@wrongstack/tools 0.257.2 → 0.264.0

package/dist/exec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/_output-spool.ts","../src/_util.ts","../src/circuit-breaker.ts","../src/process-registry.ts","../src/_win32-resolve.ts","../src/exec.ts"],"names":["isWin","path2","path3","resolve","spawn"],"mappings":";;;;;;;;;;AA6BA,IAAM,kBAAA,GAAqB,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAE9C,IAAM,qBAAA,GAAwB,IAAI,IAAA,GAAO,IAAA;AAEzC,IAAI,YAAA,GAAe,KAAA;AAGZ,SAAS,aAAA,GAAwB;AACtC,EAAA,OAAY,IAAA,CAAA,IAAA,CAAK,gBAAA,EAAiB,EAAG,aAAa,CAAA;AACpD;AAOA,SAAS,mBAAmB,GAAA,EAAmB;AAC7C,EAAA,IAAI,YAAA,EAAc;AAClB,EAAA,YAAA,GAAe,IAAA;AACf,EAAA,KAAA,CAAM,YAAY;AAChB,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAU,GAAA,CAAA,OAAA,CAAQ,GAAG,CAAA,EAAG;AACzC,QAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,EAAG;AAC5B,QAAA,MAAM,CAAA,GAAS,IAAA,CAAA,IAAA,CAAK,GAAA,EAAK,IAAI,CAAA;AAC7B,QAAA,IAAI;AACF,UAAA,MAAM,EAAA,GAAK,MAAU,GAAA,CAAA,IAAA,CAAK,CAAC,CAAA;AAC3B,UAAA,IAAI,MAAM,EAAA,CAAG,OAAA,GAAU,kBAAA,EAAoB,MAAU,WAAO,CAAC,CAAA;AAAA,QAC/D,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF,CAAA,GAAG;AACL;AAoCO,SAAS,UAAU,IAAA,EAAyB;AACjD,EAAA,MAAM,UACJ,IAAA,CAAK,YAAA,GAAe,IAAI,CAAA,GAAA,EAAM,IAAA,CAAK,YAAY,CAAA,iCAAA,CAAA,GAAsC,EAAA;AACvF,EAAA,OAAO;AAAA,8BAAA,EAA8B,KAAK,KAAK,CAAA,UAAA,EAAa,IAAA,CAAK,IAAI,GAAG,OAAO,CAAA,yEAAA,CAAA;AACjF;AAEO,SAAS,kBAAkB,IAAA,EAA6C;AAC7E,EAAA,MAAM,SAAA,GAAY,KAAK,cAAkB;AACzC,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,mBAAA,EAAqB,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,IAAK,MAAA;AAE7E,EAAA,IAAI,IAAA,GAAO,EAAA;AACX,EAAA,IAAI,SAAA,GAAY,CAAA;AAChB,EAAA,IAAI,UAAA,GAAa,CAAA;AACjB,EAAA,IAAI,YAAA,GAAe,CAAA;AACnB,EAAA,IAAI,MAAA,GAA6B,IAAA;AACjC,EAAA,IAAI,QAAA,GAA0B,IAAA;AAC9B,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,IAAI,SAAA,GAAY,KAAA;AAEhB,EAAA,MAAM,OAAO,MAAY;AACvB,IAAA,IAAI,UAAU,MAAA,EAAQ;AACtB,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,aAAA,EAAc;AAI1B,MAAA,SAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAClC,MAAA,kBAAA,CAAmB,GAAG,CAAA;AACtB,MAAA,MAAM,KAAA,GAAA,qBAAY,IAAA,EAAK,EAAE,aAAY,CAAE,OAAA,CAAQ,SAAS,GAAG,CAAA;AAC3D,MAAA,MAAM,IAAA,GAAO,KAAK,MAAA,EAAO,CAAE,SAAS,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAClD,MAAA,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,KAAK,CAAA,EAAG,KAAK,IAAI,QAAQ,CAAA,CAAA,EAAI,IAAI,CAAA,IAAA,CAAM,CAAA;AAC5D,MAAA,MAAA,GAAS,kBAAkB,QAAA,EAAU,EAAE,OAAO,GAAA,EAAK,QAAA,EAAU,QAAQ,CAAA;AACrE,MAAA,MAAA,CAAO,EAAA,CAAG,SAAS,MAAM;AAEvB,QAAA,MAAA,GAAS,IAAA;AACT,QAAA,MAAA,GAAS,IAAA;AACT,QAAA,QAAA,GAAW,IAAA;AAAA,MACb,CAAC,CAAA;AAED,MAAA,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,IACnB,CAAA,CAAA,MAAQ;AACN,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AAAA,EACF,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,IAAA,EAAoB;AACxB,MAAA,IAAI,SAAA,IAAa,CAAC,IAAA,EAAM;AACxB,MAAA,UAAA,IAAc,MAAA,CAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA;AAC5C,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ;AACtB,QAAA,IAAI,SAAA,GAAY,IAAA,CAAK,MAAA,IAAU,SAAA,EAAW;AACxC,UAAA,IAAA,IAAQ,IAAA;AACR,UAAA,SAAA,IAAa,IAAA,CAAK,MAAA;AAClB,UAAA;AAAA,QACF;AACA,QAAA,IAAA,IAAQ,IAAA;AACR,QAAA,IAAA,EAAK;AACL,QAAA,IAAA,GAAO,EAAA;AACP,QAAA;AAAA,MACF;AACA,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,IAAI,MAAA,CAAO,iBAAiB,qBAAA,EAAuB;AACjD,UAAA,YAAA,IAAgB,MAAA,CAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA;AAC9C,UAAA;AAAA,QACF;AACA,QAAA,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,MACnB;AAAA,IACF,CAAA;AAAA,IACA,QAAA,GAA6B;AAC3B,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,OAAO,WAAW,EAAE,IAAA,EAAM,UAAU,KAAA,EAAO,UAAA,EAAY,cAAa,GAAI,IAAA;AAAA,MAC1E;AACA,MAAA,SAAA,GAAY,IAAA;AACZ,MAAA,IAAA,GAAO,EAAA;AACP,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,QAAA,EAAU,OAAO,IAAA;AACjC,MAAA,IAAI;AACF,QAAA,MAAA,CAAO,GAAA,EAAI;AAAA,MACb,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,YAAY,YAAA,EAAa;AAAA,IAC3D;AAAA,GACF;AACF;AChEO,IAAM,wBAAA,GAA2B,KAAA;AAGxC,IAAM,oBAAA,GAAuB,CAAA;AAQtB,SAAS,wBAAwB,IAAA,EAAsB;AAC5D,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AACrC,EAAA,IAAI,CAAC,EAAA,CAAG,QAAA,CAAS,IAAI,GAAG,OAAO,EAAA;AAC/B,EAAA,OAAO,EAAA,CACJ,MAAM,IAAI,CAAA,CACV,IAAI,CAAC,IAAA,KAAU,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,GAAI,KAAK,KAAA,CAAM,IAAA,CAAK,YAAY,IAAI,CAAA,GAAI,CAAC,CAAA,GAAI,IAAK,CAAA,CACnF,IAAA,CAAK,IAAI,CAAA;AACd;AAOO,SAAS,6BAAA,CAA8B,IAAA,EAAc,MAAA,GAAS,oBAAA,EAA8B;AACjG,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC7B,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,OAAO,CAAA,GAAI,MAAM,MAAA,EAAQ;AACvB,IAAA,IAAI,IAAI,CAAA,GAAI,CAAA;AACZ,IAAA,OAAO,CAAA,GAAI,MAAM,MAAA,IAAU,KAAA,CAAM,CAAC,CAAA,KAAM,KAAA,CAAM,CAAC,CAAA,EAAG,CAAA,EAAA;AAClD,IAAA,MAAM,MAAM,CAAA,GAAI,CAAA;AAChB,IAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,MAAA,GAAA,CAAI,KAAK,KAAA,CAAM,CAAC,CAAA,EAAI,CAAA,sBAAA,EAAe,GAAG,CAAA,UAAA,CAAI,CAAA;AAAA,IAC5C,CAAA,MAAO;AACL,MAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,CAAA,EAAG,KAAK,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAE,CAAA;AAAA,IAChD;AACA,IAAA,CAAA,GAAI,CAAA;AAAA,EACN;AACA,EAAA,OAAO,GAAA,CAAI,KAAK,IAAI,CAAA;AACtB;AAGA,SAAS,aAAA,CAAc,GAAW,QAAA,EAA0B;AAC1D,EAAA,IAAI,QAAA,IAAY,GAAG,OAAO,EAAA;AAC1B,EAAA,IAAI,OAAO,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,IAAK,UAAU,OAAO,CAAA;AACrD,EAAA,IAAI,EAAA,GAAK,CAAA;AACT,EAAA,IAAI,KAAK,CAAA,CAAE,MAAA;AACX,EAAA,OAAO,KAAK,EAAA,EAAI;AACd,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAA,CAAM,EAAA,GAAK,MAAM,CAAC,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,UAAA,CAAW,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,EAAG,MAAM,CAAA,IAAK,QAAA,EAAU,EAAA,GAAK,GAAA;AAAA,cACvD,GAAA,GAAM,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACtB;AAGA,SAAS,aAAA,CAAc,GAAW,QAAA,EAA0B;AAC1D,EAAA,IAAI,QAAA,IAAY,GAAG,OAAO,EAAA;AAC1B,EAAA,IAAI,OAAO,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,IAAK,UAAU,OAAO,CAAA;AACrD,EAAA,IAAI,EAAA,GAAK,CAAA;AACT,EAAA,IAAI,KAAK,CAAA,CAAE,MAAA;AACX,EAAA,OAAO,KAAK,EAAA,EAAI;AACd,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAA,CAAM,EAAA,GAAK,MAAM,CAAC,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,UAAA,CAAW,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,MAAA,GAAS,GAAG,CAAA,EAAG,MAAM,CAAA,IAAK,QAAA,EAAU,EAAA,GAAK,GAAA;AAAA,cAC/D,GAAA,GAAM,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,MAAA,GAAS,EAAE,CAAA;AAC9B;AAOO,SAAS,gBAAA,CAAiB,GAAW,QAAA,EAA0B;AACpE,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA;AACzC,EAAA,IAAI,KAAA,IAAS,UAAU,OAAO,CAAA;AAG9B,EAAA,MAAM,cAAA,GAAiB,EAAA;AACvB,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,WAAW,cAAc,CAAA;AACnD,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,IAAI,CAAA;AAC1C,EAAA,MAAM,IAAA,GAAO,aAAA,CAAc,CAAA,EAAG,UAAU,CAAA;AACxC,EAAA,MAAM,IAAA,GAAO,cAAc,CAAA,EAAG,KAAA,GAAQ,OAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAC,CAAA;AACrE,EAAA,MAAM,IAAA,GAAO,OAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA;AAC7E,EAAA,OAAO,GAAG,IAAI;AAAA,iBAAA,EAAiB,QAAQ,IAAI,CAAA;AAAA,EAAa,IAAI,CAAA,CAAA;AAC9D;AAOO,SAAS,sBAAA,CACd,GAAA,EACA,IAAA,GAA0C,EAAC,EACnC;AACR,EAAA,IAAI,CAAC,KAAK,OAAO,GAAA;AACjB,EAAA,IAAI,IAAA,GAAY,eAAU,GAAG,CAAA;AAC7B,EAAA,IAAA,GAAO,wBAAwB,IAAI,CAAA;AACnC,EAAA,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,WAAA,EAAa,EAAE,CAAA;AACnC,EAAA,IAAA,GAAO,8BAA8B,IAAI,CAAA;AACzC,EAAA,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,MAAM,CAAA;AACrC,EAAA,OAAO,gBAAA,CAAiB,IAAA,EAAM,IAAA,CAAK,QAAA,IAAY,wBAAwB,CAAA;AACzE;;;ACvKA,IAAM,gCAAA,GAAmC,CAAA;AACzC,IAAM,8BAAA,GAAiC,IAAA;AAIvC,IAAM,sBAAA,GAAyB,CAAA;AAC/B,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,4BAAA,GAA+B,EAAA;AACrC,IAAM,mBAAA,GAAsB,GAAA;AAarB,IAAM,iBAAN,MAAqB;AAAA,EACT,sBAAA;AAAA,EACA,mBAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,UAAA;AAAA,EAET,KAAA,GAAsB,QAAA;AAAA,EACtB,mBAAA,GAAsB,CAAA;AAAA,EACtB,SAAuB,EAAC;AAAA,EACxB,aAAA,GAA+B,IAAA;AAAA,EAC/B,UAAA,GAA4B,IAAA;AAAA;AAAA,EAE5B,QAAA,GAA0B,IAAA;AAAA,EAElC,WAAA,CAAY,MAAA,GAA+B,EAAC,EAAG;AAC7C,IAAA,IAAA,CAAK,sBAAA,GAAyB,OAAO,sBAAA,IAA0B,gCAAA;AAC/D,IAAA,IAAA,CAAK,mBAAA,GAAsB,OAAO,mBAAA,IAAuB,8BAAA;AACzD,IAAA,IAAA,CAAK,YAAA,GAAe,OAAO,YAAA,IAAgB,sBAAA;AAC3C,IAAA,IAAA,CAAK,QAAA,GAAW,OAAO,QAAA,IAAY,iBAAA;AACnC,IAAA,IAAA,CAAK,iBAAA,GAAoB,OAAO,iBAAA,IAAqB,4BAAA;AACrD,IAAA,IAAA,CAAK,UAAA,GAAa,OAAO,UAAA,IAAc,mBAAA;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,UAAA,GAAsB;AACxB,IAAA,IAAA,CAAK,qBAAA,EAAsB;AAC3B,IAAA,OAAO,KAAK,KAAA,KAAU,MAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAKA,QAAA,GAAmC;AACjC,IAAA,IAAA,CAAK,qBAAA,EAAsB;AAC3B,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,iBAAA,GAAmC,IAAA;AACvC,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,IAAA,IAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ;AACnD,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,QAAA;AAC3B,MAAA,iBAAA,GAAoB,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,aAAa,OAAO,CAAA;AAAA,IAC3D;AACA,IAAA,OAAO;AAAA,MACL,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,qBAAqB,IAAA,CAAK,mBAAA;AAAA,MAC1B,iBAAA,EAAmB,KAAK,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,CAAE,MAAA;AAAA,MACrD,aAAA,EAAe,KAAK,MAAA,CAAO,MAAA;AAAA,MAC3B,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,mBAAA,EAAqB,iBAAA;AAAA,MACrB,eAAe,IAAA,CAAK,aAAA;AAAA,MACpB,YAAY,IAAA,CAAK;AAAA,KACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,UAAA,CAAW,SAAS,KAAA,EAAgB;AAClC,IAAA,IAAI,QAAQ,OAAO,IAAA;AACnB,IAAA,IAAA,CAAK,qBAAA,EAAsB;AAC3B,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAQ,OAAO,KAAA;AAClC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,SAAA,CAAU,UAAA,EAAoB,MAAA,EAAiB,MAAA,GAAS,KAAA,EAAa;AACnE,IAAA,IAAI,MAAA,EAAQ;AAEZ,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAErB,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,IAAA,CAAK,KAAA,EAAM;AACX,QAAA;AAAA,MACF;AAEA,MAAA,IAAA,CAAK,MAAA,EAAO;AACZ,MAAA;AAAA,IACF;AAGA,IAAA,IAAA,CAAK,aAAa,GAAG,CAAA;AAErB,IAAA,MAAM,IAAA,GAAO,cAAc,IAAA,CAAK,mBAAA;AAChC,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,EAAE,IAAI,GAAA,EAAK,MAAA,EAAQ,MAAM,CAAA;AAE1C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAA,CAAK,mBAAA,EAAA;AACL,MAAA,IAAA,CAAK,aAAA,GAAgB,GAAA;AACrB,MAAA,IAAI,IAAA,CAAK,mBAAA,IAAuB,IAAA,CAAK,sBAAA,EAAwB;AAC3D,QAAA,IAAA,CAAK,KAAA,EAAM;AAAA,MACb;AACA,MAAA;AAAA,IACF;AAGA,IAAA,IAAA,CAAK,mBAAA,GAAsB,CAAA;AAE3B,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,IAAA,CAAK,UAAA,GAAa,GAAA;AAClB,MAAA,MAAM,SAAA,GAAY,KAAK,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,CAAE,MAAA;AACpD,MAAA,IAAI,SAAA,IAAa,KAAK,YAAA,EAAc;AAClC,QAAA,IAAA,CAAK,KAAA,EAAM;AAAA,MACb;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,KAAK,MAAA,CAAO,MAAA;AAC9B,IAAA,IAAI,SAAA,IAAa,KAAK,iBAAA,EAAmB;AAIvC,MAAA,IAAA,CAAK,KAAA,EAAM;AAAA,IACb;AAAA,EACF;AAAA;AAAA,EAGA,SAAA,GAAkB;AAChB,IAAA,IAAA,CAAK,KAAA,EAAM;AAAA,EACb;AAAA;AAAA,EAGA,UAAA,GAAmB;AACjB,IAAA,IAAA,CAAK,MAAA,EAAO;AAAA,EACd;AAAA,EAEQ,KAAA,GAAc;AACpB,IAAA,IAAI,IAAA,CAAK,UAAU,MAAA,EAAQ;AAC3B,IAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AACb,IAAA,IAAA,CAAK,QAAA,GAAW,KAAK,GAAA,EAAI;AAAA,EAC3B;AAAA,EAEQ,MAAA,GAAe;AACrB,IAAA,IAAA,CAAK,KAAA,GAAQ,QAAA;AACb,IAAA,IAAA,CAAK,mBAAA,GAAsB,CAAA;AAC3B,IAAA,IAAA,CAAK,SAAS,EAAC;AACf,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAAA,EAClB;AAAA;AAAA,EAGQ,qBAAA,GAA8B;AACpC,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,IAAU,IAAA,CAAK,aAAa,IAAA,EAAM;AACrD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,QAAA;AAClC,IAAA,IAAI,OAAA,IAAW,KAAK,UAAA,EAAY;AAC9B,MAAA,IAAA,CAAK,KAAA,GAAQ,WAAA;AACb,MAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAAA,IAClB;AAAA,EACF;AAAA,EAEQ,aAAa,GAAA,EAAmB;AACtC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA;AAC1B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAK,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,MAAM,CAAA;AAAA,EACxD;AACF,CAAA;;;AClNA,IAAM,uBAAA,GAAoC;AAAA;AAAA,EAExC,4NAAA;AAAA;AAAA,EAEA,iCAAA;AAAA,EACA,8CAAA;AAAA;AAAA,EAEA,iJAAA;AAAA;AAAA;AAAA,EAGA;AACF,CAAA;AAMO,SAAS,cAAc,GAAA,EAAqB;AACjD,EAAA,IAAI,MAAA,GAAS,GAAA;AACb,EAAA,KAAA,MAAW,WAAW,uBAAA,EAAyB;AAC7C,IAAA,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,CAAC,KAAA,KAAU;AAG1C,MAAA,MAAM,EAAA,GAAK,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AAC5B,MAAA,MAAM,EAAA,GAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAA;AAC5B,MAAA,MAAM,KAAA,GAAQ,OAAO,EAAA,GAAK,GAAA,GAAM,OAAO,EAAA,GAAK,KAAA,CAAM,EAAE,CAAA,GAAI,IAAA;AACxD,MAAA,IAAI,UAAU,IAAA,EAAM;AAClB,QAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,QAAQ,aAAA,CAAc,KAAK,CAAC,CAAA,GAAI,CAAC,CAAA;AACnE,QAAA,OAAO,GAAG,IAAI,CAAA,UAAA,CAAA;AAAA,MAChB;AAGA,MAAA,MAAM,UAAU,KAAA,CAAM,KAAA,CAAM,4BAA4B,CAAA,GAAI,CAAC,CAAA,IAAK,KAAA;AAClE,MAAA,OAAO,GAAG,OAAO,CAAA,aAAA,CAAA;AAAA,IACnB,CAAC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,MAAA;AACT;AAeA,IAAM,gBAAA,GAAmB,GAAA;AAelB,SAAS,cAAc,GAAA,EAAsB;AAClD,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,UAAA,EAAY,CAAC,MAAA,EAAQ,MAAA,CAAO,GAAG,CAAA,EAAG,IAAA,EAAM,IAAI,CAAA,EAAG;AAAA,MACnD,KAAA,EAAO,QAAA;AAAA,MACP,WAAA,EAAa;AAAA,KACd,EAAE,KAAA,EAAM;AACT,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,IAAM,sBAAN,MAA0B;AAAA,EACP,SAAA,uBAAgB,GAAA,EAA4B;AAAA,EAC5C,OAAA;AAAA,EAEjB,YAAY,aAAA,EAAsC;AAChD,IAAA,IAAA,CAAK,OAAA,GAAU,IAAI,cAAA,CAAe,aAAa,CAAA;AAAA,EACjD;AAAA,EAEA,SAAS,IAAA,EAAgG;AACvG,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,SAAA,EAAW,IAAA,CAAK,SAAA,IAAa,OAAO,CAAA;AAAA,EAC7F;AAAA;AAAA,EAGA,WAAW,GAAA,EAAmB;AAC5B,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,GAAG,CAAA;AAAA,EAC3B;AAAA;AAAA,EAGA,IAAI,GAAA,EAAyC;AAC3C,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,IAAA,GAAyB;AACvB,IAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA;AAAA,EAC3C;AAAA;AAAA,EAGA,OAAO,IAAA,EAAgC;AACrC,IAAA,OAAO,IAAA,CAAK,MAAK,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,IAAI,CAAA;AAAA,EAClD;AAAA;AAAA,EAGA,UAAU,SAAA,EAAqC;AAC7C,IAAA,OAAO,IAAA,CAAK,MAAK,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,SAAS,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,IAAI,WAAA,GAAsB;AACxB,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,SAAA,CAAU,MAAA,EAAO,EAAG;AACvC,MAAA,IAAI,CAAC,EAAE,MAAA,EAAQ,CAAA,EAAA;AAAA,IACjB;AACA,IAAA,OAAO,CAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAuB;AACrB,IAAA,OAAO;AAAA,MACL,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,UAAA,EAAY,KAAK,SAAA,CAAU,IAAA;AAAA,MAC3B,OAAA,EAAS,IAAA,CAAK,OAAA,CAAQ,QAAA;AAAS,KACjC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,UAAA,GAAsB;AACxB,IAAA,OAAO,KAAK,OAAA,CAAQ,UAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAA,CAAW,SAAS,KAAA,EAAgB;AAClC,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,MAAM,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAA,CAAU,UAAA,EAAoB,MAAA,EAAiB,MAAA,GAAS,KAAA,EAAa;AACnE,IAAA,IAAA,CAAK,OAAA,CAAQ,SAAA,CAAU,UAAA,EAAY,MAAA,EAAQ,MAAM,CAAA;AAAA,EACnD;AAAA;AAAA,EAGA,gBAAA,GAAyB;AACvB,IAAA,IAAA,CAAK,QAAQ,SAAA,EAAU;AAAA,EACzB;AAAA;AAAA,EAGA,iBAAA,GAA0B;AACxB,IAAA,IAAA,CAAK,QAAQ,UAAA,EAAW;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,IAAA,CAAK,GAAA,EAAa,IAAA,GAAiB,EAAC,EAAY;AAC9C,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AAChC,IAAA,IAAI,CAAC,GAAG,OAAO,KAAA;AACf,IAAA,IAAI,CAAA,CAAE,QAAQ,OAAO,IAAA;AACrB,IAAA,IAAI,CAAA,CAAE,WAAW,OAAO,KAAA;AAExB,IAAA,MAAM,EAAE,KAAA,GAAQ,KAAA,EAAO,OAAA,GAAU,kBAAiB,GAAI,IAAA;AACtD,IAAA,MAAMA,MAAAA,GAAW,aAAS,KAAM,OAAA;AAEhC,IAAA,IAAIA,MAAAA,EAAO;AAWT,MAAA,MAAM,aAAA,GAAgB,EAAE,KAAA,CAAM,QAAA,KAAa,QAAQ,OAAO,CAAA,CAAE,MAAM,GAAA,KAAQ,QAAA;AAC1E,MAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,GAAG,CAAA,EAAG;AACvC,QAAA,MAAM,QAAA,GAAW,WAAW,MAAM;AAChC,UAAA,IAAI,CAAA,CAAE,KAAA,CAAM,QAAA,KAAa,IAAA,EAAM;AAC7B,YAAA,IAAI;AACF,cAAA,CAAA,CAAE,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,YACxB,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF;AAAA,QACF,GAAG,OAAO,CAAA;AACV,QAAA,QAAA,CAAS,KAAA,IAAQ;AAAA,MACnB,CAAA,MAAO;AACL,QAAA,IAAI;AACF,UAAA,CAAA,CAAE,KAAA,CAAM,IAAA,CAAK,KAAA,GAAQ,SAAA,GAAY,SAAS,CAAA;AAAA,QAC5C,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AACA,MAAA,CAAA,CAAE,MAAA,GAAS,IAAA;AACX,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,GAAA,EAAK,SAAS,CAAA;AAAA,QAC9B,CAAA,CAAA,MAAQ;AACN,UAAA,CAAA,CAAE,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,QACxB;AAAA,MACF,CAAA,MAAO;AACL,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,GAAA,EAAK,SAAS,CAAA;AAAA,QAC9B,CAAA,CAAA,MAAQ;AACN,UAAA,CAAA,CAAE,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,QACxB;AAEA,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAE7B,UAAA,IAAI,IAAA,CAAK,UAAU,GAAA,CAAI,GAAG,KAAK,CAAC,CAAA,CAAE,MAAM,MAAA,EAAQ;AAC9C,YAAA,IAAI;AACF,cAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,GAAA,EAAK,SAAS,CAAA;AAAA,YAC9B,CAAA,CAAA,MAAQ;AACN,cAAA,IAAI;AACF,gBAAA,CAAA,CAAE,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,cACxB,CAAA,CAAA,MAAQ;AAAA,cAER;AAAA,YACF;AAAA,UACF;AAAA,QACF,GAAG,OAAO,CAAA;AACV,QAAA,KAAA,CAAM,KAAA,IAAQ;AAAA,MAChB;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,CAAA,CAAE,MAAA,GAAS,IAAA;AACX,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,CAAQ,IAAA,GAAiB,EAAC,EAAa;AACrC,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAC7C,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AAChC,MAAA,IAAI,CAAA,IAAK,CAAC,CAAA,CAAE,SAAA,IAAa,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,IAAI,CAAA,EAAG,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAAA,IAChE;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAA,CAAY,SAAA,EAAmB,IAAA,GAAiB,EAAC,EAAa;AAC5D,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,CAAU,SAAS,EAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,GAAG,CAAA;AACvD,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,IAAI,KAAK,IAAA,CAAK,GAAA,EAAK,IAAI,CAAA,EAAG,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF,CAAA;AAGA,IAAI,SAAA;AAEG,SAAS,kBAAA,GAA0C;AACxD,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,SAAA,GAAY,IAAI,mBAAA,EAAoB;AAAA,EACtC;AACA,EAAA,OAAO,SAAA;AACT;AC/UO,SAAS,oBAAoB,GAAA,EAAqB;AACvD,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS,OAAO,GAAA;AAKzC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,IAAK,IAAI,QAAA,CAAS,IAAI,CAAA,IAAUC,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAC,CAAA,EAAG;AACrF,IAAA,OAAO,GAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAA,CAAW,QAAQ,GAAA,CAAI,SAAS,KAAK,uCAAA,EACxC,WAAA,EAAY,CACZ,KAAA,CAAM,GAAG,CAAA;AAEZ,EAAA,MAAM,YAAY,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,IAAK,EAAA,EAAI,MAAWA,IAAA,CAAA,SAAS,CAAA;AAEjE,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,MAAM,IAAA,GAAYA,IAAA,CAAA,IAAA,CAAK,GAAA,EAAK,GAAG,CAAA;AAG/B,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,MAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,EAAG,GAAG,CAAA,CAAA;AAC1B,MAAA,IAAI;AACF,QAAG,EAAA,CAAA,UAAA,CAAW,IAAA,EAAS,EAAA,CAAA,SAAA,CAAU,IAAI,CAAA;AACrC,QAAA,OAAO,IAAA;AAAA,MACT,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAIA,EAAA,OAAO,GAAA;AACT;;;ACrCA,IAAM,KAAA,GAAQ,QAAQ,QAAA,KAAa,OAAA;AAEnC,IAAM,gBAAA,GAA6C;AAAA,EACjD,IAAA,EAAM,CAAC,WAAA,EAAa,IAAA,EAAM,qBAAqB,CAAA;AAAA,EAC/C,GAAA,EAAK,CAAC,WAAA,EAAa,MAAA,EAAQ,OAAO,QAAA,EAAU,MAAA,EAAQ,YAAY,OAAO,CAAA;AAAA,EACvE,MAAM,CAAC,WAAA,EAAa,UAAU,MAAA,EAAQ,MAAA,EAAQ,YAAY,OAAO,CAAA;AAAA,EACjE,GAAA,EAAK,CAAC,WAAW,CAAA;AAAA,EACjB,GAAA,EAAK;AAAA,IACH,WAAA;AAAA,IACA,QAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,EAAA,EAAI,CAAC,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AAAA,EACtB,KAAK,EAAC;AAAA,EACN,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,EACX,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,EACX,EAAA,EAAI,CAAC,IAAA,EAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EACrB,MAAM,EAAC;AAAA,EACP,MAAM,EAAC;AAAA,EACP,MAAM,EAAC;AAAA,EACP,KAAA,EAAO,CAAC,IAAI,CAAA;AAAA,EACZ,EAAA,EAAI,CAAC,IAAI,CAAA;AAAA,EACT,IAAI,EAAC;AAAA,EACL,EAAA,EAAI,CAAC,KAAK,CAAA;AAAA,EACV,OAAO,EAAC;AAAA,EACR,GAAA,EAAK,CAAC,WAAW,CAAA;AAAA,EACjB,GAAA,EAAK,CAAC,WAAA,EAAa,UAAA,EAAY,WAAW,CAAA;AAAA,EAC1C,MAAA,EAAQ,CAAC,WAAA,EAAa,KAAA,EAAO,YAAY,CAAA;AAAA,EACzC,KAAA,EAAO,CAAC,WAAA,EAAa,MAAA,EAAQ,UAAU,OAAO,CAAA;AAAA,EAC9C,KAAA,EAAO,CAAC,WAAA,EAAa,OAAA,EAAS,QAAQ,OAAO,CAAA;AAAA,EAC7C,KAAA,EAAO,CAAC,WAAW,CAAA;AAAA,EACnB,EAAA,EAAI,CAAC,SAAA,EAAW,KAAA,EAAO,SAAS,MAAM,CAAA;AAAA,EACtC,MAAA,EAAQ,CAAC,WAAW,CAAA;AAAA,EACpB,GAAA,EAAK,CAAC,WAAA,EAAa,MAAM,CAAA;AAAA,EACzB,MAAA,EAAQ,CAAC,WAAA,EAAa,IAAA,EAAM,QAAQ,CAAA;AAAA,EACpC,OAAA,EAAS,CAAC,SAAA,EAAW,KAAA,EAAO,YAAY,MAAM;AAChD,CAAA;AAEA,IAAM,QAAA,GAAW,EAAA;AAKjB,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,kBAAA,GAAqB,GAAA;AAK3B,IAAM,oBAAA,GAAiD;AAAA;AAAA,EAErD,MAAA,EAAQ,CAAC,KAAA,EAAO,aAAA,EAAe,QAAQ,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnD,GAAA,EAAK;AAAA,IACH,UAAA;AAAA,IACA,iBAAA;AAAA,IACA,kBAAA;AAAA,IACA,MAAA;AAAA,IACA,MAAA;AAAA,IACA,YAAA;AAAA,IACA,MAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACF;AAAA;AAAA,EAEA,MAAM,CAAC,MAAA,EAAQ,aAAA,EAAe,MAAA,EAAQ,YAAY,kBAAkB,CAAA;AAAA;AAAA,EAEpE,EAAA,EAAI,CAAC,YAAY,CAAA;AAAA;AAAA,EAEjB,KAAK,CAAC,aAAA,EAAe,OAAA,EAAS,QAAA,EAAU,YAAY,QAAQ,CAAA;AAAA;AAAA;AAAA,EAG5D,QAAQ,CAAC,SAAA,EAAW,OAAA,EAAS,QAAA,EAAU,UAAU,QAAQ,CAAA;AAAA;AAAA,EAEzD,IAAA,EAAM,CAAC,SAAA,EAAW,UAAA,EAAY,OAAA,EAAS,UAAU,YAAA,EAAc,aAAA,EAAe,SAAA,EAAW,OAAA,EAAS,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9G,EAAA,EAAI,CAAC,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAO,QAAQ,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,MAAM,CAAA;AAAA;AAAA,EAE1E,GAAA,EAAK,CAAC,OAAA,EAAS,QAAA,EAAU,YAAY,QAAA,EAAU,QAAA,EAAU,aAAa,UAAU,CAAA;AAAA;AAAA,EAEhF,IAAA,EAAM,CAAC,OAAA,EAAS,OAAA,EAAS,UAAU,UAAA,EAAY,QAAA,EAAU,QAAA,EAAU,WAAA,EAAa,UAAU,CAAA;AAAA;AAAA;AAAA,EAG1F,GAAA,EAAK,CAAC,UAAU;AAClB,CAAA;AAEA,SAAS,YAAA,CAAa,KAAa,IAAA,EAA+B;AAChE,EAAA,MAAM,OAAA,GAAU,qBAAqB,GAAG,CAAA;AACxC,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AAErB,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,KAAA,MAAW,WAAW,OAAA,EAAS;AAC7B,MAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AACrB,QAAA,OAAO,CAAA,kBAAA,EAAqB,GAAG,CAAA,eAAA,EAAkB,GAAG,+BAA+B,OAAO,CAAA,CAAA,CAAA;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAmBO,IAAM,QAAA,GAAwC;AAAA,EACnD,IAAA,EAAM,MAAA;AAAA,EACN,QAAA,EAAU,OAAA;AAAA,EACV,WAAA,EACE,sTAAA;AAAA,EAGF,SAAA,EACE,+gBAAA;AAAA,EAOF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,IAAA;AAAA,EACV,QAAA,EAAU,UAAA;AAAA,EACV,SAAA,EAAW,kBAAA;AAAA,EACX,YAAA,EAAc,CAAC,kBAAkB,CAAA;AAAA,EACjC,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,IAAA,EAAM,OAAA;AAAA,QACN,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,QACxB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,GAAA,EAAK;AAAA,QACH,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf,KACF;AAAA,IACA,QAAA,EAAU,CAAC,SAAS;AAAA,GACtB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,MAAM,WAAW,kBAAA,EAAmB;AACpC,IAAA,IAAI,CAAC,SAAS,UAAA,EAAY;AACxB,MAAA,OAAO;AAAA,QACL,SAAS,KAAA,CAAM,OAAA;AAAA,QACf,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,EAAC;AAAA,QACrB,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,2FAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AAC/B,IAAA,IAAI,CAAC,GAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,MAAM,EAAC;AAAA,QACP,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,eAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAEF,IAAA,IAAI,EAAE,OAAO,gBAAA,CAAA,EAAmB;AAC9B,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,EAAC;AAAA,QACrB,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,YAAY,GAAG,CAAA,6DAAA,CAAA;AAAA,QACvB,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,MAAM,QAAQ,KAAA,CAAM,IAAA,IAAQ,EAAC,EAAG,KAAA,CAAM,GAAG,QAAQ,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,KAAA,CAAM,OAAA,IAAW,kBAAA,EAAoB,kBAAkB,CAAC,CAAA;AAG7F,IAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAA,EAAK,IAAI,CAAA;AACvC,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,QAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAIA,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,GAAWC,IAAA,CAAA,OAAA,CAAQ,IAAI,WAAA,EAAa,KAAA,CAAM,GAAG,CAAA,GAAI,GAAA,CAAI,GAAA;AAChF,IAAA,MAAM,GAAA,GAAWA,IAAA,CAAA,QAAA,CAAS,GAAA,CAAI,WAAA,EAAa,YAAY,CAAA;AACvD,IAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAUA,IAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAChD,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,CAAA,KAAA,EAAQ,KAAA,CAAM,GAAG,CAAA,+BAAA,CAAA;AAAA,QACzB,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,YAAA;AACZ,IAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AAEpB,IAAA,OAAO,UAAA,CAAW,KAAK,IAAA,EAAM,GAAA,EAAK,SAAS,MAAA,EAAQ,GAAA,CAAI,SAAS,EAAE,CAAA;AAAA,EACpE;AACF;AAEA,SAAS,WACP,GAAA,EACA,IAAA,EACA,GAAA,EACA,OAAA,EACA,QACA,SAAA,EACqB;AACrB,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACC,QAAAA,KAAY;AAC9B,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,KAAA;AACb,IAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAI3B,IAAA,MAAM,KAAA,GAAQ,kBAAkB,EAAE,IAAA,EAAM,QAAQ,GAAG,CAAA,CAAA,EAAI,cAAA,EAAgB,UAAA,EAAY,CAAA;AAMnF,IAAA,MAAM,QAAA,GAAW,oBAAoB,GAAG,CAAA;AACxC,IAAA,MAAM,UAAA,GAAa,UAAU,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,IAAK,QAAA,CAAS,SAAS,MAAM,CAAA,CAAA;AAMlF,IAAA,MAAM,KAAA,GAAQC,KAAAA,CAAM,QAAA,EAAU,IAAA,EAAM;AAAA,MAClC,GAAA;AAAA,MACA,GAAA,EAAK,cAAc,SAAS,CAAA;AAAA,MAC5B,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAAA,MAChC,WAAA,EAAa,IAAA;AAAA,MACb,GAAI,KAAA,GAAQ,EAAC,GAAI,EAAE,MAAA,EAAO;AAAA,MAC1B,GAAI,aAAa,EAAE,KAAA,EAAO,MAAM,wBAAA,EAA0B,IAAA,KAAS;AAAC,KACrE,CAAA;AAED,IAAA,MAAM,WAAW,kBAAA,EAAmB;AACpC,IAAA,MAAM,MAAM,KAAA,CAAM,GAAA;AAClB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,MAAA,MAAM,cAAc,CAAA,EAAG,GAAG,IAAI,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAC5C,MAAA,QAAA,CAAS,QAAA,CAAS,EAAE,GAAA,EAAK,IAAA,EAAM,QAAQ,OAAA,EAAS,aAAA,CAAc,WAAW,CAAA,EAAG,WAAW,IAAA,CAAK,GAAA,EAAI,EAAG,SAAA,EAAW,OAAO,CAAA;AAAA,IACvH;AAEA,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,QAAA,CAAS,KAAK,GAAG,CAAA;AAAA,WACzC,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,IAC3B,GAAG,OAAO,CAAA;AAEV,IAAA,MAAM,UAAU,MAAM;AACpB,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,IAAI,OAAO,QAAQ,QAAA,EAAU,QAAA,CAAS,KAAK,GAAA,EAAK,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,WAC1D,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,IAC3B,CAAA;AACA,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAI,MAAA,CAAO,SAAS,OAAA,EAAQ;AAAA,kBAChB,gBAAA,CAAiB,OAAA,EAAS,SAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,IAC/D;AAEA,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,EAAS;AAC5B,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,UAAA,EAAY,MAAA,IAAU,IAAA;AAC1C,MAAA,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClB,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,EAAS;AAC5B,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,UAAA,EAAY,MAAA,IAAU,IAAA;AAC1C,MAAA,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClB,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AACtD,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,QAAA,CAAS,WAAW,GAAG,CAAA;AACpD,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAChC,MAAA,MAAM,QAAA,GAAW,MAAA,GAAS,GAAA,GAAO,IAAA,IAAQ,CAAA;AACzC,MAAA,QAAA,CAAS,SAAA,CAAU,UAAA,EAAY,QAAA,KAAa,CAAC,CAAA;AAC7C,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,EAAS;AAC/B,MAAAD,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,QAAQ,sBAAA,CAAuB,MAAM,KAAK,OAAA,GAAU,SAAA,CAAU,OAAO,CAAA,GAAI,EAAA,CAAA;AAAA,QACzE,MAAA,EAAQ,uBAAuB,MAAM,CAAA;AAAA,QACrC,QAAA;AAAA,QACA,SAAA,EACE,MAAA,CAAO,UAAA,CAAW,MAAA,EAAQ,MAAM,CAAA,GAAI,wBAAA,IACpC,MAAA,CAAO,UAAA,CAAW,MAAA,EAAQ,MAAM,CAAA,GAAI,wBAAA;AAAA,QACtC,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AACtD,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,QAAA,CAAS,WAAW,GAAG,CAAA;AACpD,MAAA,QAAA,CAAS,SAAA,CAAU,IAAA,CAAK,GAAA,EAAI,GAAI,WAAW,IAAI,CAAA;AAC/C,MAAA,KAAA,CAAM,QAAA,EAAS;AACf,MAAAA,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,uBAAuB,MAAM,CAAA;AAAA,QACrC,QAAQ,GAAA,CAAI,OAAA;AAAA,QACZ,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,MAAA,CAAO,UAAA,CAAW,MAAA,EAAQ,MAAM,CAAA,GAAI,wBAAA;AAAA,QAC/C,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"exec.js","sourcesContent":["/**\n * _output-spool — file-based capture of FULL command output.\n *\n * Command tools (bash/exec and the _spawn-stream consumers) cap what they\n * keep in memory and what reaches the model (COMMAND_OUTPUT_MAX_BYTES head+\n * tail). Everything past the cap used to be silently dropped, which pushed\n * agents to re-run commands with bigger buffers or stuff huge outputs into\n * chat history. The spool keeps the host's memory and the context window\n * small while losing nothing: once a command's output exceeds the in-memory\n * threshold, the FULL stream is written to a log file under\n * `~/.wrongstack/tool-output/` and the capped tool result carries a\n * `[full output: <path>]` marker so the model can read/grep the file\n * selectively instead of dumping it into context.\n *\n * Properties:\n *   - zero disk I/O for small outputs (file is created lazily on first byte\n *     past the threshold; the buffered head is flushed at that moment)\n *   - bounded memory: the head buffer never exceeds the threshold, and disk\n *     backpressure drops chunks past a 4 MB writable-buffer high-water mark\n *     (counted and reported in the marker) instead of queueing them on the heap\n *   - best-effort: any fs error disables the spool silently — command tools\n *     must never fail because diagnostics couldn't be written\n *   - retention: spool files older than 7 days are swept once per process\n */\nimport { createWriteStream, mkdirSync, type WriteStream } from 'node:fs';\nimport * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport { wstackGlobalRoot } from '@wrongstack/core';\n\nconst SPOOL_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;\n/** Stop queueing chunks on the heap when the fs stream falls this far behind. */\nconst SPOOL_WRITE_HWM_BYTES = 4 * 1024 * 1024;\n\nlet sweepStarted = false;\n\n/** Directory for spooled command output (under the wstack global root). */\nexport function toolOutputDir(): string {\n  return path.join(wstackGlobalRoot(), 'tool-output');\n}\n\n/** Reset module state — test hook (per-process sweep memo + nothing else). */\nexport function _resetOutputSpoolForTests(): void {\n  sweepStarted = false;\n}\n\nfunction sweepOldSpoolFiles(dir: string): void {\n  if (sweepStarted) return;\n  sweepStarted = true;\n  void (async () => {\n    try {\n      const now = Date.now();\n      for (const name of await fsp.readdir(dir)) {\n        if (!name.endsWith('.log')) continue;\n        const p = path.join(dir, name);\n        try {\n          const st = await fsp.stat(p);\n          if (now - st.mtimeMs > SPOOL_RETENTION_MS) await fsp.unlink(p);\n        } catch {\n          /* concurrently removed — ignore */\n        }\n      }\n    } catch {\n      /* directory doesn't exist yet — nothing to sweep */\n    }\n  })();\n}\n\nexport interface SpoolInfo {\n  /** Absolute path of the spool file. */\n  path: string;\n  /** Total bytes of output produced (including what reached the file). */\n  bytes: number;\n  /** Bytes dropped due to disk backpressure (0 in the normal case). */\n  droppedBytes: number;\n}\n\nexport interface OutputSpool {\n  /** Feed every raw output chunk. Never throws. */\n  write(text: string): void;\n  /**\n   * Close the file (if one was opened) and return its info, or null when the\n   * output never exceeded the threshold. Idempotent.\n   */\n  finalize(): SpoolInfo | null;\n}\n\nexport interface CreateOutputSpoolOptions {\n  /** Tool name used in the spool filename (sanitized). */\n  tool: string;\n  /**\n   * Output size at which the spool activates. Should match the tool's\n   * in-memory cap so files are only created for output the model can't\n   * already see in full. Default 32 KB.\n   */\n  thresholdBytes?: number | undefined;\n}\n\n/**\n * Render the marker line appended to a capped tool result. Kept in one place\n * so every command tool phrases it identically (and tests can match it).\n */\nexport function spoolNote(info: SpoolInfo): string {\n  const dropped =\n    info.droppedBytes > 0 ? `, ~${info.droppedBytes} bytes dropped under backpressure` : '';\n  return `\\n[output truncated — full ${info.bytes} bytes at ${info.path}${dropped}; read/grep that file selectively instead of re-running with more output]`;\n}\n\nexport function createOutputSpool(opts: CreateOutputSpoolOptions): OutputSpool {\n  const threshold = opts.thresholdBytes ?? 32_768;\n  const safeTool = opts.tool.replace(/[^a-zA-Z0-9._-]+/g, '_').slice(0, 40) || 'tool';\n\n  let head = '';\n  let headBytes = 0;\n  let totalBytes = 0;\n  let droppedBytes = 0;\n  let stream: WriteStream | null = null;\n  let filePath: string | null = null;\n  let failed = false;\n  let finalized = false;\n\n  const open = (): void => {\n    if (stream || failed) return;\n    try {\n      const dir = toolOutputDir();\n      // Synchronous on purpose: createWriteStream would race an async mkdir\n      // and error with ENOENT. This runs at most once per oversized command,\n      // and after the first call the dir exists (mkdirSync is a no-op stat).\n      mkdirSync(dir, { recursive: true });\n      sweepOldSpoolFiles(dir);\n      const stamp = new Date().toISOString().replace(/[:.]/g, '-');\n      const rand = Math.random().toString(36).slice(2, 6);\n      filePath = path.join(dir, `${stamp}-${safeTool}-${rand}.log`);\n      stream = createWriteStream(filePath, { flags: 'w', encoding: 'utf8' });\n      stream.on('error', () => {\n        // Disk full / permission — disable the spool, keep the tool alive.\n        failed = true;\n        stream = null;\n        filePath = null;\n      });\n      // Flush the buffered head first so the file is the complete output.\n      stream.write(head);\n    } catch {\n      failed = true;\n      stream = null;\n      filePath = null;\n    }\n  };\n\n  return {\n    write(text: string): void {\n      if (finalized || !text) return;\n      totalBytes += Buffer.byteLength(text, 'utf8');\n      if (!stream && !failed) {\n        if (headBytes + text.length <= threshold) {\n          head += text;\n          headBytes += text.length;\n          return;\n        }\n        head += text; // include the crossing chunk so the file misses nothing\n        open();\n        head = ''; // flushed into the stream by open(); release the heap copy\n        return;\n      }\n      if (stream) {\n        if (stream.writableLength > SPOOL_WRITE_HWM_BYTES) {\n          droppedBytes += Buffer.byteLength(text, 'utf8');\n          return;\n        }\n        stream.write(text);\n      }\n    },\n    finalize(): SpoolInfo | null {\n      if (finalized) {\n        return filePath ? { path: filePath, bytes: totalBytes, droppedBytes } : null;\n      }\n      finalized = true;\n      head = '';\n      if (!stream || !filePath) return null;\n      try {\n        stream.end();\n      } catch {\n        /* already closed */\n      }\n      return { path: filePath, bytes: totalBytes, droppedBytes };\n    },\n  };\n}\n","import * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core';\nimport type { Context } from '@wrongstack/core';\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm → yarn → npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const root = path.resolve(ctx.projectRoot);\n  const target = path.resolve(absPath);\n  const rel = path.relative(root, target);\n  if (rel.startsWith('..') || path.isAbsolute(rel)) {\n    throw new Error(`Path \"${absPath}\" is outside project root \"${root}\"`);\n  }\n  return target;\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root→out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink — macOS `/var`→`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  const realRoot = await fsp.realpath(ctx.projectRoot).catch(() => path.resolve(ctx.projectRoot));\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    const rel = path.relative(realRoot, real);\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\n      throw new Error(\n        `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoot}\"`,\n      );\n    }\n    return;\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// ─── Command-output normalization (token-saving) ────────────────────────────\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) — never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only — it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `… ⟨repeated ${run}×⟩`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends — the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n…[truncated ${total - kept} bytes]…\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI → collapse\n * carriage-return progress → trim trailing whitespace → collapse identical\n * consecutive lines → squeeze blank-line runs → head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines → 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n","/**\n * CircuitBreaker — prevents runaway bash/exec tool chains by:\n *\n *   - Tripping on consecutive failures (models that keep repeating the\n *     same failing command, e.g. `npm install` with wrong args in a loop)\n *   - Tripping on slow call ratio (too many long-running commands suggest\n *     a hung subprocess that the model doesn't know how to kill)\n *   - Rate-limiting bursts (rapid succession of commands without reading\n *     output suggests the model isn't processing results)\n *   - Auto-recovering after a cooldown period so a fixed model can resume\n *\n * The breaker is owned by the ProcessRegistry so any tool that registers\n * a process participates in the same circuit. \"Per-tool\" isolation is\n * intentionally NOT implemented — the model treats bash/exec as one\n * resource pool; isolating them would let the model route around the\n * breaker by alternating which tool it uses.