@vigil-guard/vge-cc-guard 0.9.0-beta.1

package/dist/daemon/session-state.js

@@ -0,0 +1,495 @@
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { isSafeId } from './id-validation.js';
+import { logLegacyPendingEscalationDropped } from './audit-logger.js';
+import { decisionOwnerKey } from './decision-owner.js';
+import { chmodPrivateSync, writePrivateFileSync } from '../shared/private-file.js';
+const sessionStore = new Map();
+const lazyTimers = new Map();
+const LAZY_FLUSH_MS = 5_000;
+const MAX_PENDING_ESCALATIONS = 100;
+const MAX_ATTACHMENT_FINGERPRINTS = 256;
+function getSessionsDir() {
+    const base = process.env['VGE_CC_GUARD_CONFIG_DIR'] ?? path.join(os.homedir(), '.vge-cc-guard');
+    return path.join(base, 'sessions');
+}
+function serialize(data) {
+    return JSON.stringify({
+        ...data,
+        allowlist: [...data.allowlist],
+        allowlistEscalationIds: Object.fromEntries(data.allowlistEscalationIds),
+        blocklist: [...data.blocklist],
+        blocklistEscalationIds: Object.fromEntries(data.blocklistEscalationIds),
+        urlAllowOnce: [...data.urlAllowOnce],
+        attachmentCursors: Object.fromEntries(data.attachmentCursors),
+        attachmentSeenFingerprints: data.attachmentSeenFingerprints,
+        attachmentAllowOnce: [...data.attachmentAllowOnce],
+        promptAllowOnce: [...data.promptAllowOnce],
+    });
+}
+// Atomic write: temp file in the same dir → fsync → rename → fsync dir.
+// Eager fsync for security-critical state (taint, exact allow/block decisions)
+// — the daemon may be SIGKILLed at any moment, and a half-written rename
+// would lose the latest session trust decision.
+function persistSession(data) {
+    if (!isSafeId(data.sessionId)) {
+        throw new Error(`unsafe session id: ${data.sessionId}`);
+    }
+    const dir = getSessionsDir();
+    fs.mkdirSync(dir, { recursive: true });
+    const target = path.join(dir, `${data.sessionId}.json`);
+    const tmp = `${target}.${process.pid}.tmp`;
+    const payload = serialize(data);
+    const fd = fs.openSync(tmp, 'w', process.platform === 'win32' ? undefined : 0o600);
+    try {
+        fs.writeSync(fd, payload);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    chmodPrivateSync(tmp);
+    fs.renameSync(tmp, target);
+    chmodPrivateSync(target);
+    // Best-effort dir fsync — guarantees the rename is durable. Some FS / OS
+    // combinations reject opening a directory for write, so swallow EISDIR/EPERM.
+    try {
+        const dfd = fs.openSync(dir, 'r');
+        try {
+            fs.fsyncSync(dfd);
+        }
+        finally {
+            fs.closeSync(dfd);
+        }
+    }
+    catch {
+        /* fsync(dir) not supported here — accept the small durability gap */
+    }
+}
+function scheduleLazyWrite(sessionId) {
+    if (lazyTimers.has(sessionId))
+        return;
+    const t = setTimeout(() => {
+        lazyTimers.delete(sessionId);
+        const data = sessionStore.get(sessionId);
+        if (data)
+            persistSession(data);
+    }, LAZY_FLUSH_MS);
+    // Allow the daemon to exit even if a lazy write is pending — we'll flush
+    // on shutdown via flushAllLazyWrites().
+    t.unref?.();
+    lazyTimers.set(sessionId, t);
+}
+// High-frequency lastActivity touch — used on every hook call. Eager fsync
+// here would burn an fsync per request; the lazy 5s coalesce keeps disk
+// writes bounded without losing too much information on a crash.
