@te-river/opencode-team-mode 1.5.1 → 1.5.3

package/README.md

@@ -218,7 +218,7 @@ In **OpenCode Desktop**, you get additional UX benefits:
 
 ---
 
-## 🧯 Context governance (tm_* + R6) — new in v1.5.1
+## 🧯 Context governance (tm_* + R6 + R2) — new in v1.5.1
 
 > ⚠️ Requires `@te-river/opencode-team-mode@1.5.1` or later (released
 > 2026-09-08). If your config pins `@latest`, OpenCode upgrades on next start.
@@ -235,18 +235,56 @@ HMAC-signed, run-scoped, expiring handle. `tm_bash` only allows read-only
 commands (allowlist), and failures come back as structured errors instead of
 raw dumps.
 
-**R6 environment protection.** With TeamMode active, env-var reads by the
-model are blocked at the tool layer: env dump commands (`printenv`,
-`Get-ChildItem env:`, …), `$env:` / `$VAR` / `${VAR}` expansions, and env
-files (`.env`, shell rc files). The model sees a structured refusal and can
-ask the human instead; tm_* wrappers route through the same checks (no
-backdoor via the wrappers). Audit lines record only tool name + pattern
-category — never command text, paths, variable names or values.
+**R6 environment protection (now an approval gate).** With TeamMode active,
+the model cannot read environment variables silently. Env-var reads
+(`printenv`, `env`, `Get-ChildItem env:`, …) and env files (`.env`, shell rc
+files) route through OpenCode's **official confirmation dialog**: you get a
+native prompt to approve or deny, and an unanswered prompt is **auto-rejected
+after `TM_ASK_TIMEOUT_MIN` (default 10 min)** — the plugin only ever rejects
+on timeout, never approves on the model's behalf. Env reads that no wildcard
+can express (embedded `$VAR` / `${VAR}` / `$env:` inside another command,
+command substitution, subshell/escaped forms) and the `tm_*` wrapper channel
+stay a **hard block** (no dialog to slip through). tm_* wrappers route through
+the same checks (no backdoor via the wrappers). Audit lines record only tool
+name + pattern category + the verdict (`ask` / `allowed-once` /
+`allowed-always` / `rejected` / `timeout-rejected` / `degraded`) — never
+command text, paths, variable names or values.
+
+**R2 dangerous operations (same dialog).** Delete (`rm`/`del`/`Remove-Item`/
+`rmdir`), git publishing (`git push`/`git commit`), network fetch (`curl`/
+`wget`/`Invoke-WebRequest`/`Invoke-RestMethod`), package installs/publishes
+(`npm install`/`npm publish`/`pip install`/`winget`/`choco`), process/system
+(`taskkill`/`Stop-Process`/`kill`/`shutdown`/`format`) and privilege changes
+(`chmod`/`takeown`/`icacls`) — none are silently allowed. They pop the same
+official dialog and are auto-rejected if you don't answer within the timeout.
+The normal verification stack (`npm test`, `tsc`, `git status`/`diff`) is NOT
+gated, so day-to-day team work runs without interruption.
+
+> ⚠️ **When you approve a dialog, pick "once" — not "always".** Verified on
+> the live host, "always" records a far broader rule than the command you
+> saw: approving `Get-ChildItem env:PATH` with "always" stores `Get-ChildItem
+> *`, so every later `Get-ChildItem` runs with no dialog at all. Only the
+> once-verdict keeps each gated operation individually human-checked.
+
+> Deferral is per-session: env reads only route to the dialog in sessions
+> running TeamMode's injected agents (or after such a session has shown one
+> of these dialogs). In any other session (e.g. a stock `build`/`plan` chat)
+> TeamMode's guard keeps hard-blocking env reads, since no dialog would back
+> them there. Compound commands (`a; b`) are evaluated per segment by the
+> host and approved through one dialog; the guard blocks them outright
+> whenever any segment is an env read.
+
+> The permission protocol was verified against a live `opencode serve` host
+> (1.18.29) via SSE event capture; the Desktop dialog rendering itself is the
+> one leg that still needs eyeballing in a real Desktop session. Headless
+> `opencode run` auto-rejects an unanswered `ask` immediately (there is no
+> human to prompt).
 