\n */\n\nexport interface CircuitBreakerConfig {\n  /**\n   * Consecutive failures before trip. Default: 5.\n   * A single success resets this counter to 0.\n   */\n  maxConsecutiveFailures?: number | undefined;\n  /**\n   * Slow-call threshold in ms. A call that runs longer than this is\n   * counted as \"slow\". Default: 60_000 (1 minute).\n   */\n  slowCallThresholdMs?: number | undefined;\n  /**\n   * Max slow calls before trip (within the sliding window). Default: 3.\n   */\n  maxSlowCalls?: number | undefined;\n  /**\n   * Sliding window for rate-limit and slow-call counting, in ms.\n   * Default: 60_000 (1 minute).\n   */\n  windowMs?: number | undefined;\n  /**\n   * Max calls within the sliding window. Default: 30.\n   * Burst exceeding this trips the breaker immediately.\n   */\n  maxCallsPerWindow?: number | undefined;\n  /**\n   * Cooldown before auto-recovery attempt, in ms. Default: 30_000 (30s).\n   * After this the breaker enters \"half-open\" state and allows one call\n   * through to test whether the problem is resolved.\n   */\n  cooldownMs?: number | undefined;\n}\n\ninterface CallRecord {\n  at: number;\n  /** True if the call threw or returned an is_error result. */\n  failed: boolean;\n  /** True if elapsed time exceeded slowCallThresholdMs. */\n  slow: boolean;\n}\n\ntype BreakerState = 'closed' | 'open' | 'half-open';\n\nconst DEFAULT_MAX_CONSECUTIVE_FAILURES = 5;\nconst DEFAULT_SLOW_CALL_THRESHOLD_MS = 180_000;\n// 3 minutes — balanced against the 5-minute bash timeout. Commands\n// running <3min are normal; 3-5min are \"slow\" and count toward the\n// breaker. 3 consecutive slow calls trip the circuit.\nconst DEFAULT_MAX_SLOW_CALLS = 3;\nconst DEFAULT_WINDOW_MS = 60_000;\nconst DEFAULT_MAX_CALLS_PER_WINDOW = 30;\nconst DEFAULT_COOLDOWN_MS = 30_000;\n\nexport interface CircuitBreakerSnapshot {\n  state: 'closed' | 'open' | 'half-open';\n  consecutiveFailures: number;\n  slowCallsInWindow: number;\n  callsInWindow: number;\n  windowMs: number;\n  cooldownRemainingMs: number | null;\n  lastFailureAt: number | null;\n  lastSlowAt: number | null;\n}\n\nexport class CircuitBreaker {\n  private readonly maxConsecutiveFailures: number;\n  private readonly slowCallThresholdMs: number;\n  private readonly maxSlowCalls: number;\n  private readonly windowMs: number;\n  private readonly maxCallsPerWindow: number;\n  private readonly cooldownMs: number;\n\n  private state: BreakerState = 'closed';\n  private consecutiveFailures = 0;\n  private window: CallRecord[] = [];\n  private lastFailureAt: number | null = null;\n  private lastSlowAt: number | null = null;\n  /** Timestamp when the breaker was opened (for cooldown calculation). */\n  private openedAt: number | null = null;\n\n  constructor(config: CircuitBreakerConfig = {}) {\n    this.maxConsecutiveFailures = config.maxConsecutiveFailures ?? DEFAULT_MAX_CONSECUTIVE_FAILURES;\n    this.slowCallThresholdMs = config.slowCallThresholdMs ?? DEFAULT_SLOW_CALL_THRESHOLD_MS;\n    this.maxSlowCalls = config.maxSlowCalls ?? DEFAULT_MAX_SLOW_CALLS;\n    this.windowMs = config.windowMs ?? DEFAULT_WINDOW_MS;\n    this.maxCallsPerWindow = config.maxCallsPerWindow ?? DEFAULT_MAX_CALLS_PER_WINDOW;\n    this.cooldownMs = config.cooldownMs ?? DEFAULT_COOLDOWN_MS;\n  }\n\n  /**\n   * Returns true if the circuit allows a new call to proceed.\n   * When false, callers should abort the tool call and return a\n   * circuit-breaker error instead of spawning a process.\n   */\n  get canProceed(): boolean {\n    this._checkStateTransition();\n    return this.state !== 'open';\n  }\n\n  /**\n   * Snapshot of the current breaker state for observability (`/kill`).\n   */\n  snapshot(): CircuitBreakerSnapshot {\n    this._checkStateTransition();\n    const now = Date.now();\n    let cooldownRemaining: number | null = null;\n    if (this.openedAt !== null && this.state === 'open') {\n      const elapsed = now - this.openedAt;\n      cooldownRemaining = Math.max(0, this.cooldownMs - elapsed);\n    }\n    return {\n      state: this.state,\n      consecutiveFailures: this.consecutiveFailures,\n      slowCallsInWindow: this.window.filter((c) => c.slow).length,\n      callsInWindow: this.window.length,\n      windowMs: this.windowMs,\n      cooldownRemainingMs: cooldownRemaining,\n      lastFailureAt: this.lastFailureAt,\n      lastSlowAt: this.lastSlowAt,\n    };\n  }\n\n  /**\n   * Call this BEFORE spawning a bash/exec process.\n   * Returns true if the call is allowed; false if the breaker is open.\n   * When false, callers MUST NOT spawn a process.\n   *\n   * @param bypass - If true, skip the circuit breaker check entirely.\n   *                  Use for background/fire-and-forget processes that should\n   *                  not affect breaker state.\n   */\n  beforeCall(bypass = false): boolean {\n    if (bypass) return true;\n    this._checkStateTransition();\n    if (this.state === 'open') return false;\n    return true;\n  }\n\n  /**\n   * Call this AFTER a bash/exec process finishes (success or failure).\n   * `durationMs` is the wall-clock time the process ran.\n   * `failed` is true when the process returned a non-zero exit code or\n   * threw an exception before spawning.\n   *\n   * @param bypass - If true, do not update breaker state.\n   *                  Use for background/fire-and-forget processes.\n   */\n  afterCall(durationMs: number, failed: boolean, bypass = false): void {\n    if (bypass) return;\n\n    const now = Date.now();\n\n    if (this.state === 'half-open') {\n      // First call through after cooldown — if it failed, go back to open.\n      if (failed) {\n        this._trip();\n        return;\n      }\n      // Success in half-open → reset to closed.\n      this._reset();\n      return;\n    }\n\n    // Prune old records outside the sliding window.\n    this._pruneWindow(now);\n\n    const slow = durationMs >= this.slowCallThresholdMs;\n    this.window.push({ at: now, failed, slow });\n\n    if (failed) {\n      this.consecutiveFailures++;\n      this.lastFailureAt = now;\n      if (this.consecutiveFailures >= this.maxConsecutiveFailures) {\n        this._trip();\n      }\n      return;\n    }\n\n    // Success: reset consecutive failure counter.\n    this.consecutiveFailures = 0;\n\n    if (slow) {\n      this.lastSlowAt = now;\n      const slowCount = this.window.filter((c) => c.slow).length;\n      if (slowCount >= this.maxSlowCalls) {\n        this._trip();\n      }\n    }\n\n    const callCount = this.window.length;\n    if (callCount >= this.maxCallsPerWindow) {\n      // Rate limit exceeded. This is a soft trip — we reset the window\n      // and let the next call try immediately (the caller will still see\n      // canProceed=false until the window drains naturally).\n      this._trip();\n    }\n  }\n\n  /** Force the breaker open. Used by /kill force and Ctrl+C. */\n  forceOpen(): void {\n    this._trip();\n  }\n\n  /** Force a reset to closed. Used by tests and /kill reset. */\n  forceReset(): void {\n    this._reset();\n  }\n\n  private _trip(): void {\n    if (this.state === 'open') return; // already open\n    this.state = 'open';\n    this.openedAt = Date.now();\n  }\n\n  private _reset(): void {\n    this.state = 'closed';\n    this.consecutiveFailures = 0;\n    this.window = [];\n    this.openedAt = null;\n  }\n\n  /** Transition from open → half-open when cooldown elapses. */\n  private _checkStateTransition(): void {\n    if (this.state !== 'open' || this.openedAt === null) return;\n    const elapsed = Date.now() - this.openedAt;\n    if (elapsed >= this.cooldownMs) {\n      this.state = 'half-open';\n      this.openedAt = null;\n    }\n  }\n\n  private _pruneWindow(now: number): void {\n    const cutoff = now - this.windowMs;\n    this.window = this.window.filter((c) => c.at >= cutoff);\n  }\n}","import { expectDefined } from '@wrongstack/core';\n/**\n * ProcessRegistry — global singleton that tracks all spawned child processes\n * from `bash` and `exec` tools. Enables:\n *\n *   - Listing active processes (for TUI status bar)\n *   - Killing individual processes or all processes (for Ctrl+C and /kill)\n *   - Detecting runaway processes (hung, looping)\n *   - Circuit breaker integration to prevent recursive/repeated failures\n *\n * Thread-safety: Node.js is single-threaded, but async callbacks can fire\n * in any order. All mutations go through synchronized Map methods.\n */\nimport { spawn } from 'node:child_process';\nimport type { ChildProcess } from 'node:child_process';\nimport * as os from 'node:os';\nimport { CircuitBreaker, type CircuitBreakerSnapshot, type CircuitBreakerConfig } from './circuit-breaker.js';\nexport type { CircuitBreakerSnapshot, CircuitBreakerConfig } from './circuit-breaker.js';\n\nexport interface TrackedProcess {\n  pid: number;\n  name: string;\n  /** Display-safe redacted command string — safe for logs, /ps, crash dumps.\n   *  Contains [REDACTED] in place of sensitive flag values. */\n  command: string;\n  startedAt: number;\n  sessionId?: string | undefined;\n  /** The raw ChildProcess handle. Never call .kill() directly on this —\n   *  use `kill()` below which handles process groups correctly on POSIX\n   *  and degrades gracefully on Windows. */\n  child: ChildProcess;\n  /** True once the process has been kill()ed but not yet exited.\n   *  We keep it in the registry until 'close' fires so callers can\n   *  distinguish \"still running\" from \"just exited\". */\n  killed: boolean;\n  /** If true, kill() and killAll() will refuse to kill this process.\n   *  Used for infrastructure processes (browser, dev servers, …) that\n   *  must outlive the agent session. */\n  protected: boolean;\n}\n\n// Sensitive CLI flag patterns that may appear in process command lines.\n// Redacted to [REDACTED] so crash dumps /ps output cannot leak secrets.\nconst SENSITIVE_FLAG_PATTERNS: RegExp[] = [\n  // --flag=value  or  --flag \"value\"  (value captured up to next space or comma)\n  /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\\s,][^\\s]*)?/gi,\n  // -f \"value\" style short flags\n  /(?<!\\w)-t(?:\\s+|\\s*=\\s*)[^\\s,]+/,\n  /(?<!\\w)-p(?:ssword)?(?:\\s+|\\s*=\\s*)[^\\s,]+/gi,\n  // env var–style secrets: TOKEN=x, API_KEY=y, etc.\n  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\\s*[=:]\\s*[^\\s,]+/gi,\n  // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only\n  // when preceded by a flag name (e.g. --github-token=EyJ...).\n  /--\\w*(?:token|key|secret|password|passwd|auth|credential)\\w*[=\\s,][A-Za-z0-9+/=]{32,}/,\n];\n\n/**\n * Returns a display-safe copy of `cmd` with sensitive flag values replaced by [REDACTED].\n * The original string is unchanged; this is pure and has no side effects.\n */\nexport function redactCommand(cmd: string): string {\n  let result = cmd;\n  for (const pattern of SENSITIVE_FLAG_PATTERNS) {\n    result = result.replace(pattern, (match) => {\n      // Preserve the flag name portion; redact only the value part.\n      // e.g. \"--token=sekrit_abc\"  →  \"--token=[REDACTED]\"\n      const eq = match.indexOf('=');\n      const sp = match.search(/\\s/);\n      const delim = eq !== -1 ? '=' : sp !== -1 ? match[sp] : null;\n      if (delim !== null) {\n        const flag = match.slice(0, match.indexOf(expectDefined(delim)) + 1);\n        return `${flag}[REDACTED]`;\n      }\n      // Nothing delimitable found; replace the whole token silently.\n      // Short flags like -tVALUE are replaced entirely to avoid edge cases.\n      const flagEnd = match.match(/^--?[a-zA-Z][a-zA-Z0-9_-]*/)?.[0] ?? match;\n      return `${flagEnd}=**redacted**`;\n    });\n  }\n  return result;\n}\n\ninterface KillOpts {\n  /** SIGKILL instead of SIGTERM. Default: false (SIGTERM first). */\n  force?: boolean | undefined;\n  /** MS to wait between SIGTERM and SIGKILL on POSIX. Default: 2000. */\n  graceMs?: number | undefined;\n}\n\nexport interface RegistryStats {\n  activeCount: number;\n  totalCount: number;\n  breaker: CircuitBreakerSnapshot;\n}\n\nconst DEFAULT_GRACE_MS = 2000;\n\n/**\n * Kill an entire process tree on Windows via `taskkill /T /F`.\n *\n * TerminateProcess (what `child.kill()` maps to) has no process-group\n * semantics, so killing a shell wrapper (`cmd.exe /c …`) orphans its\n * grandchildren (node, vitest forks, dev servers). The orphans inherit the\n * parent's stdio pipe handles and can keep streaming into this process for\n * the rest of the session — which both prevents the child's 'close' event\n * from ever firing and grows in-memory output buffers without bound.\n *\n * Fire-and-forget: returns true if taskkill was spawned, false if spawning\n * it failed (caller should fall back to a direct `child.kill()`).\n */\nexport function killWin32Tree(pid: number): boolean {\n  try {\n    spawn('taskkill', ['/pid', String(pid), '/T', '/F'], {\n      stdio: 'ignore',\n      windowsHide: true,\n    }).unref();\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nclass ProcessRegistryImpl {\n  private readonly processes = new Map<number, TrackedProcess>();\n  private readonly breaker: CircuitBreaker;\n\n  constructor(breakerConfig?: CircuitBreakerConfig) {\n    this.breaker = new CircuitBreaker(breakerConfig);\n  }\n\n  register(info: Omit<TrackedProcess, 'killed' | 'protected'> & { protected?: boolean | undefined }): void {\n    this.processes.set(info.pid, { ...info, killed: false, protected: info.protected ?? false });\n  }\n\n  /** Unregister a process by PID. Called on 'close' / 'exit' events. */\n  unregister(pid: number): void {\n    this.processes.delete(pid);\n  }\n\n  /** Get a single process by PID. */\n  get(pid: number): TrackedProcess | undefined {\n    return this.processes.get(pid);\n  }\n\n  /** Get all tracked processes. */\n  list(): TrackedProcess[] {\n    return Array.from(this.processes.values());\n  }\n\n  /** Get processes filtered by name (e.g. 'bash', 'exec'). */\n  byName(name: string): TrackedProcess[] {\n    return this.list().filter((p) => p.name === name);\n  }\n\n  /** Get processes filtered by session. */\n  bySession(sessionId: string): TrackedProcess[] {\n    return this.list().filter((p) => p.sessionId === sessionId);\n  }\n\n  /** Count of active (non-killed) processes. */\n  get activeCount(): number {\n    let n = 0;\n    for (const p of this.processes.values()) {\n      if (!p.killed) n++;\n    }\n    return n;\n  }\n\n  /**\n   * Combined stats for observability — used by /ps and the TUI status bar.\n   */\n  stats(): RegistryStats {\n    return {\n      activeCount: this.activeCount,\n      totalCount: this.processes.size,\n      breaker: this.breaker.snapshot(),\n    };\n  }\n\n  /**\n   * Returns true if the circuit allows a new bash/exec call to proceed.\n   * When false, callers MUST NOT spawn a process.\n   */\n  get canProceed(): boolean {\n    return this.breaker.canProceed;\n  }\n\n  /**\n   * Called before spawning a process. Returns true if allowed; false if\n   * the circuit breaker is open.\n   *\n   * @param bypass - If true, skip circuit breaker check (for background processes).\n   */\n  beforeCall(bypass = false): boolean {\n    return this.breaker.beforeCall(bypass);\n  }\n\n  /**\n   * Called after a process finishes. `durationMs` is wall-clock time;\n   * `failed` is true for non-zero exit codes.\n   *\n   * @param bypass - If true, do not update circuit breaker state (for background processes).\n   */\n  afterCall(durationMs: number, failed: boolean, bypass = false): void {\n    this.breaker.afterCall(durationMs, failed, bypass);\n  }\n\n  /** Force-open the circuit breaker (Ctrl+C, /kill force). */\n  forceBreakerOpen(): void {\n    this.breaker.forceOpen();\n  }\n\n  /** Force-reset the circuit breaker to closed (/kill reset). */\n  forceBreakerReset(): void {\n    this.breaker.forceReset();\n  }\n\n  /** Kill a single process by PID.\n   *\n   *  On POSIX: sends SIGTERM to the *process group* (-pid) so that\n   *  runaway grandchild processes (`sleep 9999 & disown`) are also killed.\n   *  After `graceMs` a SIGKILL is sent if the process hasn't exited.\n   *\n   *  On Windows: `child.kill()` maps to TerminateProcess — process groups\n   *  are not meaningfully supported. A second `force=true` call sends\n   *  SIGKILL (which maps to TerminateProcess again — the distinction is\n   *  in the exit code, not the signal).\n   *\n   *  Returns true if the process was found and kill was attempted.\n   */\n  kill(pid: number, opts: KillOpts = {}): boolean {\n    const p = this.processes.get(pid);\n    if (!p) return false;\n    if (p.killed) return true; // already kill()ed, don't double-send\n    if (p.protected) return false; // protected processes are never kill()ed\n\n    const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;\n    const isWin = os.platform() === 'win32';\n\n    if (isWin) {\n      // Windows: no process group semantics. A direct kill terminates only\n      // the immediate child — shell-wrapped commands (cmd.exe /c …) leave\n      // grandchildren running that hold the inherited stdio pipes open and\n      // keep feeding output into this process indefinitely. Kill the whole\n      // tree via taskkill instead, but only for a real, still-running child\n      // (exitCode === null); test fakes and already-exited processes take\n      // the plain-kill path. The direct kill is deliberately NOT sent\n      // immediately alongside taskkill: killing the root first would break\n      // taskkill's parent-pid tree enumeration and orphan the grandchildren\n      // again — it runs as a delayed fallback instead.\n      const liveRealChild = p.child.exitCode === null && typeof p.child.pid === 'number';\n      if (liveRealChild && killWin32Tree(pid)) {\n        const fallback = setTimeout(() => {\n          if (p.child.exitCode === null) {\n            try {\n              p.child.kill('SIGKILL');\n            } catch {\n              // Process may have already exited.\n            }\n          }\n        }, graceMs);\n        fallback.unref?.