@usine/executor 0.2.1 → 0.4.0

package/dist/ssh/gateway/admin.js

@@ -0,0 +1,129 @@
+import { WorkerName } from "@usine/core/worker";
+import { GatewayAdminApi, } from "@usine/gateway/admin";
+import { Data, DateTime, Effect, Option, Result, Schema } from "effect";
+import { HttpClient, HttpClientError, HttpClientRequest } from "effect/http";
+import { HttpApiClient } from "effect/http-api";
+import { GatewayForwardClosed } from "./forward.js";
+const GatewayAdminOperation = Schema.Literals(["attach", "renew", "detach", "list", "providers"]);
+const ACTIONS = {
+    attach: "attach a token",
+    renew: "renew an attachment",
+    detach: "detach an attachment",
+    list: "list the attachments",
+    providers: "list the LLM providers",
+};
+/**
+ * The error for a failed Gateway admin API request. `message` contains no token; the request
+ * and raw failure are discarded because an attach request contains the installation token.
+ */
+export class GatewayAdminError extends Schema.TaggedError("@usine/executor/GatewayAdminError")("GatewayAdminError", {
+    worker: WorkerName,
+    operation: GatewayAdminOperation,
+    message: Schema.NonEmptyString,
+}) {
+}
+/** The timeout for one admin request. A publish keeps the Attempt's scope open while it runs. */
+const ADMIN_REQUEST_TIMEOUT = "30 seconds";
+/**
+ * The error when an admin request through the open forward gets no response. `since` is when
+ * the first unanswered request after the last response was sent.
+ */
+class GatewayAdminUnanswered extends Data.TaggedError("GatewayAdminUnanswered") {
+}
+/** Returns the failure reason, built only from the forward's state or the failure's tag and status. */
+const reason = (failure) => {
+    if (failure instanceof GatewayForwardClosed)
+        return `the forward through ${failure.gateway} has been closed since ${DateTime.formatIso(failure.since)}: ${failure.reason}`;
+    if (failure instanceof GatewayAdminUnanswered)
+        return `the admin API through ${failure.gateway} hasn't responded since ${DateTime.formatIso(failure.since)}: ${failure.detail}`;
+    if (HttpClientError.isHttpClientError(failure))
+        return failure.response === undefined
+            ? `no response (${failure.reason._tag})`
+            : `the admin API returned status ${String(failure.response.status)}`;
+    switch (failure._tag) {
+        case "TimeoutError":
+            return `no response within ${ADMIN_REQUEST_TIMEOUT}`;
+        case "Unauthorized":
+            return "the gateway rejected the admin token";
+        case "AttachmentAlreadyExpired":
+            return "the token had already expired";
+        case "AttachmentConflict":
+            return "the attachment ID belongs to another worker or repository";
+        case "SchemaError":
+            return "the admin API response doesn't match its schema";
+        default:
+            return `the request failed with ${failure._tag}`;
+    }
+};
+/** Returns whether the admin API returned 404 because the Gateway predates the endpoint. */
+const unknownRoute = (failure) => HttpClientError.isHttpClientError(failure) && failure.response?.status === 404;
+/** Returns whether the request got no response, possibly because the forward's SSH connection died unnoticed. */
+const unanswered = (failure) => failure._tag === "TimeoutError" ||
+    (HttpClientError.isHttpClientError(failure) && failure.response === undefined);
+/** Returns the log field with the time the admin API became unreachable, if the failure has it. */
+const sinceFields = (failure) => {
+    if (failure instanceof GatewayForwardClosed)
+        return { closedSince: DateTime.formatIso(failure.since) };
+    if (failure instanceof GatewayAdminUnanswered)
+        return { unansweredSince: DateTime.formatIso(failure.since) };
+    return {};
+};
+const adminClientAt = (url, adminToken) => HttpApiClient.make(GatewayAdminApi, {
+    baseUrl: url,
+    transformClient: HttpClient.mapRequest(HttpClientRequest.bearerToken(adminToken)),
+});
+/**
+ * Returns the admin API client for the Gateway in front of `worker`, connected through
+ * `forward` with the admin token as a bearer token. If the forward is closed or a request gets
+ * no response, reopens the forward and retries once.
+ */
+export const gatewayAdminFor = Effect.fn("SshExecutor.gatewayAdminFor")(function* (worker, gateway, forward) {
+    const http = yield* HttpClient.HttpClient;
+    const exchange = Effect.fn("SshExecutor.gatewayAdminRequest")(function* (operation, call) {
+        yield* Effect.annotateCurrentSpan({ worker, operation, gateway: forward.gateway });
+        const through = Effect.fnUntraced(function* (open) {
+            const sentAt = yield* DateTime.now;
+            const sent = yield* Effect.result(adminClientAt(open.url, gateway.adminToken).pipe(Effect.provideService(HttpClient.HttpClient, http), Effect.flatMap(call), Effect.timeout(ADMIN_REQUEST_TIMEOUT)));
+            if (Result.isFailure(sent) && unanswered(sent.failure))
+                return yield* new GatewayAdminUnanswered({
+                    gateway: forward.gateway,
+                    since: yield* forward.unanswered(sentAt),
+                    detail: reason(sent.failure),
+                });
+            yield* forward.answered;
+            if (Result.isFailure(sent))
+                return yield* Effect.fail(sent.failure);
+            return sent.success;
+        });
+        const retried = (generation, failure) => Effect.logWarning("A Gateway admin request did not get through; reopening the forward and sending it once more", {
+            worker,
+            operation,
+            gateway: forward.gateway,
+            generation,
+            reason: reason(failure),
+            ...sinceFields(failure),
+        }).pipe(Effect.andThen(forward.reopen(generation)), Effect.flatMap(through));
+        const opened = yield* Effect.result(forward.current);
+        if (Result.isFailure(opened))
+            return yield* retried(opened.failure.generation, opened.failure);
+        const answered = yield* Effect.result(through(opened.success));
+        if (Result.isSuccess(answered))
+            return answered.success;
+        if (!(answered.failure instanceof GatewayAdminUnanswered))
+            return yield* Effect.fail(answered.failure);
+        return yield* retried(opened.success.generation, answered.failure);
+    });
+    const bounded = (operation) => (call) => exchange(operation, call).pipe(Effect.mapError((failure) => new GatewayAdminError({
+        worker,
+        operation,
+        message: `Can't ${ACTIONS[operation]} on the admin API of gateway ${forward.gateway} for worker "${worker}": ${reason(failure)}`,
+    })));
+    return {
+        attach: (request) => bounded("attach")((client) => client.attachments.attach({ payload: request })),
+        renew: (id, request) => bounded("renew")((client) => client.attachments.renew({ params: { id }, payload: request })),
+        detach: (id) => bounded("detach")((client) => client.attachments.detach({ params: { id } })),
+        list: bounded("list")((client) => client.attachments.list()),
+        providers: bounded("providers")((client) => client.llm.providers().pipe(Effect.map(Option.some), Effect.catchIf(unknownRoute, () => Effect.succeedNone))),
+    };
+});
+//# sourceMappingURL=admin.js.map

