@wrongstack/core 0.284.0 → 0.285.0

package/dist/tools/index.js

@@ -1,11 +1,7 @@
-import * as fs from 'fs/promises';
-import { randomBytes } from 'crypto';
-import * as path from 'path';
-
 // src/utils/expect-defined.ts
 function expectDefined(value, label) {
   if (value === null || value === void 0) {
-    const err = new Error("Expected value to be defined");
+    const err = new Error(label ? `Expected ${label} to be defined` : "Expected value to be defined");
     err.name = "ExpectDefinedError";
     throw err;
   }
@@ -19,8 +15,83 @@ function toErrorMessage(err) {
 
 // src/security/capabilities.ts
 var ToolCapabilities = {
+  /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
+  SHELL_ARBITRARY: "shell.arbitrary",
+  /** Can execute a restricted set of commands (the `exec` tool). */
+  SHELL_RESTRICTED: "shell.restricted",
+  /** Can run a restricted project formatter/linter-style command. */
+  SHELL_EXEC: "shell.exec",
+  /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
+  FS_READ: "fs.read",
+  /** Can write / modify / delete files inside the project. */
+  FS_WRITE: "fs.write",
+  /** Can write files outside the current project root (very high risk). */
+  FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project",
+  /** Can perform outbound network requests. */
+  NET_OUTBOUND: "net.outbound",
+  /** Can mutate in-memory session todos only. */
+  SESSION_TODO: "session.todo",
+  /** Can mutate in-memory session mode only. */
+  SESSION_MODE: "session.mode",
+  /** Can inspect registered tool metadata. */
+  TOOL_META: "tool.meta",
+  /** Can invoke arbitrary registered tools through a meta-tool. */
+  TOOL_MUTATE_ANY: "tool.mutate.any",
+  /** Can read persistent memory. */
+  MEMORY_READ: "memory.read",
+  /** Can write persistent memory. */
+  MEMORY_WRITE: "memory.write",
+  /** Can delete persistent memory. */
+  MEMORY_DELETE: "memory.delete",
+  /** Proxies tools from external MCP servers (unknown capability). */
+  MCP_PROXY: "mcp.proxy",
+  /** Can spawn or manage subagents / multi-agent tasks. */
+  SUBAGENT_SPAWN: "subagent.spawn",
+  /** Can inspect fleet/subagent coordination state without mutating it. */
+  COORDINATION_FLEET_READ: "coordination.fleet.read",
+  /** Can publish attributed, schema-checked events onto the fleet bus. */
+  COORDINATION_FLEET_EMIT: "coordination.fleet.emit",
+  /** Can submit a task-local structured result to the parent Director. */
+  COORDINATION_RESULT_SUBMIT: "coordination.result.submit",
+  /** Can read or write inter-agent mailbox messages. */
+  COORDINATION_MAIL: "coordination.mail",
+  /** Can schedule, inspect, or cancel in-session cron jobs. */
+  COORDINATION_CRON: "coordination.cron",
   /** Can mutate global or session configuration / trust state. */
-  CONFIG_MUTATE: "config.mutate"};
+  CONFIG_MUTATE: "config.mutate",
+  /** Can install packages or run package managers with side effects. */
+  PACKAGE_INSTALL: "package.install"
+};
+var DANGEROUS_FOR_SUBAGENTS = [
+  ToolCapabilities.SHELL_ARBITRARY,
+  ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
+  ToolCapabilities.FS_WRITE,
+  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
+  ToolCapabilities.TOOL_MUTATE_ANY,
+  ToolCapabilities.MEMORY_WRITE,
+  ToolCapabilities.MEMORY_DELETE,
+  ToolCapabilities.MCP_PROXY,
+  ToolCapabilities.SUBAGENT_SPAWN,
+  ToolCapabilities.CONFIG_MUTATE,
+  ToolCapabilities.PACKAGE_INSTALL
+];
+var WIDE_SUBAGENT_CAPABILITIES = [
+  ToolCapabilities.FS_READ,
+  ToolCapabilities.FS_WRITE,
+  ToolCapabilities.NET_OUTBOUND,
+  ToolCapabilities.SESSION_TODO,
+  ToolCapabilities.TOOL_META,
+  ToolCapabilities.MEMORY_READ,
+  ToolCapabilities.SHELL_ARBITRARY,
+  ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
+  ToolCapabilities.PACKAGE_INSTALL,
+  // Read-only fleet visibility (fleet_status) — peer awareness has no blast
+  // radius and every fleet worker should coordinate around its peers.
+  ToolCapabilities.COORDINATION_FLEET_READ,
+  ToolCapabilities.COORDINATION_RESULT_SUBMIT
+];
 
 // src/infrastructure/mcp-servers.ts
 var filesystemServer = () => ({
@@ -178,6 +249,14 @@ var allServers = () => ({
   playwright: { ...playwrightServer(), enabled: false },
   ssh: { ...sshManagerServer(), enabled: false }
 });
+
+// src/utils/config-json.ts
+import * as fs2 from "node:fs/promises";
+
+// src/utils/atomic-write.ts
+import { randomBytes } from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
 async function atomicWrite(targetPath, content, opts = {}) {
   const dir = path.dirname(targetPath);
   await fs.mkdir(dir, { recursive: true });
@@ -249,7 +328,7 @@ async function renameWithRetry(from, to) {
 // src/utils/config-json.ts
 async function readJsonObjectFile(filePath) {
   try {
-    const parsed = JSON.parse(await fs.readFile(filePath, "utf8"));
+    const parsed = JSON.parse(await fs2.readFile(filePath, "utf8"));
     return isJsonObject(parsed) ? parsed : {};
   } catch {
     return {};
@@ -341,10 +420,10 @@ function createMcpControlTool(opts) {
     mutating: true,
     // `enable`/`restart` spawn a server process that, for the stdio presets,
     // fetches and runs an npm package (`npx -y <pkg>`) — effectively remote
-    // code execution. Marking the tool destructive means YOLO still prompts
-    // before it runs (plain non-YOLO already confirms via the CONFIG_MUTATE
-    // dangerous-capability net in the executor). Read-only actions
-    // (list/search) ride the same tool but are cheap to confirm/trust once.
+    // code execution. Marking the tool destructive preserves risk metadata for
+    // UI/audit surfaces; YOLO itself still auto-approves unless an explicit
+    // deny rule blocks the call. Read-only actions (list/search) ride the same
+    // tool but are cheap to confirm/trust once when YOLO is off.
     riskTier: "destructive",
     capabilities: [ToolCapabilities.CONFIG_MUTATE],
     inputSchema,
@@ -560,7 +639,7 @@ function badge(state) {
       return dim(state);
   }
 }
-
-export { createMcpControlTool };
+export {
+  createMcpControlTool
+};
 //# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -1 +1,7 @@
-{"version":3,"sources":["../../src/utils/expect-defined.ts","../../src/utils/error.ts","../../src/security/capabilities.ts","../../src/infrastructure/mcp-servers.ts","../../src/utils/atomic-write.ts","../../src/utils/config-json.ts","../../src/tools/mcp-control.ts"],"names":["stat","fs2","path"],"mappings":";;;;;AAIO,SAAS,aAAA,CAAiB,OAA6B,KAAA,EAAmB;AAC/E,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW;AACzC,IAAA,MAAM,MAAM,IAAI,KAAA,CAAkD,8BAA8B,CAAA;AAChG,IAAA,GAAA,CAAI,IAAA,GAAO,oBAAA;AACX,IAAA,MAAM,GAAA;AAAA,EACR;AACA,EAAA,OAAO,KAAA;AACT;;;ACPO,SAAS,eAAe,GAAA,EAAsB;AACnD,EAAA,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AACxD;;;ACKO,IAAM,gBAAA,GAAmB;AAAA,EA8DX;AAAA,EAGnB,aAAA,EAAe,eAIjB,CAAA;;;AC/DO,IAAM,mBAAmB,OAAwB;AAAA,EACtD,IAAA,EAAM,YAAA;AAAA,EACN,WAAA,EAAa,mEAAA;AAAA,EACb,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,IAAA,EAAM,CAAC,IAAA,EAAM,yCAAA,EAA2C,GAAG,CAAA;AAAA,EAC3D,UAAA,EAAY;AACd,CAAA,CAAA;AAGO,IAAM,eAAe,OAAwB;AAAA,EAClD,IAAA,EAAM,QAAA;AAAA,EACN,WAAA,EACE,gGAAA;AAAA,EACF,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,IAAA,EAAM,CAAC,IAAA,EAAM,qCAAqC,CAAA;AAAA,EAClD,cAAA,EAAgB,CAAC,8BAAA,EAAgC,cAAc,CAAA;AAAA,EAC/D,UAAA,EAAY;AACd,CAAA,CAAA;AAMO,IAAM,iBAAiB,OAAwB;AAAA,EACpD,IAAA,EAAM,UAAA;AAAA,EACN,WAAA,EAAa,oDAAA;AAAA,EACb,SAAA,EAAW,iBAAA;AAAA,EACX,GAAA,EAAK,8BAAA;AAAA,EACL,UAAA,EAAY;AACd,CAAA,CAAA;AAOO,IAAM,oBAAoB,OAAwB;AAAA,EACvD,IAAA,EAAM,cAAA;AAAA,EACN,WAAA,EAAa,qFAAA;AAAA,EACb,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,IAAA,EAAM,CAAC,IAAA,EAAM,2CAA2C,CAAA;AAAA,EACxD,cAAA,EAAgB,CAAC,sBAAsB,CAAA;AAAA,EACvC,UAAA,EAAY;AACd,CAAA,CAAA;AAMO,IAAM,cAAc,OAAwB;AAAA,EACjD,IAAA,EAAM,OAAA;AAAA,EACN,WAAA,EAAa,qDAAA;AAAA,EACb,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,IAAA,EAAM,CAAC,IAAA,EAAM,oCAAoC,CAAA;AAAA,EACjD,UAAA,EAAY;AACd,CAAA,CAAA;AAMO,IAAM,gBAAgB,OAAwB;AAAA,EACnD,IAAA,EAAM,SAAA;AAAA,EACN,WAAA,EAAa,yDAAA;AAAA,EACb,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,IAAA,EAAM,CAAC,IAAA,EAAM,sCAAsC,CAAA;AAAA,EACnD,cAAA,EAAgB,CAAC,iBAAiB,CAAA;AAAA,EAClC,UAAA,EAAY;AACd,CAAA,CAAA;AAMO,IAAM,cAAc,OAAwB;AAAA,EACjD,IAAA,EAAM,OAAA;AAAA,EACN,WAAA,EAAa,oFAAA;AAAA,EACb,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,IAAA,EAAM,CAAC,IAAA,EAAM,oCAAoC,CAAA;AAAA,EACjD,cAAA,EAAgB,CAAC,iBAAA,EAAmB,eAAe,CAAA;AAAA,EACnD,UAAA,EAAY;AACd,CAAA,CAAA;AAMO,IAAM,YAAY,OAAwB;AAAA,EAC/C,IAAA,EAAM,KAAA;AAAA,EACN,WAAA,EAAa,kFAAA;AAAA,EACb,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,IAAA,EAAM,CAAC,IAAA,EAAM,kCAAkC,CAAA;AAAA,EAC/C,cAAA,EAAgB,CAAC,mBAAA,EAAqB,uBAAA,EAAyB,cAAc,mBAAmB,CAAA;AAAA,EAChG,UAAA,EAAY;AACd,CAAA,CAAA;AAMO,IAAM,mBAAmB,OAAwB;AAAA,EACtD,IAAA,EAAM,aAAA;AAAA,EACN,WAAA,EAAa,gFAAA;AAAA,EACb,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,IAAA,EAAM,CAAC,IAAA,EAAM,0CAA0C,CAAA;AAAA,EACvD,cAAA,EAAgB,CAAC,qBAAqB,CAAA;AAAA,EACtC,UAAA,EAAY;AACd,CAAA,CAAA;AAGO,IAAM,iBAAiB,OAAwB;AAAA,EACpD,IAAA,EAAM,UAAA;AAAA,EACN,WAAA,EAAa,4CAAA;AAAA,EACb,SAAA,EAAW,iBAAA;AAAA,EACX,GAAA,EAAK,yBAAA;AAAA,EACL,UAAA,EAAY;AAAA;AACd,CAAA,CAAA;AAMO,IAAM,kBAAkB,OAAwB;AAAA,EACrD,IAAA,EAAM,YAAA;AAAA,EACN,WAAA,EAAa,oEAAA;AAAA,EACb,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,IAAA,EAAM,CAAC,IAAA,EAAM,yBAAyB,CAAA;AAAA,EACtC,GAAA,EAAK,EAAE,SAAA,EAAW,KAAA,EAAM;AAAA,EACxB,cAAA,EAAgB,CAAC,cAAc,CAAA;AAAA,EAC/B,YAAA,EAAc;AAAA,IACZ,gBAAA;AAAA,IACA,8BAAA;AAAA,IACA,2BAAA;AAAA,IACA,8BAAA;AAAA,IACA,4BAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,UAAA,EAAY;AACd,CAAA,CAAA;AAQO,IAAM,mBAAmB,OAAwB;AAAA,EACtD,IAAA,EAAM,YAAA;AAAA,EACN,WAAA,EACE,8FAAA;AAAA,EACF,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,IAAA,EAAM,CAAC,IAAA,EAAM,yCAAyC,CAAA;AAAA,EACtD,UAAA,EAAY;AACd,CAAA,CAAA;AAOO,IAAM,sBAAsB,OAAwB;AAAA,EACzD,IAAA,EAAM,gBAAA;AAAA,EACN,WAAA,EAAa,6DAAA;AAAA,EACb,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,IAAA,EAAM,CAAC,yBAAA,EAA2B,IAAI,CAAA;AAAA,EACtC,GAAA,EAAK;AAAA,IACH,qBAAA,EAAuB,8BAAA;AAAA,IACvB,gBAAA,EAAkB,wBAAA;AAAA,IAClB,yBAAA,EAA2B;AAAA,GAC7B;AAAA,EACA,cAAA,EAAgB,CAAC,iBAAiB,CAAA;AAAA,EAClC,YAAA,EAAc,CAAC,kBAAkB,CAAA;AAAA,EACjC,UAAA,EAAY;AACd,CAAA,CAAA;AAOO,IAAM,mBAAmB,OAAwB;AAAA,EACtD,IAAA,EAAM,KAAA;AAAA,EACN,WAAA,EACE,yGAAA;AAAA,EACF,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,IAAA,EAAM,CAAC,IAAA,EAAM,iBAAiB,CAAA;AAAA,EAC9B,GAAA,EAAK;AAAA,IACH,oBAAA,EAAsB,MAAA;AAAA,IACtB,uBAAA,EAAyB;AAAA,GAC3B;AAAA,EACA,UAAA,EAAY,SAAA;AAAA,EACZ,gBAAA,EAAkB;AACpB,CAAA,CAAA;AAGO,IAAM,aAAa,OAAwC;AAAA,EAChE,YAAY,EAAE,GAAG,gBAAA,EAAiB,EAAG,SAAS,KAAA,EAAM;AAAA,EACpD,QAAQ,EAAE,GAAG,YAAA,EAAa,EAAG,SAAS,KAAA,EAAM;AAAA,EAC5C,UAAU,EAAE,GAAG,cAAA,EAAe,EAAG,SAAS,KAAA,EAAM;AAAA,EAChD,gBAAgB,EAAE,GAAG,iBAAA,EAAkB,EAAG,SAAS,KAAA,EAAM;AAAA,EACzD,OAAO,EAAE,GAAG,WAAA,EAAY,EAAG,SAAS,KAAA,EAAM;AAAA,EAC1C,SAAS,EAAE,GAAG,aAAA,EAAc,EAAG,SAAS,KAAA,EAAM;AAAA,EAC9C,OAAO,EAAE,GAAG,WAAA,EAAY,EAAG,SAAS,KAAA,EAAM;AAAA,EAC1C,KAAK,EAAE,GAAG,SAAA,EAAU,EAAG,SAAS,KAAA,EAAM;AAAA,EACtC,eAAe,EAAE,GAAG,gBAAA,EAAiB,EAAG,SAAS,KAAA,EAAM;AAAA,EACvD,UAAU,EAAE,GAAG,cAAA,EAAe,EAAG,SAAS,KAAA,EAAM;AAAA,EAChD,cAAc,EAAE,GAAG,eAAA,EAAgB,EAAG,SAAS,KAAA,EAAM;AAAA,EACrD,kBAAkB,EAAE,GAAG,mBAAA,EAAoB,EAAG,SAAS,KAAA,EAAM;AAAA,EAC7D,YAAY,EAAE,GAAG,gBAAA,EAAiB,EAAG,SAAS,KAAA,EAAM;AAAA,EACpD,KAAK,EAAE,GAAG,gBAAA,EAAiB,EAAG,SAAS,KAAA;AACzC,CAAA,CAAA;AChOA,eAAsB,WAAA,CACpB,UAAA,EACA,OAAA,EACA,IAAA,GAA2B,EAAC,EACb;AACf,EAAA,MAAM,GAAA,GAAW,aAAQ,UAAU,CAAA;AACnC,EAAA,MAAS,EAAA,CAAA,KAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAA;AACvC,EAAA,MAAM,GAAA,GAAW,IAAA,CAAA,IAAA,CAAK,GAAA,EAAK,CAAA,CAAA,EAAS,cAAS,UAAU,CAAC,CAAA,CAAA,EAAI,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,IAAA,CAAM,CAAA;AAIhG,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,MAAS,EAAA,CAAA,SAAA,CAAU,GAAA,EAAK,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,QAAA,EAAU,IAAA,CAAK,QAAA,IAAY,MAAA,EAAQ,CAAA;AAAA,IACpF,CAAA,MAAO;AACL,MAAA,MAAS,aAAU,GAAA,EAAK,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,IACjD;AACA,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,GAAK,MAAS,EAAA,CAAA,IAAA,CAAK,GAAA,EAAK,IAAI,CAAA;AAClC,MAAA,IAAI;AACF,QAAA,MAAM,GAAG,IAAA,EAAK;AAAA,MAChB,CAAA,SAAE;AACA,QAAA,MAAM,GAAG,KAAA,EAAM;AAAA,MACjB;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAGA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAMA,KAAAA,GAAO,MAAS,EAAA,CAAA,IAAA,CAAK,UAAU,CAAA;AACrC,MAAA,IAAA,GAAOA,MAAK,IAAA,GAAO,GAAA;AAAA,IACrB,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,GAAO,IAAA,CAAK,IAAA;AAAA,IACd;AACA,IAAA,IAAI,SAAS,KAAA,CAAA,EAAW;AACtB,MAAA,MAAS,EAAA,CAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,IAC1B;AACA,IAAA,MAAM,eAAA,CAAgB,KAAK,UAAU,CAAA;AASrC,IAAA,IAAI,IAAA,KAAS,KAAA,CAAA,IAAa,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS;AACtD,MAAA,IAAI;AACF,QAAA,MAAS,EAAA,CAAA,KAAA,CAAM,YAAY,IAAI,CAAA;AAAA,MACjC,CAAA,CAAA,MAAQ;AAAA,MAGR;AAAA,IACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI;AACF,MAAA,MAAS,UAAO,GAAG,CAAA;AAAA,IACrB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AA0EA,IAAM,sBAAA,uBAA6B,GAAA,CAAI,CAAC,SAAS,OAAA,EAAS,QAAA,EAAU,WAAW,CAAC,CAAA;AAEhF,eAAe,eAAA,CAAgB,MAAc,EAAA,EAA2B;AACtE,EAAA,IAAI,OAAA,CAAQ,aAAa,OAAA,EAAS;AAChC,IAAA,MAAS,EAAA,CAAA,MAAA,CAAO,MAAM,EAAE,CAAA;AACxB,IAAA;AAAA,EACF;AACA,EAAA,MAAM,SAAS,CAAC,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,KAAK,GAAG,CAAA;AACpC,EAAA,IAAI,OAAA;AACJ,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,IAAK,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACvC,IAAA,IAAI;AACF,MAAA,MAAS,EAAA,CAAA,MAAA,CAAO,MAAM,EAAE,CAAA;AACxB,MAAA;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA,GAAU,GAAA;AACV,MAAA,MAAM,OAAQ,GAAA,EAA+B,IAAA;AAC7C,MAAA,IAAI,CAAC,QAAQ,CAAC,sBAAA,CAAuB,IAAI,IAAI,CAAA,IAAK,CAAA,KAAM,MAAA,CAAO,MAAA,EAAQ;AACrE,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAAA,IAC/D;AAAA,EACF;AACA,EAAA,MAAM,OAAA;AACR;;;ACzKA,eAAsB,mBAAmB,QAAA,EAAuC;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,MAASC,EAAA,CAAA,QAAA,CAAS,QAAA,EAAU,MAAM,CAAC,CAAA;AAC7D,IAAA,OAAO,YAAA,CAAa,MAAM,CAAA,GAAI,MAAA,GAAS,EAAC;AAAA,EAC1C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAWA,eAAsB,mBAAA,CAAoB,UAAkB,KAAA,EAAkC;AAC5F,EAAA,MAAM,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E;AAEA,eAAsB,oBAAA,CACpB,UACA,OAAA,EACqB;AACrB,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,QAAQ,CAAA;AAChD,EAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,MAAM,CAAA;AACtC,EAAA,MAAM,IAAA,GAAO,SAAA,IAAa,YAAA,CAAa,SAAS,IAAI,SAAA,GAAY,MAAA;AAChE,EAAA,MAAM,mBAAA,CAAoB,UAAU,IAAI,CAAA;AACxC,EAAA,OAAO,IAAA;AACT;AAgBO,SAAS,WAAA,CAAY,IAAA,EAAkBC,KAAAA,EAAgB,KAAA,EAA4B;AACxF,EAAA,IAAIA,KAAAA,CAAK,WAAW,CAAA,EAAG;AACrB,IAAA,IAAI,CAAC,YAAA,CAAa,KAAK,GAAG,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAC/E,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,IAAA,EAAMA,KAAI,CAAA;AAC1C,EAAA,MAAM,IAAA,GAAO,gBAAgBA,KAAI,CAAA;AACjC,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,QAAS,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,IAAI,CAAA,oBAAA,CAAsB,CAAA;AACpG,IAAA,MAAA,CAAO,IAAI,CAAA,GAAI,KAAA;AAAA,EACjB,CAAA,MAAO;AACL,IAAA,IAAI,CAAC,aAAa,MAAM,CAAA,QAAS,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,IAAI,CAAA,qBAAA,CAAuB,CAAA;AAC7F,IAAA,MAAA,CAAO,IAAI,CAAA,GAAI,KAAA;AAAA,EACjB;AACA,EAAA,OAAO,IAAA;AACT;AA0BO,SAAS,aAAa,KAAA,EAAqC;AAChE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,gBAAgBA,KAAAA,EAAiC;AACxD,EAAA,MAAM,OAAA,GAAUA,KAAAA,CAAKA,KAAAA,CAAK,MAAA,GAAS,CAAC,CAAA;AAEpC,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,MAAM,IAAI,MAAM,yBAAyB,CAAA;AACpE,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,gBAAA,CAAiB,MAAkBA,KAAAA,EAAwC;AAClF,EAAA,IAAI,OAAA,GAAkC,IAAA;AACtC,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAIA,MAAK,MAAA,GAAS,CAAA,EAAG,KAAK,CAAA,EAAG;AAC3C,IAAA,MAAM,OAAA,GAAUA,MAAK,CAAC,CAAA;AACtB,IAAA,MAAM,WAAA,GAAcA,KAAAA,CAAK,CAAA,GAAI,CAAC,CAAA;AAE9B,IAAA,IAAI,OAAA,KAAY,MAAA,EAAW,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAC5E,IAAA,MAAM,gBAAgB,OAAO,WAAA,KAAgB,QAAA,GAAW,KAAK,EAAC;AAE9D,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,QAAS,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,OAAO,CAAA,oBAAA,CAAsB,CAAA;AAC7G,MAAA,IAAI,CAAC,YAAA,CAAa,OAAA,CAAQ,OAAO,CAAC,CAAA,IAAK,CAAC,KAAA,CAAM,OAAA,CAAQ,QAAQ,OAAO,CAAC,CAAA,EAAG,OAAA,CAAQ,OAAO,CAAA,GAAI,aAAA;AAC5F,MAAA,OAAA,GAAU,QAAQ,OAAO,CAAA;AAAA,IAC3B,CAAA,MAAO;AACL,MAAA,IAAI,CAAC,aAAa,OAAO,CAAA,QAAS,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,OAAO,CAAA,qBAAA,CAAuB,CAAA;AACtG,MAAA,IAAI,CAAC,YAAA,CAAa,OAAA,CAAQ,OAAO,CAAC,CAAA,IAAK,CAAC,KAAA,CAAM,OAAA,CAAQ,QAAQ,OAAO,CAAC,CAAA,EAAG,OAAA,CAAQ,OAAO,CAAA,GAAI,aAAA;AAC5F,MAAA,OAAA,GAAU,QAAQ,OAAO,CAAA;AAAA,IAC3B;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;;;AC5DO,SAAS,qBAAqB,IAAA,EAAyC;AAC5E,EAAA,MAAM,EAAE,SAAA,EAAW,UAAA,EAAY,QAAA,EAAS,GAAI,IAAA;AAE5C,EAAA,MAAM,WAAA,GAA0B;AAAA,IAC9B,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,MAAA,EAAQ,QAAA,EAAU,UAAU,SAAA,EAAW,SAAA,EAAW,YAAY,YAAY,CAAA;AAAA,QACjF,WAAA,EAAa;AAAA,OACf;AAAA;AAAA,MAEA,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA;AAAA,MAEA,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf,KACF;AAAA,IACA,QAAA,EAAU,CAAC,QAAQ;AAAA,GACrB;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,aAAA;AAAA,IACN,WAAA,EACE,sgBAAA;AAAA,IACF,QAAA,EAAU