();\n      } else {\n        try {\n          p.child.kill(force ? 'SIGKILL' : 'SIGTERM');\n        } catch {\n          // Process may have already exited.\n        }\n      }\n      p.killed = true;\n      return true;\n    }\n\n    // POSIX: kill the process group so grandchildren are cleaned up too.\n    try {\n      if (force) {\n        try {\n          process.kill(-pid, 'SIGKILL');\n        } catch {\n          p.child.kill('SIGKILL');\n        }\n      } else {\n        try {\n          process.kill(-pid, 'SIGTERM');\n        } catch {\n          p.child.kill('SIGTERM');\n        }\n        // Schedule SIGKILL as backup.\n        const timer = setTimeout(() => {\n          // Re-check: process may have exited on its own.\n          if (this.processes.has(pid) && !p.child.killed) {\n            try {\n              process.kill(-pid, 'SIGKILL');\n            } catch {\n              try {\n                p.child.kill('SIGKILL');\n              } catch {\n                /* already gone */\n              }\n            }\n          }\n        }, graceMs);\n        timer.unref?.(); // Don't keep event loop alive.\n      }\n    } catch {\n      // Process may have already exited.\n    }\n    p.killed = true;\n    return true;\n  }\n\n  /**\n   * Kill all tracked processes.\n   * Returns the PIDs that were kill()ed.\n   */\n  killAll(opts: KillOpts = {}): number[] {\n    const pids = Array.from(this.processes.keys());\n    const killed: number[] = [];\n    for (const pid of pids) {\n      const p = this.processes.get(pid);\n      if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);\n    }\n    return killed;\n  }\n\n  /**\n   * Kill all processes for a specific session.\n   * Returns the PIDs that were kill()ed.\n   */\n  killSession(sessionId: string, opts: KillOpts = {}): number[] {\n    const pids = this.bySession(sessionId).map((p) => p.pid);\n    const killed: number[] = [];\n    for (const pid of pids) {\n      if (this.kill(pid, opts)) killed.push(pid);\n    }\n    return killed;\n  }\n}\n\n/** Module-level singleton. Initialized on first access. */\nlet _registry: ProcessRegistryImpl | undefined;\n\nexport function getProcessRegistry(): ProcessRegistryImpl {\n  if (!_registry) {\n    _registry = new ProcessRegistryImpl();\n  }\n  return _registry;\n}\n\n/** Reset for tests. */\nexport function _resetProcessRegistry(): void {\n  _registry = undefined;\n}\n\n// ── Convenience re-exports ────────────────────────────────────────────────────\n\nexport type { KillOpts };","import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\n/**\n * On Windows, Node.js `spawn()` without a shell does NOT resolve .cmd/.bat\n * extensions through PATHEXT — it only auto-resolves .exe. Most Node.js CLI\n * tools (npx, pnpm, biome, tsc, vitest, etc.) ship as .cmd wrappers on\n * Windows. This function resolves the command name to its full path so spawn\n * can find it without relying on shell-mode argument concatenation.\n *\n * On non-Windows, returns the command unchanged.\n */\nexport function resolveWin32Command(cmd: string): string {\n  if (process.platform !== 'win32') return cmd;\n\n  // Already has a path or extension — use as-is\n  // Normalize forward slashes so path.extname correctly detects extensions\n  // even when a Unix-style path is passed on Windows.\n  if (cmd.includes('/') || cmd.includes('\\\\') || path.extname(cmd.replace(/\\//g, '\\\\'))) {\n    return cmd;\n  }\n\n  const pathext = (process.env['PATHEXT'] ?? '.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC')\n    .toLowerCase()\n    .split(';');\n\n  const pathDirs = (process.env['PATH'] ?? '').split(path.delimiter);\n\n  for (const dir of pathDirs) {\n    const base = path.join(dir, cmd);\n    // Check extensions in PATHEXT order. .EXE should win first because\n    // it's typically listed first, and .exe doesn't need shell: true.\n    for (const ext of pathext) {\n      const full = `${base}${ext}`;\n      try {\n        fs.accessSync(full, fs.constants.X_OK);\n        return full;\n      } catch {\n        // Not found with this extension — try next\n      }\n    }\n  }\n\n  // Not found — return original; let spawn report ENOENT with the\n  // expected error message so tools can surface it properly.\n  return cmd;\n}\n","import { spawn } from 'node:child_process';\nimport * as path from 'node:path';\nimport type { Tool } from '@wrongstack/core';\nimport { buildChildEnv } from './_env.js';\nimport { createOutputSpool, spoolNote } from './_output-spool.js';\nimport { COMMAND_OUTPUT_MAX_BYTES, normalizeCommandOutput } from './_util.js';\nimport { getProcessRegistry, redactCommand } from './process-registry.js';\nimport { resolveWin32Command } from './_win32-resolve.js';\n\nconst isWin = process.platform === 'win32';\n\nconst ALLOWED_COMMANDS: Record<string, string[]> = {\n  node: ['--version', '-r', '--input-type=module'],\n  npm: ['--version', 'list', 'pkg', 'doctor', 'view', 'outdated', 'audit'],\n  pnpm: ['--version', 'remove', 'list', 'view', 'outdated', 'audit'],\n  npx: ['--version'],\n  git: [\n    '--version',\n    'status',\n    'log',\n    'diff',\n    'branch',\n    'checkout',\n    'stash',\n    'add',\n    'commit',\n    'push',\n    'pull',\n  ],\n  ls: ['-la', '-l', '-a'],\n  cat: [],\n  head: ['-n'],\n  tail: ['-n'],\n  wc: ['-l', '-w', '-c'],\n  grep: [],\n  find: [],\n  echo: [],\n  mkdir: ['-p'],\n  cp: ['-r'],\n  mv: [],\n  rm: ['-rf'],\n  touch: [],\n  bun: ['--version'],\n  tsc: ['--version', '--noEmit', '--project'],\n  vitest: ['--version', 'run', '--coverage'],\n  biome: ['--version', 'lint', 'format', 'check'],\n  cargo: ['--version', 'build', 'test', 'check'],\n  rustc: ['--version'],\n  go: ['version', 'run', 'build', 'test'],\n  python: ['--version'],\n  pip: ['--version', 'list'],\n  docker: ['--version', 'ps', 'images'],\n  kubectl: ['version', 'get', 'describe', 'logs'],\n};\n\nconst MAX_ARGS = 20;\n// 200 KB — larger than bash's 32 KB cap. exec commands produce structured,\n// predictable output (build logs, test results, git diffs) that the agent\n// needs in full. 200 KB is safe for context windows ≥200K tokens while\n// still preventing a rogue build from filling the context.\nconst MAX_OUTPUT = 200_000;\nconst DEFAULT_TIMEOUT_MS = 30_000;\n\n// Per-command argument validation. Each entry is a list of regex patterns\n// that, if matched against any argument, will reject the invocation.\n// This blocks common injection vectors through allowlisted commands.\nconst BLOCKED_ARG_PATTERNS: Record<string, RegExp[]> = {\n  // python -c/--command executes arbitrary code; python -m runs modules\n  python: [/-c$/, /^--command$/, /^-m$/, /^--module$/],\n  // git --exec=<cmd> runs arbitrary commands via upload-pack/receive-pack;\n  // -C <dir> changes working directory, bypassing cwd sandbox;\n  // -c/--config <k>=<v> injects config that runs commands\n  // (e.g. core.sshCommand, core.pager, http.proxy, alias.x=!cmd).\n  git: [\n    /^--exec=/,\n    /^--upload-pack=/,\n    /^--receive-pack=/,\n    /^-C$/,\n    /^-c$/,\n    /^--config$/,\n    /^-c=/,\n    /^--config=/,\n    /^--config-env=/,\n  ],\n  // node -r/--require preloads arbitrary modules; --eval executes code\n  node: [/^-r$/, /^--require$/, /^-e$/, /^--eval$/, /^--prof-process$/],\n  // go run could execute arbitrary .go files; -ldflags could inject build-time code\n  go: [/^-ldflags$/],\n  // bun --preload is similar to node --require\n  bun: [/^--preload$/, /^run$/, /^bunx$/, /^create$/, /^init$/],\n  // docker build/run can create containers with host access;\n  // only allow read-only commands (ps, images, version)\n  docker: [/^build$/, /^run$/, /^exec$/, /^push$/, /^pull$/],\n  // find -exec/-ok/-execdir execute arbitrary commands\n  find: [/^-exec$/, /^-exec;$/, /^-ok$/, /^-ok;$/, /^-execdir$/, /^-execdir;$/, /^-exec=/, /^-ok=/, /^-execdir=/],\n  // rm -rf / is catastrophic — block absolute paths, home, dot-dirs,\n  // and glob patterns that could expand to dangerous targets.\n  // `rm -rf ./src/*` expands to project files; `rm -rf ../../` escapes upward;\n  // `rm -rf /*` targets the filesystem root. All are blocked.\n  rm: [/^\\//, /^~\\//, /^~$/, /^\\.$/, /^\\.\\.$/, /\\*$/, /\\/$/, /\\/\\*$/, /\\.\\//],\n  // npm run/exec/create/pack/publish can execute arbitrary scripts or publish malware\n  npm: [/^run$/, /^exec$/, /^create$/, /^init$/, /^pack$/, /^publish$/, /^deploy$/],\n  // pnpm run/dlx/exec/create can execute arbitrary scripts\n  pnpm: [/^run$/, /^dlx$/, /^exec$/, /^create$/, /^init$/, /^pack$/, /^publish$/, /^deploy$/],\n  // npx should only be used for --version; any package name is a vector for\n  // malicious package execution (typosquatting, dependency confusion)\n  npx: [/^[^\\s]+$/],\n};\n\nfunction validateArgs(cmd: string, args: string[]): string | null {\n  const blocked = BLOCKED_ARG_PATTERNS[cmd];\n  if (!blocked) return null;\n\n  for (const arg of args) {\n    for (const pattern of blocked) {\n      if (pattern.test(arg)) {\n        return `Blocked argument \"${arg}\" for command \"${cmd}\" (matches security pattern ${pattern})`;\n      }\n    }\n  }\n  return null;\n}\n\ninterface ExecInput {\n  command: string;\n  args?: string[] | undefined;\n  cwd?: string | undefined;\n  timeout?: number | undefined;\n}\n\ninterface ExecOutput {\n  command: string;\n  args: string[];\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  truncated: boolean;\n  allowed: boolean;\n}\n\nexport const execTool: Tool<ExecInput, ExecOutput> = {\n  name: 'exec',\n  category: 'Shell',\n  description:\n    'Execute a **whitelisted, restricted set of commands** with strict argument validation. ' +\n    'This is the **preferred and safer** alternative to the `bash` tool for running development tools (node, npm, pnpm, tsc, git, tests, linters, etc.). ' +\n    'It prevents arbitrary command injection and limits what the model can do.',\n  usageHint:\n    'PREFERRED SHELL TOOL for most cases.\\n\\n' +\n    'Use this instead of `bash` whenever possible.\\n' +\n    '- `command` must be one of the allowed commands (node, npm, pnpm, git, tsc, eslint, vitest, etc.).\\n' +\n    '- Arguments are passed as a clean array (no shell interpretation).\\n' +\n    '- `cwd` is validated to stay inside the project.\\n' +\n    '- For anything that requires real shell features (pipes, complex redirection, arbitrary commands), fall back to `bash` (with strong justification).\\n' +\n    'This tool significantly reduces the risk compared to full shell access.',\n  permission: 'confirm',\n  mutating: true,\n  riskTier: 'standard',\n  timeoutMs: DEFAULT_TIMEOUT_MS,\n  capabilities: ['shell.restricted'],\n  inputSchema: {\n    type: 'object',\n    properties: {\n      command: {\n        type: 'string',\n        description: 'The base command to run. Must be in the internal allowlist (e.g. \"node\", \"pnpm\", \"git\", \"tsc\").',\n      },\n      args: {\n        type: 'array',\n        items: { type: 'string' },\n        description: 'Arguments passed to the command. Passed as an array (no shell parsing).',\n      },\n      cwd: {\n        type: 'string',\n        description: 'Optional working directory. Must resolve inside the project root.',\n      },\n      timeout: {\n        type: 'integer',\n        description: 'Per-command timeout in milliseconds.',\n      },\n    },\n    required: ['command'],\n  },\n  async execute(input, ctx, opts) {\n    const registry = getProcessRegistry();\n    if (!registry.canProceed) {\n      return {\n        command: input.command,\n        args: input.args ?? [],\n        stdout: '',\n        stderr: 'Circuit breaker is open — too many consecutive failures. Use /kill reset to recover.',\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n\n    const cmd = input.command.trim();\n    if (!cmd)\n      return {\n        command: cmd,\n        args: [],\n        stdout: '',\n        stderr: 'Empty command',\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n\n    if (!(cmd in ALLOWED_COMMANDS)) {\n      return {\n        command: cmd,\n        args: input.args ?? [],\n        stdout: '',\n        stderr: `Command \"${cmd}\" not in allowlist. Use the bash tool for arbitrary commands.`,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n\n    const args = (input.args ?? []).slice(0, MAX_ARGS);\n    const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS, DEFAULT_TIMEOUT_MS));\n\n    // Validate args against per-command security patterns\n    const argError = validateArgs(cmd, args);\n    if (argError) {\n      return {\n        command: cmd,\n        args,\n        stdout: '',\n        stderr: argError,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n\n    // Resolve cwd inside the project root. Model-supplied paths like '/etc'\n    // would otherwise let allowlisted commands operate anywhere on disk.\n    const requestedCwd = input.cwd ? path.resolve(ctx.projectRoot, input.cwd) : ctx.cwd;\n    const rel = path.relative(ctx.projectRoot, requestedCwd);\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\n      return {\n        command: cmd,\n        args,\n        stdout: '',\n        stderr: `cwd \"${input.cwd}\" resolves outside project root`,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n    const cwd = requestedCwd;\n    const signal = opts.signal;\n\n    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id);\n  },\n};\n\nfunction runCommand(\n  cmd: string,\n  args: string[],\n  cwd: string,\n  timeout: number,\n  signal: AbortSignal,\n  sessionId: string | undefined,\n): Promise<ExecOutput> {\n  return new Promise((resolve) => {\n    let stdout = '';\n    let stderr = '';\n    let killed = false;\n    const startedAt = Date.now();\n    // Full-output spool (stdout+stderr interleaved as they arrive): the\n    // in-memory buffers keep only the first MAX_OUTPUT bytes; the spool\n    // captures everything on disk and the result points at the file.\n    const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT });\n\n    // On Windows, .cmd/.bat resolution requires shell: true — same rationale\n    // as _spawn-stream.ts. resolveWin32Command() finds the full path to the\n    // .cmd file so spawn can locate it; shell: true is still needed because\n    // .cmd/.bat files are not natively executable by CreateProcess.\n    const resolved = resolveWin32Command(cmd);\n    const needsShell = isWin && (resolved.endsWith('.cmd') || resolved.endsWith('.bat'));\n\n    // On Windows the abort signal is handled manually below: Node's built-in\n    // handling kills only the direct child, orphaning grandchildren (vitest\n    // forks, dev servers, anything under a .cmd shim) that keep the inherited\n    // stdio pipes open. registry.kill() tree-kills via taskkill instead.\n    const child = spawn(resolved, args, {\n      cwd,\n      env: buildChildEnv(sessionId),\n      stdio: ['ignore', 'pipe', 'pipe'],\n      windowsHide: true,\n      ...(isWin ? {} : { signal }),\n      ...(needsShell ? { shell: true, windowsVerbatimArguments: true } : {}),\n    });\n\n    const registry = getProcessRegistry();\n    const pid = child.pid;\n    if (typeof pid === 'number') {\n      const fullCommand = `${cmd} ${args.join(' ')}`;\n      registry.register({ pid, name: 'exec', command: redactCommand(fullCommand), startedAt: Date.now(), sessionId, child });\n    }\n\n    const timer = setTimeout(() => {\n      killed = true;\n      if (typeof pid === 'number') registry.kill(pid);\n      else child.kill('SIGTERM');\n    }, timeout);\n\n    const onAbort = () => {\n      killed = true;\n      if (typeof pid === 'number') registry.kill(pid, { force: true });\n      else child.kill('SIGTERM');\n    };\n    if (isWin) {\n      if (signal.aborted) onAbort();\n      else signal.addEventListener('abort', onAbort, { once: true });\n    }\n\n    child.stdout?.on('data', (chunk: Buffer) => {\n      const text = chunk.toString();\n      if (stdout.length < MAX_OUTPUT) stdout += text;\n      spool.write(text);\n    });\n\n    child.stderr?.on('data', (chunk: Buffer) => {\n      const text = chunk.toString();\n      if (stderr.length < MAX_OUTPUT) stderr += text;\n      spool.write(text);\n    });\n\n    child.on('close', (code) => {\n      clearTimeout(timer);\n      if (isWin) signal.removeEventListener('abort', onAbort);\n      if (typeof pid === 'number') registry.unregister(pid);\n      const durationMs = Date.now() - startedAt;\n      const exitCode = killed ? 124 : (code ?? 1);\n      registry.afterCall(durationMs, exitCode !== 0);\n      const spooled = spool.finalize();\n      resolve({\n        command: cmd,\n        args,\n        stdout: normalizeCommandOutput(stdout) + (spooled ? spoolNote(spooled) : ''),\n        stderr: normalizeCommandOutput(stderr),\n        exitCode,\n        truncated:\n          Buffer.byteLength(stdout, 'utf8') > COMMAND_OUTPUT_MAX_BYTES ||\n          Buffer.byteLength(stderr, 'utf8') > COMMAND_OUTPUT_MAX_BYTES,\n        allowed: true,\n      });\n    });\n\n    child.on('error', (err) => {\n      clearTimeout(timer);\n      if (isWin) signal.removeEventListener('abort', onAbort);\n      if (typeof pid === 'number') registry.unregister(pid);\n      registry.afterCall(Date.now() - startedAt, true);\n      spool.finalize();\n      resolve({\n        command: cmd,\n        args,\n        stdout: normalizeCommandOutput(stdout),\n        stderr: err.message,\n        exitCode: 1,\n        truncated: Buffer.byteLength(stdout, 'utf8') > COMMAND_OUTPUT_MAX_BYTES,\n        allowed: true,\n      });\n    });\n  });\n}\n"]}
