@with-logic/elwood 0.1.0

package/dist/codex/clipboard.js

@@ -0,0 +1,92 @@
+/**
+ * macOS clipboard save / set-image / restore for Codex image attachment. Codex
+ * ingests an interactive image only from the OS clipboard (it reads `public.tiff`
+ * off `NSPasteboard`), so Elwood writes the image there, triggers a paste, then
+ * restores the user's prior clipboard TEXT (only text is snapshotted). Async (never blocks the event loop) and
+ * Codex-local, since this is Codex/macOS-specific mechanics. Implements PRD §5.3
+ * (C-API-46).
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { elwoodError } from "../core/errors.js";
+import { currentPlatform } from "../runtime/seams.js";
+const run = promisify(execFile);
+const OSASCRIPT = "/usr/bin/osascript";
+const PBPASTE = "/usr/bin/pbpaste";
+const PBCOPY = "/usr/bin/pbcopy";
+// JXA hosting AppKit: load the file as an NSImage and lay it on the pasteboard
+// with writeObjects, which writes the canonical `public.tiff` representation the
+// `arboard` reader Codex uses expects. A bare JS array becomes an NSDictionary
+// under the bridge and is rejected, so the image is wrapped in a real NSArray.
+const SET_IMAGE_JXA = 'function run(argv){ObjC.import("AppKit");' +
+    "var img=$.NSImage.alloc.initWithContentsOfFile(argv[0]);" +
+    'if(!img||img.isNil())throw new Error("image load failed");' +
+    "var pb=$.NSPasteboard.generalPasteboard;pb.clearContents;" +
+    "if(!pb.writeObjects($.NSArray.arrayWithObject(img)))" +
+    'throw new Error("clipboard write failed");return "ok";}';
+/** Canonical, content-free copy for the clipboard-restore-failed warning (C-API-46). */
+export const CLIPBOARD_RESTORE_FAILED_MESSAGE = "Elwood could not restore the clipboard after attaching an image.";
+/** True only on macOS, where the NSPasteboard-backed attach path is available. */
+export function clipboardImageSupported() {
+    return currentPlatform() === "darwin";
+}
+/**
+ * The current clipboard text. Rejects with `image_attach_failed` when `pbpaste`
+ * fails, so the caller can abort BEFORE mutating the clipboard rather than later
+ * "restoring" an empty string over the user's real clipboard (C-API-46).
+ */
+export async function snapshotClipboardText() {
+    try {
+        const { stdout } = await run(PBPASTE, [], { timeout: 5_000, encoding: "utf8" });
+        return stdout;
+    }
+    catch (error) {
+        throw elwoodError("image_attach_failed", "Could not read the clipboard.", {
+            cause: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+/**
+ * Restores clipboard text captured by `snapshotClipboardText` (best-effort).
+ * Returns whether the restore succeeded, so the caller can surface a content-free
+ * warning if the user's prior clipboard may have been lost (C-API-46).
+ */
+export async function restoreClipboardText(text) {
+    try {
+        const child = run(PBCOPY, [], { timeout: 5_000 });
+        child.child.stdin?.end(text); // inside try so a synchronous spawn/stdin failure can't escape
+        await child;
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Writes the image file at `path` onto the macOS clipboard as a native image.
+ * A file the decoder cannot load is a bad INPUT → `invalid_image`; a pasteboard
+ * write failure, process failure, or timeout is an OS/attach failure →
+ * `image_attach_failed`. Either way the caller aborts before pasting (C-API-46).
+ */
+export async function setClipboardImage(path) {
+    try {
+        await run(OSASCRIPT, ["-l", "JavaScript", "-e", SET_IMAGE_JXA, path], { timeout: 10_000 });
+    }
+    catch (error) {
+        const reason = clipboardErrorReason(error);
+        // The JXA throws "image load failed" only when NSImage cannot decode the file.
+        const code = /image load failed/i.test(reason) ? "invalid_image" : "image_attach_failed";
+        throw elwoodError(code, `Could not place image on clipboard: ${reason}`, { path });
+    }
+}
+function clipboardErrorReason(error) {
+    if (error && typeof error === "object") {
+        const { stderr, message } = error;
+        if (typeof stderr === "string" && stderr.trim())
+            return stderr.trim();
+        if (typeof message === "string" && message.trim())
+            return message.trim();
+    }
+    return "clipboard image write failed";
+}
+//# sourceMappingURL=clipboard.js.map