,KAAA;AAAA,IACV,UAAA,EAAY,SAAA;AAAA,IACZ,QAAA,EAAU,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOV,QAAA,EAAU,aAAA;AAAA,IACV,YAAA,EAAc,CAAC,gBAAA,CAAiB,aAAa,CAAA;AAAA,IAC7C,WAAA;AAAA,IACA,MAAM,QAAQ,GAAA,EAAK;AACjB,MAAA,MAAM,KAAA,GAAQ,GAAA;AACd,MAAA,OAAO,mBAAmB,KAAA,EAAO,EAAE,SAAA,EAAW,UAAA,EAAY,UAAU,CAAA;AAAA,IACtE;AAAA,GACF;AACF;AAIA,eAAe,kBAAA,CACb,OACA,IAAA,EACiB;AACjB,EAAA,MAAM,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAO,GAAI,KAAA;AAElC,EAAA,QAAQ,MAAA;AAAQ,IACd,KAAK,MAAA;AAAS,MAAA,OAAO,WAAW,IAAI,CAAA;AAAA,IACpC,KAAK,QAAA;AAAU,MAAA,OAAO,YAAA,CAAa,KAAA,IAAS,EAAA,EAAI,IAAI,CAAA;AAAA,IACpD,KAAK,QAAA;AAAU,MAAA,OAAO,MAAA,GAAS,SAAA,CAAU,MAAA,EAAQ,IAAI,CAAA,GAAI,kCAAA;AAAA,IACzD,KAAK,SAAA;AAAW,MAAA,OAAO,MAAA,GAAS,UAAA,CAAW,MAAA,EAAQ,IAAI,CAAA,GAAI,mCAAA;AAAA,IAC3D,KAAK,SAAA;AAAW,MAAA,OAAO,MAAA,GAAS,UAAA,CAAW,MAAA,EAAQ,IAAI,CAAA,GAAI,mCAAA;AAAA,IAC3D,KAAK,UAAA;AAAY,MAAA,OAAO,MAAA,GAAS,WAAA,CAAY,MAAA,EAAQ,IAAI,CAAA,GAAI,oCAAA;AAAA,IAC7D,KAAK,YAAA;AAAc,MAAA,OAAO,MAAA,GAAS,aAAA,CAAc,MAAA,EAAQ,IAAI,CAAA,GAAI,sCAAA;AAAA,IACjE;AACE,MAAA,OAAO,mBAAmB,MAAM,CAAA,4EAAA,CAAA;AAAA;AAEtC;AAIA,eAAe,WAAW,IAAA,EAAqG;AAC7H,EAAA,MAAM,UAAA,GAAa,MAAM,uBAAA,CAAwB,IAAI,CAAA;AACrD,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,QAAA,EAAS;AAEpC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,CAAE,WAAW,CAAA,EAAG;AACxC,IAAA,OAAO;AAAA,MACL,4BAAA;AAAA,MACA,qEAAA;AAAA,MACA;AAAA,KACF,CAAE,KAAK,IAAI,CAAA;AAAA,EACb;AAEA,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAC,CAAC,CAAA;AAEpD,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,GAAG,KAAK,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,EAAG;AACpD,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AACjC,IAAA,MAAM,SAAA,GAAY,QAAA,GAAW,CAAA,EAAA,EAAK,QAAA,CAAS,SAAS,CAAA,OAAA,CAAA,GAAY,EAAA;AAChE,IAAA,MAAM,WAAW,QAAA,GAAW,KAAA,CAAM,SAAS,KAAK,CAAA,GAAI,IAAI,mBAAc,CAAA;AACtE,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,KAAY,KAAA,GAC5B,CAAA,EAAG,GAAA,CAAI,UAAU,CAAC,CAAA,EAAA,CAAA,GAClB,CAAA,EAAG,KAAA,CAAM,gBAAW,CAAC,CAAA,EAAA,CAAA;AACzB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAA,EAAK,IAAA,CAAK,IAAI,CAAC,CAAA,EAAA,EAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,EAAG,SAAS,CAAA,CAAE,CAAA;AAC/D,IAAA,IAAI,GAAA,CAAI,aAAa,KAAA,CAAM,IAAA,CAAK,OAAO,GAAA,CAAI,GAAA,CAAI,WAAW,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AAEA,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,EAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,gFAAgF,CAAC,CAAA;AAChG,EAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,gFAAgF,CAAC,CAAA;AAChG,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAEA,eAAe,YAAA,CACb,OACA,IAAA,EACiB;AACjB,EAAA,MAAM,UAAA,GAAa,MAAM,uBAAA,CAAwB,IAAI,CAAA;AACrD,EAAA,MAAM,MAAM,UAAA,EAAW;AACvB,EAAA,MAAM,CAAA,GAAI,MAAM,WAAA,EAAY;AAE5B,EAAA,MAAM,kBAAkB,IAAI,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,UAAU,CAAC,CAAA;AAGvD,EAAA,MAAM,iBAAA,GAAoB,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAAE,MAAA;AAAA,IACnD,CAAC,CAAC,IAAA,EAAM,GAAG,CAAA,KACT,KAAK,WAAA,EAAY,CAAE,QAAA,CAAS,CAAC,MAC5B,GAAA,CAAI,WAAA,IAAe,IAAI,WAAA,EAAY,CAAE,SAAS,CAAC;AAAA,GACpD;AAEA,EAAA,MAAM,mBAAA,GAAsB,MAAA,CAAO,OAAA,CAAQ,GAAG,EAC3C,MAAA,CAAO,CAAC,CAAC,IAAI,MAAM,CAAC,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAC,CAAA,CAC7C,MAAA;AAAA,IACC,CAAC,CAAC,IAAA,EAAM,GAAG,CAAA,KACT,KAAK,WAAA,EAAY,CAAE,QAAA,CAAS,CAAC,MAC5B,GAAA,CAAI,WAAA,IAAe,IAAI,WAAA,EAAY,CAAE,SAAS,CAAC;AAAA,GACpD;AAEF,EAAA,MAAM,QAAkB,EAAC;AAEzB,EAAA,IAAI,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAChC,IAAA,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,+BAA+B,CAAA,GAAI,QAAQ,IAAI,CAAA;AAC/D,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,GAAG,CAAA,IAAK,iBAAA,EAAmB;AAC3C,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAA,EAAK,IAAA,CAAK,IAAI,CAAC,KAAK,GAAA,CAAI,WAAA,IAAe,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AAAA,IACnE;AACA,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAAA,EACf;AAEA,EAAA,IAAI,mBAAA,CAAoB,SAAS,CAAA,EAAG;AAClC,IAAA,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,8BAA8B,CAAA,GAAI,QAAQ,IAAI,CAAA;AAC9D,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,GAAG,CAAA,IAAK,mBAAA,EAAqB;AAC7C,MAAA,MAAM,OAAO,GAAA,CAAI,UAAA,KAAe,MAAA,GAAS,GAAA,CAAI,0BAAqB,CAAA,GAAI,EAAA;AACtE,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAA,EAAK,IAAA,CAAK,IAAI,CAAC,CAAA,EAAA,EAAK,GAAA,CAAI,WAAA,IAAe,GAAA,CAAI,SAAS,CAAA,EAAG,IAAI,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAAA,EACf;AAEA,EAAA,IAAI,iBAAA,CAAkB,MAAA,KAAW,CAAA,IAAK,mBAAA,CAAoB,WAAW,CAAA,EAAG;AACtE,IAAA,OAAO,qBAAqB,KAAK,CAAA,gEAAA,CAAA;AAAA,EACnC;AAEA,EAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,MAAA,GAAS,mBAAA,CAAoB,MAAA;AAC7D,EAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,CAAA,EAAA,EAAK,KAAK,CAAA,OAAA,EAAU,UAAU,CAAA,GAAI,GAAA,GAAM,EAAE,CAAA,6CAAA,CAA+C,CAAC,CAAA;AACzG,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAEA,eAAe,SAAA,CACb,MACA,IAAA,EACiB;AACjB,EAAA,IAAI,CAAC,MAAM,OAAO,kFAAA;AAElB,EAAA,MAAM,MAAM,UAAA,EAAW;AACvB,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,EAAU,CAAE,cAAc,EAAC;AAGnD,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,IAAI,CAAA,IAAK,IAAI,IAAI,CAAA;AACxC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AACxC,IAAA,OAAO,CAAA,gBAAA,EAAmB,IAAI,CAAA,sBAAA,EAAyB,KAAK,CAAA,CAAA;AAAA,EAC9D;AAGA,EAAA,MAAM,oBAAA,CAAqB,IAAA,CAAK,UAAA,EAAY,CAAC,IAAA,KAAS;AACpD,IAAA,MAAM,UAAU,iBAAA,CAAkB,IAAA,CAAK,UAAU,CAAA,GAAI,IAAA,CAAK,aAAa,EAAC;AACxE,IAAA,WAAA,CAAY,IAAA,EAAM,CAAC,YAAA,EAAc,IAAI,GAAG,EAAE,GAAG,OAAA,CAAQ,IAAI,CAAA,EAAG,GAAG,GAAA,EAAK,OAAA,EAAS,MAAM,CAAA;AAAA,EACrF,CAAC,CAAA;AAGD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,QAAA,EAAS,CAAE,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,IAAI,CAAA;AACjE,IAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,KAAA,KAAU,WAAA,EAAa;AACtC,MAAA,OAAO,CAAA,EAAG,MAAM,QAAG,CAAC,YAAY,IAAI,CAAA,sBAAA,EAAyB,KAAK,SAAS,CAAA,mBAAA,CAAA;AAAA,IAC7E;AACA,IAAA,MAAM,IAAA,CAAK,SAAS,KAAA,CAAM,EAAE,GAAG,GAAA,EAAK,OAAA,EAAS,MAAM,CAAA;AACnD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,QAAA,EAAS,CAAE,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,IAAI,CAAA;AACpE,IAAA,OAAO,CAAA,EAAG,KAAA,CAAM,4BAAuB,CAAC,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,EAAI,OAAA,GAAU,CAAA,EAAA,EAAK,OAAA,CAAQ,SAAS,CAAA,mBAAA,CAAA,GAAwB,GAAG,CAAA,CAAA;AAAA,EAClH,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO,CAAA,EAAG,IAAI,wBAAmB,CAAC,KAAK,IAAI,CAAA,GAAA,EAAM,cAAA,CAAe,GAAG,CAAC,CAAA,CAAA;AAAA,EACtE;AACF;AAEA,eAAe,UAAA,CACb,MACA,IAAA,EACiB;AACjB,EAAA,IAAI,CAAC,MAAM,OAAO,oFAAA;AAElB,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,EAAU,CAAE,cAAc,EAAC;AACnD,EAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG;AACrB,IAAA,OAAO,CAAA,QAAA,EAAW,IAAI,CAAA,2EAAA,EAA8E,IAAI,CAAA,OAAA,CAAA;AAAA,EAC1G;AAGA,EAAA,MAAM,oBAAA,CAAqB,IAAA,CAAK,UAAA,EAAY,CAAC,IAAA,KAAS;AACpD,IAAA,MAAM,UAAU,iBAAA,CAAkB,IAAA,CAAK,UAAU,CAAA,GAAI,IAAA,CAAK,aAAa,EAAC;AACxE,IAAA,MAAM,QAAA,GAAW,aAAA,CAAc,OAAA,CAAQ,IAAI,CAAC,CAAA;AAC5C,IAAA,WAAA,CAAY,IAAA,EAAM,CAAC,YAAA,EAAc,IAAI,CAAA,EAAG,EAAE,GAAG,QAAA,EAAU,OAAA,EAAS,KAAA,EAAO,CAAA;AAAA,EACzE,CAAC,CAAA;AAGD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA;AAC7B,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,iBAAY,CAAC,KAAK,IAAI,CAAA,uCAAA,CAAA;AAAA,EACzC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,iBAAY,CAAC,KAAK,IAAI,CAAA,uCAAA,CAAA;AAAA,EACzC;AACF;AAEA,eAAe,UAAA,CACb,MACA,IAAA,EACiB;AACjB,EAAA,IAAI,CAAC,MAAM,OAAO,oFAAA;AAElB,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,EAAU,CAAE,cAAc,EAAC;AACnD,EAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG;AACrB,IAAA,OAAO,CAAA,QAAA,EAAW,IAAI,CAAA,oEAAA,EAAuE,IAAI,CAAA,aAAA,CAAA;AAAA,EACnG;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,IAAI,CAAA;AAChC,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,QAAA,EAAS,CAAE,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,IAAI,CAAA;AACpE,IAAA,OAAO,CAAA,EAAG,KAAA,CAAM,kBAAa,CAAC,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,EAAI,OAAA,GAAU,CAAA,EAAA,EAAK,OAAA,CAAQ,SAAS,CAAA,mBAAA,CAAA,GAAwB,GAAG,CAAA,CAAA;AAAA,EACxG,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO,CAAA,EAAG,IAAI,uBAAkB,CAAC,SAAS,IAAI,CAAA,GAAA,EAAM,cAAA,CAAe,GAAG,CAAC,CAAA,CAAA;AAAA,EACzE;AACF;AAQA,eAAe,WAAA,CACb,MACA,IAAA,EACiB;AACjB,EAAA,IAAI,CAAC,MAAM,OAAO,oCAAA;AAClB,EAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,cAAA,EAAgB;AACjC,IAAA,OAAO,4EAA4E,IAAI,CAAA,UAAA,CAAA;AAAA,EACzF;AACA,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,QAAA,EAAS,CAAE,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,IAAI,CAAA;AACjE,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,CAAA,QAAA,EAAW,IAAI,CAAA,oEAAA,EAAuE,IAAI,CAAA,aAAA,CAAA;AAAA,EACnG;AACA,EAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAC9B,IAAA,OAAO,CAAA,QAAA,EAAW,IAAI,CAAA,2BAAA,EAA8B,IAAA,CAAK,KAAK,CAAA,oCAAA,CAAA;AAAA,EAChE;AACA,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,WAAA,GAAc,IAAI,CAAA,EAAG;AACrC,IAAA,OAAO,CAAA,EAAG,KAAA,CAAM,QAAG,CAAC,YAAY,IAAI,CAAA,4DAAA,CAAA;AAAA,EACtC;AACA,EAAA,IAAA,CAAK,QAAA,CAAS,eAAe,IAAI,CAAA;AACjC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,QAAA,EAAS,CAAE,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,IAAI,CAAA;AACpE,EAAA,OAAO,CAAA,EAAG,KAAA,CAAM,kBAAa,CAAC,CAAA,EAAA,EAAK,IAAI,CAAA,SAAA,EAAO,OAAA,EAAS,SAAA,IAAa,CAAC,CAAA,4EAAA,EAA+E,IAAI,CAAA,8BAAA,CAAA;AAC1J;AAMA,eAAe,aAAA,CACb,MACA,IAAA,EACiB;AACjB,EAAA,IAAI,CAAC,MAAM,OAAO,sCAAA;AAClB,EAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,gBAAA,EAAkB;AACnC,IAAA,OAAO,8EAA8E,IAAI,CAAA,UAAA,CAAA;AAAA,EAC3F;AACA,EAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,WAAA,GAAc,IAAI,CAAA,EAAG;AACtC,IAAA,OAAO,WAAW,IAAI,CAAA,iCAAA,CAAA;AAAA,EACxB;AACA,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,QAAA,CAAS,gBAAA,CAAiB,IAAI,CAAA;AACjD,EAAA,OAAO,GAAG,MAAA,CAAO,oBAAe,CAAC,CAAA,EAAA,EAAK,IAAI,YAAO,KAAK,CAAA,8CAAA,CAAA;AACxD;AAIA,eAAe,wBAAwB,IAAA,EAAiG;AACtI,EAAA,MAAM,UAAA,GAAa,MAAM,kBAAA,CAAmB,IAAA,CAAK,UAAU,CAAA;AAC3D,EAAA,IAAI,iBAAA,CAAkB,UAAA,CAAW,UAAU,CAAA,SAAU,UAAA,CAAW,UAAA;AAChE,EAAA,OAAO,IAAA,CAAK,SAAA,EAAU,CAAE,UAAA,IAAc,EAAC;AACzC;AAEA,SAAS,kBAAkB,KAAA,EAA0D;AACnF,EAAA,OAAO,CAAC,CAAC,KAAA,IAAS,OAAO,UAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACrE;AAIA,SAAS,KAAK,CAAA,EAAY;AAAE,EAAA,OAAO,UAAU,CAAC,CAAA,OAAA,CAAA;AAAW;AACzD,SAAS,IAAI,CAAA,EAAY;AAAE,EAAA,OAAO,UAAU,CAAC,CAAA,OAAA,CAAA;AAAW;AACxD,SAAS,MAAM,CAAA,EAAW;AAAE,EAAA,OAAO,WAAW,CAAC,CAAA,OAAA,CAAA;AAAW;AAC1D,SAAS,OAAO,CAAA,EAAU;AAAE,EAAA,OAAO,WAAW,CAAC,CAAA,OAAA,CAAA;AAAW;AAC1D,SAAS,IAAI,CAAA,EAAa;AAAE,EAAA,OAAO,WAAW,CAAC,CAAA,OAAA,CAAA;AAAW;AAE1D,SAAS,MAAM,KAAA,EAAuB;AACpC,EAAA,QAAQ,KAAA;AAAO,IACb,KAAK,WAAA;AAAgB,MAAA,OAAO,MAAM,kBAAa,CAAA;AAAA,IAC/C,KAAK,YAAA;AAAgB,MAAA,OAAO,CAAA,gCAAA,CAAA;AAAA,IAC5B,KAAK,cAAA;AAAgB,MAAA,OAAO,CAAA,kCAAA,CAAA;AAAA,IAC5B,KAAK,cAAA;AAAgB,MAAA,OAAO,IAAI,qBAAgB,CAAA;AAAA,IAChD,KAAK,QAAA;AAAgB,MAAA,OAAO,IAAI,eAAU,CAAA;AAAA,IAC1C;AAAoB,MAAA,OAAO,IAAI,KAAK,CAAA;AAAA;AAExC","file":"index.js","sourcesContent":["/** Assert a value is neither null nor undefined. Throws if it is.\n *  Useful after optional chaining and indexed access when the\n *  control flow guarantees the value exists but TypeScript can't\n *  prove it (e.g. after a check on a related field). */\nexport function expectDefined<T>(value: T | null | undefined, label?: string): T {\n  if (value === null || value === undefined) {\n    const err = new Error(label ? `Expected ${label} to be defined` : 'Expected value to be defined');\n    err.name = 'ExpectDefinedError';\n    throw err;\n  }\n  return value;\n}\n","/**\n * Converts an unknown error value to a human-readable string.\n * Used in 40+ files across the codebase to normalize error messaging.\n */\nexport function toErrorMessage(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n","/**\n * Well-known tool capabilities used for authorization decisions.\n *\n * These are the preferred values for `Tool.capabilities`.\n * New capabilities should be added here with clear documentation.\n *\n * Philosophy (2026-06+):\n * - Prefer capabilities over exact tool name matching.\n * - Subagent guards and future policies should primarily key off capabilities.\n * - Name-based denylists are legacy and will be phased down.\n */\nexport const ToolCapabilities = {\n  /** Can execute arbitrary commands in the user's shell (the `bash` tool). */\n  SHELL_ARBITRARY: 'shell.arbitrary',\n\n  /** Can execute a restricted set of commands (the `exec` tool). */\n  SHELL_RESTRICTED: 'shell.restricted',\n\n  /** Can run a restricted project formatter/linter-style command. */\n  SHELL_EXEC: 'shell.exec',\n\n  /** Can read files inside the project (and possibly outside via symlinks if not guarded). */\n  FS_READ: 'fs.read',\n\n  /** Can write / modify / delete files inside the project. */\n  FS_WRITE: 'fs.write',\n\n  /** Can write files outside the current project root (very high risk). */\n  FS_WRITE_OUTSIDE_PROJECT: 'fs.write.outside-project',\n\n  /** Can perform outbound network requests. */\n  NET_OUTBOUND: 'net.outbound',\n\n  /** Can mutate in-memory session todos only. */\n  SESSION_TODO: 'session.todo',\n\n  /** Can mutate in-memory session mode only. */\n  SESSION_MODE: 'session.mode',\n\n  /** Can inspect registered tool metadata. */\n  TOOL_META: 'tool.meta',\n\n  /** Can invoke arbitrary registered tools through a meta-tool. */\n  TOOL_MUTATE_ANY: 'tool.mutate.any',\n\n  /** Can read persistent memory. */\n  MEMORY_READ: 'memory.read',\n\n  /** Can write persistent memory. */\n  MEMORY_WRITE: 'memory.write',\n\n  /** Can delete persistent memory. */\n  MEMORY_DELETE: 'memory.delete',\n\n  /** Proxies tools from external MCP servers (unknown capability). */\n  MCP_PROXY: 'mcp.proxy',\n\n  /** Can spawn or manage subagents / multi-agent tasks. */\n  SUBAGENT_SPAWN: 'subagent.spawn',\n\n  /** Can inspect fleet/subagent coordination state without mutating it. */\n  COORDINATION_FLEET_READ: 'coordination.fleet.read',\n\n  /** Can publish attributed, schema-checked events onto the fleet bus. */\n  COORDINATION_FLEET_EMIT: 'coordination.fleet.emit',\n\n  /** Can submit a task-local structured result to the parent Director. */\n  COORDINATION_RESULT_SUBMIT: 'coordination.result.submit',\n\n  /** Can read or write inter-agent mailbox messages. */\n  COORDINATION_MAIL: 'coordination.mail',\n\n  /** Can schedule, inspect, or cancel in-session cron jobs. */\n  COORDINATION_CRON: 'coordination.cron',\n\n  /** Can mutate global or session configuration / trust state. */\n  CONFIG_MUTATE: 'config.mutate',\n\n  /** Can install packages or run package managers with side effects. */\n  PACKAGE_INSTALL: 'package.install',\n} as const;\n\nexport type ToolCapability = (typeof ToolCapabilities)[keyof typeof ToolCapabilities];\n\n/**\n * Set of capabilities that are considered dangerous for subagents by default.\n * Subagents should not receive these capabilities unless the leader explicitly\n * allows the specific tool at spawn time.\n */\nexport const DANGEROUS_FOR_SUBAGENTS: readonly ToolCapability[] = [\n  ToolCapabilities.SHELL_ARBITRARY,\n  ToolCapabilities.SHELL_RESTRICTED,\n  ToolCapabilities.SHELL_EXEC,\n  ToolCapabilities.FS_WRITE,\n  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,\n  ToolCapabilities.TOOL_MUTATE_ANY,\n  ToolCapabilities.MEMORY_WRITE,\n  ToolCapabilities.MEMORY_DELETE,\n  ToolCapabilities.MCP_PROXY,\n  ToolCapabilities.SUBAGENT_SPAWN,\n  ToolCapabilities.CONFIG_MUTATE,\n  ToolCapabilities.PACKAGE_INSTALL,\n];\n\n/**\n * Wide capability allowlist for subagents that the user has authorized to act\n * with full developer power (the CLI fleet host applies this to any subagent\n * that isn't given an explicit, narrower grant). It covers everything needed to\n * do real work end-to-end — read, write/edit inside the project, outbound\n * network, all shell/build/install capabilities, session todos, tool metadata, and read-only\n * memory lookup — so a delegated coding or build agent runs the same toolchain\n * the leader would, without per-tool confirmation it cannot answer.\n *\n * Deliberately EXCLUDED (require an explicit per-spawn `allowedCapabilities`\n * grant, because they escape the task's blast radius rather than perform it):\n *   - `fs.write.outside-project` — writing outside the repo (e.g. ~/.ssh).\n *   - `tool.mutate.any` — arbitrary meta-tool dispatch.\n *   - `memory.write` / `memory.delete` — persistent memory mutation.\n *   - `mcp.proxy` — third-party MCP tools (also hard-blocked by name).\n *   - `subagent.spawn` — recursive delegation (the baseline prompt forbids it).\n *   - `config.mutate` — rewriting trust/config is privilege escalation, not work.\n */\nexport const WIDE_SUBAGENT_CAPABILITIES: readonly ToolCapability[] = [\n  ToolCapabilities.FS_READ,\n  ToolCapabilities.FS_WRITE,\n  ToolCapabilities.NET_OUTBOUND,\n  ToolCapabilities.SESSION_TODO,\n  ToolCapabilities.TOOL_META,\n  ToolCapabilities.MEMORY_READ,\n  ToolCapabilities.SHELL_ARBITRARY,\n  ToolCapabilities.SHELL_RESTRICTED,\n  ToolCapabilities.SHELL_EXEC,\n  ToolCapabilities.PACKAGE_INSTALL,\n  // Read-only fleet visibility (fleet_status) — peer awareness has no blast\n  // radius and every fleet worker should coordinate around its peers.