@wrongstack/tools 0.297.0 → 0.298.1

package/dist/exec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/exec.ts", "../src/_env.ts", "../src/_output-spool.ts", "../src/_util.ts", "../src/process-registry.ts", "../src/circuit-breaker.ts", "../src/_redact-command.ts", "../src/_win32-resolve.ts", "../src/_danger-detect.ts", "../src/exec-kill-guard.ts", "../src/process-registry-persistent.ts"],
-  "sourcesContent": ["import { spawn } from 'node:child_process';\nimport {\n  emitProcessCompleted,\n  emitProcessOutput,\n  emitProcessStarted,\n} from '@wrongstack/core/observability';\nimport type { Tool } from '@wrongstack/core/types';\nimport { toErrorMessage } from '@wrongstack/core/utils/error';\nimport { buildChildEnv } from './_env.js';\nimport { createOutputSpool, spoolNote } from './_output-spool.js';\nimport { COMMAND_OUTPUT_MAX_BYTES, normalizeCommandOutput, safeResolveReal } from './_util.js';\nimport { getProcessRegistry, redactCommand } from './process-registry.js';\nimport {\n  buildWin32CmdShimInvocation,\n  resolveWin32Command,\n} from './_win32-resolve.js';\nimport { detectDanger, type DangerAssessment } from './_danger-detect.js';\nimport { checkExecKillCommand } from './exec-kill-guard.js';\n\nconst isWin = process.platform === 'win32';\n\n// Curated default allowlist of command NAMES the `exec` tool may run. Only the\n// command name is gated (per-arg safety is the BLOCKED_ARG_PATTERNS denylist\n// below + the per-call `confirm` permission). A prior version mapped each\n// command to an allowed-args array, but those arrays were never enforced (dead\n// code) \u2014 a plain Set is the honest shape.\n//\n// Extend/trim at runtime via `configureExecPolicy()` (wired from\n// `config.tools.exec.{allow,deny}` at boot). `allow` is trusted-config-only;\n// see the security note on ExecToolConfig.\nconst DEFAULT_ALLOWED_COMMANDS: ReadonlySet<string> = new Set([\n  // JS / TS toolchain\n  'node', 'npm', 'pnpm', 'yarn', 'npx', 'bun', 'deno',\n  'corepack', 'tsc', 'tsx', 'ts-node', 'vite', 'vitest', 'jest',\n  'biome', 'eslint', 'prettier', 'turbo', 'nx', 'webpack', 'rollup',\n  'parcel', 'next', 'astro', 'playwright', 'cypress',\n  // version control\n  'git',\n  // Rust\n  'cargo', 'rustc',\n  // Go\n  'go',\n  // Python\n  'python', 'python3', 'pip', 'pip3', 'pytest', 'ruff', 'mypy',\n  'uv', 'uvx', 'poetry', 'hatch', 'tox',\n  // Ruby\n  'ruby', 'gem', 'bundle',\n  // PHP\n  'php', 'composer', 'phpunit',\n  // JVM\n  'java', 'javac', 'mvn', 'gradle', 'gradlew',\n  // .NET\n  'dotnet',\n  // C / C++ / native build\n  'make', 'cmake', 'ninja', 'clang', 'clang-cl', 'gcc', 'g++', 'link', 'msbuild',\n  // containers / orchestration\n  'docker', 'podman', 'kubectl',\n  // network (read-only intent; destructive ops still blocked by BLOCKED_ARG_PATTERNS)\n  'curl', 'wget',\n  // common POSIX file/text utilities\n  'pwd', 'ls', 'cat', 'head', 'tail', 'wc', 'grep', 'rg', 'find',\n  'echo', 'sort', 'uniq', 'sed', 'awk', 'mkdir', 'cp', 'mv', 'rm',\n  'touch', 'tar',\n  // Windows-native tooling (win32). All non-destructive binaries; per-arg\n  // safety is still enforced by BLOCKED_ARG_PATTERNS + the destructive-ops\n  // gate in bash-kill-guard.ts. `gh` is included even though it lives at\n  // \"C:\\Program Files\\GitHub CLI\\gh.exe\" \u2014 resolveWin32Command handles the\n  // space in the path.\n  'gh',\n  'where', 'tasklist', 'systeminfo', 'wmic', 'sc',\n  'netstat', 'ipconfig', 'nslookup', 'tracert', 'pathping',\n  // Windows shell interpreters. Without these, `exec` cannot run cmd builtins\n  // (`dir`, `type`, `copy`, \u2026) or any PowerShell cmdlet on Windows \u2014 a major\n  // gap since those are the platform's primary shells. Arbitrary execution\n  // through `cmd /c \u2026` / `powershell -c \u2026` is NOT a new hole: the permission\n  // policy reconstructs the full command line (shellCommandLineFromInput) and\n  // still runs it through the YOLO destructive classifier, so a genuinely\n  // destructive `cmd /c del /s /q C:\\\u2026` continues to require confirmation.\n  'cmd', 'cmd.exe', 'powershell', 'powershell.exe', 'pwsh', 'pwsh.exe',\n  // [core] Extended default allowlist (added 4b3d18d1 + this commit). All\n  // non-destructive, broadly-used dev binaries. Per-arg safety is still\n  // enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts.\n  // --- Archives & compression ---\n  '7z', '7za', 'bzip2', 'gzip', 'xz', 'unzip', 'zip', 'gtar', 'bsdtar', 'star', 'pax', 'cpio',\n  // --- Android / mobile dev ---\n  'adb', 'fastboot', 'sdkmanager',\n  // --- DevOps / config mgmt ---\n  'ansible', 'ansible-playbook', 'ansible-vault', 'ansible-lint', 'ansible-galaxy', 'molecule',\n  // --- Cloud CLIs ---\n  'aws', 'aws-vault', 'awslocal', 'az', 'azcopy', 'gcloud', 'gsutil', 'doctl', 'linode-cli',\n  // --- Native / C / C++ / linker tools ---\n  'clang++', 'clang-format', 'clang-tidy', 'clangd', 'lld', 'lldb', 'ctest', 'gmake', 'meson', 'conan', 'vcpkg', 'cl', 'rc', 'mt', 'dumpbin', 'dotnet-format',\n  // --- Image / media / binary tools ---\n  'convert', 'ffmpeg', 'ffprobe', 'magick', 'gs', 'exiftool',\n  // --- HTTP / fetch ---\n  'wget2', 'aria2c', 'axel', 'httpie', 'hey', 'ab', 'wrk', 'http',\n  // --- Diff / patch / merge ---\n  'diff', 'diff3', 'patch', 'meld', 'kdiff3', 'kompare',\n  // --- Encoding / file inspection ---\n  'dos2unix', 'unix2dos', 'iconv', 'file', 'stat', 'xxd', 'hexdump', 'od', 'base64',\n  // --- SSH / crypto / signing ---\n  'ssh', 'ssh-add', 'ssh-keygen', 'ssh-keyscan', 'scp', 'sftp', 'rsync', 'gpg', 'gpg2', 'gpg-agent', 'openssl', 'step', 'keytool',\n  // --- Search ---\n  'egrep', 'fgrep', 'ag', 'ack', 'sift', 'ugrep', 'fd', 'fdfind', 'jq', 'yq', 'xq', 'fx', 'gron',\n  // --- K8s / container ecosystem ---\n  'kubectl.exe', 'kubeadm', 'kubelet', 'helm', 'k9s', 'kustomize', 'skaffold', 'tilt', 'minikube', 'kind', 'k3d', 'k3s',\n  'docker-compose', 'buildah', 'skopeo', 'nerdctl', 'ctr', 'ctr.exe',\n  // --- Databases ---\n  'sqlite3', 'sqlite', 'psql', 'pg_dump', 'pg_restore', 'mysql', 'mysqladmin', 'mysqldump', 'mariadb', 'mariadb-dump',\n  'redis-cli', 'redis-server', 'memcached', 'etcdctl', 'consul', 'vault', 'nomad',\n  'mongosh', 'mongo', 'mongoexport', 'mongoimport', 'mongodump', 'mongorestore',\n  // --- Windows extended (read-mostly ops) ---\n  'taskkill', 'gpupdate', 'gpresult', 'hostname', 'whoami', 'who', 'net', 'net1',\n  // --- VCS ecosystem ---\n  'glab', 'hub', 'tea', 'git-lfs', 'tig', 'lazygit',\n  // --- POSIX text utilities (extended; duplicates of pwd/ls/cat/head/tail/wc/\n  //     grep/find/echo/awk/mkdir/cp/mv/rm/touch from the base list above are\n  //     omitted \u2014 the Set is de-duplicated at runtime but a clean literal is\n  //     easier to maintain) ---\n  'gawk', 'tr', 'cut', 'paste', 'join', 'comm', 'expand', 'unexpand', 'fold', 'fmt', 'nl', 'pr', 'column', 'tsort',\n  'tty', 'ul', 'units', 'factor', 'seq', 'shuf', 'look', 'yes', 'true', 'false', 'test', '[', 'printf',\n  'env',\n  'tree', 'locate', 'which', 'whereis', 'type', 'hash', 'pushd', 'popd', 'dirs', 'history', 'fc', 'jobs', 'bg', 'fg', 'wait',\n  'ulimit', 'umask', 'nice', 'nohup', 'timeout', 'time', 'trap', 'exit', 'return', 'source', '.', 'alias', 'unalias',\n  'set', 'unset', 'export', 'readonly', 'typeset', 'declare', 'local', 'eval', 'exec',\n  // --- Process / system inspection ---\n  'htop', 'top', 'atop', 'glances', 'iotop', 'nethogs', 'iftop', 'lsof', 'strace', 'ltrace', 'sysstat', 'vmstat', 'iostat', 'mpstat', 'sar',\n  'free', 'df', 'du', 'mount', 'umount', 'lsblk', 'blkid',\n  'kill', 'killall', 'pkill', 'pgrep', 'pidof', 'ps', 'ps.exe',\n  // --- Network inspection ---\n  'ip', 'ss', 'route', 'arp', 'arping', 'ping', 'ping6', 'hping3', 'mtr', 'tracepath', 'tcpdump', 'nmap', 'netcat', 'nc', 'ncat', 'socat',\n  // --- Sync / backup ---\n  'rclone', 'restic', 'borg', 'duplicati', 'duplicacy', 'syncthing', 'syncthing-cli',\n  // --- Permissions / users / ACLs (POSIX) ---\n  'useradd', 'userdel', 'usermod', 'groupadd', 'groupdel', 'groupmod', 'chown', 'chmod', 'chgrp', 'getfacl', 'setfacl', 'setcap', 'getcap',\n  // --- Crypto / cert mgmt (extended) ---\n  'certbot', 'mkcert', 'jarsigner',\n  // --- Editors ---\n  'subl', 'code', 'code-insiders', 'cursor', 'atom', 'nano', 'vim', 'nvim', 'vi', 'emacs', 'helix', 'hx', 'micro', 'jed', 'ed', 'ex', 'mg',\n  // --- Terminal multiplexers ---\n  'asciinema', 'script', 'scriptreplay', 'expect', 'screen', 'tmux', 'byobu', 'dtach', 'abduco',\n  // --- Calculators / REPLs / scientific ---\n  'bc', 'dc', 'calc', 'qalc', 'genius', 'octave', 'R', 'Rscript', 'julia', 'irb', 'pry', 'ghci', 'stack', 'cabal', 'ghc',\n  // --- PHP / Lua / Perl / Ruby ecosystem (extended) ---\n  'php8', 'php7', 'phpcs', 'phpcbf', 'phpmd', 'phpstan', 'psalm',\n  'lua', 'lua5.1', 'lua5.2', 'lua5.3', 'lua5.4', 'luarocks',\n  'perl', 'cpan', 'prove', 'plackup',\n  'rake', 'rspec', 'jekyll', 'node-gyp', 'node-pre-gyp',\n  // --- JS / TS toolchain (extended) ---\n  'electron', 'electron-builder', 'electron-forge', 'vite-preview', 'swc', 'swc-cli', 'swcpack',\n  'mocha', 'chai', 'jasmine', 'puppeteer', 'lighthouse',\n  // --- Linters / formatters (extended) ---\n  'tslint', 'stylelint', 'htmlhint', 'jshint', 'jslint', 'jscs',\n  // --- Document conversion ---\n  'pandoc', 'weasyprint', 'wkhtmltopdf', 'wkhtmltoimage', 'prince', 'mdp', 'markdown', 'multimarkdown', 'cmark', 'cmark-gfm',\n  // --- Office / spreadsheet ---\n  'soffice', 'libreoffice', 'unoconv', 'abiword', 'gnumeric',\n  // --- Spell / grammar ---\n  'aspell', 'hunspell', 'enchant', 'languagetool',\n  // --- Source-highlight / diff tools ---\n  'delta', 'bat', 'ccat', 'hl', 'highlight', 'source-highlight', 'ansifilter',\n  // --- Job schedulers ---\n  'pueue', 'task-spooler', 'ts', 'at', 'atd', 'anacron', 'fcron', 'cronie', 'systemd-run', 'systemd-cat',\n  // --- Plotting / visualization ---\n  'gnuplot', 'gnuplot-nox', 'veusz', 'scidavis', 'grace', 'xmgrace', 'labplot',\n  // --- Security / recon (network + web) ---\n  'masscan', 'zmap', 'rustscan', 'amass', 'subfinder', 'httpx', 'nuclei', 'naabu', 'katana', 'dnsx', 'assetfinder', 'findomain', 'gau', 'waybackurls', 'httprobe', 'meg', 'subjack', 'sublert', 'chaos',\n]);\n\n// The live, effective allowlist: DEFAULT \u222A config.allow \u2212 config.deny. Replaced\n// wholesale by configureExecPolicy(); defaults until boot wires the config.\nlet allowedCommands: Set<string> = new Set(DEFAULT_ALLOWED_COMMANDS);\n\nconst normalizeCmd = (c: string): string => c.trim();\n\n/**\n * Apply the configured exec command policy. Recomputes the effective allowlist\n * as `DEFAULT \u222A allow \u2212 deny`. Call once at boot from\n * `config.tools.exec.{allow,deny}`. Idempotent (always rebuilt from defaults).\n *\n * SECURITY: `allow` must originate from TRUSTED config only \u2014 the config loader\n * strips `tools.exec.allow` from the untrusted in-project repo config before it\n * reaches here. `deny` is safe from any source (it only narrows).\n */\nexport function configureExecPolicy(opts: { allow?: readonly string[] | undefined; deny?: readonly string[] | undefined } = {}): void {\n  const next = new Set(DEFAULT_ALLOWED_COMMANDS);\n  for (const c of opts.allow ?? []) {\n    const n = normalizeCmd(c);\n    if (n) next.add(n);\n  }\n  for (const c of opts.deny ?? []) next.delete(normalizeCmd(c));\n  allowedCommands = next;\n}\n\n/** Reset the exec allowlist to the built-in defaults (tests / re-init). */\nexport function resetExecPolicy(): void {\n  allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);\n}\n\n// -----------------------------------------------------------------------\n// Danger-detection bypass (config.tools.exec.danger.bypass)\n// -----------------------------------------------------------------------\n\n/**\n * Set of rule ids that should be skipped during danger detection. Wired\n * from `config.tools.exec.danger.bypass` at boot. Mirrors the\n * `allowedCommands` pattern above: defaults to empty, replaced wholesale\n * by `configureDangerBypass()`, reset by `resetDangerBypass()`.\n *\n * SECURITY: like `allow`, this is a per-rule weakening of the danger\n * gate. The boot path strips `tools.exec.danger.bypass` from in-project\n * repo config; only trusted config (user-global, system) sets it.\n */\nlet dangerBypass: ReadonlySet<string> = new Set();\n\n/**\n * Apply the configured danger-bypass policy. Each id in `bypass` is\n * added to the effective skip set; duplicates are fine. Idempotent.\n *\n * Call once at boot from `config.tools.exec.danger.bypass`.\n */\nexport function configureDangerBypass(opts: { bypass?: readonly string[] | undefined } = {}): void {\n  const next = new Set<string>();\n  for (const id of opts.bypass ?? []) {\n    const trimmed = id.trim();\n    if (trimmed) next.add(trimmed);\n  }\n  dangerBypass = next;\n}\n\n/** Reset the danger-bypass set to empty (tests / re-init). */\nexport function resetDangerBypass(): void {\n  dangerBypass = new Set();\n}\n\n/**\n * Read-only view of the active bypass set. `detectDanger()` takes a\n * `bypass` argument directly, so consumers should prefer passing this\n * rather than reading the set and matching themselves.\n */\nexport function getDangerBypass(): ReadonlySet<string> {\n  return dangerBypass;\n}\n\n/** Whether `cmd` is currently in the effective exec allowlist. */\nexport function isExecCommandAllowed(cmd: string): boolean {\n  return allowedCommands.has(normalizeCmd(cmd));\n}\n\n/** Snapshot of the effective allowlist (sorted) \u2014 for tests / diagnostics. */\nexport function getExecAllowlist(): string[] {\n  return [...allowedCommands].sort();\n}\n\nconst MAX_ARGS = 20;\n// 200 KB \u2014 larger than bash's 32 KB cap. exec commands produce structured,\n// predictable output (build logs, test results, git diffs) that the agent\n// needs in full. 200 KB is safe for context windows \u2265200K tokens while\n// still preventing a rogue build from filling the context.\nconst MAX_OUTPUT = 200_000;\nconst DEFAULT_TIMEOUT_MS = 30_000;\n\n// Per-command hard-blocks. Keep this list narrow: `exec` is already a\n// confirm-gated tool with argv passed as an array and cwd confined to the\n// project. These patterns should block clear sandbox escapes / destructive\n// operations, not normal development workflows that happen to execute code.\nconst BLOCKED_ARG_PATTERNS: Record<string, RegExp[]> = {\n  python: [],\n  // git --exec=<cmd> runs arbitrary commands via upload-pack/receive-pack;\n  // -C <dir> changes working directory, bypassing cwd sandbox;\n  // -c/--config <k>=<v> injects config that runs commands\n  // (e.g. core.sshCommand, core.pager, http.proxy, alias.x=!cmd).\n  git: [\n    /^--exec=/,\n    /^--upload-pack=/,\n    /^--receive-pack=/,\n    /^-C$/,\n    /^-c$/,\n    /^--config$/,\n    /^-c=/,\n    /^--config=/,\n    /^--config-env=/,\n  ],\n  node: [],\n  go: [],\n  bun: [],\n  docker: [],\n  // find -exec/-ok/-execdir execute arbitrary commands\n  find: [/^-exec$/, /^-exec;$/, /^-ok$/, /^-ok;$/, /^-execdir$/, /^-execdir;$/, /^-exec=/, /^-ok=/, /^-execdir=/],\n  // rm -rf / is catastrophic \u2014 block absolute paths, home, dot-dirs,\n  // and glob patterns that could expand to dangerous targets.\n  // `rm -rf ./src/*` expands to project files; `rm -rf ../../` escapes upward;\n  // `rm -rf /*` targets the filesystem root. All are blocked.\n  rm: [/^\\//, /^[A-Za-z]:[\\\\/]/, /^~\\//, /^~$/, /^\\.$/, /^\\.\\.$/, /\\*$/, /\\/$/, /\\/\\*$/, /\\.\\//],\n  // npm/pnpm subcommands are checked separately below. Matching every arg here\n  // over-blocked normal dev flows such as `pnpm vitest run ...`.\n  npm: [],\n  pnpm: [],\n  npx: [],\n};\n\n// Subcommand verbs only make sense in subcommand position. Keep externally\n// destructive actions blocked there without rejecting harmless downstream args\n// named \"run\", \"publish\", etc. passed to test runners or build tools.\nconst BLOCKED_SUBCOMMANDS: Record<string, ReadonlySet<string>> = {\n  docker: new Set(['push']),\n  podman: new Set(['push']),\n  npm: new Set(['publish', 'deploy']),\n  pnpm: new Set(['publish', 'deploy']),\n  yarn: new Set(['publish']),\n};\n\nconst BLOCKED_SUBCOMMAND_SEQUENCES: Record<string, readonly (readonly string[])[]> = {\n  yarn: [['npm', 'publish']],\n};\n\nfunction firstSubcommand(args: string[]): string | null {\n  for (const arg of args) {\n    if (arg === '--') return null;\n    if (!arg.startsWith('-')) return arg;\n  }\n  return null;\n}\n\nfunction subcommandArgs(args: string[]): string[] {\n  const out: string[] = [];\n  for (const arg of args) {\n    if (arg === '--') break;\n    if (!arg.startsWith('-')) out.push(arg);\n  }\n  return out;\n}\n\nfunction validateArgs(cmd: string, args: string[]): string | null {\n  const blockedSubcommands = BLOCKED_SUBCOMMANDS[cmd];\n  const subcommand = firstSubcommand(args);\n  if (blockedSubcommands && subcommand && blockedSubcommands.has(subcommand)) {\n    return `Blocked subcommand \"${subcommand}\" for command \"${cmd}\"`;\n  }\n\n  const blockedSequences = BLOCKED_SUBCOMMAND_SEQUENCES[cmd];\n  if (blockedSequences) {\n    const actual = subcommandArgs(args);\n    const blocked = blockedSequences.find((seq) => seq.every((part, idx) => actual[idx] === part));\n    if (blocked) return `Blocked subcommand \"${blocked.join(' ')}\" for command \"${cmd}\"`;\n  }\n\n  const blocked = BLOCKED_ARG_PATTERNS[cmd];\n  if (!blocked) return null;\n\n  for (const arg of args) {\n    for (const pattern of blocked) {\n      if (pattern.test(arg)) {\n        return `Blocked argument \"${arg}\" for command \"${cmd}\" (matches security pattern ${pattern})`;\n      }\n    }\n  }\n  return null;\n}\n\ninterface ExecInput {\n  command: string;\n  args?: string[] | undefined;\n  cwd?: string | undefined;\n  timeout?: number | undefined;\n}\n\ninterface ExecOutput {\n  command: string;\n  args: string[];\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  truncated: boolean;\n  allowed: boolean;\n  /**\n   * Heuristic danger assessment of the (cmd, args) pair. Populated for every\n   * call (not just blocked ones) so the UI/TUI can render a banner when the\n   * level is 'caution' or 'destructive'. See `_danger-detect.ts` for the\n   * rule set.\n   *\n   * Pre-execution error returns (allowlist miss, circuit breaker, etc.)\n   * report `level: 'safe'` because the command never actually ran; the UI\n   * should surface the error separately and not also a danger warning.\n   */\n  danger: DangerAssessment;\n}\n\nconst SAFE_DANGER: DangerAssessment = { level: 'safe', reasons: [] };\n\nexport const execTool: Tool<ExecInput, ExecOutput> = {\n  name: 'exec',\n  category: 'Shell',\n  description:\n    'Execute a **whitelisted, restricted set of commands** with strict argument validation. ' +\n    'This is the **preferred and safer** alternative to the `bash` tool for running development tools (node, npm, pnpm, tsc, git, tests, linters, etc.). ' +\n    'It prevents arbitrary command injection and limits what the model can do.',\n  usageHint:\n    'PREFERRED SHELL TOOL for most cases.\\n\\n' +\n    'Use this instead of `bash` whenever possible.\\n' +\n    '- `command` must be in the allowlist. Defaults cover JS (node/npm/pnpm/yarn/bun/deno/tsc/vitest/eslint/biome), Go (`go build`/`go test`), Rust (cargo), Python (python/pip), Ruby (gem/bundle), JVM (java/mvn/gradle), .NET (dotnet), native (make/cmake), and git. Users can extend it via `tools.exec.allow` in config.\\n' +\n    '- Arguments are passed as a clean array (no shell interpretation).\\n' +\n    '- `cwd` is validated to stay inside the project.\\n' +\n    '- If a command is not allowlisted, the error explains how to add it; for one-off arbitrary commands, fall back to `bash` (with strong justification).