+export function touchActivity(sessionId) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return;
+    data.lastActivity = Date.now();
+    scheduleLazyWrite(sessionId);
+}
+export function flushAllLazyWrites() {
+    for (const [id, timer] of lazyTimers) {
+        clearTimeout(timer);
+        const data = sessionStore.get(id);
+        if (data)
+            persistSession(data);
+    }
+    lazyTimers.clear();
+}
+export function persistCurrentSession(sessionId) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return;
+    data.lastActivity = Date.now();
+    persistSession(data);
+}
+export function createSession(sessionId, parentSessionId) {
+    if (parentSessionId !== null) {
+        const parent = sessionStore.get(parentSessionId);
+        if (parent) {
+            sessionStore.set(sessionId, parent); // shared reference — PRD §7.12
+            return parent;
+        }
+    }
+    const data = {
+        sessionId,
+        parentSessionId,
+        createdAt: Date.now(),
+        lastActivity: Date.now(),
+        state: 'clean',
+        allowlist: new Set(),
+        allowlistEscalationIds: new Map(),
+        blocklist: new Set(),
+        blocklistEscalationIds: new Map(),
+        pendingEscalations: [],
+        escalationCount: 0,
+        urlAllowOnce: new Set(),
+        attachmentCursors: new Map(),
+        attachmentSeenFingerprints: [],
+        attachmentAllowOnce: new Set(),
+        promptAllowOnce: new Set(),
+    };
+    sessionStore.set(sessionId, data);
+    return data;
+}
+export function getSession(sessionId) {
+    return sessionStore.get(sessionId);
+}
+export function getSessionLookupContext(lookupId) {
+    const data = sessionStore.get(lookupId);
+    if (!data) {
+        return { data: undefined, canonicalSessionId: null, isSubagent: false, parentSessionId: null };
+    }
+    const isSubagent = lookupId !== data.sessionId;
+    return {
+        data,
+        canonicalSessionId: data.sessionId,
+        isSubagent,
+        parentSessionId: isSubagent ? data.sessionId : data.parentSessionId,
+    };
+}
+export function deleteSession(sessionId) {
+    sessionStore.delete(sessionId);
+}
+export function transitionState(sessionId, newState) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return;
+    data.state = newState;
+    data.lastActivity = Date.now();
+    persistSession(data);
+}
+export function addToAllowlist(sessionId, key, escalationId) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return;
+    data.allowlist.add(key);
+    if (escalationId)
+        data.allowlistEscalationIds.set(key, escalationId);
+    data.lastActivity = Date.now();
+    persistSession(data);
+}
+export function addResourceAllow(sessionId, key, decisionId) {
+    addToAllowlist(sessionId, key, decisionId);
+}
+export function addToBlocklist(sessionId, key, escalationId) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return;
+    data.blocklist.add(key);
+    if (escalationId)
+        data.blocklistEscalationIds.set(key, escalationId);
+    data.lastActivity = Date.now();
+    persistSession(data);
+}
+export function addResourceBlock(sessionId, key, decisionId) {
+    addToBlocklist(sessionId, key, decisionId);
+}
+export function isResourceAllowed(session, key) {
+    return session.allowlist.has(key);
+}
+export function isResourceBlocked(session, key) {
+    return session.blocklist.has(key);
+}
+export function enqueueEscalation(sessionId, esc) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return false;
+    if (data.pendingEscalations.length >= MAX_PENDING_ESCALATIONS)
+        return false;
+    data.pendingEscalations.push({ ...esc, kind: esc.kind ?? 'tool-output' });
+    data.escalationCount++;
+    data.lastActivity = Date.now();
+    persistSession(data);
+    return true;
+}
+export function enqueueUrlEscalation(sessionId, esc) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return false;
+    if (data.pendingEscalations.length >= MAX_PENDING_ESCALATIONS)
+        return false;