package/dist/codex/clipboard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clipboard.js","sourceRoot":"","sources":["../../src/codex/clipboard.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC,MAAM,SAAS,GAAG,oBAAoB,CAAC;AACvC,MAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAEjC,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,aAAa,GACjB,2CAA2C;IAC3C,0DAA0D;IAC1D,4DAA4D;IAC5D,2DAA2D;IAC3D,sDAAsD;IACtD,yDAAyD,CAAC;AAE5D,wFAAwF;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAC3C,kEAAkE,CAAC;AAErE,kFAAkF;AAClF,MAAM,UAAU,uBAAuB;IACrC,OAAO,eAAe,EAAE,KAAK,QAAQ,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,qBAAqB,EAAE,+BAA+B,EAAE;YACxE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,+DAA+D;QAC7F,MAAM,KAAK,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC3C,+EAA+E;QAC/E,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC;QACzF,MAAM,WAAW,CAAC,IAAI,EAAE,uCAAuC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAgD,CAAC;QAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;YAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,8BAA8B,CAAC;AACxC,CAAC"}

package/dist/codex/command.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Builds shell commands used to launch interactive Codex.
+ * Implements PRD §4.2, §4.4, and §9.1.
+ */
+import type { SessionRecord } from "../state/store.ts";
+import type { CodexCliCapabilities } from "./preflight.ts";
+import type { StartCodexOptions } from "./session/types.ts";
+export declare function buildCodexShellCommand(record: SessionRecord, bridgeScriptPath: string, options: StartCodexOptions, capabilities?: CodexCliCapabilities): string;
+//# sourceMappingURL=command.d.ts.map

package/dist/codex/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/codex/command.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,EACrB,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,iBAAiB,EAC1B,YAAY,GAAE,oBAAwD,GACrE,MAAM,CAuBR"}

package/dist/codex/command.js

@@ -0,0 +1,72 @@
+/**
+ * Builds shell commands used to launch interactive Codex.
+ * Implements PRD §4.2, §4.4, and §9.1.
+ */
+import { hookCommand } from "../runtime/hook-command.js";
+import { shellQuote } from "../runtime/shell.js";
+import { codexHookEventNames } from "./hooks/index.js";
+export function buildCodexShellCommand(record, bridgeScriptPath, options, capabilities = { supportsHookTrustBypass: true }) {
+    const parts = record.codex.resumeId
+        ? ["exec", "codex", "resume", shellQuote(record.codex.resumeId)]
+        : ["exec", "codex"];
+    addLaunchFlags(parts, options);
+    parts.push("--cd", shellQuote(record.cwd));
+    if (capabilities.supportsHookTrustBypass) {
+        parts.push("--dangerously-bypass-hook-trust");
+    }
+    // Elwood's `hooks.*` overrides precede the caller's `configOverrides` by design: a
+    // caller may override (or disable) the bridge hooks, which PRD §4.4 permits.
+    for (const override of hookOverrides(bridgeScriptPath, options))
+        parts.push("-c", shellQuote(override));
+    for (const override of options.configOverrides ?? [])
+        parts.push("-c", shellQuote(override));
+    // Reasoning effort is validated before spawn (C-CODEX-21) and applied AFTER caller
+    // overrides so it wins over a hand-rolled `model_reasoning_effort` duplicate. Emitted
+    // as a bare TOML string value; the enum members contain no TOML-special characters.
+    if (options.reasoningEffort) {
+        parts.push("-c", shellQuote(`model_reasoning_effort="${options.reasoningEffort}"`));
+    }
+    parts.push("-c", shellQuote("features.hooks=true"));
+    parts.push("-c", shellQuote('hookTrust="trust-all"'));
+    return parts.join(" ");
+}
+function addLaunchFlags(parts, options) {
+    if (options.model)
+        parts.push("--model", shellQuote(options.model));
+    if (options.profile)
+        parts.push("--profile", shellQuote(options.profile));
+    if (options.sandbox)
+        parts.push("--sandbox", shellQuote(options.sandbox));
+    if (options.approvalPolicy) {
+        parts.push("--ask-for-approval", shellQuote(options.approvalPolicy));
+    }
+}
+/**
+ * Seconds of slack added to the CLI-side hook timeout beyond Elwood's fail-open
+ * deadline. Codex starts its clock when it SPAWNS the hook, before the bridge has
+ * connected and Elwood's own timer has started, so an identical value would let
+ * Codex kill the hook just before Elwood's fail-open no-decision response arrives.
+ */
+const cliHookTimeoutSlackSeconds = 5;
+function hookOverrides(bridgeScriptPath, options) {
+    const timeout = Math.ceil((options.hookTimeoutMs ?? 25_000) / 1000) + cliHookTimeoutSlackSeconds;
+    return codexHookEventNames.map((eventName) => {
+        const command = hookCommand(bridgeScriptPath);
+        const hook = `{type="command",command=${tomlString(command)},timeout=${timeout}}`;
+        const group = `{matcher=${tomlString(matcherFor(eventName))},hooks=[${hook}]}`;
+        return `hooks.${eventName}=[${group}]`;
+    });
+}
+function matcherFor(eventName) {
+    if (eventName === "UserPromptSubmit" || eventName === "Stop")
+        return "";
+    if (eventName === "SessionStart")
+        return "startup|resume|clear|compact";
+    if (eventName === "PreCompact" || eventName === "PostCompact")
+        return "manual|auto";
+    return "*";
+}
+function tomlString(value) {
+    return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+//# sourceMappingURL=command.js.map

