@wascartech/devbot 0.0.0-stage → 2.1.0

package/dist/devcontainer.js

@@ -0,0 +1,141 @@
+// Pure helpers for nested rootless Podman inside the per-work-item builder
+// container (work item #17). Kept free of config/db imports so the flag and
+// storage shapes can be unit-tested without podman, env, or a DB.
+//
+// Security envelope: enabling dev containers broadens the builder container's
+// privileges (nested user namespaces + mount + mknod) versus the default
+// unprivileged launch. It never mounts the host podman socket or host
+// filesystem. The capability set is deliberately minimal and pinned by the host
+// smoke test in docs/dev-containers.md; --privileged is a documented last
+// resort, never a default.
+import { accessSync, constants } from "node:fs";
+// Dev containers are build-mode only and globally gated. Plan mode is read-only
+// and never gets a container runtime. Pure: the caller passes the resolved
+// runtime flag so this module stays config-free.
+export function devcontainerEnabled(enabled, mode) {
+    return enabled && mode === "build";
+}
+// Probe for the FUSE device. Used only when the configured driver is "auto".
+// A missing /dev/fuse is not an error — it just selects the portable vfs driver.
+export function hasFuseDevice(path = "/dev/fuse") {
+    try {
+        accessSync(path, constants.R_OK | constants.W_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// Inner rootless store lives on the dedicated per-work-item podman volume
+// (mounted at /home/devbot/.local/share/containers). Never under /workspace, so
+// container artifacts cannot leak into the git diff. graphroot/runroot are
+// separate subdirs so a runroot cleanup can never touch the image store.
+export const PODMAN_STORE_DIR = "/home/devbot/.local/share/containers";
+// Resolve the effective storage driver. "auto" probes for /dev/fuse at startup:
+// fuse-overlayfs when present (layered, disk-efficient), else vfs (portable but
+// full-copy). An explicit choice is honored as-is.
+export function resolveStorageDriver(configured, hasFuse) {
+    if (configured === "auto")
+        return hasFuse ? "fuse-overlayfs" : "vfs";
+    return configured;
+}
+// Base `podman run` args every mode needs. The sandbox shell runs commands as
+// the unprivileged `agent` UID (uid 1001), so the container process needs
+// CAP_SETUID/CAP_SETGID for `setpriv` to drop to it. Nested-podman build runs add
+// the rest (SYS_ADMIN/MKNOD/SYS_CHROOT) via nestedPodmanArgs; the duplicate
+// SETUID/SETGID there is harmless. The agent UID itself never keeps
+// DAC_OVERRIDE, so /home/devbot/.xdg stays readable only by opencode.
+export function sandboxBaseArgs() {
+    return ["--cap-add", "SETUID", "--cap-add", "SETGID"];
+}
+// Extra `podman run` args appended to the outer builder launch when dev
+// containers are enabled for a build-mode run. Ordering is not load-bearing but
+// the exact membership is tested. --device /dev/fuse is added only for
+// fuse-overlayfs.
+export function nestedPodmanArgs(driver) {
+    const args = [
+        // Predictable host↔container uid mapping; the inner subuid range (1001:64535
+        // in the image) is derived from this mapping.
+        "--userns=keep-id",
+        // No systemd inside the builder; the inner runtime uses cgroupfs and shares
+        // the outer cgroup namespace.
+        "--cgroupns=host",
+        // The nested store manages its own SELinux labels.
+        "--security-opt", "label=disable",
+        // The default seccomp profile blocks the clone/unshare flags crun needs.
+        "--security-opt", "seccomp=unconfined",
+        // The inner crun must write /proc/sys/net/ipv4/ping_group_range when it
+        // builds the container's new network namespace; the outer run mounts /proc
+        // read-only by default, so a path-scoped unmask is not enough (it still
+        // reports "Read-only file system"). unmask=ALL remounts /proc writable —
+        // far less than --privileged, and pinned by the host smoke test.
+        "--security-opt", "unmask=ALL",
+        // Minimal escalation: create nested namespaces, map uid/gid, mknod, chroot.
+        "--cap-add", "SYS_ADMIN",
+        "--cap-add", "SETUID",
+        "--cap-add", "SETGID",
+        "--cap-add", "MKNOD",
+        "--cap-add", "SYS_CHROOT",
+        // pasta (the rootless network backend passt ships) opens /dev/net/tun to
+        // build the container tap device. The default rootless launch does not pass
+        // it, so inner networking fails with "Failed to open() /dev/net/tun".