+    data.pendingEscalations.push({ ...esc, kind: 'url-block' });
+    data.lastActivity = Date.now();
+    persistSession(data);
+    return true;
+}
+function scopedResourceKey(key, owner) {
+    return owner?.kind === 'subagent' ? `${decisionOwnerKey(owner)}\0${key}` : key;
+}
+export function addUrlAllowOnce(sessionId, key, owner) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return;
+    data.urlAllowOnce.add(scopedResourceKey(key, owner));
+    data.lastActivity = Date.now();
+    persistSession(data);
+}
+export function consumeUrlAllowOnce(sessionId, key, owner) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return false;
+    const storedKey = scopedResourceKey(key, owner);
+    if (!data.urlAllowOnce.has(storedKey))
+        return false;
+    data.urlAllowOnce.delete(storedKey);
+    data.lastActivity = Date.now();
+    persistSession(data);
+    return true;
+}
+export function getAttachmentScanState(sessionId, transcriptPath) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return { cursorOffset: 0, seenFingerprints: new Set() };
+    return {
+        cursorOffset: data.attachmentCursors.get(transcriptPath)?.offset ?? 0,
+        seenFingerprints: new Set(data.attachmentSeenFingerprints),
+    };
+}
+export function recordAttachmentScanTerminalState(sessionId, params) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return;
+    const current = data.attachmentCursors.get(params.transcriptPath)?.offset ?? 0;
+    data.attachmentCursors.set(params.transcriptPath, { offset: Math.max(current, params.nextOffset) });
+    data.attachmentSeenFingerprints = data.attachmentSeenFingerprints.filter((fingerprint) => fingerprint !== params.fingerprint);
+    data.attachmentSeenFingerprints.push(params.fingerprint);
+    if (data.attachmentSeenFingerprints.length > MAX_ATTACHMENT_FINGERPRINTS) {
+        data.attachmentSeenFingerprints = data.attachmentSeenFingerprints.slice(-MAX_ATTACHMENT_FINGERPRINTS);
+    }
+    data.lastActivity = Date.now();
+    persistSession(data);
+}
+export function recordAttachmentCursorOffset(sessionId, params) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return;
+    const current = data.attachmentCursors.get(params.transcriptPath)?.offset ?? 0;
+    if (params.nextOffset <= current)
+        return;
+    data.attachmentCursors.set(params.transcriptPath, { offset: params.nextOffset });
+    data.lastActivity = Date.now();
+    persistSession(data);
+}
+export function grantAttachmentAllowOnce(sessionId, resourceId) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return;
+    data.attachmentAllowOnce.add(resourceId);
+    data.lastActivity = Date.now();
+    persistSession(data);
+}
+export function consumeAttachmentAllowOnce(sessionId, resourceId) {
+    const data = sessionStore.get(sessionId);
+    if (!data || !data.attachmentAllowOnce.has(resourceId))
+        return false;
+    data.attachmentAllowOnce.delete(resourceId);
+    data.lastActivity = Date.now();
+    persistSession(data);
+    return true;
+}
+export function grantPromptAllowOnce(sessionId, resourceId) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return;
+    data.promptAllowOnce.add(resourceId);
+    data.lastActivity = Date.now();
+    persistSession(data);
+}
+export function consumePromptAllowOnce(sessionId, resourceId) {
+    const data = sessionStore.get(sessionId);
+    if (!data || !data.promptAllowOnce.has(resourceId))
+        return false;
+    data.promptAllowOnce.delete(resourceId);
+    data.lastActivity = Date.now();
+    persistSession(data);
+    return true;
+}
+export function dequeueEscalation(sessionId) {
+    const data = sessionStore.get(sessionId);
+    if (!data)
+        return undefined;
+    const esc = data.pendingEscalations.shift();
+    if (esc) {
+        data.lastActivity = Date.now();
+        persistSession(data);
+    }
+    return esc;
+}
+// PR-review C1: clears in-memory + on-disk session state. Used by both the
+// daemon's /v1/control/reset-session route and reset-session CLI fallback when
+// the daemon isn't running.