\\n' +\n    'This tool significantly reduces the risk compared to full shell access.',\n  selection: {\n    doNotUseWhen: 'the operation requires pipes, redirection, shell expansion, or a non-allowlisted command.',\n    useInstead: ['bash'],\n  },\n  permission: 'confirm',\n  mutating: true,\n  riskTier: 'standard',\n  timeoutMs: DEFAULT_TIMEOUT_MS,\n  capabilities: ['shell.restricted'],\n  icon: 'terminal',\n  inputSchema: {\n    type: 'object',\n    properties: {\n      command: {\n        type: 'string',\n        description: 'The base command to run. Must be in the internal allowlist (e.g. \"node\", \"pnpm\", \"git\", \"tsc\").',\n      },\n      args: {\n        type: 'array',\n        items: { type: 'string' },\n        description: 'Arguments passed to the command. Passed as an array (no shell parsing).',\n      },\n      cwd: {\n        type: 'string',\n        description: 'Optional working directory. Must resolve inside the project root.',\n      },\n      timeout: {\n        type: 'integer',\n        description: 'Per-command timeout in milliseconds.',\n      },\n    },\n    required: ['command'],\n  },\n  async execute(input, ctx, opts) {\n    const registry = getProcessRegistry();\n    if (!registry.canProceed) {\n      return {\n        command: input.command,\n        args: input.args ?? [],\n        stdout: '',\n        stderr: 'Circuit breaker is open \u2014 too many consecutive failures. Use /kill reset to recover.',\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n        danger: SAFE_DANGER,\n      };\n    }\n\n    const cmd = input.command.trim();\n    if (!cmd)\n      return {\n        command: cmd,\n        args: [],\n        stdout: '',\n        stderr: 'Empty command',\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n        danger: SAFE_DANGER,\n      };\n\n    if (!isExecCommandAllowed(cmd)) {\n      return {\n        command: cmd,\n        args: input.args ?? [],\n        stdout: '',\n        stderr:\n          `Command \"${cmd}\" not in allowlist. ` +\n          `Add it to your active profile config (~/.wrongstack/profiles/<name>/config.json) ` +\n          `under \"tools\": { \"exec\": { \"allow\": [\"${cmd}\"] } }, ` +\n          `or use the bash tool for one-off arbitrary commands.`,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n        danger: SAFE_DANGER,\n      };\n    }\n\n    const args = (input.args ?? []).slice(0, MAX_ARGS);\n    const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS, DEFAULT_TIMEOUT_MS));\n\n    // Heuristic danger assessment. Computed once here, attached to every\n    // return from this point on (including error returns) so the UI can\n    // render a banner for 'caution' / 'destructive' levels. The `bypass`\n    // argument is wired from `config.tools.exec.danger.bypass` (see\n    // `configureDangerBypass`); rule ids in that set are skipped.\n    const danger: DangerAssessment = detectDanger(cmd, args, dangerBypass);\n\n    // Kill guard: check if the command targets protected WrongStack processes\n    // (taskkill /F /IM node.exe, Stop-Process -Name node, wmic process delete, etc.)\n    const killCheck = await checkExecKillCommand(cmd, args);\n    if (killCheck.blocked) {\n      return {\n        command: cmd,\n        args,\n        stdout: '',\n        stderr: killCheck.reason ?? 'Kill command blocked: targets a protected WrongStack process.',\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n        danger,\n      };\n    }\n\n    // Validate args against per-command security patterns\n    const argError = validateArgs(cmd, args);\n    if (argError) {\n      return {\n        command: cmd,\n        args,\n        stdout: '',\n        stderr: argError,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n        danger,\n      };\n    }\n\n    let cwd: string;\n    try {\n      // Resolve cwd inside the project root and verify realpath containment so\n      // an in-project symlink cannot redirect allowlisted commands outside.\n      cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : await safeResolveReal(ctx.cwd, ctx);\n    } catch {\n      return {\n        command: cmd,\n        args,\n        stdout: '',\n        stderr: `cwd \"${input.cwd ?? ctx.cwd}\" resolves outside project root`,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n        danger,\n      };\n    }\n    const signal = opts.signal;\n\n    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id, danger);\n  },\n};\n\nfunction runCommand(\n  cmd: string,\n  args: string[],\n  cwd: string,\n  timeout: number,\n  signal: AbortSignal,\n  sessionId: string | undefined,\n  danger: DangerAssessment,\n): Promise<ExecOutput> {\n  return new Promise((resolve) => {\n    let stdout = '';\n    let stderr = '';\n    let killed = false;\n    const resolvedOnce = { value: false };\n    const finish = (result: ExecOutput): void => {\n      // Guard against double-resolve: 'error' and 'close' can both fire for\n      // the same abort (Node's abort path emits both), and resolving twice\n      // is a no-op but the extra work (normalizeCommandOutput, registry\n      // bookkeeping, spool finalize) is wasted. First writer wins.\n      if (resolvedOnce.value) return;\n      resolvedOnce.value = true;\n      resolve(result);\n    };\n    const startedAt = Date.now();\n    let stdoutBytes = 0;\n    let stderrBytes = 0;\n    let telemetryCompleted = false;\n    let timedOut = false;\n    // Full-output spool (stdout+stderr interleaved as they arrive): the\n    // in-memory buffers keep only the first MAX_OUTPUT bytes; the spool\n    // captures everything on disk and the result points at the file.\n    const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT });\n\n    // On Windows, .cmd/.bat files are not natively executable by CreateProcess.\n    // resolveWin32Command() finds the full path, then the shim helper launches\n    // it through cmd.exe without Node's deprecated shell+args path.\n    const resolved = resolveWin32Command(cmd);\n    const needsShell = isWin && (resolved.endsWith('.cmd') || resolved.endsWith('.bat'));\n    const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;\n    const spawnCmd = shim?.command ?? resolved;\n    const spawnArgs = shim?.args ?? args;\n\n    const emitCompletedOnce = (\n      exitCode: number,\n      pid: number | undefined,\n      signal?: string | undefined,\n    ): void => {\n      if (telemetryCompleted) return;\n      telemetryCompleted = true;\n      emitProcessCompleted({\n        ...(pid !== undefined ? { pid } : {}),\n        exitCode,\n        ...(signal ? { signal } : {}),\n        durationMs: Date.now() - startedAt,\n        stdoutBytes,\n        stderrBytes,\n        timedOut,\n        endedAt: new Date().toISOString(),\n      });\n    };\n\n    // Wrap the entire spawn lifecycle in try/catch so a synchronous throw\n    // (bad argv, ENOENT for missing binary, ERR_INVALID_ARG_TYPE for bad\n    // signal, etc.) resolves the promise with an error response instead\n    // of producing an unhandled rejection. Without this guard the\n    // promise executor itself can throw, which Node treats as an\n    // unhandled rejection and surfaces in process.on('unhandledRejection').\n    let child: ReturnType<typeof spawn>;\n    try {\n      // On Windows the abort signal is handled manually below: Node's built-in\n      // handling kills only the direct child, orphaning grandchildren (vitest\n      // forks, dev servers, anything under a .cmd shim) that keep the inherited\n      // stdio pipes open. registry.kill() tree-kills via taskkill instead.\n      child = spawn(spawnCmd, spawnArgs, {\n        cwd,\n        env: buildChildEnv(sessionId),\n        stdio: ['ignore', 'pipe', 'pipe'],\n        windowsHide: true,\n        ...(isWin ? {} : { signal }),\n        ...(shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}),\n      });\n    } catch (err) {\n      // spawn() can throw synchronously \u2014 e.g. ERR_INVALID_ARG_TYPE for a\n      // malformed `signal`, or for some Node versions ENOENT when the binary\n      // isn't on PATH. Convert to a graceful result so the tool caller\n      // sees a structured error instead of an unhandled rejection that\n      // would crash the host.\n      spool.finalize();\n      emitProcessStarted({\n        parentPid: process.pid,\n        command: redactCommand(`${cmd} ${args.join(' ')}`),\n        args: redactCommand(args.join(' ')).split(' ').filter(Boolean),\n        cwd,\n        background: false,\n        startedAt: new Date(startedAt).toISOString(),\n      });\n      emitCompletedOnce(1, undefined);\n      finish({\n        command: cmd,\n        args,\n        stdout: '',\n        stderr: `spawn failed: ${toErrorMessage(err)}`,\n        exitCode: 1,\n        truncated: false,\n        allowed: true,\n        danger,\n      });\n      return;\n    }\n\n    emitProcessStarted({\n      ...(child.pid !== undefined ? { pid: child.pid } : {}),\n      parentPid: process.pid,\n      command: redactCommand(`${cmd} ${args.join(' ')}`),\n      args: redactCommand(args.join(' ')).split(' ').filter(Boolean),\n      cwd,\n      background: false,\n      startedAt: new Date(startedAt).toISOString(),\n    });\n\n    // Attach the 'error' listener IMMEDIATELY after spawn, BEFORE any other\n    // async setup (process registry call, setTimeout, abort listener). The\n    // Node EventEmitter contract is that an 'error' event with no listener\n    // rethrows on nextTick and crashes the entire process \u2014 this is the\n    // exact failure mode issue #99 describes. Attach first, then do the\n    // bookkeeping, so an abort / ENOENT / EPIPE that fires between spawn\n    // and the rest of setup still has a listener attached.\n    child.on('error', (err) => {\n      // Distinguish an abort from a true spawn failure so the caller can\n      // tell \"the user cancelled this\" apart from \"the binary is missing\".\n      // The signal passed to spawn() is an AbortSignal; Node internally\n      // converts the abort into an AbortError with `code: 'ABORT_ERR'`.\n      const isAbort = err && (err as NodeJS.ErrnoException).code === 'ABORT_ERR';\n      const stderrText = isAbort ? `Aborted: ${err.message}` : err.message;\n      clearTimeout(timer);\n      if (isWin) signal.removeEventListener('abort', onAbort);\n      if (typeof pid === 'number') registry.unregister(pid);\n      registry.afterCall(Date.now() - startedAt, true);\n      spool.finalize();\n      emitCompletedOnce(isAbort ? 124 : 1, child.pid, isAbort ? 'ABORT' : undefined);\n      finish({\n        command: cmd,\n        args,\n        stdout: normalizeCommandOutput(stdout),\n        stderr: stderrText,\n        exitCode: isAbort ? 124 : 1,\n        truncated: Buffer.byteLength(stdout, 'utf8') > COMMAND_OUTPUT_MAX_BYTES,\n        allowed: true,\n        danger,\n      });\n    });\n\n    const registry = getProcessRegistry();\n    const pid = child.pid;\n    if (typeof pid === 'number') {\n      const fullCommand = `${cmd} ${args.join(' ')}`;\n      registry.register({ pid, name: 'exec', command: redactCommand(fullCommand), startedAt: Date.now(), sessionId, child });\n    }\n\n    const timer = setTimeout(() => {\n      killed = true;\n      timedOut = true;\n      if (typeof pid === 'number') registry.kill(pid);\n      else child.kill('SIGTERM');\n    }, timeout);\n\n    const onAbort = () => {\n      killed = true;\n      if (typeof pid === 'number') registry.kill(pid, { force: true });\n      else child.kill('SIGTERM');\n    };\n    if (isWin) {\n      if (signal.aborted) onAbort();\n      else signal.addEventListener('abort', onAbort, { once: true });\n    }\n\n    child.stdout?.on('data', (chunk: Buffer) => {\n      const text = chunk.toString();\n      stdoutBytes += chunk.byteLength;\n      emitProcessOutput({ pid, stream: 'stdout', chunk });\n      if (stdout.length < MAX_OUTPUT) stdout += text;\n      spool.write(text);\n    });\n\n    child.stderr?.on('data', (chunk: Buffer) => {\n      const text = chunk.toString();\n      stderrBytes += chunk.byteLength;\n      emitProcessOutput({ pid, stream: 'stderr', chunk });\n      if (stderr.length < MAX_OUTPUT) stderr += text;\n      spool.write(text);\n    });\n\n    child.on('close', (code) => {\n      clearTimeout(timer);\n      if (isWin) signal.removeEventListener('abort', onAbort);\n      if (typeof pid === 'number') registry.unregister(pid);\n      const durationMs = Date.now() - startedAt;\n      const exitCode = killed ? 124 : (code ?? 1);\n      emitCompletedOnce(exitCode, pid);\n      registry.afterCall(durationMs, exitCode !== 0);\n      const spooled = spool.finalize();\n      finish({\n        command: cmd,\n        args,\n        stdout: normalizeCommandOutput(stdout) + (spooled ? spoolNote(spooled) : ''),\n        stderr: normalizeCommandOutput(stderr),\n        exitCode,\n        truncated:\n          Buffer.byteLength(stdout, 'utf8') > COMMAND_OUTPUT_MAX_BYTES ||\n          Buffer.byteLength(stderr, 'utf8') > COMMAND_OUTPUT_MAX_BYTES,\n        allowed: true,\n        danger,\n      });\n    });\n  });\n}\n", "/**\n * Re-exported from @wrongstack/core. This file exists for backward\n * compatibility \u2014 tools/src/bash.ts and exec.ts import './_env.js'.\n */\nexport { buildChildEnv } from '@wrongstack/core/utils';\n", "/**\n * _output-spool \u2014 file-based capture of FULL command output.\n *\n * Command tools (bash/exec and the _spawn-stream consumers) cap what they\n * keep in memory and what reaches the model (COMMAND_OUTPUT_MAX_BYTES head+\n * tail). Everything past the cap used to be silently dropped, which pushed\n * agents to re-run commands with bigger buffers or stuff huge outputs into\n * chat history. The spool keeps the host's memory and the context window\n * small while losing nothing: once a command's output exceeds the in-memory\n * threshold, the FULL stream is written to a log file under\n * `~/.wrongstack/tool-output/` and the capped tool result carries a\n * `[full output: <path>]` marker so the model can read/grep the file\n * selectively instead of dumping it into context.\n *\n * Properties:\n *   - zero disk I/O for small outputs (file is created lazily on first byte\n *     past the threshold; the buffered head is flushed at that moment)\n *   - bounded memory: the head buffer never exceeds the threshold, and disk\n *     backpressure drops chunks past a 4 MB writable-buffer high-water mark\n *     (counted and reported in the marker) instead of queueing them on the heap\n *   - best-effort: any fs error disables the spool silently \u2014 command tools\n *     must never fail because diagnostics couldn't be written\n *   - retention: spool files older than 7 days are swept once per process\n */\nimport { createWriteStream, mkdirSync, type WriteStream } from 'node:fs';\nimport * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport { wstackGlobalRoot } from '@wrongstack/core/utils';\n\nconst SPOOL_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;\n/** Stop queueing chunks on the heap when the fs stream falls this far behind. */\nconst SPOOL_WRITE_HWM_BYTES = 4 * 1024 * 1024;\n\nlet sweepStarted = false;\n\n/** Directory for spooled command output (under the wstack global root). */\nexport function toolOutputDir(): string {\n  return path.join(wstackGlobalRoot(), 'tool-output');\n}\n\n/** Reset module state \u2014 test hook (per-process sweep memo + nothing else). */\nexport function _resetOutputSpoolForTests(): void {\n  sweepStarted = false;\n}\n\nfunction sweepOldSpoolFiles(dir: string): void {\n  if (sweepStarted) return;\n  sweepStarted = true;\n  void (async () => {\n    try {\n      const now = Date.now();\n      for (const name of await fsp.readdir(dir)) {\n        if (!name.endsWith('.log')) continue;\n        const p = path.join(dir, name);\n        try {\n          const st = await fsp.stat(p);\n          if (now - st.mtimeMs > SPOOL_RETENTION_MS) await fsp.unlink(p);\n        } catch {\n          /* concurrently removed \u2014 ignore */\n        }\n      }\n    } catch {\n      /* directory doesn't exist yet \u2014 nothing to sweep */\n    }\n  })();\n}\n\nexport interface SpoolInfo {\n  /** Absolute path of the spool file. */\n  path: string;\n  /** Total bytes of output produced (including what reached the file). */\n  bytes: number;\n  /** Bytes dropped due to disk backpressure (0 in the normal case). */\n  droppedBytes: number;\n}\n\nexport interface OutputSpool {\n  /** Feed every raw output chunk. Never throws. */\n  write(text: string): void;\n  /**\n   * Close the file (if one was opened) and return its info, or null when the\n   * output never exceeded the threshold. Idempotent.\n   */\n  finalize(): SpoolInfo | null;\n}\n\nexport interface CreateOutputSpoolOptions {\n  /** Tool name used in the spool filename (sanitized). */\n  tool: string;\n  /**\n   * Output size at which the spool activates. Should match the tool's\n   * in-memory cap so files are only created for output the model can't\n   * already see in full. Default 32 KB.\n   */\n  thresholdBytes?: number | undefined;\n}\n\n/**\n * Render the marker line appended to a capped tool result. Kept in one place\n * so every command tool phrases it identically (and tests can match it).\n */\nexport function spoolNote(info: SpoolInfo): string {\n  const dropped =\n    info.droppedBytes > 0 ? `, ~${info.droppedBytes} bytes dropped under backpressure` : '';\n  return `\\n[output truncated \u2014 full ${info.bytes} bytes at ${info.path}${dropped}; read/grep that file selectively instead of re-running with more output]`;\n}\n\nexport function createOutputSpool(opts: CreateOutputSpoolOptions): OutputSpool {\n  const threshold = opts.thresholdBytes ?? 32_768;\n  const safeTool = opts.tool.replace(/[^a-zA-Z0-9._-]+/g, '_').slice(0, 40) || 'tool';\n\n  let head = '';\n  let headBytes = 0;\n  let totalBytes = 0;\n  let droppedBytes = 0;\n  let stream: WriteStream | null = null;\n  let filePath: string | null = null;\n  let failed = false;\n  let finalized = false;\n\n  const open = (): void => {\n    if (stream || failed) return;\n    try {\n      const dir = toolOutputDir();\n      // Synchronous on purpose: createWriteStream would race an async mkdir\n      // and error with ENOENT. This runs at most once per oversized command,\n      // and after the first call the dir exists (mkdirSync is a no-op stat).\n      mkdirSync(dir, { recursive: true });\n      sweepOldSpoolFiles(dir);\n      const stamp = new Date().toISOString().replace(/[:.]/g, '-');\n      const rand = Math.random().toString(36).slice(2, 6);\n      filePath = path.join(dir, `${stamp}-${safeTool}-${rand}.log`);\n      stream = createWriteStream(filePath, { flags: 'w', encoding: 'utf8' });\n      stream.on('error', () => {\n        // Disk full / permission \u2014 disable the spool, keep the tool alive.\n        failed = true;\n        stream = null;\n        filePath = null;\n      });\n      // Flush the buffered head first so the file is the complete output.\n      stream.write(head);\n    } catch {\n      failed = true;\n      stream = null;\n      filePath = null;\n    }\n  };\n\n  return {\n    write(text: string): void {\n      if (finalized || !text) return;\n      totalBytes += Buffer.byteLength(text, 'utf8');\n      if (!stream && !failed) {\n        if (headBytes + text.length <= threshold) {\n          head += text;\n          headBytes += text.length;\n          return;\n        }\n        head += text; // include the crossing chunk so the file misses nothing\n        open();\n        head = ''; // flushed into the stream by open(); release the heap copy\n        return;\n      }\n      if (stream) {\n        if (stream.writableLength > SPOOL_WRITE_HWM_BYTES) {\n          droppedBytes += Buffer.byteLength(text, 'utf8');\n          return;\n        }\n        stream.write(text);\n      }\n    },\n    finalize(): SpoolInfo | null {\n      if (finalized) {\n        return filePath ? { path: filePath, bytes: totalBytes, droppedBytes } : null;\n      }\n      finalized = true;\n      head = '';\n      if (!stream || !filePath) return null;\n      try {\n        stream.end();\n      } catch {\n        /* already closed */\n      }\n      return { path: filePath, bytes: totalBytes, droppedBytes };\n    },\n  };\n}\n", "import { createHash } from 'node:crypto';\nimport * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core/utils';\nimport type { Context } from '@wrongstack/core/agent';\n\n/**\n * sha-256 hex of a UTF-8 string. Used by the file tools to record a content\n * hash alongside the mtime in `ctx.recordRead` \u2014 the hash is the authoritative\n * staleness arbiter for `edit` (mtime has a 2 s tolerance window on Windows).\n */\nexport function sha256hex(content: string): string {\n  return createHash('sha256').update(content, 'utf8').digest('hex');\n}\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm \u2192 yarn \u2192 npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);\n}\n\n/**\n * Roots every file tool may always reach, even in restricted mode: the\n * project root and the user-global `~/.wrongstack` directory (config, memory,\n * sessions, skills). `~/.wrongstack` honors the `WRONGSTACK_HOME` override.