package/dist/ssh/gateway/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../src/ssh/gateway/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAML,eAAe,GAEhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAiB,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAuB,oBAAoB,EAAoB,MAAM,cAAc,CAAC;AAE3F,MAAM,qBAAqB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAGlG,MAAM,OAAO,GAAG;IACd,MAAM,EAAE,gBAAgB;IACxB,KAAK,EAAE,qBAAqB;IAC5B,MAAM,EAAE,sBAAsB;IAC9B,IAAI,EAAE,sBAAsB;IAC5B,SAAS,EAAE,wBAAwB;CACqB,CAAC;AAE3D;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,CACvD,mCAAmC,CACpC,CAAC,mBAAmB,EAAE;IACrB,MAAM,EAAE,UAAU;IAClB,SAAS,EAAE,qBAAqB;IAChC,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAqBL,iGAAiG;AACjG,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAE3C;;;GAGG;AACH,MAAM,sBAAuB,SAAQ,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAI5E;CAAG;AAEL,uGAAuG;AACvG,MAAM,MAAM,GAAG,CAAC,OAAkC,EAAU,EAAE;IAC5D,IAAI,OAAO,YAAY,oBAAoB;QACzC,OAAO,uBAAuB,OAAO,CAAC,OAAO,0BAA0B,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;IAChI,IAAI,OAAO,YAAY,sBAAsB;QAC3C,OAAO,yBAAyB,OAAO,CAAC,OAAO,2BAA2B,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;IACnI,IAAI,eAAe,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAC5C,OAAO,OAAO,CAAC,QAAQ,KAAK,SAAS;YACnC,CAAC,CAAC,gBAAgB,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG;YACxC,CAAC,CAAC,iCAAiC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACzE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,cAAc;YACjB,OAAO,sBAAsB,qBAAqB,EAAE,CAAC;QACvD,KAAK,cAAc;YACjB,OAAO,sCAAsC,CAAC;QAChD,KAAK,0BAA0B;YAC7B,OAAO,+BAA+B,CAAC;QACzC,KAAK,oBAAoB;YACvB,OAAO,2DAA2D,CAAC;QACrE,KAAK,aAAa;YAChB,OAAO,iDAAiD,CAAC;QAC3D;YACE,OAAO,2BAA2B,OAAO,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;AACH,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,YAAY,GAAG,CAAC,OAAkC,EAAW,EAAE,CACnE,eAAe,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAC;AAEjF,iHAAiH;AACjH,MAAM,UAAU,GAAG,CAAC,OAAkC,EAAW,EAAE,CACjE,OAAO,CAAC,IAAI,KAAK,cAAc;IAC/B,CAAC,eAAe,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;AAEjF,mGAAmG;AACnG,MAAM,WAAW,GAAG,CAAC,OAAkC,EAAE,EAAE;IACzD,IAAI,OAAO,YAAY,oBAAoB;QACzC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,IAAI,OAAO,YAAY,sBAAsB;QAC3C,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAChE,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,GAAQ,EAAE,UAAqC,EAAE,EAAE,CACxE,aAAa,CAAC,IAAI,CAAC,eAAe,EAAE;IAClC,OAAO,EAAE,GAAG;IACZ,eAAe,EAAE,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;CAClF,CAAC,CAAC;AAIL;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAC/E,MAAkB,EAClB,OAAyB,EACzB,OAAuB;IAEvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EAGrE,SAAgC,EAAE,IAAkD;QACpF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAiB;YAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAC/B,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,EAClD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EACpB,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CACtC,CACF,CAAC;YACF,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;gBACpD,OAAO,KAAK,CAAC,CAAC,IAAI,sBAAsB,CAAC;oBACvC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;oBACxC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;iBAC7B,CAAC,CAAC;YACL,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxB,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,UAAkB,EAAE,OAAkC,EAAE,EAAE,CACzE,MAAM,CAAC,UAAU,CACf,6FAA6F,EAC7F;YACE,MAAM;YACN,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU;YACV,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;YACvB,GAAG,WAAW,CAAC,OAAO,CAAC;SACxB,CACF,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAE9E,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QACxD,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,YAAY,sBAAsB,CAAC;YACvD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GACX,CAAC,SAAgC,EAAE,EAAE,CACrC,CACE,IAAkD,EACb,EAAE,CACvC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAC5B,MAAM,CAAC,QAAQ,CACb,CAAC,OAAO,EAAE,EAAE,CACV,IAAI,iBAAiB,CAAC;QACpB,MAAM;QACN,SAAS;QACT,OAAO,EAAE,SAAS,OAAO,CAAC,SAAS,CAAC,gCAAgC,OAAO,CAAC,OAAO,gBAAgB,MAAM,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE;KACjI,CAAC,CACL,CACF,CAAC;IACN,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,KAAK,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5F,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC5D,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CACzB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EACvB,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CACvD,CACF;KACqB,CAAC;AAC3B,CAAC,CAAC,CAAC"}