+        "--device", "/dev/net/tun",
+    ];
+    if (driver === "fuse-overlayfs") {
+        args.push("--device", "/dev/fuse");
+    }
+    return args;
+}
+// Inner containers/storage.conf written into the podman volume's storage
+// directory. Podman's valid drivers are overlay/vfs/...; fuse-overlayfs is a
+// mount_program under [storage.options.overlay], so selecting fuse-overlayfs
+// means driver=overlay + mount_program=fuse-overlayfs.
+export function storageConf(driver) {
+    const lines = [
+        "[storage]",
+        driver === "fuse-overlayfs" ? `driver = "overlay"` : `driver = "vfs"`,
+        `graphroot = "${PODMAN_STORE_DIR}/storage"`,
+        `runroot = "${PODMAN_STORE_DIR}/runroot"`,
+    ];
+    if (driver === "fuse-overlayfs") {
+        lines.push("", "[storage.options.overlay]", `mount_program = "/usr/bin/fuse-overlayfs"`);
+    }
+    lines.push("");
+    return lines.join("\n");
+}
+// The `-v <volume>:<store>:Z` mount for the private inner runtime store. It is
+// deliberately NOT /workspace, so artifacts can never enter the git diff.
+export function devcontainerVolumeArgs(podmanVolume) {
+    return ["-v", `${podmanVolume}:${PODMAN_STORE_DIR}:Z`];
+}
+// Point the inner podman at the storage.conf written into the podman volume
+// (CONTAINERS_STORAGE_CONF). Without this, rootless podman would look in
+// $XDG_CONFIG_HOME/containers (now the out-of-tree xdg volume — still worth
+// overriding so the inner runtime's config never mixes with opencode's). The
+// referenced file is created by ensurePodmanStore.
+export function devcontainerEnvArgs() {
+    return [
+        "--env", `CONTAINERS_STORAGE_CONF=${PODMAN_STORE_DIR}/storage.conf`,
+        // Tells docker/devbot-shell to route container-runtime commands through the
+        // non-bwrap, cap-preserving path (nested rootless podman cannot run under
+        // bwrap's PR_SET_NO_NEW_PRIVS). Set by the runner, never the agent.
+        "--env", "DEVBOT_NESTED_PODMAN=1",
+    ];
+}
+// Prompt block appended to build-mode runs when dev containers are enabled.
+// Tells the agent the capability exists, that its runtime is private to the
+// work item, and that the store lives outside /workspace so it can never be
+// committed.
+export function devcontainerPromptSection() {
+    return [
+        "## Local container runtime (Podman)",
+        "",
+        "`podman` is available inside this container for integration tests. Its runtime is **private to this work item**: containers, images, and networks you create here are invisible to every other task, and no other task can affect yours.",
+        "",
+        "- Build and run the project's own images, or pull service images (postgres, redis, etc.), then `podman network create` a private network so containers resolve each other by name.",
+        "- Prefer a repo `compose.yaml`/`docker-compose.yml` via `podman compose` when one exists; otherwise use raw `podman`.",
+        "- The container store lives in a separate volume outside `/workspace`, so container artifacts are never part of the git diff and must not be committed.",
+        "- Stop long-running containers when you're done (`podman rm -f <name>`); they are reaped when this run exits.",
+    ].join("\n");
+}
+//# sourceMappingURL=devcontainer.js.map

package/dist/devcontainer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devcontainer.js","sourceRoot":"","sources":["../src/devcontainer.