\n */\nfunction allowedRoots(ctx: Context): string[] {\n  return [path.resolve(ctx.projectRoot), path.resolve(Core.wstackGlobalRoot())];\n}\n\n/** True if `target` is `root` itself or nested inside any of `roots`. */\nfunction isInsideAny(target: string, roots: string[]): boolean {\n  return roots.some((root) => {\n    const rel = path.relative(root, target);\n    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));\n  });\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const target = path.resolve(absPath);\n  // Unrestricted filesystem access: skip the project-root containment check.\n  if (ctx.allowOutsideProjectRoot) return target;\n  if (isInsideAny(target, allowedRoots(ctx))) return target;\n  throw new Error(`Path \"${absPath}\" is outside project root \"${path.resolve(ctx.projectRoot)}\"`);\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root\u2192out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink \u2014 macOS `/var`\u2192`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  // Unrestricted filesystem access: no symlink-escape check to perform.\n  if (ctx.allowOutsideProjectRoot) return;\n  // Compare like-for-like against the realpath of each always-allowed root\n  // (project root + ~/.wrongstack), since a root may itself be a symlink.\n  const realRoots = await Promise.all(\n    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r))),\n  );\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    if (isInsideAny(real, realRoots)) return;\n    throw new Error(\n      `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoots[0]}\"`,\n    );\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n\u2026[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]\u2026\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// \u2500\u2500\u2500 Command-output normalization (token-saving) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) \u2014 never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only \u2014 it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `\u2026 \u27E8repeated ${run}\u00D7\u27E9`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends \u2014 the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n\u2026[truncated ${total - kept} bytes]\u2026\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI \u2192 collapse\n * carriage-return progress \u2192 trim trailing whitespace \u2192 collapse identical\n * consecutive lines \u2192 squeeze blank-line runs \u2192 head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines \u2192 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n", "/**\n * ProcessRegistry \u2014 global singleton that tracks all spawned child processes\n * from `bash` and `exec` tools. Enables:\n *\n *   - Listing active processes (for TUI status bar)\n *   - Killing individual processes or all processes (for Ctrl+C and /kill)\n *   - Detecting runaway processes (hung, looping)\n *   - Circuit breaker integration to prevent recursive/repeated failures\n *\n * Thread-safety: Node.js is single-threaded, but async callbacks can fire\n * in any order. All mutations go through synchronized Map methods.\n */\nimport { spawn } from 'node:child_process';\nimport type { ChildProcess } from 'node:child_process';\nimport * as os from 'node:os';\nimport { CircuitBreaker, type CircuitBreakerSnapshot, type CircuitBreakerConfig } from './circuit-breaker.js';\nexport type { CircuitBreakerSnapshot, CircuitBreakerConfig } from './circuit-breaker.js';\n\nexport interface TrackedProcess {\n  pid: number;\n  name: string;\n  /** Display-safe redacted command string \u2014 safe for logs, /ps, crash dumps.\n   *  Contains [REDACTED] in place of sensitive flag values. */\n  command: string;\n  startedAt: number;\n  sessionId?: string | undefined;\n  /** The raw ChildProcess handle. Never call .kill() directly on this \u2014\n   *  use `kill()` below which handles process groups correctly on POSIX\n   *  and degrades gracefully on Windows. */\n  child: ChildProcess;\n  /** True only when this child was spawned as a POSIX process-group/session\n   *  leader (for example `spawn(..., { detached: true })`) and `pid` is the\n   *  actual `child.pid`. Negative-PID signaling is host-wide dangerous for\n   *  values like -1, so tests and manually registered entries must not opt in. */\n  processGroupLeader?: boolean | undefined;\n  /** True once the process has been kill()ed but not yet exited.\n   *  We keep it in the registry until 'close' fires so callers can\n   *  distinguish \"still running\" from \"just exited\". */\n  killed: boolean;\n  /** If true, kill() and killAll() will refuse to kill this process.\n   *  Used for infrastructure processes (browser, dev servers, \u2026) that\n   *  must outlive the agent session. */\n  protected: boolean;\n  /** True for an explicitly detached/background tool launch. */\n  background: boolean;\n}\n\n// redactCommand (and its sensitive-flag patterns) lives in _redact-command.ts\n// so registry-only consumers (e.g. ps-slash) don't carry its dependencies.\n// Re-exported here to keep this module's historical public API intact.\nexport { redactCommand } from './_redact-command.js';\n\ninterface KillOpts {\n  /** SIGKILL instead of SIGTERM. Default: false (SIGTERM first). */\n  force?: boolean | undefined;\n  /** MS to wait between SIGTERM and SIGKILL on POSIX. Default: 2000. */\n  graceMs?: number | undefined;\n  /** Leave explicitly backgrounded jobs alive. Default false. */\n  preserveBackground?: boolean | undefined;\n}\n\n/**\n * Snapshot of the armed auto kill/reset countdown, or null when nothing is\n * armed. `remainingMs` ticks down in real time; the TUI statusline renders it.\n */\nexport interface BreakerCountdown {\n  remainingMs: number;\n  totalMs: number;\n}\n\ntype BreakerCountdownListener = (snapshot: BreakerCountdown | null) => void;\n\nexport interface RegistryStats {\n  activeCount: number;\n  backgroundCount: number;\n  totalCount: number;\n  breaker: CircuitBreakerSnapshot;\n}\n\nconst DEFAULT_GRACE_MS = 2000;\nconst WIN32_TASKKILL_TIMEOUT_MS = 5000;\n\ninterface Win32TreeKillOptions {\n  /**\n   * Upper bound for taskkill itself before the caller's fallback may run.\n   * This is deliberately separate from POSIX SIGTERM grace: on Windows the\n   * direct-child fallback must not fire while taskkill is still walking the\n   * child tree, or it can orphan grandchildren that keep stdio open.\n   */\n  timeoutMs?: number | undefined;\n  onSettled?: (() => void) | undefined;\n}\n\n/**\n * Kill an entire process tree on Windows via `taskkill /T /F`.\n *\n * TerminateProcess (what `child.kill()` maps to) has no process-group\n * semantics, so killing a shell wrapper (`cmd.exe /c \u2026`) orphans its\n * grandchildren (node, vitest forks, dev servers). The orphans inherit the\n * parent's stdio pipe handles and can keep streaming into this process for\n * the rest of the session \u2014 which both prevents the child's 'close' event\n * from ever firing and grows in-memory output buffers without bound.\n *\n * Returns true if taskkill was spawned, false if spawning it failed (caller\n * should fall back to a direct `child.kill()`). Callers that need a direct\n * fallback should pass `onSettled`; it runs after taskkill exits, errors, or\n * exceeds `timeoutMs`, avoiding the race where killing cmd.exe first prevents\n * taskkill from enumerating and killing grandchildren.\n */\nexport function killWin32Tree(pid: number, opts: Win32TreeKillOptions = {}): boolean {\n  try {\n    const child = spawn('taskkill', ['/pid', String(pid), '/T', '/F'], {\n      stdio: 'ignore',\n      windowsHide: true,\n    });\n    let settled = false;\n    let timeout: ReturnType<typeof setTimeout> | undefined;\n    const settle = () => {\n      if (settled) return;\n      settled = true;\n      if (timeout) clearTimeout(timeout);\n      try {\n        opts.onSettled?.();\n      } catch {\n        /* fallback callbacks are best-effort */\n      }\n    };\n    // spawn() reports a failure to launch (e.g. taskkill not on PATH, blocked by\n    // security software) via an ASYNC 'error' event \u2014 the surrounding try/catch\n    // only traps synchronous throws. Without a listener that event is unhandled\n    // and crashes the whole process. Swallow it: this is best-effort tree-kill\n    // and the registry still has the direct child.kill() fallback.\n    child.on('error', settle);\n    child.on('close', settle);\n    timeout = setTimeout(() => {\n      try {\n        child.kill();\n      } catch {\n        /* already exited */\n      }\n      settle();\n    }, Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS));\n    timeout.unref?.();\n    child.unref();\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport class ProcessRegistryImpl {\n  private readonly processes = new Map<number, TrackedProcess>();\n  private readonly breaker: CircuitBreaker;\n\n  /**\n   * Auto kill/reset config. When the breaker trips and `autoKillResetMs > 0`,\n   * a countdown is armed; on expiry all tracked processes are killed and the\n   * breaker is reset to closed (forced recovery). Zero means manual recovery\n   * only (`/kill reset`).\n   */\n  private autoKillResetMs = 0;\n  private autoKillTimer: ReturnType<typeof setTimeout> | null = null;\n  private autoKillArmedAt: number | null = null;\n  private breakerCountdownListeners: BreakerCountdownListener[] = [];\n\n  constructor(breakerConfig?: CircuitBreakerConfig) {\n    this.breaker = new CircuitBreaker(breakerConfig);\n    // Arm on trip, cancel on recovery. Listeners are best-effort.\n    this.breaker.onTrip = () => this._armAutoKillReset();\n    this.breaker.onReset = () => this._cancelAutoKillReset();\n    // Protection is OFF by default \u2014 the user opts in via `/settings breaker on`.\n    this.breaker.setEnabled(false);\n  }\n\n  register(\n    info: Omit<TrackedProcess, 'killed' | 'protected' | 'background'> & {\n      protected?: boolean | undefined;\n      background?: boolean | undefined;\n    },\n  ): void {\n    this.processes.set(info.pid, {\n      ...info,\n      killed: false,\n      protected: info.protected ?? false,\n      background: info.background ?? false,\n    });\n  }\n\n  private _isSafeSignalPid(pid: number): boolean {\n    return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;\n  }\n\n  private _canSignalProcessGroup(p: TrackedProcess): boolean {\n    return (\n      os.platform() !== 'win32' &&\n      p.processGroupLeader === true &&\n      this._isSafeSignalPid(p.pid) &&\n      typeof p.child.pid === 'number' &&\n      p.child.pid === p.pid\n    );\n  }\n\n  private _killChildDirect(p: TrackedProcess, signal: NodeJS.Signals): void {\n    try {\n      p.child.kill(signal);\n    } catch {\n      // Process may have already exited, or this may be a persistent entry\n      // without a live ChildProcess handle in the current process.\n    }\n  }\n\n  private _killPosix(p: TrackedProcess, signal: NodeJS.Signals): void {\n    if (this._canSignalProcessGroup(p)) {\n      try {\n        process.kill(-p.pid, signal);\n        return;\n      } catch {\n        // Process group may already be gone; fall back to the direct child.\n      }\n    }\n    this._killChildDirect(p, signal);\n  }\n\n  /** Unregister a process by PID. Called on 'close' / 'exit' events. */\n  unregister(pid: number): void {\n    this.processes.delete(pid);\n  }\n\n  /** Get a single process by PID. */\n  get(pid: number): TrackedProcess | undefined {\n    this._pruneStale(pid);\n    return this.processes.get(pid);\n  }\n\n  /** Get all tracked processes. */\n  list(): TrackedProcess[] {\n    this._pruneAllStale();\n    return Array.from(this.processes.values());\n  }\n\n  /** Get processes filtered by name (e.g. 'bash', 'exec'). */\n  byName(name: string): TrackedProcess[] {\n    return this.list().filter((p) => p.name === name);\n  }\n\n  /** Get processes filtered by session. */\n  bySession(sessionId: string): TrackedProcess[] {\n    return this.list().filter((p) => p.sessionId === sessionId);\n  }\n\n  /** Count of active (non-killed) processes. */\n  get activeCount(): number {\n    let n = 0;\n    for (const p of this.processes.values()) {\n      if (!p.killed) n++;\n    }\n    return n;\n  }\n\n  /** Count of active jobs explicitly launched in background mode. */\n  get activeBackgroundCount(): number {\n    let n = 0;\n    for (const p of this.processes.values()) {\n      if (p.background && !p.killed) n++;\n    }\n    return n;\n  }\n\n  /**\n   * Combined stats for observability \u2014 used by /ps and the TUI status bar.\n   */\n  stats(): RegistryStats {\n    this._pruneAllStale();\n    return {\n      activeCount: this.activeCount,\n      backgroundCount: this.activeBackgroundCount,\n      totalCount: this.processes.size,\n      breaker: this.breaker.snapshot(),\n    };\n  }\n\n  /**\n   * Returns true if the circuit allows a new bash/exec call to proceed.\n   * When false, callers MUST NOT spawn a process.\n   */\n  get canProceed(): boolean {\n    return this.breaker.canProceed;\n  }\n\n  /**\n   * Called before spawning a process. Returns true if allowed; false if\n   * the circuit breaker is open.\n   *\n   * @param bypass - If true, skip circuit breaker check (for background processes).\n   */\n  beforeCall(bypass = false): boolean {\n    return this.breaker.beforeCall(bypass);\n  }\n\n  /**\n   * Called after a process finishes. `durationMs` is wall-clock time;\n   * `failed` is true for non-zero exit codes.\n   *\n   * @param bypass - If true, do not update circuit breaker state (for background processes).\n   */\n  afterCall(durationMs: number, failed: boolean, bypass = false): void {\n    this.breaker.afterCall(durationMs, failed, bypass);\n  }\n\n  /** Force-open the circuit breaker (Ctrl+C, /kill force). */\n  forceBreakerOpen(): void {\n    this.breaker.forceOpen();\n  }\n\n  /** Force-reset the circuit breaker to closed (/kill reset). */\n  forceBreakerReset(): void {\n    this.breaker.forceReset();\n  }\n\n  /**\n   * Configure circuit-breaker protection at runtime. Called from `/settings`\n   * (instant, all modes) and on TUI mount (applies persisted config).\n   *\n   * - `enabled` toggles whether the breaker gates `bash`/`exec`.\n   * - `autoKillResetMs` arms the auto kill/reset countdown when the breaker\n   *   trips (0 = manual recovery only).\n   *\n   * Re-applies cleanly on every call: cancels a pending countdown when the\n   * timeout is cleared or protection disabled, and re-arms if the breaker is\n   * currently open under the new settings.\n   */\n  setBreakerConfig(cfg: { enabled?: boolean | undefined; autoKillResetMs?: number | undefined }): void {\n    if (cfg.enabled !== undefined) this.breaker.setEnabled(cfg.enabled);\n    if (cfg.autoKillResetMs !== undefined) this.autoKillResetMs = Math.max(0, cfg.autoKillResetMs);\n\n    if (this.autoKillResetMs <= 0) {\n      this._cancelAutoKillReset();\n      return;\n    }\n    // If protection is active and the breaker is currently tripped, ensure a\n    // countdown is armed for the new window (covers a live config change while\n    // the breaker is already open).\n    if (this.breaker.isEnabled && this.breaker.snapshot().state === 'open') {\n      this._armAutoKillReset();\n    }\n  }\n\n  /**\n   * Live countdown to the next auto kill/reset, or null when nothing is armed.\n   * The TUI polls this on a 1s tick while armed so the statusline decrements.\n   */\n  getBreakerCountdown(): BreakerCountdown | null {\n    if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;\n    const elapsed = Date.now() - this.autoKillArmedAt;\n    return { remainingMs: Math.max(0, this.autoKillResetMs - elapsed), totalMs: this.autoKillResetMs };\n  }\n\n  /**\n   * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.\n   * Use {@link getBreakerCountdown} for the live ticking value between events.\n   */\n  onBreakerCountdownChange(listener: BreakerCountdownListener): () => void {\n    this.breakerCountdownListeners.push(listener);\n    return () => {\n      this.breakerCountdownListeners = this.breakerCountdownListeners.filter((l) => l !== listener);\n    };\n  }\n\n  private _emitBreakerCountdown(): void {\n    const snap = this.getBreakerCountdown();\n    for (const l of this.breakerCountdownListeners) {\n      try {\n        l(snap);\n      } catch {\n        /* listener failure must never affect breaker behavior */\n      }\n    }\n  }\n\n  /**\n   * Arm the auto kill/reset countdown. Idempotent: re-arming resets the window\n   * (a fresh trip after a failed half-open probe restarts the clock). No-op\n   * when protection is off or no timeout is configured.\n   */\n  private _armAutoKillReset(): void {\n    if (this.autoKillResetMs <= 0 || !this.breaker.isEnabled) return;\n    this._clearAutoKillTimer();\n    this.autoKillArmedAt = Date.now();\n    this.autoKillTimer = setTimeout(() => {\n      this.autoKillTimer = null;\n      this.autoKillArmedAt = null;\n      // Forced recovery: nuke runaway processes and reopen the circuit.\n      this.killAll({ force: false, preserveBackground: true });\n      this.breaker.forceReset();\n      this._emitBreakerCountdown();\n    }, this.autoKillResetMs);\n    // Don't keep the event loop alive purely for auto-recovery.\n    this.autoKillTimer.unref?.();\n    this._emitBreakerCountdown();\n  }\n\n  private _cancelAutoKillReset(): void {\n    const wasArmed = this.autoKillArmedAt !== null;\n    this._clearAutoKillTimer();\n    if (wasArmed) {\n      this.autoKillArmedAt = null;\n      this._emitBreakerCountdown();\n    }\n  }\n\n  private _clearAutoKillTimer(): void {\n    if (this.autoKillTimer !== null) {\n      clearTimeout(this.autoKillTimer);\n      this.autoKillTimer = null;\n    }\n  }\n\n  /** Kill a single process by PID.\n   *\n   *  On POSIX: sends SIGTERM to the *process group* (-pid) so that\n   *  runaway grandchild processes (`sleep 9999 & disown`) are also killed.\n   *  After `graceMs` a SIGKILL is sent if the process hasn't exited.\n   *\n   *  On Windows: `child.kill()` maps to TerminateProcess \u2014 process groups\n   *  are not meaningfully supported. A second `force=true` call sends\n   *  SIGKILL (which maps to TerminateProcess again \u2014 the distinction is\n   *  in the exit code, not the signal).\n   *\n   *  Returns true if the process was found and kill was attempted.\n   */\n  kill(pid: number, opts: KillOpts = {}): boolean {\n    this._pruneStale(pid);\n    const p = this.processes.get(pid);\n    if (!p) return false;\n    if (p.killed) return true; // already kill()ed, don't double-send\n    if (p.protected) return false; // protected processes are never kill()ed\n    if (opts.preserveBackground && p.background) return false;\n\n    const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;\n    const isWin = os.platform() === 'win32';\n\n    if (isWin) {\n      // Windows: no process group semantics. A direct kill terminates only\n      // the immediate child \u2014 shell-wrapped commands (cmd.exe /c \u2026) leave\n      // grandchildren running that hold the inherited stdio pipes open and\n      // keep feeding output into this process indefinitely. Kill the whole\n      // tree via taskkill instead, but only for a real, still-running child\n      // (exitCode === null); test fakes and already-exited processes take\n      // the plain-kill path. The direct kill is deliberately NOT sent\n      // immediately alongside taskkill: killing the root first would break\n      // taskkill's parent-pid tree enumeration and orphan the grandchildren\n      // again \u2014 it runs as a delayed fallback instead.\n      const liveRealChild = p.child.exitCode === null && typeof p.child.pid === 'number';\n      const directFallback = () => {\n        if (p.child.exitCode === null) {\n          try {\n            p.child.kill('SIGKILL');\n          } catch {\n            // Process may have already exited.