@wrongstack/cli 0.295.0 → 0.296.2

package/dist/acp-A5OSIU2P.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/subcommands/handlers/acp.ts", "../src/acp-server-agent.ts"],
+  "sourcesContent": ["/**\n * ACP CLI integration.\n *\n * `wstack acp`                  \u2014 start WrongStack as an ACP server (blocks)\n * `wstack acp list`             \u2014 list ACP agents installed on $PATH\n * `wstack acp spawn <id> <task>`      \u2014 run a task on one named ACP agent\n * `wstack acp parallel <csv> <task>`  \u2014 fan a task out to multiple agents\n *\n * DIR-2: `wstack acp` runs WrongStack as a standard-compliant ACP agent.\n * ACP clients (Zed, JetBrains, VS Code ACP extension) spawn it as a subprocess.\n * This is the correct CLI entry point to test DIR-2 against a real ACP client.\n */\n\nimport {\n  type ACPProgressEvent,\n  type AcpAgentCommandOverrides,\n  defaultPermissionPolicy,\n  EnsembleRegistry,\n  probeAcpAgents,\n  renderAcpBenchText,\n  resolveAcpAgentCommand,\n  runAcpBench,\n  runEnsemble,\n  runOneAcpTask,\n} from '@wrongstack/acp';\nimport {\n  ACPProtocolHandler,\n  ACPSessionStore,\n  makeACPServerAgentTurn,\n  type RunTurn,\n  WrongStackACPServer,\n  WsBridgeTransport,\n} from '@wrongstack/acp/agent';\nimport * as path from 'node:path';\nimport { WebSocketServer } from 'ws';\nimport { AcpServerConfigError, buildAcpServerAgentFactory } from '../../acp-server-agent.js';\nimport {\n  type LoadedAcpRegistry,\n  loadCachedAcpRegistry,\n  refreshAcpRegistry,\n} from '../../acp-registry-cache.js';\nimport { createGracefulShutdown } from '../../shutdown-cleanup.js';\nimport type { SubcommandDeps, SubcommandHandler } from '../index.js';\n\n/** User-config ACP command overrides (never sourced from in-project config). */\nfunction acpOverrides(deps: SubcommandDeps): AcpAgentCommandOverrides | undefined {\n  return deps.config.acp?.agents;\n}\n\n/** Load the synced registry cache, or null if never synced / unavailable. */\nasync function loadLive(deps: SubcommandDeps): Promise<LoadedAcpRegistry | null> {\n  return deps.paths ? loadCachedAcpRegistry(deps.paths) : null;\n}\n\nexport const acpCmd: SubcommandHandler = async (args, deps) => {\n  const sub = args[0];\n\n  if (!sub || sub === 'server' || sub === 'serve') {\n    return runACPServer(deps);\n  }\n\n  if (sub === 'help') {\n    deps.renderer.write(`\\\nwstack acp \u2014 ACP (Agent Client Protocol) integration\n\nUsage:\n  wstack acp              Start WrongStack as an ACP server (blocks)\n  wstack acp server       Same as above\n  wstack acp list         List available ACP agents\n  wstack acp sync         Pull the official agentclientprotocol/registry into cache\n  wstack acp spawn <id> <task>\n                        Spawn an ACP agent as a subagent and wait for result\n  wstack acp parallel <agent-id-csv> <task>\n                        Fan a task out to multiple ACP agents in parallel\n                        and aggregate the results\n  wstack acp probe [agent-id-csv]\n                        Handshake-test agents (bounded concurrency). Defaults\n                        to all installed agents.\n  wstack acp bench [agent-id-csv] [--fs]\n                        End-to-end verify each agent (handshake \u2192 prompt \u2192\n                        marker, optional fs check) and print a graded report.\n                        Defaults to all installed agents.\n  wstack acp help         Show this help\n\nACP Mode:\n  When run as \\`wstack acp\\`. WrongStack acts as an ACP-compatible agent driven\n  by your configured model provider. ACP clients (Zed, JetBrains, VS Code)\n  spawn it as a subprocess and communicate over stdio JSON-RPC. Run\n  \\`wstack auth\\` first to configure a provider, or pass \\`--echo\\` for a no-op\n  connectivity test that needs no provider. Press Ctrl+C to stop.\n\n  Transports:\n    (default)        stdio JSON-RPC (the usual editor-spawned-subprocess mode)\n    --ws[=port]      serve over WebSocket on 127.0.0.1:<port> (default 8889) \u2014\n                     full-duplex, so updates/permission prompts stream live.\n\nspawn:\n  Spawns a named ACP agent (claude-code, gemini-cli, codex-cli, copilot,\n  cline, goose, openhands, qwen-code, kiro-cli, opencode, mistral-vibe,\n  cursor) with the given task and waits for its result.\n  Example: wstack acp spawn cline \"fix the login bug\"\n\nparallel:\n  Runs the same task on a comma-separated list of ACP agents concurrently.\n  Example: wstack acp parallel claude-code,gemini-cli,codex-cli \"review this diff\"\n  Each agent's result is rendered under a clearly-marked header. Returns 0\n  if at least one agent succeeds, 1 if all fail. Agents that aren't\n  installed are skipped with a warning.\n`);\n    return 0;\n  }\n\n  if (sub === 'list') {\n    return listACPAgents(deps);\n  }\n\n  if (sub === 'sync') {\n    return syncACPRegistry(deps);\n  }\n\n  if (sub === 'spawn') {\n    return spawnACPAgent(args.slice(1), deps);\n  }\n\n  if (sub === 'parallel') {\n    return parallelACPAgents(args.slice(1), deps);\n  }\n\n  if (sub === 'probe') {\n    return probeACPAgents(args.slice(1), deps);\n  }\n\n  if (sub === 'bench') {\n    return benchACPAgents(args.slice(1), deps);\n  }\n\n  deps.renderer.writeError(`Unknown acp subcommand: ${sub}\\n`);\n  deps.renderer.write('Run `wstack acp help` for usage.\\n');\n  return 1;\n};\n\n/** Parse the `--ws[=port]` flag into a port number, or null if not set. */\nfunction parseWsPort(flag: unknown): number | null {\n  if (flag === undefined || flag === false) return null;\n  if (flag === true || flag === 'true') return 8889;\n  const n = Number(flag);\n  return Number.isInteger(n) && n > 0 && n < 65_536 ? n : 8889;\n}\n\n/**\n * Serve WrongStack as an ACP agent over WebSocket. Unlike the HTTP transport\n * (one POST per message, notifications buffered), a WebSocket is full-duplex:\n * the agent streams `session/update` and makes `session/request_permission`\n * callbacks live during a turn. One handler + transport per connection.\n */\nasync function runACPWebSocketServer(deps: SubcommandDeps, port: number): Promise<number> {\n  const host = '127.0.0.1';\n  // `--echo` over WS: a no-provider connectivity test, mirroring stdio `--echo`.\n  const echo = deps.flags?.echo === true || deps.flags?.echo === 'true';\n\n  let turnFactory: (() => ReturnType<typeof makeACPServerAgentTurn>) | undefined;\n  let echoTurn: RunTurn | undefined;\n  let store: ACPSessionStore | undefined;\n  if (echo) {\n    echoTurn = async () => ({ stopReason: 'end_turn' });\n  } else {\n    let agentFor;\n    try {\n      agentFor = buildAcpServerAgentFactory(deps);\n    } catch (err) {\n      if (err instanceof AcpServerConfigError) {\n        deps.renderer.writeError(`${err.message}\\n`);\n        return 1;\n      }\n      throw err;\n    }\n    turnFactory = () => makeACPServerAgentTurn({ agentFor });\n    store = deps.paths?.projectDir\n      ? new ACPSessionStore({ dir: path.join(deps.paths.projectDir, 'acp-sessions') })\n      : undefined;\n  }\n\n  const wss = new WebSocketServer({ host, port, maxPayload: 20 * 1024 * 1024 });\n  wss.on('connection', (socket, req) => {\n    // Origin guard: real ACP clients send no Origin; reject cross-origin\n    // browser connections so a web page can't drive this loopback agent.\n    const origin = req.headers.origin;\n    if (origin && origin !== `http://${host}:${port}` && origin !== `ws://${host}:${port}`) {\n      socket.close(1008, 'cross-origin forbidden');\n      return;\n    }\n    const connectionTurn = turnFactory?.();\n    const transport = new WsBridgeTransport((m) => {\n      const data = JSON.stringify(m);\n      if (socket.bufferedAmount + Buffer.byteLength(data, 'utf8') > 32 * 1024 * 1024) {\n        socket.terminate();\n        return;\n      }\n      socket.send(data);\n    });\n    const handler = new ACPProtocolHandler({\n      transport,\n      defaultCwd: deps.cwd ?? process.cwd(),\n      runTurn: connectionTurn ?? echoTurn!,\n      ...(connectionTurn\n        ? {\n            replayFor: connectionTurn.replay,\n            seedFor: connectionTurn.seed,\n            disposeFor: connectionTurn.dispose,\n          }\n        : {}),\n      ...(store ? { store } : {}),\n    });\n    socket.on('message', (data: { toString(): string }) => {\n      let msg: unknown;\n      try {\n        msg = JSON.parse(data.toString());\n      } catch {\n        return;\n      }\n      transport.receive(msg as never);\n      void handler.handleMessage(msg);\n    });\n    const teardown = (): void => {\n      handler.close();\n      transport.close();\n    };\n    socket.on('close', teardown);\n    socket.on('error', teardown);\n  });\n\n  deps.renderer.writeInfo(\n    echo\n      ? `ACP server (echo, no provider) listening on ws://${host}:${port}. Press Ctrl+C to stop.\\n`\n      : `WrongStack ACP server listening on ws://${host}:${port} (${deps.config.provider}/${deps.config.model}). Press Ctrl+C to stop.\\n`,\n  );\n\n  await new Promise<void>((resolve) => {\n    const shutdown = (): void => {\n      deps.renderer.writeWarning('\\nShutting down ACP WebSocket server...');\n      wss.close();\n      resolve();\n    };\n    process.on('SIGINT', shutdown);\n    process.on('SIGTERM', shutdown);\n  });\n  return 0;\n}\n\nasync function runACPServer(deps: SubcommandDeps): Promise<number> {\n  const wsPort = parseWsPort(deps.flags?.ws);\n  if (wsPort !