\n  ToolCapabilities.COORDINATION_FLEET_READ,\n  ToolCapabilities.COORDINATION_RESULT_SUBMIT,\n];\n\n/**\n * Check if a tool (or its capabilities array) includes any dangerous capability\n * for subagent execution.\n */\nexport function hasDangerousCapabilityForSubagents(\n  toolOrCaps: { capabilities?: readonly string[] | undefined } | readonly string[] | undefined,\n): boolean {\n  if (!toolOrCaps) return false;\n  const input = toolOrCaps as never as { capabilities?: readonly string[] | undefined };\n  const caps: readonly string[] = Array.isArray(toolOrCaps) ? toolOrCaps : (input.capabilities ?? []);\n  return caps.some((c) => DANGEROUS_FOR_SUBAGENTS.includes(c as ToolCapability));\n}\n\n/**\n * Check if a tool declares a specific capability (or any of the provided ones).\n */\nexport function hasCapability(\n  toolOrCaps: { capabilities?: readonly string[] | undefined } | readonly string[] | undefined,\n  capability: ToolCapability | ToolCapability[],\n): boolean {\n  if (!toolOrCaps) return false;\n  const input = toolOrCaps as never as { capabilities?: readonly string[] | undefined };\n  const caps: readonly string[] = Array.isArray(toolOrCaps) ? toolOrCaps : (input.capabilities ?? []);\n  const toCheck = Array.isArray(capability) ? capability : [capability];\n  return toCheck.some((c) => caps.includes(c));\n}\n\n/**\n * Returns the intersection of a tool's capabilities with the dangerous set.\n * Useful for logging and audit trails.\n */\nexport function getDangerousCapabilities(\n  toolOrCaps: { capabilities?: readonly string[] | undefined } | readonly string[] | undefined,\n): ToolCapability[] {\n  if (!toolOrCaps) return [];\n  const input = toolOrCaps as never as { capabilities?: readonly string[] | undefined };\n  const caps: readonly string[] = Array.isArray(toolOrCaps) ? toolOrCaps : (input.capabilities ?? []);\n  return caps.filter((c): c is ToolCapability =>\n    DANGEROUS_FOR_SUBAGENTS.includes(c as ToolCapability),\n  );\n}\n","import type { MCPServerConfig } from '../types/config.js';\n\n/**\n * Built-in MCP server presets available to all WrongStack users out of the box.\n * These servers must be explicitly enabled in config (disabled by default).\n *\n * To enable: set `mcpServers: { serverName: { enabled: true } }` in your config.\n *\n * Some servers require environment variables or additional config — see notes below.\n *\n * Transport types:\n *   stdio       — spawns a local npm package binary via child_process\n *   sse         — HTTP SSE endpoint (client POSTs requests)\n *   streamable-http — session-based HTTP with NDJSON responses\n */\n\n/** Filesystem access: read, write, list, search, tree. Good for exploring projects. */\nexport const filesystemServer = (): MCPServerConfig => ({\n  name: 'filesystem',\n  description: 'Read, write, and navigate the local filesystem (read-heavy tools)',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-filesystem', '.'],\n  permission: 'confirm',\n});\n\n/** GitHub API: issues, PRs, repos, search, file operations. Requires GITHUB_PERSONAL_ACCESS_TOKEN. */\nexport const githubServer = (): MCPServerConfig => ({\n  name: 'github',\n  description:\n    'GitHub API — issues, PRs, repos, search, file ops (requires GITHUB_PERSONAL_ACCESS_TOKEN)',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-github'],\n  passthroughEnv: ['GITHUB_PERSONAL_ACCESS_TOKEN', 'GITHUB_TOKEN'],\n  permission: 'confirm',\n});\n\n/**\n * Context7 — codebase-aware documentation and Q&A using context from your code.\n * Live documentation for any library, grounded in your actual versions.\n */\nexport const context7Server = (): MCPServerConfig => ({\n  name: 'context7',\n  description: 'Codebase-aware documentation and Q&A (context7.ai)',\n  transport: 'streamable-http',\n  url: 'https://mcp.context7.com/mcp',\n  permission: 'confirm',\n});\n\n/**\n * Brave Search — web search via Brave Browser's API.\n * Requires BRAVE_SEARCH_API_KEY. Free tier: 2,000 queries/month.\n * Sign up at https://api.search.brave.com/\n */\nexport const braveSearchServer = (): MCPServerConfig => ({\n  name: 'brave-search',\n  description: 'Web search (Brave). Requires BRAVE_SEARCH_API_KEY — free tier 2k queries/month',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-brave-search'],\n  passthroughEnv: ['BRAVE_SEARCH_API_KEY'],\n  permission: 'confirm',\n});\n\n/**\n * Block (Block, Inc.) — Postgres database access via SQL.\n * Useful for running queries against a connected database during development.\n */\nexport const blockServer = (): MCPServerConfig => ({\n  name: 'block',\n  description: 'Postgres database access via SQL (Block MCP server)',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-block'],\n  permission: 'confirm',\n});\n\n/**\n * EverArt — AI image generation via various providers.\n * Requires EVERART_API_KEY.\n */\nexport const everArtServer = (): MCPServerConfig => ({\n  name: 'everart',\n  description: 'AI image generation (EverArt). Requires EVERART_API_KEY',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-everart'],\n  passthroughEnv: ['EVERART_API_KEY'],\n  permission: 'confirm',\n});\n\n/**\n * Slack — messaging, channels, search.\n * Requires SLACK_BOT_TOKEN and either SLACK_TEAM_ID or SLACK_USER_TOKEN.\n */\nexport const slackServer = (): MCPServerConfig => ({\n  name: 'slack',\n  description: 'Slack — messaging, channels, search. Requires SLACK_BOT_TOKEN + SLACK_TEAM_ID',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-slack'],\n  passthroughEnv: ['SLACK_BOT_TOKEN', 'SLACK_TEAM_ID'],\n  permission: 'confirm',\n});\n\n/**\n * AWS knowledge base — EC2, S3, Lambda, IAM, CloudFormation, cost management.\n * Requires AWS access key + secret in environment.\n */\nexport const awsServer = (): MCPServerConfig => ({\n  name: 'aws',\n  description: 'AWS — EC2, S3, Lambda, IAM, CloudFormation, costs. Requires AWS credentials',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-aws'],\n  passthroughEnv: ['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_REGION', 'AWS_SESSION_TOKEN'],\n  permission: 'confirm',\n});\n\n/**\n * Google Maps — directions, distance matrix, geocoding, places.\n * Requires GOOGLE_MAPS_API_KEY.\n */\nexport const googleMapsServer = (): MCPServerConfig => ({\n  name: 'google-maps',\n  description: 'Google Maps — directions, geocoding, places. Requires GOOGLE_MAPS_API_KEY',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-google-maps'],\n  passthroughEnv: ['GOOGLE_MAPS_API_KEY'],\n  permission: 'confirm',\n});\n\n/** Sentinel — security vulnerability scanning (sentinel-labs). */\nexport const sentinelServer = (): MCPServerConfig => ({\n  name: 'sentinel',\n  description: 'Security vulnerability scanning (Sentinel)',\n  transport: 'streamable-http',\n  url: 'https://mcp.sentinel.ai',\n  permission: 'deny', // security tool — require explicit confirmation\n});\n\n/**\n * Z.AI Vision MCP — image understanding fallback for text-only models.\n * Requires Z_AI_API_KEY. Tools are read-only and safe to run automatically.\n */\nexport const zaiVisionServer = (): MCPServerConfig => ({\n  name: 'zai-vision',\n  description: 'Z.AI Vision MCP — image analysis and screenshot understanding',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@z_ai/mcp-server@latest'],\n  env: { Z_AI_MODE: 'ZAI' },\n  passthroughEnv: ['Z_AI_API_KEY'],\n  allowedTools: [\n    'image_analysis',\n    'extract_text_from_screenshot',\n    'diagnose_error_screenshot',\n    'understand_technical_diagram',\n    'analyze_data_visualization',\n    'ui_diff_check',\n  ],\n  permission: 'auto',\n});\n\n/**\n * Playwright — browser automation: navigate, click, type, screenshot, evaluate JS.\n * Spawns a headless Chromium browser via @modelcontextprotocol/server-playwright.\n * Tools can read and interact with live web pages — permission defaults to\n * `confirm` because form submission / DOM mutation is possible.\n */\nexport const playwrightServer = (): MCPServerConfig => ({\n  name: 'playwright',\n  description:\n    'Browser automation — navigate, screenshot, click, type, evaluate JS (headless Chromium)',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-playwright'],\n  permission: 'confirm',\n});\n\n/**\n * MiniMax Token Plan MCP — search + understand_image.\n * This preset exposes only the read-only image understanding tool by default.\n * Requires MINIMAX_API_KEY and uvx on PATH.\n */\nexport const miniMaxVisionServer = (): MCPServerConfig => ({\n  name: 'minimax-vision',\n  description: 'MiniMax MCP — image understanding via understand_image',\n  transport: 'stdio',\n  command: 'uvx',\n  args: ['minimax-coding-plan-mcp', '-y'],\n  env: {\n    MINIMAX_MCP_BASE_PATH: './.wrongstack/minimax-output',\n    MINIMAX_API_HOST: 'https://api.minimax.io',\n    MINIMAX_API_RESOURCE_MODE: 'url',\n  },\n  passthroughEnv: ['MINIMAX_API_KEY'],\n  allowedTools: ['understand_image'],\n  permission: 'auto',\n});\n\n/**\n * SSH Manager — remote SSH execution, file transfer, tunnels, health checks, and deployment ops.\n * Server credentials are intentionally NOT embedded here. Configure hosts via mcp-ssh-manager's\n * env/TOML config (for example SSH_SERVER_<NAME>_HOST, USER, KEYPATH/PASSWORD) or ssh-agent.\n */\nexport const sshManagerServer = (): MCPServerConfig => ({\n  name: 'ssh',\n  description:\n    'Remote SSH management — execute commands, transfer files, tunnels, health checks (mcp-ssh-manager)',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', 'mcp-ssh-manager'],\n  env: {\n    MCP_SSH_COMPACT_JSON: 'true',\n    MCP_SSH_DEFAULT_TIMEOUT: '120000',\n  },\n  permission: 'confirm',\n  requestTimeoutMs: 180_000,\n});\n\n/** Everything bundled — full set of built-in servers. Useful for `wstack mcp add --all`. */\nexport const allServers = (): Record<string, MCPServerConfig> => ({\n  filesystem: { ...filesystemServer(), enabled: false },\n  github: { ...githubServer(), enabled: false },\n  context7: { ...context7Server(), enabled: false },\n  'brave-search': { ...braveSearchServer(), enabled: false },\n  block: { ...blockServer(), enabled: false },\n  everart: { ...everArtServer(), enabled: false },\n  slack: { ...slackServer(), enabled: false },\n  aws: { ...awsServer(), enabled: false },\n  'google-maps': { ...googleMapsServer(), enabled: false },\n  sentinel: { ...sentinelServer(), enabled: false },\n  'zai-vision': { ...zaiVisionServer(), enabled: false },\n  'minimax-vision': { ...miniMaxVisionServer(), enabled: false },\n  playwright: { ...playwrightServer(), enabled: false },\n  ssh: { ...sshManagerServer(), enabled: false },\n});\n","import { randomBytes } from 'node:crypto';\nimport * as fs from 'node:fs/promises';\nimport * as path from 'node:path';\nimport { FsError } from '../types/errors.js';\n\nexport interface AtomicWriteOptions {\n  mode?: number | undefined;\n  encoding?: BufferEncoding | undefined;\n}\n\nexport interface FileLockOptions {\n  timeoutMs?: number | undefined;\n  staleMs?: number | undefined;\n}\n\nexport async function atomicWrite(\n  targetPath: string,\n  content: string | Uint8Array,\n  opts: AtomicWriteOptions = {},\n): Promise<void> {\n  const dir = path.dirname(targetPath);\n  await fs.mkdir(dir, { recursive: true });\n  const tmp = path.join(dir, `.${path.basename(targetPath)}.${randomBytes(6).toString('hex')}.tmp`);\n\n  // Write content to tmp first; 'wx' ensures exclusive creation (fails if\n  // tmp already exists — extremely unlikely with 6-byte random suffix).\n  try {\n    if (typeof content === 'string') {\n      await fs.writeFile(tmp, content, { flag: 'wx', encoding: opts.encoding ?? 'utf8' });\n    } else {\n      await fs.writeFile(tmp, content, { flag: 'wx' });\n    }\n    try {\n      const fh = await fs.open(tmp, 'r+');\n      try {\n        await fh.sync();\n      } finally {\n        await fh.close();\n      }\n    } catch {\n      // fsync best-effort\n    }\n    // Now safely read mode from target (if it exists) and apply to tmp before rename.\n    // Prefer opts.mode for new files; for existing files preserve their mode.\n    let mode: number | undefined;\n    try {\n      const stat = await fs.stat(targetPath);\n      mode = stat.mode & 0o777;\n    } catch {\n      mode = opts.mode;\n    }\n    if (mode !== undefined) {\n      await fs.chmod(tmp, mode);\n    }\n    await renameWithRetry(tmp, targetPath);\n    // P3 #20 (before-release.md): on Windows, fs.rename (MoveFileExW) does\n    // not preserve Unix permission bits — the chmod above applies to the tmp\n    // file, but the rename may reset the destination's mode to the Windows\n    // default. Re-apply the mode after rename on win32 so an edited file\n    // keeps its executable bit (or any non-default permission). On POSIX,\n    // rename preserves metadata so this is a no-op (chmod is idempotent and\n    // cheap), but we gate it on win32 to avoid the extra stat+chmod on the\n    // common path.\n    if (mode !== undefined && process.platform === 'win32') {\n      try {\n        await fs.chmod(targetPath, mode);\n      } catch {\n        // Best-effort: a transient EPERM (antivirus lock) should not fail\n        // the write — the content is already on disk.\n      }\n    }\n  } catch (err) {\n    try {\n      await fs.unlink(tmp);\n    } catch {\n      // ignore cleanup error\n    }\n    throw err;\n  }\n}\n\nexport async function ensureDir(dir: string): Promise<void> {\n  await fs.mkdir(dir, { recursive: true });\n}\n\nexport async function withFileLock<T>(\n  targetPath: string,\n  fn: () => Promise<T>,\n  opts: FileLockOptions = {},\n): Promise<T> {\n  const dir = path.dirname(targetPath);\n  await fs.mkdir(dir, { recursive: true });\n  const lockPath = path.join(dir, `.${path.basename(targetPath)}.lock`);\n  const timeoutMs = opts.timeoutMs ?? 5_000;\n  const staleMs = opts.staleMs ?? 30_000;\n  const started = Date.now();\n  let handle: fs.FileHandle | undefined;\n\n  for (;;) {\n    try {\n      handle = await fs.open(lockPath, 'wx');\n      await handle.writeFile(`${process.pid}:${Date.now()}`);\n      break;\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code;\n      // ENOENT means the directory was deleted (e.g. by concurrent cleanup).\n      // Recreate it and retry acquiring the lock.\n      if (code === 'ENOENT') {\n        await fs.mkdir(dir, { recursive: true });\n        continue;\n      }\n      if (code !== 'EEXIST') throw err;\n      try {\n        const stat = await fs.stat(lockPath);\n        if (Date.now() - stat.mtimeMs > staleMs) {\n          await fs.unlink(lockPath);\n          continue;\n        }\n      } catch {\n        continue;\n      }\n      if (Date.now() - started >= timeoutMs) {\n        throw new FsError({\n          message: `Timed out waiting for file lock: ${targetPath}`,\n          code: 'FS_ATOMIC_WRITE_FAILED',\n          path: targetPath,\n          context: { timeoutMs },\n        });\n      }\n      await new Promise((resolve) => setTimeout(resolve, 25));\n    }\n  }\n\n  try {\n    return await fn();\n  } finally {\n    try {\n      await handle?.close();\n    } catch {\n      // ignore\n    }\n    try {\n      await fs.unlink(lockPath);\n    } catch {\n      // ignore\n    }\n  }\n}\n\n// On Windows, fs.rename over an existing file can fail with EPERM/EBUSY/EACCES\n// when antivirus, file indexers, editor file watchers, or a concurrent writer\n// briefly hold a handle on the destination. These are transient — retry with a\n// short backoff before giving up. POSIX renames are atomic and won't hit this.\nconst TRANSIENT_RENAME_CODES = new Set(['EPERM', 'EBUSY', 'EACCES', 'ENOTEMPTY']);\n\nasync function renameWithRetry(from: string, to: string): Promise<void> {\n  if (process.platform !== 'win32') {\n    await fs.rename(from, to);\n    return;\n  }\n  const delays = [10, 25, 60, 120, 250];\n  let lastErr: unknown;\n  for (let i = 0; i <= delays.length; i++) {\n    try {\n      await fs.rename(from, to);\n      return;\n    } catch (err) {\n      lastErr = err;\n      const code = (err as NodeJS.ErrnoException)?.code;\n      if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {\n        throw err;\n      }\n      await new Promise((resolve) => setTimeout(resolve, delays[i]));\n    }\n  }\n  throw lastErr;\n}\n","import * as fs from 'node:fs/promises';\nimport { atomicWrite } from './atomic-write.js';\n\nexport type JsonObject = Record<string, unknown>;\nexport type JsonPathSegment = string | number;\nexport type JsonPath = readonly JsonPathSegment[];\n\nexport async function readJsonObjectFile(filePath: string): Promise<JsonObject> {\n  try {\n    const parsed = JSON.parse(await fs.readFile(filePath, 'utf8')) as unknown;\n    return isJsonObject(parsed) ? parsed : {};\n  } catch {\n    return {};\n  }\n}\n\nexport async function jsonObjectFileExists(filePath: string): Promise<boolean> {\n  try {\n    await fs.access(filePath);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport async function writeJsonObjectFile(filePath: string, value: JsonObject): Promise<void> {\n  await atomicWrite(filePath, JSON.stringify(value, null, 2), { mode: 0o600 });\n}\n\nexport async function updateJsonObjectFile(\n  filePath: string,\n  mutator: (config: JsonObject) => void | JsonObject | Promise<void | JsonObject>,\n): Promise<JsonObject> {\n  const config = await readJsonObjectFile(filePath);\n  const maybeNext = await mutator(config);\n  const next = maybeNext && isJsonObject(maybeNext) ? maybeNext : config;\n  await writeJsonObjectFile(filePath, next);\n  return next;\n}\n\nexport function getJsonPath(root: unknown, path: JsonPath): unknown {\n  let current = root;\n  for (const segment of path) {\n    if (typeof segment === 'number') {\n      if (!Array.isArray(current)) return undefined;\n      current = current[segment];\n      continue;\n    }\n    if (!isJsonObject(current)) return undefined;\n    current = current[segment];\n  }\n  return current;\n}\n\nexport function setJsonPath(root: JsonObject, path: JsonPath, value: unknown): JsonObject {\n  if (path.length === 0) {\n    if (!isJsonObject(value)) throw new Error('Root config value must be an object');\n    return value;\n  }\n  const parent = ensureJsonParent(root, path);\n  const leaf = lastPathSegment(path);\n  if (typeof leaf === 'number') {\n    if (!Array.isArray(parent)) throw new Error(`Cannot set numeric segment ${leaf} on non-array parent`);\n    parent[leaf] = value;\n  } else {\n    if (!isJsonObject(parent)) throw new Error(`Cannot set property ${leaf} on non-object parent`);\n    parent[leaf] = value;\n  }\n  return root;\n}\n\nexport function removeJsonPath(root: JsonObject, path: JsonPath): boolean {\n  if (path.length === 0) return false;\n  const parent = getJsonPath(root, path.slice(0, -1));\n  const leaf = lastPathSegment(path);\n  if (typeof leaf === 'number') {\n    if (!Array.isArray(parent) || leaf < 0 || leaf >= parent.length) return false;\n    parent.splice(leaf, 1);\n    return true;\n  }\n  if (!isJsonObject(parent) || !