result)\n      }\n\n      child.on('error', (err) => {\n        if (settled) return\n        settled = true\n        if (timer) clearTimeout(timer)\n        if (forceKillTimer) clearTimeout(forceKillTimer)\n        options.signal?.removeEventListener('abort', onAbort)\n        reject(err)\n      })\n\n      child.on('close', (code, signal) => {\n        const durationMs = Date.now() - startedAt\n        try {\n          const usage = options.codexReproducible ? parseCodexTokenUsage(stdout) : undefined\n          finalize({\n            exitCode: code,\n            stdout,\n            stderr: redactCodexHome(stderr, env.CODEX_HOME),\n            killedBySignal: signal,\n            durationMs,\n            timedOut,\n            ...(usage ? { usage } : {}),\n            ...(evidence ? { evidence } : {}),\n          })\n        } catch (err) {\n          if (settled) return\n          settled = true\n          if (timer) clearTimeout(timer)\n          if (forceKillTimer) clearTimeout(forceKillTimer)\n          options.signal?.removeEventListener('abort', onAbort)\n          const reason = err instanceof Error ? err.message : String(err)\n          reject(\n            options.codexReproducible\n              ? createCodexExecutionDiagnosticError({\n                  reason,\n                  exitCode: code,\n                  killedBySignal: signal,\n                  timedOut,\n                  durationMs,\n                  stdout,\n                  stderr,\n                  codexHome: env.CODEX_HOME,\n                  redactionValues: isolated.diagnosticRedactionValues,\n                  cause: err,\n                })\n              : err instanceof Error\n                ? err\n                : new Error(reason),\n          )\n        }\n      })\n    })\n  } finally {\n    await isolated.cleanup()\n  }\n}\n\nconst CODEX_EXECUTION_POLICY: CodexExecutionPolicy = {\n  sessionPersistence: 'ephemeral',\n  userConfig: false,\n  rules: false,\n  projectInstructions: false,\n  skillInstructions: false,\n  appInstructions: false,\n  toolSuggestions: false,\n  multiAgentInstructions: false,\n  sandbox: 'workspace-write',\n  permissionProfile: 'agent_runtime_reproducible',\n  approvalPolicy: 'never',\n  shellNetwork: false,\n  webSearch: false,\n  serviceTier: 'default',\n  shellEnvironment: 'core-filtered',\n  loginShell: false,\n  credentialsReadable: false,\n  hostHomeReadable: false,\n  procEnvironment: 'private-sanitized',\n  sensitiveEnvironmentNamesVisible: false,\n  parentRepoRead: false,\n  gitMetadata: false,\n  temporaryDirectory: 'workspace-private',\n  stagedExecutable: 'static-elf-read-only',\n  callerReadDeniedPaths: 'enforced',\n  containerSockets: false,\n}\n\nconst FORBIDDEN_CODEX_PROMPT_MARKERS = [\n  '<skills_instructions>',\n  '# AGENTS.md instructions',\n  '<apps_instructions>',\n  '<recommended_plugins>',\n  '<multi_agent_mode>',\n  'You are `/root`, the primary agent',\n] as const\n\nasync function collectCodexExecutionEvidence(opts: {\n  command: string\n  args: string[]\n  cwd: string\n  env: NodeJS.ProcessEnv\n  spawn: NonNullable<RunLocalHarnessOptions['spawn']>\n  controlledConfigSha256: string\n  readDeniedPaths: string[]\n  executableSha256: string\n  readDeniedPathsSha256: string\n  readDeniedPathCount: number\n  ambientAuth: string\n  isolatedAuth: string\n  writeProbe: string\n  stagedWriteProbe: string\n  deniedProbePaths: string[]\n  signal?: AbortSignal\n}): Promise<CodexExecutionEvidence> {\n  assertCodexReproducibleInvocation(opts.command, opts.args)\n  const prompt = opts.args[1]\n  if (opts.args[0] !== 'exec' || typeof prompt !== 'string' || prompt.length === 0) {\n    throw new Error('runLocalHarness: reproducible Codex invocation must be codex exec <prompt>')\n  }\n  const cliVersion = (await runCodexProbe(opts, ['--version'])).stdout.trim()\n  if (!/^codex-cli \\d+\\.\\d+\\.\\d+(?:[-+].+)?$/.test(cliVersion)) {\n    throw new Error(\n      `runLocalHarness: unexpected Codex CLI version output ${JSON.stringify(cliVersion)}`,\n    )\n  }\n\n  const hiddenEnvironmentChecks = [\n    'CODEX_HOME',\n    'CODEX_ACCESS_TOKEN',\n    'CODEX_API_KEY',\n    'OPENAI_API_KEY',\n  ]\n    .map((name) => `test -z \"\\${${name}:-}\"`)\n    .join(' && ')\n  const sandboxProof = [\n    hiddenEnvironmentChecks,\n    'test -r .',\n    '! test -r .git',\n    'touch \"$1\"',\n    'rm \"$1\"',\n    'staged_dir=$(dirname \"$2\")',\n    'test -x \"$staged_dir/codex\"',\n    '! chmod 700 \"$staged_dir\" 2>/dev/null',\n    '! rm \"$staged_dir/codex\" 2>/dev/null',\n    '! touch \"$2\" 2>/dev/null',\n    'shift 2',\n    'for path in \"$@\"; do ! test -r \"$path\" || exit 1; done',\n    'touch \"$TMPDIR/.agent-runtime-tmp-proof\"',\n    'rm \"$TMPDIR/.agent-runtime-tmp-proof\"',\n  ].join(' && ')\n  await runCodexProbe(opts, [\n    'sandbox',\n    '-P',\n    CODEX_PERMISSION_PROFILE,\n    '-C',\n    opts.cwd,\n    'sh',\n    '-c',\n    sandboxProof,\n    'sh',\n    opts.writeProbe,\n    opts.stagedWriteProbe,\n    ...opts.deniedProbePaths,\n  ])\n  await runCodexProbe(opts, [\n    'sandbox',\n    '-P',\n    CODEX_PERMISSION_PROFILE,\n    '-C',\n    opts.cwd,\n    'python3',\n    '-c',\n    `import os,re\npattern=re.compile(br'(TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL|AUTH|COOKIE|CODEX_HOME)', re.I)\npaths=('/proc/1/environ', '/proc/self/environ', f'/proc/{os.getppid()}/environ')\nfor path in dict.fromkeys(paths):\n data=open(path,'rb').read().split(b'\\\\0')\n names=(item.split(b'=',1)[0] for item in data if b'=' in item)\n assert not any(pattern.search(name) for name in names), path`,\n  ])\n  await runCodexProbe(opts, [\n    'sandbox',\n    '-P',\n    CODEX_PERMISSION_PROFILE,\n    '-C',\n    opts.cwd,\n    'python3',\n    '-c',\n    'import socket,sys\\nfor path in sys.argv[1:]:\\n s=socket.socket(socket.AF_UNIX)\\n try: s.connect(path)\\n except OSError: continue\\n raise SystemExit(1)',\n    '/var/run/docker.sock',\n    '/run/docker.sock',\n    '/var/run/containerd/containerd.sock',\n    '/run/containerd/containerd.sock',\n  ])\n\n  const debugArgs = codexPromptDebugArgs(opts.args, prompt)\n  const renderedPrompt = (await runCodexProbe(opts, debugArgs)).stdout\n  let parsedPrompt: unknown\n  try {\n    parsedPrompt = JSON.parse(renderedPrompt)\n  } catch {\n    throw new Error('runLocalHarness: codex debug prompt-input returned invalid JSON')\n  }\n  const promptEvidenceText = normalizeCodexDebugPromptNewlines(prompt)\n  if (!Array.isArray(parsedPrompt) || !jsonTextContains(parsedPrompt, promptEvidenceText)) {\n    throw new Error('runLocalHarness: Codex prompt evidence did not contain the exact task prompt')\n  }\n  const promptContextWithoutTask = JSON.stringify(redactJsonText(parsedPrompt, promptEvidenceText))\n  for (const marker of FORBIDDEN_CODEX_PROMPT_MARKERS) {\n    if (promptContextWithoutTask.includes(marker)) {\n      throw new Error(`runLocalHarness: Codex prompt evidence contains forbidden marker ${marker}`)\n    }\n  }\n  for (const marker of ['<permissions instructions>', '<environment_context>']) {\n    if (!renderedPrompt.includes(marker)) {\n      throw new Error(`runLocalHarness: Codex prompt evidence is missing required marker ${marker}`)\n    }\n  }\n\n  const nonPromptArgs = [\n    'codex',\n    ...opts.args.map((arg, index) => (index === 1 ? '<PROMPT>' : arg)),\n  ]\n  return {\n    cliVersion,\n    executableSha256: opts.executableSha256,\n    requestedPromptSha256: sha256(prompt),\n    effectivePromptSha256: sha256(renderedPrompt),\n    nonPromptArgsSha256: sha256(JSON.stringify(nonPromptArgs)),\n    controlledConfigSha256: opts.controlledConfigSha256,\n    readDeniedPathsSha256: opts.readDeniedPathsSha256,\n    readDeniedPathCount: opts.readDeniedPathCount,\n    readDeniedPaths: [...opts.readDeniedPaths],\n    policy: { ...CODEX_EXECUTION_POLICY },\n  }\n}\n\nfunction assertCodexReproducibleInvocation(command: string, args: string[]): void {\n  const executable = basename(command)\n  if (executable !