 | Env var | Default | Purpose |
 |---|---|---|
-| `TM_ENV_PROTECT` | `strict` | R6 mode: `strict` / `standard` / `off` |
-| `TM_ENV_PROTECT_EXTRA_DENY` | — | extra block patterns (regex list) |
+| `TM_ENV_PROTECT` | `strict` | R6 mode: `strict` / `standard` / `off` (off also disarms the approval timer) |
+| `TM_ASK_TIMEOUT_MIN` | `10` | minutes before an unanswered R6/R2 confirmation dialog is auto-rejected; minimum 3 minutes (the host's `permission.replied` reaches the plugin ~120 s late on the event bus — shorter values would auto-reject a just-approved request) |
+| `TM_ENV_PROTECT_EXTRA_DENY` | — | extra block patterns (regex list; always a hard block, never dialog-governed) |
 | `TM_OFFLOAD_THRESHOLD` | `2000` | offload threshold (tokens, chars/4 estimate) |
 | `TM_PREVIEW_MAX_TOKENS` | `80` | preview hard cap |
 | `TM_FETCH_MAX_LINES` | `2000` | tm_fetch page cap |
@@ -254,6 +292,62 @@ category — never command text, paths, variable names or values.
 | `TM_TRAJECTORY_DIR` | `.trajectory/` | append-only tool-call ledger |
 | `TM_BLACKBOARD_TTL` | `7` | store retention (days) |
 | `TM_BASH_READONLY_ALLOWED` | built-in table | tm_bash allowlist |
+| `TM_PTC_MAX_PROGRAM_CHARS` | `4000` | PTC program source length cap (chars) |
+| `TM_PTC_MAX_CALLS` | `20` | PTC per-run bridge-call budget (1–200) |
+| `TM_PTC_MAX_ERRORS` | `3` | PTC per-run error budget (1–50) |
+| `TM_PTC_TIMEOUT_MS` | `60000` | PTC per-run wall-clock timeout (5s–10min) |
+| `TM_PTC_ENGINE` | `auto` | PTC engine: `auto` (worker→inline degrade) / `worker` / `inline` |
+
+---
+
+## ⚡ Batch orchestration (`tm_ptc_run`) — new in v1.5.2
+
+> Shipped in **v1.5.2** (2026-09-10).  Requires `@te-river/opencode-team-mode@1.5.2`
+> or later.
+
+`tm_ptc_run` lets a specialist agent write **one async program** that makes N
+governed `tm_*` calls in a single turn — zero LLM round-trips during the run,
+only an aggregation summary returns to context.  It is designed for batch
+read-only tasks: multi-file reconnaissance, bulk grep + read aggregation,
+cross-referencing search results.
+
+### How it works
+
+The agent writes a program body using `tm.read(args)`, `tm.grep(args)`,
+`tm.bash(args)`, `tm.fetch(args)` — same args as the four governed tools.
+Each call returns `{ok:true, data}` (governed: inline text or an offload
+handle) or `{ok:false, error:{tool,phase,line?,message}}`.  The program
+`return`s a value; it is JSON-serialized into the aggregation summary.
+
+Programs containing `require`, `import`, `process`, `globalThis`, `Deno`,
+`Bun`, `fs`, `net`, or `child_process` are rejected before execution (static
+pre-scan, auxiliary guard).
+
+### Budgets (tighten-only)
+
+The caller may tighten `max_calls`, `max_errors`, and `timeout_ms` — values
+above the `TM_PTC_*` ceilings are clamped down; values below the floor are
+clamped up.  Hitting any budget stops the whole run; produced output is NOT
+lost.
+
+### Engine (`TM_PTC_ENGINE`)
+
+| Mode | Behavior |
+|---|---|
+| `auto` (default) | Tries `worker_threads` first; on failure degrades to `node:vm` with a `degraded-engine` mark in the summary |
+| `worker` | Forces the worker engine (engine-error on failure) |
+| `inline` | Forces the `node:vm` engine (30s compile timeout for sync busy-loops; await-gap residual documented) |
+
+The worker engine runs the program in a dedicated thread with `env:{}`
+(process.env emptied), `resourceLimits`, and hard wall-clock `terminate()`.
+All governance (P2 path scope, P3 allowlist, R6, threshold offload, TTL)
+applies to every bridged call — PTC is not a bypass layer.
+
+### Access
+
+Five specialist agents (`implementer`, `tester`, `architect`, `reviewer`,
+`researcher`) have `tm_ptc_run` in their whitelist.  The `team` lead does
+not — it orchestrates, it does not run batch programs itself.
 
 ---
 
@@ -264,12 +358,13 @@ opencode-team-mode/
 ├── package.json          ← npm package definition
 ├── tsconfig.json         ← TypeScript config
 ├── src/
-│   ├── index.ts          ← Plugin entry (server(): config + R6 tool.execute.before + tool segment)
+│   ├── index.ts          ← Plugin entry (server(): config + R6 tool.execute.before + approval-gate event + tool segment)
 │   ├── agents.ts         ← Agent definitions (prompts, modes, colors)
 │   ├── commands.ts       ← Command definitions (templates, agent bindings)
 │   ├── blackboard.ts     ← Shared blackboard + TTL auto-cleanup sweeper
-│   ├── envprotect.ts     ← R6 env-var read protection (pattern engine + hook)
-│   ├── tm/               ← JIT layer-2 tools (tm_read / tm_grep / tm_bash / tm_fetch)
+│   ├── envprotect.ts     ← R6 env-var read protection + R2 ask-pattern sets (dialog vs hard-block)
+│   ├── approval-gate.ts  ← Unified approval gate: host-dialog timeout auto-reject (never self-allows)
+│   ├── tm/               ← JIT layer-2 tools (tm_read / tm_grep / tm_bash / tm_fetch / tm_ptc_run)
 │   └── types.ts          ← Loader-contract type definitions (1.18.x)
 ├── scripts/
 │   ├── install.sh        ← One-click installer (bash)
@@ -284,7 +379,7 @@ opencode-team-mode/
 