(leaf in parent)) return false;\n  delete parent[leaf];\n  return true;\n}\n\nexport async function setJsonPathInFile(filePath: string, path: JsonPath, value: unknown): Promise<JsonObject> {\n  return updateJsonObjectFile(filePath, (config) => setJsonPath(config, path, value));\n}\n\nexport async function removeJsonPathInFile(filePath: string, path: JsonPath): Promise<JsonObject> {\n  return updateJsonObjectFile(filePath, (config) => {\n    removeJsonPath(config, path);\n  });\n}\n\nexport function isJsonObject(value: unknown): value is JsonObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction lastPathSegment(path: JsonPath): JsonPathSegment {\n  const segment = path[path.length - 1];\n  /* v8 ignore next -- defensive: callers guard path.length === 0 before here */\n  if (segment === undefined) throw new Error('Invalid empty JSON path');\n  return segment;\n}\n\nfunction ensureJsonParent(root: JsonObject, path: JsonPath): JsonObject | unknown[] {\n  let current: JsonObject | unknown[] = root;\n  for (let i = 0; i < path.length - 1; i += 1) {\n    const segment = path[i];\n    const nextSegment = path[i + 1];\n    /* v8 ignore next -- defensive: sparse-array paths are never produced by callers */\n    if (segment === undefined) throw new Error('Invalid empty JSON path segment');\n    const nextContainer = typeof nextSegment === 'number' ? [] : {};\n\n    if (typeof segment === 'number') {\n      if (!Array.isArray(current)) throw new Error(`Cannot traverse numeric segment ${segment} on non-array parent`);\n      if (!isJsonObject(current[segment]) && !Array.isArray(current[segment])) current[segment] = nextContainer;\n      current = current[segment] as JsonObject | unknown[];\n    } else {\n      if (!isJsonObject(current)) throw new Error(`Cannot traverse property ${segment} on non-object parent`);\n      if (!isJsonObject(current[segment]) && !Array.isArray(current[segment])) current[segment] = nextContainer;\n      current = current[segment] as JsonObject | unknown[];\n    }\n  }\n  return current;\n}\n","import { expectDefined } from '../utils/expect-defined.js';\nimport { toErrorMessage } from '../utils/error.js';\nimport { ToolCapabilities } from '../security/capabilities.js';\n/**\n * `mcp_control` — LLM-driven MCP server lifecycle management.\n *\n * The model calls this tool to:\n *   list  — see all known servers (running or not) without starting any\n *   search — filter the server catalog by name or description keyword\n *   enable — start a server and register its tools\n *   disable — stop a server and unregister its tools\n *   restart — stop then re-start a running server\n *\n * This is the primary mechanism by which the LLM autonomously extends its\n * own capabilities at runtime — e.g. \"I need GitHub access, let me enable it.\"\n */\nimport { allServers } from '../infrastructure/mcp-servers.js';\nimport { readJsonObjectFile, setJsonPath, updateJsonObjectFile } from '../utils/config-json.js';\nimport type { Config, JSONSchema, MCPServerConfig, Tool } from '../index.js';\nexport interface MCPRegistryHandle {\n  start(cfg: MCPServerConfig): Promise<void>;\n  stop(name: string): Promise<void>;\n  restart(name: string): Promise<void>;\n  describe(): {\n    name: string;\n    state: string;\n    toolCount: number;\n    enabled: boolean;\n    tools?: string[];\n  }[];\n  list(): { name: string; state: string; toolCount: number; tools?: string[] }[];\n  /**\n   * Register all cached tools for a server without restarting it.\n   * No-op if the server is not connected or tools are already active.\n   * Used in token-saving mode to temporarily expose MCP tools.\n   */\n  activateServer?(name: string): void;\n  /**\n   * Unregister all tools for a server without disconnecting it.\n   * Returns the number of tools that were deactivated.\n   * Used in token-saving mode to hide MCP tools after use.\n   */\n  deactivateServer?(name: string): number;\n  /**\n   * Check whether a server's tools are currently registered.\n   */\n  isActivated?(name: string): boolean;\n}\n\nexport interface CreateMcpControlToolOptions {\n  /**\n   * Read the current config object. The tool never mutates this directly —\n   * writes go to the global config file via `configPath`.\n   */\n  getConfig: () => Config;\n  /**\n   * Path to ~/.wrongstack/config.json (or equivalent) for atomic config writes.\n   */\n  configPath: string;\n  /**\n   * Live MCP registry for runtime start/stop/restart. The tool calls these\n   * immediately so the LLM sees the result of its action in the same turn.\n   */\n  registry: MCPRegistryHandle;\n}\n\nexport function createMcpControlTool(opts: CreateMcpControlToolOptions): Tool {\n  const { getConfig, configPath, registry } = opts;\n\n  const inputSchema: JSONSchema = {\n    type: 'object',\n    properties: {\n      action: {\n        type: 'string',\n        enum: ['list', 'search', 'enable', 'disable', 'restart', 'activate', 'deactivate'],\n        description: 'The management action to perform. activate/deactivate toggle tool registration ephemerally without disconnecting.',\n      },\n      /** Filter for `search`. Matches server name or description case-insensitively. */\n      query: {\n        type: 'string',\n        description: 'Search term for `search` action. Matches server name or description.',\n      },\n      /** Target server name for `enable`, `disable`, `restart`, `activate`, `deactivate`. */\n      server: {\n        type: 'string',\n        description: 'Server name (e.g. \"github\", \"filesystem\", \"brave-search\").',\n      },\n    },\n    required: ['action'],\n  };\n\n  return {\n    name: 'mcp_control',\n    description:\n      'Manage MCP server lifecycle: list available servers, search by name or capability, enable or disable servers at runtime, restart running servers. Use activate/deactivate to ephemerally toggle tool registration without disconnecting — ideal for token-saving mode where MCP tools are lazy-loaded on demand. NOTE: `enable`/`restart` start a server process, which for the built-in stdio presets runs `npx -y <package>` — i.e. it fetches and executes an npm package from the network. Treat it as code execution.',\n    category: 'mcp',\n    permission: 'confirm',\n    mutating: true,\n    // `enable`/`restart` spawn a server process that, for the stdio presets,\n    // fetches and runs an npm package (`npx -y <pkg>`) — effectively remote\n    // code execution. Marking the tool destructive means YOLO still prompts\n    // before it runs (plain non-YOLO already confirms via the CONFIG_MUTATE\n    // dangerous-capability net in the executor). Read-only actions\n    // (list/search) ride the same tool but are cheap to confirm/trust once.\n    riskTier: 'destructive',\n    capabilities: [ToolCapabilities.CONFIG_MUTATE],\n    inputSchema,\n    async execute(raw) {\n      const input = raw as { action: string; query?: string | undefined; server?: string | undefined };\n      return mcpControlDispatch(input, { getConfig, configPath, registry });\n    },\n  };\n}\n\n// ── Dispatch ──────────────────────────────────────────────────────────────────\n\nasync function mcpControlDispatch(\n  input: { action: string; query?: string | undefined; server?: string | undefined },\n  deps: { getConfig: () => Config; configPath: string; registry: MCPRegistryHandle },\n): Promise<string> {\n  const { action, query, server } = input;\n\n  switch (action) {\n    case 'list':  return renderList(deps);\n    case 'search': return renderSearch(query ?? '', deps);\n    case 'enable': return server ? runEnable(server, deps) : '`server` is required for enable.';\n    case 'disable': return server ? runDisable(server, deps) : '`server` is required for disable.';\n    case 'restart': return server ? runRestart(server, deps) : '`server` is required for restart.';\n    case 'activate': return server ? runActivate(server, deps) : '`server` is required for activate.';\n    case 'deactivate': return server ? runDeactivate(server, deps) : '`server` is required for deactivate.';\n    default:\n      return `Unknown action \"${action}\". Use one of: list, search, enable, disable, restart, activate, deactivate.`;\n  }\n}\n\n// ── Actions ───────────────────────────────────────────────────────────────────\n\nasync function renderList(deps: { getConfig: () => Config; configPath: string; registry: MCPRegistryHandle }): Promise<string> {\n  const configured = await getConfiguredMcpServers(deps);\n  const live = deps.registry.describe();\n\n  if (Object.keys(configured).length === 0) {\n    return [\n      'No MCP servers configured.',\n      '  Use `mcp_control({ action: \"search\" })` to see available presets,',\n      '  then `mcp_control({ action: \"enable\", server: \"<name>\" })` to add one.',\n    ].join('\\n');\n  }\n\n  const lines: string[] = [];\n  const liveMap = new Map(live.map((s) => [s.name, s]));\n\n  for (const [name, cfg] of Object.entries(configured)) {\n    const liveInfo = liveMap.get(name);\n    const toolCount = liveInfo ? ` (${liveInfo.toolCount} tools)` : '';\n    const stateStr = liveInfo ? badge(liveInfo.state) : dim('○ not loaded');\n    const enabled = cfg.enabled === false\n      ? `${dim('disabled')}  `\n      : `${green('● enabled')}  `;\n    lines.push(`  ${bold(name)}  ${enabled}${stateStr}${toolCount}`);\n    if (cfg.description) lines.push(`    ${dim(cfg.description)}`);\n  }\n\n  lines.push('');\n  lines.push(dim('  Use `mcp_control({ action: \"search\", query: \"<keyword>\" })` to find servers.'));\n  lines.push(dim('  Use `mcp_control({ action: \"enable\", server: \"<name>\" })` to start a server.'));\n  return lines.join('\\n');\n}\n\nasync function renderSearch(\n  query: string,\n  deps: { getConfig: () => Config; configPath: string; registry: MCPRegistryHandle },\n): Promise<string> {\n  const configured = await getConfiguredMcpServers(deps);\n  const all = allServers();\n  const q = query.toLowerCase();\n\n  const configuredNames = new Set(Object.keys(configured));\n\n  // Match against configured servers first, then remaining presets\n  const configuredEntries = Object.entries(configured).filter(\n    ([name, cfg]) =>\n      name.toLowerCase().includes(q) ||\n      (cfg.description ?? '').toLowerCase().includes(q),\n  );\n\n  const unconfiguredEntries = Object.entries(all)\n    .filter(([name]) => !configuredNames.has(name))\n    .filter(\n      ([name, cfg]) =>\n        name.toLowerCase().includes(q) ||\n        (cfg.description ?? '').toLowerCase().includes(q),\n    );\n\n  const lines: string[] = [];\n\n  if (configuredEntries.length > 0) {\n    lines.push(bold('Configured servers matching \"') + query + '\":');\n    for (const [name, cfg] of configuredEntries) {\n      lines.push(`  ${bold(name)}  ${cfg.description ?? cfg.transport}`);\n    }\n    lines.push('');\n  }\n\n  if (unconfiguredEntries.length > 0) {\n    lines.push(bold('Available presets matching \"') + query + '\":');\n    for (const [name, cfg] of unconfiguredEntries) {\n      const warn = cfg.permission === 'deny' ? red(' ⚠ confirm required') : '';\n      lines.push(`  ${bold(name)}  ${cfg.description ?? cfg.transport}${warn}`);\n    }\n    lines.push('');\n  }\n\n  if (configuredEntries.length === 0 && unconfiguredEntries.length === 0) {\n    return `No servers match \"${query}\". Try a shorter keyword or \\`mcp_control({ action: \"list\" })\\`.`;\n  }\n\n  const total = configuredEntries.length + unconfiguredEntries.length;\n  lines.push(dim(`  ${total} server${total !== 1 ? 's' : ''} shown. Run \\`enable\\` on one to activate it.`));\n  return lines.join('\\n');\n}\n\nasync function runEnable(\n  name: string | undefined,\n  deps: { getConfig: () => Config; configPath: string; registry: MCPRegistryHandle },\n): Promise<string> {\n  if (!name) return '`server` is required for enable. Example: { action: \"enable\", server: \"github\" }';\n\n  const all = allServers();\n  const configured = deps.getConfig().mcpServers ?? {};\n\n  // Resolve the target config — it may be a preset not yet in config\n  const cfg = configured[name] ?? all[name];\n  if (!cfg) {\n    const known = Object.keys(all).join(', ');\n    return `Unknown server \"${name}\". Available presets: ${known}`;\n  }\n\n  // Write to config (add or update) using the shared JSON path helper.\n  await updateJsonObjectFile(deps.configPath, (full) => {\n    const current = isMcpServerRecord(full.mcpServers) ? full.mcpServers : {};\n    setJsonPath(full, ['mcpServers', name], { ...current[name], ...cfg, enabled: true });\n  });\n\n  // Start the server in the registry\n  try {\n    const live = deps.registry.describe().find((s) => s.name === name);\n    if (live && live.state === 'connected') {\n      return `${green('●')} Server \"${name}\" is already running (${live.toolCount} tools registered).`;\n    }\n    await deps.registry.start({ ...cfg, enabled: true });\n    const updated = deps.registry.describe().find((s) => s.name === name);\n    return `${green('✓ Enabled and started')} \"${name}\"${updated ? ` (${updated.toolCount} tools registered).` : '.'}`;\n  } catch (err) {\n    return `${red('✗ Failed to start')} \"${name}\": ${toErrorMessage(err)}`;\n  }\n}\n\nasync function runDisable(\n  name: string | undefined,\n  deps: { getConfig: () => Config; configPath: string; registry: MCPRegistryHandle },\n): Promise<string> {\n  if (!name) return '`server` is required for disable. Example: { action: \"disable\", server: \"github\" }';\n\n  const configured = deps.getConfig().mcpServers ?? {};\n  if (!configured[name]) {\n    return `Server \"${name}\" is not in config. Add it with \\`mcp_control({ action: \"enable\", server: \"${name}\" })\\`.`;\n  }\n\n  // Write to config using the shared JSON path helper.\n  await updateJsonObjectFile(deps.configPath, (full) => {\n    const current = isMcpServerRecord(full.mcpServers) ? full.mcpServers : {};\n    const existing = expectDefined(current[name]);\n    setJsonPath(full, ['mcpServers', name], { ...existing, enabled: false });\n  });\n\n  // Stop the running server\n  try {\n    await deps.registry.stop(name);\n    return `${yellow('○ Disabled')} \"${name}\". It will not be started on next boot.`;\n  } catch {\n    return `${yellow('○ Disabled')} \"${name}\" (it was not running). Config updated.`;\n  }\n}\n\nasync function runRestart(\n  name: string | undefined,\n  deps: { getConfig: () => Config; configPath: string; registry: MCPRegistryHandle },\n): Promise<string> {\n  if (!name) return '`server` is required for restart. Example: { action: \"restart\", server: \"github\" }';\n\n  const configured = deps.getConfig().mcpServers ?? {};\n  if (!configured[name]) {\n    return `Server \"${name}\" is not configured. Use \\`mcp_control({ action: \"enable\", server: \"${name}\" })\\` first.`;\n  }\n\n  try {\n    await deps.registry.restart(name);\n    const updated = deps.registry.describe().find((s) => s.name === name);\n    return `${green('✓ Restarted')} \"${name}\"${updated ? ` (${updated.toolCount} tools registered).` : '.'}`;\n  } catch (err) {\n    return `${red('✗ Restart failed')} for \"${name}\": ${toErrorMessage(err)}`;\n  }\n}\n\n/**\n * Ephemerally activate a server's tools without writing to config or\n * restarting the connection. The server must already be connected (lazy mode).\n * Calls `registry.activateServer()` when available; falls back to a message\n * if the registry doesn't support ephemeral activation.\n */\nasync function runActivate(\n  name: string | undefined,\n  deps: { registry: MCPRegistryHandle },\n): Promise<string> {\n  if (!name) return '`server` is required for activate.';\n  if (!deps.registry.activateServer) {\n    return `Registry does not support ephemeral activation. Use \\`enable\\` to start \"${name}\" instead.