package/dist/ssh/gateway/attachments.d.ts

@@ -0,0 +1,31 @@
+import type { RemoteShell } from "@usine/agents/child-host";
+import type { WorkerName } from "@usine/core/worker";
+import { Effect, Option, Redacted } from "effect";
+import { CredentialProvider, CredentialUnavailableError, type ExecutorError, type ExecutorOperation } from "../../executor.ts";
+import { type RemoteCommands } from "../../remote/commands.ts";
+import type { MachineGateway, SshMachine } from "../model.ts";
+/** Writes each file of `files` on the machine through `shell`, creating its directory. */
+export declare const writeMachineFiles: (commands: RemoteCommands, operation: ExecutorOperation, shell: RemoteShell, files: ReadonlyArray<readonly [path: string, contents: string]>) => Effect.Effect<string, import("../../executor.ts").ExecutorOperationError, never>;
+/**
+ * Grants each Attempt repository access through the Gateway without a token on the machine
+ * (ADR 0027). Attaches the token, renews it before expiry, re-stores it every two minutes, and
+ * detaches it when the scope closes. If the Gateway holds the OpenAI credential, gives the
+ * Attempt its Codex home through `holdCodexHome`. On first use of a Worker, detaches attachments
+ * left by an earlier process.
+ */
+export declare const gatewayAttachmentsFor: (commands: RemoteCommands, workerFor: (worker: WorkerName) => Effect.Effect<{
+    readonly gateway: Option.Option<MachineGateway>;
+}, ExecutorError>, holdCodexHome: (machine: SshMachine, attemptId: string & import("effect/Brand").Brand<"AttemptId">) => Effect.Effect<string, never, import("effect/Scope").Scope>) => Effect.Effect<{
+    acquire: (attemptId: string & import("effect/Brand").Brand<"AttemptId">, worker: string & import("effect/Brand").Brand<"WorkerName">, repository: string & import("effect/Brand").Brand<"RepositoryName">, permissions: "read" | "write", machine: SshMachine, gateway: MachineGateway, operation: "cancel" | "cleanup" | "launch" | "preflight" | "prepare") => Effect.Effect<{
+        shell: RemoteShell;
+        secrets: Readonly<Record<string, Redacted.Redacted<string>>>;
+        readOnlyPaths: string[];
+        writablePaths: string[];
+        environment: Readonly<Record<string, string>>;
+        gitEnvironment: Readonly<Record<string, string>>;
+        refresh: Effect.Effect<void, CredentialUnavailableError, never>;
+        scrub: (text: string) => string;
+    }, CredentialUnavailableError | import("../../executor.ts").ExecutorOperationError, import("effect/Scope").Scope>;
+    reclaim: (worker: WorkerName) => Effect.Effect<void, never, never>;
+}, never, CredentialProvider>;
+//# sourceMappingURL=attachments.d.ts.map

package/dist/ssh/gateway/attachments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../../../src/ssh/gateway/attachments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAI5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAmB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAkB,MAAM,QAAQ,CAAC;AACnF,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAEvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,0BAA0B,CAAC;AAI7E,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA6B9D,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,aAClB,cAAc,aACb,iBAAiB,SACrB,WAAW,SACX,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,qFAC2B,CAAC;AAW7F;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,iDAGtB,UAAU,KACf,MAAM,CAAC,MAAM,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;CAAE,EAAE,aAAa,CAAC;;;;;;;;;;;sBA6D7D,UAAU;6BAsKnC,CAAC"}