 1. OpenCode Desktop starts and loads `opencode.json(c)`.
 2. It sees `"@te-river/opencode-team-mode@latest"` in the `plugin` array and loads the npm package.
-3. The loader calls the plugin's `server(input, options)`, which registers a `config` hook; the hook injects 6 agents and 6 commands into the merged config. The same call installs the R6 `tool.execute.before` guard and registers the governed `tm_*` tools (see [Context governance](#-context-governance-tm--r6--new-in-v151) below).
+3. The loader calls the plugin's `server(input, options)`, which registers a `config` hook; the hook injects 6 agents and 6 commands into the merged config. The same call installs the R6 `tool.execute.before` guard, arms the unified R6/R2 approval gate (official dialog + `TM_ASK_TIMEOUT_MIN` auto-reject, wired through an `event` hook), and registers the governed `tm_*` tools (see [Context governance](#-context-governance-tm--r6--r2--new-in-v151) below).
 4. The plugin's `id: "team-mode"` is displayed as the plugin name in the Desktop UI.
 5. Agents and commands are immediately available in the Desktop UI — no file copying needed. User-defined agents with the same name always win (the plugin never clobbers them).
 

package/README.zh-CN.md

@@ -213,7 +213,7 @@ team   完成。
 
 ---
 
-## 🧯 上下文治理（tm_* + R6）—— v1.5.1 起提供
+## 🧯 上下文治理（tm_* + R6 + R2）—— v1.5.1 起提供
 
 > ⚠️ 需 `@te-river/opencode-team-mode@1.5.1` 或更新（2026-09-08 发布）。
 > 配置里钉 `@latest` 的用户，下次启动自动升级。
@@ -227,17 +227,47 @@ ERROR×N 统计 / 代码签名清单 / 二进制元信息，硬上限 80 token
 确实需要全文时，用 HMAC 签名、限本 run、带有效期的句柄经 `tm_fetch`
 分段取回。`tm_bash` 仅放行只读命令白名单，失败以结构化错误返回。
 
-**R6 环境变量保护。** TeamMode 激活时，模型读取环境变量的行为在工具层
-被拦截：env 导出命令（`printenv`、`Get-ChildItem env:` 等）、
-`$env:` / `$VAR` / `${VAR}` 展开、环境文件（`.env`、shell rc 文件）。
-模型收到结构化拒绝提示，需要变量值时向人类申请；tm_* 包装工具同样
-过这套检查（不给包装层留后门）。审计日志只记工具名+模式类别——
-绝不记录命令文本、路径、变量名或值。
+**R6 环境变量保护（现已升级为审批门控）。** TeamMode 激活时，模型无法
+静默读取环境变量。env 导出命令（`printenv`、`env`、`Get-ChildItem env:`
+等）与环境文件（`.env`、shell rc 文件）会走 OpenCode **官方确认弹窗**：
+你会在桌面收到一次原生确认，超过 `TM_ASK_TIMEOUT_MIN`（默认 10 分钟）
+无人响应即**自动拒绝**——插件超时只会拒绝，绝不为模型自我放行。通配符
+表达不了的形态（命令里内嵌的 `$VAR` / `${VAR}` / `$env:`、命令替换、
+子 shell/转义写法）以及 `tm_*` 包装通道仍维持**代码级硬拦**（没有弹窗
+可钻）。tm_* 包装工具同样过这套检查（不给包装层留后门）。审计日志只记
+工具名 + 模式类别 + 裁决事件（`ask` / `allowed-once` / `allowed-always` /
+`rejected` / `timeout-rejected` / `degraded`）——绝不记录命令文本、路径、
+变量名或值。
+
+**R2 危险操作（同一个确认弹窗）。** 删除（`rm`/`del`/`Remove-Item`/
+`rmdir`）、git 发布（`git push`/`git commit`）、网络（`curl`/`wget`/
+`Invoke-WebRequest`/`Invoke-RestMethod`）、包安装与发布（`npm install`/
+`npm publish`/`pip install`/`winget`/`choco`）、进程/系统（`taskkill`/
+`Stop-Process`/`kill`/`shutdown`/`format`）、权限（`chmod`/`takeown`/
+`icacls`）——都不再静默放行，而是弹同一个官方确认框，超时未响应即自动
+拒绝。日常验证栈（`npm test`、`tsc`、`git status`/`diff`）**不在**门控
+之列，团队协作照常无打扰运行。
+
+> ⚠️ **批准弹窗时请选 once（仅此一次），不要选 always。** 真实宿主实测：
+> always 记录的泛化规则远比当次命令宽——对 `Get-ChildItem env:PATH` 选
+> always 会记下 `Get-ChildItem *`，此后所有 `Get-ChildItem` 都不再弹窗。
+> 只有 once 能让每次危险操作继续单独过人手。
+
+> 延后是**按会话**生效的：只有运行 TeamMode 注入角色的会话（或已弹过这类
+> 确认框的会话）里的 env 读取才会被放行给弹窗；其他会话（如原生
+> `build`/`plan`）里守护仍然直接硬拦——那里根本没有弹窗兜底。宿主对复合
+> 命令（`a; b`）按段评估、单次弹窗批准整条；任一子段是 env 读取时守护整条
+> 拦截。
+
+> 权限协议已在真实 `opencode serve` 宿主（1.18.29）上经 SSE 事件捕获实测
+> 核验；桌面弹窗的渲染本身仍需在真实 Desktop 会话里目视确认一次。非交互
+> `opencode run` 下，无人应答的 `ask` 会被立即自动拒绝（没有人类可弹）。
 