== null) {\n    return runACPWebSocketServer(deps, wsPort);\n  }\n  // `--echo` keeps the no-op connectivity-smoke-test path that the default\n  // runTurn provided before this server was wired to a real Agent. Useful for\n  // `wstack acp --echo` when you just want to verify the wire format against a\n  // client without needing a configured provider.\n  const echo = deps.flags?.echo === true || deps.flags?.echo === 'true';\n\n  const server = new WrongStackACPServer(\n    echo\n      ? {}\n      : (() => {\n          let agentFor;\n          try {\n            agentFor = buildAcpServerAgentFactory(deps);\n          } catch (err) {\n            if (err instanceof AcpServerConfigError) {\n              deps.renderer.writeError(`${err.message}\\n`);\n              return {};\n            }\n            throw err;\n          }\n          const turn = makeACPServerAgentTurn({ agentFor });\n          // Persist sessions under the project's wstack dir so `session/load`\n          // survives a server restart (project-scoped, not in the repo).\n          const store = deps.paths?.projectDir\n            ? new ACPSessionStore({ dir: path.join(deps.paths.projectDir, 'acp-sessions') })\n            : undefined;\n          return {\n            runTurn: turn,\n            replayFor: turn.replay,\n            seedFor: turn.seed,\n            disposeFor: turn.dispose,\n            ...(store ? { store } : {}),\n          };\n        })(),\n  );\n\n  if (echo) {\n    deps.renderer.writeInfo('ACP server starting in --echo mode (no-op turn; no provider needed).\\n');\n  } else {\n    deps.renderer.writeInfo(\n      `Starting WrongStack ACP server (${deps.config.provider}/${deps.config.model})\u2026\\n`,\n    );\n    deps.renderer.writeInfo('Waiting for an ACP client connection on stdin/stdout. Press Ctrl+C to stop.\\n');\n  }\n\n  // Graceful shutdown. The old code did `server.stop(); process.exit(0)`\n  // back-to-back, which cut off `server.stop()`'s async teardown (it\n  // initiates cleanup of underlying agents and the session store, but\n  // returns void rather than a promise \u2014 yet Node still has pending\n  // microtasks scheduled that `process.exit` would abandon). Use the\n  // same pattern as cli-main.ts: idempotent guard, await any cleanup,\n  // set exitCode, give Node a 500ms grace to drain, then force exit.\n  createGracefulShutdown({\n    run: async () => {\n      try {\n        server.stop();\n      } catch (err) {\n        deps.renderer.writeError(\n          `ACP stop failed: ${err instanceof Error ? err.message : String(err)}\\n`,\n        );\n      }\n    },\n  }).install();\n\n  try {\n    await server.start();\n  } catch (err) {\n    deps.renderer.writeError(\n      `ACP server error: ${err instanceof Error ? err.message : String(err)}\\n`,\n    );\n    return 1;\n  }\n\n  return 0;\n}\n\nasync function listACPAgents(deps: SubcommandDeps): Promise<number> {\n  const registry = new EnsembleRegistry();\n  const detected = await registry.list();\n  deps.renderer.write('Detected ACP agents:\\n\\n');\n  // Print installed first, then not-installed with a \"not installed\" note.\n  const installed = detected.filter((a) => a.installed);\n  const missing = detected.filter((a) => !a.installed);\n  for (const a of installed) {\n    const ver = a.version ? `  (${a.version.split('\\n')[0]})` : '';\n    deps.renderer.write(`  \u2713 ${a.id.padEnd(16)} ${a.displayName}${ver}\\n`);\n  }\n  for (const a of missing) {\n    deps.renderer.write(`  \u2717 ${a.id.padEnd(16)} ${a.displayName}  (${a.reason ?? 'not installed'})\\n`);\n  }\n  deps.renderer.write(`\\n${installed.length} of ${detected.length} agents available.\\n`);\n  const live = await loadLive(deps);\n  if (live && live.agents.length > 0) {\n    deps.renderer.write(\n      `Synced registry: ${live.agents.length} agents available (run \\`wstack acp spawn <id> <task>\\`).\\n`,\n    );\n  } else {\n    deps.renderer.write('Run `wstack acp sync` to pull the full official registry (37+ agents).\\n');\n  }\n  deps.renderer.write('Use `wstack acp spawn <agent-id> <task>` to delegate a task.\\n');\n  return 0;\n}\n\nasync function syncACPRegistry(deps: SubcommandDeps): Promise<number> {\n  if (!deps.paths) {\n    deps.renderer.writeError('Cannot sync: no cache directory available.\\n');\n    return 1;\n  }\n  deps.renderer.writeInfo('Fetching the official ACP registry\u2026\\n');\n  try {\n    const { count, location } = await refreshAcpRegistry(deps.paths);\n    deps.renderer.write(`Synced ${count} agents from the official ACP registry.\\n`);\n    deps.renderer.writeInfo(`Cached at ${location}\\n`);\n    return 0;\n  } catch (err) {\n    deps.renderer.writeError(`ACP registry sync failed: ${err instanceof Error ? err.message : String(err)}\\n`);\n    deps.renderer.write('The bundled offline catalog is still available via `wstack acp list`.\\n');\n    return 1;\n  }\n}\n\nasync function spawnACPAgent(args: string[], deps: SubcommandDeps): Promise<number> {\n  const [subagentId, ...taskParts] = args;\n  if (!subagentId) {\n    deps.renderer.writeError('Usage: wstack acp spawn <agent-id> <task>\\n');\n    deps.renderer.write('Run `wstack acp list` to see available agents.\\n');\n    return 1;\n  }\n\n  const task = taskParts.join(' ');\n  if (!task) {\n    deps.renderer.writeError('Usage: wstack acp spawn <agent-id> <task>\\n');\n    deps.renderer.write('Task description is required.\\n');\n    return 1;\n  }\n\n  const live = await loadLive(deps);\n  const cmd = resolveAcpAgentCommand(subagentId, acpOverrides(deps), live?.byId);\n  if (!cmd) {\n    deps.renderer.writeError(`Unknown ACP agent: ${subagentId}\\n`);\n    deps.renderer.write('Run `wstack acp list` (or `wstack acp sync`) to see available agents.\\n');\n    return 1;\n  }\n\n  deps.renderer.writeInfo(`Spawning ACP agent '${subagentId}'\u2026\\n`);\n\n  // Wire Ctrl+C to an AbortSignal so a long-running external agent is\n  // cancelled (runOneAcpTask tears the child down on signal + in its finally).\n  const ac = new AbortController();\n  const cleanup = () => ac.abort();\n  process.on('SIGINT', cleanup);\n  process.on('SIGTERM', cleanup);\n\n  try {\n    deps.renderer.writeInfo('Running task\u2026\\n');\n    const result = await runOneAcpTask({\n      command: cmd.command,\n      ...(cmd.args !== undefined ? { args: cmd.args } : {}),\n      ...(cmd.env !== undefined ? { env: cmd.env } : {}),\n      role: subagentId,\n      task,\n      signal: ac.signal,\n      permissionPolicy: defaultPermissionPolicy,\n      onProgress: (event) => {\n        const line = formatProgress(event);\n        if (line) deps.renderer.writeInfo(`  ${line}\\n`);\n      },\n    });\n\n    deps.renderer.write('\\n--- Result ---\\n');\n    deps.renderer.write(result.result.length > 0 ? result.result : 'no result');\n    deps.renderer.write('\\n---------------\\n');\n    deps.renderer.writeInfo(\n      `Done. iterations=${result.iterations} toolCalls=${result.toolCalls}\\n`,\n    );\n    return 0;\n  } catch (err) {\n    // runOneAcpTask throws structured SubagentError shapes; surface the\n    // `kind` for clarity (e.g. aborted_by_parent, bridge_failed).\n    const e = err as { kind?: string; message?: string };\n    const detail = e.kind ? `[${e.kind}] ` : '';\n    const message = e.message ?? (err instanceof Error ? err.message : String(err));\n    deps.renderer.writeError(`ACP agent error: ${detail}${message}\\n`);\n    return 1;\n  } finally {\n    process.off('SIGINT', cleanup);\n    process.off('SIGTERM', cleanup);\n  }\n}\n\n/**\n * Render one streamed ACP progress event as a compact one-line summary\n * for the CLI. Returns '' for events that shouldn't print a line (the\n * final assistant text is already shown in the result block, so we skip\n * `message`/`raw` to avoid double-printing).\n */\nfunction formatProgress(event: ACPProgressEvent): string {\n  switch (event.type) {\n    case 'tool_call':\n      return `\u25B8 ${event.toolCall.title} (${event.toolCall.status})`;\n    case 'tool_call_update':\n      return event.toolCall.status === 'completed' || event.toolCall.status === 'failed'\n        ? `  \u21B3 ${event.toolCall.title}: ${event.toolCall.status}`\n        : '';\n    case 'diff':\n      return `\u270E ${event.diff.path}${event.diff.oldText === null ? ' (new)' : ''}`;\n    case 'plan':\n      return `\u2630 plan: ${event.entries.length} step(s)`;\n    default:\n      return '';\n  }\n}\n\nasync function parallelACPAgents(\n  args: string[],\n  deps: SubcommandDeps,\n): Promise<number> {\n  const [csv, ...taskParts] = args;\n  if (!csv) {\n    deps.renderer.writeError('Usage: wstack acp parallel <agent-id-csv> <task>\\n');\n    deps.renderer.write('Example: wstack acp parallel claude-code,gemini-cli \"review this diff\"\\n');\n    return 1;\n  }\n  const task = taskParts.join(' ');\n  if (!task) {\n    deps.renderer.writeError('Usage: wstack acp parallel <agent-id-csv> <task>\\n');\n    deps.renderer.writeError('Task description is required.\\n');\n    return 1;\n  }\n\n  // Forward SIGINT to abort the run. Each child process tears down in\n  // its own finally; the AbortController propagates into the agent.\n  const ac = new AbortController();\n  const onSignal = () => ac.abort();\n  process.on('SIGINT', onSignal);\n  process.on('SIGTERM', onSignal);\n\n  try {\n    const overrides = acpOverrides(deps);\n    const live = await loadLive(deps);\n    const result = await runEnsemble({\n      agentIds: csv,\n      task,\n      resolveCmd: (id) => resolveAcpAgentCommand(id, overrides, live?.byId),\n      signal: ac.signal,\n      onProgress: (agentId, event) => {\n        const line = formatProgress(event);\n        if (line) deps.renderer.writeInfo(`  [${agentId}] ${line}\\n`);\n      },\n    });\n\n    // Surface skipped agents up-front, before the per-agent output.