package/dist/ssh/gateway/attachments.js

@@ -0,0 +1,168 @@
+import { AttachRequest, InstallationCredential } from "@usine/gateway/admin";
+import { Cache, DateTime, Effect, Option, Redacted, Ref, Semaphore } from "effect";
+import { CredentialProvider, CredentialUnavailableError, } from "../../executor.js";
+import { sendingShell } from "../../remote/commands.js";
+import { renewableCredential } from "../../renewable-credential.js";
+import { attemptCodexHome } from "../codex-homes.js";
+import { GH_GATEWAY_SOCKET_DIRECTORY, gatewayConfigFiles, gatewayEnvironment, } from "./environment.js";
+/**
+ * A script that takes path and contents pairs and writes each file, creating its directory.
+ * Each file is written to a temporary name and renamed.
+ */
+const WRITE_FILES_SCRIPT = String.raw `
+set -e
+while [ "$#" -gt 1 ]; do
+  mkdir -p "$(dirname "$1")"
+  printf '%s' "$2" > "$1.$$"
+  mv "$1.$$" "$1"
+  shift 2
+done
+`.trim();
+/** The interval for re-storing a live Attempt's attachment, which bounds the outage after a Gateway restart. */
+const RESTORE_INTERVAL = "2 minutes";
+/** Writes each file of `files` on the machine through `shell`, creating its directory. */
+export const writeMachineFiles = (commands, operation, shell, files) => commands.run(operation, shell, "sh", ["-c", WRITE_FILES_SCRIPT, "sh", ...files.flat()]);
+/**
+ * Returns the directory of gh's configuration on a Worker behind a Gateway, and the Attempt's
+ * Codex home. Neither contains a token.
+ */
+const configDirectories = (machine, attemptId) => ({
+    ghConfigDirectory: `${machine.workerDirectory}/gh`,
+    codexHome: attemptCodexHome(machine, attemptId),
+});
+/**
+ * Grants each Attempt repository access through the Gateway without a token on the machine
+ * (ADR 0027). Attaches the token, renews it before expiry, re-stores it every two minutes, and
+ * detaches it when the scope closes. If the Gateway holds the OpenAI credential, gives the
+ * Attempt its Codex home through `holdCodexHome`. On first use of a Worker, detaches attachments
+ * left by an earlier process.
+ */
+export const gatewayAttachmentsFor = Effect.fn("SshExecutor.gatewayAttachmentsFor")(function* (commands, workerFor, holdCodexHome) {
+    const provider = yield* CredentialProvider;
+    const detachLeftovers = Effect.fn("SshExecutor.detachLeftoverAttachments")(function* (worker) {
+        const machine = yield* workerFor(worker);
+        yield* Effect.annotateCurrentSpan({ worker });
+        if (Option.isNone(machine.gateway))
+            return yield* Effect.logDebug("The Worker has no Gateway to detach leftovers from", {
+                worker,
+            });
+        const { admin, settings } = machine.gateway.value;
+        yield* Effect.annotateCurrentSpan({ domain: settings.domain });
+        const { attachments } = yield* admin.list;
+        const leftovers = attachments.filter((attachment) => attachment.worker === worker);
+        if (leftovers.length === 0)
+            return yield* Effect.logDebug("No earlier process left a Gateway attachment for the Worker", {
+                worker,
+                domain: settings.domain,
+            });
+        // Detaches each leftover separately so one failure doesn't stop the others.
+        yield* Effect.forEach(leftovers, ({ id, repository }) => admin.detach(id).pipe(Effect.tap(({ detached }) => Effect.logInfo("Detached a Gateway attachment an earlier process left", {
+            worker,
+            repository,
+            attachment: id,
+            detached,
+        })), Effect.tapError((error) => Effect.logWarning("Could not detach a Gateway attachment an earlier process left; it expires with its token", { worker, repository, attachment: id, message: error.message })), Effect.ignore), { discard: true });
+    });
+    // Caches a failed listing; the leftover attachments expire with their tokens within an hour.
+    const reclaimed = yield* Cache.make({
+        capacity: Number.POSITIVE_INFINITY,
+        lookup: (worker) => detachLeftovers(worker).pipe(Effect.tapError((error) => Effect.logWarning("Could not list the Gateway attachments an earlier process left; they expire with their tokens", { worker, message: error.message })), Effect.ignore),
+    });
+    const reclaim = (worker) => Cache.get(reclaimed, worker);
+    const acquire = Effect.fn("SshExecutor.attachToGateway")(function* (attemptId, worker, repository, permissions, machine, gateway, operation) {
+        const { admin, settings } = gateway;
+        const fields = { attemptId, worker, repository, permissions, domain: settings.domain };
+        yield* Effect.annotateCurrentSpan(fields);
+        const directories = configDirectories(machine, attemptId);
+        const codex = settings.llmProviders.includes("openai");
+        if (codex)
+            yield* holdCodexHome(machine, attemptId);
+        yield* writeMachineFiles(commands, operation, machine.shell, gatewayConfigFiles({
+            domain: settings.domain,
+            llmProviders: settings.llmProviders,
+            ...directories,
+        }));
+        const attached = yield* Ref.make(Option.none());
+        // Serializes publish and restore so the Gateway never gets an older token.
+        const turn = yield* Semaphore.make(1);
+        yield* Effect.addFinalizer(() => Ref.get(attached).pipe(Effect.flatMap(Option.match({
+            onNone: () => Effect.logDebug("The Attempt has no Gateway attachment to detach", fields),
+            onSome: ({ id }) => admin.detach(id).pipe(Effect.tap(({ detached }) => Effect.logInfo("Detached the Attempt's token from the Gateway", {
+                ...fields,
+                attachment: id,
+                detached,
+            })), Effect.tapError((error) => Effect.logWarning("Could not detach the Attempt's token from the Gateway; the attachment expires with the token", { ...fields, attachment: id, message: error.message })), Effect.ignore),
+        }))));
+        const requestFor = (credential) => new AttachRequest({
+            worker,
+            repository,
+            credential: new InstallationCredential({ token: credential.value }),
+            expiresAt: credential.expiresAt,
+        });
+        const publish = Effect.fn("SshExecutor.publishAttachment")(function* (credential) {
+            yield* Effect.annotateCurrentSpan(fields);
+            const current = yield* Ref.get(attached);
+            const answer = yield* Option.match(current, {
+                onNone: () => admin.attach(requestFor(credential)),
+                onSome: ({ id }) => admin.renew(id, requestFor(credential)),
+            }).pipe(Effect.mapError((cause) => new CredentialUnavailableError({
+                repository,
+                reason: "unreachable",
+                message: cause.message,
+                cause,
+            })));
+            yield* Ref.set(attached, Option.some({ id: answer.attachment.id, credential }));
+            yield* Effect.annotateCurrentSpan({ attachment: answer.attachment.id });
+            yield* Effect.logInfo(Option.isNone(current)
+                ? "Attached the Attempt's token to the Gateway"
+                : "Renewed the Attempt's attachment on the Gateway", {
+                ...fields,
+                attachment: answer.attachment.id,
+                expiresAt: DateTime.formatIso(answer.attachment.expiresAt),
+            });
+            return answer.callerToken;
+        }, 
+        // Scope closure waits for an in-flight attach, so the detach has the attachment ID.
+        turn.withPermits(1), Effect.uninterruptible);
+        // The Gateway stores attachments in memory. After a restart, re-creates the attachment with
+        // the same ID and the current token.
+        const restore = Effect.fn("SshExecutor.restoreAttachment")(function* () {
+            yield* Effect.annotateCurrentSpan(fields);
+            const current = yield* Ref.get(attached);
+            if (Option.isNone(current))
+                return;
+            const { id, credential } = current.value;
+            yield* Effect.annotateCurrentSpan({ attachment: id });
+            yield* admin.renew(id, requestFor(credential));
+            yield* Effect.logDebug("Confirmed the Attempt's attachment on the Gateway", {
+                ...fields,
+                attachment: id,
+            });
+        }, turn.withPermits(1), Effect.uninterruptible);
+        const credential = yield* renewableCredential(provider.issue, repository, attemptId, permissions, publish);
+        const callerToken = credential.published;
+        // Forked after renewal so scope closure stops it before the token is wiped and detached.
+        yield* Effect.forever(Effect.sleep(RESTORE_INTERVAL).pipe(Effect.andThen(restore()), Effect.tapError((error) => Effect.logWarning("Could not confirm the Attempt's attachment on the Gateway; will retry", {
+            ...fields,
+            message: error.message,
+        })), Effect.ignore)).pipe(Effect.forkScoped);
+        const { exported, sent } = gatewayEnvironment({
+            domain: settings.domain,
+            llmProviders: settings.llmProviders,
+            ...directories,
+            callerToken,
+        });
+        return {
+            shell: sendingShell(machine.shell, sent),
+            secrets: sent,
+            readOnlyPaths: [directories.ghConfigDirectory, GH_GATEWAY_SOCKET_DIRECTORY],
+            writablePaths: codex ? [directories.codexHome] : [],
+            environment: exported,
+            gitEnvironment: exported,
+            refresh: credential.refresh(),
+            scrub: (text) => credential.scrub(text).replaceAll(Redacted.value(callerToken), "[REDACTED]"),
+        };
+    });
+    return { acquire, reclaim };
+});
+//# sourceMappingURL=attachments.js.map