 | 环境变量 | 默认 | 作用 |
 |---|---|---|
-| `TM_ENV_PROTECT` | `strict` | R6 模式：`strict` / `standard` / `off` |
-| `TM_ENV_PROTECT_EXTRA_DENY` | — | 追加拦截正则（分号分隔） |
+| `TM_ENV_PROTECT` | `strict` | R6 模式：`strict` / `standard` / `off`（off 同时解除审批计时器） |
+| `TM_ASK_TIMEOUT_MIN` | `10` | R6/R2 确认弹窗无人应答后自动拒绝的分钟数；最小 3 分钟（宿主的 `permission.replied` 经事件总线到达插件约延迟 ~120 秒——更小的值会把刚获批的请求误拒） |
+| `TM_ENV_PROTECT_EXTRA_DENY` | — | 追加拦截正则（分号分隔；始终硬拦，不走弹窗） |
 | `TM_OFFLOAD_THRESHOLD` | `2000` | 卸载阈值（token，chars/4 估算） |
 | `TM_PREVIEW_MAX_TOKENS` | `80` | 预览硬上限 |
 | `TM_FETCH_MAX_LINES` | `2000` | tm_fetch 单段上限 |
@@ -245,6 +275,54 @@ ERROR×N 统计 / 代码签名清单 / 二进制元信息，硬上限 80 token
 | `TM_TRAJECTORY_DIR` | `.trajectory/` | 只追加工具调用账本 |
 | `TM_BLACKBOARD_TTL` | `7` | 存储保留天数 |
 | `TM_BASH_READONLY_ALLOWED` | 内置表 | tm_bash 只读白名单 |
+| `TM_PTC_MAX_PROGRAM_CHARS` | `4000` | PTC 程序源码长度上限（字符） |
+| `TM_PTC_MAX_CALLS` | `20` | PTC 单次运行桥接调用数上限（1–200） |
+| `TM_PTC_MAX_ERRORS` | `3` | PTC 单次运行错误数上限（1–50） |
+| `TM_PTC_TIMEOUT_MS` | `60000` | PTC 单次运行墙钟超时（5 秒–10 分钟） |
+| `TM_PTC_ENGINE` | `auto` | PTC 引擎：`auto`（worker→inline 降级）/ `worker` / `inline` |
+
+---
+
+## ⚡ 批量编排（`tm_ptc_run`）—— v1.5.2 起提供
+
+> 已随 **v1.5.2**（2026-09-10）发布。需 `@te-river/opencode-team-mode@1.5.2` 或更新。
+
+`tm_ptc_run` 让专家代理编写**一个异步程序**，在单次回合中执行 N 次受治理的
+`tm_*` 调用——运行期间零 LLM 往返，仅将聚合摘要返回上下文。设计用于批量
+只读任务：多文件侦察、批量 grep + read 聚合、交叉引用搜索结果。
+
+### 工作原理
+
+代理使用 `tm.read(args)`、`tm.grep(args)`、`tm.bash(args)`、`tm.fetch(args)`
+编写程序体——参数与四个受治理工具相同。每次调用返回 `{ok:true, data}`（已受
+治理：内联文本或卸载句柄）或 `{ok:false, error:{tool,phase,line?,message}}`。
+程序 `return` 一个值；它会被 JSON 序列化进聚合摘要。
+
+包含 `require`、`import`、`process`、`globalThis`、`Deno`、`Bun`、`fs`、`net`
+或 `child_process` 的程序会在执行前被拒绝（静态预扫描，辅助防护）。
+
+### 预算（仅收紧）
+
+调用方可收紧 `max_calls`、`max_errors` 和 `timeout_ms`——超过 `TM_PTC_*` 上限
+的值会被钳制到上限；低于下限的值会被钳制到下限。触达任一预算即整体停止运行；
+已产出的输出不会丢失。
+
+### 引擎（`TM_PTC_ENGINE`）
+
+| 模式 | 行为 |
+|---|---|
+| `auto`（默认） | 优先尝试 `worker_threads`；失败时降级为 `node:vm`，摘要标记 `degraded-engine` |
+| `worker` | 强制使用 worker 引擎（失败时返回 engine-error） |
+| `inline` | 强制使用 `node:vm` 引擎（30 秒编译超时斩杀同步忙等；await 间隙残余已记录） |
+
+worker 引擎在专用线程中运行程序，`env:{}` 清空 process.env、`resourceLimits`
+限量、硬墙钟 `terminate()`。所有治理（P2 路径范围、P3 白名单、R6、阈值卸载、
+TTL）对每次桥接调用生效——PTC 不是绕过层。
+
+### 访问权限
+
+五个专家代理（`implementer`、`tester`、`architect`、`reviewer`、`researcher`）
+的白名单中包含 `tm_ptc_run`。`team` lead 不包含——它负责编排，不运行批量程序。
 