\n          }\n        }\n      };\n      if (\n        liveRealChild &&\n        killWin32Tree(pid, {\n          timeoutMs: Math.max(graceMs, WIN32_TASKKILL_TIMEOUT_MS),\n          onSettled: directFallback,\n        })\n      ) {\n        // The direct fallback is intentionally chained from taskkill's\n        // completion. Killing cmd.exe before taskkill has walked the tree can\n        // orphan the real command and leave stdio pipes open forever.\n      } else {\n        try {\n          p.child.kill(force ? 'SIGKILL' : 'SIGTERM');\n        } catch {\n          // Process may have already exited.\n        }\n      }\n      p.killed = true;\n      return true;\n    }\n\n    // POSIX: kill the process group only when the tracked child is proven to\n    // be the group leader. Otherwise use child.kill(); negative PID signaling\n    // with untrusted/fake PIDs can target unrelated host processes.\n    try {\n      if (force) {\n        this._killPosix(p, 'SIGKILL');\n      } else {\n        this._killPosix(p, 'SIGTERM');\n        // Schedule SIGKILL as backup.\n        const timer = setTimeout(() => {\n          // Re-check: process may have exited on its own.\n          if (this.processes.has(pid) && !p.child.killed) {\n            this._killPosix(p, 'SIGKILL');\n          }\n        }, graceMs);\n        timer.unref?.(); // Don't keep event loop alive.\n      }\n    } catch {\n      // Process may have already exited.\n    }\n    p.killed = true;\n    return true;\n  }\n\n  /**\n   * Kill all tracked processes.\n   * Returns the PIDs that were kill()ed.\n   */\n  killAll(opts: KillOpts = {}): number[] {\n    const pids = Array.from(this.processes.keys());\n    const killed: number[] = [];\n    for (const pid of pids) {\n      const p = this.processes.get(pid);\n      if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);\n    }\n    return killed;\n  }\n\n  /**\n   * Kill all processes for a specific session.\n   * Returns the PIDs that were kill()ed.\n   */\n  killSession(sessionId: string, opts: KillOpts = {}): number[] {\n    const pids = this.bySession(sessionId).map((p) => p.pid);\n    const killed: number[] = [];\n    for (const pid of pids) {\n      if (this.kill(pid, opts)) killed.push(pid);\n    }\n    return killed;\n  }\n\n  /**\n   * Check whether a tracked process entry is stale \u2014 the child has exited\n   * (exitCode !== null) AND it's been in the registry long enough that the\n   * OS may have reused the PID for a new, unrelated process.\n   *\n   * P3 #24 (before-release.md): on POSIX, PIDs are reused after process\n   * exit. If a tracked process exits but its 'close' event hasn't fired yet\n   * (or was missed), the registry still holds the entry. A new process\n   * gets the same PID, and PID-based lookups (get, kill, shouldBlockKill)\n   * may incorrectly protect or target the wrong process.\n   *\n   * The 60s threshold is conservative \u2014 the OS typically waits much longer\n   * before reusing a PID, but we want to clean up before that becomes a risk.\n   */\n  private _isStaleEntry(entry: TrackedProcess): boolean {\n    return entry.child.exitCode !== null && Date.now() - entry.startedAt > 60_000;\n  }\n\n  /**\n   * Remove a stale entry for a specific PID before any PID-based lookup.\n   * This prevents PID reuse from causing the registry to act on a dead\n   * process that has been replaced by a new one with the same PID.\n   */\n  private _pruneStale(pid: number): void {\n    const entry = this.processes.get(pid);\n    if (entry && this._isStaleEntry(entry)) {\n      this.processes.delete(pid);\n    }\n  }\n\n  /**\n   * Remove every stale entry, not just one PID. `list()`/`stats()` \u2014 the\n   * surfaces the TUI status bar and `/ps` poll \u2014 must prune too: a child\n   * whose 'close' event never fires (e.g. Windows grandchildren holding stdio\n   * open) would otherwise linger in the registry until someone looks up its\n   * exact PID, and PID reuse meanwhile makes `get()`/`kill()` target the\n   * wrong process. RAM-leak audit 2026-07-31, MEDIUM.\n   */\n  private _pruneAllStale(): void {\n    for (const [pid, entry] of this.processes) {\n      if (this._isStaleEntry(entry)) this.processes.delete(pid);\n    }\n  }\n}\n\n/** Module-level singleton. Initialized on first access. */\nlet _registry: ProcessRegistryImpl | undefined;\n\nexport function getProcessRegistry(): ProcessRegistryImpl {\n  if (!_registry) {\n    _registry = new ProcessRegistryImpl();\n  }\n  return _registry;\n}\n\n/** Reset for tests. */\nexport function _resetProcessRegistry(): void {\n  _registry = undefined;\n}\n\n// \u2500\u2500 Convenience re-exports \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport type { KillOpts };\n", "/**\n * CircuitBreaker \u2014 prevents runaway bash/exec tool chains by:\n *\n *   - Tripping on consecutive failures (models that keep repeating the\n *     same failing command, e.g. `npm install` with wrong args in a loop)\n *   - Tripping on slow call ratio (too many long-running commands suggest\n *     a hung subprocess that the model doesn't know how to kill)\n *   - Rate-limiting bursts (rapid succession of commands without reading\n *     output suggests the model isn't processing results)\n *   - Auto-recovering after a cooldown period so a fixed model can resume\n *\n * The breaker is owned by the ProcessRegistry so any tool that registers\n * a process participates in the same circuit. \"Per-tool\" isolation is\n * intentionally NOT implemented \u2014 the model treats bash/exec as one\n * resource pool; isolating them would let the model route around the\n * breaker by alternating which tool it uses.\n */\n\nexport interface CircuitBreakerConfig {\n  /**\n   * Consecutive failures before trip. Default: 5.\n   * A single success resets this counter to 0.\n   */\n  maxConsecutiveFailures?: number | undefined;\n  /**\n   * Slow-call threshold in ms. A call that runs longer than this is\n   * counted as \"slow\". Default: 60_000 (1 minute).\n   */\n  slowCallThresholdMs?: number | undefined;\n  /**\n   * Max slow calls before trip (within the sliding window). Default: 3.\n   */\n  maxSlowCalls?: number | undefined;\n  /**\n   * Sliding window for rate-limit and slow-call counting, in ms.\n   * Default: 60_000 (1 minute).\n   */\n  windowMs?: number | undefined;\n  /**\n   * Max calls within the sliding window. Default: 30.\n   * Burst exceeding this trips the breaker immediately.\n   */\n  maxCallsPerWindow?: number | undefined;\n  /**\n   * Cooldown before auto-recovery attempt, in ms. Default: 30_000 (30s).\n   * After this the breaker enters \"half-open\" state and allows one call\n   * through to test whether the problem is resolved.\n   */\n  cooldownMs?: number | undefined;\n}\n\ninterface CallRecord {\n  at: number;\n  /** True if the call threw or returned an is_error result. */\n  failed: boolean;\n  /** True if elapsed time exceeded slowCallThresholdMs. */\n  slow: boolean;\n}\n\ntype BreakerState = 'closed' | 'open' | 'half-open';\n\nconst DEFAULT_MAX_CONSECUTIVE_FAILURES = 5;\nconst DEFAULT_SLOW_CALL_THRESHOLD_MS = 180_000;\n// 3 minutes \u2014 balanced against the 5-minute bash timeout. Commands\n// running <3min are normal; 3-5min are \"slow\" and count toward the\n// breaker. 3 consecutive slow calls trip the circuit.\nconst DEFAULT_MAX_SLOW_CALLS = 3;\nconst DEFAULT_WINDOW_MS = 60_000;\nconst DEFAULT_MAX_CALLS_PER_WINDOW = 30;\nconst DEFAULT_COOLDOWN_MS = 30_000;\n\nexport interface CircuitBreakerSnapshot {\n  state: 'closed' | 'open' | 'half-open';\n  consecutiveFailures: number;\n  slowCallsInWindow: number;\n  callsInWindow: number;\n  windowMs: number;\n  cooldownRemainingMs: number | null;\n  lastFailureAt: number | null;\n  lastSlowAt: number | null;\n}\n\nexport class CircuitBreaker {\n  private readonly maxConsecutiveFailures: number;\n  private readonly slowCallThresholdMs: number;\n  private readonly maxSlowCalls: number;\n  private readonly windowMs: number;\n  private readonly maxCallsPerWindow: number;\n  private readonly cooldownMs: number;\n\n  private state: BreakerState = 'closed';\n  private consecutiveFailures = 0;\n  private window: CallRecord[] = [];\n  private lastFailureAt: number | null = null;\n  private lastSlowAt: number | null = null;\n  /** Timestamp when the breaker was opened (for cooldown calculation). */\n  private openedAt: number | null = null;\n\n  /**\n   * Master enable flag. When false the breaker is bypassed: `beforeCall`\n   * always returns true and `afterCall` records nothing. The class itself\n   * defaults to enabled (so the standalone unit tests exercise tripping); the\n   * ProcessRegistry flips this off until the user opts in via `/settings`.\n   */\n  private enabled = true;\n\n  /**\n   * Fired (best-effort) when the breaker transitions into the `open` state.\n   * The registry uses this to arm its auto kill/reset countdown.\n   */\n  onTrip?: (() => void) | undefined;\n  /**\n   * Fired (best-effort) when the breaker returns to `closed` after having been\n   * open/half-open. The registry uses this to cancel a pending kill/reset.\n   */\n  onReset?: (() => void) | undefined;\n\n  constructor(config: CircuitBreakerConfig = {}) {\n    this.maxConsecutiveFailures = config.maxConsecutiveFailures ?? DEFAULT_MAX_CONSECUTIVE_FAILURES;\n    this.slowCallThresholdMs = config.slowCallThresholdMs ?? DEFAULT_SLOW_CALL_THRESHOLD_MS;\n    this.maxSlowCalls = config.maxSlowCalls ?? DEFAULT_MAX_SLOW_CALLS;\n    this.windowMs = config.windowMs ?? DEFAULT_WINDOW_MS;\n    this.maxCallsPerWindow = config.maxCallsPerWindow ?? DEFAULT_MAX_CALLS_PER_WINDOW;\n    this.cooldownMs = config.cooldownMs ?? DEFAULT_COOLDOWN_MS;\n  }\n\n  /** Toggle the master enable. Disabling resets to a clean `closed` state. */\n  setEnabled(enabled: boolean): void {\n    if (this.enabled === enabled) return;\n    this.enabled = enabled;\n    if (!enabled) this._reset();\n  }\n\n  get isEnabled(): boolean {\n    return this.enabled;\n  }\n\n  /**\n   * Returns true if the circuit allows a new call to proceed.\n   * When false, callers should abort the tool call and return a\n   * circuit-breaker error instead of spawning a process.\n   */\n  get canProceed(): boolean {\n    if (!this.enabled) return true;\n    this._checkStateTransition();\n    return this.state !== 'open';\n  }\n\n  /**\n   * Snapshot of the current breaker state for observability (`/kill`).\n   */\n  snapshot(): CircuitBreakerSnapshot {\n    this._checkStateTransition();\n    const now = Date.now();\n    let cooldownRemaining: number | null = null;\n    if (this.openedAt !== null && this.state === 'open') {\n      const elapsed = now - this.openedAt;\n      cooldownRemaining = Math.max(0, this.cooldownMs - elapsed);\n    }\n    return {\n      state: this.state,\n      consecutiveFailures: this.consecutiveFailures,\n      slowCallsInWindow: this.window.filter((c) => c.slow).length,\n      callsInWindow: this.window.length,\n      windowMs: this.windowMs,\n      cooldownRemainingMs: cooldownRemaining,\n      lastFailureAt: this.lastFailureAt,\n      lastSlowAt: this.lastSlowAt,\n    };\n  }\n\n  /**\n   * Call this BEFORE spawning a bash/exec process.\n   * Returns true if the call is allowed; false if the breaker is open.\n   * When false, callers MUST NOT spawn a process.\n   *\n   * @param bypass - If true, skip the circuit breaker check entirely.\n   *                  Use for background/fire-and-forget processes that should\n   *                  not affect breaker state.\n   */\n  beforeCall(bypass = false): boolean {\n    if (bypass || !this.enabled) return true;\n    this._checkStateTransition();\n    if (this.state === 'open') return false;\n    return true;\n  }\n\n  /**\n   * Call this AFTER a bash/exec process finishes (success or failure).\n   * `durationMs` is the wall-clock time the process ran.\n   * `failed` is true when the process returned a non-zero exit code or\n   * threw an exception before spawning.\n   *\n   * @param bypass - If true, do not update breaker state.\n   *                  Use for background/fire-and-forget processes.\n   */\n  afterCall(durationMs: number, failed: boolean, bypass = false): void {\n    if (bypass || !this.enabled) return;\n\n    const now = Date.now();\n\n    if (this.state === 'half-open') {\n      // First call through after cooldown \u2014 if it failed, go back to open.\n      if (failed) {\n        this._trip();\n        return;\n      }\n      // Success in half-open \u2192 reset to closed.\n      this._reset();\n      return;\n    }\n\n    // Prune old records outside the sliding window.\n    this._pruneWindow(now);\n\n    const slow = durationMs >= this.slowCallThresholdMs;\n    this.window.push({ at: now, failed, slow });\n\n    if (failed) {\n      this.consecutiveFailures++;\n      this.lastFailureAt = now;\n      if (this.consecutiveFailures >= this.maxConsecutiveFailures) {\n        this._trip();\n      }\n      return;\n    }\n\n    // Success: reset consecutive failure counter.\n    this.consecutiveFailures = 0;\n\n    if (slow) {\n      this.lastSlowAt = now;\n      const slowCount = this.window.filter((c) => c.slow).length;\n      if (slowCount >= this.maxSlowCalls) {\n        this._trip();\n      }\n    }\n\n    const callCount = this.window.length;\n    if (callCount >= this.maxCallsPerWindow) {\n      // Rate limit exceeded. This is a soft trip \u2014 we reset the window\n      // and let the next call try immediately (the caller will still see\n      // canProceed=false until the window drains naturally).\n      this._trip();\n    }\n  }\n\n  /** Force the breaker open. Used by /kill force and Ctrl+C. */\n  forceOpen(): void {\n    this._trip();\n  }\n\n  /** Force a reset to closed. Used by tests and /kill reset. */\n  forceReset(): void {\n    this._reset();\n  }\n\n  private _trip(): void {\n    if (this.state === 'open') return; // already open\n    this.state = 'open';\n    this.openedAt = Date.now();\n    // P3 #23 (before-release.md): clear the window on trip. Old records are\n    // irrelevant once tripped \u2014 the breaker starts fresh after cooldown\n    // (half-open \u2192 closed resets the counters). Without this the window array\n    // holds onto CallRecord entries for its lifetime if no new afterCall()\n    // arrives (which is the case when the breaker stays open and no new calls\n    // are attempted).\n    this.window = [];\n    // Best-effort: never let a listener failure corrupt breaker state.\n    try {\n      this.onTrip?.();\n    } catch {\n      /* ignored \u2014 observability hook only */\n    }\n  }\n\n  private _reset(): void {\n    const wasRecovering = this.state !== 'closed';\n    this.state = 'closed';\n    this.consecutiveFailures = 0;\n    this.window = [];\n    this.openedAt = null;\n    // Only notify on a real recovery (open/half-open \u2192 closed), not on the\n    // initial closed state or an idempotent re-reset.\n    if (wasRecovering) {\n      try {\n        this.onReset?.();\n      } catch {\n        /* ignored \u2014 observability hook only */\n      }\n    }\n  }\n\n  /** Transition from open \u2192 half-open when cooldown elapses. */\n  private _checkStateTransition(): void {\n    if (this.state !== 'open' || this.openedAt === null) return;\n    const elapsed = Date.now() - this.openedAt;\n    if (elapsed >= this.cooldownMs) {\n      this.state = 'half-open';\n      this.openedAt = null;\n    }\n  }\n\n  private _pruneWindow(now: number): void {\n    const cutoff = now - this.windowMs;\n    this.window = this.window.filter((c) => c.at >= cutoff);\n  }\n}", "import { expectDefined } from '@wrongstack/core/utils';\n\n// Sensitive CLI flag patterns that may appear in process command lines.\n// Redacted to [REDACTED] so crash dumps /ps output cannot leak secrets.\n// Split out of process-registry.ts so entries that only need the registry\n// (e.g. ps-slash) don't carry this module's dependencies.\n//\n// NOTE: @wrongstack/core carries its own copy (observability/redact-command.ts)\n// so the emitProcessStarted telemetry producer can redact command+args\n// centrally. Keep these two copies in sync when updating the patterns.\nconst SENSITIVE_FLAG_PATTERNS: RegExp[] = [\n  // --flag=value  or  --flag \"value\"  (value captured up to next space or comma)\n  /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\\s,][^\\s]*)?/gi,\n  // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.\n  // (?<![-\\w]) anchors to a token start so we don't match the `-t` inside `--token`.\n  // NOTE: synced with @wrongstack/core observability/redact-command.ts.\n  /(?<![-\\w])-t(?:[=\\s]+)?[^\\s,-]+/,\n  // -p|-password|-a (redis auth) short flags: attached + separated + =value.\n  // Same token-start anchor; over-redaction is an accepted tradeoff for a\n  // redaction function. Synced with core copy.\n  /(?<![-\\w])-(?:password|p|a)(?:[=\\s]+)?[^\\s,-]+/gi,\n  // env var\u2013style secrets: TOKEN=x, API_KEY=y, etc.\n  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\\s*[=:]\\s*[^\\s,]+/gi,\n  // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits \u2014 but only\n  // when preceded by a flag name (e.g. --github-token=EyJ...).\n  /--\\w*(?:token|key|secret|password|passwd|auth|credential)\\w*[=\\s,][A-Za-z0-9+/=]{32,}/,\n];\n\n/**\n * Returns a display-safe copy of `cmd` with sensitive flag values replaced by [REDACTED].\n * The original string is unchanged; this is pure and has no side effects.\n */\nexport function redactCommand(cmd: string): string {\n  let result = cmd;\n  for (const pattern of SENSITIVE_FLAG_PATTERNS) {\n    result = result.replace(pattern, (match) => {\n      // Preserve the flag name portion; redact only the value part.\n      // e.g. \"--token=sekrit_abc\"  \u2192  \"--token=[REDACTED]\"\n      const eq = match.indexOf('=');\n      const sp = match.search(/\\s/);\n      const delim = eq !== -1 ? '=' : sp !== -1 ? match[sp] : null;\n      if (delim !== null) {\n        const flag = match.slice(0, match.indexOf(expectDefined(delim)) + 1);\n        return `${flag}[REDACTED]`;\n      }\n      // No delimitable separator found in the match.\n      if (match.startsWith('--')) {\n        // Long flag with no value attached (e.g. a bare \"--token\" argv token).\n        // No secret here \u2014 leave it untouched so downstream pair-scan can still\n        // recognize the bare flag. NOTE: keep this synced with\n        // @wrongstack/core observability/redact-command.ts.\n        return match;\n      }\n      // Short flag attached form (-pVALUE, -tVALUE, -aVALUE): flag name is the\n      // leading -X (2 chars); redact everything after. Don't use a greedy\n      // [a-zA-Z0-9_-]* flag-name match \u2014 value chars would be consumed into the\n      // flag name and the secret would survive. Synced with core copy.\n      return `${match.slice(0, 2)}[REDACTED]`;\n    });\n  }\n  return result;\n}\n", "import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\n/**\n * On Windows, Node.js `spawn()` without a shell does NOT resolve .cmd/.bat\n * extensions through PATHEXT \u2014 it only auto-resolves .exe. Most Node.js CLI\n * tools (npx, pnpm, biome, tsc, vitest, etc.) ship as .cmd wrappers on\n * Windows. This function resolves the command name to its full path so spawn\n * can find it without relying on shell-mode argument concatenation.\n *\n * On non-Windows, returns the command unchanged.\n */\nexport function resolveWin32Command(cmd: string): string {\n  if (process.platform !== 'win32') return cmd;\n\n  // Already has a path or extension \u2014 use as-is\n  // Normalize forward slashes so path.extname correctly detects extensions\n  // even when a Unix-style path is passed on Windows.\n  if (cmd.includes('/') || cmd.includes('\\\\') || path.extname(cmd.replace(/\\//g, '\\\\'))) {\n    return cmd;\n  }\n\n  const pathext = (process.env['PATHEXT'] ?? '.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC')\n    .toLowerCase()\n    .split(';');\n\n  const pathDirs = (process.env['PATH'] ?? '').split(path.delimiter);\n\n  for (const dir of pathDirs) {\n    const base = path.join(dir, cmd);\n    // Check extensions in PATHEXT order. .EXE should win first because\n    // it's typically listed first, and .exe doesn't need shell: true.\n    for (const ext of pathext) {\n      const full = `${base}${ext}`;\n      try {\n        fs.accessSync(full, fs.constants.X_OK);\n        return full;\n      } catch {\n        // Not found with this extension \u2014 try next\n      }\n    }\n  }\n\n  // Not found \u2014 return original; let spawn report ENOENT with the\n  // expected error message so tools can surface it properly.