package/dist/codex/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../src/codex/command.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAIvD,MAAM,UAAU,sBAAsB,CACpC,MAAqB,EACrB,gBAAwB,EACxB,OAA0B,EAC1B,eAAqC,EAAE,uBAAuB,EAAE,IAAI,EAAE;IAEtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ;QACjC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtB,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,YAAY,CAAC,uBAAuB,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAChD,CAAC;IACD,mFAAmF;IACnF,6EAA6E;IAC7E,KAAK,MAAM,QAAQ,IAAI,aAAa,CAAC,gBAAgB,EAAE,OAAO,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,eAAe,IAAI,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7F,mFAAmF;IACnF,sFAAsF;IACtF,oFAAoF;IACpF,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,2BAA2B,OAAO,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,cAAc,CAAC,KAAe,EAAE,OAA0B;IACjE,IAAI,OAAO,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,SAAS,aAAa,CAAC,gBAAwB,EAAE,OAA0B;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,0BAA0B,CAAC;IACjG,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,2BAA2B,UAAU,CAAC,OAAO,CAAC,YAAY,OAAO,GAAG,CAAC;QAClF,MAAM,KAAK,GAAG,YAAY,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC;QAC/E,OAAO,SAAS,SAAS,KAAK,KAAK,GAAG,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB;IACnC,IAAI,SAAS,KAAK,kBAAkB,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IACxE,IAAI,SAAS,KAAK,cAAc;QAAE,OAAO,8BAA8B,CAAC;IACxE,IAAI,SAAS,KAAK,YAAY,IAAI,SAAS,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;AACtE,CAAC"}

package/dist/codex/config/lock.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Process-wide async mutex for the Codex `config.toml`. The file is a single
+ * process-global resource, but Elwood sessions serialize only per-session, so
+ * two concurrent `setModel` switches could interleave their snapshot / picker /
+ * compare-and-swap restore transactions on the shared file and leave the wrong
+ * model persisted as the user's default. This serializes the whole transaction
+ * across all sessions in the process. Mirrors clipboard-lock.ts and implements
+ * PRD §5.3 setModel restore and C-CODEX-14.
+ *
+ * SCOPE: this lock is PROCESS-LOCAL. Two separate Elwood processes sharing one
+ * `config.toml` can still interleave their transactions — an accepted current
+ * limitation (the compare-and-swap still refuses to clobber an unrelated edit).
+ * Closing it needs an inter-process lock on the resolved path and is separate work.
+ */
+/**
+ * Runs `task` while holding the config lock: each caller waits for the prior
+ * holder to finish before starting, and the lock is released when `task`
+ * settles (success or failure), so a failing switch never wedges the queue.
+ */
+export declare const withCodexConfigLock: import("../../core/async-mutex.ts").AsyncMutex;
+//# sourceMappingURL=lock.d.ts.map