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,4EAA4E;AAC5E,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,sEAAsE;AACtE,gFAAgF;AAChF,0EAA0E;AAC1E,2BAA2B;AAE3B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAKhD,gFAAgF;AAChF,2EAA2E;AAC3E,iDAAiD;AACjD,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,IAAsB;IAC1E,OAAO,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;AACrC,CAAC;AAED,6EAA6E;AAC7E,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,IAAI,GAAG,WAAW;IAC9C,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,gFAAgF;AAChF,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;AAEvE,gFAAgF;AAChF,gFAAgF;AAChF,mDAAmD;AACnD,MAAM,UAAU,oBAAoB,CAAC,UAA4B,EAAE,OAAgB;IACjF,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,kFAAkF;AAClF,4EAA4E;AAC5E,oEAAoE;AACpE,sEAAsE;AACtE,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,wEAAwE;AACxE,gFAAgF;AAChF,uEAAuE;AACvE,kBAAkB;AAClB,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,MAAM,IAAI,GAAG;QACX,6EAA6E;QAC7E,8CAA8C;QAC9C,kBAAkB;QAClB,4EAA4E;QAC5E,8BAA8B;QAC9B,iBAAiB;QACjB,mDAAmD;QACnD,gBAAgB,EAAE,eAAe;QACjC,yEAAyE;QACzE,gBAAgB,EAAE,oBAAoB;QACtC,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,iEAAiE;QACjE,gBAAgB,EAAE,YAAY;QAC9B,4EAA4E;QAC5E,WAAW,EAAE,WAAW;QACxB,WAAW,EAAE,QAAQ;QACrB,WAAW,EAAE,QAAQ;QACrB,WAAW,EAAE,OAAO;QACpB,WAAW,EAAE,YAAY;QACzB,yEAAyE;QACzE,4EAA4E;QAC5E,sEAAsE;QACtE,UAAU,EAAE,cAAc;KAC3B,CAAC;IACF,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,6EAA6E;AAC7E,6EAA6E;AAC7E,uDAAuD;AACvD,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC/C,MAAM,KAAK,GAAG;QACZ,WAAW;QACX,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB;QACrE,gBAAgB,gBAAgB,WAAW;QAC3C,cAAc,gBAAgB,WAAW;KAC1C,CAAC;IACF,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CACR,EAAE,EACF,2BAA2B,EAC3B,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,OAAO,CAAC,IAAI,EAAE,GAAG,YAAY,IAAI,gBAAgB,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,mDAAmD;AACnD,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,OAAO,EAAE,2BAA2B,gBAAgB,eAAe;QACnE,4EAA4E;QAC5E,0EAA0E;QAC1E,oEAAoE;QACpE,OAAO,EAAE,wBAAwB;KAClC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,aAAa;AACb,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,qCAAqC;QACrC,EAAE;QACF,0OAA0O;QAC1O,EAAE;QACF,oLAAoL;QACpL,uHAAuH;QACvH,yJAAyJ;QACzJ,+GAA+G;KAChH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/env-config-store.js

@@ -0,0 +1,132 @@
+import { db } from "./db.js";
+import { log } from "./logger.js";
+import { encrypt, decryptOrPlaintext } from "./crypto-util.js";
+import { EnvVarSchema, } from "./types/env-config.js";
+// Per-project environment variables. Same DB file as project_tokens and
+// project_mcp_servers (devbot.db, 0600). Keyed by (project_id, name); the
+// value is encrypted at rest via crypto-util.ts (AES-256-GCM, SESSION_KEY).
+// The runner is the trust boundary for what the container actually receives
+// — values are re-validated on read; a corrupt row is skipped (logged at
+// warn), never crashes a run.
+export function initEnvVarsTables() {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS project_env_vars (
+      project_id  INTEGER NOT NULL,
+      name        TEXT    NOT NULL,
+      value       TEXT    NOT NULL,
+      enabled     INTEGER NOT NULL,
+      created_at  INTEGER NOT NULL,
+      updated_at  INTEGER NOT NULL,
+      PRIMARY KEY (project_id, name)
+    )
+  `);
+}
+function rowToEnvVar(projectId, row) {
+    let plaintext;
+    try {
+        plaintext = decryptOrPlaintext(row.value);
+    }
+    catch {
+        log.warn("env var row decrypt failed, skipping", { projectId, name: row.name });
+        return null;
+    }
+    const v = EnvVarSchema.safeParse({
+        name: row.name,
+        value: plaintext,
+        enabled: row.enabled === 1,
+    });
+    if (!v.success) {
+        log.warn("env var row failed schema, skipping", { projectId, name: row.name });
+        return null;
+    }
+    return v.data;
+}
+export function listEnvVars(projectId) {
+    const rows = db
+        .prepare("SELECT name, value, enabled FROM project_env_vars WHERE project_id = ? ORDER BY name")
+        .all(projectId);
+    const out = [];
+    for (const r of rows) {
+        const v = rowToEnvVar(projectId, r);
+        if (v)
+            out.push(v);
+    }
+    return out;
+}
+// Stripped shape for the browser — never exposes the value.