\n  return cmd;\n}\n\n/**\n * Resolve a PowerShell binary by name. `pickShell` in `_shell-pick.ts`\n * already decides whether the user wants `'pwsh'` (PowerShell 7+) or\n * `'powershell'` (Windows PowerShell 5.1). This helper turns that decision\n * into a real on-disk path.\n *\n * Order:\n *   1. If `cmd` is `pwsh` and a `pwsh.exe` exists on PATH \u2192 return that.\n *   2. If `cmd` is `pwsh` and only `powershell.exe` exists \u2192 fall back to\n *      that (the alternative is a cryptic ENOENT for the user).\n *   3. Symmetric for `powershell`: prefer `powershell.exe`, fall back to\n *      `pwsh.exe` if installed and the legacy binary is missing.\n *   4. Anything else \u2192 delegate to `resolveWin32Command` (handles `.cmd`\n *      shims a sysadmin might drop in place, etc.).\n *\n * Returns the original command on ENOENT \u2014 `spawn()` will surface a clean\n * ENOENT and the user sees \"PowerShell not installed\", which is the right\n * diagnostic. We never throw from here.\n */\nexport function resolvePowerShell(cmd: string): string {\n  if (process.platform !== 'win32') return cmd;\n  const lower = cmd.toLowerCase();\n  if (lower !== 'pwsh' && lower !== 'powershell' && lower !== 'pwsh.exe' && lower !== 'powershell.exe') {\n    return resolveWin32Command(cmd);\n  }\n  // Prefer the requested edition, fall back to the other one.\n  const primary = lower.startsWith('pwsh') ? 'pwsh.exe' : 'powershell.exe';\n  const fallback = lower.startsWith('pwsh') ? 'powershell.exe' : 'pwsh.exe';\n  const resolved = resolveWin32Command(primary);\n  if (resolved !== primary) {\n    // resolveWin32Command returns the original string when not found.\n    const fb = resolveWin32Command(fallback);\n    return fb === fallback ? cmd : fb;\n  }\n  return resolved;\n}\n\n/**\n * cmd.exe metacharacters that chain a new command or redirect I/O. When a\n * `.cmd`/`.bat` wrapper is launched through `cmd.exe`, any argument carrying\n * one of these can break out of the intended command line and run an\n * attacker-chosen command (the CVE-2024-27980 / \"BatBadBut\" argument-injection\n * class). We use a single vetted command line for cmd shims, so this guard is\n * mandatory before spawning.\n *\n * The set is limited to the unambiguous command-separator / redirection chars\n * plus newlines and NUL. Legitimate package-manager / test-runner flags and\n * Windows file paths (which use `:` `\\` `/` `.` `-` `_` space `(` `)`) never\n * contain these, so the guard is false-positive-free. Double quotes are also\n * rejected because cmd.exe quote toggling can break argument grouping.\n */\nconst WIN32_SHELL_META = /[&|<>\"\\r\\n\\0]/;\n\nexport interface Win32CmdShimInvocation {\n  command: string;\n  args: string[];\n  windowsVerbatimArguments: true;\n}\n\n/**\n * Throw if any argument contains a cmd.exe command-injection metacharacter.\n * Call this ONLY on the Windows `.cmd`/`.bat` shim path. A no-op for safe args.\n */\nexport function assertSafeWin32ShellArgs(args: readonly unknown[]): void {\n  for (const arg of args) {\n    if (typeof arg === 'string' && WIN32_SHELL_META.test(arg)) {\n      throw new Error(\n        'win32 cmd shim spawn: argument contains a shell metacharacter ' +\n          '(one of & | < > \", or a newline) that could enable command injection ' +\n          'through the .cmd/.bat wrapper - refusing to run. Offending argument: ' +\n          JSON.stringify(arg),\n      );\n    }\n  }\n}\n\nexport function buildWin32CmdShimInvocation(\n  command: string,\n  args: readonly string[] = [],\n): Win32CmdShimInvocation {\n  assertSafeWin32ShellArgs([command, ...args]);\n  const line = ['call', quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(' ');\n  return {\n    command: process.env['COMSPEC'] ?? 'cmd.exe',\n    args: ['/d', '/c', line],\n    windowsVerbatimArguments: true,\n  };\n}\n\nfunction quoteWin32CmdArg(arg: string): string {\n  return `\"${arg}\"`;\n}\n", "/**\n * Heuristic danger detection for `exec` tool commands.\n *\n * Layered on top of `BLOCKED_ARG_PATTERNS` (which is a hard-deny list for\n * clear sandbox escapes) and `bash-kill-guard.ts` (which protects WrongStack\n * itself from kill). This module assigns a danger level to a command/arg\n * pair so the caller can decide whether to:\n *\n *   - 'safe'        \u2192 execute normally\n *   - 'caution'     \u2192 execute and emit a warning line to the tool output\n *   - 'destructive' \u2192 route through the existing confirm flow\n *                     (`execTool.permission === 'confirm'`) instead of\n *                     hard-deny, so the user can still proceed if intentional\n *\n * Design constraints:\n *   - Deterministic: no randomness, no I/O, no time. Same input \u2192 same output.\n *   - No LLM calls. Patterns are regex / exact-match.\n *   - Per-rule `id` so config can override specific rules via\n *     `tools.exec.danger.bypass`.\n *   - Reasons are human-readable, joined with \"; \" for the confirm prompt.\n *\n * Caution rules are deliberately permissive \u2014 they execute and emit a\n * warning rather than blocking. The rationale: many of these patterns\n * (python -c, sudo) are part of legitimate dev workflows,\n * so a hard deny would block too much. A warning gives the user a\n * chance to notice \"wait, I didn't mean to do that\" without forcing\n * them to add a config override for every script.\n */\n\nexport type DangerLevel = 'safe' | 'caution' | 'destructive';\n\nexport interface DangerAssessment {\n  level: DangerLevel;\n  reasons: string[];\n  /** Stable id of the matched rule, for tests and config-override. */\n  matchedRule?: string;\n}\n\ninterface DangerRule {\n  id: string;\n  level: DangerLevel;\n  /** Match a (cmd, args) pair. Return true if this rule fires. */\n  test: (cmd: string, args: readonly string[]) => boolean;\n  /** Human-readable explanation, joined with \"; \" in the output. */\n  reason: string;\n}\n\nconst argHas = (args: readonly string[], value: string): boolean => args.includes(value);\nconst argMatches = (args: readonly string[], re: RegExp): boolean => args.some((a) => re.test(a));\n/**\n * Check for a flag like `-rf`, `-fr`, `-r -f`, `-f -r` etc. where the *order*\n * (and whether the letters are joined into one token or split across\n * separate `-x` tokens) does not matter. We accumulate every short-flag\n * letter seen across all args, then check the required letters are all\n * present somewhere in that set.\n */\nconst hasShortFlags = (args: readonly string[], letters: string): boolean => {\n  const seen = new Set<string>();\n  for (const a of args) {\n    if (!a.startsWith('-') || a.startsWith('--')) continue;\n    for (const ch of a.replace(/^-+/, '')) seen.add(ch);\n  }\n  return letters.split('').every((l) => seen.has(l));\n};\n\nconst RULES: readonly DangerRule[] = [\n  // ----- rm / rmdir: recursive force delete (any path) -----\n  // Note: BLOCKED_ARG_PATTERNS already hard-denies root/home/glob paths,\n  // but `rm -rf ./build` is a normal dev workflow that the user might\n  // want to do intentionally. We downgrade it to 'destructive' so the\n  // confirm prompt can approve.\n  {\n    id: 'rm-recursive',\n    level: 'destructive',\n    test: (cmd, args) => (cmd === 'rm' || cmd === 'rmdir') && hasShortFlags(args, 'rf'),\n    reason: 'recursive force-delete',\n  },\n  // ----- Windows PowerShell Remove-Item: -Recurse -Force -----\n  {\n    id: 'powershell-remove-item-recursive-force',\n    level: 'destructive',\n    test: (cmd, args) => {\n      if (cmd !== 'powershell' && cmd !== 'pwsh') return false;\n      const hasRecurse = argMatches(args, /^-(?:R|Recurse|Recurse\\s)/);\n      const hasForce = argHas(args, '-Force') || argHas(args, '-F');\n      // Allow `-WhatIf` (dry-run) without confirmation\n      if (argHas(args, '-WhatIf')) return false;\n      return hasRecurse && hasForce;\n    },\n    reason: 'Remove-Item with -Recurse -Force',\n  },\n  // ----- find -exec / -ok / -execdir -----\n  {\n    id: 'find-exec',\n    level: 'destructive',\n    test: (cmd, args) => {\n      if (cmd !== 'find') return false;\n      return args.some(\n        (a) =>\n          a === '-exec' ||\n          a === '-exec;' ||\n          a === '-ok' ||\n          a === '-ok;' ||\n          a === '-execdir' ||\n          a === '-execdir;' ||\n          a.startsWith('-exec=') ||\n          a.startsWith('-ok=') ||\n          a.startsWith('-execdir='),\n      );\n    },\n    reason: 'find with -exec/-ok (executes arbitrary command on matches)',\n  },\n  // ----- git --exec= / --upload-pack= / --receive-pack= -----\n  // These run arbitrary commands via the git transport layer.\n  {\n    id: 'git-exec',\n    level: 'destructive',\n    test: (cmd, args) =>\n      cmd === 'git' &&\n      args.some(\n        (a) =>\n          a.startsWith('--exec=') ||\n          a.startsWith('--upload-pack=') ||\n          a.startsWith('--receive-pack=') ||\n          a === '--exec' ||\n          a === '--upload-pack' ||\n          a === '--receive-pack',\n      ),\n    reason: 'git with --exec/--upload-pack/--receive-pack (runs arbitrary code)',\n  },\n  // ----- Windows: format / diskpart / bcdedit -----\n  {\n    id: 'win32-format',\n    level: 'destructive',\n    test: (cmd) => cmd === 'format' || cmd === 'format.exe',\n    reason: 'format (Windows disk format)',\n  },\n  {\n    id: 'win32-diskpart',\n    level: 'destructive',\n    test: (cmd) => cmd === 'diskpart' || cmd === 'diskpart.exe',\n    reason: 'diskpart (Windows partition editor)',\n  },\n  {\n    id: 'win32-bcdedit',\n    level: 'destructive',\n    test: (cmd) => cmd === 'bcdedit' || cmd === 'bcdedit.exe',\n    reason: 'bcdedit (Windows boot config editor)',\n  },\n  // ----- mkfs family -----\n  {\n    id: 'mkfs',\n    level: 'destructive',\n    test: (cmd) => /^mkfs(\\.[a-z0-9]+)?$/.test(cmd) || cmd === 'mkswap',\n    reason: 'mkfs (filesystem creation \u2014 destroys existing data)',\n  },\n  // ----- dd writing to a block device -----\n  {\n    id: 'dd-to-block-device',\n    level: 'destructive',\n    test: (cmd, args) => {\n      if (cmd !== 'dd') return false;\n      return args.some((a) => /of=\\/dev\\/(sd|hd|nvme|vd|mmcblk|xvd|loop|disk)/.test(a));\n    },\n    reason: 'dd writing to a block device',\n  },\n  // ----- Secure-erase tools -----\n  {\n    id: 'shred',\n    level: 'destructive',\n    test: (cmd) => cmd === 'shred' || cmd === 'shred.exe',\n    reason: 'shred (secure file delete)',\n  },\n  {\n    id: 'wipefs',\n    level: 'destructive',\n    test: (cmd) => cmd === 'wipefs' || cmd === 'wipefs.exe',\n    reason: 'wipefs (signature wipe \u2014 destroys filesystem headers)',\n  },\n  {\n    id: 'sdelete',\n    level: 'destructive',\n    test: (cmd) => cmd === 'sdelete' || cmd === 'sdelete.exe',\n    reason: 'sdelete (Sysinternals secure delete)',\n  },\n  // ----- VCS history rewrite (destructive) -----\n  // `git push --force` / `-f` rewrites remote history. `--force-with-lease`\n  // is the safer variant (checks remote hasn't moved) but still rewrites.\n  {\n    id: 'git-push-force',\n    level: 'destructive',\n    test: (cmd, args) => {\n      if (cmd !== 'git') return false;\n      const pushIdx = args.indexOf('push');\n      if (pushIdx < 0) return false;\n      for (let i = pushIdx + 1; i < args.length; i++) {\n        const a = args[i]!;\n        if (a === '--force' || a === '-f' || a === '--force-with-lease') return true;\n        if (!a.startsWith('-') && !a.includes('=')) continue;\n        if (a.startsWith('--force') /* covers --force-with-lease already */) return true;\n      }\n      return false;\n    },\n    reason: 'git push with --force / -f (rewrites remote history)',\n  },\n  // ----- git reset --hard (destructive) -----\n  {\n    id: 'git-reset-hard',\n    level: 'destructive',\n    test: (cmd, args) =>\n      cmd === 'git' && args.some((a) => a === '--hard' || a.startsWith('--hard=')),\n    reason: 'git reset --hard (discards working tree + index)',\n  },\n  // ----- git clean -f / -fd (destructive) -----\n  {\n    id: 'git-clean-force',\n    level: 'destructive',\n    test: (cmd, args) => {\n      if (cmd !== 'git') return false;\n      const cleanIdx = args.indexOf('clean');\n      if (cleanIdx < 0) return false;\n      // Must include -f / --force (without it, git clean errors out and\n      // does nothing). -fd / -fdX combinations are subsumed.\n      return args\n        .slice(cleanIdx + 1)\n        .some(\n          (a) =>\n            a === '-f' ||\n            a === '--force' ||\n            a.startsWith('-f') /* -fd, -fdx, etc. */ ||\n            a.startsWith('--force='),\n        );\n    },\n    reason: 'git clean -f (deletes untracked files)',\n  },\n  // ----- package publish (destructive \u2014 public, irreversible) -----\n  {\n    id: 'npm-publish',\n    level: 'destructive',\n    test: (cmd, args) => {\n      if (!['npm', 'pnpm', 'yarn', 'bun', 'cargo'].includes(cmd)) return false;\n      // For npm/pnpm/yarn/bun: subcommand is \"publish\".\n      // For cargo: subcommand is \"publish\" OR \"yank\" (both touch the\n      // public registry; yank is reversible, publish is not, but yank\n      // is rare enough we treat it the same).\n      return args.includes('publish') || (cmd === 'cargo' && args.includes('yank'));\n    },\n    reason: 'publishing to a public package registry (hard to reverse)',\n  },\n  // ----- k8s cluster-wide destructive ops (destructive) -----\n  {\n    id: 'kubectl-delete-namespace',\n    level: 'destructive',\n    test: (cmd, args) => {\n      if (cmd !== 'kubectl') return false;\n      const delIdx = args.indexOf('delete');\n      if (delIdx < 0) return false;\n      // Match `kubectl delete namespace <name>` or `kubectl delete ns <name>`.\n      // Generic `kubectl delete pod foo` is left out \u2014 too common.\n      const after = args.slice(delIdx + 1);\n      return after[0] === 'namespace' || after[0] === 'ns';\n    },\n    reason: 'kubectl delete namespace (deletes all resources in the namespace)',\n  },\n  {\n    id: 'kubectl-drain',\n    level: 'destructive',\n    test: (cmd, args) => cmd === 'kubectl' && args.includes('drain'),\n    reason: 'kubectl drain (evicts pods, marks node unschedulable)',\n  },\n  // ----- inline code evaluation (caution \u2014 high false-positive) -----\n  // Common in scripts: `python -c \"...\"`, `node -e \"...\"`, `bash -c \"...\"`.\n  // We tag 'caution' rather than 'destructive' because these are used in\n  // many legitimate one-liners (e.g. `python -c \"print(1)\"`).\n  {\n    id: 'inline-eval',\n    level: 'caution',\n    test: (cmd, args) => {\n      if (\n        ![\n          'python',\n          'python3',\n          'python2',\n          'node',\n          'bash',\n          'sh',\n          'zsh',\n          'ruby',\n          'perl',\n          'lua',\n        ].includes(cmd)\n      ) {\n        return false;\n      }\n      return args.some(\n        (a) =>\n          a === '-c' ||\n          a === '-e' ||\n          a === '--eval' ||\n          a === '-eval' ||\n          a === '-E' /* node --eval shorthand in some shells */,\n      );\n    },\n    reason: 'inline script evaluation (-c / -e / --eval)',\n  },\n  // ----- pipe-to-shell (destructive \u2014 download-and-run pattern) -----\n  // The classic `curl https://... | sh` download-and-run vector. Detected by\n  // looking for a known fetcher piped into a shell or expression evaluator.\n  // A shell command passed through `bash -c` / `pwsh -Command` arrives as one\n  // argv string, so scan the reconstructed argv text rather than individual\n  // tokens only.\n  {\n    id: 'pipe-to-shell',\n    level: 'destructive',\n    test: (cmd, args) =>\n      /\\b(?:curl|wget|fetch|httpie|http|irm|iwr|Invoke-WebRequest|Invoke-RestMethod)\\b[\\s\\S]{0,300}\\|\\s*(?:sudo\\s+)?(?:sh|bash|zsh|fish|pwsh|powershell|iex|Invoke-Expression)\\b/i.test(\n        [cmd, ...args].join(' '),\n      ),\n    reason: 'network fetch piped to a shell (download-and-run pattern)',\n  },\n  // ----- privilege escalation (caution) -----\n  {\n    id: 'sudo',\n    level: 'caution',\n    test: (cmd) => cmd === 'sudo' || cmd === 'doas',\n    reason: 'privilege escalation (sudo / doas)',\n  },\n  {\n    id: 'runas',\n    level: 'caution',\n    test: (cmd) => cmd === 'runas' || cmd === 'runas.exe',\n    reason: 'Windows runas (run as different user)',\n  },\n  // ----- world-writable permissions (caution) -----\n  // `chmod 777` is rarely correct. `chmod -R 777` is almost always wrong.\n  // We only flag octal modes; symbolic modes like `chmod o+w` are\n  // left to the operator's discretion.\n  {\n    id: 'chmod-world-writable',\n    level: 'caution',\n    test: (cmd, args) => {\n      if (cmd !== 'chmod') return false;\n      // Skip symbolic modes: anything starting with [ugoa]=\\w or [ugoa]+\\w.\n      // The only thing we flag is a pure octal mode containing 7 anywhere\n      // in the user/group/other triple (e.g. 777, 776, 747, 707).\n      return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));\n    },\n    reason: 'chmod with world-writable octal mode (e.g. 777)',\n  },\n];\n\n/**\n * Evaluate the danger level of a (cmd, args) pair.\n *\n * Returns 'safe' if no rule fires, otherwise the highest level among all\n * matching rules. The 'matchedRule' field is the *last* rule that fired\n * (stable, since rules are evaluated in declaration order).\n *\n * Optional `bypass` argument: a set of rule ids that should be SKIPPED\n * even if they would otherwise match. Wired from\n * `config.tools.exec.danger.bypass` (see `ExecDangerConfig` in\n * `@wrongstack/core/src/types/config.ts`). Unknown ids are silently\n * ignored \u2014 forward-compat: a rule added in a future version can be\n * referenced before the user upgrades their config schema.\n *\n * This function is the single source of truth for danger classification;\n * it is pure (no side effects) and unit-tested in `danger-detect.test.ts`.\n */\nexport function detectDanger(\n  cmd: string,\n  args: readonly string[],\n  bypass?: ReadonlySet<string>,\n): DangerAssessment {\n  const reasons: string[] = [];\n  let level: DangerLevel = 'safe';\n  let matchedRule: string | undefined;\n\n  for (const rule of RULES) {\n    if (bypass?.has(rule.id)) continue;\n    if (!rule.test(cmd, args)) continue;\n    reasons.push(rule.reason);\n    matchedRule = rule.id;\n    if (levelRank(rule.level) > levelRank(level)) {\n      level = rule.level;\n    }\n  }\n\n  if (level === 'safe') return { level: 'safe', reasons: [] };\n  // matchedRule is set above (last winning rule). For exactOptionalPropertyTypes\n  // we build the object conditionally so the property is omitted when undefined.\n  const result: DangerAssessment = { level, reasons };\n  if (matchedRule !== undefined) result.matchedRule = matchedRule;\n  return result;\n}\n\nfunction levelRank(level: DangerLevel): number {\n  switch (level) {\n    case 'safe':\n      return 0;\n    case 'caution':\n      return 1;\n    case 'destructive':\n      return 2;\n  }\n}\n", "/**\n * Exec Kill Guard \u2014 Intercepts exec tool kill commands and prevents them from\n * terminating WrongStack processes.\n *\n * Unlike bash-kill-guard.ts which parses a raw shell string, this module\n * works with the exec tool's (command, args) format. It handles:\n * - taskkill /F /IM node.exe (name-based)\n * - taskkill /F /PID 1234 (PID-based)\n * - Stop-Process -Name \"node\" -Force (PowerShell cmdlet)\n * - kill -9 12345 / pkill node (POSIX via allowlisted commands)\n * - wmic process where \"name='node.exe'\" delete\n * - node -e \"process.kill(12345)\" (eval-based kill)\n * - Any script that contains kill commands (exec'd via shell interpreters)\n *\n * This is one defense-in-depth layer \u2014 the primary guard is the\n * PreToolUse hook in the process-guard plugin, and the permission\n * policy's YOLO destructive detection.\n */\n\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport { getPersistentProcessRegistry } from './process-registry-persistent.js';\n\nconst isWin = os.platform() === 'win32';\n\nexport interface ExecKillCheckResult {\n  blocked: boolean;\n  reason?: string;\n}\n\n/**\n * Check if an exec (command, args) pair is a kill operation targeting\n * a protected WrongStack process. Returns { blocked: true, reason } when\n * the command should be blocked, or { blocked: false } when it's safe.