+export function resetSession(sessionId) {
+    if (!isSafeId(sessionId))
+        return false;
+    const now = Date.now();
+    const data = sessionStore.get(sessionId);
+    let touchedMemory = false;
+    let touchedDisk = false;
+    if (data) {
+        data.state = 'clean';
+        data.allowlist = new Set();
+        data.allowlistEscalationIds = new Map();
+        data.blocklist = new Set();
+        data.blocklistEscalationIds = new Map();
+        data.pendingEscalations = [];
+        data.escalationCount = 0;
+        data.urlAllowOnce = new Set();
+        data.attachmentCursors = new Map();
+        data.attachmentSeenFingerprints = [];
+        data.attachmentAllowOnce = new Set();
+        data.promptAllowOnce = new Set();
+        data.lastActivity = now;
+        persistSession(data);
+        touchedMemory = true;
+    }
+    // Also handle the case where the daemon was restarted between session creation
+    // and reset — the file exists on disk but isn't in memory.
+    const dir = getSessionsDir();
+    const filePath = path.join(dir, `${sessionId}.json`);
+    if (!touchedMemory && fs.existsSync(filePath)) {
+        try {
+            const raw = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+            const reset = {
+                ...raw,
+                state: 'clean',
+                allowlist: [],
+                allowlistEscalationIds: {},
+                blocklist: [],
+                blocklistEscalationIds: {},
+                pendingEscalations: [],
+                escalationCount: 0,
+                urlAllowOnce: [],
+                attachmentCursors: {},
+                attachmentSeenFingerprints: [],
+                attachmentAllowOnce: [],
+                promptAllowOnce: [],
+                lastActivity: now,
+            };
+            writePrivateFileSync(filePath, JSON.stringify(reset));
+            touchedDisk = true;
+        }
+        catch {
+            // malformed file — ignore, caller will get false
+        }
+    }
+    return touchedMemory || touchedDisk;
+}
+// Restore session state from disk. Skips malformed files and prunes any
+// session whose lastActivity is older than ttlHours. Returns counts so the
+// daemon can log the outcome at startup.
+export function loadSessionsFromDisk(ttlHours) {
+    const dir = getSessionsDir();
+    if (!fs.existsSync(dir))
+        return { loaded: 0, pruned: 0, skipped: 0 };
+    const cutoff = Date.now() - ttlHours * 3600 * 1000;
+    let loaded = 0;
+    let pruned = 0;
+    let skipped = 0;
+    for (const entry of fs.readdirSync(dir)) {
+        if (!entry.endsWith('.json'))
+            continue;
+        const file = path.join(dir, entry);
+        let raw;
+        try {
+            raw = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        }
+        catch {
+            skipped++;
+            continue;
+        }
+        const sessionId = raw['sessionId'] ?? entry.replace(/\.json$/, '');
+        if (!isSafeId(sessionId)) {
+            skipped++;
+            continue;
+        }
+        const lastActivity = Number(raw['lastActivity'] ?? 0);
+        if (lastActivity < cutoff) {
+            pruned++;
+            try {
+                fs.unlinkSync(file);
+            }
+            catch { /* best effort */ }
+            continue;
+        }
+        const rawAllowlistEscalationIds = raw['allowlistEscalationIds'];
+        const allowlistEscalationIds = typeof rawAllowlistEscalationIds === 'object' && rawAllowlistEscalationIds !== null
+            ? Object.entries(rawAllowlistEscalationIds)
+                .filter((entry) => typeof entry[1] === 'string')
+            : [];
+        const rawBlocklistEscalationIds = raw['blocklistEscalationIds'];
+        const blocklistEscalationIds = typeof rawBlocklistEscalationIds === 'object' && rawBlocklistEscalationIds !== null
+            ? Object.entries(rawBlocklistEscalationIds)
+                .filter((entry) => typeof entry[1] === 'string')
+            : [];
+        const pendingEscalations = Array.isArray(raw['pendingEscalations']) ? raw['pendingEscalations'] : [];
+        const rawAttachmentCursors = raw['attachmentCursors'];
+        const attachmentCursorEntries = typeof rawAttachmentCursors === 'object' && rawAttachmentCursors !== null
+            ? Object.entries(rawAttachmentCursors)
+                .map(([key, value]) => {
+                if (typeof value !== 'object' || value === null)