package/dist/codex/config/lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../../src/codex/config/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,gDAAqB,CAAC"}

package/dist/codex/config/lock.js

@@ -0,0 +1,22 @@
+/**
+ * Process-wide async mutex for the Codex `config.toml`. The file is a single
+ * process-global resource, but Elwood sessions serialize only per-session, so
+ * two concurrent `setModel` switches could interleave their snapshot / picker /
+ * compare-and-swap restore transactions on the shared file and leave the wrong
+ * model persisted as the user's default. This serializes the whole transaction
+ * across all sessions in the process. Mirrors clipboard-lock.ts and implements
+ * PRD §5.3 setModel restore and C-CODEX-14.
+ *
+ * SCOPE: this lock is PROCESS-LOCAL. Two separate Elwood processes sharing one
+ * `config.toml` can still interleave their transactions — an accepted current
+ * limitation (the compare-and-swap still refuses to clobber an unrelated edit).
+ * Closing it needs an inter-process lock on the resolved path and is separate work.
+ */
+import { createAsyncMutex } from "../../core/async-mutex.js";
+/**
+ * Runs `task` while holding the config lock: each caller waits for the prior
+ * holder to finish before starting, and the lock is released when `task`
+ * settles (success or failure), so a failing switch never wedges the queue.
+ */
+export const withCodexConfigLock = createAsyncMutex();
+//# sourceMappingURL=lock.js.map

package/dist/codex/config/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/codex/config/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,EAAE,CAAC"}

package/dist/codex/config/restore.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Compensates the Codex CLI persisting picker selections into config.toml.
+ * Implements PRD §5.3 setModel restore and C-CODEX-14: a compare-and-swap restore
+ * of the user's global config that never clobbers concurrent edits, written
+ * atomically (sibling temp file + rename) so a crash mid-restore can never leave
+ * the user's config truncated.
+ */
+/**
+ * `restored`: the snapshot was written back. `unchanged`: the picker wrote nothing.
+ * `skipped`: the file changed in ways other than the root model keys (or vanished),
+ * so it was left alone. `no_snapshot`: no config.toml existed before the switch and
+ * the picker created one — Elwood has nothing to restore and leaves the new file.
+ */
+type ConfigRestoreOutcome = "restored" | "skipped" | "unchanged" | "no_snapshot";
+export declare function codexConfigPath(): string;
+/**
+ * Builds the CONTENT-FREE `raw` for a swallowed restore-failure warning: the config
+ * path plus a bounded errno code only — never the error message, which could carry
+ * credentials or conversation data if the failure came from a public listener.
+ */
+export declare function restoreFailureRaw(path: string, error: unknown): string;
+export declare function snapshotCodexConfig(): string | undefined;
+/**
+ * Restores the snapshot if and only if the file now differs solely in the
+ * root-level model keys the picker writes. Anything else — a concurrent user
+ * edit, an unexpected rewrite — skips the restore so user-owned configuration is
+ * never clobbered. With no snapshot (no config.toml before the switch) a file the
+ * picker created is reported as `no_snapshot` rather than misreported as a
+ * concurrent edit.
+ */
+export declare function restoreCodexConfig(snapshot: string | undefined): ConfigRestoreOutcome;
+export {};
+//# sourceMappingURL=restore.d.ts.map

package/dist/codex/config/restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../../../src/codex/config/restore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH;;;;;GAKG;AACH,KAAK,oBAAoB,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAEjF,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtE;AAED,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAGxD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,oBAAoB,CAUrF"}