`;\n  }\n  const live = deps.registry.describe().find((s) => s.name === name);\n  if (!live) {\n    return `Server \"${name}\" is not registered. Use \\`mcp_control({ action: \"enable\", server: \"${name}\" })\\` first.`;\n  }\n  if (live.state !== 'connected') {\n    return `Server \"${name}\" is not connected (state: ${live.state}). Use \\`enable\\` to start it first.`;\n  }\n  if (deps.registry.isActivated?.(name)) {\n    return `${green('●')} Server \"${name}\" tools are already active. Use \\`deactivate\\` to hide them.`;\n  }\n  deps.registry.activateServer(name);\n  const updated = deps.registry.describe().find((s) => s.name === name);\n  return `${green('✓ Activated')} \"${name}\" — ${updated?.toolCount ?? 0} tool(s) now registered. Use \\`mcp_control({ action: \"deactivate\", server: \"${name}\" })\\` to hide them when done.`;\n}\n\n/**\n * Ephemerally deactivate a server's tools without disconnecting.\n * Calls `registry.deactivateServer()` when available.\n */\nasync function runDeactivate(\n  name: string | undefined,\n  deps: { registry: MCPRegistryHandle },\n): Promise<string> {\n  if (!name) return '`server` is required for deactivate.';\n  if (!deps.registry.deactivateServer) {\n    return `Registry does not support ephemeral deactivation. Use \\`disable\\` to stop \"${name}\" instead.`;\n  }\n  if (!deps.registry.isActivated?.(name)) {\n    return `Server \"${name}\" tools are not currently active.`;\n  }\n  const count = deps.registry.deactivateServer(name);\n  return `${yellow('○ Deactivated')} \"${name}\" — ${count} tool(s) unregistered. Server stays connected.`;\n}\n\n// ── Config helpers ──────────────────────────────────────────────────────────────\n\nasync function getConfiguredMcpServers(deps: { getConfig: () => Config; configPath: string }): Promise<Record<string, MCPServerConfig>> {\n  const diskConfig = await readJsonObjectFile(deps.configPath);\n  if (isMcpServerRecord(diskConfig.mcpServers)) return diskConfig.mcpServers;\n  return deps.getConfig().mcpServers ?? {};\n}\n\nfunction isMcpServerRecord(value: unknown): value is Record<string, MCPServerConfig> {\n  return !!value && typeof value === 'object' && !Array.isArray(value);\n}\n\n// ── Colour helpers (no dep on core color — inline) ───────────────────────────\n\nfunction bold(s: string)  { return `\\x1b[1m${s}\\x1b[0m`; }\nfunction dim(s: string)  { return `\\x1b[2m${s}\\x1b[0m`; }\nfunction green(s: string) { return `\\x1b[32m${s}\\x1b[0m`; }\nfunction yellow(s: string){ return `\\x1b[33m${s}\\x1b[0m`; }\nfunction red(s: string)   { return `\\x1b[31m${s}\\x1b[0m`; }\n\nfunction badge(state: string): string {\n  switch (state) {\n    case 'connected':    return green('● connected');\n    case 'connecting':   return `\\x1b[36m◐ connecting\\x1b[0m`;\n    case 'reconnecting': return `\\x1b[36m◑ reconnecting\\x1b[0m`;\n    case 'disconnected': return dim('○ disconnected');\n    case 'failed':       return red('✗ failed');\n    default:            return dim(state);\n  }\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../../src/utils/expect-defined.ts", "../../src/utils/error.ts", "../../src/security/capabilities.ts", "../../src/infrastructure/mcp-servers.ts", "../../src/utils/config-json.ts", "../../src/utils/atomic-write.ts", "../../src/tools/mcp-control.ts"],
+  "sourcesContent": ["/** Assert a value is neither null nor undefined. Throws if it is.\n *  Useful after optional chaining and indexed access when the\n *  control flow guarantees the value exists but TypeScript can't\n *  prove it (e.g. after a check on a related field). */\nexport function expectDefined<T>(value: T | null | undefined, label?: string): T {\n  if (value === null || value === undefined) {\n    const err = new Error(label ? `Expected ${label} to be defined` : 'Expected value to be defined');\n    err.name = 'ExpectDefinedError';\n    throw err;\n  }\n  return value;\n}\n", "/**\n * Converts an unknown error value to a human-readable string.\n * Used in 40+ files across the codebase to normalize error messaging.\n */\nexport function toErrorMessage(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n", "/**\n * Well-known tool capabilities used for authorization decisions.\n *\n * These are the preferred values for `Tool.capabilities`.\n * New capabilities should be added here with clear documentation.\n *\n * Philosophy (2026-06+):\n * - Prefer capabilities over exact tool name matching.\n * - Subagent guards and future policies should primarily key off capabilities.\n * - Name-based denylists are legacy and will be phased down.\n */\nexport const ToolCapabilities = {\n  /** Can execute arbitrary commands in the user's shell (the `bash` tool). */\n  SHELL_ARBITRARY: 'shell.arbitrary',\n\n  /** Can execute a restricted set of commands (the `exec` tool). */\n  SHELL_RESTRICTED: 'shell.restricted',\n\n  /** Can run a restricted project formatter/linter-style command. */\n  SHELL_EXEC: 'shell.exec',\n\n  /** Can read files inside the project (and possibly outside via symlinks if not guarded). */\n  FS_READ: 'fs.read',\n\n  /** Can write / modify / delete files inside the project. */\n  FS_WRITE: 'fs.write',\n\n  /** Can write files outside the current project root (very high risk). */\n  FS_WRITE_OUTSIDE_PROJECT: 'fs.write.outside-project',\n\n  /** Can perform outbound network requests. */\n  NET_OUTBOUND: 'net.outbound',\n\n  /** Can mutate in-memory session todos only. */\n  SESSION_TODO: 'session.todo',\n\n  /** Can mutate in-memory session mode only. */\n  SESSION_MODE: 'session.mode',\n\n  /** Can inspect registered tool metadata. */\n  TOOL_META: 'tool.meta',\n\n  /** Can invoke arbitrary registered tools through a meta-tool. */\n  TOOL_MUTATE_ANY: 'tool.mutate.any',\n\n  /** Can read persistent memory. */\n  MEMORY_READ: 'memory.read',\n\n  /** Can write persistent memory. */\n  MEMORY_WRITE: 'memory.write',\n\n  /** Can delete persistent memory. */\n  MEMORY_DELETE: 'memory.delete',\n\n  /** Proxies tools from external MCP servers (unknown capability). */\n  MCP_PROXY: 'mcp.proxy',\n\n  /** Can spawn or manage subagents / multi-agent tasks. */\n  SUBAGENT_SPAWN: 'subagent.spawn',\n\n  /** Can inspect fleet/subagent coordination state without mutating it. */\n  COORDINATION_FLEET_READ: 'coordination.fleet.read',\n\n  /** Can publish attributed, schema-checked events onto the fleet bus. */\n  COORDINATION_FLEET_EMIT: 'coordination.fleet.emit',\n\n  /** Can submit a task-local structured result to the parent Director. */\n  COORDINATION_RESULT_SUBMIT: 'coordination.result.submit',\n\n  /** Can read or write inter-agent mailbox messages. */\n  COORDINATION_MAIL: 'coordination.mail',\n\n  /** Can schedule, inspect, or cancel in-session cron jobs. */\n  COORDINATION_CRON: 'coordination.cron',\n\n  /** Can mutate global or session configuration / trust state. */\n  CONFIG_MUTATE: 'config.mutate',\n\n  /** Can install packages or run package managers with side effects. */\n  PACKAGE_INSTALL: 'package.install',\n} as const;\n\nexport type ToolCapability = (typeof ToolCapabilities)[keyof typeof ToolCapabilities];\n\n/**\n * Set of capabilities that are considered dangerous for subagents by default.\n * Subagents should not receive these capabilities unless the leader explicitly\n * allows the specific tool at spawn time.\n */\nexport const DANGEROUS_FOR_SUBAGENTS: readonly ToolCapability[] = [\n  ToolCapabilities.SHELL_ARBITRARY,\n  ToolCapabilities.SHELL_RESTRICTED,\n  ToolCapabilities.SHELL_EXEC,\n  ToolCapabilities.FS_WRITE,\n  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,\n  ToolCapabilities.TOOL_MUTATE_ANY,\n  ToolCapabilities.MEMORY_WRITE,\n  ToolCapabilities.MEMORY_DELETE,\n  ToolCapabilities.MCP_PROXY,\n  ToolCapabilities.SUBAGENT_SPAWN,\n  ToolCapabilities.CONFIG_MUTATE,\n  ToolCapabilities.PACKAGE_INSTALL,\n];\n\n/**\n * Wide capability allowlist for subagents that the user has authorized to act\n * with full developer power (the CLI fleet host applies this to any subagent\n * that isn't given an explicit, narrower grant). It covers everything needed to\n * do real work end-to-end \u2014 read, write/edit inside the project, outbound\n * network, all shell/build/install capabilities, session todos, tool metadata, and read-only\n * memory lookup \u2014 so a delegated coding or build agent runs the same toolchain\n * the leader would, without per-tool confirmation it cannot answer.\n *\n * Deliberately EXCLUDED (require an explicit per-spawn `allowedCapabilities`\n * grant, because they escape the task's blast radius rather than perform it):\n *   - `fs.write.outside-project` \u2014 writing outside the repo (e.g. ~/.ssh).\n *   - `tool.mutate.any` \u2014 arbitrary meta-tool dispatch.\n *   - `memory.write` / `memory.delete` \u2014 persistent memory mutation.\n *   - `mcp.proxy` \u2014 third-party MCP tools (also hard-blocked by name).\n *   - `subagent.spawn` \u2014 recursive delegation (the baseline prompt forbids it).\n *   - `config.mutate` \u2014 rewriting trust/config is privilege escalation, not work.\n */\nexport const WIDE_SUBAGENT_CAPABILITIES: readonly ToolCapability[] = [\n  ToolCapabilities.FS_READ,\n  ToolCapabilities.FS_WRITE,\n  ToolCapabilities.NET_OUTBOUND,\n  ToolCapabilities.SESSION_TODO,\n  ToolCapabilities.TOOL_META,\n  ToolCapabilities.MEMORY_READ,\n  ToolCapabilities.SHELL_ARBITRARY,\n  ToolCapabilities.SHELL_RESTRICTED,\n  ToolCapabilities.SHELL_EXEC,\n  ToolCapabilities.PACKAGE_INSTALL,\n  // Read-only fleet visibility (fleet_status) \u2014 peer awareness has no blast\n  // radius and every fleet worker should coordinate around its peers.\n  ToolCapabilities.COORDINATION_FLEET_READ,\n  ToolCapabilities.COORDINATION_RESULT_SUBMIT,\n];\n\n/**\n * Check if a tool (or its capabilities array) includes any dangerous capability\n * for subagent execution.\n */\nexport function hasDangerousCapabilityForSubagents(\n  toolOrCaps: { capabilities?: readonly string[] | undefined } | readonly string[] | undefined,\n): boolean {\n  if (!toolOrCaps) return false;\n  const input = toolOrCaps as never as { capabilities?: readonly string[] | undefined };\n  const caps: readonly string[] = Array.isArray(toolOrCaps) ? toolOrCaps : (input.capabilities ?? []);\n  return caps.some((c) => DANGEROUS_FOR_SUBAGENTS.includes(c as ToolCapability));\n}\n\n/**\n * Check if a tool declares a specific capability (or any of the provided ones).\n */\nexport function hasCapability(\n  toolOrCaps: { capabilities?: readonly string[] | undefined } | readonly string[] | undefined,\n  capability: ToolCapability | ToolCapability[],\n): boolean {\n  if (!toolOrCaps) return false;\n  const input = toolOrCaps as never as { capabilities?: readonly string[] | undefined };\n  const caps: readonly string[] = Array.isArray(toolOrCaps) ? toolOrCaps : (input.capabilities ?? []);\n  const toCheck = Array.isArray(capability) ? capability : [capability];\n  return toCheck.some((c) => caps.includes(c));\n}\n\n/**\n * Returns the intersection of a tool's capabilities with the dangerous set.\n * Useful for logging and audit trails.\n */\nexport function getDangerousCapabilities(\n  toolOrCaps: { capabilities?: readonly string[] | undefined } | readonly string[] | undefined,\n): ToolCapability[] {\n  if (!toolOrCaps) return [];\n  const input = toolOrCaps as never as { capabilities?: readonly string[] | undefined };\n  const caps: readonly string[] = Array.isArray(toolOrCaps) ? toolOrCaps : (input.capabilities ?? []);\n  return caps.filter((c): c is ToolCapability =>\n    DANGEROUS_FOR_SUBAGENTS.includes(c as ToolCapability),\n  );\n}\n", "import type { MCPServerConfig } from '../types/config.js';\n\n/**\n * Built-in MCP server presets available to all WrongStack users out of the box.\n * These servers must be explicitly enabled in config (disabled by default).\n *\n * To enable: set `mcpServers: { serverName: { enabled: true } }` in your config.\n *\n * Some servers require environment variables or additional config \u2014 see notes below.\n *\n * Transport types:\n *   stdio       \u2014 spawns a local npm package binary via child_process\n *   sse         \u2014 HTTP SSE endpoint (client POSTs requests)\n *   streamable-http \u2014 session-based HTTP with NDJSON responses\n */\n\n/** Filesystem access: read, write, list, search, tree. Good for exploring projects. */\nexport const filesystemServer = (): MCPServerConfig => ({\n  name: 'filesystem',\n  description: 'Read, write, and navigate the local filesystem (read-heavy tools)',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-filesystem', '.'],\n  permission: 'confirm',\n});\n\n/** GitHub API: issues, PRs, repos, search, file operations. Requires GITHUB_PERSONAL_ACCESS_TOKEN. */\nexport const githubServer = (): MCPServerConfig => ({\n  name: 'github',\n  description:\n    'GitHub API \u2014 issues, PRs, repos, search, file ops (requires GITHUB_PERSONAL_ACCESS_TOKEN)',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-github'],\n  passthroughEnv: ['GITHUB_PERSONAL_ACCESS_TOKEN', 'GITHUB_TOKEN'],\n  permission: 'confirm',\n});\n\n/**\n * Context7 \u2014 codebase-aware documentation and Q&A using context from your code.\n * Live documentation for any library, grounded in your actual versions.\n */\nexport const context7Server = (): MCPServerConfig => ({\n  name: 'context7',\n  description: 'Codebase-aware documentation and Q&A (context7.ai)',\n  transport: 'streamable-http',\n  url: 'https://mcp.context7.com/mcp',\n  permission: 'confirm',\n});\n\n/**\n * Brave Search \u2014 web search via Brave Browser's API.\n * Requires BRAVE_SEARCH_API_KEY. Free tier: 2,000 queries/month.\n * Sign up at https://api.search.brave.com/\n */\nexport const braveSearchServer = (): MCPServerConfig => ({\n  name: 'brave-search',\n  description: 'Web search (Brave). Requires BRAVE_SEARCH_API_KEY \u2014 free tier 2k queries/month',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-brave-search'],\n  passthroughEnv: ['BRAVE_SEARCH_API_KEY'],\n  permission: 'confirm',\n});\n\n/**\n * Block (Block, Inc.) \u2014 Postgres database access via SQL.\n * Useful for running queries against a connected database during development.\n */\nexport const blockServer = (): MCPServerConfig => ({\n  name: 'block',\n  description: 'Postgres database access via SQL (Block MCP server)',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-block'],\n  permission: 'confirm',\n});\n\n/**\n * EverArt \u2014 AI image generation via various providers.\n * Requires EVERART_API_KEY.\n */\nexport const everArtServer = (): MCPServerConfig => ({\n  name: 'everart',\n  description: 'AI image generation (EverArt). Requires EVERART_API_KEY',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-everart'],\n  passthroughEnv: ['EVERART_API_KEY'],\n  permission: 'confirm',\n});\n\n/**\n * Slack \u2014 messaging, channels, search.\n * Requires SLACK_BOT_TOKEN and either SLACK_TEAM_ID or SLACK_USER_TOKEN.\n */\nexport const slackServer = (): MCPServerConfig => ({\n  name: 'slack',\n  description: 'Slack \u2014 messaging, channels, search. Requires SLACK_BOT_TOKEN + SLACK_TEAM_ID',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-slack'],\n  passthroughEnv: ['SLACK_BOT_TOKEN', 'SLACK_TEAM_ID'],\n  permission: 'confirm',\n});\n\n/**\n * AWS knowledge base \u2014 EC2, S3, Lambda, IAM, CloudFormation, cost management.\n * Requires AWS access key + secret in environment.\n */\nexport const awsServer = (): MCPServerConfig => ({\n  name: 'aws',\n  description: 'AWS \u2014 EC2, S3, Lambda, IAM, CloudFormation, costs. Requires AWS credentials',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-aws'],\n  passthroughEnv: ['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_REGION', 'AWS_SESSION_TOKEN'],\n  permission: 'confirm',\n});\n\n/**\n * Google Maps \u2014 directions, distance matrix, geocoding, places.\n * Requires GOOGLE_MAPS_API_KEY.\n */\nexport const googleMapsServer = (): MCPServerConfig => ({\n  name: 'google-maps',\n  description: 'Google Maps \u2014 directions, geocoding, places. Requires GOOGLE_MAPS_API_KEY',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-google-maps'],\n  passthroughEnv: ['GOOGLE_MAPS_API_KEY'],\n  permission: 'confirm',\n});\n\n/** Sentinel \u2014 security vulnerability scanning (sentinel-labs). */\nexport const sentinelServer = (): MCPServerConfig => ({\n  name: 'sentinel',\n  description: 'Security vulnerability scanning (Sentinel)',\n  transport: 'streamable-http',\n  url: 'https://mcp.sentinel.ai',\n  permission: 'deny', // security tool \u2014 require explicit confirmation\n});\n\n/**\n * Z.AI Vision MCP \u2014 image understanding fallback for text-only models.\n * Requires Z_AI_API_KEY. Tools are read-only and safe to run automatically.\n */\nexport const zaiVisionServer = (): MCPServerConfig => ({\n  name: 'zai-vision',\n  description: 'Z.AI Vision MCP \u2014 image analysis and screenshot understanding',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@z_ai/mcp-server@latest'],\n  env: { Z_AI_MODE: 'ZAI' },\n  passthroughEnv: ['Z_AI_API_KEY'],\n  allowedTools: [\n    'image_analysis',\n    'extract_text_from_screenshot',\n    'diagnose_error_screenshot',\n    'understand_technical_diagram',\n    'analyze_data_visualization',\n    'ui_diff_check',\n  ],\n  permission: 'auto',\n});\n\n/**\n * Playwright \u2014 browser automation: navigate, click, type, screenshot, evaluate JS.