\n    const skipped = result.results.filter((r) => r.status === 'skipped');\n    if (skipped.length > 0) {\n      deps.renderer.writeWarning(\n        `Skipping ${skipped.length} agent(s) not installed: ${skipped.map((s) => `${s.agentId} (${s.reason ?? 'not installed'})`).join(', ')}\\n`,\n      );\n    }\n    if (result.summary.succeeded + result.summary.failed + result.summary.cancelled === 0) {\n      deps.renderer.writeError('No installed agents to run.\\n');\n      deps.renderer.write('Run `wstack acp list` to see what is available.\\n');\n      return 1;\n    }\n\n    const fannedOut = result.results\n      .filter((r) => r.status !== 'skipped')\n      .map((r) => r.agentId)\n      .join(', ');\n    deps.renderer.writeInfo(\n      `Fanning out to ${result.summary.succeeded + result.summary.failed + result.summary.cancelled} agent(s): ${fannedOut}\\n`,\n    );\n    deps.renderer.writeInfo(`Task: ${result.task}\\n\\n`);\n\n    // Render each result under a clear header, in input order.\n    for (const r of result.results) {\n      if (r.status === 'skipped') continue;\n      deps.renderer.write(`\\n=== ${r.agentId} ===\\n`);\n      if (r.status === 'success') {\n        deps.renderer.write(r.result && r.result.length > 0 ? r.result : '(no result)');\n        deps.renderer.write(\n          `\\n[${r.agentId}] success  ${r.durationMs}ms  iterations=${r.iterations} toolCalls=${r.toolCalls}\\n`,\n        );\n      } else if (r.status === 'failed') {\n        deps.renderer.writeError(\n          `[${r.error?.kind ?? 'unknown'}] ${r.error?.message ?? 'failed'}\\n`,\n        );\n        deps.renderer.write(\n          `[${r.agentId}] failed  ${r.durationMs}ms\\n`,\n        );\n      } else {\n        // cancelled\n        deps.renderer.writeError(\n          `[${r.error?.kind ?? 'aborted'}] ${r.error?.message ?? 'cancelled'}\\n`,\n        );\n        deps.renderer.write(\n          `[${r.agentId}] cancelled  ${r.durationMs}ms\\n`,\n        );\n      }\n    }\n\n    const { succeeded, failed, cancelled, skipped: skip } = result.summary;\n    deps.renderer.write(\n      `\\nParallel summary: ${succeeded} succeeded, ${failed} failed, ${cancelled} cancelled, ${skip} skipped.\\n`,\n    );\n\n    // 0 if at least one agent succeeded, 1 otherwise.\n    return succeeded > 0 ? 0 : 1;\n  } finally {\n    process.off('SIGINT', onSignal);\n    process.off('SIGTERM', onSignal);\n  }\n}\n\nasync function probeACPAgents(args: string[], deps: SubcommandDeps): Promise<number> {\n  const csv = args.join(' ');\n  let ids: string[];\n  if (csv) {\n    ids = csv.split(',').flatMap((s) => s.split(/\\s+/)).map((s) => s.trim()).filter(Boolean);\n  } else {\n    const detected = await new EnsembleRegistry().list();\n    ids = detected.filter((a) => a.installed).map((a) => a.id);\n  }\n  if (ids.length === 0) {\n    deps.renderer.writeError('No installed agents to probe.\\n');\n    return 1;\n  }\n  const overrides = acpOverrides(deps);\n  const live = await loadLive(deps);\n  deps.renderer.writeInfo(\n    `Probing ${ids.length} agent(s)\u2026 (npx-based agents may download on first run)\\n`,\n  );\n  const results = await probeAcpAgents({\n    agentIds: ids,\n    resolveCmd: (id) => resolveAcpAgentCommand(id, overrides, live?.byId),\n    projectRoot: deps.cwd ?? process.cwd(),\n    onProgress: (id, r) => deps.renderer.writeInfo(`  ${r.ok ? '\u2713' : '\u2717'} ${id} (${r.ms}ms)\\n`),\n  });\n  deps.renderer.write('\\nACP handshake probe:\\n\\n');\n  for (const r of results) {\n    if (r.ok) {\n      const info = r.agentInfo ? ` \u2014 ${r.agentInfo.name} ${r.agentInfo.version}` : '';\n      deps.renderer.write(`  \u2713 ${r.id.padEnd(16)} ok  ${r.ms}ms${info}\\n`);\n    } else {\n      deps.renderer.write(`  \u2717 ${r.id.padEnd(16)} ${r.error ?? 'failed'}  (${r.ms}ms)\\n`);\n    }\n  }\n  const ok = results.filter((r) => r.ok).length;\n  deps.renderer.write(`\\n${ok} of ${results.length} agents completed the ACP handshake.\\n`);\n  return ok > 0 ? 0 : 1;\n}\n\nasync function benchACPAgents(args: string[], deps: SubcommandDeps): Promise<number> {\n  // `--fs` is parsed into deps.flags by the subcommand arg parser (flags never\n  // arrive in `args`); tolerate a literal token too for safety.\n  const checkFs =\n    deps.flags?.fs === true || deps.flags?.fs === 'true' || args.includes('--fs');\n  const csv = args.filter((a) => a !== '--fs').join(' ');\n\n  let ids: string[];\n  if (csv) {\n    ids = csv\n      .split(',')\n      .flatMap((s) => s.split(/\\s+/))\n      .map((s) => s.trim())\n      .filter(Boolean);\n  } else {\n    const detected = await new EnsembleRegistry().list();\n    ids = detected.filter((a) => a.installed).map((a) => a.id);\n  }\n  if (ids.length === 0) {\n    deps.renderer.writeError('No installed agents to bench.\\n');\n    deps.renderer.write('Pass ids explicitly: `wstack acp bench gemini-cli,codex-cli`.\\n');\n    return 1;\n  }\n\n  const ac = new AbortController();\n  const onSignal = () => ac.abort();\n  process.on('SIGINT', onSignal);\n  process.on('SIGTERM', onSignal);\n\n  try {\n    const overrides = acpOverrides(deps);\n    const live = await loadLive(deps);\n    deps.renderer.writeInfo(\n      `Benching ${ids.length} agent(s)${checkFs ? ' (with fs check)' : ''}: ${ids.join(', ')}\u2026\\n`,\n    );\n    const result = await runAcpBench({\n      agentIds: ids,\n      resolveCmd: (id) => resolveAcpAgentCommand(id, overrides, live?.byId),\n      projectRoot: deps.cwd ?? process.cwd(),\n      checkFs,\n      signal: ac.signal,\n      onProgress: (agentId, phase, r) => {\n        if (phase === 'start') deps.renderer.writeInfo(`  \u25B8 ${agentId}\u2026\\n`);\n        else if (r) deps.renderer.writeInfo(`  \u21B3 ${agentId}: ${r.status}\\n`);\n      },\n    });\n    deps.renderer.write(`\\n${renderAcpBenchText(result)}\\n`);\n    // Exit 0 if at least one agent passed; 1 otherwise.\n    return result.summary.pass > 0 ? 0 : 1;\n  } finally {\n    process.off('SIGINT', onSignal);\n    process.off('SIGTERM', onSignal);\n  }\n}\n", "/**\n * ACP server \u2192 real WrongStack Agent wiring.\n *\n * `wstack acp` exposes WrongStack as an ACP v1 agent so any ACP-capable\n * client (Zed, JetBrains, VS Code ACP extension, etc.) can drive it. The\n * server-side `runTurn` adapter (`makeACPServerAgentTurn` in `@wrongstack/acp`)\n * needs a factory that produces a fresh, isolated `Agent` per session \u2014 this\n * module is that factory, reusing the same boot pieces the interactive CLI\n * uses (`setupProvider`, `createDefaultContainer`, builtin tools).\n *\n * Scope: a minimal but real agent. It deliberately does NOT wire MCP servers,\n * compaction middleware, model-runtime overlays, or lifecycle hooks \u2014 those\n * belong in the interactive host. The ACP server is a headless single-turn\n * surface; a future PR can layer richer session behaviour if needed.\n */\nimport { Agent, Context, createDefaultPipelines } from '@wrongstack/core/agent';\nimport { AutoApprovePermissionPolicy, ToolCapabilities } from '@wrongstack/core/security';\nimport { DefaultLogger } from '@wrongstack/core/infrastructure';\nimport { EventBus, TOKENS } from '@wrongstack/core/kernel';\nimport { type Logger, type PermissionDecision, type PermissionPolicy, type Tool, ToolValidationError } from '@wrongstack/core/types';\nimport { ToolRegistry } from '@wrongstack/core/registry';\nimport type { WstackPaths } from '@wrongstack/core/utils';\nimport { DefaultTokenCounter } from '@wrongstack/core/infrastructure';\nimport { ToolExecutor } from '@wrongstack/core/execution';\nimport type { RunTurnApi } from '@wrongstack/acp/agent';\nimport { createDefaultContainer } from '@wrongstack/runtime';\nimport type { SubcommandDeps } from './subcommands/index.js';\nimport { setupProvider } from './wiring/provider.js';\n\n/**\n * Error thrown when the server cannot start because no model provider is\n * configured. The CLI handler catches this and prints a actionable message\n * (`wstack auth`) rather than a stack trace.\n */\nexport class AcpServerConfigError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'AcpServerConfigError';\n  }\n}\n\nexport interface AcpAgentFactoryOptions {\n  /** Caller-supplied logger; a minimal stderr logger is created when omitted. */\n  logger?: Logger | undefined;\n}\n\n/** Capabilities considered safe to auto-approve without asking the client. */\nconst SAFE_CAPS = new Set<string>([\n  ToolCapabilities.FS_READ,\n  ToolCapabilities.NET_OUTBOUND,\n  ToolCapabilities.COORDINATION_FLEET_READ,\n]);\n\n/**\n * Permission policy that routes side-effecting tool calls to the connected\n * ACP client via `session/request_permission` (the v1-correct behavior),\n * while auto-approving read-only/safe tools. This replaces the blanket\n * auto-approve so an editor driving WrongStack-as-agent gets a real\n * permission prompt before file writes / shell commands run.\n *\n * Exported for direct regression testing of the malformed-response path \u2014\n * `acp-server-agent.test.ts` injects a response whose `optionId` is missing\n * (which previously threw a TypeError at `outcome.optionId.startsWith(...)`\n * and was misattributed to \"no permission channel\" by the surrounding\n * try/catch). Production callers go through `buildAcpServerAgentFactory`,\n * which constructs this internally when the client exposes a permission\n * channel.