package/dist/codex/config/restore.js

@@ -0,0 +1,90 @@
+/**
+ * Compensates the Codex CLI persisting picker selections into config.toml.
+ * Implements PRD §5.3 setModel restore and C-CODEX-14: a compare-and-swap restore
+ * of the user's global config that never clobbers concurrent edits, written
+ * atomically (sibling temp file + rename) so a crash mid-restore can never leave
+ * the user's config truncated.
+ */
+import { chmodSync, existsSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { errnoCode } from "../../core/errors.js";
+export function codexConfigPath() {
+    return join(process.env["CODEX_HOME"] ?? join(homedir(), ".codex"), "config.toml");
+}
+/**
+ * Builds the CONTENT-FREE `raw` for a swallowed restore-failure warning: the config
+ * path plus a bounded errno code only — never the error message, which could carry
+ * credentials or conversation data if the failure came from a public listener.
+ */
+export function restoreFailureRaw(path, error) {
+    return `${path} (${errnoCode(error) ?? "UNKNOWN"})`;
+}
+export function snapshotCodexConfig() {
+    const path = codexConfigPath();
+    return existsSync(path) ? readFileSync(path, "utf8") : undefined;
+}
+/**
+ * Restores the snapshot if and only if the file now differs solely in the
+ * root-level model keys the picker writes. Anything else — a concurrent user
+ * edit, an unexpected rewrite — skips the restore so user-owned configuration is
+ * never clobbered. With no snapshot (no config.toml before the switch) a file the
+ * picker created is reported as `no_snapshot` rather than misreported as a
+ * concurrent edit.
+ */
+export function restoreCodexConfig(snapshot) {
+    const path = codexConfigPath();
+    const exists = existsSync(path);
+    if (snapshot === undefined)
+        return exists ? "no_snapshot" : "unchanged";
+    if (!exists)
+        return "skipped";
+    const current = readFileSync(path, "utf8");
+    if (current === snapshot)
+        return "unchanged";
+    if (withoutRootModelKeys(current) !== withoutRootModelKeys(snapshot))
+        return "skipped";
+    writeAtomically(path, snapshot);
+    return "restored";
+}
+/**
+ * Replaces `path` via a sibling temp file + rename so the config is never observed
+ * empty or partial. A symlinked config.toml is written THROUGH to its resolved
+ * target (renaming onto the link path would replace the link itself), and the
+ * target's mode is preserved. The temp file is removed on any failure.
+ */
+function writeAtomically(path, contents) {
+    const target = realpathSync(path);
+    const temp = join(dirname(target), `.config.toml.elwood-${process.pid}-${Date.now()}`);
+    try {
+        writeFileSync(temp, contents, { mode: 0o600 });
+        chmodSync(temp, statSync(target).mode & 0o777);
+        renameSync(temp, target);
+    }
+    catch (error) {
+        try {
+            unlinkSync(temp);
+        }
+        catch { } // best-effort cleanup; the original write error is the one that surfaces
+        throw error;
+    }
+}
+/**
+ * Strips `model` / `model_reasoning_effort` assignments from the root region
+ * only. TOML requires root keys to precede the first table header, so keys of
+ * the same name inside tables (for example profiles) are left untouched.
+ */
+function withoutRootModelKeys(text) {
+    const lines = text.split("\n");
+    const kept = [];
+    let inRoot = true;
+    for (const line of lines) {
+        if (inRoot && /^\s*\[/.test(line))
+            inRoot = false;
+        if (inRoot && /^\s*(model|model_reasoning_effort)\s*=/.test(line))
+            continue;
+        kept.push(line);
+    }
+    return kept.join("\n");
+}
+//# sourceMappingURL=restore.js.map

package/dist/codex/config/restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../../src/codex/config/restore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAUjD,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAc;IAC5D,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,GAAG,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA4B;IAC7D,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IACxE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IAC7C,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,oBAAoB,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACvF,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACrD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,uBAAuB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC,CAAC,yEAAyE;QACpF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC;QAClD,IAAI,MAAM,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/dist/codex/config/transaction.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The Codex setModel config transaction: snapshot → drive the picker → restore,
+ * all under the process-wide config lock. Factored out of session-instance so
+ * every branch (switch succeeds/rejects × restore succeeds/throws) is unit
+ * testable without a live session. Implements PRD §5.3 setModel restore and
+ * C-CODEX-14 (a late picker rejection must still restore, and a restore failure
+ * must never mask the primary automation error).
+ */
+type CodexModelSwitch = {
+    /** Reads the current config.toml so it can be restored after the switch. */
+    readonly snapshot: () => string | undefined;
+    /** Drives the picker; rejects if the CLI automation fails or times out. */
+    readonly apply: () => Promise<void>;
+    /** Compare-and-swap restore of the snapshot; may warn but should not throw. */
+    readonly restore: (snapshot: string | undefined) => void;
+    /**
+     * Reports a restore failure that had to be SWALLOWED because a primary error is
+     * being preserved (both the picker and the restore failed). Without this the user
+     * would get no signal that their global config.toml may remain mutated. Optional;
+     * omitted in tests that don't assert the diagnostic.
+     */
+    readonly onRestoreError?: (error: unknown) => void;
+};
+export declare function runCodexModelSwitch(io: CodexModelSwitch): Promise<void>;
+export {};
+//# sourceMappingURL=transaction.d.ts.map