== 'codex' && executable !== 'codex.exe') {\n    throw new Error('runLocalHarness: reproducible Codex invocation must use the Codex executable')\n  }\n  const prompt = args[1]\n  const expectedPrefix = ['exec', prompt, ...CODEX_REPRODUCIBLE_ARGS]\n  const hasExactPrefix = expectedPrefix.every((arg, index) => args[index] === arg)\n  const tail = args.slice(expectedPrefix.length)\n  const validModel =\n    tail[0] === '-m' &&\n    typeof tail[1] === 'string' &&\n    tail[1].length > 0 &&\n    !tail[1].startsWith('-')\n  const validReasoning =\n    tail[2] === '-c' &&\n    typeof tail[3] === 'string' &&\n    /^model_reasoning_effort=\"(?:none|minimal|low|medium|high|xhigh)\"$/.test(tail[3])\n  if (!hasExactPrefix || tail.length !== 4 || !validModel || !validReasoning) {\n    throw new Error(\n      'runLocalHarness: reproducible Codex invocation does not match the required isolated argv',\n    )\n  }\n}\n\nfunction codexPromptDebugArgs(execArgs: string[], prompt: string): string[] {\n  const debugArgs = ['debug', 'prompt-input']\n  for (let index = 2; index < execArgs.length; index += 1) {\n    const arg = execArgs[index]\n    const value = execArgs[index + 1]\n    if (arg === '-c' && value !== undefined) {\n      debugArgs.push('-c', value)\n      index += 1\n    } else if (arg === '--disable' && value !== undefined) {\n      debugArgs.push('--disable', value)\n      index += 1\n    } else if (arg === '-m' && value !== undefined) {\n      debugArgs.push('-c', `model=${JSON.stringify(value)}`)\n      index += 1\n    } else if (arg === '-s' && value !== undefined) {\n      debugArgs.push('-c', `sandbox_mode=${JSON.stringify(value)}`)\n      index += 1\n    }\n  }\n  debugArgs.push(prompt)\n  return debugArgs\n}\n\nfunction runCodexProbe(\n  opts: {\n    command: string\n    cwd: string\n    env: NodeJS.ProcessEnv\n    spawn: NonNullable<RunLocalHarnessOptions['spawn']>\n    signal?: AbortSignal\n  },\n  args: string[],\n): Promise<{ stdout: string; stderr: string }> {\n  return new Promise((resolve, reject) => {\n    let child: ChildProcess\n    try {\n      child = opts.spawn(opts.command, args, {\n        cwd: opts.cwd,\n        env: opts.env,\n        stdio: 'pipe',\n        detached: process.platform !== 'win32',\n      })\n    } catch (err) {\n      reject(err instanceof Error ? err : new Error(String(err)))\n      return\n    }\n    child.stdin?.end()\n    let stdout = ''\n    let stderr = ''\n    let settled = false\n    let forceKillTimer: ReturnType<typeof setTimeout> | null = null\n    const timer = setTimeout(() => {\n      signalProcessTree(child, 'SIGTERM')\n      forceKillTimer = setTimeout(() => signalProcessTree(child, 'SIGKILL'), processKillGraceMs)\n      forceKillTimer.unref?.()\n    }, 10_000)\n    timer.unref?.()\n    const onAbort = () => {\n      signalProcessTree(child, 'SIGTERM')\n      if (!forceKillTimer) {\n        forceKillTimer = setTimeout(() => signalProcessTree(child, 'SIGKILL'), processKillGraceMs)\n        forceKillTimer.unref?.()\n      }\n    }\n    if (opts.signal) {\n      if (opts.signal.aborted) onAbort()\n      else opts.signal.addEventListener('abort', onAbort, { once: true })\n    }\n    child.stdout?.on('data', (chunk) => {\n      stdout += String(chunk)\n    })\n    child.stderr?.on('data', (chunk) => {\n      stderr += String(chunk)\n    })\n    child.on('error', (err) => {\n      if (settled) return\n      settled = true\n      clearTimeout(timer)\n      if (forceKillTimer) clearTimeout(forceKillTimer)\n      opts.signal?.removeEventListener('abort', onAbort)\n      reject(err)\n    })\n    child.on('close', (code, signal) => {\n      if (settled) return\n      settled = true\n      clearTimeout(timer)\n      if (forceKillTimer) clearTimeout(forceKillTimer)\n      opts.signal?.removeEventListener('abort', onAbort)\n      if (code !== 0) {\n        const safeStderr = redactCodexHome(stderr, opts.env.CODEX_HOME)\n        reject(\n          new Error(\n            `runLocalHarness: Codex evidence probe failed (exit ${String(code)}, signal ${String(signal)}): ${safeStderr.trim()}`,\n          ),\n        )\n        return\n      }\n      resolve({ stdout, stderr })\n    })\n  })\n}\n\nfunction sha256(value: string): string {\n  return createHash('sha256').update(value).digest('hex')\n}\n\n/** Codex's debug renderer converts CRLF pairs to LF. No other whitespace is equivalent. */\nfunction normalizeCodexDebugPromptNewlines(value: string): string {\n  return value.replaceAll('\\r\\n', '\\n')\n}\n\nfunction jsonTextContains(value: unknown, needle: string): boolean {\n  if (typeof value === 'string') return value.includes(needle)\n  if (Array.isArray(value)) return value.some((item) => jsonTextContains(item, needle))\n  if (isRecord(value)) return Object.values(value).some((item) => jsonTextContains(item, needle))\n  return false\n}\n\nfunction redactJsonText(value: unknown, text: string): unknown {\n  if (typeof value === 'string') return value.replaceAll(text, '')\n  if (Array.isArray(value)) return value.map((item) => redactJsonText(item, text))\n  if (isRecord(value)) {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, item]) => [key, redactJsonText(item, text)]),\n    )\n  }\n  return value\n}\n\nconst CODEX_AUTH_ENV = ['CODEX_ACCESS_TOKEN', 'CODEX_API_KEY', 'OPENAI_API_KEY'] as const\n\nconst CODEX_PERMISSION_PROFILE = 'agent_runtime_reproducible'\n\nasync function isolateCodexHome(opts: {\n  baseEnv: NodeJS.ProcessEnv\n  cwd: string\n  command: string\n  readDeniedPaths: ReadonlyArray<string>\n  resolveExecutable: (command: string, env: NodeJS.ProcessEnv) => Promise<string>\n}): Promise<{\n  env: NodeJS.ProcessEnv\n  command: string\n  cleanup: () => Promise<void>\n  controlledConfigSha256: string\n  executableSha256: string\n  readDeniedPaths: string[]\n  readDeniedPathsSha256: string\n  readDeniedPathCount: number\n  diagnosticRedactionValues: string[]\n  ambientAuth: string\n  isolatedAuth: string\n  writeProbe: string\n  stagedWriteProbe: string\n  deniedProbePaths: string[]\n}> {\n  const isolatedHome = await mkdtemp(join(tmpdir(), 'agent-runtime-codex-'))\n  await chmod(isolatedHome, 0o700)\n  let workspaceTemp = ''\n  let stagedExecutableDir = ''\n  let ownsStagedExecutableDir = false\n  let writeProbe = ''\n  const cleanup = async () => {\n    if (ownsStagedExecutableDir) {\n      await chmod(stagedExecutableDir, 0o700).catch(() => undefined)\n    }\n    await Promise.all([\n      ...