+{"version":3,"sources":["../src/_output-spool.ts","../src/_util.ts","../src/circuit-breaker.ts","../src/process-registry.ts","../src/_win32-resolve.ts","../src/exec.ts"],"names":["isWin","path2","path3","resolve","spawn"],"mappings":";;;;;;;;;;AA6BA,IAAM,kBAAA,GAAqB,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAE9C,IAAM,qBAAA,GAAwB,IAAI,IAAA,GAAO,IAAA;AAEzC,IAAI,YAAA,GAAe,KAAA;AAGZ,SAAS,aAAA,GAAwB;AACtC,EAAA,OAAY,IAAA,CAAA,IAAA,CAAK,gBAAA,EAAiB,EAAG,aAAa,CAAA;AACpD;AAOA,SAAS,mBAAmB,GAAA,EAAmB;AAC7C,EAAA,IAAI,YAAA,EAAc;AAClB,EAAA,YAAA,GAAe,IAAA;AACf,EAAA,KAAA,CAAM,YAAY;AAChB,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAU,GAAA,CAAA,OAAA,CAAQ,GAAG,CAAA,EAAG;AACzC,QAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,EAAG;AAC5B,QAAA,MAAM,CAAA,GAAS,IAAA,CAAA,IAAA,CAAK,GAAA,EAAK,IAAI,CAAA;AAC7B,QAAA,IAAI;AACF,UAAA,MAAM,EAAA,GAAK,MAAU,GAAA,CAAA,IAAA,CAAK,CAAC,CAAA;AAC3B,UAAA,IAAI,MAAM,EAAA,CAAG,OAAA,GAAU,kBAAA,EAAoB,MAAU,WAAO,CAAC,CAAA;AAAA,QAC/D,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF,CAAA,GAAG;AACL;AAoCO,SAAS,UAAU,IAAA,EAAyB;AACjD,EAAA,MAAM,UACJ,IAAA,CAAK,YAAA,GAAe,IAAI,CAAA,GAAA,EAAM,IAAA,CAAK,YAAY,CAAA,iCAAA,CAAA,GAAsC,EAAA;AACvF,EAAA,OAAO;AAAA,8BAAA,EAA8B,KAAK,KAAK,CAAA,UAAA,EAAa,IAAA,CAAK,IAAI,GAAG,OAAO,CAAA,yEAAA,CAAA;AACjF;AAEO,SAAS,kBAAkB,IAAA,EAA6C;AAC7E,EAAA,MAAM,SAAA,GAAY,KAAK,cAAkB;AACzC,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,mBAAA,EAAqB,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,IAAK,MAAA;AAE7E,EAAA,IAAI,IAAA,GAAO,EAAA;AACX,EAAA,IAAI,SAAA,GAAY,CAAA;AAChB,EAAA,IAAI,UAAA,GAAa,CAAA;AACjB,EAAA,IAAI,YAAA,GAAe,CAAA;AACnB,EAAA,IAAI,MAAA,GAA6B,IAAA;AACjC,EAAA,IAAI,QAAA,GAA0B,IAAA;AAC9B,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,IAAI,SAAA,GAAY,KAAA;AAEhB,EAAA,MAAM,OAAO,MAAY;AACvB,IAAA,IAAI,UAAU,MAAA,EAAQ;AACtB,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,aAAA,EAAc;AAI1B,MAAA,SAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAClC,MAAA,kBAAA,CAAmB,GAAG,CAAA;AACtB,MAAA,MAAM,KAAA,GAAA,qBAAY,IAAA,EAAK,EAAE,aAAY,CAAE,OAAA,CAAQ,SAAS,GAAG,CAAA;AAC3D,MAAA,MAAM,IAAA,GAAO,KAAK,MAAA,EAAO,CAAE,SAAS,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAClD,MAAA,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,KAAK,CAAA,EAAG,KAAK,IAAI,QAAQ,CAAA,CAAA,EAAI,IAAI,CAAA,IAAA,CAAM,CAAA;AAC5D,MAAA,MAAA,GAAS,kBAAkB,QAAA,EAAU,EAAE,OAAO,GAAA,EAAK,QAAA,EAAU,QAAQ,CAAA;AACrE,MAAA,MAAA,CAAO,EAAA,CAAG,SAAS,MAAM;AAEvB,QAAA,MAAA,GAAS,IAAA;AACT,QAAA,MAAA,GAAS,IAAA;AACT,QAAA,QAAA,GAAW,IAAA;AAAA,MACb,CAAC,CAAA;AAED,MAAA,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,IACnB,CAAA,CAAA,MAAQ;AACN,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AAAA,EACF,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,IAAA,EAAoB;AACxB,MAAA,IAAI,SAAA,IAAa,CAAC,IAAA,EAAM;AACxB,MAAA,UAAA,IAAc,MAAA,CAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA;AAC5C,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ;AACtB,QAAA,IAAI,SAAA,GAAY,IAAA,CAAK,MAAA,IAAU,SAAA,EAAW;AACxC,UAAA,IAAA,IAAQ,IAAA;AACR,UAAA,SAAA,IAAa,IAAA,CAAK,MAAA;AAClB,UAAA;AAAA,QACF;AACA,QAAA,IAAA,IAAQ,IAAA;AACR,QAAA,IAAA,EAAK;AACL,QAAA,IAAA,GAAO,EAAA;AACP,QAAA;AAAA,MACF;AACA,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,IAAI,MAAA,CAAO,iBAAiB,qBAAA,EAAuB;AACjD,UAAA,YAAA,IAAgB,MAAA,CAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA;AAC9C,UAAA;AAAA,QACF;AACA,QAAA,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,MACnB;AAAA,IACF,CAAA;AAAA,IACA,QAAA,GAA6B;AAC3B,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,OAAO,WAAW,EAAE,IAAA,EAAM,UAAU,KAAA,EAAO,UAAA,EAAY,cAAa,GAAI,IAAA;AAAA,MAC1E;AACA,MAAA,SAAA,GAAY,IAAA;AACZ,MAAA,IAAA,GAAO,EAAA;AACP,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,QAAA,EAAU,OAAO,IAAA;AACjC,MAAA,IAAI;AACF,QAAA,MAAA,CAAO,GAAA,EAAI;AAAA,MACb,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,YAAY,YAAA,EAAa;AAAA,IAC3D;AAAA,GACF;AACF;AC5DO,IAAM,wBAAA,GAA2B,KAAA;AAGxC,IAAM,oBAAA,GAAuB,CAAA;AAQtB,SAAS,wBAAwB,IAAA,EAAsB;AAC5D,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AACrC,EAAA,IAAI,CAAC,EAAA,CAAG,QAAA,CAAS,IAAI,GAAG,OAAO,EAAA;AAC/B,EAAA,OAAO,EAAA,CACJ,MAAM,IAAI,CAAA,CACV,IAAI,CAAC,IAAA,KAAU,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,GAAI,KAAK,KAAA,CAAM,IAAA,CAAK,YAAY,IAAI,CAAA,GAAI,CAAC,CAAA,GAAI,IAAK,CAAA,CACnF,IAAA,CAAK,IAAI,CAAA;AACd;AAOO,SAAS,6BAAA,CAA8B,IAAA,EAAc,MAAA,GAAS,oBAAA,EAA8B;AACjG,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC7B,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,OAAO,CAAA,GAAI,MAAM,MAAA,EAAQ;AACvB,IAAA,IAAI,IAAI,CAAA,GAAI,CAAA;AACZ,IAAA,OAAO,CAAA,GAAI,MAAM,MAAA,IAAU,KAAA,CAAM,CAAC,CAAA,KAAM,KAAA,CAAM,CAAC,CAAA,EAAG,CAAA,EAAA;AAClD,IAAA,MAAM,MAAM,CAAA,GAAI,CAAA;AAChB,IAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,MAAA,GAAA,CAAI,KAAK,KAAA,CAAM,CAAC,CAAA,EAAI,CAAA,sBAAA,EAAe,GAAG,CAAA,UAAA,CAAI,CAAA;AAAA,IAC5C,CAAA,MAAO;AACL,MAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,CAAA,EAAG,KAAK,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAE,CAAA;AAAA,IAChD;AACA,IAAA,CAAA,GAAI,CAAA;AAAA,EACN;AACA,EAAA,OAAO,GAAA,CAAI,KAAK,IAAI,CAAA;AACtB;AAGA,SAAS,aAAA,CAAc,GAAW,QAAA,EAA0B;AAC1D,EAAA,IAAI,QAAA,IAAY,GAAG,OAAO,EAAA;AAE1B,EAAA,IAAI,OAAO,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,IAAK,UAAU,OAAO,CAAA;AACrD,EAAA,IAAI,EAAA,GAAK,CAAA;AACT,EAAA,IAAI,KAAK,CAAA,CAAE,MAAA;AACX,EAAA,OAAO,KAAK,EAAA,EAAI;AACd,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAA,CAAM,EAAA,GAAK,MAAM,CAAC,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,UAAA,CAAW,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,EAAG,MAAM,CAAA,IAAK,QAAA,EAAU,EAAA,GAAK,GAAA;AAAA,cACvD,GAAA,GAAM,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACtB;AAGA,SAAS,aAAA,CAAc,GAAW,QAAA,EAA0B;AAC1D,EAAA,IAAI,QAAA,IAAY,GAAG,OAAO,EAAA;AAE1B,EAAA,IAAI,OAAO,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,IAAK,UAAU,OAAO,CAAA;AACrD,EAAA,IAAI,EAAA,GAAK,CAAA;AACT,EAAA,IAAI,KAAK,CAAA,CAAE,MAAA;AACX,EAAA,OAAO,KAAK,EAAA,EAAI;AACd,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAA,CAAM,EAAA,GAAK,MAAM,CAAC,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,UAAA,CAAW,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,MAAA,GAAS,GAAG,CAAA,EAAG,MAAM,CAAA,IAAK,QAAA,EAAU,EAAA,GAAK,GAAA;AAAA,cAC/D,GAAA,GAAM,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,MAAA,GAAS,EAAE,CAAA;AAC9B;AAOO,SAAS,gBAAA,CAAiB,GAAW,QAAA,EAA0B;AACpE,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA;AACzC,EAAA,IAAI,KAAA,IAAS,UAAU,OAAO,CAAA;AAG9B,EAAA,MAAM,cAAA,GAAiB,EAAA;AACvB,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,WAAW,cAAc,CAAA;AACnD,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,IAAI,CAAA;AAC1C,EAAA,MAAM,IAAA,GAAO,aAAA,CAAc,CAAA,EAAG,UAAU,CAAA;AACxC,EAAA,MAAM,IAAA,GAAO,cAAc,CAAA,EAAG,KAAA,GAAQ,OAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAC,CAAA;AACrE,EAAA,MAAM,IAAA,GAAO,OAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA;AAC7E,EAAA,OAAO,GAAG,IAAI;AAAA,iBAAA,EAAiB,QAAQ,IAAI,CAAA;AAAA,EAAa,IAAI,CAAA,CAAA;AAC9D;AAOO,SAAS,sBAAA,CACd,GAAA,EACA,IAAA,GAA0C,EAAC,EACnC;AACR,EAAA,IAAI,CAAC,KAAK,OAAO,GAAA;AACjB,EAAA,IAAI,IAAA,GAAY,eAAU,GAAG,CAAA;AAC7B,EAAA,IAAA,GAAO,wBAAwB,IAAI,CAAA;AACnC,EAAA,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,WAAA,EAAa,EAAE,CAAA;AACnC,EAAA,IAAA,GAAO,8BAA8B,IAAI,CAAA;AACzC,EAAA,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,MAAM,CAAA;AACrC,EAAA,OAAO,gBAAA,CAAiB,IAAA,EAAM,IAAA,CAAK,QAAA,IAAY,wBAAwB,CAAA;AACzE;;;AC7KA,IAAM,gCAAA,GAAmC,CAAA;AACzC,IAAM,8BAAA,GAAiC,IAAA;AAIvC,IAAM,sBAAA,GAAyB,CAAA;AAC/B,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,4BAAA,GAA+B,EAAA;AACrC,IAAM,mBAAA,GAAsB,GAAA;AAarB,IAAM,iBAAN,MAAqB;AAAA,EACT,sBAAA;AAAA,EACA,mBAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,UAAA;AAAA,EAET,KAAA,GAAsB,QAAA;AAAA,EACtB,mBAAA,GAAsB,CAAA;AAAA,EACtB,SAAuB,EAAC;AAAA,EACxB,aAAA,GAA+B,IAAA;AAAA,EAC/B,UAAA,GAA4B,IAAA;AAAA;AAAA,EAE5B,QAAA,GAA0B,IAAA;AAAA,EAElC,WAAA,CAAY,MAAA,GAA+B,EAAC,EAAG;AAC7C,IAAA,IAAA,CAAK,sBAAA,GAAyB,OAAO,sBAAA,IAA0B,gCAAA;AAC/D,IAAA,IAAA,CAAK,mBAAA,GAAsB,OAAO,mBAAA,IAAuB,8BAAA;AACzD,IAAA,IAAA,CAAK,YAAA,GAAe,OAAO,YAAA,IAAgB,sBAAA;AAC3C,IAAA,IAAA,CAAK,QAAA,GAAW,OAAO,QAAA,IAAY,iBAAA;AACnC,IAAA,IAAA,CAAK,iBAAA,GAAoB,OAAO,iBAAA,IAAqB,4BAAA;AACrD,IAAA,IAAA,CAAK,UAAA,GAAa,OAAO,UAAA,IAAc,mBAAA;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,UAAA,GAAsB;AACxB,IAAA,IAAA,CAAK,qBAAA,EAAsB;AAC3B,IAAA,OAAO,KAAK,KAAA,KAAU,MAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAKA,QAAA,GAAmC;AACjC,IAAA,IAAA,CAAK,qBAAA,EAAsB;AAC3B,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,iBAAA,GAAmC,IAAA;AACvC,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,IAAA,IAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ;AACnD,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,QAAA;AAC3B,MAAA,iBAAA,GAAoB,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,aAAa,OAAO,CAAA;AAAA,IAC3D;AACA,IAAA,OAAO;AAAA,MACL,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,qBAAqB,IAAA,CAAK,mBAAA;AAAA,MAC1B,iBAAA,EAAmB,KAAK,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,CAAE,MAAA;AAAA,MACrD,aAAA,EAAe,KAAK,MAAA,CAAO,MAAA;AAAA,MAC3B,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,mBAAA,EAAqB,iBAAA;AAAA,MACrB,eAAe,IAAA,CAAK,aAAA;AAAA,MACpB,YAAY,IAAA,CAAK;AAAA,KACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,UAAA,CAAW,SAAS,KAAA,EAAgB;AAClC,IAAA,IAAI,QAAQ,OAAO,IAAA;AACnB,IAAA,IAAA,CAAK,qBAAA,EAAsB;AAC3B,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAQ,OAAO,KAAA;AAClC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,SAAA,CAAU,UAAA,EAAoB,MAAA,EAAiB,MAAA,GAAS,KAAA,EAAa;AACnE,IAAA,IAAI,MAAA,EAAQ;AAEZ,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAErB,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,IAAA,CAAK,KAAA,EAAM;AACX,QAAA;AAAA,MACF;AAEA,MAAA,IAAA,CAAK,MAAA,EAAO;AACZ,MAAA;AAAA,IACF;AAGA,IAAA,IAAA,CAAK,aAAa,GAAG,CAAA;AAErB,IAAA,MAAM,IAAA,GAAO,cAAc,IAAA,CAAK,mBAAA;AAChC,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,EAAE,IAAI,GAAA,EAAK,MAAA,EAAQ,MAAM,CAAA;AAE1C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAA,CAAK,mBAAA,EAAA;AACL,MAAA,IAAA,CAAK,aAAA,GAAgB,GAAA;AACrB,MAAA,IAAI,IAAA,CAAK,mBAAA,IAAuB,IAAA,CAAK,sBAAA,EAAwB;AAC3D,QAAA,IAAA,CAAK,KAAA,EAAM;AAAA,MACb;AACA,MAAA;AAAA,IACF;AAGA,IAAA,IAAA,CAAK,mBAAA,GAAsB,CAAA;AAE3B,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,IAAA,CAAK,UAAA,GAAa,GAAA;AAClB,MAAA,MAAM,SAAA,GAAY,KAAK,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,CAAE,MAAA;AACpD,MAAA,IAAI,SAAA,IAAa,KAAK,YAAA,EAAc;AAClC,QAAA,IAAA,CAAK,KAAA,EAAM;AAAA,MACb;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,KAAK,MAAA,CAAO,MAAA;AAC9B,IAAA,IAAI,SAAA,IAAa,KAAK,iBAAA,EAAmB;AAIvC,MAAA,IAAA,CAAK,KAAA,EAAM;AAAA,IACb;AAAA,EACF;AAAA;AAAA,EAGA,SAAA,GAAkB;AAChB,IAAA,IAAA,CAAK,KAAA,EAAM;AAAA,EACb;AAAA;AAAA,EAGA,UAAA,GAAmB;AACjB,IAAA,IAAA,CAAK,MAAA,EAAO;AAAA,EACd;AAAA,EAEQ,KAAA,GAAc;AACpB,IAAA,IAAI,IAAA,CAAK,UAAU,MAAA,EAAQ;AAC3B,IAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AACb,IAAA,IAAA,CAAK,QAAA,GAAW,KAAK,GAAA,EAAI;AAAA,EAC3B;AAAA,EAEQ,MAAA,GAAe;AACrB,IAAA,IAAA,CAAK,KAAA,GAAQ,QAAA;AACb,IAAA,IAAA,CAAK,mBAAA,GAAsB,CAAA;AAC3B,IAAA,IAAA,CAAK,SAAS,EAAC;AACf,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAAA,EAClB;AAAA;AAAA,EAGQ,qBAAA,GAA8B;AACpC,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,IAAU,IAAA,CAAK,aAAa,IAAA,EAAM;AACrD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,QAAA;AAClC,IAAA,IAAI,OAAA,IAAW,KAAK,UAAA,EAAY;AAC9B,MAAA,IAAA,CAAK,KAAA,GAAQ,WAAA;AACb,MAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAAA,IAClB;AAAA,EACF;AAAA,EAEQ,aAAa,GAAA,EAAmB;AACtC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA;AAC1B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAK,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,MAAM,CAAA;AAAA,EACxD;AACF,CAAA;;;AClNA,IAAM,uBAAA,GAAoC;AAAA;AAAA,EAExC,4NAAA;AAAA;AAAA,EAEA,iCAAA;AAAA,EACA,8CAAA;AAAA;AAAA,EAEA,iJAAA;AAAA;AAAA;AAAA,EAGA;AACF,CAAA;AAMO,SAAS,cAAc,GAAA,EAAqB;AACjD,EAAA,IAAI,MAAA,GAAS,GAAA;AACb,EAAA,KAAA,MAAW,WAAW,uBAAA,EAAyB;AAC7C,IAAA,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,CAAC,KAAA,KAAU;AAG1C,MAAA,MAAM,EAAA,GAAK,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AAC5B,MAAA,MAAM,EAAA,GAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAA;AAC5B,MAAA,MAAM,KAAA,GAAQ,OAAO,EAAA,GAAK,GAAA,GAAM,OAAO,EAAA,GAAK,KAAA,CAAM,EAAE,CAAA,GAAI,IAAA;AACxD,MAAA,IAAI,UAAU,IAAA,EAAM;AAClB,QAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,QAAQ,aAAA,CAAc,KAAK,CAAC,CAAA,GAAI,CAAC,CAAA;AACnE,QAAA,OAAO,GAAG,IAAI,CAAA,UAAA,CAAA;AAAA,MAChB;AAGA,MAAA,MAAM,UAAU,KAAA,CAAM,KAAA,CAAM,4BAA4B,CAAA,GAAI,CAAC,CAAA,IAAK,KAAA;AAClE,MAAA,OAAO,GAAG,OAAO,CAAA,aAAA,CAAA;AAAA,IACnB,CAAC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,MAAA;AACT;AAeA,IAAM,gBAAA,GAAmB,GAAA;AAelB,SAAS,cAAc,GAAA,EAAsB;AAClD,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,UAAA,EAAY,CAAC,MAAA,EAAQ,MAAA,CAAO,GAAG,CAAA,EAAG,IAAA,EAAM,IAAI,CAAA,EAAG;AAAA,MACnD,KAAA,EAAO,QAAA;AAAA,MACP,WAAA,EAAa;AAAA,KACd,EAAE,KAAA,EAAM;AACT,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,IAAM,sBAAN,MAA0B;AAAA,EACP,SAAA,uBAAgB,GAAA,EAA4B;AAAA,EAC5C,OAAA;AAAA,EAEjB,YAAY,aAAA,EAAsC;AAChD,IAAA,IAAA,CAAK,OAAA,GAAU,IAAI,cAAA,CAAe,aAAa,CAAA;AAAA,EACjD;AAAA,EAEA,SAAS,IAAA,EAAgG;AACvG,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,SAAA,EAAW,IAAA,CAAK,SAAA,IAAa,OAAO,CAAA;AAAA,EAC7F;AAAA;AAAA,EAGA,WAAW,GAAA,EAAmB;AAC5B,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,GAAG,CAAA;AAAA,EAC3B;AAAA;AAAA,EAGA,IAAI,GAAA,EAAyC;AAC3C,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,IAAA,GAAyB;AACvB,IAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA;AAAA,EAC3C;AAAA;AAAA,EAGA,OAAO,IAAA,EAAgC;AACrC,IAAA,OAAO,IAAA,CAAK,MAAK,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,IAAI,CAAA;AAAA,EAClD;AAAA;AAAA,EAGA,UAAU,SAAA,EAAqC;AAC7C,IAAA,OAAO,IAAA,CAAK,MAAK,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,SAAS,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,IAAI,WAAA,GAAsB;AACxB,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,SAAA,CAAU,MAAA,EAAO,EAAG;AACvC,MAAA,IAAI,CAAC,EAAE,MAAA,EAAQ,CAAA,EAAA;AAAA,IACjB;AACA,IAAA,OAAO,CAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAuB;AACrB,IAAA,OAAO;AAAA,MACL,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,UAAA,EAAY,KAAK,SAAA,CAAU,IAAA;AAAA,MAC3B,OAAA,EAAS,IAAA,CAAK,OAAA,CAAQ,QAAA;AAAS,KACjC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,UAAA,GAAsB;AACxB,IAAA,OAAO,KAAK,OAAA,CAAQ,UAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAA,CAAW,SAAS,KAAA,EAAgB;AAClC,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,MAAM,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAA,CAAU,UAAA,EAAoB,MAAA,EAAiB,MAAA,GAAS,KAAA,EAAa;AACnE,IAAA,IAAA,CAAK,OAAA,CAAQ,SAAA,CAAU,UAAA,EAAY,MAAA,EAAQ,MAAM,CAAA;AAAA,EACnD;AAAA;AAAA,EAGA,gBAAA,GAAyB;AACvB,IAAA,IAAA,CAAK,QAAQ,SAAA,EAAU;AAAA,EACzB;AAAA;AAAA,EAGA,iBAAA,GAA0B;AACxB,IAAA,IAAA,CAAK,QAAQ,UAAA,EAAW;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,IAAA,CAAK,GAAA,EAAa,IAAA,GAAiB,EAAC,EAAY;AAC9C,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AAChC,IAAA,IAAI,CAAC,GAAG,OAAO,KAAA;AACf,IAAA,IAAI,CAAA,CAAE,QAAQ,OAAO,IAAA;AACrB,IAAA,IAAI,CAAA,CAAE,WAAW,OAAO,KAAA;AAExB,IAAA,MAAM,EAAE,KAAA,GAAQ,KAAA,EAAO,OAAA,GAAU,kBAAiB,GAAI,IAAA;AACtD,IAAA,MAAMA,MAAAA,GAAW,aAAS,KAAM,OAAA;AAEhC,IAAA,IAAIA,MAAAA,EAAO;AAWT,MAAA,MAAM,aAAA,GAAgB,EAAE,KAAA,CAAM,QAAA,KAAa,QAAQ,OAAO,CAAA,CAAE,MAAM,GAAA,KAAQ,QAAA;AAC1E,MAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,GAAG,CAAA,EAAG;AACvC,QAAA,MAAM,QAAA,GAAW,WAAW,MAAM;AAChC,UAAA,IAAI,CAAA,CAAE,KAAA,CAAM,QAAA,KAAa,IAAA,EAAM;AAC7B,YAAA,IAAI;AACF,cAAA,CAAA,CAAE,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,YACxB,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF;AAAA,QACF,GAAG,OAAO,CAAA;AACV,QAAA,QAAA,CAAS,KAAA,IAAQ;AAAA,MACnB,CAAA,MAAO;AACL,QAAA,IAAI;AACF,UAAA,CAAA,CAAE,KAAA,CAAM,IAAA,CAAK,KAAA,GAAQ,SAAA,GAAY,SAAS,CAAA;AAAA,QAC5C,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AACA,MAAA,CAAA,CAAE,MAAA,GAAS,IAAA;AACX,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,GAAA,EAAK,SAAS,CAAA;AAAA,QAC9B,CAAA,CAAA,MAAQ;AACN,UAAA,CAAA,CAAE,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,QACxB;AAAA,MACF,CAAA,MAAO;AACL,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,GAAA,EAAK,SAAS,CAAA;AAAA,QAC9B,CAAA,CAAA,MAAQ;AACN,UAAA,CAAA,CAAE,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,QACxB;AAEA,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAE7B,UAAA,IAAI,IAAA,CAAK,UAAU,GAAA,CAAI,GAAG,KAAK,CAAC,CAAA,CAAE,MAAM,MAAA,EAAQ;AAC9C,YAAA,IAAI;AACF,cAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,GAAA,EAAK,SAAS,CAAA;AAAA,YAC9B,CAAA,CAAA,MAAQ;AACN,cAAA,IAAI;AACF,gBAAA,CAAA,CAAE,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,cACxB,CAAA,CAAA,MAAQ;AAAA,cAER;AAAA,YACF;AAAA,UACF;AAAA,QACF,GAAG,OAAO,CAAA;AACV,QAAA,KAAA,CAAM,KAAA,IAAQ;AAAA,MAChB;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,CAAA,CAAE,MAAA,GAAS,IAAA;AACX,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,CAAQ,IAAA,GAAiB,EAAC,EAAa;AACrC,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAC7C,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AAChC,MAAA,IAAI,CAAA,IAAK,CAAC,CAAA,CAAE,SAAA,IAAa,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,IAAI,CAAA,EAAG,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAAA,IAChE;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAA,CAAY,SAAA,EAAmB,IAAA,GAAiB,EAAC,EAAa;AAC5D,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,CAAU,SAAS,EAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,GAAG,CAAA;AACvD,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,IAAI,KAAK,IAAA,CAAK,GAAA,EAAK,IAAI,CAAA,EAAG,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF,CAAA;AAGA,IAAI,SAAA;AAEG,SAAS,kBAAA,GAA0C;AACxD,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,SAAA,GAAY,IAAI,mBAAA,EAAoB;AAAA,EACtC;AACA,EAAA,OAAO,SAAA;AACT;AC/UO,SAAS,oBAAoB,GAAA,EAAqB;AACvD,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS,OAAO,GAAA;AAKzC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,IAAK,IAAI,QAAA,CAAS,IAAI,CAAA,IAAUC,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAC,CAAA,EAAG;AACrF,IAAA,OAAO,GAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAA,CAAW,QAAQ,GAAA,CAAI,SAAS,KAAK,uCAAA,EACxC,WAAA,EAAY,CACZ,KAAA,CAAM,GAAG,CAAA;AAEZ,EAAA,MAAM,YAAY,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,IAAK,EAAA,EAAI,MAAWA,IAAA,CAAA,SAAS,CAAA;AAEjE,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,MAAM,IAAA,GAAYA,IAAA,CAAA,IAAA,CAAK,GAAA,EAAK,GAAG,CAAA;AAG/B,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,MAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,EAAG,GAAG,CAAA,CAAA;AAC1B,MAAA,IAAI;AACF,QAAG,EAAA,CAAA,UAAA,CAAW,IAAA,EAAS,EAAA,CAAA,SAAA,CAAU,IAAI,CAAA;AACrC,QAAA,OAAO,IAAA;AAAA,MACT,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAIA,EAAA,OAAO,GAAA;AACT;;;ACrCA,IAAM,KAAA,GAAQ,QAAQ,QAAA,KAAa,OAAA;AAEnC,IAAM,gBAAA,GAA6C;AAAA,EACjD,IAAA,EAAM,CAAC,WAAA,EAAa,IAAA,EAAM,qBAAqB,CAAA;AAAA,EAC/C,GAAA,EAAK,CAAC,WAAA,EAAa,MAAA,EAAQ,OAAO,QAAA,EAAU,MAAA,EAAQ,YAAY,OAAO,CAAA;AAAA,EACvE,MAAM,CAAC,WAAA,EAAa,UAAU,MAAA,EAAQ,MAAA,EAAQ,YAAY,OAAO,CAAA;AAAA,EACjE,GAAA,EAAK,CAAC,WAAW,CAAA;AAAA,EACjB,GAAA,EAAK;AAAA,IACH,WAAA;AAAA,IACA,QAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,EAAA,EAAI,CAAC,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AAAA,EACtB,KAAK,EAAC;AAAA,EACN,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,EACX,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,EACX,EAAA,EAAI,CAAC,IAAA,EAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EACrB,MAAM,EAAC;AAAA,EACP,MAAM,EAAC;AAAA,EACP,MAAM,EAAC;AAAA,EACP,KAAA,EAAO,CAAC,IAAI,CAAA;AAAA