\n * Spawns a headless Chromium browser via @modelcontextprotocol/server-playwright.\n * Tools can read and interact with live web pages \u2014 permission defaults to\n * `confirm` because form submission / DOM mutation is possible.\n */\nexport const playwrightServer = (): MCPServerConfig => ({\n  name: 'playwright',\n  description:\n    'Browser automation \u2014 navigate, screenshot, click, type, evaluate JS (headless Chromium)',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', '@modelcontextprotocol/server-playwright'],\n  permission: 'confirm',\n});\n\n/**\n * MiniMax Token Plan MCP \u2014 search + understand_image.\n * This preset exposes only the read-only image understanding tool by default.\n * Requires MINIMAX_API_KEY and uvx on PATH.\n */\nexport const miniMaxVisionServer = (): MCPServerConfig => ({\n  name: 'minimax-vision',\n  description: 'MiniMax MCP \u2014 image understanding via understand_image',\n  transport: 'stdio',\n  command: 'uvx',\n  args: ['minimax-coding-plan-mcp', '-y'],\n  env: {\n    MINIMAX_MCP_BASE_PATH: './.wrongstack/minimax-output',\n    MINIMAX_API_HOST: 'https://api.minimax.io',\n    MINIMAX_API_RESOURCE_MODE: 'url',\n  },\n  passthroughEnv: ['MINIMAX_API_KEY'],\n  allowedTools: ['understand_image'],\n  permission: 'auto',\n});\n\n/**\n * SSH Manager \u2014 remote SSH execution, file transfer, tunnels, health checks, and deployment ops.\n * Server credentials are intentionally NOT embedded here. Configure hosts via mcp-ssh-manager's\n * env/TOML config (for example SSH_SERVER_<NAME>_HOST, USER, KEYPATH/PASSWORD) or ssh-agent.\n */\nexport const sshManagerServer = (): MCPServerConfig => ({\n  name: 'ssh',\n  description:\n    'Remote SSH management \u2014 execute commands, transfer files, tunnels, health checks (mcp-ssh-manager)',\n  transport: 'stdio',\n  command: 'npx',\n  args: ['-y', 'mcp-ssh-manager'],\n  env: {\n    MCP_SSH_COMPACT_JSON: 'true',\n    MCP_SSH_DEFAULT_TIMEOUT: '120000',\n  },\n  permission: 'confirm',\n  requestTimeoutMs: 180_000,\n});\n\n/** Everything bundled \u2014 full set of built-in servers. Useful for `wstack mcp add --all`. */\nexport const allServers = (): Record<string, MCPServerConfig> => ({\n  filesystem: { ...filesystemServer(), enabled: false },\n  github: { ...githubServer(), enabled: false },\n  context7: { ...context7Server(), enabled: false },\n  'brave-search': { ...braveSearchServer(), enabled: false },\n  block: { ...blockServer(), enabled: false },\n  everart: { ...everArtServer(), enabled: false },\n  slack: { ...slackServer(), enabled: false },\n  aws: { ...awsServer(), enabled: false },\n  'google-maps': { ...googleMapsServer(), enabled: false },\n  sentinel: { ...sentinelServer(), enabled: false },\n  'zai-vision': { ...zaiVisionServer(), enabled: false },\n  'minimax-vision': { ...miniMaxVisionServer(), enabled: false },\n  playwright: { ...playwrightServer(), enabled: false },\n  ssh: { ...sshManagerServer(), enabled: false },\n});\n", "import * as fs from 'node:fs/promises';\nimport { atomicWrite } from './atomic-write.js';\n\nexport type JsonObject = Record<string, unknown>;\nexport type JsonPathSegment = string | number;\nexport type JsonPath = readonly JsonPathSegment[];\n\nexport async function readJsonObjectFile(filePath: string): Promise<JsonObject> {\n  try {\n    const parsed = JSON.parse(await fs.readFile(filePath, 'utf8')) as unknown;\n    return isJsonObject(parsed) ? parsed : {};\n  } catch {\n    return {};\n  }\n}\n\nexport async function jsonObjectFileExists(filePath: string): Promise<boolean> {\n  try {\n    await fs.access(filePath);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport async function writeJsonObjectFile(filePath: string, value: JsonObject): Promise<void> {\n  await atomicWrite(filePath, JSON.stringify(value, null, 2), { mode: 0o600 });\n}\n\nexport async function updateJsonObjectFile(\n  filePath: string,\n  mutator: (config: JsonObject) => void | JsonObject | Promise<void | JsonObject>,\n): Promise<JsonObject> {\n  const config = await readJsonObjectFile(filePath);\n  const maybeNext = await mutator(config);\n  const next = maybeNext && isJsonObject(maybeNext) ? maybeNext : config;\n  await writeJsonObjectFile(filePath, next);\n  return next;\n}\n\nexport function getJsonPath(root: unknown, path: JsonPath): unknown {\n  let current = root;\n  for (const segment of path) {\n    if (typeof segment === 'number') {\n      if (!Array.isArray(current)) return undefined;\n      current = current[segment];\n      continue;\n    }\n    if (!isJsonObject(current)) return undefined;\n    current = current[segment];\n  }\n  return current;\n}\n\nexport function setJsonPath(root: JsonObject, path: JsonPath, value: unknown): JsonObject {\n  if (path.length === 0) {\n    if (!isJsonObject(value)) throw new Error('Root config value must be an object');\n    return value;\n  }\n  const parent = ensureJsonParent(root, path);\n  const leaf = lastPathSegment(path);\n  if (typeof leaf === 'number') {\n    if (!Array.isArray(parent)) throw new Error(`Cannot set numeric segment ${leaf} on non-array parent`);\n    parent[leaf] = value;\n  } else {\n    if (!isJsonObject(parent)) throw new Error(`Cannot set property ${leaf} on non-object parent`);\n    parent[leaf] = value;\n  }\n  return root;\n}\n\nexport function removeJsonPath(root: JsonObject, path: JsonPath): boolean {\n  if (path.length === 0) return false;\n  const parent = getJsonPath(root, path.slice(0, -1));\n  const leaf = lastPathSegment(path);\n  if (typeof leaf === 'number') {\n    if (!Array.isArray(parent) || leaf < 0 || leaf >= parent.length) return false;\n    parent.splice(leaf, 1);\n    return true;\n  }\n  if (!isJsonObject(parent) || !(leaf in parent)) return false;\n  delete parent[leaf];\n  return true;\n}\n\nexport async function setJsonPathInFile(filePath: string, path: JsonPath, value: unknown): Promise<JsonObject> {\n  return updateJsonObjectFile(filePath, (config) => setJsonPath(config, path, value));\n}\n\nexport async function removeJsonPathInFile(filePath: string, path: JsonPath): Promise<JsonObject> {\n  return updateJsonObjectFile(filePath, (config) => {\n    removeJsonPath(config, path);\n  });\n}\n\nexport function isJsonObject(value: unknown): value is JsonObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction lastPathSegment(path: JsonPath): JsonPathSegment {\n  const segment = path[path.length - 1];\n  /* v8 ignore next -- defensive: callers guard path.length === 0 before here */\n  if (segment === undefined) throw new Error('Invalid empty JSON path');\n  return segment;\n}\n\nfunction ensureJsonParent(root: JsonObject, path: JsonPath): JsonObject | unknown[] {\n  let current: JsonObject | unknown[] = root;\n  for (let i = 0; i < path.length - 1; i += 1) {\n    const segment = path[i];\n    const nextSegment = path[i + 1];\n    /* v8 ignore next -- defensive: sparse-array paths are never produced by callers */\n    if (segment === undefined) throw new Error('Invalid empty JSON path segment');\n    const nextContainer = typeof nextSegment === 'number' ? [] : {};\n\n    if (typeof segment === 'number') {\n      if (!Array.isArray(current)) throw new Error(`Cannot traverse numeric segment ${segment} on non-array parent`);\n      if (!isJsonObject(current[segment]) && !Array.isArray(current[segment])) current[segment] = nextContainer;\n      current = current[segment] as JsonObject | unknown[];\n    } else {\n      if (!isJsonObject(current)) throw new Error(`Cannot traverse property ${segment} on non-object parent`);\n      if (!isJsonObject(current[segment]) && !Array.isArray(current[segment])) current[segment] = nextContainer;\n      current = current[segment] as JsonObject | unknown[];\n    }\n  }\n  return current;\n}\n", "import { randomBytes } from 'node:crypto';\nimport * as fs from 'node:fs/promises';\nimport * as path from 'node:path';\nimport { FsError } from '../types/errors.js';\n\nexport interface AtomicWriteOptions {\n  mode?: number | undefined;\n  encoding?: BufferEncoding | undefined;\n}\n\nexport interface FileLockOptions {\n  timeoutMs?: number | undefined;\n  staleMs?: number | undefined;\n}\n\nexport async function atomicWrite(\n  targetPath: string,\n  content: string | Uint8Array,\n  opts: AtomicWriteOptions = {},\n): Promise<void> {\n  const dir = path.dirname(targetPath);\n  await fs.mkdir(dir, { recursive: true });\n  const tmp = path.join(dir, `.${path.basename(targetPath)}.${randomBytes(6).toString('hex')}.tmp`);\n\n  // Write content to tmp first; 'wx' ensures exclusive creation (fails if\n  // tmp already exists \u2014 extremely unlikely with 6-byte random suffix).\n  try {\n    if (typeof content === 'string') {\n      await fs.writeFile(tmp, content, { flag: 'wx', encoding: opts.encoding ?? 'utf8' });\n    } else {\n      await fs.writeFile(tmp, content, { flag: 'wx' });\n    }\n    try {\n      const fh = await fs.open(tmp, 'r+');\n      try {\n        await fh.sync();\n      } finally {\n        await fh.close();\n      }\n    } catch {\n      // fsync best-effort\n    }\n    // Now safely read mode from target (if it exists) and apply to tmp before rename.\n    // Prefer opts.mode for new files; for existing files preserve their mode.\n    let mode: number | undefined;\n    try {\n      const stat = await fs.stat(targetPath);\n      mode = stat.mode & 0o777;\n    } catch {\n      mode = opts.mode;\n    }\n    if (mode !== undefined) {\n      await fs.chmod(tmp, mode);\n    }\n    await renameWithRetry(tmp, targetPath);\n    // P3 #20 (before-release.md): on Windows, fs.rename (MoveFileExW) does\n    // not preserve Unix permission bits \u2014 the chmod above applies to the tmp\n    // file, but the rename may reset the destination's mode to the Windows\n    // default. Re-apply the mode after rename on win32 so an edited file\n    // keeps its executable bit (or any non-default permission). On POSIX,\n    // rename preserves metadata so this is a no-op (chmod is idempotent and\n    // cheap), but we gate it on win32 to avoid the extra stat+chmod on the\n    // common path.\n    if (mode !== undefined && process.platform === 'win32') {\n      try {\n        await fs.chmod(targetPath, mode);\n      } catch {\n        // Best-effort: a transient EPERM (antivirus lock) should not fail\n        // the write \u2014 the content is already on disk.\n      }\n    }\n  } catch (err) {\n    try {\n      await fs.unlink(tmp);\n    } catch {\n      // ignore cleanup error\n    }\n    throw err;\n  }\n}\n\nexport async function ensureDir(dir: string): Promise<void> {\n  await fs.mkdir(dir, { recursive: true });\n}\n\nexport async function withFileLock<T>(\n  targetPath: string,\n  fn: () => Promise<T>,\n  opts: FileLockOptions = {},\n): Promise<T> {\n  const dir = path.dirname(targetPath);\n  await fs.mkdir(dir, { recursive: true });\n  const lockPath = path.join(dir, `.${path.basename(targetPath)}.lock`);\n  const timeoutMs = opts.timeoutMs ?? 5_000;\n  const staleMs = opts.staleMs ?? 30_000;\n  const started = Date.now();\n  let handle: fs.FileHandle | undefined;\n\n  for (;;) {\n    try {\n      handle = await fs.open(lockPath, 'wx');\n      await handle.writeFile(`${process.pid}:${Date.now()}`);\n      break;\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code;\n      // ENOENT means the directory was deleted (e.g. by concurrent cleanup).\n      // Recreate it and retry acquiring the lock.\n      if (code === 'ENOENT') {\n        await fs.mkdir(dir, { recursive: true });\n        continue;\n      }\n      if (code !== 'EEXIST') throw err;\n      try {\n        const stat = await fs.stat(lockPath);\n        if (Date.now() - stat.mtimeMs > staleMs) {\n          await fs.unlink(lockPath);\n          continue;\n        }\n      } catch {\n        continue;\n      }\n      if (Date.now() - started >= timeoutMs) {\n        throw new FsError({\n          message: `Timed out waiting for file lock: ${targetPath}`,\n          code: 'FS_ATOMIC_WRITE_FAILED',\n          path: targetPath,\n          context: { timeoutMs },\n        });\n      }\n      await new Promise((resolve) => setTimeout(resolve, 25));\n    }\n  }\n\n  try {\n    return await fn();\n  } finally {\n    try {\n      await handle?.close();\n    } catch {\n      // ignore\n    }\n    try {\n      await fs.unlink(lockPath);\n    } catch {\n      // ignore\n    }\n  }\n}\n\n// On Windows, fs.rename over an existing file can fail with EPERM/EBUSY/EACCES\n// when antivirus, file indexers, editor file watchers, or a concurrent writer\n// briefly hold a handle on the destination. These are transient \u2014 retry with a\n// short backoff before giving up. POSIX renames are atomic and won't hit this.\nconst TRANSIENT_RENAME_CODES = new Set(['EPERM', 'EBUSY', 'EACCES', 'ENOTEMPTY']);\n\nasync function renameWithRetry(from: string, to: string): Promise<void> {\n  if (process.platform !== 'win32') {\n    await fs.rename(from, to);\n    return;\n  }\n  const delays = [10, 25, 60, 120, 250];\n  let lastErr: unknown;\n  for (let i = 0; i <= delays.length; i++) {\n    try {\n      await fs.rename(from, to);\n      return;\n    } catch (err) {\n      lastErr = err;\n      const code = (err as NodeJS.ErrnoException)?.code;\n      if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {\n        throw err;\n      }\n      await new Promise((resolve) => setTimeout(resolve, delays[i]));\n    }\n  }\n  throw lastErr;\n}\n", "import { expectDefined } from '../utils/expect-defined.js';\nimport { toErrorMessage } from '../utils/error.js';\nimport { ToolCapabilities } from '../security/capabilities.js';\n/**\n * `mcp_control` \u2014 LLM-driven MCP server lifecycle management.\n *\n * The model calls this tool to:\n *   list  \u2014 see all known servers (running or not) without starting any\n *   search \u2014 filter the server catalog by name or description keyword\n *   enable \u2014 start a server and register its tools\n *   disable \u2014 stop a server and unregister its tools\n *   restart \u2014 stop then re-start a running server\n *\n * This is the primary mechanism by which the LLM autonomously extends its\n * own capabilities at runtime \u2014 e.g. \"I need GitHub access, let me enable it.\"\n */\nimport { allServers } from '../infrastructure/mcp-servers.js';\nimport { readJsonObjectFile, setJsonPath, updateJsonObjectFile } from '../utils/config-json.js';\nimport type { Config, JSONSchema, MCPServerConfig, Tool } from '../index.js';\nexport interface MCPRegistryHandle {\n  start(cfg: MCPServerConfig): Promise<void>;\n  stop(name: string): Promise<void>;\n  restart(name: string): Promise<void>;\n  describe(): {\n    name: string;\n    state: string;\n    toolCount: number;\n    enabled: boolean;\n    tools?: string[];\n  }[];\n  list(): { name: string; state: string; toolCount: number; tools?: string[] }[];\n  /**\n   * Register all cached tools for a server without restarting it.\n   * No-op if the server is not connected or tools are already active.\n   * Used in token-saving mode to temporarily expose MCP tools.\n   */\n  activateServer?(name: string): void;\n  /**\n   * Unregister all tools for a server without disconnecting it.\n   * Returns the number of tools that were deactivated.\n   * Used in token-saving mode to hide MCP tools after use.\n   */\n  deactivateServer?(name: string): number;\n  /**\n   * Check whether a server's tools are currently registered.\n   */\n  isActivated?(name: string): boolean;\n}\n\nexport interface CreateMcpControlToolOptions {\n  /**\n   * Read the current config object. The tool never mutates this directly \u2014\n   * writes go to the global config file via `configPath`.\n   */\n  getConfig: () => Config;\n  /**\n   * Path to ~/.wrongstack/config.json (or equivalent) for atomic config writes.\n   */\n  configPath: string;\n  /**\n   * Live MCP registry for runtime start/stop/restart. The tool calls these\n   * immediately so the LLM sees the result of its action in the same turn.\n   */\n  registry: MCPRegistryHandle;\n}\n\nexport function createMcpControlTool(opts: CreateMcpControlToolOptions): Tool {\n  const { getConfig, configPath, registry } = opts;\n\n  const inputSchema: JSONSchema = {\n    type: 'object',\n    properties: {\n      action: {\n        type: 'string',\n        enum: ['list', 'search', 'enable', 'disable', 'restart', 'activate', 'deactivate'],\n        description: 'The management action to perform. activate/deactivate toggle tool registration ephemerally without disconnecting.',\n      },\n      /** Filter for `search`. Matches server name or description case-insensitively. */\n      query: {\n        type: 'string',\n        description: 'Search term for `search` action. Matches server name or description.',\n      },\n      /** Target server name for `enable`, `disable`, `restart`, `activate`, `deactivate`. */\n      server: {\n        type: 'string',\n        description: 'Server name (e.g. \"github\", \"filesystem\", \"brave-search\").',\n      },\n    },\n    required: ['action'],\n  };\n\n  return {\n    name: 'mcp_control',\n    description:\n      'Manage MCP server lifecycle: list available servers, search by name or capability, enable or disable servers at runtime, restart running servers. Use activate/deactivate to ephemerally toggle tool registration without disconnecting \u2014 ideal for token-saving mode where MCP tools are lazy-loaded on demand. NOTE: `enable`/`restart` start a server process, which for the built-in stdio presets runs `npx -y <package>` \u2014 i.e. it fetches and executes an npm package from the network. Treat it as code execution.',\n    category: 'mcp',\n    permission: 'confirm',\n    mutating: true,\n    // `enable`/`restart` spawn a server process that, for the stdio presets,\n    // fetches and runs an npm package (`npx -y <pkg>`) \u2014 effectively remote\n    // code execution. Marking the tool destructive preserves risk metadata for\n    // UI/audit surfaces; YOLO itself still auto-approves unless an explicit\n    // deny rule blocks the call. Read-only actions (list/search) ride the same\n    // tool but are cheap to confirm/trust once when YOLO is off.