(writeProbe ? [rm(writeProbe, { force: true })] : []),\n      ...(workspaceTemp ? [rm(workspaceTemp, { recursive: true, force: true })] : []),\n      ...(ownsStagedExecutableDir\n        ? [rm(stagedExecutableDir, { recursive: true, force: true })]\n        : []),\n      rm(isolatedHome, { recursive: true, force: true }),\n    ])\n  }\n  try {\n    const readDeniedPaths = await normalizeReadDeniedPaths(opts.readDeniedPaths)\n    const candidateRoot = await realpath(opts.cwd)\n    writeProbe = join(candidateRoot, `.agent-runtime-write-proof-${randomUUID()}`)\n    const stagedPath = join(candidateRoot, '.agent-runtime-bin')\n    if (\n      readDeniedPaths.some(\n        (path) =>\n          isSameOrDescendant(candidateRoot, path) ||\n          isSameOrDescendant(stagedPath, path) ||\n          isSameOrDescendant(path, stagedPath),\n      )\n    ) {\n      throw new Error(\n        'runLocalHarness: codexReadDeniedPaths cannot contain the candidate root or staged executable',\n      )\n    }\n    const nativeExecutable = await opts.resolveExecutable(opts.command, opts.baseEnv)\n    if (!(await isStaticElfExecutable(nativeExecutable))) {\n      throw new Error(\n        'runLocalHarness: reproducible Codex mode requires a statically linked Linux Codex ELF',\n      )\n    }\n    const sourceExecutableSha256 = await sha256File(nativeExecutable)\n\n    stagedExecutableDir = stagedPath\n    try {\n      await mkdir(stagedExecutableDir, { mode: 0o700 })\n      ownsStagedExecutableDir = true\n    } catch (err) {\n      throw new Error(\n        `runLocalHarness: candidate-private .agent-runtime-bin must not already exist: ${String((err as NodeJS.ErrnoException).code ?? err)}`,\n      )\n    }\n    const stagedExecutable = join(stagedExecutableDir, 'codex')\n    await copyFile(nativeExecutable, stagedExecutable, constants.COPYFILE_FICLONE)\n    await chmod(stagedExecutable, 0o500)\n    const executableSha256 = await sha256File(stagedExecutable)\n    if (\n      executableSha256 !== sourceExecutableSha256 ||\n      !(await isStaticElfExecutable(stagedExecutable))\n    ) {\n      throw new Error('runLocalHarness: staged Codex executable digest mismatch')\n    }\n    await chmod(stagedExecutableDir, 0o500)\n\n    workspaceTemp = await mkdtemp(join(candidateRoot, '.agent-runtime-tmp-'))\n    await chmod(workspaceTemp, 0o700)\n    const ambientHome = resolve(opts.baseEnv.CODEX_HOME?.trim() || join(homedir(), '.codex'))\n    const ambientAuth = join(ambientHome, 'auth.json')\n    const isolatedAuth = join(isolatedHome, 'auth.json')\n    let authText = ''\n    try {\n      await access(ambientAuth, constants.R_OK)\n      authText = await readCodexAuthRedactionText(ambientAuth)\n      await symlink(ambientAuth, isolatedAuth)\n    } catch (err) {\n      throw new Error(\n        `runLocalHarness: reproducible Codex mode requires readable auth.json: ${String((err as NodeJS.ErrnoException).code ?? err)}`,\n      )\n    }\n    const deniedHostRoots = [homedir(), opts.baseEnv.HOME?.trim(), ambientHome]\n      .filter((path): path is string => Boolean(path))\n      .map((path) => resolve(path))\n      .filter((path, index, paths) => paths.indexOf(path) === index)\n    const controlledConfig = codexControlledConfig({\n      ambientTmp: opts.baseEnv.TMPDIR?.trim() || tmpdir(),\n      deniedHostRoots,\n      workspaceTemp,\n      stagedExecutableDir,\n      readDeniedPaths,\n    })\n    await writeFile(join(isolatedHome, 'config.toml'), controlledConfig, { mode: 0o600 })\n    const env = { ...opts.baseEnv }\n    for (const name of Object.keys(env)) {\n      if (\n        codexSensitiveEnvironmentName.test(name) ||\n        CODEX_AUTH_ENV.some((authName) => authName === name)\n      ) {\n        delete env[name]\n      }\n    }\n    env.CODEX_HOME = isolatedHome\n    const home = homedir()\n    const deniedProbePaths = [\n      ...deniedHostRoots,\n      ambientAuth,\n      isolatedAuth,\n      join(home, '.claude', '.credentials.json'),\n      join(home, '.claude.json'),\n      join(home, '.local', 'share', 'opencode', 'auth.json'),\n      join(home, '.agents'),\n      join(home, 'Documents'),\n      join(home, 'Downloads'),\n      join(home, '.npm'),\n      join(home, 'code'),\n      ...readDeniedPaths,\n    ].filter((path, index, paths) => paths.indexOf(path) === index)\n    return {\n      env,\n      command: stagedExecutable,\n      cleanup,\n      controlledConfigSha256: sha256(controlledConfig),\n      executableSha256,\n      readDeniedPaths,\n      readDeniedPathsSha256: sha256(JSON.stringify(readDeniedPaths)),\n      readDeniedPathCount: readDeniedPaths.length,\n      diagnosticRedactionValues: collectCodexDiagnosticRedactionValues(opts.baseEnv, authText),\n      ambientAuth,\n      isolatedAuth,\n      writeProbe,\n      stagedWriteProbe: join(stagedExecutableDir, 'write-proof'),\n      deniedProbePaths,\n    }\n  } catch (err) {\n    await cleanup()\n    throw err\n  }\n}\n\nfunction codexControlledConfig(opts: {\n  ambientTmp: string\n  deniedHostRoots: string[]\n  workspaceTemp: string\n  stagedExecutableDir: string\n  readDeniedPaths: string[]\n}): string {\n  const rules = new Map<string, 'deny' | 'read' | 'write'>()\n  const broadDeniedPaths = minimalPathRoots([\n    ...opts.deniedHostRoots.map((path) => resolve(path)),\n    tmpdir(),\n    opts.ambientTmp,\n    '/proc',\n    '/run/docker',\n    '/run/containerd',\n  ])\n  for (const path of broadDeniedPaths) {\n    rules.set(path, 'deny')\n  }\n  const workspaceRoot = dirname(opts.workspaceTemp)\n  for (const path of opts.readDeniedPaths) {\n    const alreadyDenied = broadDeniedPaths.some((root) => isSameOrDescendant(path, root))\n    if (!alreadyDenied || isSameOrDescendant(path, workspaceRoot)) rules.set(path, 'deny')\n  }\n  if (!rules.has(opts.workspaceTemp)) rules.set(opts.workspaceTemp, 'write')\n  if (!rules.has(opts.stagedExecutableDir)) rules.set(opts.stagedExecutableDir, 'read')\n  const filesystemRules = [...rules]\n    .sort(([a], [b]) => a.localeCompare(b))\n    .map(([path, access]) => `${JSON.stringify(path)} = ${JSON.stringify(access)}`)\n    .join('\\n')\n  return `default_permissions = \"${CODEX_PERMISSION_PROFILE}\"\napproval_policy = \"never\"\nallow_login_shell = false\nservice_tier = \"default\"\n\n[shell_environment_policy]\ninherit = \"core\"\nignore_default_excludes = false\nexclude = [\"^CODEX_HOME$\", \"(?i).*TOKEN.*\", \"(?i).*KEY.*\", \"(?i).*SECRET.*\", \"(?i).*PASSWORD.*\", \"(?i).*CREDENTIAL.*\", \"(?i).*AUTH.*\", \"(?i).*COOKIE.*\"]\nset = { TMPDIR = ${JSON.stringify(opts.workspaceTemp)} }\n\n[permissions.