package/dist/ssh/gateway/attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../../../src/ssh/gateway/attachments.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAqB,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAI3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAuB,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAmB,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B;;;GAGG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;CAQpC,CAAC,IAAI,EAAE,CAAC;AAET,gHAAgH;AAChH,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAOrC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,QAAwB,EACxB,SAA4B,EAC5B,KAAkB,EAClB,KAA+D,EAC/D,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAE7F;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CAAC,OAAmB,EAAE,SAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,iBAAiB,EAAE,GAAG,OAAO,CAAC,eAAe,KAAK;IAClD,SAAS,EAAE,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC;CAChD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,QAAQ,CAAC,EAC3F,QAAwB,EACxB,SAEsF,EACtF,aAAiC;IAEjC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;IAE3C,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,uCAAuC,CAAC,CAAC,QAAQ,CAAC,EAClF,MAAkB;QAElB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAChC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oDAAoD,EAAE;gBAClF,MAAM;aACP,CAAC,CAAC;QACL,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QAClD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YACxB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,6DAA6D,EAAE;gBAC3F,MAAM;gBACN,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,4EAA4E;QAC5E,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,SAAS,EACT,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CACrB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CACnB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC1B,MAAM,CAAC,OAAO,CAAC,uDAAuD,EAAE;YACtE,MAAM;YACN,UAAU;YACV,UAAU,EAAE,EAAE;YACd,QAAQ;SACT,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CACf,0FAA0F,EAC1F,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAC/D,CACF,EACD,MAAM,CAAC,MAAM,CACd,EACH,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,6FAA6F;IAC7F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,MAAM,EAAE,CAAC,MAAkB,EAAE,EAAE,CAC7B,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAC1B,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CACf,+FAA+F,EAC/F,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CACnC,CACF,EACD,MAAM,CAAC,MAAM,CACd;KACJ,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,MAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAChE,SAAoB,EACpB,MAAkB,EAClB,UAA0B,EAC1B,WAA4B,EAC5B,OAAmB,EACnB,OAAuB,EACvB,SAA4B;QAE5B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,KAAK;YAAE,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,KAAK,CAAC,CAAC,iBAAiB,CACtB,QAAQ,EACR,SAAS,EACT,OAAO,CAAC,KAAK,EACb,kBAAkB,CAAC;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,GAAG,WAAW;SACf,CAAC,CACH,CAAC;QAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAqB,CAAC,CAAC;QACnE,2EAA2E;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAC9B,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpB,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,KAAK,CAAC;YACX,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CAAC,QAAQ,CAAC,iDAAiD,EAAE,MAAM,CAAC;YAC5E,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CACjB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CACnB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC1B,MAAM,CAAC,OAAO,CAAC,+CAA+C,EAAE;gBAC9D,GAAG,MAAM;gBACT,UAAU,EAAE,EAAE;gBACd,QAAQ;aACT,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CACf,8FAA8F,EAC9F,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CACtD,CACF,EACD,MAAM,CAAC,MAAM,CACd;SACJ,CAAC,CACH,CACF,CACF,CAAC;QAEF,MAAM,UAAU,GAAG,CAAC,UAA4B,EAAE,EAAE,CAClD,IAAI,aAAa,CAAC;YAChB,MAAM;YACN,UAAU;YACV,UAAU,EAAE,IAAI,sBAAsB,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YACnE,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;QAEL,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CACxD,QAAQ,CAAC,EAAE,UAA4B;YACrC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC1C,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBAClD,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;aAC5D,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,0BAA0B,CAAC;gBAC7B,UAAU;gBACV,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK;aACN,CAAC,CACL,CACF,CAAC;YACF,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAChF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YACxE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBACpB,CAAC,CAAC,6CAA6C;gBAC/C,CAAC,CAAC,iDAAiD,EACrD;gBACE,GAAG,MAAM;gBACT,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE;gBAChC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;aAC3D,CACF,CAAC;YACF,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QACD,oFAAoF;QACpF,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EACnB,MAAM,CAAC,eAAe,CACvB,CAAC;QAEF,4FAA4F;QAC5F,qCAAqC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CACxD,QAAQ,CAAC;YACP,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,OAAO;YACnC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;YACzC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/C,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,mDAAmD,EAAE;gBAC1E,GAAG,MAAM;gBACT,UAAU,EAAE,EAAE;aACf,CAAC,CAAC;QACL,CAAC,EACD,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EACnB,MAAM,CAAC,eAAe,CACvB,CAAC;QAEF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAC3C,QAAQ,CAAC,KAAK,EACd,UAAU,EACV,SAAS,EACT,WAAW,EACX,OAAO,CACR,CAAC;QACF,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC;QACzC,yFAAyF;QACzF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CACjC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EACzB,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CACf,uEAAuE,EACvE;YACE,GAAG,MAAM;YACT,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CACF,CACF,EACD,MAAM,CAAC,MAAM,CACd,CACF,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC;YAC5C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,GAAG,WAAW;YACd,WAAW;SACZ,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;YACxC,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,CAAC,WAAW,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;YAC3E,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;YACnD,WAAW,EAAE,QAAQ;YACrB,cAAc,EAAE,QAAQ;YACxB,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE;YAC7B,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;SACvE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC"}