\n    riskTier: 'destructive',\n    capabilities: [ToolCapabilities.CONFIG_MUTATE],\n    inputSchema,\n    async execute(raw) {\n      const input = raw as { action: string; query?: string | undefined; server?: string | undefined };\n      return mcpControlDispatch(input, { getConfig, configPath, registry });\n    },\n  };\n}\n\n// \u2500\u2500 Dispatch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nasync function mcpControlDispatch(\n  input: { action: string; query?: string | undefined; server?: string | undefined },\n  deps: { getConfig: () => Config; configPath: string; registry: MCPRegistryHandle },\n): Promise<string> {\n  const { action, query, server } = input;\n\n  switch (action) {\n    case 'list':  return renderList(deps);\n    case 'search': return renderSearch(query ?? '', deps);\n    case 'enable': return server ? runEnable(server, deps) : '`server` is required for enable.';\n    case 'disable': return server ? runDisable(server, deps) : '`server` is required for disable.';\n    case 'restart': return server ? runRestart(server, deps) : '`server` is required for restart.';\n    case 'activate': return server ? runActivate(server, deps) : '`server` is required for activate.';\n    case 'deactivate': return server ? runDeactivate(server, deps) : '`server` is required for deactivate.';\n    default:\n      return `Unknown action \"${action}\". Use one of: list, search, enable, disable, restart, activate, deactivate.`;\n  }\n}\n\n// \u2500\u2500 Actions \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nasync function renderList(deps: { getConfig: () => Config; configPath: string; registry: MCPRegistryHandle }): Promise<string> {\n  const configured = await getConfiguredMcpServers(deps);\n  const live = deps.registry.describe();\n\n  if (Object.keys(configured).length === 0) {\n    return [\n      'No MCP servers configured.',\n      '  Use `mcp_control({ action: \"search\" })` to see available presets,',\n      '  then `mcp_control({ action: \"enable\", server: \"<name>\" })` to add one.',\n    ].join('\\n');\n  }\n\n  const lines: string[] = [];\n  const liveMap = new Map(live.map((s) => [s.name, s]));\n\n  for (const [name, cfg] of Object.entries(configured)) {\n    const liveInfo = liveMap.get(name);\n    const toolCount = liveInfo ? ` (${liveInfo.toolCount} tools)` : '';\n    const stateStr = liveInfo ? badge(liveInfo.state) : dim('\u25CB not loaded');\n    const enabled = cfg.enabled === false\n      ? `${dim('disabled')}  `\n      : `${green('\u25CF enabled')}  `;\n    lines.push(`  ${bold(name)}  ${enabled}${stateStr}${toolCount}`);\n    if (cfg.description) lines.push(`    ${dim(cfg.description)}`);\n  }\n\n  lines.push('');\n  lines.push(dim('  Use `mcp_control({ action: \"search\", query: \"<keyword>\" })` to find servers.'));\n  lines.push(dim('  Use `mcp_control({ action: \"enable\", server: \"<name>\" })` to start a server.'));\n  return lines.join('\\n');\n}\n\nasync function renderSearch(\n  query: string,\n  deps: { getConfig: () => Config; configPath: string; registry: MCPRegistryHandle },\n): Promise<string> {\n  const configured = await getConfiguredMcpServers(deps);\n  const all = allServers();\n  const q = query.toLowerCase();\n\n  const configuredNames = new Set(Object.keys(configured));\n\n  // Match against configured servers first, then remaining presets\n  const configuredEntries = Object.entries(configured).filter(\n    ([name, cfg]) =>\n      name.toLowerCase().includes(q) ||\n      (cfg.description ?? '').toLowerCase().includes(q),\n  );\n\n  const unconfiguredEntries = Object.entries(all)\n    .filter(([name]) => !configuredNames.has(name))\n    .filter(\n      ([name, cfg]) =>\n        name.toLowerCase().includes(q) ||\n        (cfg.description ?? '').toLowerCase().includes(q),\n    );\n\n  const lines: string[] = [];\n\n  if (configuredEntries.length > 0) {\n    lines.push(bold('Configured servers matching \"') + query + '\":');\n    for (const [name, cfg] of configuredEntries) {\n      lines.push(`  ${bold(name)}  ${cfg.description ?? cfg.transport}`);\n    }\n    lines.push('');\n  }\n\n  if (unconfiguredEntries.length > 0) {\n    lines.push(bold('Available presets matching \"') + query + '\":');\n    for (const [name, cfg] of unconfiguredEntries) {\n      const warn = cfg.permission === 'deny' ? red(' \u26A0 confirm required') : '';\n      lines.push(`  ${bold(name)}  ${cfg.description ?? cfg.transport}${warn}`);\n    }\n    lines.push('');\n  }\n\n  if (configuredEntries.length === 0 && unconfiguredEntries.length === 0) {\n    return `No servers match \"${query}\". Try a shorter keyword or \\`mcp_control({ action: \"list\" })\\`.`;\n  }\n\n  const total = configuredEntries.length + unconfiguredEntries.length;\n  lines.push(dim(`  ${total} server${total !== 1 ? 's' : ''} shown. Run \\`enable\\` on one to activate it.`));\n  return lines.join('\\n');\n}\n\nasync function runEnable(\n  name: string | undefined,\n  deps: { getConfig: () => Config; configPath: string; registry: MCPRegistryHandle },\n): Promise<string> {\n  if (!name) return '`server` is required for enable. Example: { action: \"enable\", server: \"github\" }';\n\n  const all = allServers();\n  const configured = deps.getConfig().mcpServers ?? {};\n\n  // Resolve the target config \u2014 it may be a preset not yet in config\n  const cfg = configured[name] ?? all[name];\n  if (!cfg) {\n    const known = Object.keys(all).join(', ');\n    return `Unknown server \"${name}\". Available presets: ${known}`;\n  }\n\n  // Write to config (add or update) using the shared JSON path helper.\n  await updateJsonObjectFile(deps.configPath, (full) => {\n    const current = isMcpServerRecord(full.mcpServers) ? full.mcpServers : {};\n    setJsonPath(full, ['mcpServers', name], { ...current[name], ...cfg, enabled: true });\n  });\n\n  // Start the server in the registry\n  try {\n    const live = deps.registry.describe().find((s) => s.name === name);\n    if (live && live.state === 'connected') {\n      return `${green('\u25CF')} Server \"${name}\" is already running (${live.toolCount} tools registered).`;\n    }\n    await deps.registry.start({ ...cfg, enabled: true });\n    const updated = deps.registry.describe().find((s) => s.name === name);\n    return `${green('\u2713 Enabled and started')} \"${name}\"${updated ? ` (${updated.toolCount} tools registered).` : '.'}`;\n  } catch (err) {\n    return `${red('\u2717 Failed to start')} \"${name}\": ${toErrorMessage(err)}`;\n  }\n}\n\nasync function runDisable(\n  name: string | undefined,\n  deps: { getConfig: () => Config; configPath: string; registry: MCPRegistryHandle },\n): Promise<string> {\n  if (!name) return '`server` is required for disable. Example: { action: \"disable\", server: \"github\" }';\n\n  const configured = deps.getConfig().mcpServers ?? {};\n  if (!configured[name]) {\n    return `Server \"${name}\" is not in config. Add it with \\`mcp_control({ action: \"enable\", server: \"${name}\" })\\`.`;\n  }\n\n  // Write to config using the shared JSON path helper.\n  await updateJsonObjectFile(deps.configPath, (full) => {\n    const current = isMcpServerRecord(full.mcpServers) ? full.mcpServers : {};\n    const existing = expectDefined(current[name]);\n    setJsonPath(full, ['mcpServers', name], { ...existing, enabled: false });\n  });\n\n  // Stop the running server\n  try {\n    await deps.registry.stop(name);\n    return `${yellow('\u25CB Disabled')} \"${name}\". It will not be started on next boot.`;\n  } catch {\n    return `${yellow('\u25CB Disabled')} \"${name}\" (it was not running). Config updated.`;\n  }\n}\n\nasync function runRestart(\n  name: string | undefined,\n  deps: { getConfig: () => Config; configPath: string; registry: MCPRegistryHandle },\n): Promise<string> {\n  if (!name) return '`server` is required for restart. Example: { action: \"restart\", server: \"github\" }';\n\n  const configured = deps.getConfig().mcpServers ?? {};\n  if (!configured[name]) {\n    return `Server \"${name}\" is not configured. Use \\`mcp_control({ action: \"enable\", server: \"${name}\" })\\` first.`;\n  }\n\n  try {\n    await deps.registry.restart(name);\n    const updated = deps.registry.describe().find((s) => s.name === name);\n    return `${green('\u2713 Restarted')} \"${name}\"${updated ? ` (${updated.toolCount} tools registered).` : '.'}`;\n  } catch (err) {\n    return `${red('\u2717 Restart failed')} for \"${name}\": ${toErrorMessage(err)}`;\n  }\n}\n\n/**\n * Ephemerally activate a server's tools without writing to config or\n * restarting the connection. The server must already be connected (lazy mode).\n * Calls `registry.activateServer()` when available; falls back to a message\n * if the registry doesn't support ephemeral activation.\n */\nasync function runActivate(\n  name: string | undefined,\n  deps: { registry: MCPRegistryHandle },\n): Promise<string> {\n  if (!name) return '`server` is required for activate.';\n  if (!deps.registry.activateServer) {\n    return `Registry does not support ephemeral activation. Use \\`enable\\` to start \"${name}\" instead.`;\n  }\n  const live = deps.registry.describe().find((s) => s.name === name);\n  if (!live) {\n    return `Server \"${name}\" is not registered. Use \\`mcp_control({ action: \"enable\", server: \"${name}\" })\\` first.`;\n  }\n  if (live.state !== 'connected') {\n    return `Server \"${name}\" is not connected (state: ${live.state}). Use \\`enable\\` to start it first.`;\n  }\n  if (deps.registry.isActivated?.(name)) {\n    return `${green('\u25CF')} Server \"${name}\" tools are already active. Use \\`deactivate\\` to hide them.`;\n  }\n  deps.registry.activateServer(name);\n  const updated = deps.registry.describe().find((s) => s.name === name);\n  return `${green('\u2713 Activated')} \"${name}\" \u2014 ${updated?.toolCount ?? 0} tool(s) now registered. Use \\`mcp_control({ action: \"deactivate\", server: \"${name}\" })\\` to hide them when done.`;\n}\n\n/**\n * Ephemerally deactivate a server's tools without disconnecting.\n * Calls `registry.deactivateServer()` when available.\n */\nasync function runDeactivate(\n  name: string | undefined,\n  deps: { registry: MCPRegistryHandle },\n): Promise<string> {\n  if (!name) return '`server` is required for deactivate.';\n  if (!deps.registry.deactivateServer) {\n    return `Registry does not support ephemeral deactivation. Use \\`disable\\` to stop \"${name}\" instead.`;\n  }\n  if (!deps.registry.isActivated?.(name)) {\n    return `Server \"${name}\" tools are not currently active.`;\n  }\n  const count = deps.registry.deactivateServer(name);\n  return `${yellow('\u25CB Deactivated')} \"${name}\" \u2014 ${count} tool(s) unregistered. Server stays connected.`;\n}\n\n// \u2500\u2500 Config helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nasync function getConfiguredMcpServers(deps: { getConfig: () => Config; configPath: string }): Promise<Record<string, MCPServerConfig>> {\n  const diskConfig = await readJsonObjectFile(deps.configPath);\n  if (isMcpServerRecord(diskConfig.mcpServers)) return diskConfig.mcpServers;\n  return deps.getConfig().mcpServers ?? {};\n}\n\nfunction isMcpServerRecord(value: unknown): value is Record<string, MCPServerConfig> {\n  return !!value && typeof value === 'object' && !Array.isArray(value);\n}\n\n// \u2500\u2500 Colour helpers (no dep on core color \u2014 inline) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction bold(s: string)  { return `\\x1b[1m${s}\\x1b[0m`; }\nfunction dim(s: string)  { return `\\x1b[2m${s}\\x1b[0m`; }\nfunction green(s: string) { return `\\x1b[32m${s}\\x1b[0m`; }\nfunction yellow(s: string){ return `\\x1b[33m${s}\\x1b[0m`; }\nfunction red(s: string)   { return `\\x1b[31m${s}\\x1b[0m`; }\n\nfunction badge(state: string): string {\n  switch (state) {\n    case 'connected':    return green('\u25CF connected');\n    case 'connecting':   return `\\x1b[36m\u25D0 connecting\\x1b[0m`;\n    case 'reconnecting': return `\\x1b[36m\u25D1 reconnecting\\x1b[0m`;\n    case 'disconnected': return dim('\u25CB disconnected');\n    case 'failed':       return red('\u2717 failed');\n    default:            return dim(state);\n  }\n}\n"],
+  "mappings": ";AAIO,SAAS,cAAiB,OAA6B,OAAmB;AAC/E,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,UAAM,MAAM,IAAI,MAAM,QAAQ,YAAY,KAAK,mBAAmB,8BAA8B;AAChG,QAAI,OAAO;AACX,UAAM;AAAA,EACR;AACA,SAAO;AACT;;;ACPO,SAAS,eAAe,KAAsB;AACnD,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;;;ACKO,IAAM,mBAAmB;AAAA;AAAA,EAE9B,iBAAiB;AAAA;AAAA,EAGjB,kBAAkB;AAAA;AAAA,EAGlB,YAAY;AAAA;AAAA,EAGZ,SAAS;AAAA;AAAA,EAGT,UAAU;AAAA;AAAA,EAGV,0BAA0B;AAAA;AAAA,EAG1B,cAAc;AAAA;AAAA,EAGd,cAAc;AAAA;AAAA,EAGd,cAAc;AAAA;AAAA,EAGd,WAAW;AAAA;AAAA,EAGX,iBAAiB;AAAA;AAAA,EAGjB,aAAa;AAAA;AAAA,EAGb,cAAc;AAAA;AAAA,EAGd,eAAe;AAAA;AAAA,EAGf,WAAW;AAAA;AAAA,EAGX,gBAAgB;AAAA;AAAA,EAGhB,yBAAyB;AAAA;AAAA,EAGzB,yBAAyB;AAAA;AAAA,EAGzB,4BAA4B;AAAA;AAAA,EAG5B,mBAAmB;AAAA;AAAA,EAGnB,mBAAmB;AAAA;AAAA,EAGnB,eAAe;AAAA;AAAA,EAGf,iBAAiB;AACnB;AASO,IAAM,0BAAqD;AAAA,EAChE,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AACnB;AAoBO,IAAM,6BAAwD;AAAA,EACnE,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA;AAAA;AAAA,EAGjB,iBAAiB;AAAA,EACjB,iBAAiB;AACnB;;;ACxHO,IAAM,mBAAmB,OAAwB;AAAA,EACtD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,WAAW;AAAA,EACX,SAAS;AAAA,EACT,MAAM,CAAC,MAAM,2CAA2C,GAAG;AAAA,EAC3D,YAAY;AACd;AAGO,IAAM,eAAe,OAAwB;AAAA,EAClD,MAAM;AAAA,EACN,aACE;AAAA,EACF,WAAW;AAAA,EACX,SAAS;AAAA,EACT,MAAM,CAAC,MAAM,qCAAqC;AAAA,EAClD,gBAAgB,CAAC,gCAAgC,cAAc;AAAA,EAC/D,YAAY;AACd;AAMO,IAAM,iBAAiB,OAAwB;AAAA,EACpD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,WAAW;AAAA,EACX,KAAK;AAAA,EACL,YAAY;AACd;AAOO,IAAM,oBAAoB,OAAwB;AAAA,EACvD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,WAAW;AAAA,EACX,SAAS;AAAA,EACT,MAAM,CAAC,MAAM,2CAA2C;AAAA,EACxD,gBAAgB,CAAC,sBAAsB;AAAA,EACvC,YAAY;AACd;AAMO,IAAM,cAAc,OAAwB;AAAA,EACjD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,WAAW;AAAA,EACX,SAAS;AAAA,EACT,MAAM,CAAC,MAAM,oCAAoC;AAAA,EACjD,YAAY;AACd;AAMO,IAAM,gBAAgB,OAAwB;AAAA,EACnD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,WAAW;AAAA,EACX,SAAS;AAAA,EACT,MAAM,CAAC,MAAM,sCAAsC;AAAA,EACnD,gBAAgB,CAAC,iBAAiB;AAAA,EAClC,YAAY;AACd;AAMO,IAAM,cAAc,OAAwB;AAAA,EACjD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,WAAW;AAAA,EACX,SAAS;AAAA,EACT,MAAM,CAAC,MAAM,oCAAoC;AAAA,EACjD,gBAAgB,CAAC,mBAAmB,eAAe;AAAA,EACnD,YAAY;AACd;AAMO,IAAM,YAAY,OAAwB;AAAA,EAC/C,MAAM;AAAA,EACN,aAAa;AAAA,EACb,WAAW;AAAA,EACX,SAAS;AAAA,EACT,MAAM,CAAC,MAAM,kCAAkC;AAAA,EAC/C,gBAAgB,CAAC,qBAAqB,yBAAyB,cAAc,mBAAmB;AAAA,EAChG,YAAY;AACd;AAMO,IAAM,mBAAmB,OAAwB;AAAA,EACtD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,WAAW;AAAA,EACX,SAAS;AAAA,EACT,MAAM,CAAC,MAAM,0CAA0C;AAAA,EACvD,gBAAgB,CAAC,qBAAqB;AAAA,EACtC,YAAY;AACd;AAGO,IAAM,iBAAiB,OAAwB;AAAA,EACpD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,WAAW;AAAA,EACX,KAAK;AAAA,EACL,YAAY;AAAA;AACd;AAMO,IAAM,kBAAkB,OAAwB;AAAA,EACrD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,WAAW;AAAA,EACX,SAAS;AAAA,EACT,MAAM,CAAC,MAAM,yBAAyB;AAAA,EACtC,KAAK,EAAE,WAAW,MAAM;AAAA,EACxB,gBAAgB,CAAC,cAAc;AAAA,EAC/B,cAAc;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,YAAY;AACd;AAQO,IAAM,mBAAmB,OAAwB;AAAA,EACtD,MAAM;AAAA,EACN,aACE;AAAA,EACF,WAAW;AAAA,EACX,SAAS;AAAA,EACT,MAAM,CAAC,MAAM,yCAAyC;AAAA,EACtD,YAAY;AACd;AAOO,IAAM,sBAAsB,OAAwB;AAAA,EACzD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,WAAW;AAAA,EACX,SAAS;AAAA,EACT,MAAM,CAAC,2BAA2B,IAAI;AAAA,EACtC,KAAK;AAAA,IACH,uBAAuB;AAAA,IACvB,kBAAkB;AAAA,IAClB,2BAA2B;AAAA,EAC7B;AAAA,EACA,gBAAgB,CAAC,iBAAiB;AAAA,EAClC,cAAc,CAAC,kBAAkB;AAAA,EACjC,YAAY;AACd;AAOO,IAAM,mBAAmB,OAAwB;AAAA,EACtD,MAAM;AAAA,EACN,aACE;AAAA,EACF,WAAW;AAAA,EACX,SAAS;AAAA,EACT,MAAM,CAAC,MAAM,iBAAiB;AAAA,EAC9B,KAAK;AAAA,IACH,sBAAsB;AAAA,IACtB,yBAAyB;AAAA,EAC3B;AAAA,EACA,YAAY;AAAA,EACZ,kBAAkB;AACpB;AAGO,IAAM,aAAa,OAAwC;AAAA,EAChE,YAAY,EAAE,GAAG,iBAAiB,GAAG,SAAS,MAAM;AAAA,EACpD,QAAQ,EAAE,GAAG,aAAa,GAAG,SAAS,MAAM;AAAA,EAC5C,UAAU,EAAE,GAAG,eAAe,GAAG,SAAS,MAAM;AAAA,EAChD,gBAAgB,EAAE,GAAG,kBAAkB,GAAG,SAAS,MAAM;AAAA,EACzD,OAAO,EAAE,GAAG,YAAY,GAAG,SAAS,MAAM;AAAA,EAC1C,SAAS,EAAE,GAAG,cAAc,GAAG,SAAS,MAAM;AAAA,EAC9C,OAAO,EAAE,GAAG,YAAY,GAAG,SAAS,MAAM;AAAA,EAC1C,KAAK,EAAE,GAAG,UAAU,GAAG,SAAS,MAAM;AAAA,EACtC,eAAe,EAAE,GAAG,iBAAiB,GAAG,SAAS,MAAM;AAAA,EACvD,UAAU,EAAE,GAAG,eAAe,