 ---
 
@@ -255,12 +333,13 @@ opencode-team-mode/
 ├── package.json          ← npm 包定义
 ├── tsconfig.json         ← TypeScript 配置
 ├── src/
-│   ├── index.ts          ← 插件入口（server()：config + R6 tool.execute.before 钩子 + tool 段）
+│   ├── index.ts          ← 插件入口（server()：config + R6 tool.execute.before + 审批门 event 钩子 + tool 段）
 │   ├── agents.ts         ← Agent 定义（prompts、模式、颜色）
 │   ├── commands.ts       ← 命令定义（模板、Agent 绑定）
 │   ├── blackboard.ts     ← 共享黑板 + TTL 自动清理清扫器
-│   ├── envprotect.ts     ← R6 环境变量读取保护（模式引擎 + 钩子）
-│   ├── tm/               ← JIT 层 2 工具（tm_read / tm_grep / tm_bash / tm_fetch）
+│   ├── envprotect.ts     ← R6 环境变量读取保护 + R2 确认弹窗模式集（弹窗 vs 硬拦）
+│   ├── approval-gate.ts  ← 统一审批门：官方弹窗超时自动拒绝（绝不自我放行）
+│   ├── tm/               ← JIT 层 2 工具（tm_read / tm_grep / tm_bash / tm_fetch / tm_ptc_run）
 │   └── types.ts          ← 加载器契约类型定义（1.18.x）
 ├── scripts/
 │   ├── install.sh        ← 一键安装脚本（bash）
@@ -275,7 +354,7 @@ opencode-team-mode/
 
 1. OpenCode 桌面版启动，加载 `opencode.json(c)`
 2. 检测到 `plugin` 数组中的 `"@te-river/opencode-team-mode@latest"`，加载 npm 包
-3. 加载器调用插件的 `server(input, options)`，注册 `config` hook；hook 向合并后的配置注入 6 个 Agent 和 6 个命令。同一次调用还会安装 R6 的 `tool.execute.before` 防护，并注册受治理的 `tm_*` 工具（见下文“上下文治理”）
+3. 加载器调用插件的 `server(input, options)`，注册 `config` hook；hook 向合并后的配置注入 6 个 Agent 和 6 个命令。同一次调用还会安装 R6 的 `tool.execute.before` 防护、武装 R6/R2 统一审批门（官方确认弹窗 + `TM_ASK_TIMEOUT_MIN` 超时自动拒绝，经 `event` 钩子驱动），并注册受治理的 `tm_*` 工具（见下文“上下文治理”）
 4. 插件的 `id: "team-mode"` 作为插件名显示在桌面版 UI
 5. Agent 和命令立即在桌面版 UI 中可用 —— 无需复制任何文件；同名 Agent 以用户自定义优先（插件绝不覆盖）
 

package/dist/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AA0iB7C,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAO9C,CAAA"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAA;AA4pB9D,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAO9C,CAAA"}

package/dist/agents.js

@@ -23,6 +23,75 @@
  *  - All agents run at temperature 0.2 for format discipline.
  */
 /* ------------------------------------------------------------------ */
+/*  Tool whitelist builder (Phase 2 / T2.1, G2 ruling "方案甲")        */
+/* ------------------------------------------------------------------ */
+/**
+ * Builds the permission block that IS the agent's tool whitelist.
+ *
+ * Verified live (T0.4③): a "deny" permission removes the built-in tool
+ * from the model's tool surface entirely — zero bypass, zero hallucinated
+ * calls.  So a whitelist = deny every excluded built-in + allow the kept
+ * set, exactly the shape the D6 probe validated
+ * (%TEMP%/opencode/tm-probe/workspace/opencode.json).
+ *
+ * G2 rulings baked in:
+ *  - glob/list never enter the whitelist — file enumeration goes through
+ *    tm_bash (ls / dir / Get-ChildItem);
+ *  - webfetch/websearch excluded network-wide (P5 network zero);
+ *  - "tm_*" covers exactly the four governed tools (tm_read / tm_grep /
+ *    tm_bash / tm_fetch); the R6 env-protection hook aliases onto them
+ *    unchanged, so narrowing the surface does not weaken the anti-backdoor
+ *    chain.
+ *
+ * T2.1 review revision (Critical fix): the built-in bash RETURNS for the
+ * execution roles (team / implementer / reviewer / tester).  G2 only ruled
+ * that glob/list enumeration goes through tm_bash — it never ruled away
+ * command execution, and tm_bash is a read-only allowlist that cannot run
+ * npm test / tsc / --help probes.  R6 keeps governing bash's env surface
+ * through the envprotect hook, independently of this matrix.
+ */
+const NEVER_ALLOWED = [
+    "read",
+    "grep",
+    "glob",
+    "list",
+    "apply_patch",
+    "webfetch",
+    "websearch",
+    "todowrite",
+    "lsp",
+    "skill",
+    "question",
+];
+/** Built-ins granted per agent; every one NOT granted is denied. */
+const PER_AGENT_TOOLS = ["edit", "write", "task", "bash"];
+/** The governed tools, named explicitly next to the "tm_*" wildcard
+ *  (belt-and-braces: the explicit allows survive even if a host ever
+ *  stops expanding the wildcard). */
+const TM_TOOLS = ["tm_read", "tm_grep", "tm_bash", "tm_fetch"];
+/** M3: tm_ptc_run — explicit per-agent grant (five specialists = allow,
+ *  team = deny to override the tm_* wildcard).  Design §3: PTC is a
+ *  governed, read-only bridge; the team lead orchestrates, it does not
+ *  run batch programs itself. */
+const PTC_TOOL = "tm_ptc_run";
+const whitelist = (...granted) => {
+    const permission = {};
+    for (const tool of NEVER_ALLOWED)
+        permission[tool] = "deny";
+    for (const tool of PER_AGENT_TOOLS) {
+        permission[tool] = granted.includes(tool) ? "allow" : "deny";
+    }
+    for (const tool of TM_TOOLS)
+        permission[tool] = "allow";
+    permission["tm_*"] = "allow";
+    return permission;
+};
+/** Apply the M3 tm_ptc_run grant to an agent's permission block.  The five
+ *  specialists get `allow`; the team lead gets `deny` (overrides the wildcard). */
+function applyPtcPermission(permission, isTeamLead) {
+    permission[PTC_TOOL] = isTeamLead ? "deny" : "allow";
+}
+/* ------------------------------------------------------------------ */
 /*  Reply contract + hybrid blackboard (appended to every specialist)  */
 /* ------------------------------------------------------------------ */
 const REPLY_CONTRACT = `
@@ -74,8 +143,9 @@ process management every run.
 ## Triage — classify before acting (Step 0, always)
 - Question ≠ work order.  When the user asks, analyzes, or consults
   ("why does X fail?", "how would we do Y?"), ANSWER it — read code if
-  useful, change nothing.  If answering needs external knowledge, dispatch
-  \`researcher\`; don't grind through it yourself.
+  useful, change nothing.  If answering needs a deeper dig through the
+  codebase than your context affords, dispatch \`researcher\`; don't
+  grind through it yourself.
 - Spotted an obvious defect while answering?  Propose the fix and WAIT for
   the go-ahead — never fix-on-the-sly.
 - Explicit action request ("fix X", "add Y", "refactor Z") → route via the
@@ -96,7 +166,7 @@ files — NOT docs, comments, formatting, NOT *.test.* files).
 | Docs / comments / formatting only | implementer (or direct edit, see below) |
 | Product behavior change (bug fix, small feature) | implementer → tester → reviewer |
 | Multi-module / cross-interface feature | architect → implementer → tester → reviewer(s) |
-| Unknown external tech / dependency in play | researcher first, then the fitting row above |
+| Unfamiliar tech / dependency in play | researcher first (local-repo evidence: call sites, installed/vendored packages, shipped docs), then the fitting row above |
 