+export function listEnvVarSummaries(projectId) {
+    const rows = db
+        .prepare("SELECT name, value, enabled FROM project_env_vars WHERE project_id = ? ORDER BY name")
+        .all(projectId);
+    const out = [];
+    for (const r of rows) {
+        // Re-validate the name (value decrypt is cheap; skip to keep summary fast).
+        const plaintext = decryptOrPlaintext(r.value);
+        const v = EnvVarSchema.safeParse({
+            name: r.name,
+            value: plaintext,
+            enabled: r.enabled === 1,
+        });
+        if (!v.success) {
+            log.warn("env var row failed schema, skipping", { projectId, name: r.name });
+            continue;
+        }
+        out.push({ name: v.data.name, enabled: v.data.enabled, hasValue: true });
+    }
+    return out;
+}
+// Upsert a var. If value is empty and a row already exists, keep the existing
+// encrypted value (the "leave unchanged" semantics from the panel edit flow).
+export function upsertEnvVar(projectId, name, value, enabled) {
+    const now = Math.floor(Date.now() / 1000);
+    if (value === "") {
+        // Keep existing value, only update enabled + updated_at.
+        const existing = db
+            .prepare("SELECT value FROM project_env_vars WHERE project_id = ? AND name = ?")
+            .get(projectId, name);
+        if (existing) {
+            db.prepare(`INSERT OR REPLACE INTO project_env_vars
+           (project_id, name, value, enabled, created_at, updated_at)
+         VALUES (?, ?, ?, ?,
+           COALESCE((SELECT created_at FROM project_env_vars WHERE project_id = ? AND name = ?), ?),
+           ?)`).run(projectId, name, existing.value, enabled ? 1 : 0, projectId, name, now, now);
+            return;
+        }
+        // No existing row + empty value → store empty string (hasValue will be false
+        // after a re-read since empty value validates fine but is meaningless).
+        // We allow it so the admin can create a placeholder and fill the value
+        // later via another PUT.
+    }
+    const v = EnvVarSchema.safeParse({ name, value, enabled });
+    if (!v.success) {
+        throw new Error("invalid env var");
+    }
+    db.prepare(`INSERT OR REPLACE INTO project_env_vars
+       (project_id, name, value, enabled, created_at, updated_at)
+     VALUES (?, ?, ?, ?, COALESCE((SELECT created_at FROM project_env_vars WHERE project_id = ? AND name = ?), ?), ?)`).run(projectId, name, encrypt(v.data.value), v.data.enabled ? 1 : 0, projectId, name, now, now);
+}
+export function deleteEnvVar(projectId, name) {
+    const r = db
+        .prepare("DELETE FROM project_env_vars WHERE project_id = ? AND name = ?")
+        .run(projectId, name);
+    return r.changes > 0;
+}
+export function deleteAllEnvVars(projectId) {
+    db.prepare("DELETE FROM project_env_vars WHERE project_id = ?").run(projectId);
+}
+// Build the array of enabled env vars the runner injects into container runs.
+// Decrypts + validates each row; disabled or corrupt rows are skipped (never
+// crash a run over one hand-edited DB row).