package/dist/ssh/gateway/environment.d.ts

@@ -0,0 +1,71 @@
+import type { RepositoryName } from "@usine/core/repository";
+import type { GatewayDomain, GatewayLlmProvider } from "@usine/core/worker";
+import { type CallerToken } from "@usine/gateway/admin";
+import { Redacted } from "effect";
+/** The directory of the Unix socket that gh reaches the Gateway through. */
+export declare const GH_GATEWAY_SOCKET_DIRECTORY = "/run/usine-gateway";
+/** The variables sent through the SSH connection because they contain the caller token. The Worker's sshd must accept each in `AcceptEnv`. */
+export declare const GATEWAY_SENT_VARIABLES: readonly ["GIT_CONFIG_VALUE_0", "GH_ENTERPRISE_TOKEN", "GH_TOKEN", "ANTHROPIC_AUTH_TOKEN", "USINE_GATEWAY_TOKEN"];
+/** Returns the Gateway's forward proxy URL from a Worker; children receive it as `HTTPS_PROXY`. */
+export declare const forwardProxyUrl: (domain: GatewayDomain) => string;
+/** Returns the URL a Worker behind the Gateway clones and fetches `repository` from. */
+export declare const gatewayRepositoryUrl: (domain: GatewayDomain, repository: RepositoryName) => string;
+/**
+ * Returns gh's configuration files for the Gateway at `domain`. Neither file contains a token;
+ * gh reads the caller token from `GH_ENTERPRISE_TOKEN` and `GH_TOKEN`.
+ */
+export declare const ghGatewayConfig: (domain: GatewayDomain) => {
+    readonly "config.yml": "version: \"1\"\nhttp_unix_socket: /run/usine-gateway/http.sock\n";
+    readonly "hosts.yml": `git.${string & import("effect/Brand").Brand<"GatewayDomain">}:
+    git_protocol: https
+`;
+};
+export interface GatewayEnvironmentOptions {
+    readonly domain: GatewayDomain;
+    readonly llmProviders: ReadonlyArray<GatewayLlmProvider>;
+    /** The machine directory that contains the `ghGatewayConfig` files. */
+    readonly ghConfigDirectory: string;
+    /** The Attempt's machine directory that Codex uses as `CODEX_HOME` if the Gateway holds the OpenAI credential. */
+    readonly codexHome: string;
+    readonly callerToken: CallerToken;
+}
+/**
+ * Returns the configuration files that the executor writes on the machine before an Attempt,
+ * keyed by path: gh's files, and Codex's `config.toml` if the Gateway holds the OpenAI
+ * credential. None contains a token.
+ */
+export declare const gatewayConfigFiles: (options: Omit<GatewayEnvironmentOptions, "callerToken">) => ReadonlyArray<readonly [path: string, contents: string]>;
+/**
+ * An Attempt's environment behind a Gateway. `exported` has no secrets and goes in each command
+ * line; `sent` contains the caller token and goes only through the SSH connection.
+ */
+export interface GatewayEnvironment {
+    readonly exported: Readonly<Record<string, string>>;
+    readonly sent: Readonly<Record<string, Redacted.Redacted<string>>>;
+}
+/**
+ * Returns the variables of `gatewayEnvironment` without a caller token or Codex's home, which
+ * only an Attempt has, for commands that reach the Gateway's forward proxy but no attachment,
+ * such as a preflight's harness probes.
+ */
+export declare const gatewayExportedEnvironment: (settings: Pick<GatewayEnvironmentOptions, "domain" | "llmProviders">, ghConfigDirectory: string) => Readonly<Record<string, string>>;
+/**
+ * Returns the environment that points git, gh, package managers, and Claude Code at the
+ * Gateway at `domain`.
+ *
+ * - git sends the caller token in `x-usine-gateway-token` to `git.<domain>` only, and rewrites
+ *   `https://github.com/` and `https://git.<domain>/` to the Gateway. The header value is
+ *   config entry 0 (`GIT_CONFIG_VALUE_0`).
+ * - gh uses `git.<domain>` through the Gateway socket, with the caller token as both its
+ *   enterprise and GitHub token, so absolute pagination links also authenticate.
+ * - Package managers use the forward proxy at `<domain>:3128`; local addresses and the
+ *   Gateway's own names bypass it.
+ * - Claude Code calls `llm.<domain>/anthropic` with the caller token if the Gateway has the
+ *   Anthropic credential.
+ * - Codex reads `codexGatewayConfig` from `CODEX_HOME` and calls `llm.<domain>/openai/v1` with
+ *   the caller token if the Gateway has the OpenAI credential.
+ * - A harness whose provider the Gateway has no credential for uses its own login through the
+ *   forward proxy, whose allowlist must include the login's hosts.
+ */
+export declare const gatewayEnvironment: (options: GatewayEnvironmentOptions) => GatewayEnvironment;
+//# sourceMappingURL=environment.d.ts.map

package/dist/ssh/gateway/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/ssh/gateway/environment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,KAAK,WAAW,EAAwB,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAchE,8IAA8I;AAC9I,eAAO,MAAM,sBAAsB,YACjC,oBAAoB,EACpB,qBAAqB,EACrB,UAAU,EACV,sBAAsB,wBAEd,CAAC;AAEX,mGAAmG;AACnG,eAAO,MAAM,eAAe,WAAY,aAAa,KAAG,MACd,CAAC;AAE3C,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,WAAY,aAAa,cAAc,cAAc,KAAG,MAC/C,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,eAAe,WAAY,aAAa;aAEjD,YAAY;aACZ,WAAW;;;CACF,CAAC;AAoBd,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,uEAAuE;IACvE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,kHAAkH;IAClH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,YACpB,IAAI,CAAC,yBAAyB,EAAE,aAAa,CAAC,KACtD,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CASzD,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACpE;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,aAC3B,IAAI,CAAC,yBAAyB,EAAE,QAAQ,GAAG,cAAc,CAAC,qBACjD,MAAM,KACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQjC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,YAAa,yBAAyB,KAAG,kBAsCvE,CAAC"}