 - FIXED MINIMUM PIPELINES: the reviewer may be skipped ONLY for
   non-product artifacts, with a one-line reason.  A product change routed
@@ -123,8 +193,9 @@ Count the dispatches your routing row prescribes:
     ONLY when it is genuinely absent.  These docs define the conventions
     the whole team must follow; distill the binding ones for your
     dispatches.  Then read the relevant source yourself; dispatch
-    \`researcher\` ONLY for genuinely unknown external tech.  Done means
-    you can state which files change, in what order, and the risks.
+    \`researcher\` ONLY for genuinely unfamiliar tech — its findings come
+    from the local repo (code, docs, installed packages), never the web.
+    Done means you can state which files change, in what order, and the risks.
   - Plan (≤30 lines): Goal / Root cause or scope (file:line evidence) /
     Change list (file → what) / Pipeline (routing row + agents) /
     Assumptions & risks / Open questions.
@@ -244,8 +315,8 @@ Findings that drive architecture or API usage must be verified before
 adoption:
 - The researcher tags each finding High / Medium / Low confidence.
 - Low/medium-confidence claims that affect the design get a second check
-  (re-ask the researcher for another source, or sanity-check against the
-  actual codebase).
+  (re-ask the researcher for a second local source, or sanity-check against
+  the actual codebase).
 - Never let an unverified claim silently become an implementation
   decision; list remaining assumptions explicitly in the final report.
 