${CODEX_PERMISSION_PROFILE}.filesystem]\n\":minimal\" = \"read\"\n${filesystemRules}\n\":slash_tmp\" = \"deny\"\n\n[permissions.${CODEX_PERMISSION_PROFILE}.filesystem.\":workspace_roots\"]\n\".\" = \"write\"\n\".git\" = \"deny\"\n\n[permissions.${CODEX_PERMISSION_PROFILE}.network]\nenabled = false\n\n[permissions.${CODEX_PERMISSION_PROFILE}.network.unix_sockets]\n\"/var/run/docker.sock\" = \"deny\"\n\"/run/docker.sock\" = \"deny\"\n\"/var/run/containerd/containerd.sock\" = \"deny\"\n\"/run/containerd/containerd.sock\" = \"deny\"\n`\n}\n\nfunction isSameOrDescendant(path: string, root: string): boolean {\n  const normalizedPath = resolve(path)\n  const normalizedRoot = resolve(root)\n  return normalizedPath === normalizedRoot || normalizedPath.startsWith(`${normalizedRoot}${sep}`)\n}\n\nfunction minimalPathRoots(paths: ReadonlyArray<string>): string[] {\n  const ordered = [...new Set(paths.map((path) => resolve(path)))].sort(\n    (a, b) => a.length - b.length || a.localeCompare(b),\n  )\n  return ordered.filter(\n    (path, index) => !ordered.slice(0, index).some((root) => isSameOrDescendant(path, root)),\n  )\n}\n\nasync function normalizeReadDeniedPaths(paths: ReadonlyArray<string>): Promise<string[]> {\n  if (!Array.isArray(paths)) {\n    throw new Error('runLocalHarness: codexReadDeniedPaths must be an array of absolute paths')\n  }\n  const normalized = new Set<string>()\n  for (const path of paths) {\n    if (typeof path !== 'string' || path.length === 0 || path.includes('\\0') || !isAbsolute(path)) {\n      throw new Error('runLocalHarness: codexReadDeniedPaths must contain absolute paths')\n    }\n    const absolute = resolve(path)\n    normalized.add(absolute)\n    try {\n      normalized.add(await realpath(absolute))\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err\n    }\n  }\n  return [...normalized].sort()\n}\n\nasync function resolveCodexNativeExecutable(\n  command: string,\n  env: NodeJS.ProcessEnv,\n): Promise<string> {\n  const candidates =\n    command.includes(sep) || isAbsolute(command)\n      ? [resolve(command)]\n      : (env.PATH ?? '')\n          .split(delimiter)\n          .filter(Boolean)\n          .map((entry) => join(entry, command))\n  const seen = new Set<string>()\n  for (const candidate of candidates) {\n    let resolved: string\n    try {\n      await access(candidate, constants.X_OK)\n      resolved = await realpath(candidate)\n    } catch {\n      continue\n    }\n    if (seen.has(resolved)) continue\n    seen.add(resolved)\n    if (await isStaticElfExecutable(resolved)) return resolved\n    const packageRoot = await findCodexPackageRoot(resolved)\n    if (!packageRoot) continue\n    const bundled = await findBundledCodexExecutable(packageRoot)\n    if (bundled) return bundled\n  }\n  throw new Error(\n    'runLocalHarness: could not resolve the native Codex executable from the requested command',\n  )\n}\n\nasync function findCodexPackageRoot(file: string): Promise<string | undefined> {\n  let cursor = dirname(file)\n  while (true) {\n    try {\n      const parsed = JSON.parse(await readFile(join(cursor, 'package.json'), 'utf8')) as {\n        name?: unknown\n      }\n      if (parsed.name === '@openai/codex') return cursor\n    } catch {\n      // Keep walking; PATH wrappers commonly live outside the package directory.\n    }\n    const parent = dirname(cursor)\n    if (parent === cursor) return undefined\n    cursor = parent\n  }\n}\n\nasync function findBundledCodexExecutable(packageRoot: string): Promise<string | undefined> {\n  const target = linuxCodexTarget()\n  const candidates = [\n    join(\n      packageRoot,\n      'node_modules',\n      '@openai',\n      target.packageName,\n      'vendor',\n      target.triple,\n      'bin',\n      'codex',\n    ),\n    join(packageRoot, 'vendor', target.triple, 'bin', 'codex'),\n  ]\n  for (const executable of candidates) {\n    if (await isStaticElfExecutable(executable)) return executable\n  }\n  return undefined\n}\n\nfunction linuxCodexTarget(): { packageName: string; triple: string } {\n  if (process.platform !== 'linux') {\n    throw new Error('runLocalHarness: reproducible Codex mode requires Linux')\n  }\n  if (process.arch === 'x64') {\n    return { packageName: 'codex-linux-x64', triple: 'x86_64-unknown-linux-musl' }\n  }\n  if (process.arch === 'arm64') {\n    return { packageName: 'codex-linux-arm64', triple: 'aarch64-unknown-linux-musl' }\n  }\n  throw new Error(`runLocalHarness: unsupported Linux architecture ${process.arch}`)\n}\n\nasync function isStaticElfExecutable(path: string): Promise<boolean> {\n  let handle: Awaited<ReturnType<typeof open>> | undefined\n  try {\n    await access(path, constants.X_OK)\n    handle = await open(path, 'r')\n    const header = Buffer.alloc(64)\n    const { bytesRead } = await handle.read(header, 0, header.length, 0)\n    if (\n      bytesRead !== header.length ||\n      !header.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])) ||\n      header[4] !== 2 ||\n      header[5] !== 1\n    ) {\n      return false\n    }\n    const programHeaderOffset = Number(header.readBigUInt64LE(32))\n    const programHeaderSize = header.readUInt16LE(54)\n    const programHeaderCount = header.readUInt16LE(56)\n    const expectedMachine = process.arch === 'x64' ? 62 : process.arch === 'arm64' ? 183 : -1\n    if (\n      ![2, 3].includes(header.readUInt16LE(16)) ||\n      header.readUInt16LE(18) !== expectedMachine ||\n      !Number.isSafeInteger(programHeaderOffset) ||\n      programHeaderOffset < 64 ||\n      programHeaderSize < 56 ||\n      programHeaderSize > 1024 ||\n      programHeaderCount === 0 ||\n      programHeaderCount > 1024\n    ) {\n      return false\n    }\n    const tableSize = programHeaderSize * programHeaderCount\n    const table = Buffer.alloc(tableSize)\n    const tableRead = await handle.read(table, 0, tableSize, programHeaderOffset)\n    if (tableRead.bytesRead !== tableSize) return false\n    for (let index = 0; index < programHeaderCount; index += 1) {\n      const type = table.readUInt32LE(index * programHeaderSize)\n      if (type === 3) return false\n    }\n    return true\n  } catch {\n    return false\n  } finally {\n    await handle?.close()\n  }\n}\n\nfunction sha256File(path: string): Promise<string> {\n  return new Promise((resolveDigest, reject) => {\n    const hash = createHash('sha256')\n    const stream = createReadStream(path)\n    stream.on('error', reject)\n    stream.on('data', (chunk) => hash.update(chunk))\n    stream.on('end', () => resolveDigest(hash.digest('hex')))\n  })\n}\n\nfunction signalProcessTree(child: ChildProcess, signal: NodeJS.Signals): void {\n  if (process.platform !== 'win32' && typeof child.pid === 'number') {\n    try {\n      process.kill(-child.pid, signal)\n      return\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ESRCH') return\n    }\n  }\n  try {\n    child.kill(signal)\n  } catch {\n    // The process may have exited between the timer and signal delivery.