,EACZ,EAAA,EAAI,CAAC,IAAI,CAAA;AAAA,EACT,IAAI,EAAC;AAAA,EACL,EAAA,EAAI,CAAC,KAAK,CAAA;AAAA,EACV,OAAO,EAAC;AAAA,EACR,GAAA,EAAK,CAAC,WAAW,CAAA;AAAA,EACjB,GAAA,EAAK,CAAC,WAAA,EAAa,UAAA,EAAY,WAAW,CAAA;AAAA,EAC1C,MAAA,EAAQ,CAAC,WAAA,EAAa,KAAA,EAAO,YAAY,CAAA;AAAA,EACzC,KAAA,EAAO,CAAC,WAAA,EAAa,MAAA,EAAQ,UAAU,OAAO,CAAA;AAAA,EAC9C,KAAA,EAAO,CAAC,WAAA,EAAa,OAAA,EAAS,QAAQ,OAAO,CAAA;AAAA,EAC7C,KAAA,EAAO,CAAC,WAAW,CAAA;AAAA,EACnB,EAAA,EAAI,CAAC,SAAA,EAAW,KAAA,EAAO,SAAS,MAAM,CAAA;AAAA,EACtC,MAAA,EAAQ,CAAC,WAAW,CAAA;AAAA,EACpB,GAAA,EAAK,CAAC,WAAA,EAAa,MAAM,CAAA;AAAA,EACzB,MAAA,EAAQ,CAAC,WAAA,EAAa,IAAA,EAAM,QAAQ,CAAA;AAAA,EACpC,OAAA,EAAS,CAAC,SAAA,EAAW,KAAA,EAAO,YAAY,MAAM;AAChD,CAAA;AAEA,IAAM,QAAA,GAAW,EAAA;AAKjB,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,kBAAA,GAAqB,GAAA;AAK3B,IAAM,oBAAA,GAAiD;AAAA;AAAA,EAErD,MAAA,EAAQ,CAAC,KAAA,EAAO,aAAA,EAAe,QAAQ,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnD,GAAA,EAAK;AAAA,IACH,UAAA;AAAA,IACA,iBAAA;AAAA,IACA,kBAAA;AAAA,IACA,MAAA;AAAA,IACA,MAAA;AAAA,IACA,YAAA;AAAA,IACA,MAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACF;AAAA;AAAA,EAEA,MAAM,CAAC,MAAA,EAAQ,aAAA,EAAe,MAAA,EAAQ,YAAY,kBAAkB,CAAA;AAAA;AAAA,EAEpE,EAAA,EAAI,CAAC,YAAY,CAAA;AAAA;AAAA,EAEjB,KAAK,CAAC,aAAA,EAAe,OAAA,EAAS,QAAA,EAAU,YAAY,QAAQ,CAAA;AAAA;AAAA;AAAA,EAG5D,QAAQ,CAAC,SAAA,EAAW,OAAA,EAAS,QAAA,EAAU,UAAU,QAAQ,CAAA;AAAA;AAAA,EAEzD,IAAA,EAAM,CAAC,SAAA,EAAW,UAAA,EAAY,OAAA,EAAS,UAAU,YAAA,EAAc,aAAA,EAAe,SAAA,EAAW,OAAA,EAAS,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9G,EAAA,EAAI,CAAC,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAO,QAAQ,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,MAAM,CAAA;AAAA;AAAA,EAE1E,GAAA,EAAK,CAAC,OAAA,EAAS,QAAA,EAAU,YAAY,QAAA,EAAU,QAAA,EAAU,aAAa,UAAU,CAAA;AAAA;AAAA,EAEhF,IAAA,EAAM,CAAC,OAAA,EAAS,OAAA,EAAS,UAAU,UAAA,EAAY,QAAA,EAAU,QAAA,EAAU,WAAA,EAAa,UAAU,CAAA;AAAA;AAAA;AAAA,EAG1F,GAAA,EAAK,CAAC,UAAU;AAClB,CAAA;AAEA,SAAS,YAAA,CAAa,KAAa,IAAA,EAA+B;AAChE,EAAA,MAAM,OAAA,GAAU,qBAAqB,GAAG,CAAA;AACxC,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AAErB,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,KAAA,MAAW,WAAW,OAAA,EAAS;AAC7B,MAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AACrB,QAAA,OAAO,CAAA,kBAAA,EAAqB,GAAG,CAAA,eAAA,EAAkB,GAAG,+BAA+B,OAAO,CAAA,CAAA,CAAA;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAmBO,IAAM,QAAA,GAAwC;AAAA,EACnD,IAAA,EAAM,MAAA;AAAA,EACN,QAAA,EAAU,OAAA;AAAA,EACV,WAAA,EACE,sTAAA;AAAA,EAGF,SAAA,EACE,+gBAAA;AAAA,EAOF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,IAAA;AAAA,EACV,QAAA,EAAU,UAAA;AAAA,EACV,SAAA,EAAW,kBAAA;AAAA,EACX,YAAA,EAAc,CAAC,kBAAkB,CAAA;AAAA,EACjC,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,IAAA,EAAM,OAAA;AAAA,QACN,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,QACxB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,GAAA,EAAK;AAAA,QACH,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf,KACF;AAAA,IACA,QAAA,EAAU,CAAC,SAAS;AAAA,GACtB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,MAAM,WAAW,kBAAA,EAAmB;AACpC,IAAA,IAAI,CAAC,SAAS,UAAA,EAAY;AACxB,MAAA,OAAO;AAAA,QACL,SAAS,KAAA,CAAM,OAAA;AAAA,QACf,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,EAAC;AAAA,QACrB,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,2FAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AAC/B,IAAA,IAAI,CAAC,GAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,MAAM,EAAC;AAAA,QACP,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,eAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAEF,IAAA,IAAI,EAAE,OAAO,gBAAA,CAAA,EAAmB;AAC9B,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,EAAC;AAAA,QACrB,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,YAAY,GAAG,CAAA,6DAAA,CAAA;AAAA,QACvB,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,MAAM,QAAQ,KAAA,CAAM,IAAA,IAAQ,EAAC,EAAG,KAAA,CAAM,GAAG,QAAQ,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,KAAA,CAAM,OAAA,IAAW,kBAAA,EAAoB,kBAAkB,CAAC,CAAA;AAG7F,IAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAA,EAAK,IAAI,CAAA;AACvC,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,QAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAIA,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,GAAWC,IAAA,CAAA,OAAA,CAAQ,IAAI,WAAA,EAAa,KAAA,CAAM,GAAG,CAAA,GAAI,GAAA,CAAI,GAAA;AAChF,IAAA,MAAM,GAAA,GAAWA,IAAA,CAAA,QAAA,CAAS,GAAA,CAAI,WAAA,EAAa,YAAY,CAAA;AACvD,IAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAUA,IAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAChD,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,CAAA,KAAA,EAAQ,KAAA,CAAM,GAAG,CAAA,+BAAA,CAAA;AAAA,QACzB,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,YAAA;AACZ,IAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AAEpB,IAAA,OAAO,UAAA,CAAW,KAAK,IAAA,EAAM,GAAA,EAAK,SAAS,MAAA,EAAQ,GAAA,CAAI,SAAS,EAAE,CAAA;AAAA,EACpE;AACF;AAEA,SAAS,WACP,GAAA,EACA,IAAA,EACA,GAAA,EACA,OAAA,EACA,QACA,SAAA,EACqB;AACrB,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACC,QAAAA,KAAY;AAC9B,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,KAAA;AACb,IAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAI3B,IAAA,MAAM,KAAA,GAAQ,kBAAkB,EAAE,IAAA,EAAM,QAAQ,GAAG,CAAA,CAAA,EAAI,cAAA,EAAgB,UAAA,EAAY,CAAA;AAMnF,IAAA,MAAM,QAAA,GAAW,oBAAoB,GAAG,CAAA;AACxC,IAAA,MAAM,UAAA,GAAa,UAAU,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,IAAK,QAAA,CAAS,SAAS,MAAM,CAAA,CAAA;AAMlF,IAAA,MAAM,KAAA,GAAQC,KAAAA,CAAM,QAAA,EAAU,IAAA,EAAM;AAAA,MAClC,GAAA;AAAA,MACA,GAAA,EAAK,cAAc,SAAS,CAAA;AAAA,MAC5B,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAAA,MAChC,WAAA,EAAa,IAAA;AAAA,MACb,GAAI,KAAA,GAAQ,EAAC,GAAI,EAAE,MAAA,EAAO;AAAA,MAC1B,GAAI,aAAa,EAAE,KAAA,EAAO,MAAM,wBAAA,EAA0B,IAAA,KAAS;AAAC,KACrE,CAAA;AAED,IAAA,MAAM,WAAW,kBAAA,EAAmB;AACpC,IAAA,MAAM,MAAM,KAAA,CAAM,GAAA;AAClB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,MAAA,MAAM,cAAc,CAAA,EAAG,GAAG,IAAI,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAC5C,MAAA,QAAA,CAAS,QAAA,CAAS,EAAE,GAAA,EAAK,IAAA,EAAM,QAAQ,OAAA,EAAS,aAAA,CAAc,WAAW,CAAA,EAAG,WAAW,IAAA,CAAK,GAAA,EAAI,EAAG,SAAA,EAAW,OAAO,CAAA;AAAA,IACvH;AAEA,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,QAAA,CAAS,KAAK,GAAG,CAAA;AAAA,WACzC,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,IAC3B,GAAG,OAAO,CAAA;AAEV,IAAA,MAAM,UAAU,MAAM;AACpB,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,IAAI,OAAO,QAAQ,QAAA,EAAU,QAAA,CAAS,KAAK,GAAA,EAAK,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,WAC1D,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,IAC3B,CAAA;AACA,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAI,MAAA,CAAO,SAAS,OAAA,EAAQ;AAAA,kBAChB,gBAAA,CAAiB,OAAA,EAAS,SAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,IAC/D;AAEA,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,EAAS;AAC5B,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,UAAA,EAAY,MAAA,IAAU,IAAA;AAC1C,MAAA,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClB,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,EAAS;AAC5B,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,UAAA,EAAY,MAAA,IAAU,IAAA;AAC1C,MAAA,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClB,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AACtD,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,QAAA,CAAS,WAAW,GAAG,CAAA;AACpD,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAChC,MAAA,MAAM,QAAA,GAAW,MAAA,GAAS,GAAA,GAAO,IAAA,IAAQ,CAAA;AACzC,MAAA,QAAA,CAAS,SAAA,CAAU,UAAA,EAAY,QAAA,KAAa,CAAC,CAAA;AAC7C,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,EAAS;AAC/B,MAAAD,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,QAAQ,sBAAA,CAAuB,MAAM,KAAK,OAAA,GAAU,SAAA,CAAU,OAAO,CAAA,GAAI,EAAA,CAAA;AAAA,QACzE,MAAA,EAAQ,uBAAuB,MAAM,CAAA;AAAA,QACrC,QAAA;AAAA,QACA,SAAA,EACE,MAAA,CAAO,UAAA,CAAW,MAAA,EAAQ,MAAM,CAAA,GAAI,wBAAA,IACpC,MAAA,CAAO,UAAA,CAAW,MAAA,EAAQ,MAAM,CAAA,GAAI,wBAAA;AAAA,QACtC,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AACtD,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,QAAA,CAAS,WAAW,GAAG,CAAA;AACpD,MAAA,QAAA,CAAS,SAAA,CAAU,IAAA,CAAK,GAAA,EAAI,GAAI,WAAW,IAAI,CAAA;AAC/C,MAAA,KAAA,CAAM,QAAA,EAAS;AACf,MAAAA,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,uBAAuB,MAAM,CAAA;AAAA,QACrC,QAAQ,GAAA,CAAI,OAAA;AAAA,QACZ,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,MAAA,CAAO,UAAA,CAAW,MAAA,EAAQ,MAAM,CAAA,GAAI,wBAAA;AAAA,QAC/C,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"exec.js","sourcesContent":["/**\n * _output-spool — file-based capture of FULL command output.\n *\n * Command tools (bash/exec and the _spawn-stream consumers) cap what they\n * keep in memory and what reaches the model (COMMAND_OUTPUT_MAX_BYTES head+\n * tail). Everything past the cap used to be silently dropped, which pushed\n * agents to re-run commands with bigger buffers or stuff huge outputs into\n * chat history. The spool keeps the host's memory and the context window\n * small while losing nothing: once a command's output exceeds the in-memory\n * threshold, the FULL stream is written to a log file under\n * `~/.wrongstack/tool-output/` and the capped tool result carries a\n * `[full output: <path>]` marker so the model can read/grep the file\n * selectively instead of dumping it into context.\n *\n * Properties:\n *   - zero disk I/O for small outputs (file is created lazily on first byte\n *     past the threshold; the buffered head is flushed at that moment)\n *   - bounded memory: the head buffer never exceeds the threshold, and disk\n *     backpressure drops chunks past a 4 MB writable-buffer high-water mark\n *     (counted and reported in the marker) instead of queueing them on the heap\n *   - best-effort: any fs error disables the spool silently — command tools\n *     must never fail because diagnostics couldn't be written\n *   - retention: spool files older than 7 days are swept once per process\n */\nimport { createWriteStream, mkdirSync, type WriteStream } from 'node:fs';\nimport * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport { wstackGlobalRoot } from '@wrongstack/core';\n\nconst SPOOL_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;\n/** Stop queueing chunks on the heap when the fs stream falls this far behind. */\nconst SPOOL_WRITE_HWM_BYTES = 4 * 1024 * 1024;\n\nlet sweepStarted = false;\n\n/** Directory for spooled command output (under the wstack global root). */\nexport function toolOutputDir(): string {\n  return path.join(wstackGlobalRoot(), 'tool-output');\n}\n\n/** Reset module state — test hook (per-process sweep memo + nothing else). */\nexport function _resetOutputSpoolForTests(): void {\n  sweepStarted = false;\n}\n\nfunction sweepOldSpoolFiles(dir: string): void {\n  if (sweepStarted) return;\n  sweepStarted = true;\n  void (async () => {\n    try {\n      const now = Date.now();\n      for (const name of await fsp.readdir(dir)) {\n        if (!name.endsWith('.log')) continue;\n        const p = path.join(dir, name);\n        try {\n          const st = await fsp.stat(p);\n          if (now - st.mtimeMs > SPOOL_RETENTION_MS) await fsp.unlink(p);\n        } catch {\n          /* concurrently removed — ignore */\n        }\n      }\n    } catch {\n      /* directory doesn't exist yet — nothing to sweep */\n    }\n  })();\n}\n\nexport interface SpoolInfo {\n  /** Absolute path of the spool file. */\n  path: string;\n  /** Total bytes of output produced (including what reached the file). */\n  bytes: number;\n  /** Bytes dropped due to disk backpressure (0 in the normal case). */\n  droppedBytes: number;\n}\n\nexport interface OutputSpool {\n  /** Feed every raw output chunk. Never throws. */\n  write(text: string): void;\n  /**\n   * Close the file (if one was opened) and return its info, or null when the\n   * output never exceeded the threshold. Idempotent.\n   */\n  finalize(): SpoolInfo | null;\n}\n\nexport interface CreateOutputSpoolOptions {\n  /** Tool name used in the spool filename (sanitized). */\n  tool: string;\n  /**\n   * Output size at which the spool activates. Should match the tool's\n   * in-memory cap so files are only created for output the model can't\n   * already see in full. Default 32 KB.\n   */\n  thresholdBytes?: number | undefined;\n}\n\n/**\n * Render the marker line appended to a capped tool result. Kept in one place\n * so every command tool phrases it identically (and tests can match it).\n */\nexport function spoolNote(info: SpoolInfo): string {\n  const dropped =\n    info.droppedBytes > 0 ? `, ~${info.droppedBytes} bytes dropped under backpressure` : '';\n  return `\\n[output truncated — full ${info.bytes} bytes at ${info.path}${dropped}; read/grep that file selectively instead of re-running with more output]`;\n}\n\nexport function createOutputSpool(opts: CreateOutputSpoolOptions): OutputSpool {\n  const threshold = opts.thresholdBytes ?? 32_768;\n  const safeTool = opts.tool.replace(/[^a-zA-Z0-9._-]+/g, '_').slice(0, 40) || 'tool';\n\n  let head = '';\n  let headBytes = 0;\n  let totalBytes = 0;\n  let droppedBytes = 0;\n  let stream: WriteStream | null = null;\n  let filePath: string | null = null;\n  let failed = false;\n  let finalized = false;\n\n  const open = (): void => {\n    if (stream || failed) return;\n    try {\n      const dir = toolOutputDir();\n      // Synchronous on purpose: createWriteStream would race an async mkdir\n      // and error with ENOENT. This runs at most once per oversized command,\n      // and after the first call the dir exists (mkdirSync is a no-op stat).\n      mkdirSync(dir, { recursive: true });\n      sweepOldSpoolFiles(dir);\n      const stamp = new Date().toISOString().replace(/[:.]/g, '-');\n      const rand = Math.random().toString(36).slice(2, 6);\n      filePath = path.join(dir, `${stamp}-${safeTool}-${rand}.log`);\n      stream = createWriteStream(filePath, { flags: 'w', encoding: 'utf8' });\n      stream.on('error', () => {\n        // Disk full / permission — disable the spool, keep the tool alive.\n        failed = true;\n        stream = null;\n        filePath = null;\n      });\n      // Flush the buffered head first so the file is the complete output.\n      stream.write(head);\n    } catch {\n      failed = true;\n      stream = null;\n      filePath = null;\n    }\n  };\n\n  return {\n    write(text: string): void {\n      if (finalized || !text) return;\n      totalBytes += Buffer.byteLength(text, 'utf8');\n      if (!stream && !failed) {\n        if (headBytes + text.length <= threshold) {\n          head += text;\n          headBytes += text.length;\n          return;\n        }\n        head += text; // include the crossing chunk so the file misses nothing\n        open();\n        head = ''; // flushed into the stream by open(); release the heap copy\n        return;\n      }\n      if (stream) {\n        if (stream.writableLength > SPOOL_WRITE_HWM_BYTES) {\n          droppedBytes += Buffer.byteLength(text, 'utf8');\n          return;\n        }\n        stream.write(text);\n      }\n    },\n    finalize(): SpoolInfo | null {\n      if (finalized) {\n        return filePath ? { path: filePath, bytes: totalBytes, droppedBytes } : null;\n      }\n      finalized = true;\n      head = '';\n      if (!stream || !filePath) return null;\n      try {\n        stream.end();\n      } catch {\n        /* already closed */\n      }\n      return { path: filePath, bytes: totalBytes, droppedBytes };\n    },\n  };\n}\n","import * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core';\nimport type { Context } from '@wrongstack/core';\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm → yarn → npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  // If allowOutsideProjectRoot is true, skip the project-root restriction.\n  if (ctx.allowOutsideProjectRoot) return path.resolve(absPath);\n  const root = path.resolve(ctx.projectRoot);\n  const target = path.resolve(absPath);\n  const rel = path.relative(root, target);\n  if (rel.startsWith('..') || path.isAbsolute(rel)) {\n    throw new Error(`Path \"${absPath}\" is outside project root \"${root}\"`);\n  }\n  return target;\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root→out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink — macOS `/var`→`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  // If allowOutsideProjectRoot is true, skip the symlink-escape check.\n  if (ctx.allowOutsideProjectRoot) return;\n  const realRoot = await fsp.realpath(ctx.projectRoot).catch(() => path.resolve(ctx.projectRoot));\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    const rel = path.relative(realRoot, real);\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\n      throw new Error(\n        `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoot}\"`,\n      );\n    }\n    return;\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// ─── Command-output normalization (token-saving) ────────────────────────────\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) — never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only — it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `… ⟨repeated ${run}×⟩`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends — the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n…[truncated ${total - kept} bytes]…\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI → collapse\n * carriage-return progress → trim trailing whitespace → collapse identical\n * consecutive lines → squeeze blank-line runs → head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines → 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n","/**\n * CircuitBreaker — prevents runaway bash/exec tool chains by:\n *\n *   - Tripping on consecutive failures (models that keep repeating the\n *     same failing command, e.g. `npm install` with wrong args in a loop)\n *   - Tripping on slow call ratio (too many long-running commands suggest\n *     a hung subprocess that the model doesn't know how to kill)\n *   - Rate-limiting bursts (rapid succession of commands without reading\n *     output suggests the model isn't processing results)\n *   - Auto-recovering after a cooldown period so a fixed model can resume\n *\n * The breaker is owned by the ProcessRegistry so any tool that registers\n * a process participates in the same circuit. \"Per-tool\" isolation is\n * intentionally NOT implemented — the model treats bash/exec as one\n * resource pool; isolating them would let the model route around the\n * breaker by alternating which tool it uses.\n */\n\nexport interface CircuitBreakerConfig {\n  /**\n   * Consecutive failures before trip. Default: 5.\n   * A single success resets this counter to 0.