+                    return null;
+                const offset = Number(value['offset'] ?? 0);
+                return Number.isFinite(offset) && offset >= 0 ? [key, { offset }] : null;
+            })
+                .filter((entry) => entry !== null)
+            : [];
+        const data = {
+            sessionId,
+            parentSessionId: raw['parentSessionId'] ?? null,
+            createdAt: Number(raw['createdAt'] ?? Date.now()),
+            lastActivity,
+            state: (raw['state'] ?? 'clean'),
+            allowlist: new Set(Array.isArray(raw['allowlist']) ? raw['allowlist'] : []),
+            allowlistEscalationIds: new Map(allowlistEscalationIds),
+            blocklist: new Set(Array.isArray(raw['blocklist']) ? raw['blocklist'] : []),
+            blocklistEscalationIds: new Map(blocklistEscalationIds),
+            pendingEscalations,
+            escalationCount: Number(raw['escalationCount'] ?? 0),
+            urlAllowOnce: new Set(Array.isArray(raw['urlAllowOnce']) ? raw['urlAllowOnce'] : []),
+            attachmentCursors: new Map(attachmentCursorEntries),
+            attachmentSeenFingerprints: Array.isArray(raw['attachmentSeenFingerprints'])
+                ? raw['attachmentSeenFingerprints']
+                    .filter((item) => typeof item === 'string')
+                    .slice(-MAX_ATTACHMENT_FINGERPRINTS)
+                : [],
+            attachmentAllowOnce: new Set(Array.isArray(raw['attachmentAllowOnce']) ? raw['attachmentAllowOnce'] : []),
+            promptAllowOnce: new Set(Array.isArray(raw['promptAllowOnce']) ? raw['promptAllowOnce'] : []),
+        };
+        if (data.pendingEscalations.length > 0) {
+            for (const escalation of data.pendingEscalations) {
+                try {
+                    logLegacyPendingEscalationDropped({ sessionId, escalation });
+                }
+                catch {
+                    // Audit failure during recovery should not prevent daemon startup.
+                }
+            }
+            data.pendingEscalations = [];
+            data.lastActivity = Date.now();
+            persistSession(data);
+        }
+        sessionStore.set(sessionId, data);
+        loaded++;
+    }
+    return { loaded, pruned, skipped };
+}
+export function gcIdleSessions(ttlHours) {
+    const cutoff = Date.now() - ttlHours * 3600 * 1000;
+    for (const [id, data] of sessionStore) {
+        if (data.lastActivity < cutoff) {
+            sessionStore.delete(id);
+            try {
+                fs.unlinkSync(path.join(getSessionsDir(), `${id}.json`));
+            }
+            catch {
+                // file may not exist — ignore
+            }
+        }
+    }
+}
+//# sourceMappingURL=session-state.js.map

package/dist/daemon/session-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-state.js","sourceRoot":"","sources":["../../src/daemon/session-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAQ7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEnF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;AACpD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;AACrD,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,eAAe,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,IAAiB;IAClC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,GAAG,IAAI;QACP,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,sBAAsB,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC;QACvE,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,sBAAsB,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC;QACvE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;QACpC,iBAAiB,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAC7D,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;QAC3D,mBAAmB,EAAE,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAClD,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,+EAA+E;AAC/E,yEAAyE;AACzE,gDAAgD;AAChD,SAAS,cAAc,CAAC,IAAiB;IACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAEhC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnF,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC1B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,yEAAyE;IACzE,8EAA8E;IAC9E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO;IACtC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;QACxB,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,IAAI;YAAE,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,EAAE,