+export function buildEnvArray(projectId) {
+    const rows = db
+        .prepare("SELECT name, value, enabled FROM project_env_vars WHERE project_id = ? AND enabled = 1 ORDER BY name")
+        .all(projectId);
+    const out = [];
+    for (const r of rows) {
+        const v = rowToEnvVar(projectId, r);
+        if (v && v.enabled)
+            out.push({ name: v.name, value: v.value });
+    }
+    return out;
+}
+//# sourceMappingURL=env-config-store.js.map

package/dist/env-config-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-config-store.js","sourceRoot":"","sources":["../src/env-config-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,YAAY,GAGb,MAAM,uBAAuB,CAAC;AAE/B,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,8BAA8B;AAE9B,MAAM,UAAU,iBAAiB;IAC/B,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;GAUP,CAAC,CAAC;AACL,CAAC;AAID,SAAS,WAAW,CAAC,SAAiB,EAAE,GAAqD;IAC3F,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC;QAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,sFAAsF,CAAC;SAC/F,GAAG,CAAC,SAAS,CAA4D,CAAC;IAC7E,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,sFAAsF,CAAC;SAC/F,GAAG,CAAC,SAAS,CAA4D,CAAC;IAC7E,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,4EAA4E;QAC5E,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC;YAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,IAAY,EAAE,KAAa,EAAE,OAAgB;IAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,yDAAyD;QACzD,MAAM,QAAQ,GAAG,EAAE;aAChB,OAAO,CAAC,sEAAsE,CAAC;aAC/E,GAAG,CAAC,SAAS,EAAE,IAAI,CAAkC,CAAC;QACzD,IAAI,QAAQ,EAAE,CAAC;YACb,EAAE,CAAC,OAAO,CACR;;;;cAIM,CACP,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,6EAA6E;QAC7E,wEAAwE;QACxE,uEAAuE;QACvE,yBAAyB;IAC3B,CAAC;IACD,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IACD,EAAE,CAAC,OAAO,CACR;;sHAEkH,CACnH,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,IAAY;IAC1D,MAAM,CAAC,GAAG,EAAE;SACT,OAAO,CAAC,gEAAgE,CAAC;SACzE,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACjF,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,sGAAsG,CAAC;SAC/G,GAAG,CAAC,SAAS,CAA4D,CAAC;IAC7E,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/error-log-store.js

@@ -0,0 +1,193 @@
+import { db } from "./db.js";
+import { log } from "./logger.js";
+// Persisted record of final run failures across all phases. One row per final
+// failure (retries collapse to the last attempt — the caller records once on a
+// terminal/transient-exhausted return). Retention is age-based: purged at
+// startup and by a daily sweep for ERROR_LOG_RETENTION_DAYS (see lifecycle.ts).
+// Log bodies are redacted by callers and additionally capped here so a runaway
+// container can't bloat the DB. Same DB file as the other stores (devbot.db).
+// Max stored body, in chars. Matches the live-log cap; anything larger is
+// truncated and flagged so the UI can say so.
+export const ERROR_LOG_MAX_CHARS = 200_000;
+export function initErrorLogTables() {
+    // Belt-and-braces: migrations 0007/0010/0011/0025 are authoritative; keep the
+    // idempotent CREATE so a test DB opened without migrate() still works.
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS container_error_logs (
+      id            INTEGER PRIMARY KEY AUTOINCREMENT,
+      task_seq      INTEGER,
+      work_item_id  INTEGER NOT NULL,
+      work_item_iid INTEGER NOT NULL,
+      project_id    INTEGER NOT NULL,
+      mode          TEXT NOT NULL,
+      phase         TEXT NOT NULL,
+      kind          TEXT NOT NULL,
+      exit_code     INTEGER,
+      message       TEXT NOT NULL,
+      logs          TEXT NOT NULL DEFAULT '',
+      truncated     INTEGER NOT NULL DEFAULT 0,
+      created_at    INTEGER NOT NULL,
+      model         TEXT NOT NULL DEFAULT '',
+      variant       TEXT NOT NULL DEFAULT '',
+      work_item_title TEXT NOT NULL DEFAULT '',
+      log_file        TEXT NOT NULL DEFAULT '',
+      run_history_id  INTEGER
+    )
+  `);
+    db.exec("CREATE INDEX IF NOT EXISTS idx_container_error_logs_created ON container_error_logs(created_at)");
+    // A pre-0010 DB lacks model/variant. ADD COLUMN errors if present.
+    try {
+        db.exec("ALTER TABLE container_error_logs ADD COLUMN model TEXT NOT NULL DEFAULT ''");
+    }
+    catch { /* exists */ }
+    try {
+        db.exec("ALTER TABLE container_error_logs ADD COLUMN variant TEXT NOT NULL DEFAULT ''");
+    }
+    catch { /* exists */ }
+    // A pre-0011 DB lacks work_item_title. ADD COLUMN errors if present.
+    try {
+        db.exec("ALTER TABLE container_error_logs ADD COLUMN work_item_title TEXT NOT NULL DEFAULT ''");
+    }
+    catch { /* exists */ }
+    // A pre-0025 DB lacks the run-log file reference. ADD COLUMN errors if present.