\n   */\n  maxConsecutiveFailures?: number | undefined;\n  /**\n   * Slow-call threshold in ms. A call that runs longer than this is\n   * counted as \"slow\". Default: 60_000 (1 minute).\n   */\n  slowCallThresholdMs?: number | undefined;\n  /**\n   * Max slow calls before trip (within the sliding window). Default: 3.\n   */\n  maxSlowCalls?: number | undefined;\n  /**\n   * Sliding window for rate-limit and slow-call counting, in ms.\n   * Default: 60_000 (1 minute).\n   */\n  windowMs?: number | undefined;\n  /**\n   * Max calls within the sliding window. Default: 30.\n   * Burst exceeding this trips the breaker immediately.\n   */\n  maxCallsPerWindow?: number | undefined;\n  /**\n   * Cooldown before auto-recovery attempt, in ms. Default: 30_000 (30s).\n   * After this the breaker enters \"half-open\" state and allows one call\n   * through to test whether the problem is resolved.\n   */\n  cooldownMs?: number | undefined;\n}\n\ninterface CallRecord {\n  at: number;\n  /** True if the call threw or returned an is_error result. */\n  failed: boolean;\n  /** True if elapsed time exceeded slowCallThresholdMs. */\n  slow: boolean;\n}\n\ntype BreakerState = 'closed' | 'open' | 'half-open';\n\nconst DEFAULT_MAX_CONSECUTIVE_FAILURES = 5;\nconst DEFAULT_SLOW_CALL_THRESHOLD_MS = 180_000;\n// 3 minutes — balanced against the 5-minute bash timeout. Commands\n// running <3min are normal; 3-5min are \"slow\" and count toward the\n// breaker. 3 consecutive slow calls trip the circuit.\nconst DEFAULT_MAX_SLOW_CALLS = 3;\nconst DEFAULT_WINDOW_MS = 60_000;\nconst DEFAULT_MAX_CALLS_PER_WINDOW = 30;\nconst DEFAULT_COOLDOWN_MS = 30_000;\n\nexport interface CircuitBreakerSnapshot {\n  state: 'closed' | 'open' | 'half-open';\n  consecutiveFailures: number;\n  slowCallsInWindow: number;\n  callsInWindow: number;\n  windowMs: number;\n  cooldownRemainingMs: number | null;\n  lastFailureAt: number | null;\n  lastSlowAt: number | null;\n}\n\nexport class CircuitBreaker {\n  private readonly maxConsecutiveFailures: number;\n  private readonly slowCallThresholdMs: number;\n  private readonly maxSlowCalls: number;\n  private readonly windowMs: number;\n  private readonly maxCallsPerWindow: number;\n  private readonly cooldownMs: number;\n\n  private state: BreakerState = 'closed';\n  private consecutiveFailures = 0;\n  private window: CallRecord[] = [];\n  private lastFailureAt: number | null = null;\n  private lastSlowAt: number | null = null;\n  /** Timestamp when the breaker was opened (for cooldown calculation). */\n  private openedAt: number | null = null;\n\n  constructor(config: CircuitBreakerConfig = {}) {\n    this.maxConsecutiveFailures = config.maxConsecutiveFailures ?? DEFAULT_MAX_CONSECUTIVE_FAILURES;\n    this.slowCallThresholdMs = config.slowCallThresholdMs ?? DEFAULT_SLOW_CALL_THRESHOLD_MS;\n    this.maxSlowCalls = config.maxSlowCalls ?? DEFAULT_MAX_SLOW_CALLS;\n    this.windowMs = config.windowMs ?? DEFAULT_WINDOW_MS;\n    this.maxCallsPerWindow = config.maxCallsPerWindow ?? DEFAULT_MAX_CALLS_PER_WINDOW;\n    this.cooldownMs = config.cooldownMs ?? DEFAULT_COOLDOWN_MS;\n  }\n\n  /**\n   * Returns true if the circuit allows a new call to proceed.\n   * When false, callers should abort the tool call and return a\n   * circuit-breaker error instead of spawning a process.\n   */\n  get canProceed(): boolean {\n    this._checkStateTransition();\n    return this.state !== 'open';\n  }\n\n  /**\n   * Snapshot of the current breaker state for observability (`/kill`).\n   */\n  snapshot(): CircuitBreakerSnapshot {\n    this._checkStateTransition();\n    const now = Date.now();\n    let cooldownRemaining: number | null = null;\n    if (this.openedAt !== null && this.state === 'open') {\n      const elapsed = now - this.openedAt;\n      cooldownRemaining = Math.max(0, this.cooldownMs - elapsed);\n    }\n    return {\n      state: this.state,\n      consecutiveFailures: this.consecutiveFailures,\n      slowCallsInWindow: this.window.filter((c) => c.slow).length,\n      callsInWindow: this.window.length,\n      windowMs: this.windowMs,\n      cooldownRemainingMs: cooldownRemaining,\n      lastFailureAt: this.lastFailureAt,\n      lastSlowAt: this.lastSlowAt,\n    };\n  }\n\n  /**\n   * Call this BEFORE spawning a bash/exec process.\n   * Returns true if the call is allowed; false if the breaker is open.\n   * When false, callers MUST NOT spawn a process.\n   *\n   * @param bypass - If true, skip the circuit breaker check entirely.\n   *                  Use for background/fire-and-forget processes that should\n   *                  not affect breaker state.\n   */\n  beforeCall(bypass = false): boolean {\n    if (bypass) return true;\n    this._checkStateTransition();\n    if (this.state === 'open') return false;\n    return true;\n  }\n\n  /**\n   * Call this AFTER a bash/exec process finishes (success or failure).\n   * `durationMs` is the wall-clock time the process ran.\n   * `failed` is true when the process returned a non-zero exit code or\n   * threw an exception before spawning.\n   *\n   * @param bypass - If true, do not update breaker state.\n   *                  Use for background/fire-and-forget processes.\n   */\n  afterCall(durationMs: number, failed: boolean, bypass = false): void {\n    if (bypass) return;\n\n    const now = Date.now();\n\n    if (this.state === 'half-open') {\n      // First call through after cooldown — if it failed, go back to open.\n      if (failed) {\n        this._trip();\n        return;\n      }\n      // Success in half-open → reset to closed.\n      this._reset();\n      return;\n    }\n\n    // Prune old records outside the sliding window.\n    this._pruneWindow(now);\n\n    const slow = durationMs >= this.slowCallThresholdMs;\n    this.window.push({ at: now, failed, slow });\n\n    if (failed) {\n      this.consecutiveFailures++;\n      this.lastFailureAt = now;\n      if (this.consecutiveFailures >= this.maxConsecutiveFailures) {\n        this._trip();\n      }\n      return;\n    }\n\n    // Success: reset consecutive failure counter.\n    this.consecutiveFailures = 0;\n\n    if (slow) {\n      this.lastSlowAt = now;\n      const slowCount = this.window.filter((c) => c.slow).length;\n      if (slowCount >= this.maxSlowCalls) {\n        this._trip();\n      }\n    }\n\n    const callCount = this.window.length;\n    if (callCount >= this.maxCallsPerWindow) {\n      // Rate limit exceeded. This is a soft trip — we reset the window\n      // and let the next call try immediately (the caller will still see\n      // canProceed=false until the window drains naturally).\n      this._trip();\n    }\n  }\n\n  /** Force the breaker open. Used by /kill force and Ctrl+C. */\n  forceOpen(): void {\n    this._trip();\n  }\n\n  /** Force a reset to closed. Used by tests and /kill reset. */\n  forceReset(): void {\n    this._reset();\n  }\n\n  private _trip(): void {\n    if (this.state === 'open') return; // already open\n    this.state = 'open';\n    this.openedAt = Date.now();\n  }\n\n  private _reset(): void {\n    this.state = 'closed';\n    this.consecutiveFailures = 0;\n    this.window = [];\n    this.openedAt = null;\n  }\n\n  /** Transition from open → half-open when cooldown elapses. */\n  private _checkStateTransition(): void {\n    if (this.state !== 'open' || this.openedAt === null) return;\n    const elapsed = Date.now() - this.openedAt;\n    if (elapsed >= this.cooldownMs) {\n      this.state = 'half-open';\n      this.openedAt = null;\n    }\n  }\n\n  private _pruneWindow(now: number): void {\n    const cutoff = now - this.windowMs;\n    this.window = this.window.filter((c) => c.at >= cutoff);\n  }\n}","import { expectDefined } from '@wrongstack/core';\n/**\n * ProcessRegistry — global singleton that tracks all spawned child processes\n * from `bash` and `exec` tools. Enables:\n *\n *   - Listing active processes (for TUI status bar)\n *   - Killing individual processes or all processes (for Ctrl+C and /kill)\n *   - Detecting runaway processes (hung, looping)\n *   - Circuit breaker integration to prevent recursive/repeated failures\n *\n * Thread-safety: Node.js is single-threaded, but async callbacks can fire\n * in any order. All mutations go through synchronized Map methods.\n */\nimport { spawn } from 'node:child_process';\nimport type { ChildProcess } from 'node:child_process';\nimport * as os from 'node:os';\nimport { CircuitBreaker, type CircuitBreakerSnapshot, type CircuitBreakerConfig } from './circuit-breaker.js';\nexport type { CircuitBreakerSnapshot, CircuitBreakerConfig } from './circuit-breaker.js';\n\nexport interface TrackedProcess {\n  pid: number;\n  name: string;\n  /** Display-safe redacted command string — safe for logs, /ps, crash dumps.\n   *  Contains [REDACTED] in place of sensitive flag values. */\n  command: string;\n  startedAt: number;\n  sessionId?: string | undefined;\n  /** The raw ChildProcess handle. Never call .kill() directly on this —\n   *  use `kill()` below which handles process groups correctly on POSIX\n   *  and degrades gracefully on Windows. */\n  child: ChildProcess;\n  /** True once the process has been kill()ed but not yet exited.\n   *  We keep it in the registry until 'close' fires so callers can\n   *  distinguish \"still running\" from \"just exited\". */\n  killed: boolean;\n  /** If true, kill() and killAll() will refuse to kill this process.\n   *  Used for infrastructure processes (browser, dev servers, …) that\n   *  must outlive the agent session. */\n  protected: boolean;\n}\n\n// Sensitive CLI flag patterns that may appear in process command lines.\n// Redacted to [REDACTED] so crash dumps /ps output cannot leak secrets.\nconst SENSITIVE_FLAG_PATTERNS: RegExp[] = [\n  // --flag=value  or  --flag \"value\"  (value captured up to next space or comma)\n  /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\\s,][^\\s]*)?/gi,\n  // -f \"value\" style short flags\n  /(?<!\\w)-t(?:\\s+|\\s*=\\s*)[^\\s,]+/,\n  /(?<!\\w)-p(?:ssword)?(?:\\s+|\\s*=\\s*)[^\\s,]+/gi,\n  // env var–style secrets: TOKEN=x, API_KEY=y, etc.\n  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\\s*[=:]\\s*[^\\s,]+/gi,\n  // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only\n  // when preceded by a flag name (e.g. --github-token=EyJ...).\n  /--\\w*(?:token|key|secret|password|passwd|auth|credential)\\w*[=\\s,][A-Za-z0-9+/=]{32,}/,\n];\n\n/**\n * Returns a display-safe copy of `cmd` with sensitive flag values replaced by [REDACTED].\n * The original string is unchanged; this is pure and has no side effects.\n */\nexport function redactCommand(cmd: string): string {\n  let result = cmd;\n  for (const pattern of SENSITIVE_FLAG_PATTERNS) {\n    result = result.replace(pattern, (match) => {\n      // Preserve the flag name portion; redact only the value part.\n      // e.g. \"--token=sekrit_abc\"  →  \"--token=[REDACTED]\"\n      const eq = match.indexOf('=');\n      const sp = match.search(/\\s/);\n      const delim = eq !== -1 ? '=' : sp !== -1 ? match[sp] : null;\n      if (delim !== null) {\n        const flag = match.slice(0, match.indexOf(expectDefined(delim)) + 1);\n        return `${flag}[REDACTED]`;\n      }\n      // Nothing delimitable found; replace the whole token silently.\n      // Short flags like -tVALUE are replaced entirely to avoid edge cases.\n      const flagEnd = match.match(/^--?[a-zA-Z][a-zA-Z0-9_-]*/)?.[0] ?? match;\n      return `${flagEnd}=**redacted**`;\n    });\n  }\n  return result;\n}\n\ninterface KillOpts {\n  /** SIGKILL instead of SIGTERM. Default: false (SIGTERM first). */\n  force?: boolean | undefined;\n  /** MS to wait between SIGTERM and SIGKILL on POSIX. Default: 2000. */\n  graceMs?: number | undefined;\n}\n\nexport interface RegistryStats {\n  activeCount: number;\n  totalCount: number;\n  breaker: CircuitBreakerSnapshot;\n}\n\nconst DEFAULT_GRACE_MS = 2000;\n\n/**\n * Kill an entire process tree on Windows via `taskkill /T /F`.\n *\n * TerminateProcess (what `child.kill()` maps to) has no process-group\n * semantics, so killing a shell wrapper (`cmd.exe /c …`) orphans its\n * grandchildren (node, vitest forks, dev servers). The orphans inherit the\n * parent's stdio pipe handles and can keep streaming into this process for\n * the rest of the session — which both prevents the child's 'close' event\n * from ever firing and grows in-memory output buffers without bound.\n *\n * Fire-and-forget: returns true if taskkill was spawned, false if spawning\n * it failed (caller should fall back to a direct `child.kill()`).\n */\nexport function killWin32Tree(pid: number): boolean {\n  try {\n    spawn('taskkill', ['/pid', String(pid), '/T', '/F'], {\n      stdio: 'ignore',\n      windowsHide: true,\n    }).unref();\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nclass ProcessRegistryImpl {\n  private readonly processes = new Map<number, TrackedProcess>();\n  private readonly breaker: CircuitBreaker;\n\n  constructor(breakerConfig?: CircuitBreakerConfig) {\n    this.breaker = new CircuitBreaker(breakerConfig);\n  }\n\n  register(info: Omit<TrackedProcess, 'killed' | 'protected'> & { protected?: boolean | undefined }): void {\n    this.processes.set(info.pid, { ...info, killed: false, protected: info.protected ?? false });\n  }\n\n  /** Unregister a process by PID. Called on 'close' / 'exit' events. */\n  unregister(pid: number): void {\n    this.processes.delete(pid);\n  }\n\n  /** Get a single process by PID. */\n  get(pid: number): TrackedProcess | undefined {\n    return this.processes.get(pid);\n  }\n\n  /** Get all tracked processes. */\n  list(): TrackedProcess[] {\n    return Array.from(this.processes.values());\n  }\n\n  /** Get processes filtered by name (e.g. 'bash', 'exec'). */\n  byName(name: string): TrackedProcess[] {\n    return this.list().filter((p) => p.name === name);\n  }\n\n  /** Get processes filtered by session. */\n  bySession(sessionId: string): TrackedProcess[] {\n    return this.list().filter((p) => p.sessionId === sessionId);\n  }\n\n  /** Count of active (non-killed) processes. */\n  get activeCount(): number {\n    let n = 0;\n    for (const p of this.processes.values()) {\n      if (!p.killed) n++;\n    }\n    return n;\n  }\n\n  /**\n   * Combined stats for observability — used by /ps and the TUI status bar.\n   */\n  stats(): RegistryStats {\n    return {\n      activeCount: this.activeCount,\n      totalCount: this.processes.size,\n      breaker: this.breaker.snapshot(),\n    };\n  }\n\n  /**\n   * Returns true if the circuit allows a new bash/exec call to proceed.\n   * When false, callers MUST NOT spawn a process.\n   */\n  get canProceed(): boolean {\n    return this.breaker.canProceed;\n  }\n\n  /**\n   * Called before spawning a process. Returns true if allowed; false if\n   * the circuit breaker is open.\n   *\n   * @param bypass - If true, skip circuit breaker check (for background processes).\n   */\n  beforeCall(bypass = false): boolean {\n    return this.breaker.beforeCall(bypass);\n  }\n\n  /**\n   * Called after a process finishes. `durationMs` is wall-clock time;\n   * `failed` is true for non-zero exit codes.\n   *\n   * @param bypass - If true, do not update circuit breaker state (for background processes).\n   */\n  afterCall(durationMs: number, failed: boolean, bypass = false): void {\n    this.breaker.afterCall(durationMs, failed, bypass);\n  }\n\n  /** Force-open the circuit breaker (Ctrl+C, /kill force). */\n  forceBreakerOpen(): void {\n    this.breaker.forceOpen();\n  }\n\n  /** Force-reset the circuit breaker to closed (/kill reset). */\n  forceBreakerReset(): void {\n    this.breaker.forceReset();\n  }\n\n  /** Kill a single process by PID.\n   *\n   *  On POSIX: sends SIGTERM to the *process group* (-pid) so that\n   *  runaway grandchild processes (`sleep 9999 & disown`) are also killed.\n   *  After `graceMs` a SIGKILL is sent if the process hasn't exited.\n   *\n   *  On Windows: `child.kill()` maps to TerminateProcess — process groups\n   *  are not meaningfully supported. A second `force=true` call sends\n   *  SIGKILL (which maps to TerminateProcess again — the distinction is\n   *  in the exit code, not the signal).\n   *\n   *  Returns true if the process was found and kill was attempted.\n   */\n  kill(pid: number, opts: KillOpts = {}): boolean {\n    const p = this.processes.get(pid);\n    if (!p) return false;\n    if (p.killed) return true; // already kill()ed, don't double-send\n    if (p.protected) return false; // protected processes are never kill()ed\n\n    const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;\n    const isWin = os.platform() === 'win32';\n\n    if (isWin) {\n      // Windows: no process group semantics. A direct kill terminates only\n      // the immediate child — shell-wrapped commands (cmd.exe /c …) leave\n      // grandchildren running that hold the inherited stdio pipes open and\n      // keep feeding output into this process indefinitely. Kill the whole\n      // tree via taskkill instead, but only for a real, still-running child\n      // (exitCode === null); test fakes and already-exited processes take\n      // the plain-kill path. The direct kill is deliberately NOT sent\n      // immediately alongside taskkill: killing the root first would break\n      // taskkill's parent-pid tree enumeration and orphan the grandchildren\n      // again — it runs as a delayed fallback instead.\n      const liveRealChild = p.child.exitCode === null && typeof p.child.pid === 'number';\n      if (liveRealChild && killWin32Tree(pid)) {\n        const fallback = setTimeout(() => {\n          if (p.child.exitCode === null) {\n            try {\n              p.child.kill('SIGKILL');\n            } catch {\n              // Process may have already exited.\n            }\n          }\n        }, graceMs);\n        fallback.unref?.();\n      } else {\n        try {\n          p.child.kill(force ? 'SIGKILL' : 'SIGTERM');\n        } catch {\n          // Process may have already exited.\n        }\n      }\n      p.killed = true;\n      return true;\n    }\n\n    // POSIX: kill the process group so grandchildren are cleaned up too.\n    try {\n      if (force) {\n        try {\n          process.kill(-pid, 'SIGKILL');\n        } catch {\n          p.child.kill('SIGKILL');\n        }\n      } else {\n        try {\n          process.kill(-pid, 'SIGTERM');\n        } catch {\n          p.child.kill('SIGTERM');\n        }\n        // Schedule SIGKILL as backup.\n        const timer = setTimeout(() => {\n          // Re-check: process may have exited on its own.