aAAa,CAAC,CAAC;IAClB,yEAAyE;IACzE,wCAAwC;IACxC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACZ,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,wEAAwE;AACxE,iEAAiE;AACjE,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,iBAAiB,CAAC,SAAS,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACrC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IACD,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,eAA8B;IAC7E,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,+BAA+B;YACpE,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAgB;QACxB,SAAS;QACT,eAAe;QACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;QACxB,KAAK,EAAE,OAAO;QACd,SAAS,EAAE,IAAI,GAAG,EAAU;QAC5B,sBAAsB,EAAE,IAAI,GAAG,EAAkB;QACjD,SAAS,EAAE,IAAI,GAAG,EAAU;QAC5B,sBAAsB,EAAE,IAAI,GAAG,EAAkB;QACjD,kBAAkB,EAAE,EAAE;QACtB,eAAe,EAAE,CAAC;QAClB,YAAY,EAAE,IAAI,GAAG,EAAU;QAC/B,iBAAiB,EAAE,IAAI,GAAG,EAA4B;QACtD,0BAA0B,EAAE,EAAE;QAC9B,mBAAmB,EAAE,IAAI,GAAG,EAAU;QACtC,eAAe,EAAE,IAAI,GAAG,EAAU;KACnC,CAAC;IACF,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IAMtD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC;IAC/C,OAAO;QACL,IAAI;QACJ,kBAAkB,EAAE,IAAI,CAAC,SAAS;QAClC,UAAU;QACV,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,QAAsB;IACvE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;IACtB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,GAAW,EAAE,YAAqB;IAClF,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,YAAY;QAAE,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,GAAW,EAAE,UAAmB;IAClF,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,GAAW,EAAE,YAAqB;IAClF,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,YAAY;QAAE,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,GAAW,EAAE,UAAmB;IAClF,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAoB,EAAE,GAAW;IACjE,OAAO,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAoB,EAAE,GAAW;IACjE,OAAO,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,GAAe;IAClE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,uBAAuB;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,aAAa,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,eAAe,EAAE,CAAC;IACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,GAAe;IACrE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,uBAAuB;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,KAAqB;IAC3D,OAAO,KAAK,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,GAAW,EAAE,KAAqB;IACnF,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,GAAW,EAAE,KAAqB;IACvF,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,cAAsB;IAI9E,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACnE,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;QACrE,gBAAgB,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,SAAiB,EACjB,MAKC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;IAC/E,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACpG,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,CACtE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CACpD,CAAC;IACF,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,0BAA0B,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;QACzE,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,SAAiB,EACjB,MAGC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO;QAAE,OAAO;IACzC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACjF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,UAAkB;IAC5E,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,UAAkB;IAC9E,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,UAAkB;IACxE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,UAAkB;IAC1E,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;IAC5C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,+EAA+E;AAC/E,4BAA4B;AAC5B,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,IAAI,CAAC,sBAAsB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,IAAI,CAAC,sBAAsB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACxD,IAAI,CAAC,kBAAkB,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,IAAI,CAAC,iBAAiB,GAAG,IAAI,GAAG,EAA4B,CAAC;QAC7D,IAAI,CAAC,0BAA0B,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC;QACxB,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,+EAA+E;IAC/E,2DAA2D;IAC3D,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAC;YACtF,MAAM,KAAK,GAAG;gBACZ,GAAG,GAAG;gBACN,KAAK,EAAE,OAAO;gBACd,SAAS,EAAE,EAAE;gBACb,sBAAsB,EAAE,EAAE;gBAC1B,SAAS,EAAE,EAAE;gBACb,sBAAsB,EAAE,EAAE;gBAC1B,kBAAkB,EAAE,EAAE;gBACtB,eAAe,EAAE,CAAC;gBAClB,YAAY,EAAE,EAAE;gBAChB,iBAAiB,EAAE,EAAE;gBACrB,0BAA0B,EAAE,EAAE;gBAC9B,mBAAmB,EAAE,EAAE;gBACvB,eAAe,EAAE,EAAE;gBACnB,YAAY,EAAE,GAAG;aAClB,CAAC;YACF,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;IACH,CAAC;IAED,OAAO,aAAa,IAAI,WAAW,CAAC;AACtC,CAAC;AAED,wEAAwE;AACxE,2EAA2E;AAC3E,yCAAyC;AACzC,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IAKnD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC;IACnD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAA4B,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAI,GAAG,CAAC,WAAW,CAAwB,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,YAAY,GAAG,MAAM,EAAE,CAAC;YAC1B,MAAM,EAAE,CAAC;YACT,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QACD,MAAM,yBAAyB,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAChE,MAAM,sBAAsB,GAC1B,OAAO,yBAAyB,KAAK,QAAQ,IAAI,yBAAyB,KAAK,IAAI;YACjF,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAoD,CAAC;iBACjE,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;YAC/E,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,yBAAyB,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAChE,MAAM,sBAAsB,GAC1B,OAAO,yBAAyB,KAAK,QAAQ,IAAI,yBAAyB,KAAK,IAAI;YACjF,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAoD,CAAC;iBACjE,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;YAC/E,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,kBAAkB,GACtB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,oBAAoB,CAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,oBAAoB,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,uBAAuB,GAC3B,OAAO,oBAAoB,KAAK,QAAQ,IAAI,oBAAoB,KAAK,IAAI;YACvE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,oBAA+C,CAAC;iBAC5D,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAqC,EAAE;gBACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC;gBAC7D,MAAM,MAAM,GAAG,MAAM,CAAE,KAAiC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3E,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,KAAK,EAAuC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;YAC3E,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,GAAgB;YACxB,SAAS;YACT,eAAe,EAAG,GAAG,CAAC,iBAAiB,CAAmB,IAAI,IAAI;YAClE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACjD,YAAY;YACZ,KAAK,EAAE,CAAE,GAAG,CAAC,OAAO,CAA8B,IAAI,OAAO,CAAC;YAC9D,SAAS,EAAE,IAAI,GAAG,CAAS,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,sBAAsB,EAAE,IAAI,GAAG,CAAiB,sBAAsB,CAAC;YACvE,SAAS,EAAE,IAAI,GAAG,CAAS,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,sBAAsB,EAAE,IAAI,GAAG,CAAiB,sBAAsB,CAAC;YACvE,kBAAkB;YAClB,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACpD,YAAY,EAAE,IAAI,GAAG,CACnB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,cAAc,CAAc,CAAC,CAAC,CAAC,EAAE,CAC5E;YACD,iBAAiB,EAAE,IAAI,GAAG,CAA2B,uBAAuB,CAAC;YAC7E,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;gBAC1E,CAAC,CAAE,GAAG,CAAC,4BAA4B,CAAe;qBAC7C,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;qBAC1D,KAAK,CAAC,CAAC,2BAA2B,CAAC;gBACxC,CAAC,CAAC,EAAE;YACN,mBAAmB,EAAE,IAAI,GAAG,CAC1B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,qBAAqB,CAAc,CAAC,CAAC,CAAC,EAAE,CAC1F;YACD,eAAe,EAAE,IAAI,GAAG,CACtB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,iBAAiB,CAAc,CAAC,CAAC,CAAC,EAAE,CAClF;SACF,CAAC;QACF,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACjD,IAAI,CAAC;oBACH,iCAAiC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;gBACrE,CAAC;YACH,CAAC;YACD,IAAI,CAAC,kBAAkB,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,EAAE,CAAC;IACX,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC;IACnD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC;YAC/B,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/daemon/subagent-lifecycle.d.ts

@@ -0,0 +1,8 @@
+import type { CCSubagentStartPayload, CCSubagentStopPayload } from '../shared/types.js';
+export declare function handleSubagentStart(payload: CCSubagentStartPayload): null;
+export declare function handleSubagentStop(payload: CCSubagentStopPayload): {
+    decision: 'block';
+    reason: string;
+} | null;
+export declare function resetSubagentLifecycleForTests(): void;
+//# sourceMappingURL=subagent-lifecycle.d.ts.map

package/dist/daemon/subagent-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subagent-lifecycle.d.ts","sourceRoot":"","sources":["../../src/daemon/subagent-lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAiB,MAAM,oBAAoB,CAAC;AAmBvG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CASzE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,qBAAqB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA0B/G;AAED,wBAAgB,8BAA8B,IAAI,IAAI,CAErD"}