\n */\nexport class ACPClientPermissionPolicy implements PermissionPolicy {\n  constructor(private readonly requestPermission: RunTurnApi['requestPermission']) {}\n\n  async evaluate(tool: Tool, input: unknown): Promise<PermissionDecision> {\n    const caps = tool.capabilities ?? [];\n    // Safe iff every declared capability is in the safe set (and at least\n    // one exists). A tool with no declared caps is treated as unsafe.\n    const isSafe = caps.length > 0 && caps.every((c) => SAFE_CAPS.has(c));\n    if (isSafe) {\n      return { permission: 'auto', source: 'default' };\n    }\n\n    const title = describeToolCall(tool.name, input);\n    try {\n      const outcome = await this.requestPermission({\n        toolCall: { toolCallId: `tc_${tool.name}_${Date.now()}`, title },\n        options: [\n          { optionId: 'allow_once', name: 'Allow', kind: 'allow_once' },\n          { optionId: 'allow_always', name: 'Always allow', kind: 'allow_always' },\n          { optionId: 'reject_once', name: 'Reject', kind: 'reject_once' },\n        ],\n      });\n      const optionId = outcome.outcome === 'selected' ? outcome.optionId : undefined;\n      const allowed = typeof optionId === 'string' && optionId.startsWith('allow');\n      return allowed\n        ? { permission: 'auto', source: 'user' }\n        : { permission: 'deny', source: 'user', reason: 'rejected by ACP client' };\n    } catch {\n      // No client channel or the request timed out. Fail safe: deny the\n      // side-effecting tool rather than silently running it.\n      return { permission: 'deny', source: 'deny', reason: 'no permission channel' };\n    }\n  }\n\n  async trust(): Promise<void> {}\n  async deny(): Promise<void> {}\n  denyOnce(): void {}\n  allowOnce(): void {}\n  async reload(): Promise<void> {}\n}\n\nfunction describeToolCall(name: string, input: unknown): string {\n  if (input && typeof input === 'object') {\n    const r = input as Record<string, unknown>;\n    const arg = r.path ?? r.file ?? r.command ?? r.pattern;\n    if (typeof arg === 'string') return `${name}: ${arg}`;\n  }\n  return name;\n}\n\n/**\n * Swap filesystem/terminal tools for ACP-backed versions that operate on the\n * connected client's `fs/*` + `terminal/*`, gated on the client's advertised\n * capabilities. Each ACP tool reuses the builtin's name/description/inputSchema\n * so the model calls it identically \u2014 only execution is redirected.\n *\n * Note: for a local (stdio) client the agent and editor share a filesystem, so\n * tools that aren't redirected still operate on the same real files; this swap\n * adds editor-buffer awareness and makes remote (WebSocket) agents correct.\n */\nfunction wireClientBackedTools(tools: ToolRegistry, api: RunTurnApi): void {\n  const caps = api.clientCapabilities ?? {};\n  const swap = (name: string, make: (base: Tool) => Tool): void => {\n    const base = tools.get(name);\n    if (!base) return;\n    tools.unregister(name);\n    tools.register(make(base));\n  };\n  if (caps.fs?.readTextFile) {\n    swap('read', (base) => makeAcpRead(base, api));\n  }\n  if (caps.fs?.writeTextFile) {\n    swap('write', (base) => makeAcpWrite(base, api));\n    swap('edit', (base) => makeAcpEdit(base, api));\n  }\n  if (caps.terminal) {\n    swap('bash', (base) => makeAcpBash(base, api));\n  }\n}\n\nfunction makeAcpRead(base: Tool, api: RunTurnApi): Tool {\n  return {\n    ...base,\n    mutating: false,\n    execute: async (input: unknown) => {\n      const i = (input ?? {}) as { path?: string; offset?: number; limit?: number };\n      if (!i.path) throw new ToolValidationError({ message: 'read: path is required', field: 'path' });\n      const content = await api.readTextFile({\n        path: i.path,\n        ...(typeof i.offset === 'number' ? { line: i.offset } : {}),\n        ...(typeof i.limit === 'number' ? { limit: i.limit } : {}),\n      });\n      const lines = content.split(/\\r\\n|\\r|\\n/);\n      const start = Math.max(1, i.offset ?? 1);\n      const width = String(start + lines.length - 1).length;\n      const text = lines\n        .map((l, idx) => `${String(start + idx).padStart(width, ' ')}\u2192${l}`)\n        .join('\\n');\n      return { text, total_lines: lines.length, encoding: 'utf8', truncated: false };\n    },\n  } as Tool;\n}\n\nfunction makeAcpWrite(base: Tool, api: RunTurnApi): Tool {\n  return {\n    ...base,\n    execute: async (input: unknown) => {\n      const i = (input ?? {}) as { path?: string; content?: string };\n      if (!i.path) throw new ToolValidationError({ message: 'write: path is required', field: 'path' });\n      await api.writeTextFile({ path: i.path, content: i.content ?? '' });\n      return { path: i.path, ok: true };\n    },\n  } as Tool;\n}\n\nfunction makeAcpEdit(base: Tool, api: RunTurnApi): Tool {\n  return {\n    ...base,\n    execute: async (input: unknown) => {\n      const i = (input ?? {}) as {\n        path?: string;\n        old_string?: string;\n        new_string?: string;\n        replace_all?: boolean;\n      };\n      if (!i.path) throw new ToolValidationError({ message: 'edit: path is required', field: 'path' });\n      if (!i.old_string) throw new ToolValidationError({ message: 'edit: old_string is required', field: 'old_string' });\n      const before = await api.readTextFile({ path: i.path });\n      const occurrences = before.split(i.old_string).length - 1;\n      if (occurrences === 0) {\n        throw new ToolValidationError({\n          message: `edit: old_string not found in \"${i.path}\"`,\n          field: 'old_string',\n          context: { path: i.path },\n        });\n      }\n      if (occurrences > 1 && !i.replace_all) {\n        throw new ToolValidationError({\n          message: `edit: old_string appears ${occurrences} times in \"${i.path}\"; pass replace_all or use a more specific string`,\n          field: 'old_string',\n          context: { path: i.path, occurrences, replaceAll: false },\n        });\n      }\n      const after = i.replace_all\n        ? before.split(i.old_string).join(i.new_string ?? '')\n        : before.replace(i.old_string, i.new_string ?? '');\n      await api.writeTextFile({ path: i.path, content: after });\n      return { path: i.path, replacements: i.replace_all ? occurrences : 1 };\n    },\n  } as Tool;\n}\n\nfunction makeAcpBash(base: Tool, api: RunTurnApi): Tool {\n  return {\n    ...base,\n    execute: async (input: unknown) => {\n      const i = (input ?? {}) as { command?: string; cwd?: string };\n      if (!i.command) throw new ToolValidationError({ message: 'bash: command is required', field: 'command' });\n      // ACP terminals run the command through the client's shell; we pass it\n      // as `sh -c \"<command>\"` so pipelines/operators work as the model expects.\n      const { output, exitCode } = await api.runTerminal({\n        command: 'sh',\n        args: ['-c', i.command],\n        ...(i.cwd ? { cwd: i.cwd } : {}),\n      });\n      return { stdout: output, exit_code: exitCode, command: i.command };\n    },\n  } as Tool;\n}\n\n/**\n * Build a per-session `Agent` factory suitable for `makeACPServerAgentTurn`.\n *\n * The provider registry + container are built once (they're stateless across\n * sessions); each `agentFor(sessionId, cwd)` call builds a fresh `EventBus`,\n * `Context`, and `Agent` so sessions stay isolated per the v1 spec.\n *\n * Throws `AcpServerConfigError` up front if no provider is configured.\n */\nexport function buildAcpServerAgentFactory(\n  deps: SubcommandDeps,\n  options: AcpAgentFactoryOptions = {},\n): (sessionId: string, cwd: string, api?: RunTurnApi) => Promise<Agent> {\n  const config = deps.config;\n  if (!config.provider || !config.model) {\n    throw new AcpServerConfigError(\n      'No model provider is configured. Run `wstack auth` to add credentials, ' +\n        'or start the server with `wstack acp --echo` for a no-op connectivity test.',\n    );\n  }\n\n  const logger = options.logger ?? new DefaultLogger({ stderr: true });\n  const wpaths: WstackPaths = deps.paths;\n\n  // Provider + registry \u2014 built once, reused across sessions.\n  // setupProvider is async, but factory consumers expect a sync `agentFor`.\n  // We kick it off lazily and memoize so the first session pays the one-time\n  // models.dev lookup cost; later sessions reuse the resolved registry.\n  type ProviderBoot = Awaited<ReturnType<typeof setupProvider>>;\n  let providerBoot: Promise<ProviderBoot> | null = null;\n  const bootProvider = (): Promise<ProviderBoot> => {\n    if (!providerBoot) {\n      providerBoot = setupProvider({ config, modelsRegistry: deps.modelsRegistry, logger });\n    }\n    return providerBoot;\n  };\n\n  // Container \u2014 built once; safe to share across sessions (it only holds\n  // stateless service bindings, not per-run state).\n  const container = createDefaultContainer({\n    config,\n    wpaths,\n    logger,\n    modelsRegistry: deps.modelsRegistry,\n  });\n\n  return async function agentFor(\n    _sessionId: string,\n    cwd: string,\n    api?: RunTurnApi,\n  ): Promise<Agent> {\n    await container.resolve(TOKENS.MemoryStore).initialize();\n    const { provider, providerRegistry } = await bootProvider();\n\n    // Per-session event bus \u2014 keeps each ACP session's tool/iteration events\n    // isolated from the others.