\n  }\n}\n\n/** Parse and validate the one terminal usage event emitted by `codex exec --json`. */\nexport function parseCodexTokenUsage(stdout: string): CodexTokenUsage {\n  const completed: unknown[] = []\n  for (const [index, line] of stdout.split(/\\r?\\n/).entries()) {\n    if (line.trim().length === 0) continue\n    let event: unknown\n    try {\n      event = JSON.parse(line)\n    } catch {\n      throw new Error(`runLocalHarness: Codex JSONL line ${index + 1} is not valid JSON`)\n    }\n    if (isRecord(event) && event.type === 'turn.completed') completed.push(event)\n  }\n  if (completed.length !== 1) {\n    throw new Error(\n      `runLocalHarness: expected exactly one Codex turn.completed usage event, received ${completed.length}`,\n    )\n  }\n  const event = completed[0]\n  if (!isRecord(event) || !isRecord(event.usage)) {\n    throw new Error('runLocalHarness: Codex turn.completed event is missing usage')\n  }\n  const usage = event.usage\n  const inputTokens = naturalNumber(usage.input_tokens, 'input_tokens')\n  const cachedInputTokens = naturalNumber(usage.cached_input_tokens, 'cached_input_tokens')\n  const outputTokens = naturalNumber(usage.output_tokens, 'output_tokens')\n  const reasoningOutputTokens = naturalNumber(\n    usage.reasoning_output_tokens,\n    'reasoning_output_tokens',\n  )\n  if (cachedInputTokens > inputTokens) {\n    throw new Error('runLocalHarness: Codex cached_input_tokens exceeds input_tokens')\n  }\n  if (reasoningOutputTokens > outputTokens) {\n    throw new Error('runLocalHarness: Codex reasoning_output_tokens exceeds output_tokens')\n  }\n  return { inputTokens, cachedInputTokens, outputTokens, reasoningOutputTokens }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\nfunction naturalNumber(value: unknown, field: string): number {\n  if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {\n    throw new Error(`runLocalHarness: Codex usage.${field} must be a non-negative safe integer`)\n  }\n  return value\n}\n"],"mappings":";AAAA,SAAS,iBAAiB;AAC1B,SAAS,YAAY;AACrB,SAAS,gCAAgC;AAgBlC,IAAM,gCAAN,cAA4C,MAAM;AAAA,EAGvD,YACW,QACA,YACT,OACA;AACA;AAAA,MACE,yDAAyD,MAAM,gBAAgB,KAAK,UAAU,UAAU,CAAC;AAAA,MACzG,EAAE,MAAM;AAAA,IACV;AAPS;AACA;AAOT,SAAK,OAAO;AAAA,EACd;AAAA,EATW;AAAA,EACA;AAAA,EAJF,OAAO;AAalB;AAEA,IAAM,iCAAiC;AACvC,IAAM,uBAAuB,OAAO;AACpC,IAAM,iBAAiB;AAChB,IAAM,gCAAgC;AAEtC,SAAS,oCAAoC,MAWlB;AAChC,QAAM,SAAS,CAAC,UACd,sBAAsB,OAAO,KAAK,WAAW,KAAK,eAAe;AACnE,QAAM,gBAAgB,qBAAqB,OAAO,KAAK,MAAM,CAAC;AAC9D,QAAM,gBAAgB,qBAAqB,OAAO,KAAK,MAAM,CAAC;AAC9D,QAAM,aAA8C;AAAA,IAClD,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,IACf,YAAY,KAAK;AAAA,IACjB,QAAQ,cAAc;AAAA,IACtB,QAAQ,cAAc;AAAA,IACtB,iBAAiB,cAAc;AAAA,IAC/B,iBAAiB,cAAc;AAAA,EACjC;AACA,QAAM,aAAa,qBAAqB,OAAO,KAAK,MAAM,GAAG,IAAI,EAAE;AACnE,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA,sBAAsB,KAAK,OAAO,YAAY,MAAM;AAAA,EACtD;AACF;AAEO,SAAS,gBAAgB,OAAe,WAAuC;AACpF,SAAO,YAAY,MAAM,WAAW,WAAW,uBAAuB,IAAI;AAC5E;AAEO,SAAS,sCACd,KACA,UACU;AACV,QAAM,SAAS,OAAO,QAAQ,GAAG,EAC9B;AAAA,IACC,CAAC,CAAC,MAAM,KAAK,MAAM,8BAA8B,KAAK,IAAI,KAAK,OAAO,UAAU;AAAA,EAClF,EACC,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAe;AACrC,MAAI;AACF,wBAAoB,KAAK,MAAM,QAAQ,GAAG,MAAM;AAAA,EAClD,QAAQ;AAAA,EAER;AACA,QAAM,UAAU,OACb,OAAO,CAAC,UAAU,MAAM,UAAU,CAAC,EACnC,QAAQ,CAAC,UAAU;AAAA,IAClB,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,QAAQ;AAAA,IAC5C,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AAAA,IAC/C,mBAAmB,KAAK;AAAA,IACxB,KAAK,UAAU,KAAK,EAAE,MAAM,GAAG,EAAE;AAAA,EACnC,CAAC;AACH,SAAO,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC;AAC7C;AAEA,eAAsB,2BAA2B,MAA+B;AAC9E,QAAM,SAAS,MAAM,KAAK,MAAM,UAAU,WAAW,UAAU,UAAU;AACzE,MAAI;AACF,UAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,QAAI,CAAC,MAAM,OAAO,KAAK,CAAC,OAAO,cAAc,MAAM,IAAI,KAAK,MAAM,OAAO,sBAAsB;AAC7F,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,UAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AACtC,QAAI,SAAS;AACb,WAAO,SAAS,OAAO,QAAQ;AAC7B,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK,QAAQ,QAAQ,OAAO,SAAS,QAAQ,MAAM;AACtF,UAAI,cAAc,EAAG;AACrB,gBAAU;AAAA,IACZ;AACA,WAAO,OAAO,SAAS,GAAG,MAAM,EAAE,SAAS,MAAM;AAAA,EACnD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,SAAS,qBACP,OACA,WAAW,gCAC4B;AACvC,MAAI,MAAM,UAAU,SAAU,QAAO,EAAE,OAAO,WAAW,MAAM;AAC/D,QAAM,SAAS;AACf,QAAM,eAAe,WAAW,OAAO;AACvC,QAAM,YAAY,KAAK,MAAM,eAAe,CAAC;AAC7C,QAAM,YAAY,eAAe;AACjC,SAAO;AAAA,IACL,OAAO,GAAG,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC;AAAA,IACtE,WAAW;AAAA,EACb;AACF;AAEA,SAAS,sBACP,OACA,WACA,iBACQ;AACR,MAAI,WAAW,gBAAgB,yBAAyB,KAAK,GAAG,SAAS;AACzE,QAAM,cAAc,CAAC,GAAG,IAAI,IAAI,gBAAgB,OAAO,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE;AAAA,IACnF,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE;AAAA,EACzB;AACA,aAAW,UAAU,YAAa,YAAW,SAAS,WAAW,QAAQ,cAAc;AACvF,aAAW,SACR,QAAQ,yCAAyC,KAAK,cAAc,EAAE,EACtE,QAAQ,wCAAwC,cAAc,EAC9D,QAAQ,mEAAmE,cAAc,EACzF;AAAA,IACC;AAAA,IACA,OAAO,cAAc;AAAA,EACvB,EACC;AAAA,IACC;AAAA,IACA,KAAK,cAAc;AAAA,EACrB;AACF,aAAW,UAAU,YAAa,YAAW,SAAS,WAAW,QAAQ,cAAc;AACvF,SAAO;AACT;AAEA,SAAS,sBACP,OACA,YACA,QACmB;AACnB,MAAI,EAAE,iBAAiB,OAAQ,QAAO;AACtC,QAAM,YAAY,IAAI,MAAM,UAAU;AACtC,YAAU,OAAO,MAAM;AACvB,MAAI,MAAM,MAAO,WAAU,QAAQ,qBAAqB,OAAO,MAAM,KAAK,CAAC,EAAE;AAC7E,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAgB,QAAwB;AACnE,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,KAAK,KAAK;AACjB;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,QAAQ,MAAO,qBAAoB,MAAM,MAAM;AAC1D;AAAA,EACF;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,eAAW,QAAQ,OAAO,OAAO,KAAK,EAAG,qBAAoB,MAAM,MAAM;AAAA,EAC3E;AACF;;;ACxKA,SAA4B,aAAa;AACzC,SAAS,YAAY,kBAAkB;AACvC,SAAS,aAAAA,YAAW,wBAAwB;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS,cAAc;AAChC,SAAS,UAAU,WAAW,SAAS,YAAY,MAAM,SAAS,WAAW;AAkB7E,IAAM,uBAAwD;AAAA,EAC5D,MAAM;AAAA,EACN,SAAS;AAAA,EACT,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAO;AAAA,EACP,WAAW;AACb;AAEA,SAAS,mBAAmB,iBAA4C;AACtE,QAAM,SAAS,qBAAqB,eAAe;AACnD,MAAI,WAAW,QAAW;AACxB,UAAM,IAAI;AAAA,MACR,yDAAyD,OAAO,eAAe,CAAC;AAAA,IAClF;AAAA,EACF;AACA,SAAO,CAAC,MAAM,2BAA2B,MAAM,GAAG;AACpD;AAUA,IAAM,sBAUF;AAAA,EACF,QAAQ;AAAA,IACN,SAAS;AAAA;AAAA;AAAA,IAGT,WAAW,CAAC,eAAe,CAAC,MAAM,UAAU;AAAA,IAC5C,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK;AAAA,EACpC;AAAA,EACA,OAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,eAAe,CAAC,QAAQ,UAAU;AAAA,IAC9C,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK;AAAA,IAClC,eAAe;AAAA,EACjB;AAAA,EACA,UAAU;AAAA,IACR,SAAS;AAAA,IACT,WAAW,CAAC,eAAe,CAAC,OAAO,UAAU;AAAA,IAC7C,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK;AAAA,EACpC;AACF;AAmBA,IAAM,0BAA0B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,iBACP,SACA,YACA,UAAoC,CAAC,GAC3B;AACV,QAAM,OAAO,oBAAoB,OAAO,EAAE,UAAU,UAAU;AAC9D,MAAI,YAAY,YAAY,QAAQ,4BAA4B;AAC9D,SAAK,KAAK,gCAAgC;AAAA,EAC5C;AACA,MAAI,QAAQ,mBAAmB;AAC7B,QAAI,YAAY,SAAS;AACvB,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AACA,SAAK,KAAK,GAAG,uBAAuB;AAAA,EACtC;AACA,SAAO;AACT;AAkBO,SAAS,kBACd,SACA,SACA,YACA,UAAoC,CAAC,GAClB;AACnB,QAAM,aAAa,oBAAoB,OAAO;AAC9C,