@@ -272,12 +343,10 @@ If a target file does not exist, offer to create it; skip both when the
 user opted out.
 `,
     color: "#E879F9", // purple
-    permission: {
-        edit: "allow",
-        bash: "allow",
-        webfetch: "allow",
-        task: "allow",
-    },
+    // Whitelist (7 tools): tm_* x4 + task dispatch + edit (<=10-line
+    // non-product edits, see "When you may edit directly") + write (board
+    // files) + bash (discovery-gate probes: --help, installed versions).
+    permission: whitelist("task", "edit", "write", "bash"),
     temperature: 0.2,
 };
 /* ------------------------------------------------------------------ */
@@ -320,9 +389,12 @@ When the team lead sends back a design flaw found in review or testing:
   of guessing about the codebase.
 `,
     color: "#38BDF8", // sky blue
-    // Read-only on PROJECT sources; a dispatched board artifact is explicitly
-    // writable (see Blackboard rules).
-    permission: { edit: "allow", bash: "deny", webfetch: "allow" },
+    // Whitelist (5 tools): tm_* x4 + task dispatch.  Fully read-only by
+    // design (T2.1): output lives in the reply; if a board artifact is ever
+    // dispatched, the BLACKBOARD WRITE FAILED fallback hands the content to
+    // the lead inline (see Blackboard rules).  No bash — unchanged from the
+    // pre-T2.1 architect bash:deny posture.
+    permission: whitelist("task"),
     temperature: 0.2,
 };
 /* ------------------------------------------------------------------ */
@@ -359,7 +431,9 @@ to you by the team lead.
   check, the previously failing test).
 `,
     color: "#4ADE80", // green
-    permission: { edit: "allow", bash: "allow", webfetch: "allow" },
+    // Whitelist (7 tools): tm_* x4 + edit/write (code implementation) + bash
+    // (narrowest verification for the fix: build / typecheck / failing test).
+    permission: whitelist("edit", "write", "bash"),
     temperature: 0.2,
 };
 /* ------------------------------------------------------------------ */
@@ -417,9 +491,12 @@ the previously flagged scope plus regressions introduced by the fixes;
 confirm each prior finding item by item (fixed / not fixed / partial).
 `,
     color: "#FB923C", // orange
-    // May edit ONLY a dispatched board artifact; never the reviewed code
-    // (see Blackboard rules + role rules).
-    permission: { edit: "allow", bash: "allow", webfetch: "allow" },
+    // Whitelist (6 tools): tm_* x4 + task dispatch + bash.  No edit/write
+    // (T2.1): findings travel in the reply skeleton; a dispatched board
+    // artifact rides the BLACKBOARD WRITE FAILED inline fallback (see
+    // Blackboard rules).  bash backs the evidence standard — the reviewer
+    // must be able to run npm test / tsc itself.
+    permission: whitelist("task", "bash"),
     temperature: 0.2,
 };
 /* ------------------------------------------------------------------ */
@@ -483,7 +560,9 @@ worse than admitting the gap.
   refactor instead of contorting the test.
 `,
     color: "#F472B6", // pink
-    permission: { edit: "allow", bash: "allow", webfetch: "allow" },
+    // Whitelist (7 tools): tm_* x4 + edit/write (test files) + bash (the
+    // whole verification stack: build / typecheck / lint / test runs).
+    permission: whitelist("edit", "write", "bash"),
     temperature: 0.2,
 };
 /* ------------------------------------------------------------------ */
@@ -491,10 +570,11 @@ worse than admitting the gap.
 /* ------------------------------------------------------------------ */
 const researcher = {
     mode: "subagent",
-    description: "Researcher — investigates libraries, APIs, best practices, and " +
-        "documentation; every finding carries a source and confidence tag so " +
-        "the team can decide what needs verification.  Use for information that " +
-        "must inform a technical decision.",
+    description: "Researcher — investigates the local repository: code, configs, " +
+        "installed/vendored packages, and shipped documentation; every finding " +
+        "carries a source (file:line) and confidence tag so the team can decide " +
+        "what needs verification.  Use for information that must inform a " +
+        "technical decision.  Web research is out of scope (no network tools).",
     prompt: `You are the **Researcher** on a multi-agent coding team.
 
 ## Role
@@ -534,7 +614,13 @@ by the team — flag prominently if that is the case.
   of re-deriving.
 `,
     color: "#A78BFA", // violet
-    permission: { edit: "allow", bash: "allow", webfetch: "allow", websearch: "allow" },
+    // Whitelist (4 tools): tm_* x4 ONLY — intentionally below the 5-7 band
+    // (T2.1): pure local research.  webfetch/websearch are excluded
+    // network-wide (P5), which also removes the dangling websearch:allow
+    // found in T0.3; file enumeration goes through tm_bash (G2 方案甲).
+    // No bash / no execution rights is intentional trimming — local
+    // research reads, it does not run.
+    permission: whitelist(),
     temperature: 0.2,
 };
 /* Shared rules appended to every specialist prompt (after the contract). */
@@ -545,6 +631,21 @@ Every "done / fixed / passed" claim in your reply must carry its
 evidence: command output, log lines, or a diff.  No narrative-only
 completions.
 
+## Tool surface (do not retry removed tools)
+All file reads / searches / enumeration go through tm_read / tm_grep / tm_bash.
+The built-in read/grep/glob/list tools are removed from the tool surface —
+retrying them only wastes a turn.  Built-in bash exists only where granted
+(team / implementer / reviewer / tester run commands: build / test / git);
+architect and researcher have no bash at all — one-off read-only commands
+go through tm_bash or are reported as a gap.
+
+## R6 protected reads
+When you need to read protected data (system variables the R6 guard blocks),
+use the **built-in bash** tool — not tm_bash.  tm_bash hard-blocks them with
+no dialog; built-in bash triggers the official confirmation dialog (once /
+always / reject).  Dangerous commands (rm / git push / npm publish / etc.)
+always trigger the dialog regardless of tool.
+
 ## Project conventions
 If the project README (or AGENTS.md) is quoted in your dispatch, treat
 its conventions as binding — they outrank your defaults.  Do not re-open
@@ -555,6 +656,14 @@ belongs to the work.`;
 for (const a of [architect, implementer, reviewer, tester, researcher]) {
     a.prompt = (a.prompt ?? "") + REPLY_CONTRACT + SHARED_RULES;
 }
+/* M3: tm_ptc_run permission — five specialists get allow, team gets deny
+ * (overrides the tm_* wildcard).  Applied once at module init. */
+if (teamLead.permission)
+    applyPtcPermission(teamLead.permission, true);
+for (const a of [architect, implementer, reviewer, tester, researcher]) {
+    if (a.permission)
+        applyPtcPermission(a.permission, false);
+}
 /* ------------------------------------------------------------------ */
 /*  Export all agents keyed by name                                   */
 /* ------------------------------------------------------------------ */