package/dist/daemon/subagent-lifecycle.js

@@ -0,0 +1,56 @@
+import { renderActivePostToolDecisionReaskForOwner } from './posttool-decision-escrow.js';
+import { renderActivePreToolDecisionReaskForOwner } from './pretool-decision-escrow.js';
+const activeSubagents = new Map();
+function subagentKey(sessionId, agentId) {
+    return `${sessionId}\0${agentId}`;
+}
+function isTrackedSubagent(payload) {
+    if (!payload.agent_type)
+        return false;
+    return activeSubagents.has(subagentKey(payload.session_id, payload.agent_id));
+}
+function pendingDecisionReask(owner) {
+    return renderActivePreToolDecisionReaskForOwner(owner) ?? renderActivePostToolDecisionReaskForOwner(owner);
+}
+export function handleSubagentStart(payload) {
+    if (!payload.agent_type)
+        return null;
+    activeSubagents.set(subagentKey(payload.session_id, payload.agent_id), {
+        kind: 'subagent',
+        sessionId: payload.session_id,
+        agentId: payload.agent_id,
+        agentType: payload.agent_type,
+    });
+    return null;
+}
+export function handleSubagentStop(payload) {
+    const key = subagentKey(payload.session_id, payload.agent_id);
+    if (payload.stop_hook_active) {
+        activeSubagents.delete(key);
+        return null;
+    }
+    if (!isTrackedSubagent(payload))
+        return null;
+    const owner = activeSubagents.get(key);
+    if (!owner)
+        return null;
+    const reask = pendingDecisionReask(owner);
+    if (!reask) {
+        activeSubagents.delete(key);
+        return null;
+    }
+    return {
+        decision: 'block',
+        reason: [
+            'VGE Agent Guard: continue once because this subagent has a pending VGE decision.',
+            'Make the decision visible to the parent session and include the exact commands shown below.',
+            'Do not retry the blocked tool or use workarounds until the user resolves the decision.',
+            '',
+            reask,
+        ].join('\n'),
+    };
+}
+export function resetSubagentLifecycleForTests() {
+    activeSubagents.clear();
+}
+//# sourceMappingURL=subagent-lifecycle.js.map

package/dist/daemon/subagent-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subagent-lifecycle.js","sourceRoot":"","sources":["../../src/daemon/subagent-lifecycle.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yCAAyC,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,wCAAwC,EAAE,MAAM,8BAA8B,CAAC;AAExF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEzD,SAAS,WAAW,CAAC,SAAiB,EAAE,OAAe;IACrD,OAAO,GAAG,SAAS,KAAK,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA8B;IACvD,IAAI,CAAC,OAAO,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAoB;IAChD,OAAO,wCAAwC,CAAC,KAAK,CAAC,IAAI,yCAAyC,CAAC,KAAK,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAA+B;IACjE,IAAI,CAAC,OAAO,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACrC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;QACrE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,SAAS,EAAE,OAAO,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA8B;IAC/D,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE;YACN,kFAAkF;YAClF,6FAA6F;YAC7F,wFAAwF;YACxF,EAAE;YACF,KAAK;SACN,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC5C,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC"}

package/dist/daemon/tool-output-redactor.d.ts

@@ -0,0 +1,13 @@
+export type ToolOutputRedaction = {
+    ok: true;
+    output: unknown;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function canRedactTool(toolName: string, opts: {
+    ccContractHealthy: boolean;
+}): boolean;
+export declare function redactForTool(toolName: string, message: string, original: unknown): ToolOutputRedaction;
+export declare function serializedContainsOriginalString(redacted: unknown, originalString: string): boolean;
+//# sourceMappingURL=tool-output-redactor.d.ts.map

package/dist/daemon/tool-output-redactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-output-redactor.d.ts","sourceRoot":"","sources":["../../src/daemon/tool-output-redactor.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAclC,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,iBAAiB,EAAE,OAAO,CAAA;CAAE,GACnC,OAAO,CAET;AAiED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,mBAAmB,CAKvG;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAEnG"}