\n    const events = new EventBus();\n\n    // Per-session tool registry: start from the builtins, then (when the\n    // client advertises fs/terminal) swap read/write/edit/bash for\n    // ACP-backed versions that operate on the CLIENT's filesystem and\n    // terminal \u2014 so the editor's view (incl. unsaved buffers) is the source\n    // of truth. A fresh registry avoids mutating the shared builtin one.\n    const source = deps.toolRegistry ?? new ToolRegistry();\n    const tools = new ToolRegistry();\n    for (const t of source.list()) tools.register(t);\n    if (api) {\n      wireClientBackedTools(tools, api);\n    }\n\n    // Permission posture: when the ACP client exposes a permission channel\n    // (the live `wstack acp` path always does), route side-effecting tools\n    // to the client for approval. Without a channel (tests, --echo) fall\n    // back to the headless auto-approve, matching the subagent posture in\n    // fleet/host.ts.\n    const permissionPolicy: PermissionPolicy = api?.requestPermission\n      ? new ACPClientPermissionPolicy(api.requestPermission)\n      : new AutoApprovePermissionPolicy();\n\n    const tokenCounter = new DefaultTokenCounter({\n      registry: deps.modelsRegistry,\n      providerId: config.provider,\n      events,\n    });\n\n    // Minimal session writer \u2014 ACP sessions don't persist to the JSONL\n    // transcript store yet. A no-op writer keeps the Context contract happy.\n    const session = { append: async () => {} } as never;\n\n    const context = new Context({\n      systemPrompt: [],\n      provider,\n      session,\n      signal: new AbortController().signal,\n      tokenCounter,\n      cwd,\n      projectRoot: cwd,\n      allowOutsideProjectRoot: config.features?.allowOutsideProjectRoot ?? false,\n      model: config.model,\n      tools: [...tools.list()] as Tool[],\n      agentId: 'acp-server',\n      agentName: 'wrongstack-acp',\n    });\n\n    const toolExecutor = new ToolExecutor(tools, {\n      permissionPolicy,\n      secretScrubber: container.resolve(TOKENS.SecretScrubber),\n      renderer: undefined,\n      events,\n      confirmAwaiter: undefined,\n      iterationTimeoutMs: config.tools?.iterationTimeoutMs ?? 120_000,\n      maxToolTimeoutMs: config.tools?.maxToolTimeoutMs ?? 300_000,\n      perIterationOutputCapBytes: config.tools?.perIterationOutputCapBytes ?? 100_000,\n      tracer: undefined,\n    });\n\n    return new Agent({\n      container,\n      tools,\n      providers: providerRegistry,\n      events,\n      pipelines: createDefaultPipelines(),\n      context,\n      permissionPolicy,\n      toolExecutor,\n      loopDetection: config.tools?.loopDetection,\n    });\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;;;AAaA;AAAA,EAGE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP,YAAY,UAAU;AACtB,SAAS,uBAAuB;;;ACnBhC,SAAS,OAAO,SAAS,8BAA8B;AACvD,SAAS,6BAA6B,wBAAwB;AAC9D,SAAS,qBAAqB;AAC9B,SAAS,UAAU,cAAc;AACjC,SAAiF,2BAA2B;AAC5G,SAAS,oBAAoB;AAE7B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AAShC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC9C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAQA,IAAM,YAAY,oBAAI,IAAY;AAAA,EAChC,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AACnB,CAAC;AAiBM,IAAM,4BAAN,MAA4D;AAAA,EACjE,YAA6B,mBAAoD;AAApD;AAAA,EAAqD;AAAA,EAArD;AAAA,EAE7B,MAAM,SAAS,MAAY,OAA6C;AACtE,UAAM,OAAO,KAAK,gBAAgB,CAAC;AAGnC,UAAM,SAAS,KAAK,SAAS,KAAK,KAAK,MAAM,CAAC,MAAM,UAAU,IAAI,CAAC,CAAC;AACpE,QAAI,QAAQ;AACV,aAAO,EAAE,YAAY,QAAQ,QAAQ,UAAU;AAAA,IACjD;AAEA,UAAM,QAAQ,iBAAiB,KAAK,MAAM,KAAK;AAC/C,QAAI;AACF,YAAM,UAAU,MAAM,KAAK,kBAAkB;AAAA,QAC3C,UAAU,EAAE,YAAY,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,MAAM;AAAA,QAC/D,SAAS;AAAA,UACP,EAAE,UAAU,cAAc,MAAM,SAAS,MAAM,aAAa;AAAA,UAC5D,EAAE,UAAU,gBAAgB,MAAM,gBAAgB,MAAM,eAAe;AAAA,UACvE,EAAE,UAAU,eAAe,MAAM,UAAU,MAAM,cAAc;AAAA,QACjE;AAAA,MACF,CAAC;AACD,YAAM,WAAW,QAAQ,YAAY,aAAa,QAAQ,WAAW;AACrE,YAAM,UAAU,OAAO,aAAa,YAAY,SAAS,WAAW,OAAO;AAC3E,aAAO,UACH,EAAE,YAAY,QAAQ,QAAQ,OAAO,IACrC,EAAE,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,yBAAyB;AAAA,IAC7E,QAAQ;AAGN,aAAO,EAAE,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,wBAAwB;AAAA,IAC/E;AAAA,EACF;AAAA,EAEA,MAAM,QAAuB;AAAA,EAAC;AAAA,EAC9B,MAAM,OAAsB;AAAA,EAAC;AAAA,EAC7B,WAAiB;AAAA,EAAC;AAAA,EAClB,YAAkB;AAAA,EAAC;AAAA,EACnB,MAAM,SAAwB;AAAA,EAAC;AACjC;AAEA,SAAS,iBAAiB,MAAc,OAAwB;AAC9D,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,IAAI;AACV,UAAM,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE;AAC/C,QAAI,OAAO,QAAQ,SAAU,QAAO,GAAG,IAAI,KAAK,GAAG;AAAA,EACrD;AACA,SAAO;AACT;AAYA,SAAS,sBAAsB,OAAqB,KAAuB;AACzE,QAAM,OAAO,IAAI,sBAAsB,CAAC;AACxC,QAAM,OAAO,CAAC,MAAc,SAAqC;AAC/D,UAAM,OAAO,MAAM,IAAI,IAAI;AAC3B,QAAI,CAAC,KAAM;AACX,UAAM,WAAW,IAAI;AACrB,UAAM,SAAS,KAAK,IAAI,CAAC;AAAA,EAC3B;AACA,MAAI,KAAK,IAAI,cAAc;AACzB,SAAK,QAAQ,CAAC,SAAS,YAAY,MAAM,GAAG,CAAC;AAAA,EAC/C;AACA,MAAI,KAAK,IAAI,eAAe;AAC1B,SAAK,SAAS,CAAC,SAAS,aAAa,MAAM,GAAG,CAAC;AAC/C,SAAK,QAAQ,CAAC,SAAS,YAAY,MAAM,GAAG,CAAC;AAAA,EAC/C;AACA,MAAI,KAAK,UAAU;AACjB,SAAK,QAAQ,CAAC,SAAS,YAAY,MAAM,GAAG,CAAC;AAAA,EAC/C;AACF;AAEA,SAAS,YAAY,MAAY,KAAuB;AACtD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAU;AAAA,IACV,SAAS,OAAO,UAAmB;AACjC,YAAM,IAAK,SAAS,CAAC;AACrB,UAAI,CAAC,EAAE,KAAM,OAAM,IAAI,oBAAoB,EAAE,SAAS,0BAA0B,OAAO,OAAO,CAAC;AAC/F,YAAM,UAAU,MAAM,IAAI,aAAa;AAAA,QACrC,MAAM,EAAE;AAAA,QACR,GAAI,OAAO,EAAE,WAAW,WAAW,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC;AAAA,QACzD,GAAI,OAAO,EAAE,UAAU,WAAW,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAAA,MAC1D,CAAC;AACD,YAAM,QAAQ,QAAQ,MAAM,YAAY;AACxC,YAAM,QAAQ,KAAK,IAAI,GAAG,EAAE,UAAU,CAAC;AACvC,YAAM,QAAQ,OAAO,QAAQ,MAAM,SAAS,CAAC,EAAE;AAC/C,YAAM,OAAO,MACV,IAAI,CAAC,GAAG,QAAQ,GAAG,OAAO,QAAQ,GAAG,EAAE,SAAS,OAAO,GAAG,CAAC,SAAI,CAAC,EAAE,EAClE,KAAK,IAAI;AACZ,aAAO,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,QAAQ,WAAW,MAAM;AAAA,IAC/E;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAY,KAAuB;AACvD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,OAAO,UAAmB;AACjC,YAAM,IAAK,SAAS,CAAC;AACrB,UAAI,CAAC,EAAE,KAAM,OAAM,IAAI,oBAAoB,EAAE,SAAS,2BAA2B,OAAO,OAAO,CAAC;AAChG,YAAM,IAAI,cAAc,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,WAAW,GAAG,CAAC;AAClE,aAAO,EAAE,MAAM,EAAE,MAAM,IAAI,KAAK;AAAA,IAClC;AAAA,EACF;AACF;AAEA,SAAS,YAAY,MAAY,KAAuB;AACtD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,OAAO,UAAmB;AACjC,YAAM,IAAK,SAAS,CAAC;AAMrB,UAAI,CAAC,EAAE,KAAM,OAAM,IAAI,oBAAoB,EAAE,SAAS,0BAA0B,OAAO,OAAO,CAAC;AAC/F,UAAI,CAAC,EAAE,WAAY,OAAM,IAAI,oBAAoB,EAAE,SAAS,gCAAgC,OAAO,aAAa,CAAC;AACjH,YAAM,SAAS,MAAM,IAAI,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC;AACtD,YAAM,cAAc,OAAO,MAAM,EAAE,UAAU,EAAE,SAAS;AACxD,UAAI,gBAAgB,GAAG;AACrB,cAAM,IAAI,oBAAoB;AAAA,UAC5B,SAAS,kCAAkC,EAAE,IAAI;AAAA,UACjD,OAAO;AAAA,UACP,SAAS,EAAE,MAAM,EAAE,KAAK;AAAA,QAC1B,CAAC;AAAA,MACH;AACA,UAAI,cAAc,KAAK,CAAC,EAAE,aAAa;AACrC,cAAM,IAAI,oBAAoB;AAAA,UAC5B,SAAS,4BAA4B,WAAW,cAAc,EAAE,IAAI;AAAA,UACpE,OAAO;AAAA,UACP,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,YAAY,MAAM;AAAA,QAC1D,CAAC;AAAA,MACH;AACA,YAAM,QAAQ,EAAE,cACZ,OAAO,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,IAClD,OAAO,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE;AACnD,YAAM,IAAI,cAAc,EAAE,MAAM,EAAE,MAAM,SAAS,MAAM,CAAC;AACxD,aAAO,EAAE,MAAM,EAAE,MAAM,cAAc,EAAE,cAAc,cAAc,EAAE;AAAA,IACvE;AAAA,EACF;AACF;AAEA,SAAS,YAAY,MAAY,KAAuB;AACtD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,OAAO,UAAmB;AACjC,YAAM,IAAK,SAAS,CAAC;AACrB,UAAI,CAAC,EAAE,QAAS,OAAM,IAAI,oBAAoB,EAAE,SAAS,6BAA6B,OAAO,UAAU,CAAC;AAGxG,YAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,IAAI,YAAY;AAAA,QACjD,SAAS;AAAA,QACT,MAAM,CAAC,MAAM,EAAE,OAAO;AAAA,QACtB,GAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,MAChC,CAAC;AACD,aAAO,EAAE,QAAQ,QAAQ,WAAW,UAAU,SAAS,EAAE,QAAQ;AAAA,IACnE;AAAA,EACF;AACF;AAWO,SAAS,2BACd,MACA,UAAkC,CAAC,GACmC;AACtE,QAAM,SAAS,KAAK;AACpB,MAAI,CAAC,OAAO,YAAY,CAAC,OAAO,OAAO;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,SAAS,QAAQ,UAAU,IAAI,cAAc,EAAE,QAAQ,KAAK,CAAC;AACnE,QAAM,SAAsB,KAAK;AAOjC,MAAI,eAA6C;AACjD,QAAM,eAAe,MAA6B;AAChD,QAAI,CAAC,cAAc;AACjB,qBAAe,cAAc,EAAE,QAAQ,gBAAgB,KAAK,gBAAgB,OAAO,CAAC;AAAA,IACtF;AACA,WAAO;AAAA,EACT;AAIA,QAAM,YAAY,uBAAuB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,KAAK;AAAA,EACvB,CAAC;AAED,SAAO,eAAe,SACpB,YACA,KACA,KACgB;AAChB,UAAM,UAAU,QAAQ,OAAO,WAAW,EAAE,WAAW;AACvD,UAAM,EAAE,UAAU,iBAAiB,IAAI,MAAM,aAAa;AAI1D,UAAM,SAAS,IAAI,SAAS;AAO5B,UAAM,SAAS,KAAK,gBAAgB,IAAI,aAAa;AACrD,UAAM,QAAQ,IAAI,aAAa;AAC/B,eAAW,KAAK,OAAO,KAAK,EAAG,OAAM,SAAS,CAAC;AAC/C,QAAI,KAAK;AACP,4BAAsB,OAAO,GAAG;AAAA,IAClC;AAOA,UAAM,mBAAqC,KAAK,oBAC5C,IAAI,0BAA0B,IAAI,iBAAiB,IACnD,IAAI,4BAA4B;AAEpC,UAAM,eAAe,IAAI,oBAAoB;AAAA,MAC3C,UAAU,KAAK;AAAA,MACf,YAAY,OAAO;AAAA,MACnB;AAAA,IACF,CAAC;AAID,UAAM,UAAU,EAAE,QAAQ,YAAY;AAAA,IAAC,EAAE;AAEzC,UAAM,UAAU,IAAI,QAAQ;AAAA,MAC1B,cAAc,CAAC;AAAA,MACf;AAAA,MACA;AAAA,MACA,QAAQ,IAAI,gBAAgB,EAAE;AAAA,MAC9B;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,yBAAyB,OAAO,UAAU,2BAA2B;AAAA,MACrE,OAAO,OAAO;AAAA,MACd,OAAO,CAAC,GAAG,MAAM,KAAK,CAAC;AAAA,MACvB,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAED,UAAM,eAAe,IAAI,aAAa,OAAO;AAAA,MAC3C;AAAA,MACA,gBAAgB,UAAU,QAAQ,OAAO,cAAc;AAAA,MACvD,UAAU;AAAA,MACV;AAAA,MACA,gBAAgB;AAAA,MAChB,oBAAoB,OAAO,OAAO,sBAAsB;AAAA,MACxD,kBAAkB,OAAO,OAAO,oBAAoB;AAAA,MACpD,4BAA4B,OAAO,OAAO,8BAA8B;AAAA,MACxE,QAAQ;AAAA,IACV,CAAC;AAED,WAAO,IAAI,MAAM;AAAA,MACf;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX;AAAA,MACA,WAAW,uBAAuB;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,OAAO,OAAO;AAAA,IAC/B,CAAC;AAAA,EACH;AACF;;;ADjUA,SAAS,aAAa,MAA4D;AAChF,SAAO,KAAK,OAAO,KAAK;AAC1B;AAGA,eAAe,SAAS,MAAyD;AAC/E,SAAO,KAAK,QAAQ,sBAAsB,KAAK,KAAK,IAAI;AAC1D;AAEO,IAAM,SAA4B,OAAO,MAAM,SAAS;AAC7D,QAAM,MAAM,KAAK,CAAC;AAElB,MAAI,CAAC,OAAO,QAAQ,YAAY,QAAQ,SAAS;AAC/C,WAAO,aAAa,IAAI;AAAA,EAC1B;AAEA,MAAI,QAAQ,QAAQ;AAClB,SAAK,SAAS,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CA8CvB;AACG,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,QAAQ;AAClB,WAAO,cAAc,IAAI;AAAA,EAC3B;AAEA,MAAI,QAAQ,QAAQ;AAClB,WAAO,gBAAgB,IAAI;AAAA,EAC7B;AAEA,MAAI,QAAQ,SAAS;AACnB,WAAO,cAAc,KAAK,MAAM,CAAC,GAAG,IAAI;AAAA,EAC1C;AAEA,MAAI,QAAQ,YAAY;AACtB,WAAO,kBAAkB,KAAK,MAAM,CAAC,GAAG,IAAI;AAAA,EAC9C;AAEA,MAAI,QAAQ,SAAS;AACnB,WAAO,eAAe,KAAK,MAAM,CAAC,GAAG,IAAI;AAAA,EAC3C;AAEA,MAAI,QAAQ,SAAS;AACnB,WAAO,eAAe,KAAK,MAAM,CAAC,GAAG,IAAI;AAAA,EAC3C;AAEA,OAAK,SAAS,WAAW,2BAA2B,GAAG;AAAA,CAAI;AAC3D,OAAK,SAAS,MAAM,oCAAoC;AACxD,SAAO;AACT;AAGA,SAAS,YAAY,MAA8B;AACjD,MAAI,SAAS,UAAa,SAAS,MAAO,QAAO;AACjD,MAAI,SAAS,QAAQ,SAAS,OAAQ,QAAO;AAC7C,QAAM,IAAI,OAAO,IAAI;AACrB,SAAO,OAAO,UAAU,CAAC,KAAK,IAAI,KAAK,IAAI,QAAS,IAAI;AAC1D;AAQA,eAAe,sBAAsB,MAAsB,MAA+B;AACxF,QAAM,OAAO;AAEb,QAAM,OAAO,KAAK,OAAO,SAAS,QAAQ,KAAK,OAAO,SAAS;AAE/D,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,MAAM;AACR,eAAW,aAAa,EAAE,YAAY,WAAW;AAAA,EACnD,OAAO;AACL,QAAI;AACJ,QAAI;AACF,iBAAW,2BAA2B,IAAI;AAAA,IAC5C,SAAS,KAAK;AACZ,UAAI,eAAe,sBAAsB;AACvC,aAAK,SAAS,WAAW,GAAG,IAAI,OAAO;AAAA,CAAI;AAC3C,eAAO;AAAA,MACT;AACA,YAAM;AAAA,IACR;AACA,kBAAc,MAAM,uBAAuB,EAAE,SAAS,CAAC;AACvD,YAAQ,KAAK,OAAO,aAChB,IAAI,gBAAgB,EAAE,KAAU,UAAK,KAAK,MAAM,YAAY,cAAc,EAAE,CAAC,IAC7E;AAAA,EACN;AAEA,QAAM,MAAM,IAAI,gBAAgB,EAAE,MAAM,MAAM,YAAY,KAAK,OAAO,KAAK,CAAC;AAC5E,MAAI,GAAG,cAAc,CAAC,QAAQ,QAAQ;AAGpC,UAAM,SAAS,IAAI,QAAQ;AAC3B,QAAI,UAAU,WAAW,UAAU,IAAI,IAAI,IAAI,MAAM,WAAW,QAAQ,IAAI,IAAI,IAAI,IAAI;AACtF,aAAO,MAAM,MAAM,wBAAwB;AAC3C;AAAA,IACF;AACA,UAAM,iBAAiB,cAAc;AACrC,UAAM,YAAY,IAAI,kBAAkB,CAAC,MAAM;AAC7C,YAAM,OAAO,KAAK,UAAU,CAAC;AAC7B,UAAI,OAAO,iBAAiB,OAAO,WAAW,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM;AAC9E,eAAO,UAAU;AACjB;AAAA,MACF;AACA,aAAO,KAAK,IAAI;AAAA,IAClB,CAAC;AACD,UAAM,UAAU,IAAI,mBAAmB;AAAA,MACrC;AAAA,MACA,YAAY,KAAK,OAAO,QAAQ,IAAI;AAAA,MACpC,SAAS,kBAAkB;AAAA,MAC3B,GAAI,iBACA;AAAA,QACE,WAAW,eAAe;AAAA,QAC1B,SAAS,eAAe;AAAA,QACxB,YAAY,eAAe;AAAA,MAC7B,IACA,CAAC;AAAA,MACL,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IAC3B,CAAC;AACD,WAAO,GAAG,WAAW,CAAC,SAAiC;AACrD,UAAI;AACJ,UAAI;AACF,cAAM,KAAK,MAAM,KAAK,SAAS,CAAC;AAAA,MAClC,QAAQ;AACN;AAAA,MACF;AACA,gBAAU,QAAQ,GAAY;AAC9B,WAAK,QAAQ,cAAc,GAAG;AAAA,IAChC,CAAC;AACD,UAAM,WAAW,MAAY;AAC3B,cAAQ,MAAM;AACd,gBAAU,MAAM;AAAA,IAClB;AACA,WAAO,GAAG,SAAS,QAAQ;AAC3B,WAAO,GAAG,SAAS,QAAQ;AAAA,EAC7B,CAAC;AAED,OAAK,SAAS;AAAA,IACZ,OACI,oDAAoD,IAAI,IAAI,IAAI;AAAA,IAChE,2CAA2C,IAAI,IAAI,IAAI,KAAK,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,KAAK;AAAA;AAAA,EAC3G;AAEA,QAAM,IAAI,QAAc,CAAC,YAAY;AACnC,UAAM,WAAW,MAAY;AAC3B,WAAK,SAAS,aAAa,yCAAyC;AACpE,UAAI,MAAM;AACV,cAAQ;AAAA,IACV;AACA,YAAQ,GAAG,UAAU,QAAQ;AAC7B,YAAQ,GAAG,WAAW,QAAQ;AAAA,EAChC,CAAC;AACD,SAAO;AACT;AAEA,eAAe,aAAa,MAAuC;AACjE,QAAM,SAAS,YAAY,KAAK,OAAO,EAAE;AACzC,MAAI,WAAW,MAAM;AACnB,WAAO,sBAAsB,MAAM,MAAM;AAAA,EAC3C;AAKA,QAAM,OAAO,KAAK,OAAO,SAAS,QAAQ,KAAK,OAAO,SAAS;AAE/D,QAAM,SAAS,IAAI;AAAA,IACjB,OACI,CAAC,KACA,MAAM;AACL,UAAI;AACJ,UAAI;AACF,mBAAW,2BAA2B,IAAI;AAAA,MAC5C,SAAS,KAAK;AACZ,YAAI,eAAe,sBAAsB;AACvC,eAAK,SAAS,WAAW,GAAG,IAAI,OAAO;AAAA,CAAI;AAC3C,iBAAO,CAAC;AAAA,QACV;AACA,cAAM;AAAA,MACR;AACA,YAAM,OAAO,uBAAuB,EAAE,SAAS,CAAC;AAGhD,YAAM,QAAQ,KAAK,OAAO,aACtB,IAAI,gBAAgB,EAAE,KAAU,UAAK,KAAK,MAAM,YAAY,cAAc,EAAE,CAAC,IAC7E;AACJ,aAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW,KAAK;AAAA,QAChB,SAAS,KAAK;AAAA,QACd,YAAY,KAAK;AAAA,QACjB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,MAC3B;AAAA,IACF,GAAG;AAAA,EACT;AAEA,MAAI,MAAM;AACR,SAAK,SAAS,UAAU,wEAAwE;AAAA,EAClG,OAAO;AACL,SAAK,SAAS;AAAA,MACZ,mCAAmC,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,KAAK;AAAA;AAAA,IAC9E;AACA,SAAK,SAAS,UAAU,+EAA+E;AAAA,EACzG;AASA,yBAAuB;AAAA,IACrB,KAAK,YAAY;AACf,UAAI;AACF,eAAO,KAAK;AAAA,MACd,SAAS,KAAK;AACZ,aAAK,SAAS;AAAA,UACZ,oBAAoB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA;AAAA,QACtE;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC,EAAE,QAAQ;AAEX,MAAI;AACF,UAAM,OAAO,MAAM;AAAA,EACrB,SAAS,KAAK;AACZ,SAAK,SAAS;AAAA,MACZ,qBAAqB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA;AAAA,IACvE;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,eAAe,cAAc,MAAuC;AAClE,QAAM,WAAW,IAAI,iBAAiB;AACtC,QAAM,WAAW,MAAM,SAAS,KAAK;AACrC,OAAK,SAAS,MAAM,0BAA0B;AAE9C,QAAM,YAAY,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS;AACpD,QAAM,UAAU,SAAS,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS;AACnD,aAAW,KAAK,WAAW;AACzB,UAAM,MAAM,EAAE,UAAU,MAAM,EAAE,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM;AAC5D,SAAK,SAAS,MAAM,YAAO,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,GAAG;AAAA,CAAI;AAAA,EACvE;AACA,aAAW,KAAK,SAAS;AACvB,SAAK,SAAS,MAAM,YAAO,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,MAAM,EAAE,UAAU,eAAe;AAAA,CAAK;AAAA,EACnG;AACA,OAAK,SAAS,MAAM;AAAA,EAAK,UAAU,MAAM,OAAO,SAAS,MAAM;AAAA,CAAsB;AACrF,QAAM,OAAO,MAAM,SAAS,IAAI;AAChC,MAAI,QAAQ,KAAK,OAAO,SAAS,GAAG;AAClC,SAAK,SAAS;AAAA,MACZ,oBAAoB,KAAK,OAAO,MAAM;AAAA;AAAA,IACxC;AAAA,EACF,OAAO;AACL,SAAK,SAAS,MAAM,0EAA0E;AAAA,EAChG;AACA,OAAK,SAAS,MAAM,gEAAgE;AACpF,SAAO;AACT;AAEA,eAAe,gBAAgB,MAAuC;AACpE,MAAI,CAAC,KAAK,OAAO;AACf,SAAK,SAAS,WAAW,8CAA8C;AACvE,WAAO;AAAA,EACT;AACA,OAAK,SAAS,UAAU,4CAAuC;AAC/D,MAAI;AACF,UAAM,EAAE,OAAO,SAAS,IAAI,MAAM,mBAAmB,KAAK,KAAK;AAC/D,SAAK,SAAS,MAAM,UAAU,KAAK;AAAA,CAA2C;AAC9E,SAAK,SAAS,UAAU,aAAa,QAAQ;AAAA,CAAI;AACjD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,SAAK,SAAS,WAAW,6BAA6B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,CAAI;AAC1G,SAAK,SAAS,MAAM,yEAAyE;AAC7F,WAAO;AAAA,EACT;AACF;AAEA,eAAe,cAAc,MAAgB,MAAuC;AAClF,QAAM,CAAC,YAAY,GAAG,SAAS,IAAI;AACnC,MAAI,CAAC,YAAY;AACf,SAAK,SAAS,WAAW,6CAA6C;AACtE,SAAK,SAAS,MAAM,kDAAkD;AACtE,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,UAAU,KAAK,GAAG;AAC/B,MAAI,CAAC,MAAM;AACT,SAAK,SAAS,WAAW,6CAA6C;AACtE,SAAK,SAAS,MAAM,iCAAiC;AACrD,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,MAAM,SAAS,IAAI;AAChC,QAAM,MAAM,uBAAuB,YAAY,aAAa,IAAI,GAAG,MAAM,IAAI;AAC7E,MAAI,CAAC,KAAK;AACR,SAAK,SAAS,WAAW,sBAAsB,UAAU;AAAA,CAAI;AAC7D,SAAK,SAAS,MAAM,yEAAyE;AAC7F,WAAO;AAAA,EACT;AAEA,OAAK,SAAS,UAAU,uBAAuB,UAAU;AAAA,CAAM;AAI/D,QAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAM,UAAU,MAAM,GAAG,MAAM;AAC/B,UAAQ,GAAG,UAAU,OAAO;AAC5B,UAAQ,GAAG,WAAW,OAAO;AAE7B,MAAI;AACF,SAAK,SAAS,UAAU,sBAAiB;AACzC,UAAM,SAAS,MAAM,cAAc;AAAA,MACjC,SAAS,IAAI;AAAA,MACb,GAAI,IAAI,SAAS,SAAY,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;AAAA,MACnD,GAAI,IAAI,QAAQ,SAAY,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC;AAAA,MAChD,MAAM;AAAA,MACN;AAAA,MACA,QAAQ,GAAG;AAAA,MACX,kBAAkB;AAAA,MAClB,YAAY,CAAC,UAAU;AACrB,cAAM,OAAO,eAAe,KAAK;AACjC,YAAI,KAAM,MAAK,SAAS,UAAU,KAAK,IAAI;AAAA,CAAI;AAAA,MACjD;AAAA,IACF,CAAC;AAED,SAAK,SAAS,MAAM,oBAAoB;AACxC,SAAK,SAAS,MAAM,OAAO,OAAO,SAAS,IAAI,OAAO,SAAS,WAAW;AAC1E,SAAK,SAAS,MAAM,qBAAqB;AACzC,SAAK,SAAS;AAAA,MACZ,oBAAoB,OAAO,UAAU,cAAc,OAAO,SAAS;AAAA;AAAA,IACrE;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AAGZ,UAAM,IAAI;AACV,UAAM,SAAS,EAAE,OAAO,IAAI,EAAE,IAAI,OAAO;AACzC,UAAM,UAAU,EAAE,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC7E,SAAK,SAAS,WAAW,oBAAoB,MAAM,GAAG,OAAO;AAAA,CAAI;AACjE,WAAO;AAAA,EACT,UAAE;AACA,YAAQ,IAAI,UAAU,OAAO;AAC7B,YAAQ,IAAI,WAAW,OAAO;AAAA,EAChC;AACF;AAQA,SAAS,eAAe,OAAiC;AACvD,UAAQ,MAAM,MAAM;AAAA,IAClB,KAAK;AACH,aAAO,UAAK,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,MAAM;AAAA,IAC5D,KAAK;AACH,aAAO,MAAM,SAAS,WAAW,eAAe,MAAM,SAAS,WAAW,WACtE,YAAO,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,MAAM,KACrD;AAAA,IACN,KAAK;AACH,aAAO,UAAK,MAAM,KAAK,IAAI,GAAG,MAAM,KAAK,YAAY,OAAO,WAAW,EAAE;AAAA,IAC3E,KAAK;AACH,aAAO,gBAAW,MAAM,QAAQ,MAAM;AAAA,IACxC;AACE,aAAO;AAAA,EACX;AACF;AAEA,eAAe,kBACb,MACA,MACiB;AACjB,QAAM,CAAC,KAAK,GAAG,SAAS,IAAI;AAC5B,MAAI,CAAC,KAAK;AACR,SAAK,SAAS,WAAW,oDAAoD;AAC7E,SAAK,SAAS,MAAM,0EAA0E;AAC9F,WAAO;AAAA,EACT;AACA,QAAM,OAAO,UAAU,KAAK,GAAG;AAC/B,MAAI,CAAC,MAAM;AACT,SAAK,SAAS,WAAW,oDAAoD;AAC7E,SAAK,SAAS,WAAW,iCAAiC;AAC1D,WAAO;AAAA,EACT;AAIA,QAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAM,WAAW,MAAM,GAAG,MAAM;AAChC,UAAQ,GAAG,UAAU,QAAQ;AAC7B,UAAQ,GAAG,WAAW,QAAQ;AAE9B,MAAI;AACF,UAAM,YAAY,aAAa,IAAI;AACnC,UAAM,OAAO,MAAM,SAAS,IAAI;AAChC,UAAM,SAAS,MAAM,YAAY;AAAA,MAC/B,UAAU;AAAA,MACV;AAAA,MACA,YAAY,CAAC,OAAO,uBAAuB,IAAI,WAAW,MAAM,IAAI;AAAA,MACpE,QAAQ,GAAG;AAAA,MACX,YAAY,CAAC,SAAS,UAAU;AAC9B,cAAM,OAAO,eAAe,KAAK;AACjC,YAAI,KAAM,MAAK,SAAS,UAAU,MAAM,OAAO,KAAK,IAAI;AAAA,CAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAGD,UAAM,UAAU,OAAO,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AACnE,QAAI,QAAQ,SAAS,GAAG;AACtB,WAAK,SAAS;AAAA,QACZ,YAAY,QAAQ,MAAM,4BAA4B,QAAQ,IAAI,CAAC,MAAM,GAAG,EAAE,OAAO,KAAK,EAAE,UAAU,eAAe,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,MACtI;AAAA,IACF;AACA,QAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,SAAS,OAAO,QAAQ,cAAc,GAAG;AACrF,WAAK,SAAS,WAAW,+BAA+B;AACxD,WAAK,SAAS,MAAM,mDAAmD;AACvE,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,OAAO,QACtB,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS,EACpC,IAAI,CAAC,MAAM,EAAE,OAAO,EACpB,KAAK,IAAI;AACZ,SAAK,SAAS;AAAA,MACZ,kBAAkB,OAAO,QAAQ,YAAY,OAAO,QAAQ,SAAS,OAAO,QAAQ,SAAS,cAAc,SAAS;AAAA;AAAA,IACtH;AACA,SAAK,SAAS,UAAU,SAAS,OAAO,IAAI;AAAA;AAAA,CAAM;AAGlD,eAAW,KAAK,OAAO,SAAS;AAC9B,UAAI,EAAE,WAAW,UAAW;AAC5B,WAAK,SAAS,MAAM;AAAA,MAAS,EAAE,OAAO;AAAA,CAAQ;AAC9C,UAAI,EAAE,WAAW,WAAW;AAC1B,aAAK,SAAS,MAAM,EAAE