\n          if (this.processes.has(pid) && !p.child.killed) {\n            try {\n              process.kill(-pid, 'SIGKILL');\n            } catch {\n              try {\n                p.child.kill('SIGKILL');\n              } catch {\n                /* already gone */\n              }\n            }\n          }\n        }, graceMs);\n        timer.unref?.(); // Don't keep event loop alive.\n      }\n    } catch {\n      // Process may have already exited.\n    }\n    p.killed = true;\n    return true;\n  }\n\n  /**\n   * Kill all tracked processes.\n   * Returns the PIDs that were kill()ed.\n   */\n  killAll(opts: KillOpts = {}): number[] {\n    const pids = Array.from(this.processes.keys());\n    const killed: number[] = [];\n    for (const pid of pids) {\n      const p = this.processes.get(pid);\n      if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);\n    }\n    return killed;\n  }\n\n  /**\n   * Kill all processes for a specific session.\n   * Returns the PIDs that were kill()ed.\n   */\n  killSession(sessionId: string, opts: KillOpts = {}): number[] {\n    const pids = this.bySession(sessionId).map((p) => p.pid);\n    const killed: number[] = [];\n    for (const pid of pids) {\n      if (this.kill(pid, opts)) killed.push(pid);\n    }\n    return killed;\n  }\n}\n\n/** Module-level singleton. Initialized on first access. */\nlet _registry: ProcessRegistryImpl | undefined;\n\nexport function getProcessRegistry(): ProcessRegistryImpl {\n  if (!_registry) {\n    _registry = new ProcessRegistryImpl();\n  }\n  return _registry;\n}\n\n/** Reset for tests. */\nexport function _resetProcessRegistry(): void {\n  _registry = undefined;\n}\n\n// ── Convenience re-exports ────────────────────────────────────────────────────\n\nexport type { KillOpts };","import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\n/**\n * On Windows, Node.js `spawn()` without a shell does NOT resolve .cmd/.bat\n * extensions through PATHEXT — it only auto-resolves .exe. Most Node.js CLI\n * tools (npx, pnpm, biome, tsc, vitest, etc.) ship as .cmd wrappers on\n * Windows. This function resolves the command name to its full path so spawn\n * can find it without relying on shell-mode argument concatenation.\n *\n * On non-Windows, returns the command unchanged.\n */\nexport function resolveWin32Command(cmd: string): string {\n  if (process.platform !== 'win32') return cmd;\n\n  // Already has a path or extension — use as-is\n  // Normalize forward slashes so path.extname correctly detects extensions\n  // even when a Unix-style path is passed on Windows.\n  if (cmd.includes('/') || cmd.includes('\\\\') || path.extname(cmd.replace(/\\//g, '\\\\'))) {\n    return cmd;\n  }\n\n  const pathext = (process.env['PATHEXT'] ?? '.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC')\n    .toLowerCase()\n    .split(';');\n\n  const pathDirs = (process.env['PATH'] ?? '').split(path.delimiter);\n\n  for (const dir of pathDirs) {\n    const base = path.join(dir, cmd);\n    // Check extensions in PATHEXT order. .EXE should win first because\n    // it's typically listed first, and .exe doesn't need shell: true.\n    for (const ext of pathext) {\n      const full = `${base}${ext}`;\n      try {\n        fs.accessSync(full, fs.constants.X_OK);\n        return full;\n      } catch {\n        // Not found with this extension — try next\n      }\n    }\n  }\n\n  // Not found — return original; let spawn report ENOENT with the\n  // expected error message so tools can surface it properly.\n  return cmd;\n}\n","import { spawn } from 'node:child_process';\nimport * as path from 'node:path';\nimport type { Tool } from '@wrongstack/core';\nimport { buildChildEnv } from './_env.js';\nimport { createOutputSpool, spoolNote } from './_output-spool.js';\nimport { COMMAND_OUTPUT_MAX_BYTES, normalizeCommandOutput } from './_util.js';\nimport { getProcessRegistry, redactCommand } from './process-registry.js';\nimport { resolveWin32Command } from './_win32-resolve.js';\n\nconst isWin = process.platform === 'win32';\n\nconst ALLOWED_COMMANDS: Record<string, string[]> = {\n  node: ['--version', '-r', '--input-type=module'],\n  npm: ['--version', 'list', 'pkg', 'doctor', 'view', 'outdated', 'audit'],\n  pnpm: ['--version', 'remove', 'list', 'view', 'outdated', 'audit'],\n  npx: ['--version'],\n  git: [\n    '--version',\n    'status',\n    'log',\n    'diff',\n    'branch',\n    'checkout',\n    'stash',\n    'add',\n    'commit',\n    'push',\n    'pull',\n  ],\n  ls: ['-la', '-l', '-a'],\n  cat: [],\n  head: ['-n'],\n  tail: ['-n'],\n  wc: ['-l', '-w', '-c'],\n  grep: [],\n  find: [],\n  echo: [],\n  mkdir: ['-p'],\n  cp: ['-r'],\n  mv: [],\n  rm: ['-rf'],\n  touch: [],\n  bun: ['--version'],\n  tsc: ['--version', '--noEmit', '--project'],\n  vitest: ['--version', 'run', '--coverage'],\n  biome: ['--version', 'lint', 'format', 'check'],\n  cargo: ['--version', 'build', 'test', 'check'],\n  rustc: ['--version'],\n  go: ['version', 'run', 'build', 'test'],\n  python: ['--version'],\n  pip: ['--version', 'list'],\n  docker: ['--version', 'ps', 'images'],\n  kubectl: ['version', 'get', 'describe', 'logs'],\n};\n\nconst MAX_ARGS = 20;\n// 200 KB — larger than bash's 32 KB cap. exec commands produce structured,\n// predictable output (build logs, test results, git diffs) that the agent\n// needs in full. 200 KB is safe for context windows ≥200K tokens while\n// still preventing a rogue build from filling the context.\nconst MAX_OUTPUT = 200_000;\nconst DEFAULT_TIMEOUT_MS = 30_000;\n\n// Per-command argument validation. Each entry is a list of regex patterns\n// that, if matched against any argument, will reject the invocation.\n// This blocks common injection vectors through allowlisted commands.\nconst BLOCKED_ARG_PATTERNS: Record<string, RegExp[]> = {\n  // python -c/--command executes arbitrary code; python -m runs modules\n  python: [/-c$/, /^--command$/, /^-m$/, /^--module$/],\n  // git --exec=<cmd> runs arbitrary commands via upload-pack/receive-pack;\n  // -C <dir> changes working directory, bypassing cwd sandbox;\n  // -c/--config <k>=<v> injects config that runs commands\n  // (e.g. core.sshCommand, core.pager, http.proxy, alias.x=!cmd).\n  git: [\n    /^--exec=/,\n    /^--upload-pack=/,\n    /^--receive-pack=/,\n    /^-C$/,\n    /^-c$/,\n    /^--config$/,\n    /^-c=/,\n    /^--config=/,\n    /^--config-env=/,\n  ],\n  // node -r/--require preloads arbitrary modules; --eval executes code\n  node: [/^-r$/, /^--require$/, /^-e$/, /^--eval$/, /^--prof-process$/],\n  // go run could execute arbitrary .go files; -ldflags could inject build-time code\n  go: [/^-ldflags$/],\n  // bun --preload is similar to node --require\n  bun: [/^--preload$/, /^run$/, /^bunx$/, /^create$/, /^init$/],\n  // docker build/run can create containers with host access;\n  // only allow read-only commands (ps, images, version)\n  docker: [/^build$/, /^run$/, /^exec$/, /^push$/, /^pull$/],\n  // find -exec/-ok/-execdir execute arbitrary commands\n  find: [/^-exec$/, /^-exec;$/, /^-ok$/, /^-ok;$/, /^-execdir$/, /^-execdir;$/, /^-exec=/, /^-ok=/, /^-execdir=/],\n  // rm -rf / is catastrophic — block absolute paths, home, dot-dirs,\n  // and glob patterns that could expand to dangerous targets.\n  // `rm -rf ./src/*` expands to project files; `rm -rf ../../` escapes upward;\n  // `rm -rf /*` targets the filesystem root. All are blocked.\n  rm: [/^\\//, /^~\\//, /^~$/, /^\\.$/, /^\\.\\.$/, /\\*$/, /\\/$/, /\\/\\*$/, /\\.\\//],\n  // npm run/exec/create/pack/publish can execute arbitrary scripts or publish malware\n  npm: [/^run$/, /^exec$/, /^create$/, /^init$/, /^pack$/, /^publish$/, /^deploy$/],\n  // pnpm run/dlx/exec/create can execute arbitrary scripts\n  pnpm: [/^run$/, /^dlx$/, /^exec$/, /^create$/, /^init$/, /^pack$/, /^publish$/, /^deploy$/],\n  // npx should only be used for --version; any package name is a vector for\n  // malicious package execution (typosquatting, dependency confusion)\n  npx: [/^[^\\s]+$/],\n};\n\nfunction validateArgs(cmd: string, args: string[]): string | null {\n  const blocked = BLOCKED_ARG_PATTERNS[cmd];\n  if (!blocked) return null;\n\n  for (const arg of args) {\n    for (const pattern of blocked) {\n      if (pattern.test(arg)) {\n        return `Blocked argument \"${arg}\" for command \"${cmd}\" (matches security pattern ${pattern})`;\n      }\n    }\n  }\n  return null;\n}\n\ninterface ExecInput {\n  command: string;\n  args?: string[] | undefined;\n  cwd?: string | undefined;\n  timeout?: number | undefined;\n}\n\ninterface ExecOutput {\n  command: string;\n  args: string[];\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  truncated: boolean;\n  allowed: boolean;\n}\n\nexport const execTool: Tool<ExecInput, ExecOutput> = {\n  name: 'exec',\n  category: 'Shell',\n  description:\n    'Execute a **whitelisted, restricted set of commands** with strict argument validation. ' +\n    'This is the **preferred and safer** alternative to the `bash` tool for running development tools (node, npm, pnpm, tsc, git, tests, linters, etc.). ' +\n    'It prevents arbitrary command injection and limits what the model can do.',\n  usageHint:\n    'PREFERRED SHELL TOOL for most cases.\\n\\n' +\n    'Use this instead of `bash` whenever possible.\\n' +\n    '- `command` must be one of the allowed commands (node, npm, pnpm, git, tsc, eslint, vitest, etc.).\\n' +\n    '- Arguments are passed as a clean array (no shell interpretation).\\n' +\n    '- `cwd` is validated to stay inside the project.\\n' +\n    '- For anything that requires real shell features (pipes, complex redirection, arbitrary commands), fall back to `bash` (with strong justification).\\n' +\n    'This tool significantly reduces the risk compared to full shell access.',\n  permission: 'confirm',\n  mutating: true,\n  riskTier: 'standard',\n  timeoutMs: DEFAULT_TIMEOUT_MS,\n  capabilities: ['shell.restricted'],\n  inputSchema: {\n    type: 'object',\n    properties: {\n      command: {\n        type: 'string',\n        description: 'The base command to run. Must be in the internal allowlist (e.g. \"node\", \"pnpm\", \"git\", \"tsc\").',\n      },\n      args: {\n        type: 'array',\n        items: { type: 'string' },\n        description: 'Arguments passed to the command. Passed as an array (no shell parsing).',\n      },\n      cwd: {\n        type: 'string',\n        description: 'Optional working directory. Must resolve inside the project root.',\n      },\n      timeout: {\n        type: 'integer',\n        description: 'Per-command timeout in milliseconds.',\n      },\n    },\n    required: ['command'],\n  },\n  async execute(input, ctx, opts) {\n    const registry = getProcessRegistry();\n    if (!registry.canProceed) {\n      return {\n        command: input.command,\n        args: input.args ?? [],\n        stdout: '',\n        stderr: 'Circuit breaker is open — too many consecutive failures. Use /kill reset to recover.',\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n\n    const cmd = input.command.trim();\n    if (!cmd)\n      return {\n        command: cmd,\n        args: [],\n        stdout: '',\n        stderr: 'Empty command',\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n\n    if (!(cmd in ALLOWED_COMMANDS)) {\n      return {\n        command: cmd,\n        args: input.args ?? [],\n        stdout: '',\n        stderr: `Command \"${cmd}\" not in allowlist. Use the bash tool for arbitrary commands.`,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n\n    const args = (input.args ?? []).slice(0, MAX_ARGS);\n    const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS, DEFAULT_TIMEOUT_MS));\n\n    // Validate args against per-command security patterns\n    const argError = validateArgs(cmd, args);\n    if (argError) {\n      return {\n        command: cmd,\n        args,\n        stdout: '',\n        stderr: argError,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n\n    // Resolve cwd inside the project root. Model-supplied paths like '/etc'\n    // would otherwise let allowlisted commands operate anywhere on disk.\n    const requestedCwd = input.cwd ? path.resolve(ctx.projectRoot, input.cwd) : ctx.cwd;\n    const rel = path.relative(ctx.projectRoot, requestedCwd);\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\n      return {\n        command: cmd,\n        args,\n        stdout: '',\n        stderr: `cwd \"${input.cwd}\" resolves outside project root`,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n    const cwd = requestedCwd;\n    const signal = opts.signal;\n\n    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id);\n  },\n};\n\nfunction runCommand(\n  cmd: string,\n  args: string[],\n  cwd: string,\n  timeout: number,\n  signal: AbortSignal,\n  sessionId: string | undefined,\n): Promise<ExecOutput> {\n  return new Promise((resolve) => {\n    let stdout = '';\n    let stderr = '';\n    let killed = false;\n    const startedAt = Date.now();\n    // Full-output spool (stdout+stderr interleaved as they arrive): the\n    // in-memory buffers keep only the first MAX_OUTPUT bytes; the spool\n    // captures everything on disk and the result points at the file.\n    const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT });\n\n    // On Windows, .cmd/.bat resolution requires shell: true — same rationale\n    // as _spawn-stream.ts. resolveWin32Command() finds the full path to the\n    // .cmd file so spawn can locate it; shell: true is still needed because\n    // .cmd/.bat files are not natively executable by CreateProcess.\n    const resolved = resolveWin32Command(cmd);\n    const needsShell = isWin && (resolved.endsWith('.cmd') || resolved.endsWith('.bat'));\n\n    // On Windows the abort signal is handled manually below: Node's built-in\n    // handling kills only the direct child, orphaning grandchildren (vitest\n    // forks, dev servers, anything under a .cmd shim) that keep the inherited\n    // stdio pipes open. registry.kill() tree-kills via taskkill instead.\n    const child = spawn(resolved, args, {\n      cwd,\n      env: buildChildEnv(sessionId),\n      stdio: ['ignore', 'pipe', 'pipe'],\n      windowsHide: true,\n      ...(isWin ? {} : { signal }),\n      ...(needsShell ? { shell: true, windowsVerbatimArguments: true } : {}),\n    });\n\n    const registry = getProcessRegistry();\n    const pid = child.pid;\n    if (typeof pid === 'number') {\n      const fullCommand = `${cmd} ${args.join(' ')}`;\n      registry.register({ pid, name: 'exec', command: redactCommand(fullCommand), startedAt: Date.now(), sessionId, child });\n    }\n\n    const timer = setTimeout(() => {\n      killed = true;\n      if (typeof pid === 'number') registry.kill(pid);\n      else child.kill('SIGTERM');\n    }, timeout);\n\n    const onAbort = () => {\n      killed = true;\n      if (typeof pid === 'number') registry.kill(pid, { force: true });\n      else child.kill('SIGTERM');\n    };\n    if (isWin) {\n      if (signal.aborted) onAbort();\n      else signal.addEventListener('abort', onAbort, { once: true });\n    }\n\n    child.stdout?.on('data', (chunk: Buffer) => {\n      const text = chunk.toString();\n      if (stdout.length < MAX_OUTPUT) stdout += text;\n      spool.write(text);\n    });\n\n    child.stderr?.on('data', (chunk: Buffer) => {\n      const text = chunk.toString();\n      if (stderr.length < MAX_OUTPUT) stderr += text;\n      spool.write(text);\n    });\n\n    child.on('close', (code) => {\n      clearTimeout(timer);\n      if (isWin) signal.removeEventListener('abort', onAbort);\n      if (typeof pid === 'number') registry.unregister(pid);\n      const durationMs = Date.now() - startedAt;\n      const exitCode = killed ? 124 : (code ?? 1);\n      registry.afterCall(durationMs, exitCode !== 0);\n      const spooled = spool.finalize();\n      resolve({\n        command: cmd,\n        args,\n        stdout: normalizeCommandOutput(stdout) + (spooled ? spoolNote(spooled) : ''),\n        stderr: normalizeCommandOutput(stderr),\n        exitCode,\n        truncated:\n          Buffer.byteLength(stdout, 'utf8') > COMMAND_OUTPUT_MAX_BYTES ||\n          Buffer.byteLength(stderr, 'utf8') > COMMAND_OUTPUT_MAX_BYTES,\n        allowed: true,\n      });\n    });\n\n    child.on('error', (err) => {\n      clearTimeout(timer);\n      if (isWin) signal.removeEventListener('abort', onAbort);\n      if (typeof pid === 'number') registry.unregister(pid);\n      registry.afterCall(Date.now() - startedAt, true);\n      spool.finalize();\n      resolve({\n        command: cmd,\n        args,\n        stdout: normalizeCommandOutput(stdout),\n        stderr: err.message,\n        exitCode: 1,\n        truncated: Buffer.byteLength(stdout, 'utf8') > COMMAND_OUTPUT_MAX_BYTES,\n        allowed: true,\n      });\n    });\n  });\n}\n"]}

package/dist/fetch.d.ts

@@ -10,6 +10,24 @@ interface FetchOutput {
     content_type: string;
     url: string;
 }
+type LookupCallback = (err: NodeJS.ErrnoException | null, address?: string | Array<{
+    address: string | undefined;
+    family: number;
+}>, family?: number | undefined) => void;
+/**
+ * DNS lookup used by the undici dispatcher below. It performs the SINGLE name
+ * resolution that the TCP connection actually uses, and rejects if any
+ * resolved address is private/loopback/link-local. Because the connection
+ * reuses exactly this result, there is no DNS-rebinding TOCTOU window between
+ * the security check and the connect — closing the gap the old code documented
+ * (validate with one dns.lookup, then let fetch re-resolve independently).
+ * TLS still validates the certificate against the hostname (SNI is set by
+ * undici from the URL), so pinning the IP does not weaken cert checking.
+ */
+declare function guardedLookup(hostname: string, options: {
+    all?: boolean | undefined;
+    family?: number | undefined;
+}, callback: LookupCallback): void;
 /**
  * SSRF-guarded fetch with manual, per-hop-revalidated redirects, exported so
  * other builtin tools (e.g. `search`) get the same protections instead of a
@@ -21,4 +39,4 @@ interface FetchOutput {
 declare function guardedFetch(url: string, maxRedirects: number, signal: AbortSignal, headers?: Record<string, string>): Promise<Response>;
 declare const fetchTool: Tool<FetchInput, FetchOutput>;
 
-export { fetchTool, guardedFetch };
+export { fetchTool, guardedFetch, guardedLookup };

package/dist/fetch.js

@@ -267,6 +267,6 @@ function prettyJson(s) {
   }
 }
 
-export { fetchTool, guardedFetch };
+export { fetchTool, guardedFetch, guardedLookup };
 //# sourceMappingURL=fetch.js.map
 //# sourceMappingURL=fetch.js.map