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,sCAAsC,OAAO,OAAO,CAAC,EAAE;AAAA,EACzE;AAEA,MAAI,QAAQ,mBAAmB;AAC7B,UAAMC,SAAQ,QAAQ,OAAO;AAC7B,QAAI,OAAOA,WAAU,YAAYA,OAAM,KAAK,EAAE,WAAW,GAAG;AAC1D,YAAM,IAAI,MAAM,qEAAqE;AAAA,IACvF;AACA,QAAI,QAAQ,OAAO,oBAAoB,QAAW;AAChD,YAAM,IAAI,MAAM,6EAA6E;AAAA,IAC/F;AAAA,EACF;AAEA,QAAM,eAAe,QAAQ,QAAQ;AACrC,QAAM,eAAe,QAAQ,QAAQ;AACrC,MACE,iBAAiB,WAChB,CAAC,MAAM,QAAQ,YAAY,KAC1B,aAAa,KAAK,CAAC,gBAAgB,OAAO,gBAAgB,QAAQ,IACpE;AACA,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,iBAAiB;AAAA,IACrB,GAAI,OAAO,iBAAiB,YAAY,aAAa,KAAK,EAAE,SAAS,IAAI,CAAC,YAAY,IAAI,CAAC;AAAA,IAC3F,GAAI,cAAc,OAAO,CAAC,gBAAgB,YAAY,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;AAAA,IAC7E;AAAA,EACF;AACA,QAAM,iBAAiB,eAAe,KAAK,MAAM;AAEjD,QAAM,OAAO,iBAAiB,SAAS,gBAAgB,OAAO;AAE9D,QAAM,QAAQ,QAAQ,OAAO;AAC7B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,SAAK,KAAK,GAAG,WAAW,UAAU,KAAK,CAAC;AAAA,EAC1C;AAEA,QAAM,kBAAkB,QAAQ,OAAO;AACvC,MAAI,oBAAoB,UAAa,WAAW,eAAe;AAC7D,SAAK,KAAK,GAAG,WAAW,cAAc,eAAe,CAAC;AAAA,EACxD;AAEA,SAAO,EAAE,SAAS,WAAW,SAAS,MAAM,QAAQ,eAAe;AACrE;AA4HA,IAAM,qBAAqB,IAAI,KAAK;AACpC,IAAM,qBAAqB;AAqB3B,eAAsB,gBACpB,SAC6B;AAC7B,QAAM,EAAE,SAAS,KAAK,WAAW,IAAI;AACrC,MAAI,QAAQ,qBAAqB,YAAY,SAAS;AACpD,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MAAI,QAAQ,qBAAqB,QAAQ,aAAa,SAAS;AAC7D,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,MAAI,QAAQ,yBAAyB,UAAa,CAAC,QAAQ,mBAAmB;AAC5E,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,YAAY,QAAQ,SAAS;AAEnC,QAAM,aAAa,oBAAoB,OAAO;AAC9C,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,oCAAoC,OAAO,OAAO,CAAC,EAAE;AAAA,EACvE;AAEA,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,mBAAmB,QAAQ,YAAY,WAAW,WAAW;AACnE,QAAM,OAAO,QAAQ,aACjB,CAAC,GAAG,QAAQ,WAAW,IAAI,IAC3B,iBAAiB,SAAS,YAAY,OAAO;AACjD,MAAI,QAAQ,kBAAmB,mCAAkC,kBAAkB,IAAI;AASvF,QAAM,UAA6B,EAAE,GAAI,QAAQ,OAAO,QAAQ,KAAM,KAAK,IAAI;AAC/E,QAAM,WAAW,QAAQ,oBACrB,MAAM,iBAAiB;AAAA,IACrB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,iBAAiB,QAAQ,wBAAwB,CAAC;AAAA,IAClD,mBAAmB,QAAQ,0BAA0B;AAAA,EACvD,CAAC,IACD;AAAA,IACE,KAAK;AAAA,IACL,SAAS;AAAA,IACT,SAAS,YAAY;AAAA,IACrB,wBAAwB;AAAA,IACxB,kBAAkB;AAAA,IAClB,uBAAuB;AAAA,IACvB,qBAAqB;AAAA,IACrB,iBAAiB,CAAC;AAAA,IAClB,2BAA2B,CAAC;AAAA,IAC5B,aAAa;AAAA,IACb,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,kBAAkB,CAAC;AAAA,EACrB;AACJ,QAAM,MAAM,SAAS;AACrB,QAAM,UAAU,SAAS;AACzB,MAAI,QAAQ,kBAAmB,mCAAkC,SAAS,IAAI;AAE9E,MAAI;AACF,UAAM,WAAW,QAAQ,oBACrB,MAAM,8BAA8B;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP,wBAAwB,SAAS;AAAA,MACjC,kBAAkB,SAAS;AAAA,MAC3B,uBAAuB,SAAS;AAAA,MAChC,qBAAqB,SAAS;AAAA,MAC9B,iBAAiB,SAAS;AAAA,MAC1B,aAAa,SAAS;AAAA,MACtB,cAAc,SAAS;AAAA,MACvB,YAAY,SAAS;AAAA,MACrB,kBAAkB,SAAS;AAAA,MAC3B,kBAAkB,SAAS;AAAA,MAC3B,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD,CAAC,IACD;AACJ,WAAO,MAAM,IAAI,QAA4B,CAACC,UAAS,WAAW;AAChE,UAAI;AACJ,UAAI;AACF,gBAAQ,UAAU,SAAS,MAAM;AAAA,UAC/B;AAAA,UACA;AAAA,UACA,OAAO;AAAA,UACP,UAAU,QAAQ,aAAa;AAAA,QACjC,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,eAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAC1D;AAAA,MACF;AAOA,YAAM,OAAO,IAAI;AAEjB,UAAI,SAAS;AACb,UAAI,SAAS;AACb,UAAI,WAAW;AACf,UAAI,UAAU;AACd,UAAI,iBAAuD;AAC3D,UAAI,qBAAqB;AAEzB,YAAM,YAAY,MAAM;AACtB,YAAI,mBAAoB;AACxB,6BAAqB;AACrB,0BAAkB,OAAO,SAAS;AAClC,yBAAiB,WAAW,MAAM,kBAAkB,OAAO,SAAS,GAAG,kBAAkB;AACzF,uBAAe,QAAQ;AAAA,MACzB;AAEA,YAAM,QACJ,YAAY,IACR,WAAW,MAAM;AACf,mBAAW;AACX,kBAAU;AAAA,MACZ,GAAG,SAAS,IACZ;AACN,UAAI,SAAS,OAAQ,MAAiC,UAAU,YAAY;AAC1E;AAAC,QAAC,MAAgC,MAAM;AAAA,MAC1C;AAEA,YAAM,UAAU,MAAM;AACpB,kBAAU;AAAA,MACZ;AACA,UAAI,QAAQ,QAAQ;AAClB,YAAI,QAAQ,OAAO,QAAS,SAAQ;AAAA,YAC/B,SAAQ,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,MACvE;AAEA,YAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU;AAClC,kBAAU,OAAO,KAAK;AAAA,MACxB,CAAC;AACD,YAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU;AAClC,kBAAU,OAAO,KAAK;AAAA,MACxB,CAAC;AAED,YAAM,WAAW,CAAC,WAA+B;AAC/C,YAAI,QAAS;AACb,kBAAU;AACV,YAAI,MAAO,cAAa,KAAK;AAC7B,YAAI,eAAgB,cAAa,cAAc;AAC/C,gBAAQ,QAAQ,oBAAoB,SAAS,OAAO;AACpD,QAAAA,SAAQ,MAAM;AAAA,MAChB;AAEA,YAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,YAAI,QAAS;AACb,kBAAU;AACV,YAAI,MAAO,cAAa,KAAK;AAC7B,YAAI,eAAgB,cAAa,cAAc;AAC/C,gBAAQ,QAAQ,oBAAoB,SAAS,OAAO;AACpD,eAAO,GAAG;AAAA,MACZ,CAAC;AAED,YAAM,GAAG,SAAS,CAAC,MAAM,WAAW;AAClC,cAAM,aAAa,KAAK,IAAI,IAAI;AAChC,YAAI;AACF,gBAAM,QAAQ,QAAQ,oBAAoB,qBAAqB,MAAM,IAAI;AACzE,mBAAS;AAAA,YACP,UAAU;AAAA,YACV;AAAA,YACA,QAAQ,gBAAgB,QAAQ,IAAI,UAAU;AAAA,YAC9C,gBAAgB;AAAA,YAChB;AAAA,YACA;AAAA,YACA,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,YACzB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,UACjC,CAAC;AAAA,QACH,SAAS,KAAK;AACZ,cAAI,QAAS;AACb,oBAAU;AACV,cAAI,MAAO,cAAa,KAAK;AAC7B,cAAI,eAAgB,cAAa,cAAc;AAC/C,kBAAQ,QAAQ,oBAAoB,SAAS,OAAO;AACpD,gBAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC9D;AAAA,YACE,QAAQ,oBACJ,oCAAoC;AAAA,cAClC;AAAA,cACA,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA,WAAW,IAAI;AAAA,cACf,iBAAiB,SAAS;AAAA,cAC1B,OAAO;AAAA,YACT,CAAC,IACD,eAAe,QACb,MACA,IAAI,MAAM,MAAM;AAAA,UACxB;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,UAAM,SAAS,QAAQ;AAAA,EACzB;AACF;AAEA,IAAM,yBAA+C;AAAA,EACnD,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,wBAAwB;AAAA,EACxB,SAAS;AAAA,EACT,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,WAAW;AAAA,EACX,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,kCAAkC;AAAA,EAClC,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,kBAAkB;AACpB;AAEA,IAAM,iCAAiC;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,eAAe,8BAA8B,MAiBT;AAClC,oCAAkC,KAAK,SAAS,KAAK,IAAI;AACzD,QAAM,SAAS,KAAK,KAAK,CAAC;AAC1B,MAAI,KAAK,KAAK,CAAC,MAAM,UAAU,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AAChF,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,MAAM,cAAc,MAAM,CAAC,WAAW,CAAC,GAAG,OAAO,KAAK;AAC1E,MAAI,CAAC,uCAAuC,KAAK,UAAU,GAAG;AAC5D,UAAM,IAAI;AAAA,MACR,wDAAwD,KAAK,UAAU,UAAU,CAAC;AAAA,IACpF;AAAA,EACF;AAEA,QAAM,0BAA0B;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACG,IAAI,CAAC,SAAS,eAAe,IAAI,MAAM,EACvC,KAAK,MAAM;AACd,QAAM,eAAe;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,MAAM;AACb,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AAAA,IACL,GAAG,KAAK;AAAA,EACV,CAAC;AACD,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOF,CAAC;AACD,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,YAAY,qBAAqB,KAAK,MAAM,MAAM;AACxD,QAAM,kBAAkB,MAAM,cAAc,MAAM,SAAS,GAAG;AAC9D,MAAI;AACJ,MAAI;AACF,mBAAe,KAAK,MAAM,cAAc;AAAA,EAC1C,QAAQ;AACN,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,QAAM,qBAAqB,kCAAkC,MAAM;AACnE,MAAI,CAAC,MAAM,QAAQ,YAAY,KAAK,CAAC,iBAAiB,cAAc,kBAAkB,GAAG;AACvF,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AACA,QAAM,2BAA2B,KAAK,UAAU,eAAe,cAAc,kBAAkB,CAAC;AAChG,aAAW,UAAU,gCAAgC;AACnD,QAAI,yBAAyB,SAAS,MAAM,GAAG;AAC7C,YAAM,IAAI,MAAM,oEAAoE,MAAM,EAAE;AAAA,IAC9F;AAAA,EACF;AACA,aAAW,UAAU,CAAC,8BAA8B,uBAAuB,GAAG;AAC5E,QAAI,CAAC,eAAe,SAAS,MAAM,GAAG;AACpC,YAAM,IAAI,MAAM,qEAAqE,MAAM,EAAE;AAAA,IAC/F;AAAA,EACF;AAEA,QAAM,gBAAgB;AAAA,IACpB;AAAA,IACA,GAAG,KAAK,KAAK,IAAI,CAAC,KAAK,UAAW,UAAU,IAAI,aAAa,GAAI;AAAA,EACnE;AACA,SAAO;AAAA,IACL;AAAA,IACA,kBAAkB,KAAK;AAAA,IACvB,uBAAuB,OAAO,MAAM;AAAA,IACpC,uBAAuB,OAAO,cAAc;AAAA,IAC5C,qBAAqB,OAAO,KAAK,UAAU,aAAa,CAAC;AAAA,IACzD,wBAAwB,KAAK;AAAA,IAC7B,uBAAuB,KAAK;AAAA,IAC5B,qBAAqB,KAAK;AAAA,IAC1B,iBAAiB,CAAC,GAAG,KAAK,eAAe;AAAA,IACzC,QAAQ,EAAE,GAAG,uBAAuB;AAAA,EACtC;AACF;AAEA,SAAS,kCAAkC,SAAiB,MAAsB;AAChF,QAAM,aAAa,SAAS,OAAO;AACnC,MAAI,eAAe,WAAW,eAAe,aAAa;AACxD,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AACA,QAAM,SAAS,KAAK,CAAC;AACrB,QAAM,iBAAiB,CAAC,QAAQ,QAAQ,GAAG,uBAAuB;AAClE,QAAM,iBAAiB,eAAe,MAAM,CAAC,KAAK,UAAU,KAAK,KAAK,MAAM,GAAG;AAC/E,QAAM,OAAO,KAAK,MAAM,eAAe,MAAM;AAC7C,QAAM,aACJ,KAAK,CAAC,MAAM,QACZ,OAAO,KAAK,CAAC,MAAM,YACnB,KAAK,CAAC,EAAE,SAAS,KACjB,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG;AACzB,QAAM,iBACJ,KAAK,CAAC,MAAM,QACZ,OAAO,KAAK,CAAC,MAAM,YACnB,oEAAoE,KAAK,KAAK,CAAC,CAAC;AAClF,MAAI,CAAC,kBAAkB,KAAK,WAAW,KAAK,CAAC,cAAc,CAAC,gBAAgB;AAC1E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,UAAoB,QAA0B;AAC1E,QAAM,YAAY,CAAC,SAAS,cAAc;AAC1C,WAAS,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS,GAAG;AACvD,UAAM,MAAM,SAAS,KAAK;AAC1B,UAAM,QAAQ,SAAS,QAAQ,CAAC;AAChC,QAAI,QAAQ,QAAQ,UAAU,QAAW;AACvC,gBAAU,KAAK,MAAM,KAAK;AAC1B,eAAS;AAAA,IACX,WAAW,QAAQ,eAAe,UAAU,QAAW;AACrD,gBAAU,KAAK,aAAa,KAAK;AACjC,eAAS;AAAA,IACX,WAAW,QAAQ,QAAQ,UAAU,QAAW;AAC9C,gBAAU,KAAK,MAAM,SAAS,KAAK,UAAU,KAAK,CAAC,EAAE;AACrD,eAAS;AAAA,IACX,WAAW,QAAQ,QAAQ,UAAU,QAAW;AAC9C,gBAAU,KAAK,MAAM,gBAAgB,KAAK,UAAU,KAAK,CAAC,EAAE;AAC5D,eAAS;AAAA,IACX;AAAA,EACF;AACA,YAAU,KAAK,MAAM;AACrB,SAAO;AACT;AAEA,SAAS,cACP,MAOA,MAC6C;AAC7C,SAAO,IAAI,QAAQ,CAACA,UAAS,WAAW;AACtC,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,KAAK,SAAS,MAAM;AAAA,QACrC,KAAK,KAAK;AAAA,QACV,KAAK,KAAK;AAAA,QACV,OAAO;AAAA,QACP,UAAU,QAAQ,aAAa;AAAA,MACjC,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,aAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAC1D;AAAA,IACF;AACA,UAAM,OAAO,IAAI;AACjB,QAAI,SAAS;AACb,QAAI,SAAS;AACb,QAAI,UAAU;AACd,QAAI,iBAAuD;AAC3D,UAAM,QAAQ,WAAW,MAAM;AAC7B,wBAAkB,OAAO,SAAS;AAClC,uBAAiB,WAAW,MAAM,kBAAkB,OAAO,SAAS,GAAG,kBAAkB;AACzF,qBAAe,QAAQ;AAAA,IACzB,GAAG,GAAM;AACT,UAAM,QAAQ;AACd,UAAM,UAAU,MAAM;AACpB,wBAAkB,OAAO,SAAS;AAClC,UAAI,CAAC,gBAAgB;AACnB,yBAAiB,WAAW,MAAM,kBAAkB,OAAO,SAAS,GAAG,kBAAkB;AACzF,uBAAe,QAAQ;AAAA,MACzB;AAAA,IACF;AACA,QAAI,KAAK,QAAQ;AACf,UAAI,KAAK,OAAO,QAAS,SAAQ;AAAA,UAC5B,MAAK,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,IACpE;AACA,UAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU;AAClC,gBAAU,OAAO,KAAK;AAAA,IACxB,CAAC;AACD,UAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU;AAClC,gBAAU,OAAO,KAAK;AAAA,IACxB,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,KAAK;AAClB,UAAI,eAAgB,cAAa,cAAc;AAC/C,WAAK,QAAQ,oBAAoB,SAAS,OAAO;AACjD,aAAO,GAAG;AAAA,IACZ,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,MAAM,WAAW;AAClC,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,KAAK;AAClB,UAAI,eAAgB,cAAa,cAAc;AAC/C,WAAK,QAAQ,oBAAoB,SAAS,OAAO;AACjD,UAAI,SAAS,GAAG;AACd,cAAM,aAAa,gBAAgB,QAAQ,KAAK,IAAI,UAAU;AAC9D;AAAA,UACE,IAAI;AAAA,YACF,sDAAsD,OAAO,IAAI,CAAC,YAAY,OAAO,MAAM,CAAC,MAAM,WAAW,KAAK,CAAC;AAAA,UACrH;AAAA,QACF;AACA;AAAA,MACF;AACA,MAAAA,SAAQ,EAAE,QAAQ,OAAO,CAAC;AAAA,IAC5B,CAAC;AAAA,EACH,CAAC;AACH;AAEA,SAAS,OAAO,OAAuB;AACrC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAGA,SAAS,kCAAkC,OAAuB;AAChE,SAAO,MAAM,WAAW,QAAQ,IAAI;AACtC;AAEA,SAAS,iBAAiB,OAAgB,QAAyB;AACjE,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,SAAS,MAAM;AAC3D,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,KAAK,CAAC,SAAS,iBAAiB,MAAM,MAAM,CAAC;AACpF,MAAI,SAAS,KAAK,EAAG,QAAO,OAAO,OAAO,KAAK,EAAE,KAAK,CAAC,SAAS,iBAAiB,MAAM,MAAM,CAAC;AAC9F,SAAO;AACT;AAEA,SAAS,eAAe,OAAgB,MAAuB;AAC7D,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,WAAW,MAAM,EAAE;AAC/D,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,eAAe,MAAM,IAAI,CAAC;AAC/E,MAAI,SAAS,KAAK,GAAG;AACnB,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,eAAe,MAAM,IAAI,CAAC,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAM,iBAAiB,CAAC,sBAAsB,iBAAiB,gBAAgB;AAE/E,IAAM,2BAA2B;AAEjC,eAAe,iBAAiB,MAqB7B;AACD,QAAM,eAAe,MAAM,QAAQ,KAAK,OAAO,GAAG,sBAAsB,CAAC;AACzE,QAAM,MAAM,cAAc,GAAK;AAC/B,MAAI,gBAAgB;AACpB,MAAI,sBAAsB;AAC1B,MAAI,0BAA0B;AAC9B,MAAI,aAAa;AACjB,QAAM,UAAU,YAAY;AAC1B,QAAI,yBAAyB;AAC3B,YAAM,MAAM,qBAAqB,GAAK,EAAE,MAAM,MAAM,MAAS;AAAA,IAC/D;AACA,UAAM,QAAQ,IAAI;AAAA,MAChB,GAAI,aAAa,CAAC,GAAG,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC;AAAA,MACtD,GAAI,gBAAgB,CAAC,GAAG,eAAe,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC;AAAA,MAC7E,GAAI,0BACA,CAAC,GAAG,qBAAqB,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,CAAC,IAC1D,CAAC;AAAA,MACL,GAAG,cAAc,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IACnD,CAAC;AAAA,EACH;AACA,MAAI;AACF,UAAM,kBAAkB,MAAM,yBAAyB,KAAK,eAAe;AAC3E,UAAM,gBAAgB,MAAM,SAAS,KAAK,GAAG;AAC7C,iBAAa,KAAK,eAAe,8BAA8B,WAAW,CAAC,EAAE;AAC7E,UAAM,aAAa,KAAK,eAAe,oBAAoB;AAC3D,QACE,gBAAgB;AAAA,MACd,CAAC,SACC,mBAAmB,eAAe,IAAI,KACtC,mBAAmB,YAAY,IAAI,KACnC,mBAAmB,MAAM,UAAU;AAAA,IACvC,GACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,mBAAmB,MAAM,KAAK,kBAAkB,KAAK,SAAS,KAAK,OAAO;AAChF,QAAI,CAAE,MAAM,sBAAsB,gBAAgB,GAAI;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,yBAAyB,MAAM,WAAW,gBAAgB;AAEhE,0BAAsB;AACtB,QAAI;AACF,YAAM,MAAM,qBAAqB,EAAE,MAAM,IAAM,CAAC;AAChD,gCAA0B;AAAA,IAC5B,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,iFAAiF,OAAQ,IAA8B,QAAQ,GAAG,CAAC;AAAA,MACrI;AAAA,IACF;AACA,UAAM,mBAAmB,KAAK,qBAAqB,OAAO;AAC1D,UAAM,SAAS,kBAAkB,kBAAkBC,WAAU,gBAAgB;AAC7E,UAAM,MAAM,kBAAkB,GAAK;AACnC,UAAM,mBAAmB,MAAM,WAAW,gBAAgB;AAC1D,QACE,qBAAqB,0BACrB,CAAE,MAAM,sBAAsB,gBAAgB,GAC9C;AACA,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AACA,UAAM,MAAM,qBAAqB,GAAK;AAEtC,oBAAgB,MAAM,QAAQ,KAAK,eAAe,qBAAqB,CAAC;AACxE,UAAM,MAAM,eAAe,GAAK;AAChC,UAAM,cAAc,QAAQ,KAAK,QAAQ,YAAY,KAAK,KAAK,KAAK,QAAQ,GAAG,QAAQ,CAAC;AACxF,UAAM,cAAc,KAAK,aAAa,WAAW;AACjD,UAAM,eAAe,KAAK,cAAc,WAAW;AACnD,QAAI,WAAW;AACf,QAAI;AACF,YAAM,OAAO,aAAaA,WAAU,IAAI;AACxC,iBAAW,MAAM,2BAA2B,WAAW;AACvD,YAAM,QAAQ,aAAa,YAAY;AAAA,IACzC,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,yEAAyE,OAAQ,IAA8B,QAAQ,GAAG,CAAC;AAAA,MAC7H;AAAA,IACF;AACA,UAAM,kBAAkB,CAAC,QAAQ,GAAG,KAAK,QAAQ,MAAM,KAAK,GAAG,WAAW,EACvE,OAAO,CAAC,SAAyB,QAAQ,IAAI,CAAC,EAC9C,IAAI,CAAC,SAAS,QAAQ,IAAI,CAAC,EAC3B,OAAO,CAAC,MAAM,OAAO,UAAU,MAAM,QAAQ,IAAI,MAAM,KAAK;AAC/D,UAAM,mBAAmB,sBAAsB;AAAA,MAC7C,YAAY,KAAK,QAAQ,QAAQ,KAAK,KAAK,OAAO;AAAA,MAClD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,UAAU,KAAK,cAAc,aAAa,GAAG,kBAAkB,EAAE,MAAM,IAAM,CAAC;AACpF,UAAM,MAAM,EAAE,GAAG,KAAK,QAAQ;AAC9B,eAAW,QAAQ,OAAO,KAAK,GAAG,GAAG;AACnC,UACE,8BAA8B,KAAK,IAAI,KACvC,eAAe,KAAK,CAAC,aAAa,aAAa,IAAI,GACnD;AACA,eAAO,IAAI,IAAI;AAAA,MACjB;AAAA,IACF;AACA,QAAI,aAAa;AACjB,UAAM,OAAO,QAAQ;AACrB,UAAM,mBAAmB;AAAA,MACvB,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA,KAAK,MAAM,WAAW,mBAAmB;AAAA,MACzC,KAAK,MAAM,cAAc;AAAA,MACzB,KAAK,MAAM,UAAU,SAAS,YAAY,WAAW;AAAA,MACrD,KAAK,MAAM,SAAS;AAAA,MACpB,KAAK,MAAM,WAAW;AAAA,MACtB,KAAK,MAAM,WAAW;AAAA,MACtB,KAAK,MAAM,MAAM;AAAA,