,UAAU,EAAE,OAAO,SAAS,IAAI,EAAE,SAAS,aAAa;AAC9E,aAAK,SAAS;AAAA,UACZ;AAAA,GAAM,EAAE,OAAO,cAAc,EAAE,UAAU,kBAAkB,EAAE,UAAU,cAAc,EAAE,SAAS;AAAA;AAAA,QAClG;AAAA,MACF,WAAW,EAAE,WAAW,UAAU;AAChC,aAAK,SAAS;AAAA,UACZ,IAAI,EAAE,OAAO,QAAQ,SAAS,KAAK,EAAE,OAAO,WAAW,QAAQ;AAAA;AAAA,QACjE;AACA,aAAK,SAAS;AAAA,UACZ,IAAI,EAAE,OAAO,aAAa,EAAE,UAAU;AAAA;AAAA,QACxC;AAAA,MACF,OAAO;AAEL,aAAK,SAAS;AAAA,UACZ,IAAI,EAAE,OAAO,QAAQ,SAAS,KAAK,EAAE,OAAO,WAAW,WAAW;AAAA;AAAA,QACpE;AACA,aAAK,SAAS;AAAA,UACZ,IAAI,EAAE,OAAO,gBAAgB,EAAE,UAAU;AAAA;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,WAAW,QAAQ,WAAW,SAAS,KAAK,IAAI,OAAO;AAC/D,SAAK,SAAS;AAAA,MACZ;AAAA,oBAAuB,SAAS,eAAe,MAAM,YAAY,SAAS,eAAe,IAAI;AAAA;AAAA,IAC/F;AAGA,WAAO,YAAY,IAAI,IAAI;AAAA,EAC7B,UAAE;AACA,YAAQ,IAAI,UAAU,QAAQ;AAC9B,YAAQ,IAAI,WAAW,QAAQ;AAAA,EACjC;AACF;AAEA,eAAe,eAAe,MAAgB,MAAuC;AACnF,QAAM,MAAM,KAAK,KAAK,GAAG;AACzB,MAAI;AACJ,MAAI,KAAK;AACP,UAAM,IAAI,MAAM,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAAA,EACzF,OAAO;AACL,UAAM,WAAW,MAAM,IAAI,iBAAiB,EAAE,KAAK;AACnD,UAAM,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,EAC3D;AACA,MAAI,IAAI,WAAW,GAAG;AACpB,SAAK,SAAS,WAAW,iCAAiC;AAC1D,WAAO;AAAA,EACT;AACA,QAAM,YAAY,aAAa,IAAI;AACnC,QAAM,OAAO,MAAM,SAAS,IAAI;AAChC,OAAK,SAAS;AAAA,IACZ,WAAW,IAAI,MAAM;AAAA;AAAA,EACvB;AACA,QAAM,UAAU,MAAM,eAAe;AAAA,IACnC,UAAU;AAAA,IACV,YAAY,CAAC,OAAO,uBAAuB,IAAI,WAAW,MAAM,IAAI;AAAA,IACpE,aAAa,KAAK,OAAO,QAAQ,IAAI;AAAA,IACrC,YAAY,CAAC,IAAI,MAAM,KAAK,SAAS,UAAU,KAAK,EAAE,KAAK,WAAM,QAAG,IAAI,EAAE,KAAK,EAAE,EAAE;AAAA,CAAO;AAAA,EAC5F,CAAC;AACD,OAAK,SAAS,MAAM,4BAA4B;AAChD,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,IAAI;AACR,YAAM,OAAO,EAAE,YAAY,WAAM,EAAE,UAAU,IAAI,IAAI,EAAE,UAAU,OAAO,KAAK;AAC7E,WAAK,SAAS,MAAM,YAAO,EAAE,GAAG,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,IAAI;AAAA,CAAI;AAAA,IACrE,OAAO;AACL,WAAK,SAAS,MAAM,YAAO,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI,EAAE,SAAS,QAAQ,MAAM,EAAE,EAAE;AAAA,CAAO;AAAA,IACpF;AAAA,EACF;AACA,QAAM,KAAK,QAAQ,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE;AACvC,OAAK,SAAS,MAAM;AAAA,EAAK,EAAE,OAAO,QAAQ,MAAM;AAAA,CAAwC;AACxF,SAAO,KAAK,IAAI,IAAI;AACtB;AAEA,eAAe,eAAe,MAAgB,MAAuC;AAGnF,QAAM,UACJ,KAAK,OAAO,OAAO,QAAQ,KAAK,OAAO,OAAO,UAAU,KAAK,SAAS,MAAM;AAC9E,QAAM,MAAM,KAAK,OAAO,CAAC,MAAM,MAAM,MAAM,EAAE,KAAK,GAAG;AAErD,MAAI;AACJ,MAAI,KAAK;AACP,UAAM,IACH,MAAM,GAAG,EACT,QAAQ,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,EAC7B,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAAA,EACnB,OAAO;AACL,UAAM,WAAW,MAAM,IAAI,iBAAiB,EAAE,KAAK;AACnD,UAAM,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,EAC3D;AACA,MAAI,IAAI,WAAW,GAAG;AACpB,SAAK,SAAS,WAAW,iCAAiC;AAC1D,SAAK,SAAS,MAAM,iEAAiE;AACrF,WAAO;AAAA,EACT;AAEA,QAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAM,WAAW,MAAM,GAAG,MAAM;AAChC,UAAQ,GAAG,UAAU,QAAQ;AAC7B,UAAQ,GAAG,WAAW,QAAQ;AAE9B,MAAI;AACF,UAAM,YAAY,aAAa,IAAI;AACnC,UAAM,OAAO,MAAM,SAAS,IAAI;AAChC,SAAK,SAAS;AAAA,MACZ,YAAY,IAAI,MAAM,YAAY,UAAU,qBAAqB,EAAE,KAAK,IAAI,KAAK,IAAI,CAAC;AAAA;AAAA,IACxF;AACA,UAAM,SAAS,MAAM,YAAY;AAAA,MAC/B,UAAU;AAAA,MACV,YAAY,CAAC,OAAO,uBAAuB,IAAI,WAAW,MAAM,IAAI;AAAA,MACpE,aAAa,KAAK,OAAO,QAAQ,IAAI;AAAA,MACrC;AAAA,MACA,QAAQ,GAAG;AAAA,MACX,YAAY,CAAC,SAAS,OAAO,MAAM;AACjC,YAAI,UAAU,QAAS,MAAK,SAAS,UAAU,YAAO,OAAO;AAAA,CAAK;AAAA,iBACzD,EAAG,MAAK,SAAS,UAAU,YAAO,OAAO,KAAK,EAAE,MAAM;AAAA,CAAI;AAAA,MACrE;AAAA,IACF,CAAC;AACD,SAAK,SAAS,MAAM;AAAA,EAAK,mBAAmB,MAAM,CAAC;AAAA,CAAI;AAEvD,WAAO,OAAO,QAAQ,OAAO,IAAI,IAAI;AAAA,EACvC,UAAE;AACA,YAAQ,IAAI,UAAU,QAAQ;AAC9B,YAAQ,IAAI,WAAW,QAAQ;AAAA,EACjC;AACF;",
+  "names": []
+}

package/dist/acp-server-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acp-server-agent.d.ts","sourceRoot":"","sources":["../src/acp-server-agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,EAAmC,MAAM,wBAAwB,CAAC;AAIhF,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,KAAK,IAAI,EAAuB,MAAM,wBAAwB,CAAC;AAKrI,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AASD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAA0B,YAAW,gBAAgB;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAA9C,YAA6B,iBAAiB,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAI;IAE7E,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA6BtE;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;IAC9B,QAAQ,IAAI,IAAI,CAAG;IACnB,SAAS,IAAI,IAAI,CAAG;IACd,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;CACjC;AAmID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE,sBAA2B,GACnC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,KAAK,CAAC,CAmHtE"}
+{"version":3,"file":"acp-server-agent.d.ts","sourceRoot":"","sources":["../src/acp-server-agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,EAAmC,MAAM,wBAAwB,CAAC;AAIhF,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,KAAK,IAAI,EAAuB,MAAM,wBAAwB,CAAC;AAKrI,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AASD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAA0B,YAAW,gBAAgB;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAA9C,YAA6B,iBAAiB,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAI;IAE7E,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA6BtE;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;IAC9B,QAAQ,IAAI,IAAI,CAAG;IACnB,SAAS,IAAI,IAAI,CAAG;IACd,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;CACjC;AAmID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE,sBAA2B,GACnC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,KAAK,CAAC,CAoHtE"}

package/dist/arg-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"arg-parser.d.ts","sourceRoot":"","sources":["../src/arg-parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,aA6DxB,CAAC;AAIH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;IACxC,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,yCAAyC;AACzC,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAoCpD;AAyCD,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,wBAAwB,EAAE,UAAU,GAAG,SAAS,CAAC;IACjE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAChC;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAyBxD;AAID,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC3B,CAAC;CACH;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CA8CzD"}
+{"version":3,"file":"arg-parser.d.ts","sourceRoot":"","sources":["../src/arg-parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,aAuExB,CAAC;AAIH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;IACxC,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,yCAAyC;AACzC,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAoCpD;AAyCD,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,wBAAwB,EAAE,UAAU,GAAG,SAAS,CAAC;IACjE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAChC;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAyBxD;AAID,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC3B,CAAC;CACH;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CA8CzD"}

package/dist/audit-2ZSFGNIF.js

@@ -0,0 +1,102 @@
+import "./chunk-7OCVIDC7.js";
+
+// src/subcommands/handlers/audit.ts
+import { color, resolveWstackPaths } from "@wrongstack/core/utils";
+import { ToolAuditLog } from "@wrongstack/core/storage";
+var auditCmd = async (args, deps) => {
+  const wpaths = resolveWstackPaths({
+    projectRoot: deps.projectRoot,
+    userHome: deps.userHome
+  });
+  const log = new ToolAuditLog({ dir: wpaths.projectSessions });
+  if (args[0] === "--list" || args[0] === "-l") {
+    return listAudits(log, wpaths.projectSessions, deps);
+  }
+  const sessionId = args[0];
+  if (!sessionId) {
+    deps.renderer.writeError(
+      "Usage: wstack audit <sessionId>\n       wstack audit --list\n\nInspects a session's tamper-evident tool audit log. Each entry\nis chained to the previous via SHA-256; any post-hoc modification\nbreaks the chain. Use this to verify a session was not tampered\nwith after recording.\n"
+    );
+    return 1;
+  }
+  const entries = await log.load(sessionId);
+  if (entries.length === 0) {
+    deps.renderer.write(
+      color.yellow(
+        `No audit entries for session ${sessionId}. (The audit log is written when tools are recorded \u2014 check that the session ran with audit enabled.)`
+      ) + "\n"
+    );
+    return 0;
+  }
+  const verify = await log.verify(sessionId);
+  const lines = [
+    color.bold(`Audit log for ${sessionId}`),
+    verify.ok ? `  ${color.green("\u2713 Verified")}  ${entries.length} entries, chain intact` : `  ${color.red("\u2717 BROKEN")}  at entry ${verify.brokenAt}: ${verify.reason}`,
+    "",
+    "  Entries (oldest first):"
+  ];
+  const cap = 12;
+  for (const e of entries.slice(0, cap)) {
+    const t = color.dim(e.ts.slice(11, 19));
+    const idx = color.dim(`#${e.index}`.padStart(4));
+    const tool = e.toolName;
+    const err = e.isError ? color.red("(error)") : "";
+    lines.push(
+      `    ${t}  ${idx}  ${color.cyan(tool.padEnd(14))} ${err}  ${color.dim(e.hash.slice(0, 12) + "\u2026")}`
+    );
+  }
+  if (entries.length > cap) {
+    lines.push(color.dim(`    \u2026 and ${entries.length - cap} more`));
+  }
+  deps.renderer.write(lines.join("\n") + "\n");
+  return verify.ok ? 0 : 1;
+};
+async function listAudits(log, dir, deps) {
+  const fs = await import("node:fs/promises");
+  const path = await import("node:path");
+  const out = [];
+  let foundRoot = true;
+  const scan = async (scanDir, prefix, depth) => {
+    let entries;
+    try {
+      entries = await fs.readdir(scanDir, { withFileTypes: true });
+    } catch {
+      if (depth === 0) foundRoot = false;
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.startsWith(".")) continue;