package/dist/ssh/gateway/environment.js

@@ -0,0 +1,148 @@
+import { GATEWAY_TOKEN_HEADER } from "@usine/gateway/admin";
+import { Redacted } from "effect";
+/** The directory of the Unix socket that gh reaches the Gateway through. */
+export const GH_GATEWAY_SOCKET_DIRECTORY = "/run/usine-gateway";
+/**
+ * The Unix socket that systemd forwards to the Gateway's port 80
+ * (`infra/hetzner/gateway/worker-cloud-init.yaml`). gh sends plain HTTP over it, and only HTTPS
+ * to `GH_HOST` directly.
+ */
+const GH_GATEWAY_SOCKET = `${GH_GATEWAY_SOCKET_DIRECTORY}/http.sock`;
+const FORWARD_PROXY_PORT = 3128;
+/** The variable that Codex's `model_provider` reads the caller token from (`env_key`). */
+const CODEX_TOKEN_VARIABLE = "USINE_GATEWAY_TOKEN";
+/** The variables sent through the SSH connection because they contain the caller token. The Worker's sshd must accept each in `AcceptEnv`. */
+export const GATEWAY_SENT_VARIABLES = [
+    "GIT_CONFIG_VALUE_0",
+    "GH_ENTERPRISE_TOKEN",
+    "GH_TOKEN",
+    "ANTHROPIC_AUTH_TOKEN",
+    CODEX_TOKEN_VARIABLE,
+];
+/** Returns the Gateway's forward proxy URL from a Worker; children receive it as `HTTPS_PROXY`. */
+export const forwardProxyUrl = (domain) => `http://${domain}:${FORWARD_PROXY_PORT}`;
+/** Returns the URL a Worker behind the Gateway clones and fetches `repository` from. */
+export const gatewayRepositoryUrl = (domain, repository) => `http://git.${domain}/${repository}.git`;
+/**
+ * Returns gh's configuration files for the Gateway at `domain`. Neither file contains a token;
+ * gh reads the caller token from `GH_ENTERPRISE_TOKEN` and `GH_TOKEN`.
+ */
+export const ghGatewayConfig = (domain) => ({
+    "config.yml": `version: "1"\nhttp_unix_socket: ${GH_GATEWAY_SOCKET}\n`,
+    "hosts.yml": `git.${domain}:\n    git_protocol: https\n`,
+});
+/**
+ * Returns Codex's `config.toml` for the Gateway at `domain`: a `model_provider` that sends the
+ * Responses API to `llm.<domain>/openai/v1` with the caller token from `USINE_GATEWAY_TOKEN` as
+ * the bearer token, and needs no login. The file contains no token.
+ */
+const codexGatewayConfig = (domain) => [
+    'model_provider = "usine-gateway"',
+    "",
+    "[model_providers.usine-gateway]",
+    'name = "usine gateway"',
+    `base_url = "http://llm.${domain}/openai/v1"`,
+    `env_key = "${CODEX_TOKEN_VARIABLE}"`,
+    'wire_api = "responses"',
+    "requires_openai_auth = false",
+    "",
+].join("\n");
+/**
+ * Returns the configuration files that the executor writes on the machine before an Attempt,
+ * keyed by path: gh's files, and Codex's `config.toml` if the Gateway holds the OpenAI
+ * credential. None contains a token.
+ */
+export const gatewayConfigFiles = (options) => {
+    const gh = ghGatewayConfig(options.domain);
+    return [
+        [`${options.ghConfigDirectory}/config.yml`, gh["config.yml"]],
+        [`${options.ghConfigDirectory}/hosts.yml`, gh["hosts.yml"]],
+        ...(options.llmProviders.includes("openai")
+            ? [[`${options.codexHome}/config.toml`, codexGatewayConfig(options.domain)]]
+            : []),
+    ];
+};
+/**
+ * Returns the variables of `gatewayEnvironment` without a caller token or Codex's home, which
+ * only an Attempt has, for commands that reach the Gateway's forward proxy but no attachment,
+ * such as a preflight's harness probes.
+ */
+export const gatewayExportedEnvironment = (settings, ghConfigDirectory) => {
+    const { CODEX_HOME: _, ...exported } = gatewayEnvironment({
+        ...settings,
+        ghConfigDirectory,
+        codexHome: "",
+        callerToken: Redacted.make(""),
+    }).exported;
+    return exported;
+};
+/**
+ * Returns the environment that points git, gh, package managers, and Claude Code at the
+ * Gateway at `domain`.
+ *
+ * - git sends the caller token in `x-usine-gateway-token` to `git.<domain>` only, and rewrites
+ *   `https://github.com/` and `https://git.<domain>/` to the Gateway. The header value is
+ *   config entry 0 (`GIT_CONFIG_VALUE_0`).
+ * - gh uses `git.<domain>` through the Gateway socket, with the caller token as both its
+ *   enterprise and GitHub token, so absolute pagination links also authenticate.
+ * - Package managers use the forward proxy at `<domain>:3128`; local addresses and the
+ *   Gateway's own names bypass it.
+ * - Claude Code calls `llm.<domain>/anthropic` with the caller token if the Gateway has the
+ *   Anthropic credential.
+ * - Codex reads `codexGatewayConfig` from `CODEX_HOME` and calls `llm.<domain>/openai/v1` with
+ *   the caller token if the Gateway has the OpenAI credential.
+ * - A harness whose provider the Gateway has no credential for uses its own login through the
+ *   forward proxy, whose allowlist must include the login's hosts.
+ */
+export const gatewayEnvironment = (options) => {
+    const { domain, callerToken } = options;
+    const gitBase = `http://git.${domain}/`;
+    const proxy = forwardProxyUrl(domain);
+    const direct = `localhost,127.0.0.1,::1,${domain}`;
+    const exported = {
+        GIT_CONFIG_COUNT: "3",
+        GIT_CONFIG_KEY_0: `http.${gitBase}.extraHeader`,
+        GIT_CONFIG_KEY_1: `url.${gitBase}.insteadOf`,
+        GIT_CONFIG_VALUE_1: "https://github.com/",
+        GIT_CONFIG_KEY_2: `url.${gitBase}.insteadOf`,
+        GIT_CONFIG_VALUE_2: `https://git.${domain}/`,
+        GH_HOST: `git.${domain}`,
+        GH_CONFIG_DIR: options.ghConfigDirectory,
+        GH_PROMPT_DISABLED: "1",
+        HTTPS_PROXY: proxy,
+        HTTP_PROXY: proxy,
+        https_proxy: proxy,
+        http_proxy: proxy,
+        NO_PROXY: direct,
+        no_proxy: direct,
+    };
+    const sent = {
+        GIT_CONFIG_VALUE_0: Redacted.make(`${GATEWAY_TOKEN_HEADER}: ${Redacted.value(callerToken)}`),
+        GH_ENTERPRISE_TOKEN: callerToken,
+        GH_TOKEN: callerToken,
+    };
+    const harnesses = options.llmProviders.map((provider) => harnessVariables(provider, options));
+    return {
+        exported: {
+            ...exported,
+            ...Object.fromEntries(harnesses.flatMap(({ exported }) => Object.entries(exported))),
+        },
+        sent: {
+            ...sent,
+            ...Object.fromEntries(harnesses.map(({ token }) => [token, callerToken])),
+        },
+    };
+};
+/** Returns the variables that point `provider`'s harness at the Gateway. */
+const harnessVariables = (provider, options) => {
+    switch (provider) {
+        case "anthropic":
+            return {
+                exported: { ANTHROPIC_BASE_URL: `http://llm.${options.domain}/anthropic` },
+                token: "ANTHROPIC_AUTH_TOKEN",
+            };
+        case "openai":
+            return { exported: { CODEX_HOME: options.codexHome }, token: CODEX_TOKEN_VARIABLE };
+    }
+};
+//# sourceMappingURL=environment.js.map