\n */\nexport async function checkExecKillCommand(\n  cmd: string,\n  args: readonly string[],\n): Promise<ExecKillCheckResult> {\n  if (!cmd) return { blocked: false };\n\n  const cmdLower = cmd.toLowerCase().trim();\n  const fullCommand = [cmdLower, ...args].join(' ').replace(/\\s+/g, ' ').trim();\n\n  // On Windows, check for taskkill, Stop-Process, wmic kill\n  if (isWin) {\n    // taskkill /IM node.exe or taskkill /F /PID 1234\n    if (cmdLower === 'taskkill' || cmdLower === 'taskkill.exe') {\n      const hasForce = args.some((a) => a.toUpperCase() === '/F' || a.toUpperCase() === '-F');\n      const signal = hasForce ? 'FORCE' : 'TERM';\n\n      // /IM name-based kill\n      for (let i = 0; i < args.length; i++) {\n        const a = args[i]!;\n        if (a.toUpperCase() === '/IM' || a.toUpperCase() === '-IM') {\n          const nameArg = args[i + 1];\n          if (nameArg) {\n            const result = await checkKillTarget({ name: nameArg, signal, cmd: fullCommand });\n            if (result.blocked) return result;\n          }\n        }\n      }\n      // /PID specific process\n      for (let i = 0; i < args.length; i++) {\n        const a = args[i]!;\n        if (a.toUpperCase() === '/PID' || a.toUpperCase() === '-PID') {\n          const pidArg = args[i + 1];\n          if (pidArg && /^\\d+$/.test(pidArg)) {\n            const result = await checkKillTarget({\n              pid: parseInt(pidArg, 10),\n              signal,\n              cmd: fullCommand,\n            });\n            if (result.blocked) return result;\n          }\n        }\n      }\n      // /FI \"IMAGENAME eq node.exe\" filter-based name kill (functionally\n      // equivalent to /IM, documented taskkill idiom)\n      for (let i = 0; i < args.length; i++) {\n        const a = args[i]!;\n        if (a.toUpperCase() === '/FI' || a.toUpperCase() === '-FI') {\n          const filterArg = args[i + 1];\n          if (filterArg) {\n            const nameMatch = filterArg.match(/IMAGENAME\\s+eq\\s+\"?([^\"\\s]+)/i);\n            if (nameMatch?.[1]) {\n              const result = await checkKillTarget({ name: nameMatch[1], signal, cmd: fullCommand });\n              if (result.blocked) return result;\n            }\n          }\n        }\n      }\n      // If it's taskkill with /IM but we didn't match a specific name,\n      // still be conservative if it targets processes broadly\n      return { blocked: false };\n    }\n\n    // Shell indirection: inspect the command after cmd /c or PowerShell\n    // -Command/-c. Recurse through this guard rather than passing the wrapper\n    // string to bash-kill-guard, which cannot parse a leading `cmd /c`.\n    if (\n      cmdLower === 'powershell' ||\n      cmdLower === 'powershell.exe' ||\n      cmdLower === 'pwsh' ||\n      cmdLower === 'pwsh.exe' ||\n      cmdLower === 'cmd' ||\n      cmdLower === 'cmd.exe'\n    ) {\n      const shellFlagIndex = args.findIndex((arg) => {\n        const lower = arg.toLowerCase();\n        return lower === '-c' || lower === '-command' || lower === '/c';\n      });\n      if (shellFlagIndex >= 0) {\n        const innerTokens = tokenizeShellCommand(args.slice(shellFlagIndex + 1).join(' '));\n        const innerCommand = innerTokens[0];\n        if (innerCommand) {\n          const result = await checkExecKillCommand(innerCommand, innerTokens.slice(1));\n          if (result.blocked) return result;\n        }\n      }\n    }\n\n    // Direct Stop-Process / kill command (PowerShell alias)\n    if (cmdLower === 'stop-process' || cmdLower === 'kill') {\n      for (let i = 0; i < args.length; i++) {\n        const a = args[i]!;\n        // -Name \"node\" or -Name node\n        if (a === '-Name' || a === '-n') {\n          const nameArg = args[i + 1]?.replace(/^['\"]|['\"]$/g, '');\n          if (nameArg) {\n            const result = await checkKillTarget({\n              name: nameArg,\n              signal: 'FORCE',\n              cmd: fullCommand,\n            });\n            if (result.blocked) return result;\n          }\n        }\n        // -Id 1234 or -PID 1234\n        if (a === '-Id' || a === '-PID' || a === '-pid') {\n          const pidArg = args[i + 1];\n          if (pidArg && /^\\d+$/.test(pidArg)) {\n            const result = await checkKillTarget({\n              pid: parseInt(pidArg, 10),\n              signal: 'FORCE',\n              cmd: fullCommand,\n            });\n            if (result.blocked) return result;\n          }\n        }\n      }\n      // Bare \"kill node\" (PowerShell alias) \u2014 name as first non-flag arg\n      const firstNonFlag = args.find((a) => !a.startsWith('-'));\n      if (firstNonFlag) {\n        const name = firstNonFlag.replace(/^['\"]|['\"]$/g, '');\n        // pkill and process names like \"node\" \u2014 conservative check\n        const result = await checkKillTarget({ name, signal: 'TERM', cmd: fullCommand });\n        if (result.blocked) return result;\n      }\n    }\n\n    // WMIC process ... delete\n    if (cmdLower === 'wmic' || cmdLower === 'wmic.exe') {\n      const joined = args.join(' ').toLowerCase();\n      if (/\\bprocess\\b/.test(joined) && /\\bdelete\\b/.test(joined)) {\n        // Extract the name filter\n        const nameMatch = joined.match(/name\\s*=\\s*['\"]?([^'\"]+)/);\n        if (nameMatch?.[1]) {\n          const result = await checkKillTarget({\n            name: nameMatch[1].trim(),\n            signal: 'FORCE',\n            cmd: fullCommand,\n          });\n          if (result.blocked) return result;\n        }\n        // No name filter \u2014 block conservatively (wmic process delete is broad)\n        return {\n          blocked: true,\n          reason:\n            'Blocked: wmic process delete targets all matched processes \u2014 would include protected WrongStack processes.',\n        };\n      }\n    }\n\n    // node -e \"process.kill(12345)\" \u2014 eval-based kill\n    if (cmdLower === 'node' || cmdLower === 'node.exe') {\n      if (args.includes('-e') || args.includes('--eval')) {\n        const evalIdx = args.indexOf('-e') !== -1 ? args.indexOf('-e') : args.indexOf('--eval');\n        const evalCode = args[evalIdx + 1] ?? '';\n        if (/\\bprocess\\.kill\\s*\\(/.test(evalCode)) {\n          // Extract the PID from process.kill(...)\n          const pidMatch = evalCode.match(/process\\.kill\\s*\\(\\s*(\\d+)/);\n          if (pidMatch?.[1]) {\n            const pid = parseInt(pidMatch[1], 10);\n            const result = await checkKillTarget({ pid, signal: 'SIGTERM', cmd: fullCommand });\n            if (result.blocked) return result;\n          }\n          // Can't extract PID but it's process.kill \u2014 block conservatively\n          return {\n            blocked: true,\n            reason:\n              'Blocked: node -e with process.kill() \u2014 would target protected WrongStack process(es).',\n          };\n        }\n      }\n    }\n  } else {\n    // POSIX\n    // Direct kill/pkill/killall via exec\n    if (cmdLower === 'kill') {\n      for (const a of args) {\n        // kill 1234, kill -9 1234, kill -- -1234 (group)\n        const num = a.replace(/^-/, '');\n        if (/^\\d+$/.test(num)) {\n          const pid = parseInt(num, 10);\n          const result = await checkKillTarget({ pid, signal: 'SIGTERM', cmd: fullCommand });\n          if (result.blocked) return result;\n        }\n      }\n    }\n    if (cmdLower === 'pkill' || cmdLower === 'killall') {\n      const firstNonFlag = args.find((a) => !a.startsWith('-'));\n      if (firstNonFlag) {\n        const result = await checkKillTarget({\n          name: firstNonFlag,\n          signal: 'SIGTERM',\n          cmd: fullCommand,\n        });\n        if (result.blocked) return result;\n      }\n    }\n  }\n\n  return { blocked: false };\n}\n\n// \u2500\u2500 Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** Split a shell payload into argv-like tokens while preserving quoted names. */\nfunction tokenizeShellCommand(command: string): string[] {\n  const tokens: string[] = [];\n  let current = '';\n  let quote: '\"' | \"'\" | null = null;\n\n  for (const char of command.trim()) {\n    if (quote) {\n      if (char === quote) quote = null;\n      else current += char;\n      continue;\n    }\n    if (char === '\"' || char === \"'\") {\n      quote = char;\n    } else if (/\\s/.test(char)) {\n      if (current) {\n        tokens.push(current);\n        current = '';\n      }\n    } else {\n      current += char;\n    }\n  }\n\n  if (current) tokens.push(current);\n  return tokens;\n}\n\ninterface KillTarget {\n  pid?: number;\n  name?: string;\n  signal: string;\n  cmd: string;\n}\n\n/**\n * Check if a kill target maps to a protected WrongStack process by\n * consulting the persistent process registry (cross-instance PID store).\n */\nasync function checkKillTarget(target: KillTarget): Promise<ExecKillCheckResult> {\n  const registry = getPersistentProcessRegistry();\n\n  // PID-based check: is this PID known as protected?\n  if (target.pid !== undefined) {\n    const blocked = await registry.shouldBlockKill(target.pid);\n    if (blocked) {\n      return {\n        blocked: true,\n        reason: `Blocked: kill ${target.signal} PID ${target.pid} targets a protected WrongStack process (${target.cmd.slice(0, 80)}).`,\n      };\n    }\n    // Also check if it's the current process or its parent\n    if (target.pid === process.pid) {\n      return {\n        blocked: true,\n        reason: 'Blocked: cannot kill the current WrongStack process.',\n      };\n    }\n    if (target.pid === process.ppid) {\n      return {\n        blocked: true,\n        reason: 'Blocked: cannot kill the parent terminal hosting WrongStack.',\n      };\n    }\n    return { blocked: false };\n  }\n\n  // Name-based check: does the target name match any protected process?\n  if (target.name) {\n    const nameLower = target.name.toLowerCase().replace(/\\.exe$/, '');\n\n    // Hard-block on \"wrongstack\" references\n    if (nameLower.includes('wrongstack')) {\n      return {\n        blocked: true,\n        reason: `Blocked: kill ${target.signal} '${target.name}' targets a WrongStack process name.`,\n      };\n    }\n\n    // The guard itself runs inside the current WrongStack process, which may\n    // not have been written to the persistent registry yet (notably in fresh\n    // CLI/test sessions). A broad image-name kill matching the current runtime\n    // would therefore kill WrongStack even when the registry is empty.\n    const currentImage = path\n      .basename(process.execPath)\n      .toLowerCase()\n      .replace(/\\.exe$/, '');\n    const targetsNodeRuntime = nameLower === 'node' || nameLower.startsWith('node');\n    if (targetsNodeRuntime && currentImage === 'node') {\n      return {\n        blocked: true,\n        reason: `Blocked: kill ${target.signal} '${target.name}' would kill the active WrongStack node.exe runtime.`,\n      };\n    }\n\n    // Also protect other registered WrongStack instances that use Node even\n    // when this instance is running from a packaged executable.\n    const protectedPids = await registry.getAllProtectedPids();\n    if (protectedPids.length > 0 && targetsNodeRuntime) {\n      return {\n        blocked: true,\n        reason: `Blocked: kill ${target.signal} '${target.name}' would kill all node.exe processes including active WrongStack instance(s).`,\n      };\n    }\n\n    return { blocked: false };\n  }\n\n  return { blocked: false };\n}\n", "/**\n * PersistentProcessRegistry \u2014 filesystem-backed process registry that survives\n * process restarts and coordinates protection across multiple WrongStack instances\n * running in different terminals.\n *\n * Key features:\n * - PIDs stored in ~/.wrongstack/process-registry.json\n * - File locking for cross-instance coordination\n * - Heartbeat mechanism to detect stale entries\n * - Protection whitelist that blocks kill commands targeting WrongStack processes\n * - Multi-instance awareness: all instances share the same protection state\n */\n\n// Note: spawn imported for potential future use with child process tracking\nimport * as fs from 'node:fs/promises';\n// Note: fsSync imported for potential future use with synchronous file operations\nimport * as os from 'node:os';\nimport { wstackGlobalRoot } from '@wrongstack/core/utils';\nimport * as path from 'node:path';\nimport type { ChildProcess } from 'node:child_process';\nimport { getProcessRegistry, type ProcessRegistryImpl } from './process-registry.js';\n\nconst REGISTRY_FILE = 'process-registry.json';\n\nfunction toErrorMessage(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n\nfunction emitStructuredLog(level: 'debug' | 'info' | 'warn' | 'error', event: string, message: string, error?: unknown): void {\n  const payload: { level: 'debug' | 'info' | 'warn' | 'error'; event: string; message: string; error?: string; timestamp: string } = {\n    level,\n    event,\n    message,\n    timestamp: new Date().toISOString(),\n  };\n\n  if (error !== undefined) {\n    payload.error = toErrorMessage(error);\n  }\n\n  console.log(JSON.stringify(payload));\n}\nconst HEARTBEAT_INTERVAL_MS = 5_000;\nconst STALE_THRESHOLD_MS = 30_000;\n// A registry lock is only ever held for a brief read-modify-write; one older\n// than this means the holder crashed. This is the ONLY stale signal on\n// Windows, where process.kill(pid, 0) liveness checks are unreliable.\nconst LOCK_STALE_MS = 30_000;\nconst LOCKFILE = '.process-registry.lock';\n\nexport interface PersistentProcessEntry {\n  pid: number;\n  name: string;\n  command: string;\n  startedAt: number;\n  lastHeartbeat: number;\n  sessionId?: string;\n  instanceId: string;\n  /** Hostname where this process is running */\n  hostname: string;\n  protected: boolean;\n  /** How this process was spawned: 'fork' (child_process.fork), 'spawn' (child_process.spawn), 'main' (the main WrongStack process itself) */\n  spawnMode: 'fork' | 'spawn' | 'main';\n  /** Parent PID if spawned via fork/spawn */\n  parentPid?: number;\n  /** OS platform where this entry was created */\n  platform: string;\n}\n\nexport interface PersistentRegistryData {\n  version: 1;\n  instances: Map<string, PersistentProcessEntry>;\n  protectedPatterns: string[];\n  lastCleanup: number;\n}\n\n/**\n * Generate a unique instance ID for this WrongStack process.\n * Combines hostname + pid + random suffix for uniqueness across restarts.\n */\nfunction generateInstanceId(): string {\n  const hostname = os.hostname();\n  const pid = process.pid;\n  const random = Math.random().toString(36).slice(2, 8);\n  return `${hostname}:${pid}:${random}`;\n}\n\n/**\n * Acquire a file lock using flock-style locking.\n * On Windows, uses a separate lockfile with atomic rename.\n */\nfunction isNodeError(err: unknown): err is NodeJS.ErrnoException {\n  return typeof err === 'object' && err !== null && 'code' in err;\n}\n\nasync function acquireLock(lockfilePath: string, timeoutMs = 5000): Promise<() => Promise<void>> {\n  const start = Date.now();\n  const pidStr = String(process.pid);\n  const hostStr = os.hostname();\n\n  while (Date.now() - start < timeoutMs) {\n    try {\n      // Try to create the lock file exclusively\n      await fs.writeFile(lockfilePath, `${pidStr}:${hostStr}:${Date.now()}`, { flag: 'wx' });\n      return async () => {\n        try {\n          await fs.unlink(lockfilePath);\n        } catch {\n          // Lock file may have been cleaned up by another process\n        }\n      };\n    } catch (err) {\n      if (isNodeError(err) && err.code === 'EEXIST') {\n        // Lock exists - decide whether it is stale and stealable.\n        try {\n          const content = await fs.readFile(lockfilePath, 'utf-8');\n          const parts = content.split(':');\n          const lockPid = parseInt(parts[0] ?? '0', 10);\n          // Content is `pid:host:timestamp`; the last field is the\n          // acquisition time (host is never empty, so index is safe).\n          const lockTs = Number(parts[parts.length - 1]);\n          const staleByAge = Number.isFinite(lockTs) && Date.now() - lockTs > LOCK_STALE_MS;\n\n          let holderDead = false;\n          if (process.platform !== 'win32' && Number.isFinite(lockPid) && lockPid > 0) {\n            try {\n              process.kill(lockPid, 0); // Signal 0 just checks if process exists\n            } catch {\n              holderDead = true;\n            }\n          }\n\n          // Steal when the holder is provably dead (Unix) OR the lock is older\n          // than LOCK_STALE_MS. The age check is the only stale signal on\n          // Windows \u2014 without it a crashed holder's lock wedges the registry,\n          // and with it every kill-guard, permanently.\n          if (holderDead || staleByAge) {\n            await fs.unlink(lockfilePath).catch(() => {});\n            continue;\n          }\n        } catch {\n          // Can't read lock file - assume stale, try to steal\n          await fs.unlink(lockfilePath).catch(() => {});\n          continue;\n        }\n\n        // Holder still alive and lock fresh \u2014 wait before retrying\n        await new Promise((r) => setTimeout(r, 100));\n        continue;\n      }\n      throw err;\n    }\n  }\n  throw new Error(`Failed to acquire lock after ${timeoutMs}ms`);\n}\n\n/**\n * Read and parse the persistent registry file.\n * Returns empty data if the file is missing, corrupted, or structurally wrong.\n */\nfunction freshRegistryData(): PersistentRegistryData {\n  return {\n    version: 1,\n    instances: new Map(),\n    protectedPatterns: ['wrongstack', 'node'],\n    lastCleanup: Date.now(),\n  };\n}\n\nasync function readRegistryFile(filePath: string): Promise<PersistentRegistryData> {\n  let content: string;\n  try {\n    content = await fs.readFile(filePath, 'utf-8');\n  } catch (err) {\n    if (isNodeError(err) && err.code === 'ENOENT') return freshRegistryData();\n    throw err; // genuine IO error (EACCES, EMFILE\u2026) \u2014 surface it\n  }\n\n  // A torn write (crash mid-persist) or hand-corruption must NOT throw here:\n  // that would propagate through every kill-guard and wedge them forever with\n  // no self-heal. Parse defensively and fall back to empty; the next write\n  // overwrites the bad file.\n  try {\n    const parsed = JSON.parse(content) as Partial<PersistentRegistryData> & {\n      instances?: unknown;\n    };\n    if (!parsed || typeof parsed !== 'object') return freshRegistryData();\n    const base = freshRegistryData();\n    return {\n      version: 1,\n      instances: Array.isArray(parsed.instances)\n        ? new Map(parsed.instances as [string, PersistentProcessEntry][])\n        : base.instances,\n      protectedPatterns: Array.isArray(parsed.protectedPatterns)\n        ? parsed.protectedPatterns\n        : base.protectedPatterns,\n      lastCleanup:\n        typeof parsed.lastCleanup === 'number' ? parsed.lastCleanup : base.lastCleanup,\n    };\n  } catch {\n    return freshRegistryData();\n  }\n}\n\n/**\n * Write the registry file atomically using rename.\n */\nasync function writeRegistryFile(filePath: string, data: PersistentRegistryData): Promise<void> {\n  const tmpPath = `${filePath}.tmp.${process.pid}`;\n  const content = JSON.stringify(data, (_k, v) => {\n    if (v instanceof Map) {\n      return Array.from(v.entries());\n    }\n    return v;\n  }, 2);\n\n  await fs.writeFile(tmpPath, content, 'utf-8');\n  await fs.rename(tmpPath, filePath);\n}\n\n/**\n * PersistentProcessRegistry wraps the in-memory ProcessRegistryImpl and\n * synchronizes entries to a filesystem-backed store for cross-instance coordination.