+    try {
+        db.exec("ALTER TABLE container_error_logs ADD COLUMN log_file TEXT NOT NULL DEFAULT ''");
+    }
+    catch { /* exists */ }
+    try {
+        db.exec("ALTER TABLE container_error_logs ADD COLUMN run_history_id INTEGER");
+    }
+    catch { /* exists */ }
+}
+function escLike(term) {
+    return term.replace(/[\\%_]/g, (ch) => `\\${ch}`);
+}
+function buildErrorWhere(filter) {
+    if (!filter)
+        return { sql: "", params: [] };
+    const clauses = [];
+    const params = [];
+    if (filter.projectId !== undefined) {
+        clauses.push("project_id = ?");
+        params.push(filter.projectId);
+    }
+    if (filter.model !== undefined) {
+        clauses.push("model = ?");
+        params.push(filter.model);
+    }
+    if (filter.mode !== undefined) {
+        clauses.push("mode = ?");
+        params.push(filter.mode);
+    }
+    if (filter.title !== undefined) {
+        clauses.push("work_item_title LIKE ? ESCAPE '\\'");
+        params.push(`%${escLike(filter.title)}%`);
+    }
+    if (filter.sinceSec !== undefined) {
+        clauses.push("created_at >= ?");
+        params.push(filter.sinceSec);
+    }
+    if (filter.untilSec !== undefined) {
+        clauses.push("created_at < ?");
+        params.push(filter.untilSec);
+    }
+    return { sql: clauses.length > 0 ? ` WHERE ${clauses.join(" AND ")}` : "", params };
+}
+function capLogs(logs) {
+    if (logs.length <= ERROR_LOG_MAX_CHARS)
+        return { logs, truncated: false };
+    return { logs: logs.slice(0, ERROR_LOG_MAX_CHARS) + "\n…[truncated]", truncated: true };
+}
+export function recordErrorLog(input) {
+    const capped = capLogs(input.logs);
+    const truncated = input.truncated || capped.truncated;
+    const now = Math.floor(Date.now() / 1000);
+    const r = db
+        .prepare(`INSERT INTO container_error_logs
+         (task_seq, work_item_id, work_item_iid, project_id, mode, phase, kind, exit_code, message, logs, truncated, created_at, model, variant, work_item_title, log_file, run_history_id)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(input.taskSeq, input.workItemId, input.workItemNumber, input.projectId, input.mode, input.phase, input.kind, input.exitCode, input.message, capped.logs, truncated ? 1 : 0, now, input.model ?? "", input.variant ?? "", input.workItemTitle ?? "", input.logFile ?? "", input.runHistoryId ?? null);
+    return Number(r.lastInsertRowid);
+}
+function toSummary(r) {
+    return {
+        id: r.id,
+        taskSeq: r.task_seq,
+        workItemId: r.work_item_id,
+        workItemIid: r.work_item_iid,
+        projectId: r.project_id,
+        mode: r.mode,
+        phase: r.phase,
+        kind: r.kind,
+        exitCode: r.exit_code,
+        message: r.message,
+        truncated: r.truncated === 1,
+        createdAt: r.created_at,
+        model: r.model,
+        variant: r.variant,
+        workItemTitle: r.work_item_title,
+        logFile: r.log_file,
+        runHistoryId: r.run_history_id,
+    };
+}
+// Newest first. Omits `logs` so the list payload stays small. Optional
+// limit/offset for the WebUI pager, plus optional server-side filters.
+export function listErrorLogs(limit, offset, filter) {
+    const { sql: where, params } = buildErrorWhere(filter);
+    const sql = `SELECT id, task_seq, work_item_id, work_item_iid, project_id, mode, phase, kind, exit_code, message, truncated, created_at, model, variant, work_item_title, log_file, run_history_id
+     FROM container_error_logs${where} ORDER BY id DESC` +
+        (limit === undefined ? "" : " LIMIT ? OFFSET ?");
+    const args = limit === undefined ? params : [...params, limit, offset ?? 0];
+    const rows = db.prepare(sql).all(...args);
+    return rows.map(toSummary);
+}
+export function countErrorLogs(filter) {
+    const { sql: where, params } = buildErrorWhere(filter);
+    const row = db.prepare(`SELECT COUNT(*) AS c FROM container_error_logs${where}`).get(...params);
+    return row.c;
+}
+// Distinct filter values across all rows, ignoring any active filter, so a
+// selected value can always be cleared again.