package/dist/ssh/gateway/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/ssh/gateway/environment.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAEhE;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,GAAG,2BAA2B,YAAY,CAAC;AAErE,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,0FAA0F;AAC1F,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAEnD,8IAA8I;AAC9I,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,oBAAoB;IACpB,qBAAqB;IACrB,UAAU;IACV,sBAAsB;IACtB,oBAAoB;CACZ,CAAC;AAEX,mGAAmG;AACnG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAqB,EAAU,EAAE,CAC/D,UAAU,MAAM,IAAI,kBAAkB,EAAE,CAAC;AAE3C,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAqB,EAAE,UAA0B,EAAU,EAAE,CAChG,cAAc,MAAM,IAAI,UAAU,MAAM,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAqB,EAAE,EAAE,CACvD,CAAC;IACC,YAAY,EAAE,mCAAmC,iBAAiB,IAAI;IACtE,WAAW,EAAE,OAAO,MAAM,8BAA8B;CACzD,CAAU,CAAC;AAEd;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,CAAC,MAAqB,EAAU,EAAE,CAC3D;IACE,kCAAkC;IAClC,EAAE;IACF,iCAAiC;IACjC,wBAAwB;IACxB,0BAA0B,MAAM,aAAa;IAC7C,cAAc,oBAAoB,GAAG;IACrC,wBAAwB;IACxB,8BAA8B;IAC9B,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAYf;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAuD,EACG,EAAE;IAC5D,MAAM,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO;QACL,CAAC,GAAG,OAAO,CAAC,iBAAiB,aAAa,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;QAC7D,CAAC,GAAG,OAAO,CAAC,iBAAiB,YAAY,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAU,CAAC;YACrF,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC,CAAC;AAWF;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,QAAoE,EACpE,iBAAyB,EACS,EAAE;IACpC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,kBAAkB,CAAC;QACxD,GAAG,QAAQ;QACX,iBAAiB;QACjB,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;KAC/B,CAAC,CAAC,QAAQ,CAAC;IACZ,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAkC,EAAsB,EAAE;IAC3F,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACxC,MAAM,OAAO,GAAG,cAAc,MAAM,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,2BAA2B,MAAM,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG;QACf,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,QAAQ,OAAO,cAAc;QAC/C,gBAAgB,EAAE,OAAO,OAAO,YAAY;QAC5C,kBAAkB,EAAE,qBAAqB;QACzC,gBAAgB,EAAE,OAAO,OAAO,YAAY;QAC5C,kBAAkB,EAAE,eAAe,MAAM,GAAG;QAC5C,OAAO,EAAE,OAAO,MAAM,EAAE;QACxB,aAAa,EAAE,OAAO,CAAC,iBAAiB;QACxC,kBAAkB,EAAE,GAAG;QACvB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,MAAM;KACjB,CAAC;IACF,MAAM,IAAI,GAAG;QACX,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,KAAK,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5F,mBAAmB,EAAE,WAAW;QAChC,QAAQ,EAAE,WAAW;KACtB,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9F,OAAO;QACL,QAAQ,EAAE;YACR,GAAG,QAAQ;YACX,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;SACrF;QACD,IAAI,EAAE;YACJ,GAAG,IAAI;YACP,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,CAAU,CAAC,CAAC;SACnF;KACF,CAAC;AACJ,CAAC,CAAC;AASF,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,CACvB,QAA4B,EAC5B,OAAgE,EAC9C,EAAE;IACpB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO;gBACL,QAAQ,EAAE,EAAE,kBAAkB,EAAE,cAAc,OAAO,CAAC,MAAM,YAAY,EAAE;gBAC1E,KAAK,EAAE,sBAAsB;aAC9B,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACxF,CAAC;AACH,CAAC,CAAC"}