+      if (entry.isDirectory()) {
+        if (depth === 0) await scan(path.join(scanDir, entry.name), entry.name, depth + 1);
+        continue;
+      }
+      if (!entry.isFile() || !entry.name.endsWith(".audit.jsonl")) continue;
+      const base = entry.name.slice(0, -".audit.jsonl".length);
+      const sessionId = prefix ? `${prefix}/${base}` : base;
+      const all = await log.load(sessionId);
+      const verify = await log.verify(sessionId);
+      out.push({ sessionId, entryCount: all.length, ok: verify.ok });
+    }
+  };
+  await scan(dir, "", 0);
+  if (!foundRoot) {
+    deps.renderer.write(color.dim(`No sessions dir found at ${dir}. Run a session first.`) + "\n");
+    return 0;
+  }
+  out.sort((a, b) => a.sessionId.localeCompare(b.sessionId));
+  if (out.length === 0) {
+    deps.renderer.write(color.dim("No audit logs recorded yet.") + "\n");
+    return 0;
+  }
+  const lines = [color.bold(`${out.length} audit log(s)`), ""];
+  for (const r of out) {
+    const status = r.ok ? color.green("\u2713 intact") : color.red("\u2717 broken");
+    lines.push(`  ${color.cyan(r.sessionId)}  ${color.dim(`${r.entryCount} entries`)}  ${status}`);
+  }
+  deps.renderer.write(lines.join("\n") + "\n");
+  return 0;
+}
+export {
+  auditCmd
+};
+//# sourceMappingURL=audit-2ZSFGNIF.js.map

package/dist/audit-2ZSFGNIF.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/subcommands/handlers/audit.ts"],
+  "sourcesContent": ["import { color, resolveWstackPaths } from '@wrongstack/core/utils';\nimport { ToolAuditLog } from '@wrongstack/core/storage';\nimport type { SubcommandHandler } from '../index.js';\n\n/**\n * `wstack audit <sessionId>` \u2014 inspect a session's tamper-evident\n * tool audit log. Shows the chained hash entries and runs\n * `ToolAuditLog.verify()` to surface any post-hoc modifications.\n *\n * Subcommands:\n *   - `wstack audit <sessionId>`  \u2014 show entries + verify\n *   - `wstack audit --list`       \u2014 list all sessions with audit logs\n */\nexport const auditCmd: SubcommandHandler = async (args, deps) => {\n  const wpaths = resolveWstackPaths({\n    projectRoot: deps.projectRoot,\n    userHome: deps.userHome,\n  });\n  const log = new ToolAuditLog({ dir: wpaths.projectSessions });\n\n  if (args[0] === '--list' || args[0] === '-l') {\n    return listAudits(log, wpaths.projectSessions, deps);\n  }\n\n  const sessionId = args[0];\n  if (!sessionId) {\n    deps.renderer.writeError(\n      'Usage: wstack audit <sessionId>\\n' +\n        '       wstack audit --list\\n\\n' +\n        \"Inspects a session's tamper-evident tool audit log. Each entry\\n\" +\n        'is chained to the previous via SHA-256; any post-hoc modification\\n' +\n        'breaks the chain. Use this to verify a session was not tampered\\n' +\n        'with after recording.\\n',\n    );\n    return 1;\n  }\n\n  const entries = await log.load(sessionId);\n  if (entries.length === 0) {\n    deps.renderer.write(\n      color.yellow(\n        `No audit entries for session ${sessionId}. ` +\n          `(The audit log is written when tools are recorded \u2014 check that the session ran with audit enabled.)`,\n      ) + '\\n',\n    );\n    return 0;\n  }\n  const verify = await log.verify(sessionId);\n  const lines: string[] = [\n    color.bold(`Audit log for ${sessionId}`),\n    verify.ok\n      ? `  ${color.green('\u2713 Verified')}  ${entries.length} entries, chain intact`\n      : `  ${color.red('\u2717 BROKEN')}  at entry ${(verify as { brokenAt: number }).brokenAt}: ${(verify as { reason: string }).reason}`,\n    '',\n    '  Entries (oldest first):',\n  ];\n  const cap = 12;\n  for (const e of entries.slice(0, cap)) {\n    const t = color.dim(e.ts.slice(11, 19));\n    const idx = color.dim(`#${e.index}`.padStart(4));\n    const tool = e.toolName;\n    const err = e.isError ? color.red('(error)') : '';\n    lines.push(\n      `    ${t}  ${idx}  ${color.cyan(tool.padEnd(14))} ${err}  ${color.dim(e.hash.slice(0, 12) + '\u2026')}`,\n    );\n  }\n  if (entries.length > cap) {\n    lines.push(color.dim(`    \u2026 and ${entries.length - cap} more`));\n  }\n  deps.renderer.write(lines.join('\\n') + '\\n');\n  return verify.ok ? 0 : 1;\n};\n\nasync function listAudits(\n  log: ToolAuditLog,\n  dir: string,\n  deps: import('../index.js').SubcommandDeps,\n): Promise<number> {\n  // Sidecar files end in .audit.jsonl. They sit next to their session\n  // JSONL \u2014 flat at the root for legacy ids, inside a date-shard dir for\n  // modern ids (\"2026-06-11/<base>.audit.jsonl\"). Scan both levels.\n  const fs = await import('node:fs/promises');\n  const path = await import('node:path');\n  const out: Array<{ sessionId: string; entryCount: number; ok: boolean }> = [];\n  let foundRoot = true;\n  const scan = async (scanDir: string, prefix: string, depth: number): Promise<void> => {\n    let entries: import('node:fs').Dirent[];\n    try {\n      entries = await fs.readdir(scanDir, { withFileTypes: true });\n    } catch {\n      if (depth === 0) foundRoot = false;\n      return;\n    }\n    for (const entry of entries) {\n      if (entry.name.startsWith('.')) continue;\n      if (entry.isDirectory()) {\n        if (depth === 0) await scan(path.join(scanDir, entry.name), entry.name, depth + 1);\n        continue;\n      }\n      if (!entry.isFile() || !entry.name.endsWith('.audit.jsonl')) continue;\n      const base = entry.name.slice(0, -'.audit.jsonl'.length);\n      const sessionId = prefix ? `${prefix}/${base}` : base;\n      const all = await log.load(sessionId);\n      const verify = await log.verify(sessionId);\n      out.push({ sessionId, entryCount: all.length, ok: verify.ok });\n    }\n  };\n  await scan(dir, '', 0);\n  if (!foundRoot) {\n    deps.renderer.write(color.dim(`No sessions dir found at ${dir}. Run a session first.`) + '\\n');\n    return 0;\n  }\n  out.sort((a, b) => a.sessionId.localeCompare(b.sessionId));\n  if (out.length === 0) {\n    deps.renderer.write(color.dim('No audit logs recorded yet.') + '\\n');\n    return 0;\n  }\n  const lines: string[] = [color.bold(`${out.length} audit log(s)`), ''];\n  for (const r of out) {\n    const status = r.ok ? color.green('\u2713 intact') : color.red('\u2717 broken');\n    lines.push(`  ${color.cyan(r.sessionId)}  ${color.dim(`${r.entryCount} entries`)}  ${status}`);\n  }\n  deps.renderer.write(lines.join('\\n') + '\\n');\n  return 0;\n}\n"],
+  "mappings": ";;;;AAAA,SAAS,OAAO,0BAA0B;AAC1C,SAAS,oBAAoB;AAYtB,IAAM,WAA8B,OAAO,MAAM,SAAS;AAC/D,QAAM,SAAS,mBAAmB;AAAA,IAChC,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK;AAAA,EACjB,CAAC;AACD,QAAM,MAAM,IAAI,aAAa,EAAE,KAAK,OAAO,gBAAgB,CAAC;AAE5D,MAAI,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,MAAM,MAAM;AAC5C,WAAO,WAAW,KAAK,OAAO,iBAAiB,IAAI;AAAA,EACrD;AAEA,QAAM,YAAY,KAAK,CAAC;AACxB,MAAI,CAAC,WAAW;AACd,SAAK,SAAS;AAAA,MACZ;AAAA,IAMF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,SAAS;AACxC,MAAI,QAAQ,WAAW,GAAG;AACxB,SAAK,SAAS;AAAA,MACZ,MAAM;AAAA,QACJ,gCAAgC,SAAS;AAAA,MAE3C,IAAI;AAAA,IACN;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,IAAI,OAAO,SAAS;AACzC,QAAM,QAAkB;AAAA,IACtB,MAAM,KAAK,iBAAiB,SAAS,EAAE;AAAA,IACvC,OAAO,KACH,KAAK,MAAM,MAAM,iBAAY,CAAC,KAAK,QAAQ,MAAM,2BACjD,KAAK,MAAM,IAAI,eAAU,CAAC,cAAe,OAAgC,QAAQ,KAAM,OAA8B,MAAM;AAAA,IAC/H;AAAA,IACA;AAAA,EACF;AACA,QAAM,MAAM;AACZ,aAAW,KAAK,QAAQ,MAAM,GAAG,GAAG,GAAG;AACrC,UAAM,IAAI,MAAM,IAAI,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;AACtC,UAAM,MAAM,MAAM,IAAI,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;AAC/C,UAAM,OAAO,EAAE;AACf,UAAM,MAAM,EAAE,UAAU,MAAM,IAAI,SAAS,IAAI;AAC/C,UAAM;AAAA,MACJ,OAAO,CAAC,KAAK,GAAG,KAAK,MAAM,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,MAAM,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,IAAI,QAAG,CAAC;AAAA,IAClG;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,KAAK;AACxB,UAAM,KAAK,MAAM,IAAI,kBAAa,QAAQ,SAAS,GAAG,OAAO,CAAC;AAAA,EAChE;AACA,OAAK,SAAS,MAAM,MAAM,KAAK,IAAI,IAAI,IAAI;AAC3C,SAAO,OAAO,KAAK,IAAI;AACzB;AAEA,eAAe,WACb,KACA,KACA,MACiB;AAIjB,QAAM,KAAK,MAAM,OAAO,kBAAkB;AAC1C,QAAM,OAAO,MAAM,OAAO,WAAW;AACrC,QAAM,MAAqE,CAAC;AAC5E,MAAI,YAAY;AAChB,QAAM,OAAO,OAAO,SAAiB,QAAgB,UAAiC;AACpF,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,GAAG,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC;AAAA,IAC7D,QAAQ;AACN,UAAI,UAAU,EAAG,aAAY;AAC7B;AAAA,IACF;AACA,eAAW,SAAS,SAAS;AAC3B,UAAI,MAAM,KAAK,WAAW,GAAG,EAAG;AAChC,UAAI,MAAM,YAAY,GAAG;AACvB,YAAI,UAAU,EAAG,OAAM,KAAK,KAAK,KAAK,SAAS,MAAM,IAAI,GAAG,MAAM,MAAM,QAAQ,CAAC;AACjF;AAAA,MACF;AACA,UAAI,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,cAAc,EAAG;AAC7D,YAAM,OAAO,MAAM,KAAK,MAAM,GAAG,CAAC,eAAe,MAAM;AACvD,YAAM,YAAY,SAAS,GAAG,MAAM,IAAI,IAAI,KAAK;AACjD,YAAM,MAAM,MAAM,IAAI,KAAK,SAAS;AACpC,YAAM,SAAS,MAAM,IAAI,OAAO,SAAS;AACzC,UAAI,KAAK,EAAE,WAAW,YAAY,IAAI,QAAQ,IAAI,OAAO,GAAG,CAAC;AAAA,IAC/D;AAAA,EACF;AACA,QAAM,KAAK,KAAK,IAAI,CAAC;AACrB,MAAI,CAAC,WAAW;AACd,SAAK,SAAS,MAAM,MAAM,IAAI,4BAA4B,GAAG,wBAAwB,IAAI,IAAI;AAC7F,WAAO;AAAA,EACT;AACA,MAAI,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,cAAc,EAAE,SAAS,CAAC;AACzD,MAAI,IAAI,WAAW,GAAG;AACpB,SAAK,SAAS,MAAM,MAAM,IAAI,6BAA6B,IAAI,IAAI;AACnE,WAAO;AAAA,EACT;AACA,QAAM,QAAkB,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,eAAe,GAAG,EAAE;AACrE,aAAW,KAAK,KAAK;AACnB,UAAM,SAAS,EAAE,KAAK,MAAM,MAAM,eAAU,IAAI,MAAM,IAAI,eAAU;AACpE,UAAM,KAAK,KAAK,MAAM,KAAK,EAAE,SAAS,CAAC,KAAK,MAAM,IAAI,GAAG,EAAE,UAAU,UAAU,CAAC,KAAK,MAAM,EAAE;AAAA,EAC/F;AACA,OAAK,SAAS,MAAM,MAAM,KAAK,IAAI,IAAI,IAAI;AAC3C,SAAO;AACT;",
+  "names": []
+}