package/dist/codex/config/transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction.d.ts","sourceRoot":"","sources":["../../../src/codex/config/transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,KAAK,gBAAgB,GAAG;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC5C,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IACzD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BvE"}

package/dist/codex/config/transaction.js

@@ -0,0 +1,47 @@
+/**
+ * The Codex setModel config transaction: snapshot → drive the picker → restore,
+ * all under the process-wide config lock. Factored out of session-instance so
+ * every branch (switch succeeds/rejects × restore succeeds/throws) is unit
+ * testable without a live session. Implements PRD §5.3 setModel restore and
+ * C-CODEX-14 (a late picker rejection must still restore, and a restore failure
+ * must never mask the primary automation error).
+ */
+import { withCodexConfigLock } from "./lock.js";
+export function runCodexModelSwitch(io) {
+    return withCodexConfigLock(async () => {
+        const snapshot = io.snapshot();
+        let primary;
+        let failed = false;
+        try {
+            await io.apply();
+        }
+        catch (error) {
+            failed = true;
+            primary = error;
+        }
+        // Restore whether or not the switch rejected, so a late picker timeout that
+        // fired AFTER Codex wrote config.toml still restores the user's default.
+        try {
+            io.restore(snapshot);
+        }
+        catch (restoreError) {
+            // When the switch succeeded, a restore failure surfaces on its own. When a
+            // primary error is being preserved we cannot also throw the restore failure,
+            // but it must NOT vanish — report it so the user learns config.toml may still
+            // be mutated (the alternative, silently dropping it, was the bug). The report
+            // is CONTAINED here: a throwing reporter must never replace the primary error
+            // this function guarantees to preserve.
+            if (!failed)
+                throw restoreError;
+            try {
+                io.onRestoreError?.(restoreError);
+            }
+            catch {
+                // A throwing reporter must not replace the primary error we preserve below.
+            }
+        }
+        if (failed)
+            throw primary;
+    });
+}
+//# sourceMappingURL=transaction.js.map

package/dist/codex/config/transaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction.js","sourceRoot":"","sources":["../../../src/codex/config/transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAkBhD,MAAM,UAAU,mBAAmB,CAAC,EAAoB;IACtD,OAAO,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAgB,CAAC;QACrB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAAC;YACH,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,2EAA2E;YAC3E,6EAA6E;YAC7E,8EAA8E;YAC9E,8EAA8E;YAC9E,8EAA8E;YAC9E,wCAAwC;YACxC,IAAI,CAAC,MAAM;gBAAE,MAAM,YAAY,CAAC;YAChC,IAAI,CAAC;gBACH,EAAE,CAAC,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,4EAA4E;YAC9E,CAAC;QACH,CAAC;QACD,IAAI,MAAM;YAAE,MAAM,OAAO,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/codex/config-lock.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Process-wide async mutex for the Codex `config.toml`. The file is a single
+ * process-global resource, but Elwood sessions serialize only per-session, so
+ * two concurrent `setModel` switches could interleave their snapshot / picker /
+ * compare-and-swap restore transactions on the shared file and leave the wrong
+ * model persisted as the user's default. This serializes the whole transaction
+ * across all sessions in the process. Mirrors clipboard-lock.ts and implements
+ * PRD §5.3 setModel restore and C-CODEX-14.
+ *
+ * SCOPE: this lock is PROCESS-LOCAL. Two separate Elwood processes sharing one
+ * `config.toml` can still interleave their transactions — an accepted current
+ * limitation (the compare-and-swap still refuses to clobber an unrelated edit).
+ * Closing it needs an inter-process lock on the resolved path and is separate work.
+ */
+/**
+ * Runs `task` while holding the config lock: each caller waits for the prior
+ * holder to finish before starting, and the lock is released when `task`
+ * settles (success or failure), so a failing switch never wedges the queue.
+ */
+export declare const withCodexConfigLock: import("../core/async-mutex.ts").AsyncMutex;
+//# sourceMappingURL=config-lock.d.ts.map