MACjB,KAAK,MAAM,MAAM;AAAA,MACjB,GAAG;AAAA,IACL,EAAE,OAAO,CAAC,MAAM,OAAO,UAAU,MAAM,QAAQ,IAAI,MAAM,KAAK;AAC9D,WAAO;AAAA,MACL;AAAA,MACA,SAAS;AAAA,MACT;AAAA,MACA,wBAAwB,OAAO,gBAAgB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,uBAAuB,OAAO,KAAK,UAAU,eAAe,CAAC;AAAA,MAC7D,qBAAqB,gBAAgB;AAAA,MACrC,2BAA2B,sCAAsC,KAAK,SAAS,QAAQ;AAAA,MACvF;AAAA,MACA;AAAA,MACA;AAAA,MACA,kBAAkB,KAAK,qBAAqB,aAAa;AAAA,MACzD;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,QAAQ;AACd,UAAM;AAAA,EACR;AACF;AAEA,SAAS,sBAAsB,MAMpB;AACT,QAAM,QAAQ,oBAAI,IAAuC;AACzD,QAAM,mBAAmB,iBAAiB;AAAA,IACxC,GAAG,KAAK,gBAAgB,IAAI,CAAC,SAAS,QAAQ,IAAI,CAAC;AAAA,IACnD,OAAO;AAAA,IACP,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,aAAW,QAAQ,kBAAkB;AACnC,UAAM,IAAI,MAAM,MAAM;AAAA,EACxB;AACA,QAAM,gBAAgB,QAAQ,KAAK,aAAa;AAChD,aAAW,QAAQ,KAAK,iBAAiB;AACvC,UAAM,gBAAgB,iBAAiB,KAAK,CAAC,SAAS,mBAAmB,MAAM,IAAI,CAAC;AACpF,QAAI,CAAC,iBAAiB,mBAAmB,MAAM,aAAa,EAAG,OAAM,IAAI,MAAM,MAAM;AAAA,EACvF;AACA,MAAI,CAAC,MAAM,IAAI,KAAK,aAAa,EAAG,OAAM,IAAI,KAAK,eAAe,OAAO;AACzE,MAAI,CAAC,MAAM,IAAI,KAAK,mBAAmB,EAAG,OAAM,IAAI,KAAK,qBAAqB,MAAM;AACpF,QAAM,kBAAkB,CAAC,GAAG,KAAK,EAC9B,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EACrC,IAAI,CAAC,CAAC,MAAMC,OAAM,MAAM,GAAG,KAAK,UAAU,IAAI,CAAC,MAAM,KAAK,UAAUA,OAAM,CAAC,EAAE,EAC7E,KAAK,IAAI;AACZ,SAAO,0BAA0B,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBASxC,KAAK,UAAU,KAAK,aAAa,CAAC;AAAA;AAAA,eAEtC,wBAAwB;AAAA;AAAA,EAErC,eAAe;AAAA;AAAA;AAAA,eAGF,wBAAwB;AAAA;AAAA;AAAA;AAAA,eAIxB,wBAAwB;AAAA;AAAA;AAAA,eAGxB,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAMvC;AAEA,SAAS,mBAAmB,MAAc,MAAuB;AAC/D,QAAM,iBAAiB,QAAQ,IAAI;AACnC,QAAM,iBAAiB,QAAQ,IAAI;AACnC,SAAO,mBAAmB,kBAAkB,eAAe,WAAW,GAAG,cAAc,GAAG,GAAG,EAAE;AACjG;AAEA,SAAS,iBAAiB,OAAwC;AAChE,QAAM,UAAU,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE;AAAA,IAC/D,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC;AAAA,EACpD;AACA,SAAO,QAAQ;AAAA,IACb,CAAC,MAAM,UAAU,CAAC,QAAQ,MAAM,GAAG,KAAK,EAAE,KAAK,CAAC,SAAS,mBAAmB,MAAM,IAAI,CAAC;AAAA,EACzF;AACF;AAEA,eAAe,yBAAyB,OAAiD;AACvF,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AACA,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,QAAQ,OAAO;AACxB,QAAI,OAAO,SAAS,YAAY,KAAK,WAAW,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,IAAI,GAAG;AAC7F,YAAM,IAAI,MAAM,mEAAmE;AAAA,IACrF;AACA,UAAM,WAAW,QAAQ,IAAI;AAC7B,eAAW,IAAI,QAAQ;AACvB,QAAI;AACF,iBAAW,IAAI,MAAM,SAAS,QAAQ,CAAC;AAAA,IACzC,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU,OAAM;AAAA,IAC9D;AAAA,EACF;AACA,SAAO,CAAC,GAAG,UAAU,EAAE,KAAK;AAC9B;AAEA,eAAe,6BACb,SACA,KACiB;AACjB,QAAM,aACJ,QAAQ,SAAS,GAAG,KAAK,WAAW,OAAO,IACvC,CAAC,QAAQ,OAAO,CAAC,KAChB,IAAI,QAAQ,IACV,MAAM,SAAS,EACf,OAAO,OAAO,EACd,IAAI,CAAC,UAAU,KAAK,OAAO,OAAO,CAAC;AAC5C,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,aAAa,YAAY;AAClC,QAAI;AACJ,QAAI;AACF,YAAM,OAAO,WAAWD,WAAU,IAAI;AACtC,iBAAW,MAAM,SAAS,SAAS;AAAA,IACrC,QAAQ;AACN;AAAA,IACF;AACA,QAAI,KAAK,IAAI,QAAQ,EAAG;AACxB,SAAK,IAAI,QAAQ;AACjB,QAAI,MAAM,sBAAsB,QAAQ,EAAG,QAAO;AAClD,UAAM,cAAc,MAAM,qBAAqB,QAAQ;AACvD,QAAI,CAAC,YAAa;AAClB,UAAM,UAAU,MAAM,2BAA2B,WAAW;AAC5D,QAAI,QAAS,QAAO;AAAA,EACtB;AACA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAe,qBAAqB,MAA2C;AAC7E,MAAI,SAAS,QAAQ,IAAI;AACzB,SAAO,MAAM;AACX,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,MAAM,SAAS,KAAK,QAAQ,cAAc,GAAG,MAAM,CAAC;AAG9E,UAAI,OAAO,SAAS,gBAAiB,QAAO;AAAA,IAC9C,QAAQ;AAAA,IAER;AACA,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,WAAW,OAAQ,QAAO;AAC9B,aAAS;AAAA,EACX;AACF;AAEA,eAAe,2BAA2B,aAAkD;AAC1F,QAAM,SAAS,iBAAiB;AAChC,QAAM,aAAa;AAAA,IACjB;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,IACA,KAAK,aAAa,UAAU,OAAO,QAAQ,OAAO,OAAO;AAAA,EAC3D;AACA,aAAW,cAAc,YAAY;AACnC,QAAI,MAAM,sBAAsB,UAAU,EAAG,QAAO;AAAA,EACtD;AACA,SAAO;AACT;AAEA,SAAS,mBAA4D;AACnE,MAAI,QAAQ,aAAa,SAAS;AAChC,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,MAAI,QAAQ,SAAS,OAAO;AAC1B,WAAO,EAAE,aAAa,mBAAmB,QAAQ,4BAA4B;AAAA,EAC/E;AACA,MAAI,QAAQ,SAAS,SAAS;AAC5B,WAAO,EAAE,aAAa,qBAAqB,QAAQ,6BAA6B;AAAA,EAClF;AACA,QAAM,IAAI,MAAM,mDAAmD,QAAQ,IAAI,EAAE;AACnF;AAEA,eAAe,sBAAsB,MAAgC;AACnE,MAAI;AACJ,MAAI;AACF,UAAM,OAAO,MAAMA,WAAU,IAAI;AACjC,aAAS,MAAME,MAAK,MAAM,GAAG;AAC7B,UAAM,SAAS,OAAO,MAAM,EAAE;AAC9B,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK,QAAQ,GAAG,OAAO,QAAQ,CAAC;AACnE,QACE,cAAc,OAAO,UACrB,CAAC,OAAO,SAAS,GAAG,CAAC,EAAE,OAAO,OAAO,KAAK,CAAC,KAAM,IAAM,IAAM,EAAI,CAAC,CAAC,KACnE,OAAO,CAAC,MAAM,KACd,OAAO,CAAC,MAAM,GACd;AACA,aAAO;AAAA,IACT;AACA,UAAM,sBAAsB,OAAO,OAAO,gBAAgB,EAAE,CAAC;AAC7D,UAAM,oBAAoB,OAAO,aAAa,EAAE;AAChD,UAAM,qBAAqB,OAAO,aAAa,EAAE;AACjD,UAAM,kBAAkB,QAAQ,SAAS,QAAQ,KAAK,QAAQ,SAAS,UAAU,MAAM;AACvF,QACE,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,OAAO,aAAa,EAAE,CAAC,KACxC,OAAO,aAAa,EAAE,MAAM,mBAC5B,CAAC,OAAO,cAAc,mBAAmB,KACzC,sBAAsB,MACtB,oBAAoB,MACpB,oBAAoB,QACpB,uBAAuB,KACvB,qBAAqB,MACrB;AACA,aAAO;AAAA,IACT;AACA,UAAM,YAAY,oBAAoB;AACtC,UAAM,QAAQ,OAAO,MAAM,SAAS;AACpC,UAAM,YAAY,MAAM,OAAO,KAAK,OAAO,GAAG,WAAW,mBAAmB;AAC5E,QAAI,UAAU,cAAc,UAAW,QAAO;AAC9C,aAAS,QAAQ,GAAG,QAAQ,oBAAoB,SAAS,GAAG;AAC1D,YAAM,OAAO,MAAM,aAAa,QAAQ,iBAAiB;AACzD,UAAI,SAAS,EAAG,QAAO;AAAA,IACzB;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,UAAM,QAAQ,MAAM;AAAA,EACtB;AACF;AAEA,SAAS,WAAW,MAA+B;AACjD,SAAO,IAAI,QAAQ,CAAC,eAAe,WAAW;AAC5C,UAAM,OAAO,WAAW,QAAQ;AAChC,UAAM,SAAS,iBAAiB,IAAI;AACpC,WAAO,GAAG,SAAS,MAAM;AACzB,WAAO,GAAG,QAAQ,CAAC,UAAU,KAAK,OAAO,KAAK,CAAC;AAC/C,WAAO,GAAG,OAAO,MAAM,cAAc,KAAK,OAAO,KAAK,CAAC,CAAC;AAAA,EAC1D,CAAC;AACH;AAEA,SAAS,kBAAkB,OAAqB,QAA8B;AAC5E,MAAI,QAAQ,aAAa,WAAW,OAAO,MAAM,QAAQ,UAAU;AACjE,QAAI;AACF,cAAQ,KAAK,CAAC,MAAM,KAAK,MAAM;AAC/B;AAAA,IACF,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,QAAS;AAAA,IACvD;AAAA,EACF;AACA,MAAI;AACF,UAAM,KAAK,MAAM;AAAA,EACnB,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,qBAAqB,QAAiC;AACpE,QAAM,YAAuB,CAAC;AAC9B,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,MAAM,OAAO,EAAE,QAAQ,GAAG;AAC3D,QAAI,KAAK,KAAK,EAAE,WAAW,EAAG;AAC9B,QAAIC;AACJ,QAAI;AACF,MAAAA,SAAQ,KAAK,MAAM,IAAI;AAAA,IACzB,QAAQ;AACN,YAAM,IAAI,MAAM,qCAAqC,QAAQ,CAAC,oBAAoB;AAAA,IACpF;AACA,QAAI,SAASA,MAAK,KAAKA,OAAM,SAAS,iBAAkB,WAAU,KAAKA,MAAK;AAAA,EAC9E;AACA,MAAI,UAAU,WAAW,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,oFAAoF,UAAU,MAAM;AAAA,IACtG;AAAA,EACF;AACA,QAAM,QAAQ,UAAU,CAAC;AACzB,MAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,MAAM,KAAK,GAAG;AAC9C,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,QAAM,QAAQ,MAAM;AACpB,QAAM,cAAc,cAAc,MAAM,cAAc,cAAc;AACpE,QAAM,oBAAoB,cAAc,MAAM,qBAAqB,qBAAqB;AACxF,QAAM,eAAe,cAAc,MAAM,eAAe,eAAe;AACvE,QAAM,wBAAwB;AAAA,IAC5B,MAAM;AAAA,IACN;AAAA,EACF;AACA,MAAI,oBAAoB,aAAa;AACnC,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,MAAI,wBAAwB,cAAc;AACxC,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,SAAO,EAAE,aAAa,mBAAmB,cAAc,sBAAsB;AAC/E;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,cAAc,OAAgB,OAAuB;AAC5D,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,MAAM,gCAAgC,KAAK,sCAAsC;AAAA,EAC7F;AACA,SAAO;AACT;","names":["constants","open","model","resolve","constants","access","open","event"]}