+export function listErrorLogFilterOptions() {
+    const rows = db
+        .prepare("SELECT DISTINCT project_id, model, mode FROM container_error_logs")
+        .all();
+    const projects = new Set();
+    const models = new Set();
+    const modes = new Set();
+    for (const r of rows) {
+        projects.add(r.project_id);
+        models.add(r.model);
+        modes.add(r.mode);
+    }
+    return {
+        projects: [...projects].sort((a, b) => a - b),
+        models: [...models].sort(),
+        modes: [...modes].sort(),
+    };
+}
+export function getErrorLog(id) {
+    const row = db
+        .prepare(`SELECT id, task_seq, work_item_id, work_item_iid, project_id, mode, phase, kind, exit_code, message, truncated, created_at, model, variant, work_item_title, log_file, run_history_id, logs
+       FROM container_error_logs WHERE id = ?`)
+        .get(id);
+    if (!row)
+        return null;
+    return { ...toSummary(row), logs: row.logs };
+}
+// Delete every error log. Returns the number of rows removed. Manual "Clear"
+// from the WebUI; the age-based retention purge is separate.
+export function clearErrorLogs() {
+    const r = db.prepare("DELETE FROM container_error_logs").run();
+    if (r.changes > 0)
+        log.info("error logs cleared", { cleared: r.changes });
+    return Number(r.changes);
+}
+export function purgeErrorLogsOlderThan(days) {
+    const cutoff = Math.floor(Date.now() / 1000) - days * 24 * 3600;
+    const r = db.prepare("DELETE FROM container_error_logs WHERE created_at < ?").run(cutoff);
+    if (r.changes > 0)
+        log.debug("error log purge", { purged: r.changes, days });
+    return Number(r.changes);
+}
+//# sourceMappingURL=error-log-store.js.map

package/dist/error-log-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-log-store.js","sourceRoot":"","sources":["../src/error-log-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,8EAA8E;AAC9E,+EAA+E;AAC/E,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAE5E,0EAA0E;AAC1E,8CAA8C;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C,MAAM,UAAU,kBAAkB;IAChC,8EAA8E;IAC9E,uEAAuE;IACvE,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;GAqBP,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;IAC3G,mEAAmE;IACnE,IAAI,CAAC;QAAC,EAAE,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACrH,IAAI,CAAC;QAAC,EAAE,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACvH,qEAAqE;IACrE,IAAI,CAAC;QAAC,EAAE,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/H,gFAAgF;IAChF,IAAI,CAAC;QAAC,EAAE,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACxH,IAAI,CAAC;QAAC,EAAE,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;AAC/G,CAAC;AA0ED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,MAAuB;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IACtG,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IACzF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACtF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAClI,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IACrG,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IACpG,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,IAAI,CAAC,MAAM,IAAI,mBAAmB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC1E,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,GAAG,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,EAAE;SACT,OAAO,CACN;;kEAE4D,CAC7D;SACA,GAAG,CACF,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,OAAO,EACb,MAAM,CAAC,IAAI,EACX,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACjB,GAAG,EACH,KAAK,CAAC,KAAK,IAAI,EAAE,EACjB,KAAK,CAAC,OAAO,IAAI,EAAE,EACnB,KAAK,CAAC,aAAa,IAAI,EAAE,EACzB,KAAK,CAAC,OAAO,IAAI,EAAE,EACnB,KAAK,CAAC,YAAY,IAAI,IAAI,CAC3B,CAAC;IACJ,OAAO,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC;AAsBD,SAAS,SAAS,CAAC,CAAe;IAChC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,UAAU,EAAE,CAAC,CAAC,YAAY;QAC1B,WAAW,EAAE,CAAC,CAAC,aAAa;QAC5B,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,CAAC;QAC5B,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,aAAa,EAAE,CAAC,CAAC,eAAe;QAChC,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,YAAY,EAAE,CAAC,CAAC,cAAc;KAC/B,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,MAAe,EAAE,MAAuB;IACpF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GACP;gCAC4B,KAAK,mBAAmB;QACpD,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAA8B,CAAC;IACvE,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAuB;IACpD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,iDAAiD,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAkB,CAAC;IACjH,OAAO,GAAG,CAAC,CAAC,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,8CAA8C;AAC9C,MAAM,UAAU,yBAAyB;IACvC,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,mEAAmE,CAAC;SAC5E,GAAG,EAAgE,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE;QAC1B,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN;8CACwC,CACzC;SACA,GAAG,CAAC,EAAE,CAA6D,CAAC;IACvE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED,6EAA6E;AAC7E,6DAA6D;AAC7D,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/D,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC;IAChE,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC;QAAE,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC"}