package/dist/codex/config-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-lock.d.ts","sourceRoot":"","sources":["../../src/codex/config-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,6CAAqB,CAAC"}

package/dist/codex/config-lock.js

@@ -0,0 +1,22 @@
+/**
+ * Process-wide async mutex for the Codex `config.toml`. The file is a single
+ * process-global resource, but Elwood sessions serialize only per-session, so
+ * two concurrent `setModel` switches could interleave their snapshot / picker /
+ * compare-and-swap restore transactions on the shared file and leave the wrong
+ * model persisted as the user's default. This serializes the whole transaction
+ * across all sessions in the process. Mirrors clipboard-lock.ts and implements
+ * PRD §5.3 setModel restore and C-CODEX-14.
+ *
+ * SCOPE: this lock is PROCESS-LOCAL. Two separate Elwood processes sharing one
+ * `config.toml` can still interleave their transactions — an accepted current
+ * limitation (the compare-and-swap still refuses to clobber an unrelated edit).
+ * Closing it needs an inter-process lock on the resolved path and is separate work.
+ */
+import { createAsyncMutex } from "../core/async-mutex.js";
+/**
+ * Runs `task` while holding the config lock: each caller waits for the prior
+ * holder to finish before starting, and the lock is released when `task`
+ * settles (success or failure), so a failing switch never wedges the queue.
+ */
+export const withCodexConfigLock = createAsyncMutex();
+//# sourceMappingURL=config-lock.js.map

package/dist/codex/config-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-lock.js","sourceRoot":"","sources":["../../src/codex/config-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,EAAE,CAAC"}

package/dist/codex/config-restore.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Compensates the Codex CLI persisting picker selections into config.toml.
+ * Implements PRD §5.3 setModel restore and C-CODEX-14: a compare-and-swap restore
+ * of the user's global config that never clobbers concurrent edits, written
+ * atomically (sibling temp file + rename) so a crash mid-restore can never leave
+ * the user's config truncated.
+ */
+/**
+ * `restored`: the snapshot was written back. `unchanged`: the picker wrote nothing.
+ * `skipped`: the file changed in ways other than the root model keys (or vanished),
+ * so it was left alone. `no_snapshot`: no config.toml existed before the switch and
+ * the picker created one — Elwood has nothing to restore and leaves the new file.
+ */
+type ConfigRestoreOutcome = "restored" | "skipped" | "unchanged" | "no_snapshot";
+export declare function codexConfigPath(): string;
+/**
+ * Builds the CONTENT-FREE `raw` for a swallowed restore-failure warning: the config
+ * path plus a bounded errno code only — never the error message, which could carry
+ * credentials or conversation data if the failure came from a public listener.
+ */
+export declare function restoreFailureRaw(path: string, error: unknown): string;
+export declare function snapshotCodexConfig(): string | undefined;
+/**
+ * Restores the snapshot if and only if the file now differs solely in the
+ * root-level model keys the picker writes. Anything else — a concurrent user
+ * edit, an unexpected rewrite — skips the restore so user-owned configuration is
+ * never clobbered. With no snapshot (no config.toml before the switch) a file the
+ * picker created is reported as `no_snapshot` rather than misreported as a
+ * concurrent edit.
+ */
+export declare function restoreCodexConfig(snapshot: string | undefined): ConfigRestoreOutcome;
+export {};
+//# sourceMappingURL=config-restore.d.ts.map

package/dist/codex/config-restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-restore.d.ts","sourceRoot":"","sources":["../../src/codex/config-restore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH;;;;;GAKG;AACH,KAAK,oBAAoB,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAEjF,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtE;AAED,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAGxD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,oBAAoB,CAUrF"}