package/dist/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;+DA0BwC,CAAA;AAE/D,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,QAAQ,GAAgB;IAC5B,IAAI,EAAE,SAAS;IACf,WAAW,EACT,4DAA4D;QAC5D,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,6DAA6D;QAC7D,4BAA4B;IAC9B,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+MT;IACC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,UAAU,EAAE;QACV,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,OAAO;KACd;IACD,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,SAAS,GAAgB;IAC7B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,yCAAyC;IAC3C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BT;IACC,KAAK,EAAE,SAAS,EAAE,WAAW;IAC7B,0EAA0E;IAC1E,mCAAmC;IACnC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC9D,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,WAAW,GAAgB;IAC/B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,uEAAuE;QACvE,0EAA0E;QAC1E,gEAAgE;IAClE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;CAwBT;IACC,KAAK,EAAE,SAAS,EAAE,QAAQ;IAC1B,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC/D,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,QAAQ,GAAgB;IAC5B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,sEAAsE;QACtE,yBAAyB;IAC3B,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CT;IACC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,qEAAqE;IACrE,uCAAuC;IACvC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC/D,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,MAAM,GAAgB;IAC1B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,0DAA0D;IAC5D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDT;IACC,KAAK,EAAE,SAAS,EAAE,OAAO;IACzB,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC/D,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,UAAU,GAAgB;IAC9B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,iEAAiE;QACjE,sEAAsE;QACtE,yEAAyE;QACzE,mCAAmC;IACrC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCT;IACC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;IACnF,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,4EAA4E;AAC5E,MAAM,YAAY,GAAG;;;;;;;;;;;;qBAYA,CAAA;AAErB,4EAA4E;AAC5E,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;IACvE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,cAAc,GAAG,YAAY,CAAA;AAC7D,CAAC;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AAExE,MAAM,CAAC,MAAM,MAAM,GAAgC;IACjD,MAAM,EAAE,QAAQ;IAChB,SAAS;IACT,WAAW;IACX,QAAQ;IACR,MAAM;IACN,UAAU;CACX,CAAA"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,aAAa,GAAG;IACpB,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,aAAa;IACb,UAAU;IACV,WAAW;IACX,WAAW;IACX,KAAK;IACL,OAAO;IACP,UAAU;CACF,CAAA;AAEV,oEAAoE;AACpE,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAU,CAAA;AAElE;;qCAEqC;AACrC,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAU,CAAA;AAEvE;;;iCAGiC;AACjC,MAAM,QAAQ,GAAG,YAAqB,CAAA;AAEtC,MAAM,SAAS,GAAG,CAChB,GAAG,OAAgD,EAClC,EAAE;IACnB,MAAM,UAAU,GAAoB,EAAE,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,aAAa;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAA;IAC3D,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;IAC9D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAA;IACvD,UAAU,CAAC,MAAM,CAAC,GAAG,OAAO,CAAA;IAC5B,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED;mFACmF;AACnF,SAAS,kBAAkB,CAAC,UAA2B,EAAE,UAAmB;IAC1E,UAAU,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;AACtD,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;+DA0BwC,CAAA;AAE/D,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,QAAQ,GAAgB;IAC5B,IAAI,EAAE,SAAS;IACf,WAAW,EACT,4DAA4D;QAC5D,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,6DAA6D;QAC7D,4BAA4B;IAC9B,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiNT;IACC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,iEAAiE;IACjE,sEAAsE;IACtE,qEAAqE;IACrE,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;IACtD,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,SAAS,GAAgB;IAC7B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,yCAAyC;IAC3C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BT;IACC,KAAK,EAAE,SAAS,EAAE,WAAW;IAC7B,oEAAoE;IACpE,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,wCAAwC;IACxC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC;IAC7B,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,WAAW,GAAgB;IAC/B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,uEAAuE;QACvE,0EAA0E;QAC1E,gEAAgE;IAClE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;CAwBT;IACC,KAAK,EAAE,SAAS,EAAE,QAAQ;IAC1B,yEAAyE;IACzE,0EAA0E;IAC1E,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;IAC9C,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,QAAQ,GAAgB;IAC5B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,sEAAsE;QACtE,yBAAyB;IAC3B,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CT;IACC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,sEAAsE;IACtE,oEAAoE;IACpE,kEAAkE;IAClE,sEAAsE;IACtE,6CAA6C;IAC7C,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IACrC,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,MAAM,GAAgB;IAC1B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,0DAA0D;IAC5D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDT;IACC,KAAK,EAAE,SAAS,EAAE,OAAO;IACzB,qEAAqE;IACrE,mEAAmE;IACnE,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;IAC9C,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,UAAU,GAAgB;IAC9B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,iEAAiE;QACjE,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,uEAAuE;IACzE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCT;IACC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,uEAAuE;IACvE,gEAAgE;IAChE,qEAAqE;IACrE,iEAAiE;IACjE,gEAAgE;IAChE,mCAAmC;IACnC,UAAU,EAAE,SAAS,EAAE;IACvB,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,4EAA4E;AAC5E,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA2BA,CAAA;AAErB,4EAA4E;AAC5E,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;IACvE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,cAAc,GAAG,YAAY,CAAA;AAC7D,CAAC;AAED;kEACkE;AAClE,IAAI,QAAQ,CAAC,UAAU;IAAE,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;AACtE,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;IACvE,IAAI,CAAC,CAAC,UAAU;QAAE,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;AAC3D,CAAC;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AAExE,MAAM,CAAC,MAAM,MAAM,GAAgC;IACjD,MAAM,EAAE,QAAQ;IAChB,SAAS;IACT,WAAW;IACX,QAAQ;IACR,MAAM;IACN,UAAU;CACX,CAAA"}