GAAG,SAAS,MAAM;AAAA,EAChD,cAAc,EAAE,GAAG,gBAAgB,GAAG,SAAS,MAAM;AAAA,EACrD,kBAAkB,EAAE,GAAG,oBAAoB,GAAG,SAAS,MAAM;AAAA,EAC7D,YAAY,EAAE,GAAG,iBAAiB,GAAG,SAAS,MAAM;AAAA,EACpD,KAAK,EAAE,GAAG,iBAAiB,GAAG,SAAS,MAAM;AAC/C;;;AC/OA,YAAYA,SAAQ;;;ACApB,SAAS,mBAAmB;AAC5B,YAAY,QAAQ;AACpB,YAAY,UAAU;AAatB,eAAsB,YACpB,YACA,SACA,OAA2B,CAAC,GACb;AACf,QAAM,MAAW,aAAQ,UAAU;AACnC,QAAS,SAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACvC,QAAM,MAAW,UAAK,KAAK,IAAS,cAAS,UAAU,CAAC,IAAI,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC,MAAM;AAIhG,MAAI;AACF,QAAI,OAAO,YAAY,UAAU;AAC/B,YAAS,aAAU,KAAK,SAAS,EAAE,MAAM,MAAM,UAAU,KAAK,YAAY,OAAO,CAAC;AAAA,IACpF,OAAO;AACL,YAAS,aAAU,KAAK,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,IACjD;AACA,QAAI;AACF,YAAM,KAAK,MAAS,QAAK,KAAK,IAAI;AAClC,UAAI;AACF,cAAM,GAAG,KAAK;AAAA,MAChB,UAAE;AACA,cAAM,GAAG,MAAM;AAAA,MACjB;AAAA,IACF,QAAQ;AAAA,IAER;AAGA,QAAI;AACJ,QAAI;AACF,YAAMC,QAAO,MAAS,QAAK,UAAU;AACrC,aAAOA,MAAK,OAAO;AAAA,IACrB,QAAQ;AACN,aAAO,KAAK;AAAA,IACd;AACA,QAAI,SAAS,QAAW;AACtB,YAAS,SAAM,KAAK,IAAI;AAAA,IAC1B;AACA,UAAM,gBAAgB,KAAK,UAAU;AASrC,QAAI,SAAS,UAAa,QAAQ,aAAa,SAAS;AACtD,UAAI;AACF,cAAS,SAAM,YAAY,IAAI;AAAA,MACjC,QAAQ;AAAA,MAGR;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI;AACF,YAAS,UAAO,GAAG;AAAA,IACrB,QAAQ;AAAA,IAER;AACA,UAAM;AAAA,EACR;AACF;AA0EA,IAAM,yBAAyB,oBAAI,IAAI,CAAC,SAAS,SAAS,UAAU,WAAW,CAAC;AAEhF,eAAe,gBAAgB,MAAc,IAA2B;AACtE,MAAI,QAAQ,aAAa,SAAS;AAChC,UAAS,UAAO,MAAM,EAAE;AACxB;AAAA,EACF;AACA,QAAM,SAAS,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;AACpC,MAAI;AACJ,WAAS,IAAI,GAAG,KAAK,OAAO,QAAQ,KAAK;AACvC,QAAI;AACF,YAAS,UAAO,MAAM,EAAE;AACxB;AAAA,IACF,SAAS,KAAK;AACZ,gBAAU;AACV,YAAM,OAAQ,KAA+B;AAC7C,UAAI,CAAC,QAAQ,CAAC,uBAAuB,IAAI,IAAI,KAAK,MAAM,OAAO,QAAQ;AACrE,cAAM;AAAA,MACR;AACA,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,OAAO,CAAC,CAAC,CAAC;AAAA,IAC/D;AAAA,EACF;AACA,QAAM;AACR;;;ADzKA,eAAsB,mBAAmB,UAAuC;AAC9E,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,MAAS,aAAS,UAAU,MAAM,CAAC;AAC7D,WAAO,aAAa,MAAM,IAAI,SAAS,CAAC;AAAA,EAC1C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAWA,eAAsB,oBAAoB,UAAkB,OAAkC;AAC5F,QAAM,YAAY,UAAU,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AAC7E;AAEA,eAAsB,qBACpB,UACA,SACqB;AACrB,QAAM,SAAS,MAAM,mBAAmB,QAAQ;AAChD,QAAM,YAAY,MAAM,QAAQ,MAAM;AACtC,QAAM,OAAO,aAAa,aAAa,SAAS,IAAI,YAAY;AAChE,QAAM,oBAAoB,UAAU,IAAI;AACxC,SAAO;AACT;AAgBO,SAAS,YAAY,MAAkBC,OAAgB,OAA4B;AACxF,MAAIA,MAAK,WAAW,GAAG;AACrB,QAAI,CAAC,aAAa,KAAK,EAAG,OAAM,IAAI,MAAM,qCAAqC;AAC/E,WAAO;AAAA,EACT;AACA,QAAM,SAAS,iBAAiB,MAAMA,KAAI;AAC1C,QAAM,OAAO,gBAAgBA,KAAI;AACjC,MAAI,OAAO,SAAS,UAAU;AAC5B,QAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,MAAM,8BAA8B,IAAI,sBAAsB;AACpG,WAAO,IAAI,IAAI;AAAA,EACjB,OAAO;AACL,QAAI,CAAC,aAAa,MAAM,EAAG,OAAM,IAAI,MAAM,uBAAuB,IAAI,uBAAuB;AAC7F,WAAO,IAAI,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AA0BO,SAAS,aAAa,OAAqC;AAChE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,gBAAgBC,OAAiC;AACxD,QAAM,UAAUA,MAAKA,MAAK,SAAS,CAAC;AAEpC,MAAI,YAAY,OAAW,OAAM,IAAI,MAAM,yBAAyB;AACpE,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAkBA,OAAwC;AAClF,MAAI,UAAkC;AACtC,WAAS,IAAI,GAAG,IAAIA,MAAK,SAAS,GAAG,KAAK,GAAG;AAC3C,UAAM,UAAUA,MAAK,CAAC;AACtB,UAAM,cAAcA,MAAK,IAAI,CAAC;AAE9B,QAAI,YAAY,OAAW,OAAM,IAAI,MAAM,iCAAiC;AAC5E,UAAM,gBAAgB,OAAO,gBAAgB,WAAW,CAAC,IAAI,CAAC;AAE9D,QAAI,OAAO,YAAY,UAAU;AAC/B,UAAI,CAAC,MAAM,QAAQ,OAAO,EAAG,OAAM,IAAI,MAAM,mCAAmC,OAAO,sBAAsB;AAC7G,UAAI,CAAC,aAAa,QAAQ,OAAO,CAAC,KAAK,CAAC,MAAM,QAAQ,QAAQ,OAAO,CAAC,EAAG,SAAQ,OAAO,IAAI;AAC5F,gBAAU,QAAQ,OAAO;AAAA,IAC3B,OAAO;AACL,UAAI,CAAC,aAAa,OAAO,EAAG,OAAM,IAAI,MAAM,4BAA4B,OAAO,uBAAuB;AACtG,UAAI,CAAC,aAAa,QAAQ,OAAO,CAAC,KAAK,CAAC,MAAM,QAAQ,QAAQ,OAAO,CAAC,EAAG,SAAQ,OAAO,IAAI;AAC5F,gBAAU,QAAQ,OAAO;AAAA,IAC3B;AAAA,EACF;AACA,SAAO;AACT;;;AE5DO,SAAS,qBAAqB,MAAyC;AAC5E,QAAM,EAAE,WAAW,YAAY,SAAS,IAAI;AAE5C,QAAM,cAA0B;AAAA,IAC9B,MAAM;AAAA,IACN,YAAY;AAAA,MACV,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM,CAAC,QAAQ,UAAU,UAAU,WAAW,WAAW,YAAY,YAAY;AAAA,QACjF,aAAa;AAAA,MACf;AAAA;AAAA,MAEA,OAAO;AAAA,QACL,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA;AAAA,MAEA,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,UAAU,CAAC,QAAQ;AAAA,EACrB;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOV,UAAU;AAAA,IACV,cAAc,CAAC,iBAAiB,aAAa;AAAA,IAC7C;AAAA,IACA,MAAM,QAAQ,KAAK;AACjB,YAAM,QAAQ;AACd,aAAO,mBAAmB,OAAO,EAAE,WAAW,YAAY,SAAS,CAAC;AAAA,IACtE;AAAA,EACF;AACF;AAIA,eAAe,mBACb,OACA,MACiB;AACjB,QAAM,EAAE,QAAQ,OAAO,OAAO,IAAI;AAElC,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAS,aAAO,WAAW,IAAI;AAAA,IACpC,KAAK;AAAU,aAAO,aAAa,SAAS,IAAI,IAAI;AAAA,IACpD,KAAK;AAAU,aAAO,SAAS,UAAU,QAAQ,IAAI,IAAI;AAAA,IACzD,KAAK;AAAW,aAAO,SAAS,WAAW,QAAQ,IAAI,IAAI;AAAA,IAC3D,KAAK;AAAW,aAAO,SAAS,WAAW,QAAQ,IAAI,IAAI;AAAA,IAC3D,KAAK;AAAY,aAAO,SAAS,YAAY,QAAQ,IAAI,IAAI;AAAA,IAC7D,KAAK;AAAc,aAAO,SAAS,cAAc,QAAQ,IAAI,IAAI;AAAA,IACjE;AACE,aAAO,mBAAmB,MAAM;AAAA,EACpC;AACF;AAIA,eAAe,WAAW,MAAqG;AAC7H,QAAM,aAAa,MAAM,wBAAwB,IAAI;AACrD,QAAM,OAAO,KAAK,SAAS,SAAS;AAEpC,MAAI,OAAO,KAAK,UAAU,EAAE,WAAW,GAAG;AACxC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AAEA,QAAM,QAAkB,CAAC;AACzB,QAAM,UAAU,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpD,aAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,UAAU,GAAG;AACpD,UAAM,WAAW,QAAQ,IAAI,IAAI;AACjC,UAAM,YAAY,WAAW,KAAK,SAAS,SAAS,YAAY;AAChE,UAAM,WAAW,WAAW,MAAM,SAAS,KAAK,IAAI,IAAI,mBAAc;AACtE,UAAM,UAAU,IAAI,YAAY,QAC5B,GAAG,IAAI,UAAU,CAAC,OAClB,GAAG,MAAM,gBAAW,CAAC;AACzB,UAAM,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,OAAO,GAAG,QAAQ,GAAG,SAAS,EAAE;AAC/D,QAAI,IAAI,YAAa,OAAM,KAAK,OAAO,IAAI,IAAI,WAAW,CAAC,EAAE;AAAA,EAC/D;AAEA,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,IAAI,gFAAgF,CAAC;AAChG,QAAM,KAAK,IAAI,gFAAgF,CAAC;AAChG,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAe,aACb,OACA,MACiB;AACjB,QAAM,aAAa,MAAM,wBAAwB,IAAI;AACrD,QAAM,MAAM,WAAW;AACvB,QAAM,IAAI,MAAM,YAAY;AAE5B,QAAM,kBAAkB,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC;AAGvD,QAAM,oBAAoB,OAAO,QAAQ,UAAU,EAAE;AAAA,IACnD,CAAC,CAAC,MAAM,GAAG,MACT,KAAK,YAAY,EAAE,SAAS,CAAC,MAC5B,IAAI,eAAe,IAAI,YAAY,EAAE,SAAS,CAAC;AAAA,EACpD;AAEA,QAAM,sBAAsB,OAAO,QAAQ,GAAG,EAC3C,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,EAC7C;AAAA,IACC,CAAC,CAAC,MAAM,GAAG,MACT,KAAK,YAAY,EAAE,SAAS,CAAC,MAC5B,IAAI,eAAe,IAAI,YAAY,EAAE,SAAS,CAAC;AAAA,EACpD;AAEF,QAAM,QAAkB,CAAC;AAEzB,MAAI,kBAAkB,SAAS,GAAG;AAChC,UAAM,KAAK,KAAK,+BAA+B,IAAI,QAAQ,IAAI;AAC/D,eAAW,CAAC,MAAM,GAAG,KAAK,mBAAmB;AAC3C,YAAM,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,eAAe,IAAI,SAAS,EAAE;AAAA,IACnE;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AAEA,MAAI,oBAAoB,SAAS,GAAG;AAClC,UAAM,KAAK,KAAK,8BAA8B,IAAI,QAAQ,IAAI;AAC9D,eAAW,CAAC,MAAM,GAAG,KAAK,qBAAqB;AAC7C,YAAM,OAAO,IAAI,eAAe,SAAS,IAAI,0BAAqB,IAAI;AACtE,YAAM,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,eAAe,IAAI,SAAS,GAAG,IAAI,EAAE;AAAA,IAC1E;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AAEA,MAAI,kBAAkB,WAAW,KAAK,oBAAoB,WAAW,GAAG;AACtE,WAAO,qBAAqB,KAAK;AAAA,EACnC;AAEA,QAAM,QAAQ,kBAAkB,SAAS,oBAAoB;AAC7D,QAAM,KAAK,IAAI,KAAK,KAAK,UAAU,UAAU,IAAI,MAAM,EAAE,+CAA+C,CAAC;AACzG,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAe,UACb,MACA,MACiB;AACjB,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,MAAM,WAAW;AACvB,QAAM,aAAa,KAAK,UAAU,EAAE,cAAc,CAAC;AAGnD,QAAM,MAAM,WAAW,IAAI,KAAK,IAAI,IAAI;AACxC,MAAI,CAAC,KAAK;AACR,UAAM,QAAQ,OAAO,KAAK,GAAG,EAAE,KAAK,IAAI;AACxC,WAAO,mBAAmB,IAAI,yBAAyB,KAAK;AAAA,EAC9D;AAGA,QAAM,qBAAqB,KAAK,YAAY,CAAC,SAAS;AACpD,UAAM,UAAU,kBAAkB,KAAK,UAAU,IAAI,KAAK,aAAa,CAAC;AACxE,gBAAY,MAAM,CAAC,cAAc,IAAI,GAAG,EAAE,GAAG,QAAQ,IAAI,GAAG,GAAG,KAAK,SAAS,KAAK,CAAC;AAAA,EACrF,CAAC;AAGD,MAAI;AACF,UAAM,OAAO,KAAK,SAAS,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AACjE,QAAI,QAAQ,KAAK,UAAU,aAAa;AACtC,aAAO,GAAG,MAAM,QAAG,CAAC,YAAY,IAAI,yBAAyB,KAAK,SAAS;AAAA,IAC7E;AACA,UAAM,KAAK,SAAS,MAAM,EAAE,GAAG,KAAK,SAAS,KAAK,CAAC;AACnD,UAAM,UAAU,KAAK,SAAS,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AACpE,WAAO,GAAG,MAAM,4BAAuB,CAAC,KAAK,IAAI,IAAI,UAAU,KAAK,QAAQ,SAAS,wBAAwB,GAAG;AAAA,EAClH,SAAS,KAAK;AACZ,WAAO,GAAG,IAAI,wBAAmB,CAAC,KAAK,IAAI,MAAM,eAAe,GAAG,CAAC;AAAA,EACtE;AACF;AAEA,eAAe,WACb,MACA,MACiB;AACjB,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,aAAa,KAAK,UAAU,EAAE,cAAc,CAAC;AACnD,MAAI,CAAC,WAAW,IAAI,GAAG;AACrB,WAAO,WAAW,IAAI,8EAA8E,IAAI;AAAA,EAC1G;AAGA,QAAM,qBAAqB,KAAK,YAAY,CAAC,SAAS;AACpD,UAAM,UAAU,kBAAkB,KAAK,UAAU,IAAI,KAAK,aAAa,CAAC;AACxE,UAAM,WAAW,cAAc,QAAQ,IAAI,CAAC;AAC5C,gBAAY,MAAM,CAAC,cAAc,IAAI,GAAG,EAAE,GAAG,UAAU,SAAS,MAAM,CAAC;AAAA,EACzE,CAAC;AAGD,MAAI;AACF,UAAM,KAAK,SAAS,KAAK,IAAI;AAC7B,WAAO,GAAG,OAAO,iBAAY,CAAC,KAAK,IAAI;AAAA,EACzC,QAAQ;AACN,WAAO,GAAG,OAAO,iBAAY,CAAC,KAAK,IAAI;AAAA,EACzC;AACF;AAEA,eAAe,WACb,MACA,MACiB;AACjB,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,aAAa,KAAK,UAAU,EAAE,cAAc,CAAC;AACnD,MAAI,CAAC,WAAW,IAAI,GAAG;AACrB,WAAO,WAAW,IAAI,uEAAuE,IAAI;AAAA,EACnG;AAEA,MAAI;AACF,UAAM,KAAK,SAAS,QAAQ,IAAI;AAChC,UAAM,UAAU,KAAK,SAAS,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AACpE,WAAO,GAAG,MAAM,kBAAa,CAAC,KAAK,IAAI,IAAI,UAAU,KAAK,QAAQ,SAAS,wBAAwB,GAAG;AAAA,EACxG,SAAS,KAAK;AACZ,WAAO,GAAG,IAAI,uBAAkB,CAAC,SAAS,IAAI,MAAM,eAAe,GAAG,CAAC;AAAA,EACzE;AACF;AAQA,eAAe,YACb,MACA,MACiB;AACjB,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,CAAC,KAAK,SAAS,gBAAgB;AACjC,WAAO,4EAA4E,IAAI;AAAA,EACzF;AACA,QAAM,OAAO,KAAK,SAAS,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AACjE,MAAI,CAAC,MAAM;AACT,WAAO,WAAW,IAAI,uEAAuE,IAAI;AAAA,EACnG;AACA,MAAI,KAAK,UAAU,aAAa;AAC9B,WAAO,WAAW,IAAI,8BAA8B,KAAK,KAAK;AAAA,EAChE;AACA,MAAI,KAAK,SAAS,cAAc,IAAI,GAAG;AACrC,WAAO,GAAG,MAAM,QAAG,CAAC,YAAY,IAAI;AAAA,EACtC;AACA,OAAK,SAAS,eAAe,IAAI;AACjC,QAAM,UAAU,KAAK,SAAS,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AACpE,SAAO,GAAG,MAAM,kBAAa,CAAC,KAAK,IAAI,YAAO,SAAS,aAAa,CAAC,+EAA+E,IAAI;AAC1J;AAMA,eAAe,cACb,MACA,MACiB;AACjB,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,CAAC,KAAK,SAAS,kBAAkB;AACnC,WAAO,8EAA8E,IAAI;AAAA,EAC3F;AACA,MAAI,CAAC,KAAK,SAAS,cAAc,IAAI,GAAG;AACtC,WAAO,WAAW,IAAI;AAAA,EACxB;AACA,QAAM,QAAQ,KAAK,SAAS,iBAAiB,IAAI;AACjD,SAAO,GAAG,OAAO,oBAAe,CAAC,KAAK,IAAI,YAAO,KAAK;AACxD;AAIA,eAAe,wBAAwB,MAAiG;AACtI,QAAM,aAAa,MAAM,mBAAmB,KAAK,UAAU;AAC3D,MAAI,kBAAkB,WAAW,UAAU,EAAG,QAAO,WAAW;AAChE,SAAO,KAAK,UAAU,EAAE,cAAc,CAAC;AACzC;AAEA,SAAS,kBAAkB,OAA0D;AACnF,SAAO,CAAC,CAAC,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AACrE;AAIA,SAAS,KAAK,GAAY;AAAE,SAAO,UAAU,CAAC;AAAW;AACzD,SAAS,IAAI,GAAY;AAAE,SAAO,UAAU,CAAC;AAAW;AACxD,SAAS,MAAM,GAAW;AAAE,SAAO,WAAW,CAAC;AAAW;AAC1D,SAAS,OAAO,GAAU;AAAE,SAAO,WAAW,CAAC;AAAW;AAC1D,SAAS,IAAI,GAAa;AAAE,SAAO,WAAW,CAAC;AAAW;AAE1D,SAAS,MAAM,OAAuB;AACpC,UAAQ,OAAO;AAAA,IACb,KAAK;AAAgB,aAAO,MAAM,kBAAa;AAAA,IAC/C,KAAK;AAAgB,aAAO;AAAA,IAC5B,KAAK;AAAgB,aAAO;AAAA,IAC5B,KAAK;AAAgB,aAAO,IAAI,qBAAgB;AAAA,IAChD,KAAK;AAAgB,aAAO,IAAI,eAAU;AAAA,IAC1C;AAAoB,aAAO,IAAI,KAAK;AAAA,EACtC;AACF;",
+  "names": ["fs", "stat", "path", "path"]
+}

package/dist/tools/mcp-control.d.ts

@@ -0,0 +1,53 @@
+import type { Config, MCPServerConfig, Tool } from '../index.js';
+export interface MCPRegistryHandle {
+    start(cfg: MCPServerConfig): Promise<void>;
+    stop(name: string): Promise<void>;
+    restart(name: string): Promise<void>;
+    describe(): {
+        name: string;
+        state: string;
+        toolCount: number;
+        enabled: boolean;
+        tools?: string[];
+    }[];
+    list(): {
+        name: string;
+        state: string;
+        toolCount: number;
+        tools?: string[];
+    }[];
+    /**
+     * Register all cached tools for a server without restarting it.
+     * No-op if the server is not connected or tools are already active.
+     * Used in token-saving mode to temporarily expose MCP tools.
+     */
+    activateServer?(name: string): void;
+    /**
+     * Unregister all tools for a server without disconnecting it.
+     * Returns the number of tools that were deactivated.
+     * Used in token-saving mode to hide MCP tools after use.
+     */
+    deactivateServer?(name: string): number;
+    /**
+     * Check whether a server's tools are currently registered.
+     */
+    isActivated?(name: string): boolean;
+}
+export interface CreateMcpControlToolOptions {
+    /**
+     * Read the current config object. The tool never mutates this directly —
+     * writes go to the global config file via `configPath`.
+     */
+    getConfig: () => Config;
+    /**
+     * Path to ~/.wrongstack/config.json (or equivalent) for atomic config writes.
+     */
+    configPath: string;
+    /**
+     * Live MCP registry for runtime start/stop/restart. The tool calls these
+     * immediately so the LLM sees the result of its action in the same turn.
+     */
+    registry: MCPRegistryHandle;
+}
+export declare function createMcpControlTool(opts: CreateMcpControlToolOptions): Tool;
+//# sourceMappingURL=mcp-control.d.ts.map

package/dist/tools/mcp-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-control.d.ts","sourceRoot":"","sources":["../../src/tools/mcp-control.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAc,eAAe,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAC7E,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,QAAQ,IAAI;QACV,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,EAAE,CAAC;IACJ,IAAI,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC/E;;;;OAIG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC;;OAEG;IACH,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CA8C5E"}

package/dist/tools/mcp-use.d.ts

@@ -0,0 +1,24 @@
+import type { ToolRegistry } from '../index.js';
+import type { MCPRegistryHandle } from './mcp-control.js';
+import type { Tool } from '../types/tool.js';
+/**
+ * `mcp_use` — meta-tool for ephemeral MCP tool calls in token-saving mode.
+ *
+ * Instead of the 4-step manual cycle (list → activate → use → deactivate),
+ * the model calls this single tool. It:
+ *  1. Activates the server's tools in the registry
+ *  2. Calls the requested tool with the provided input
+ *  3. Returns the result
+ *  4. Deactivates the server's tools
+ *
+ * The tool is registered only when features.lazyMcp is active so the model
+ * always has a way to reach MCP tools without them being in the prompt.
+ */
+export interface CreateMcpUseToolOptions {
+    /** Live MCP registry handle (activate/deactivate/describe). */
+    registry: MCPRegistryHandle;
+    /** Tool registry — needed to resolve and call MCP tools by name. */
+    toolRegistry: ToolRegistry;
+}
+export declare function createMcpUseTool(opts: CreateMcpUseToolOptions): Tool;
+//# sourceMappingURL=mcp-use.d.ts.map

package/dist/tools/mcp-use.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-use.d.ts","sourceRoot":"","sources":["../../src/tools/mcp-use.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,YAAY,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,oEAAoE;IACpE,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAyFpE"}

package/dist/types/agent-bridge.d.ts

@@ -0,0 +1,42 @@
+export type BridgeMessageType = 'task' | 'result' | 'progress' | 'error' | 'heartbeat' | 'stop' | 'delegate' | 'budget_threshold';
+export interface BudgetThresholdPayload {
+    kind: 'iterations' | 'tool_calls' | 'tokens' | 'cost';
+    used: number;
+    limit: number;
+    /** Subagent's accumulated text so far — useful for partial result */
+    partialText: string;
+    /** Suggested action: extend limits or accept partial */
+    suggestion: 'extend' | 'stop';
+    /** Human-readable message */
+    message: string;
+}
+export interface BridgeMessage<T = unknown> {
+    id: string;
+    type: BridgeMessageType;
+    from: string;
+    to?: string | undefined;
+    payload: T;
+    timestamp: number;
+    priority?: 'low' | 'normal' | 'high' | 'critical' | undefined;
+}
+export interface AgentBridgeConfig {
+    agentId: string;
+    coordinatorId: string;
+    timeoutMs?: number | undefined;
+    bufferSize?: number | undefined;
+}
+export interface AgentBridge {
+    readonly agentId: string;
+    readonly coordinatorId: string;
+    send(msg: BridgeMessage): Promise<void>;
+    broadcast(msg: BridgeMessage): Promise<void>;
+    subscribe(handler: (msg: BridgeMessage) => void | Promise<void>): () => void;
+    request<T>(msg: BridgeMessage, timeoutMs?: number): Promise<BridgeMessage<T>> | undefined;
+    stop(): Promise<void>;
+}
+export interface BridgeTransport {
+    send(msg: BridgeMessage, to: string): Promise<void>;
+    subscribe(agentId: string, handler: (msg: BridgeMessage) => void | Promise<void>): () => void;
+    close(agentId: string): Promise<void>;
+}
+//# sourceMappingURL=agent-bridge.d.ts.map

package/dist/types/agent-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-bridge.d.ts","sourceRoot":"","sources":["../../src/types/agent-bridge.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,QAAQ,GACR,UAAU,GACV,OAAO,GACP,WAAW,GACX,MAAM,GACN,UAAU,GACV,kBAAkB,CAAC;AAEvB,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,CAAC;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,OAAO;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;CAC/D;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,IAAI,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC;IAC7E,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IAC1F,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC;IAC9F,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC"}