\n */\nexport class PersistentProcessRegistry {\n  private readonly instanceId: string;\n  private readonly registryPath: string;\n  private readonly lockPath: string;\n  private readonly baseRegistry: ProcessRegistryImpl;\n  private heartbeatInterval: ReturnType<typeof setInterval> | null = null;\n  private cleanupInterval: ReturnType<typeof setInterval> | null = null;\n  private heartbeatRunning = false;\n  private cleanupRunning = false;\n  private isShuttingDown = false;\n  private readonly onProcessExit = (): void => {\n    this.runInBackground(\n      this.syncToPersistent(),\n      'process_registry.exit_sync_failed',\n      'PersistentProcessRegistry: exit sync failed',\n    );\n  };\n\n  constructor(baseRegistry?: ProcessRegistryImpl) {\n    this.instanceId = generateInstanceId();\n    const globalRoot = wstackGlobalRoot();\n    this.registryPath = path.join(globalRoot, REGISTRY_FILE);\n    this.lockPath = path.join(globalRoot, LOCKFILE);\n    this.baseRegistry = baseRegistry ?? getProcessRegistry();\n\n    // Ensure the .wrongstack directory exists\n    this.ensureDirectory().catch((err) => {\n      emitStructuredLog('warn', 'process_registry.dir_create_failed', 'PersistentProcessRegistry: failed to create .wrongstack directory', err);\n    });\n  }\n\n  private async ensureDirectory(): Promise<void> {\n    const dir = path.dirname(this.registryPath);\n    try {\n      await fs.mkdir(dir, { recursive: true });\n    } catch (err) {\n      if (!isNodeError(err) || err.code !== 'EEXIST') throw err;\n    }\n  }\n\n  private runInBackground(operation: Promise<void>, event: string, message: string): void {\n    void operation.catch((err) => {\n      emitStructuredLog('warn', event, message, err);\n    });\n  }\n\n  /**\n   * Start the heartbeat and periodic cleanup tasks.\n   */\n  start(): void {\n    if (this.heartbeatInterval) return;\n    this.isShuttingDown = false;\n\n    // Register this instance's processes with the persistent registry\n    this.heartbeat();\n\n    // Heartbeat every 5 seconds to mark entries as alive\n    this.heartbeatInterval = setInterval(() => {\n      this.heartbeat();\n    }, HEARTBEAT_INTERVAL_MS);\n    this.heartbeatInterval.unref?.();\n\n    // Cleanup stale entries every 30 seconds\n    this.cleanupInterval = setInterval(() => {\n      this.cleanup();\n    }, STALE_THRESHOLD_MS);\n    this.cleanupInterval.unref?.();\n\n    // Register main process on startup\n    this.registerMainProcess();\n\n    // Sync on significant events\n    process.on('exit', this.onProcessExit);\n  }\n\n  /**\n   * Stop the heartbeat and clean up.\n   */\n  stop(): void {\n    this.isShuttingDown = true;\n    if (this.heartbeatInterval) {\n      clearInterval(this.heartbeatInterval);\n      this.heartbeatInterval = null;\n    }\n    if (this.cleanupInterval) {\n      clearInterval(this.cleanupInterval);\n      this.cleanupInterval = null;\n    }\n    process.off('exit', this.onProcessExit);\n    this.runInBackground(\n      this.syncToPersistent(),\n      'process_registry.stop_sync_failed',\n      'PersistentProcessRegistry: stop sync failed',\n    );\n  }\n\n  /**\n   * Register the main WrongStack process as protected.\n   */\n  registerMainProcess(): void {\n    const mainPid = process.pid;\n\n    this.runInBackground(\n      this.updatePersistentEntry({\n        pid: mainPid,\n        name: 'wrongstack-main',\n        command: process.argv.slice(0, 3).join(' '),\n        startedAt: Date.now(),\n        lastHeartbeat: Date.now(),\n        instanceId: this.instanceId,\n        hostname: os.hostname(),\n        protected: true,\n        spawnMode: 'main',\n        parentPid: process.ppid,\n        platform: process.platform,\n      }),\n      'process_registry.main_register_failed',\n      'PersistentProcessRegistry: failed to register main process',\n    );\n  }\n\n  /**\n   * Register a spawned child process with the persistent registry.\n   */\n  registerChildProcess(pid: number, name: string, command: string, sessionId?: string, spawnMode: 'spawn' | 'fork' = 'spawn'): void {\n    const entry: PersistentProcessEntry = {\n      pid,\n      name,\n      command,\n      startedAt: Date.now(),\n      lastHeartbeat: Date.now(),\n      instanceId: this.instanceId,\n      hostname: os.hostname(),\n      protected: true, // All WrongStack child processes are protected by default\n      spawnMode,\n      parentPid: process.pid,\n      platform: process.platform,\n    };\n    if (sessionId) {\n      entry.sessionId = sessionId;\n    }\n    this.runInBackground(\n      this.updatePersistentEntry(entry),\n      'process_registry.child_register_failed',\n      'PersistentProcessRegistry: failed to register child process',\n    );\n  }\n\n  /**\n   * Update or add an entry in the persistent registry.\n   */\n  private async updatePersistentEntry(entry: PersistentProcessEntry): Promise<void> {\n    const release = await acquireLock(this.lockPath);\n    try {\n      const data = await readRegistryFile(this.registryPath);\n\n      // Update or insert\n      data.instances.set(String(entry.pid), entry);\n\n      // Also update the in-memory registry\n      const child: ChildProcess = null as unknown as ChildProcess;\n      this.baseRegistry.register({\n        pid: entry.pid,\n        name: entry.name,\n        command: entry.command,\n        startedAt: entry.startedAt,\n        sessionId: entry.sessionId,\n        protected: entry.protected,\n        child,\n      });\n\n      await writeRegistryFile(this.registryPath, data);\n    } finally {\n      await release();\n    }\n  }\n\n  /**\n   * Unregister a process from the persistent registry.\n   */\n  async unregister(pid: number): Promise<void> {\n    const release = await acquireLock(this.lockPath);\n    try {\n      const data = await readRegistryFile(this.registryPath);\n      data.instances.delete(String(pid));\n      await writeRegistryFile(this.registryPath, data);\n    } finally {\n      await release();\n    }\n  }\n\n  /**\n   * Send heartbeat to mark all this instance's processes as alive.\n   */\n  private heartbeat(): void {\n    if (this.isShuttingDown || this.heartbeatRunning) return;\n\n    this.heartbeatRunning = true;\n    void this.syncToPersistent()\n      .catch((err) => {\n        emitStructuredLog(\n          'warn',\n          'process_registry.heartbeat_failed',\n          'PersistentProcessRegistry: heartbeat failed',\n          err,\n        );\n      })\n      .finally(() => {\n        this.heartbeatRunning = false;\n      });\n  }\n\n  private cleanup(): void {\n    if (this.isShuttingDown || this.cleanupRunning) return;\n\n    this.cleanupRunning = true;\n    void this.cleanupStaleEntries()\n      .catch((err) => {\n        emitStructuredLog(\n          'warn',\n          'process_registry.periodic_cleanup_failed',\n          'PersistentProcessRegistry: periodic cleanup failed',\n          err,\n        );\n      })\n      .finally(() => {\n        this.cleanupRunning = false;\n      });\n  }\n\n  /**\n   * Sync this instance's processes to the persistent registry.\n   */\n  private async syncToPersistent(): Promise<void> {\n    const release = await acquireLock(this.lockPath);\n    try {\n      const data = await readRegistryFile(this.registryPath);\n      const now = Date.now();\n\n      // Update heartbeat for all processes belonging to this instance\n      const updatedInstances = new Map<string, PersistentProcessEntry>();\n\n      for (const [_pidStr, entry] of data.instances) {\n        if (entry.instanceId === this.instanceId) {\n          entry.lastHeartbeat = now;\n        }\n        // Only keep non-stale entries (or entries from this instance)\n        if (entry.instanceId === this.instanceId || (now - entry.lastHeartbeat) < STALE_THRESHOLD_MS) {\n          updatedInstances.set(_pidStr, entry);\n        }\n      }\n\n      data.instances = updatedInstances;\n      data.lastCleanup = now;\n      await writeRegistryFile(this.registryPath, data);\n    } catch (err) {\n      emitStructuredLog('warn', 'process_registry.sync_failed', 'PersistentProcessRegistry: sync failed', err);\n    } finally {\n      await release();\n    }\n  }\n\n  /**\n   * Remove entries for processes that are no longer running.\n   */\n  private async cleanupStaleEntries(): Promise<void> {\n    const release = await acquireLock(this.lockPath);\n    try {\n      const data = await readRegistryFile(this.registryPath);\n      const now = Date.now();\n      const stalePids: string[] = [];\n\n      for (const [_pidStr, entry] of data.instances) {\n        const age = now - entry.lastHeartbeat;\n\n        if (age > STALE_THRESHOLD_MS) {\n          // Check if process is actually dead\n          try {\n            if (process.platform !== 'win32') {\n              process.kill(entry.pid, 0);\n            } else {\n              // On Windows, try to open the process\n              emitStructuredLog(\n                'debug',\n                'process_registry.stale_pid_check',\n                `PersistentProcessRegistry: checking stale pid ${entry.pid} (${age}ms old)`,\n              );\n            }\n\n          } catch {\n            // Process is dead - mark for removal\n            stalePids.push(_pidStr);\n          }\n        }\n      }\n\n      if (stalePids.length > 0) {\n        for (const pidStr of stalePids) {\n          data.instances.delete(pidStr);\n        }\n        await writeRegistryFile(this.registryPath, data);\n      }\n    } catch (err) {\n      emitStructuredLog('warn', 'process_registry.cleanup_failed', 'PersistentProcessRegistry: cleanup failed', err);\n    } finally {\n      await release();\n    }\n  }\n\n  /**\n   * Check if a PID belongs to a WrongStack process and should be protected.\n   */\n  async isProtectedPid(pid: number): Promise<boolean> {\n    const release = await acquireLock(this.lockPath);\n    try {\n      const data = await readRegistryFile(this.registryPath);\n      const entry = data.instances.get(String(pid));\n\n      if (!entry) return false;\n\n      // Check if stale\n      if ((Date.now() - entry.lastHeartbeat) > STALE_THRESHOLD_MS) {\n        return false;\n      }\n\n      return entry.protected;\n    } finally {\n      await release();\n    }\n  }\n\n  /**\n   * Get all protected PIDs from all WrongStack instances.\n   */\n  async getAllProtectedPids(): Promise<number[]> {\n    const release = await acquireLock(this.lockPath);\n    try {\n      const data = await readRegistryFile(this.registryPath);\n      const now = Date.now();\n      const protectedPids: number[] = [];\n\n      for (const [_pidStr, entry] of data.instances) {\n        if (entry.protected && (now - entry.lastHeartbeat) < STALE_THRESHOLD_MS) {\n          protectedPids.push(entry.pid);\n        }\n      }\n\n      return protectedPids;\n    } finally {\n      await release();\n    }\n  }\n\n  /**\n   * Get complete status of all tracked processes across all instances.\n   */\n  async getGlobalStatus(): Promise<{\n    instances: Map<string, PersistentProcessEntry[]>;\n    totalProcesses: number;\n    protectedCount: number;\n    staleCount: number;\n  }> {\n    const release = await acquireLock(this.lockPath);\n    try {\n      const data = await readRegistryFile(this.registryPath);\n      const now = Date.now();\n      const instances = new Map<string, PersistentProcessEntry[]>();\n      let protectedCount = 0;\n      let staleCount = 0;\n\n      for (const [_pidStr, entry] of data.instances) {\n        const instanceEntries = instances.get(entry.instanceId) ?? [];\n        instanceEntries.push(entry);\n        instances.set(entry.instanceId, instanceEntries);\n\n        if (entry.protected) protectedCount++;\n        if ((now - entry.lastHeartbeat) > STALE_THRESHOLD_MS) staleCount++;\n      }\n\n      return {\n        instances,\n        totalProcesses: data.instances.size,\n        protectedCount,\n        staleCount,\n      };\n    } finally {\n      await release();\n    }\n  }\n\n  /**\n   * Get the instance ID for this process.\n   */\n  getInstanceId(): string {\n    return this.instanceId;\n  }\n\n  /**\n   * Check if a kill command should be blocked.\n   * Returns true if the kill should be blocked (target is a WrongStack process).\n   */\n  async shouldBlockKill(pid: number): Promise<boolean> {\n    const protectedPids = await this.getAllProtectedPids();\n    return protectedPids.includes(pid);\n  }\n\n  /**\n   * Add a pattern-based protection rule.\n   * Processes whose command matches any protected pattern are protected.\n   */\n  async addProtectedPattern(pattern: string): Promise<void> {\n    const release = await acquireLock(this.lockPath);\n    try {\n      const data = await readRegistryFile(this.registryPath);\n      if (!data.protectedPatterns.includes(pattern)) {\n        data.protectedPatterns.push(pattern);\n        await writeRegistryFile(this.registryPath, data);\n      }\n    } finally {\n      await release();\n    }\n  }\n}\n\n// Singleton instance\nlet _persistentRegistry: PersistentProcessRegistry | undefined;\n\nexport function getPersistentProcessRegistry(): PersistentProcessRegistry {\n  if (!_persistentRegistry) {\n    _persistentRegistry = new PersistentProcessRegistry();\n  }\n  return _persistentRegistry;\n}\n\nexport function resetPersistentProcessRegistry(): void {\n  if (_persistentRegistry) {\n    _persistentRegistry.stop();\n    _persistentRegistry = undefined;\n  }\n}\n"],
-  "mappings": ";AAAA,SAAS,SAAAA,cAAa;AACtB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,kBAAAC,uBAAsB;;;ACH/B,SAAS,qBAAqB;;;ACoB9B,SAAS,mBAAmB,iBAAmC;AAC/D,YAAY,SAAS;AACrB,YAAY,UAAU;AACtB,SAAS,wBAAwB;AAEjC,IAAM,qBAAqB,IAAI,KAAK,KAAK,KAAK;AAE9C,IAAM,wBAAwB,IAAI,OAAO;AAEzC,IAAI,eAAe;AAGZ,SAAS,gBAAwB;AACtC,SAAY,UAAK,iBAAiB,GAAG,aAAa;AACpD;AAOA,SAAS,mBAAmB,KAAmB;AAC7C,MAAI,aAAc;AAClB,iBAAe;AACf,QAAM,YAAY;AAChB,QAAI;AACF,YAAM,MAAM,KAAK,IAAI;AACrB,iBAAW,QAAQ,MAAU,YAAQ,GAAG,GAAG;AACzC,YAAI,CAAC,KAAK,SAAS,MAAM,EAAG;AAC5B,cAAM,IAAS,UAAK,KAAK,IAAI;AAC7B,YAAI;AACF,gBAAM,KAAK,MAAU,SAAK,CAAC;AAC3B,cAAI,MAAM,GAAG,UAAU,mBAAoB,OAAU,WAAO,CAAC;AAAA,QAC/D,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF,GAAG;AACL;AAoCO,SAAS,UAAU,MAAyB;AACjD,QAAM,UACJ,KAAK,eAAe,IAAI,MAAM,KAAK,YAAY,sCAAsC;AACvF,SAAO;AAAA,gCAA8B,KAAK,KAAK,aAAa,KAAK,IAAI,GAAG,OAAO;AACjF;AAEO,SAAS,kBAAkB,MAA6C;AAC7E,QAAM,YAAY,KAAK,kBAAkB;AACzC,QAAM,WAAW,KAAK,KAAK,QAAQ,qBAAqB,GAAG,EAAE,MAAM,GAAG,EAAE,KAAK;AAE7E,MAAI,OAAO;AACX,MAAI,YAAY;AAChB,MAAI,aAAa;AACjB,MAAI,eAAe;AACnB,MAAI,SAA6B;AACjC,MAAI,WAA0B;AAC9B,MAAI,SAAS;AACb,MAAI,YAAY;AAEhB,QAAM,OAAO,MAAY;AACvB,QAAI,UAAU,OAAQ;AACtB,QAAI;AACF,YAAM,MAAM,cAAc;AAI1B,gBAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,yBAAmB,GAAG;AACtB,YAAM,SAAQ,oBAAI,KAAK,GAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAC3D,YAAM,OAAO,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC;AAClD,iBAAgB,UAAK,KAAK,GAAG,KAAK,IAAI,QAAQ,IAAI,IAAI,MAAM;AAC5D,eAAS,kBAAkB,UAAU,EAAE,OAAO,KAAK,UAAU,OAAO,CAAC;AACrE,aAAO,GAAG,SAAS,MAAM;AAEvB,iBAAS;AACT,iBAAS;AACT,mBAAW;AAAA,MACb,CAAC;AAED,aAAO,MAAM,IAAI;AAAA,IACnB,QAAQ;AACN,eAAS;AACT,eAAS;AACT,iBAAW;AAAA,IACb;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,MAAoB;AACxB,UAAI,aAAa,CAAC,KAAM;AACxB,oBAAc,OAAO,WAAW,MAAM,MAAM;AAC5C,UAAI,CAAC,UAAU,CAAC,QAAQ;AACtB,YAAI,YAAY,KAAK,UAAU,WAAW;AACxC,kBAAQ;AACR,uBAAa,KAAK;AAClB;AAAA,QACF;AACA,gBAAQ;AACR,aAAK;AACL,eAAO;AACP;AAAA,MACF;AACA,UAAI,QAAQ;AACV,YAAI,OAAO,iBAAiB,uBAAuB;AACjD,0BAAgB,OAAO,WAAW,MAAM,MAAM;AAC9C;AAAA,QACF;AACA,eAAO,MAAM,IAAI;AAAA,MACnB;AAAA,IACF;AAAA,IACA,WAA6B;AAC3B,UAAI,WAAW;AACb,eAAO,WAAW,EAAE,MAAM,UAAU,OAAO,YAAY,aAAa,IAAI;AAAA,MAC1E;AACA,kBAAY;AACZ,aAAO;AACP,UAAI,CAAC,UAAU,CAAC,SAAU,QAAO;AACjC,UAAI;AACF,eAAO,IAAI;AAAA,MACb,QAAQ;AAAA,MAER;AACA,aAAO,EAAE,MAAM,UAAU,OAAO,YAAY,aAAa;AAAA,IAC3D;AAAA,EACF;AACF;;;ACzLA,YAAYC,UAAS;AACrB,YAAYC,WAAU;AACtB,YAAY,UAAU;AAqCf,SAAS,YAAY,OAAe,KAAsB;AAC/D,SAAY,iBAAW,KAAK,IAAS,gBAAU,KAAK,IAAS,cAAQ,IAAI,cAAc,IAAI,KAAK,KAAK;AACvG;AAOA,SAAS,aAAa,KAAwB;AAC5C,SAAO,CAAM,cAAQ,IAAI,WAAW,GAAQ,cAAa,sBAAiB,CAAC,CAAC;AAC9E;AAGA,SAAS,YAAY,QAAgB,OAA0B;AAC7D,SAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,UAAM,MAAW,eAAS,MAAM,MAAM;AACtC,WAAO,QAAQ,MAAO,CAAC,IAAI,WAAW,IAAI,KAAK,CAAM,iBAAW,GAAG;AAAA,EACrE,CAAC;AACH;AAEO,SAAS,iBAAiB,SAAiB,KAAsB;AACtE,QAAM,SAAc,cAAQ,OAAO;AAEnC,MAAI,IAAI,wBAAyB,QAAO;AACxC,MAAI,YAAY,QAAQ,aAAa,GAAG,CAAC,EAAG,QAAO;AACnD,QAAM,IAAI,MAAM,SAAS,OAAO,8BAAmC,cAAQ,IAAI,WAAW,CAAC,GAAG;AAChG;AAEO,SAAS,YAAY,OAAe,KAAsB;AAC/D,SAAO,iBAAiB,YAAY,OAAO,GAAG,GAAG,GAAG;AACtD;AAgBA,eAAsB,qBAAqB,SAAiB,KAA6B;AAEvF,MAAI,IAAI,wBAAyB;AAGjC,QAAM,YAAY,MAAM,QAAQ;AAAA,IAC9B,aAAa,GAAG,EAAE,IAAI,CAAC,MAAU,cAAS,CAAC,EAAE,MAAM,MAAW,cAAQ,CAAC,CAAC,CAAC;AAAA,EAC3E;AACA,MAAI,QAAQ;AACZ,aAAS;AACP,QAAI;AACJ,QAAI;AACF,aAAO,MAAU,cAAS,KAAK;AAAA,IACjC,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,UAAU;AACpD,cAAM,SAAc,cAAQ,KAAK;AACjC,YAAI,WAAW,MAAO;AACtB,gBAAQ;AACR;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,QAAI,YAAY,MAAM,SAAS,EAAG;AAClC,UAAM,IAAI;AAAA,MACR,SAAS,OAAO,sDAAsD,UAAU,CAAC,CAAC;AAAA,IACpF;AAAA,EACF;AACF;AAGA,eAAsB,gBAAgB,OAAe,KAA+B;AAClF,QAAM,MAAM,YAAY,OAAO,GAAG;AAClC,QAAM,qBAAqB,KAAK,GAAG;AACnC,SAAO;AACT;AA6BO,IAAM,2BAA2B;AAGxC,IAAM,uBAAuB;AAQtB,SAAS,wBAAwB,MAAsB;AAC5D,QAAM,KAAK,KAAK,QAAQ,SAAS,IAAI;AACrC,MAAI,CAAC,GAAG,SAAS,IAAI,EAAG,QAAO;AAC/B,SAAO,GACJ,MAAM,IAAI,EACV,IAAI,CAAC,SAAU,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,IAAK,EACnF,KAAK,IAAI;AACd;AAOO,SAAS,8BAA8B,MAAc,SAAS,sBAA8B;AACjG,QAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QAAM,MAAgB,CAAC;AACvB,MAAI,IAAI;AACR,SAAO,IAAI,MAAM,QAAQ;AACvB,QAAI,IAAI,IAAI;AACZ,WAAO,IAAI,MAAM,UAAU,MAAM,CAAC,MAAM,MAAM,CAAC,EAAG;AAClD,UAAM,MAAM,IAAI;AAChB,QAAI,OAAO,QAAQ;AACjB,UAAI,KAAK,MAAM,CAAC,GAAI,yBAAe,GAAG,YAAI;AAAA,IAC5C,OAAO;AACL,eAAS,IAAI,GAAG,IAAI,GAAG,IAAK,KAAI,KAAK,MAAM,CAAC,CAAE;AAAA,IAChD;AACA,QAAI;AAAA,EACN;AACA,SAAO,IAAI,KAAK,IAAI;AACtB;AAGA,SAAS,cAAc,GAAW,UAA0B;AAC1D,MAAI,YAAY,EAAG,QAAO;AAE1B,MAAI,OAAO,WAAW,GAAG,MAAM,KAAK,SAAU,QAAO;AACrD,MAAI,KAAK;AACT,MAAI,KAAK,EAAE;AACX,SAAO,KAAK,IAAI;AACd,UAAM,MAAM,KAAK,MAAM,KAAK,MAAM,CAAC;AACnC,QAAI,OAAO,WAAW,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,KAAK,SAAU,MAAK;AAAA,QAC5D,MAAK,MAAM;AAAA,EAClB;AACA,SAAO,EAAE,MAAM,GAAG,EAAE;AACtB;AAGA,SAAS,cAAc,GAAW,UAA0B;AAC1D,MAAI,YAAY,EAAG,QAAO;AAE1B,MAAI,OAAO,WAAW,GAAG,MAAM,KAAK,SAAU,QAAO;AACrD,MAAI,KAAK;AACT,MAAI,KAAK,EAAE;AACX,SAAO,KAAK,IAAI;AACd,UAAM,MAAM,KAAK,MAAM,KAAK,MAAM,CAAC;AACnC,QAAI,OAAO,WAAW,EAAE,MAAM,EAAE,SAAS,GAAG,GAAG,MAAM,KAAK,SAAU,MAAK;AAAA,QACpE,MAAK,MAAM;AAAA,EAClB;AACA,SAAO,EAAE,MAAM,EAAE,SAAS,EAAE;AAC9B;AAOO,SAAS,iBAAiB,GAAW,UAA0B;AACpE,QAAM,QAAQ,OAAO,WAAW,GAAG,MAAM;AACzC,MAAI,SAAS,SAAU,QAAO;AAG9B,QAAM,iBAAiB;AACvB,QAAM,QAAQ,KAAK,IAAI,GAAG,WAAW,cAAc;AACnD,QAAM,aAAa,KAAK,MAAM,QAAQ,IAAI;AAC1C,QAAM,OAAO,cAAc,GAAG,UAAU;AACxC,QAAM,OAAO,cAAc,GAAG,QAAQ,OAAO,WAAW,MAAM,MAAM,CAAC;AACrE,QAAM,OAAO,OAAO,WAAW,MAAM,MAAM,IAAI,OAAO,WAAW,MAAM,MAAM;AAC7E,SAAO,GAAG,IAAI;AAAA,mBAAiB,QAAQ,IAAI;AAAA,EAAa,IAAI;AAC9D;AAOO,SAAS,uBACd,KACA,OAA0C,CAAC,GACnC;AACR,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,OAAY,eAAU,GAAG;AAC7B,SAAO,wBAAwB,IAAI;AACnC,SAAO,KAAK,QAAQ,aAAa,EAAE;AACnC,SAAO,8BAA8B,IAAI;AACzC,SAAO,KAAK,QAAQ,WAAW,MAAM;AACrC,SAAO,iBAAiB,MAAM,KAAK,YAAY,wBAAwB;AACzE;;;ACtPA,SAAS,aAAa;AAEtB,YAAY,QAAQ;;;AC+CpB,IAAM,mCAAmC;AACzC,IAAM,iCAAiC;AAIvC,IAAM,yBAAyB;AAC/B,IAAM,oBAAoB;AAC1B,IAAM,+BAA+B;AACrC,IAAM,sBAAsB;AAarB,IAAM,iBAAN,MAAqB;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,QAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,SAAuB,CAAC;AAAA,EACxB,gBAA+B;AAAA,EAC/B,aAA4B;AAAA;AAAA,EAE5B,WAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1B,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,EAMlB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EAEA,YAAY,SAA+B,CAAC,GAAG;AAC7C,SAAK,yBAAyB,OAAO,0BAA0B;AAC/D,SAAK,sBAAsB,OAAO,uBAAuB;AACzD,SAAK,eAAe,OAAO,gBAAgB;AAC3C,SAAK,WAAW,OAAO,YAAY;AACnC,SAAK,oBAAoB,OAAO,qBAAqB;AACrD,SAAK,aAAa,OAAO,cAAc;AAAA,EACzC;AAAA;AAAA,EAGA,WAAW,SAAwB;AACjC,QAAI,KAAK,YAAY,QAAS;AAC9B,SAAK,UAAU;AACf,QAAI,CAAC,QAAS,MAAK,OAAO;AAAA,EAC5B;AAAA,EAEA,IAAI,YAAqB;AACvB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,aAAsB;AACxB,QAAI,CAAC,KAAK,QAAS,QAAO;AAC1B,SAAK,sBAAsB;AAC3B,WAAO,KAAK,UAAU;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAKA,WAAmC;AACjC,SAAK,sBAAsB;AAC3B,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,oBAAmC;AACvC,QAAI,KAAK,aAAa,QAAQ,KAAK,UAAU,QAAQ;AACnD,YAAM,UAAU,MAAM,KAAK;AAC3B,0BAAoB,KAAK,IAAI,GAAG,KAAK,aAAa,OAAO;AAAA,IAC3D;AACA,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,qBAAqB,KAAK;AAAA,MAC1B,mBAAmB,KAAK,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;AAAA,MACrD,eAAe,KAAK,OAAO;AAAA,MAC3B,UAAU,KAAK;AAAA,MACf,qBAAqB;AAAA,MACrB,eAAe,KAAK;AAAA,MACpB,YAAY,KAAK;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,WAAW,SAAS,OAAgB;AAClC,QAAI,UAAU,CAAC,KAAK,QAAS,QAAO;AACpC,SAAK,sBAAsB;AAC3B,QAAI,KAAK,UAAU,OAAQ,QAAO;AAClC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,UAAU,YAAoB,QAAiB,SAAS,OAAa;AACnE,QAAI,UAAU,CAAC,KAAK,QAAS;AAE7B,UAAM,MAAM,KAAK,IAAI;AAErB,QAAI,KAAK,UAAU,aAAa;AAE9B,UAAI,QAAQ;AACV,aAAK,MAAM;AACX;AAAA,MACF;AAEA,WAAK,OAAO;AACZ;AAAA,IACF;AAGA,SAAK,aAAa,GAAG;AAErB,UAAM,OAAO,cAAc,KAAK;AAChC,SAAK,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,KAAK,CAAC;AAE1C,QAAI,QAAQ;AACV,WAAK;AACL,WAAK,gBAAgB;AACrB,UAAI,KAAK,uBAAuB,KAAK,wBAAwB;AAC3D,aAAK,MAAM;AAAA,MACb;AACA;AAAA,IACF;AAGA,SAAK,sBAAsB;AAE3B,QAAI,MAAM;AACR,WAAK,aAAa;AAClB,YAAM,YAAY,KAAK,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;AACpD,UAAI,aAAa,KAAK,cAAc;AAClC,aAAK,MAAM;AAAA,MACb;AAAA,IACF;AAEA,UAAM,YAAY,KAAK,OAAO;AAC9B,QAAI,aAAa,KAAK,mBAAmB;AAIvC,WAAK,MAAM;AAAA,IACb;AAAA,EACF;AAAA;AAAA,EAGA,YAAkB;AAChB,SAAK,MAAM;AAAA,EACb;AAAA;AAAA,EAGA,aAAmB;AACjB,SAAK,OAAO;AAAA,EACd;AAAA,EAEQ,QAAc;AACpB,QAAI,KAAK,UAAU,OAAQ;AAC3B,SAAK,QAAQ;AACb,SAAK,WAAW,KAAK,IAAI;AAOzB,SAAK,SAAS,CAAC;AAEf,QAAI;AACF,WAAK,SAAS;AAAA,IAChB,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEQ,SAAe;AACrB,UAAM,gBAAgB,KAAK,UAAU;AACrC,SAAK,QAAQ;AACb,SAAK,sBAAsB;AAC3B,SAAK,SAAS,CAAC;AACf,SAAK,WAAW;AAGhB,QAAI,eAAe;AACjB,UAAI;AACF,aAAK,UAAU;AAAA,MACjB,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGQ,wBAA8B;AACpC,QAAI,KAAK,UAAU,UAAU,KAAK,aAAa,KAAM;AACrD,UAAM,UAAU,KAAK,IAAI,IAAI,KAAK;AAClC,QAAI,WAAW,KAAK,YAAY;AAC9B,WAAK,QAAQ;AACb,WAAK,WAAW;AAAA,IAClB;AAAA,EACF;AAAA,EAEQ,aAAa,KAAmB;AACtC,UAAM,SAAS,MAAM,KAAK;AAC1B,SAAK,SAAS,KAAK,OAAO,OAAO,CAAC,MAAM,EAAE,MAAM,MAAM;AAAA,EACxD;AACF;;;ACnTA,SAAS,qBAAqB;AAU9B,IAAM,0BAAoC;AAAA;AAAA,EAExC;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA,EAGA;AACF;AAMO,SAAS,cAAc,KAAqB;AACjD,MAAI,SAAS;AACb,aAAW,WAAW,yBAAyB;AAC7C,aAAS,OAAO,QAAQ,SAAS,CAAC,UAAU;AAG1C,YAAM,KAAK,MAAM,QAAQ,GAAG;AAC5B,YAAM,KAAK,MAAM,OAAO,IAAI;AAC5B,YAAM,QAAQ,OAAO,KAAK,MAAM,OAAO,KAAK,MAAM,EAAE,IAAI;AACxD,UAAI,UAAU,MAAM;AAClB,cAAM,OAAO,MAAM,MAAM,GAAG,MAAM,QAAQ,cAAc,KAAK,CAAC,IAAI,CAAC;AACnE,eAAO,GAAG,IAAI;AAAA,MAChB;AAEA,UAAI,MAAM,WAAW,IAAI,GAAG;AAK1B,eAAO;AAAA,MACT;AAKA,aAAO,GAAG,MAAM,MAAM,GAAG,CAAC,CAAC;AAAA,IAC7B,CAAC;AAAA,EACH;AACA,SAAO;AACT;;;AFkBA,IAAM,mBAAmB;AACzB,IAAM,4BAA4B;AA6B3B,SAAS,cAAc,KAAa,OAA6B,CAAC,GAAY;AACnF,MAAI;AACF,UAAM,QAAQ,MAAM,YAAY,CAAC,QAAQ,OAAO,GAAG,GAAG,MAAM,IAAI,GAAG;AAAA,MACjE,OAAO;AAAA,MACP,aAAa;AAAA,IACf,CAAC;AACD,QAAI,UAAU;AACd,QAAI;AACJ,UAAM,SAAS,MAAM;AACnB,UAAI,QAAS;AACb,gBAAU;AACV,UAAI,QAAS,cAAa,OAAO;AACjC,UAAI;AACF,aAAK,YAAY;AAAA,MACnB,QAAQ;AAAA,MAER;AAAA,IACF;AAMA,UAAM,GAAG,SAAS,MAAM;AACxB,UAAM,GAAG,SAAS,MAAM;AACxB,cAAU,WAAW,MAAM;AACzB,UAAI;AACF,cAAM,KAAK;AAAA,MACb,QAAQ;AAAA,MAER;AACA,aAAO;AAAA,IACT,GAAG,KAAK,IAAI,GAAG,KAAK,aAAa,yBAAyB,CAAC;AAC3D,YAAQ,QAAQ;AAChB,UAAM,MAAM;AACZ,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,IAAM,sBAAN,MAA0B;AAAA,EACd,YAAY,oBAAI,IAA4B;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,kBAAkB;AAAA,EAClB,gBAAsD;AAAA,EACtD,kBAAiC;AAAA,EACjC,4BAAwD,CAAC;AAAA,EAEjE,YAAY,eAAsC;AAChD,SAAK,UAAU,IAAI,eAAe,aAAa;AAE/C,SAAK,QAAQ,SAAS,MAAM,KAAK,kBAAkB;AACnD,SAAK,QAAQ,UAAU,MAAM,KAAK,qBAAqB;AAEvD,SAAK,QAAQ,WAAW,KAAK;AAAA,EAC/B;AAAA,EAEA,SACE,MAIM;AACN,SAAK,UAAU,IAAI,KAAK,KAAK;AAAA,MAC3B,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,WAAW,KAAK,aAAa;AAAA,MAC7B,YAAY,KAAK,cAAc;AAAA,IACjC,CAAC;AAAA,EACH;AAAA,EAEQ,iBAAiB,KAAsB;AAC7C,WAAO,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,QAAQ,QAAQ,OAAO,QAAQ,QAAQ;AAAA,EACpF;AAAA,EAEQ,uBAAuB,GAA4B;AACzD,WACK,YAAS,MAAM,WAClB,EAAE,uBAAuB,QACzB,KAAK,iBAAiB,EAAE,GAAG,KAC3B,OAAO,EAAE,MAAM,QAAQ,YACvB,EAAE,MAAM,QAAQ,EAAE;AAAA,EAEtB;AAAA,EAEQ,iBAAiB,GAAmB,QAA8B;AACxE,QAAI;AACF,QAAE,MAAM,KAAK,MAAM;AAAA,IACrB,QAAQ;AAAA,IAGR;AAAA,EACF;AAAA,EAEQ,WAAW,GAAmB,QAA8B;AAClE,QAAI,KAAK,uBAAuB,CAAC,GAAG;AAClC,UAAI;AACF,gBAAQ,KAAK,CAAC,EAAE,KAAK,MAAM;AAC3B;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,SAAK,iBAAiB,GAAG,MAAM;AAAA,EACjC;AAAA;AAAA,EAGA,WAAW,KAAmB;AAC5B,SAAK,UAAU,OAAO,GAAG;AAAA,EAC3B;AAAA;AAAA,EAGA,IAAI,KAAyC;AAC3C,SAAK,YAAY,GAAG;AACpB,WAAO,KAAK,UAAU,IAAI,GAAG;AAAA,EAC/B;AAAA;AAAA,EAGA,OAAyB;AACvB,SAAK,eAAe;AACpB,WAAO,MAAM,KAAK,KAAK,UAAU,OAAO,CAAC;AAAA,EAC3C;AAAA;AAAA,EAGA,OAAO,MAAgC;AACrC,WAAO,KAAK,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI;AAAA,EAClD;AAAA;AAAA,EAGA,UAAU,WAAqC;AAC7C,WAAO,KAAK,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS;AAAA,EAC5D;AAAA;AAAA,EAGA,IAAI,cAAsB;AACxB,QAAI,IAAI;AACR,eAAW,KAAK,KAAK,UAAU,OAAO,GAAG;AACvC,UAAI,CAAC,EAAE,OAAQ;AAAA,IACjB;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,IAAI,wBAAgC;AAClC,QAAI,IAAI;AACR,eAAW,KAAK,KAAK,UAAU,OAAO,GAAG;AACvC,UAAI,EAAE,cAAc,CAAC,EAAE,OAAQ;AAAA,IACjC;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,QAAuB;AACrB,SAAK,eAAe;AACpB,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB,iBAAiB,KAAK;AAAA,MACtB,YAAY,KAAK,UAAU;AAAA,MAC3B,SAAS,KAAK,QAAQ,SAAS;AAAA,IACjC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,aAAsB;AACxB,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,SAAS,OAAgB;AAClC,WAAO,KAAK,QAAQ,WAAW,MAAM;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAU,YAAoB,QAAiB,SAAS,OAAa;AACnE,SAAK,QAAQ,UAAU,YAAY,QAAQ,MAAM;AAAA,EACnD;AAAA;AAAA,EAGA,mBAAyB;AACvB,SAAK,QAAQ,UAAU;AAAA,EACzB;AAAA;AAAA,EAGA,oBAA0B;AACxB,SAAK,QAAQ,WAAW;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,iBAAiB,KAAoF;AACnG,QAAI,IAAI,YAAY,OAAW,MAAK,QAAQ,WAAW,IAAI,OAAO;AAClE,QAAI,IAAI,oBAAoB,OAAW,MAAK,kBAAkB,KAAK,IAAI,GAAG,IAAI,eAAe;AAE7F,QAAI,KAAK,mBAAmB,GAAG;AAC7B,WAAK,qBAAqB;AAC1B;AAAA,IACF;AAIA,QAAI,KAAK,QAAQ,aAAa,KAAK,QAAQ,SAAS,EAAE,UAAU,QAAQ;AACtE,WAAK,kBAAkB;AAAA,IACzB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,sBAA+C;AAC7C,QAAI,KAAK,oBAAoB,QAAQ,KAAK,mBAAmB,EAAG,QAAO;AACvE,UAAM,UAAU,KAAK,IAAI,IAAI,KAAK;AAClC,WAAO,EAAE,aAAa,KAAK,IAAI,GAAG,KAAK,kBAAkB,OAAO,GAAG,SAAS,KAAK,gBAAgB;AAAA,EACnG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,yBAAyB,UAAgD;AACvE,SAAK,0BAA0B,KAAK,QAAQ;AAC5C,WAAO,MAAM;AACX,WAAK,4BAA4B,KAAK,0BAA0B,OAAO,CAAC,MAAM,MAAM,QAAQ;AAAA,IAC9F;AAAA,EACF;AAAA,EAEQ,wBAA8B;AACpC,UAAM,OAAO,KAAK,oBAAoB;AACtC,eAAW,KAAK,KAAK,2BAA2B;AAC9C,UAAI;AACF,UAAE,IAAI;AAAA,MACR,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,oBAA0B;AAChC,QAAI,KAAK,mBAAmB,KAAK,CAAC,KAAK,QAAQ,UAAW;AAC1D,SAAK,oBAAoB;AACzB,SAAK,kBAAkB,KAAK,IAAI;AAChC,SAAK,gBAAgB,WAAW,MAAM;AACpC,WAAK,gBAAgB;AACrB,WAAK,kBAAkB;AAEvB,WAAK,QAAQ,EAAE,OAAO,OAAO,oBAAoB,KAAK,CAAC;AACvD,WAAK,QAAQ,WAAW;AACxB,WAAK,sBAAsB;AAAA,IAC7B,GAAG,KAAK,eAAe;AAEvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,sBAAsB;AAAA,EAC7B;AAAA,EAEQ,uBAA6B;AACnC,UAAM,WAAW,KAAK,oBAAoB;AAC1C,SAAK,oBAAoB;AACzB,QAAI,UAAU;AACZ,WAAK,kBAAkB;AACvB,WAAK,sBAAsB;AAAA,IAC7B;AAAA,EACF;AAAA,EAEQ,sBAA4B;AAClC,QAAI,KAAK,kBAAkB,MAAM;AAC/B,mBAAa,KAAK,aAAa;AAC/B,WAAK,gBAAgB;AAAA,IACvB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,KAAK,KAAa,OAAiB,CAAC,GAAY;AAC9C,SAAK,YAAY,GAAG;AACpB,UAAM,IAAI,KAAK,UAAU,IAAI,GAAG;AAChC,QAAI,CAAC,EAAG,QAAO;AACf,QAAI,EAAE,OAAQ,QAAO;AACrB,QAAI,EAAE,UAAW,QAAO;AACxB,QAAI,KAAK,sBAAsB,EAAE,WAAY,QAAO;AAEpD,UAAM,EAAE,QAAQ,OAAO,UAAU,iBAAiB,IAAI;AACtD,UAAMC,SAAW,YAAS,MAAM;AAEhC,QAAIA,QAAO;AAWT,YAAM,gBAAgB,EAAE,MAAM,aAAa,QAAQ,OAAO,EAAE,MAAM,QAAQ;AAC1E,YAAM,iBAAiB,MAAM;AAC3B,YAAI,EAAE,MAAM,aAAa,MAAM;AAC7B,cAAI;AACF,cAAE,MAAM,KAAK,SAAS;AAAA,UACxB,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AACA,UACE,iBACA,cAAc,KAAK;AAAA,QACjB,WAAW,KAAK,IAAI,SAAS,yBAAyB;AAAA,QACtD,WAAW;AAAA,MACb,CAAC,GACD;AAAA,MAIF,OAAO;AACL,YAAI;AACF,YAAE,MAAM,KAAK,QAAQ,YAAY,SAAS;AAAA,QAC5C,QAAQ;AAAA,QAER;AAAA,MACF;AACA,QAAE,SAAS;AACX,aAAO;AAAA,IACT;AAKA,QAAI;AACF,UAAI,OAAO;AACT,aAAK,WAAW,GAAG,SAAS;AAAA,MAC9B,OAAO;AACL,aAAK,WAAW,GAAG,SAAS;AAE5B,cAAM,QAAQ,WAAW,MAAM;AAE7B,cAAI,KAAK,UAAU,IAAI,GAAG,KAAK,CAAC,EAAE,MAAM,QAAQ;AAC9C,iBAAK,WAAW,GAAG,SAAS;AAAA,UAC9B;AAAA,QACF,GAAG,OAAO;AACV,cAAM,QAAQ;AAAA,MAChB;AAAA,IACF,QAAQ;AAAA,IAER;AACA,MAAE,SAAS;AACX,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAQ,OAAiB,CAAC,GAAa;AACrC,UAAM,OAAO,MAAM,KAAK,KAAK,UAAU,KAAK,CAAC;AAC7C,UAAM,SAAmB,CAAC;AAC1B,eAAW,OAAO,MAAM;AACtB,YAAM,IAAI,KAAK,UAAU,IAAI,GAAG;AAChC,UAAI,KAAK,CAAC,EAAE,aAAa,KAAK,KAAK,KAAK,IAAI,EAAG,QAAO,KAAK,GAAG;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,WAAmB,OAAiB,CAAC,GAAa;AAC5D,UAAM,OAAO,KAAK,UAAU,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG;AACvD,UAAM,SAAmB,CAAC;AAC1B,eAAW,OAAO,MAAM;AACtB,UAAI,KAAK,KAAK,KAAK,IAAI,EAAG,QAAO,KAAK,GAAG;AAAA,IAC3C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBQ,cAAc,OAAgC;AACpD,WAAO,MAAM,MAAM,aAAa,QAAQ,KAAK,IAAI,IAAI,MAAM,YAAY;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,YAAY,KAAmB;AACrC,UAAM,QAAQ,KAAK,UAAU,IAAI,GAAG;AACpC,QAAI,SAAS,KAAK,cAAc,KAAK,GAAG;AACtC,WAAK,UAAU,OAAO,GAAG;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,iBAAuB;AAC7B,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,WAAW;AACzC,UAAI,KAAK,cAAc,KAAK,EAAG,MAAK,UAAU,OAAO,GAAG;AAAA,IAC1D;AAAA,EACF;AACF;AAGA,IAAI;AAEG,SAAS,qBAA0C;AACxD,MAAI,CAAC,WAAW;AACd,gBAAY,IAAI,oBAAoB;AAAA,EACtC;AACA,SAAO;AACT;;;AG3kBA,YAAY,QAAQ;AACpB,YAAYC,WAAU;AAWf,SAAS,oBAAoB,KAAqB;AACvD,MAAI,QAAQ,aAAa,QAAS,QAAO;AAKzC,MAAI,IAAI,SAAS,GAAG,KAAK,IAAI,SAAS,IAAI,KAAU,cAAQ,IAAI,QAAQ,OAAO,IAAI,CAAC,GAAG;AACrF,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,QAAQ,IAAI,SAAS,KAAK,yCACxC,YAAY,EACZ,MAAM,GAAG;AAEZ,QAAM,YAAY,QAAQ,IAAI,MAAM,KAAK,IAAI,MAAW,eAAS;AAEjE,aAAW,OAAO,UAAU;AAC1B,UAAM,OAAY,WAAK,KAAK,GAAG;AAG/B,eAAW,OAAO,SAAS;AACzB,YAAM,OAAO,GAAG,IAAI,GAAG,GAAG;AAC1B,UAAI;AACF,QAAG,cAAW,MAAS,aAAU,IAAI;AACrC,eAAO;AAAA,MACT,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAIA,SAAO;AACT;AAqDA,IAAM,mBAAmB;AAYlB,SAAS,yBAAyB,MAAgC;AACvE,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,QAAQ,YAAY,iBAAiB,KAAK,GAAG,GAAG;AACzD,YAAM,IAAI;AAAA,QACR,6MAGE,KAAK,UAAU,GAAG;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,4BACd,SACA,OAA0B,CAAC,GACH;AACxB,2BAAyB,CAAC,SAAS,GAAG,IAAI,CAAC;AAC3C,QAAM,OAAO,CAAC,QAAQ,iBAAiB,OAAO,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,EAAE,KAAK,GAAG;AACxF,SAAO;AAAA,IACL,SAAS,QAAQ,IAAI,SAAS,KAAK;AAAA,IACnC,MAAM,CAAC,MAAM,MAAM,IAAI;AAAA,IACvB,0BAA0B;AAAA,EAC5B;AACF;AAEA,SAAS,iBAAiB,KAAqB;AAC7C,SAAO,IAAI,GAAG;AAChB;;;AC5FA,IAAM,SAAS,CAAC,MAAyB,UAA2B,KAAK,SAAS,KAAK;AACvF,IAAM,aAAa,CAAC,MAAyB,OAAwB,KAAK,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;AAQhG,IAAM,gBAAgB,CAAC,MAAyB,YAA6B;AAC3E,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,MAAM;AACpB,QAAI,CAAC,EAAE,WAAW,GAAG,KAAK,EAAE,WAAW,IAAI,EAAG;AAC9C,eAAW,MAAM,EAAE,QAAQ,OAAO,EAAE,EAAG,MAAK,IAAI,EAAE;AAAA,EACpD;AACA,SAAO,QAAQ,MAAM,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AACnD;AAEA,IAAM,QAA+B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnC;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,UAAU,QAAQ,QAAQ,QAAQ,YAAY,cAAc,MAAM,IAAI;AAAA,IAClF,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SAAS;AACnB,UAAI,QAAQ,gBAAgB,QAAQ,OAAQ,QAAO;AACnD,YAAM,aAAa,WAAW,MAAM,2BAA2B;AAC/D,YAAM,WAAW,OAAO,MAAM,QAAQ,KAAK,OAAO,MAAM,IAAI;AAE5D,UAAI,OAAO,MAAM,SAAS,EAAG,QAAO;AACpC,aAAO,cAAc;AAAA,IACvB;AAAA,IACA,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SAAS;AACnB,UAAI,QAAQ,OAAQ,QAAO;AAC3B,aAAO,KAAK;AAAA,QACV,CAAC,MACC,MAAM,WACN,MAAM,YACN,MAAM,SACN,MAAM,UACN,MAAM,cACN,MAAM,eACN,EAAE,WAAW,QAAQ,KACrB,EAAE,WAAW,MAAM,KACnB,EAAE,WAAW,WAAW;AAAA,MAC5B;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SACV,QAAQ,SACR,KAAK;AAAA,MACH,CAAC,MACC,EAAE,WAAW,SAAS,KACtB,EAAE,WAAW,gBAAgB,KAC7B,EAAE,WAAW,iBAAiB,KAC9B,MAAM,YACN,MAAM,mBACN,MAAM;AAAA,IACV;AAAA,IACF,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,QAAQ,QAAQ,YAAY,QAAQ;AAAA,IAC3C,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,QAAQ,QAAQ,cAAc,QAAQ;AAAA,IAC7C,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,QAAQ,QAAQ,aAAa,QAAQ;AAAA,IAC5C,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,QAAQ,uBAAuB,KAAK,GAAG,KAAK,QAAQ;AAAA,IAC3D,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SAAS;AACnB,UAAI,QAAQ,KAAM,QAAO;AACzB,aAAO,KAAK,KAAK,CAAC,MAAM,iDAAiD,KAAK,CAAC,CAAC;AAAA,IAClF;AAAA,IACA,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,QAAQ,QAAQ,WAAW,QAAQ;AAAA,IAC1C,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,QAAQ,QAAQ,YAAY,QAAQ;AAAA,IAC3C,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,QAAQ,QAAQ,aAAa,QAAQ;AAAA,IAC5C,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SAAS;AACnB,UAAI,QAAQ,MAAO,QAAO;AAC1B,YAAM,UAAU,KAAK,QAAQ,MAAM;AACnC,UAAI,UAAU,EAAG,QAAO;AACxB,eAAS,IAAI,UAAU,GAAG,IAAI,KAAK,QAAQ,KAAK;AAC9C,cAAM,IAAI,KAAK,CAAC;AAChB,YAAI,MAAM,aAAa,MAAM,QAAQ,MAAM,qBAAsB,QAAO;AACxE,YAAI,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC,EAAE,SAAS,GAAG,EAAG;AAC5C,YAAI,EAAE,WAAW,SAAS,EAA2C,QAAO;AAAA,MAC9E;AACA,aAAO;AAAA,IACT;AAAA,IACA,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SACV,QAAQ,SAAS,KAAK,KAAK,CAAC,MAAM,MAAM,YAAY,EAAE,WAAW,SAAS,CAAC;AAAA,IAC7E,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SAAS;AACnB,UAAI,QAAQ,MAAO,QAAO;AAC1B,YAAM,WAAW,KAAK,QAAQ,OAAO;AACrC,UAAI,WAAW,EAAG,QAAO;AAGzB,aAAO,KACJ,MAAM,WAAW,CAAC,EAClB;AAAA,QACC,CAAC,MACC,MAAM,QACN,MAAM,aACN,EAAE,WAAW,IAAI,KACjB,EAAE,WAAW,UAAU;AAAA,MAC3B;AAAA,IACJ;AAAA,IACA,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SAAS;AACnB,UAAI,CAAC,CAAC,OAAO,QAAQ,QAAQ,OAAO,OAAO,EAAE,SAAS,GAAG,EAAG,QAAO;AAKnE,aAAO,KAAK,SAAS,SAAS,KAAM,QAAQ,WAAW,KAAK,SAAS,MAAM;AAAA,IAC7E;AAAA,IACA,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SAAS;AACnB,UAAI,QAAQ,UAAW,QAAO;AAC9B,YAAM,SAAS,KAAK,QAAQ,QAAQ;AACpC,UAAI,SAAS,EAAG,QAAO;AAGvB,YAAM,QAAQ,KAAK,MAAM,SAAS,CAAC;AACnC,aAAO,MAAM,CAAC,MAAM,eAAe,MAAM,CAAC,MAAM;AAAA,IAClD;AAAA,IACA,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SAAS,QAAQ,aAAa,KAAK,SAAS,OAAO;AAAA,IAC/D,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SAAS;AACnB,UACE,CAAC;AAAA,QACC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,SAAS,GAAG,GACd;AACA,eAAO;AAAA,MACT;AACA,aAAO,KAAK;AAAA,QACV,CAAC,MACC,MAAM,QACN,MAAM,QACN,MAAM,YACN,MAAM,WACN,MAAM;AAAA,MACV;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SACV,6KAA6K;AAAA,MAC3K,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;AAAA,IACzB;AAAA,IACF,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,QAAQ,QAAQ,UAAU,QAAQ;AAAA,IACzC,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,QAAQ,QAAQ,WAAW,QAAQ;AAAA,IAC1C,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,MAAM,CAAC,KAAK,SAAS;AACnB,UAAI,QAAQ,QAAS,QAAO;AAI5B,aAAO,KAAK,KAAK,CAAC,MAAM,eAAe,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;AAAA,IAC/D;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAmBO,SAAS,aACd,KACA,MACA,QACkB;AAClB,QAAM,UAAoB,CAAC;AAC3B,MAAI,QAAqB;AACzB,MAAI;AAEJ,aAAW,QAAQ,OAAO;AACxB,QAAI,QAAQ,IAAI,KAAK,EAAE,EAAG;AAC1B,QAAI,CAAC,KAAK,KAAK,KAAK,IAAI,EAAG;AAC3B,YAAQ,KAAK,KAAK,MAAM;AACxB,kBAAc,KAAK;AACnB,QAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,GAAG;AAC5C,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAEA,MAAI,UAAU,OAAQ,QAAO,EAAE,OAAO,QAAQ,SAAS,CAAC,EAAE;AAG1D,QAAM,SAA2B,EAAE,OAAO,QAAQ;AAClD,MAAI,gBAAgB,OAAW,QAAO,cAAc;AACpD,SAAO;AACT;AAEA,SAAS,UAAU,OAA4B;AAC7C,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;ACjYA,YAAYC,SAAQ;AACpB,YAAYC,WAAU;;;ACNtB,YAAYC,SAAQ;AAEpB,YAAYC,SAAQ;AACpB,SAAS,oBAAAC,yBAAwB;AACjC,YAAYC,WAAU;AAItB,IAAM,gBAAgB;AAEtB,SAAS,eAAe,KAAsB;AAC5C,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;AAEA,SAAS,kBAAkB,OAA4C,OAAe,SAAiB,OAAuB;AAC5H,QAAM,UAA6H;AAAA,IACjI;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,MAAI,UAAU,QAAW;AACvB,YAAQ,QAAQ,eAAe,KAAK;AAAA,EACtC;AAEA,UAAQ,IAAI,KAAK,UAAU,OAAO,CAAC;AACrC;AACA,IAAM,wBAAwB;AAC9B,IAAM,qBAAqB;AAI3B,IAAM,gBAAgB;AACtB,IAAM,WAAW;AAgCjB,SAAS,qBAA6B;AACpC,QAAMC,YAAc,aAAS;AAC7B,QAAM,MAAM,QAAQ;AACpB,QAAM,SAAS,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC;AACpD,SAAO,GAAGA,SAAQ,IAAI,GAAG,IAAI,MAAM;AACrC;AAMA,SAAS,YAAY,KAA4C;AAC/D,SAAO,OAAO,QAAQ,YAAY,QAAQ,QAAQ,UAAU;AAC9D;AAEA,eAAe,YAAY,cAAsB,YAAY,KAAoC;AAC/F,QAAM,QAAQ,KAAK,IAAI;AACvB,QAAM,SAAS,OAAO,QAAQ,GAAG;AACjC,QAAM,UAAa,aAAS;AAE5B,SAAO,KAAK,IAAI,IAAI,QAAQ,WAAW;AACrC,QAAI;AAEF,YAAS,cAAU,cAAc,GAAG,MAAM,IAAI,OAAO,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC;AACrF,aAAO,YAAY;AACjB,YAAI;AACF,gBAAS,WAAO,YAAY;AAAA,QAC9B,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,YAAY,GAAG,KAAK,IAAI,SAAS,UAAU;AAE7C,YAAI;AACF,gBAAM,UAAU,MAAS,aAAS,cAAc,OAAO;AACvD,gBAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,gBAAM,UAAU,SAAS,MAAM,CAAC,KAAK,KAAK,EAAE;AAG5C,gBAAM,SAAS,OAAO,MAAM,MAAM,SAAS,CAAC,CAAC;AAC7C,gBAAM,aAAa,OAAO,SAAS,MAAM,KAAK,KAAK,IAAI,IAAI,SAAS;AAEpE,cAAI,aAAa;AACjB,cAAI,QAAQ,aAAa,WAAW,OAAO,SAAS,OAAO,KAAK,UAAU,GAAG;AAC3E,gBAAI;AACF,sBAAQ,KAAK,SAAS,CAAC;AAAA,YACzB,QAAQ;AACN,2BAAa;AAAA,YACf;AAAA,UACF;AAMA,cAAI,cAAc,YAAY;AAC5B,kBAAS,WAAO,YAAY,EAAE,MAAM,MAAM;AAAA,YAAC,CAAC;AAC5C;AAAA,UACF;AAAA,QACF,QAAQ;AAEN,gBAAS,WAAO,YAAY,EAAE,MAAM,MAAM;AAAA,UAAC,CAAC;AAC5C;AAAA,QACF;AAGA,cAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC;AAC3C;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,IAAI,MAAM,gCAAgC,SAAS,IAAI;AAC/D;AAMA,SAAS,oBAA4C;AACnD,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,oBAAI,IAAI;AAAA,IACnB,mBAAmB,CAAC,cAAc,MAAM;AAAA,IACxC,aAAa,KAAK,IAAI;AAAA,EACxB;AACF;AAEA,eAAe,iBAAiB,UAAmD;AACjF,MAAI;AACJ,MAAI;AACF,cAAU,MAAS,aAAS,UAAU,OAAO;AAAA,EAC/C,SAAS,KAAK;AACZ,QAAI,YAAY,GAAG,KAAK,IAAI,SAAS,SAAU,QAAO,kBAAkB;AACxE,UAAM;AAAA,EACR;AAMA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO;AAGjC,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO,kBAAkB;AACpE,UAAM,OAAO,kBAAkB;AAC/B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW,MAAM,QAAQ,OAAO,SAAS,IACrC,IAAI,IAAI,OAAO,SAA+C,IAC9D,KAAK;AAAA,MACT,mBAAmB,MAAM,QAAQ,OAAO,iBAAiB,IACrD,OAAO,oBACP,KAAK;AAAA,MACT,aACE,OAAO,OAAO,gBAAgB,WAAW,OAAO,cAAc,KAAK;AAAA,IACvE;AAAA,EACF,QAAQ;AACN,WAAO,kBAAkB;AAAA,EAC3B;AACF;AAKA,eAAe,kBAAkB,UAAkB,MAA6C;AAC9F,QAAM,UAAU,GAAG,QAAQ,QAAQ,QAAQ,GAAG;AAC9C,QAAM,UAAU,KAAK,UAAU,MAAM,CAAC,IAAI,MAAM;AAC9C,QAAI,aAAa,KAAK;AACpB,aAAO,MAAM,KAAK,EAAE,QAAQ,CAAC;AAAA,IAC/B;AACA,WAAO;AAAA,EACT,GAAG,CAAC;AAEJ,QAAS,cAAU,SAAS,SAAS,OAAO;AAC5C,QAAS,WAAO,SAAS,QAAQ;AACnC;AAMO,IAAM,4BAAN,MAAgC;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,oBAA2D;AAAA,EAC3D,kBAAyD;AAAA,EACzD,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACR,gBAAgB,MAAY;AAC3C,SAAK;AAAA,MACH,KAAK,iBAAiB;AAAA,MACtB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,YAAY,cAAoC;AAC9C,SAAK,aAAa,mBAAmB;AACrC,UAAM,aAAaC,kBAAiB;AACpC,SAAK,eAAoB,WAAK,YAAY,aAAa;AACvD,SAAK,WAAgB,WAAK,YAAY,QAAQ;AAC9C,SAAK,eAAe,gBAAgB,mBAAmB;AAGvD,SAAK,gBAAgB,EAAE,MAAM,CAAC,QAAQ;AACpC,wBAAkB,QAAQ,sCAAsC,qEAAqE,GAAG;AAAA,IAC1I,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,kBAAiC;AAC7C,UAAM,MAAW,cAAQ,KAAK,YAAY;AAC1C,QAAI;AACF,YAAS,UAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,IACzC,SAAS,KAAK;AACZ,UAAI,CAAC,YAAY,GAAG,KAAK,IAAI,SAAS,SAAU,OAAM;AAAA,IACxD;AAAA,EACF;AAAA,EAEQ,gBAAgB,WAA0B,OAAe,SAAuB;AACtF,SAAK,UAAU,MAAM,CAAC,QAAQ;AAC5B,wBAAkB,QAAQ,OAAO,SAAS,GAAG;AAAA,IAC/C,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,QAAc;AACZ,QAAI,KAAK,kBAAmB;AAC5B,SAAK,iBAAiB;AAGtB,SAAK,UAAU;AAGf,SAAK,oBAAoB,YAAY,MAAM;AACzC,WAAK,UAAU;AAAA,IACjB,GAAG,qBAAqB;AACxB,SAAK,kBAAkB,QAAQ;AAG/B,SAAK,kBAAkB,YAAY,MAAM;AACvC,WAAK,QAAQ;AAAA,IACf,GAAG,kBAAkB;AACrB,SAAK,gBAAgB,QAAQ;AAG7B,SAAK,oBAAoB;AAGzB,YAAQ,GAAG,QAAQ,KAAK,aAAa;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAa;AACX,SAAK,iBAAiB;AACtB,QAAI,KAAK,mBAAmB;AAC1B,oBAAc,KAAK,iBAAiB;AACpC,WAAK,oBAAoB;AAAA,IAC3B;AACA,QAAI,KAAK,iBAAiB;AACxB,oBAAc,KAAK,eAAe;AAClC,WAAK,kBAAkB;AAAA,IACzB;AACA,YAAQ,IAAI,QAAQ,KAAK,aAAa;AACtC,SAAK;AAAA,MACH,KAAK,iBAAiB;AAAA,MACtB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,sBAA4B;AAC1B,UAAM,UAAU,QAAQ;AAExB,SAAK;AAAA,MACH,KAAK,sBAAsB;AAAA,QACzB,KAAK;AAAA,QACL,MAAM;AAAA,QACN,SAAS,QAAQ,KAAK,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG;AAAA,QAC1C,WAAW,KAAK,IAAI;AAAA,QACpB,eAAe,KAAK,IAAI;AAAA,QACxB,YAAY,KAAK;AAAA,QACjB,UAAa,aAAS;AAAA,QACtB,WAAW;AAAA,QACX,WAAW;AAAA,QACX,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAAA,MACD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,qBAAqB,KAAa,MAAc,SAAiB,WAAoB,YAA8B,SAAe;AAChI,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,eAAe,KAAK,IAAI;AAAA,MACxB,YAAY,KAAK;AAAA,MACjB,UAAa,aAAS;AAAA,MACtB,WAAW;AAAA;AAAA,MACX;AAAA,MACA,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,IACpB;AACA,QAAI,WAAW;AACb,YAAM,YAAY;AAAA,IACpB;AACA,SAAK;AAAA,MACH,KAAK,sBAAsB,KAAK;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,sBAAsB,OAA8C;AAChF,UAAM,UAAU,MAAM,YAAY,KAAK,QAAQ;AAC/C,QAAI;AACF,YAAM,OAAO,MAAM,iBAAiB,KAAK,YAAY;AAGrD,WAAK,UAAU,IAAI,OAAO,MAAM,GAAG,GAAG,KAAK;AAG3C,YAAM,QAAsB;AAC5B,WAAK,aAAa,SAAS;AAAA,QACzB,KAAK,MAAM;AAAA,QACX,MAAM,MAAM;AAAA,QACZ,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB;AAAA,MACF,CAAC;AAED,YAAM,kBAAkB,KAAK,cAAc,IAAI;AAAA,IACjD,UAAE;AACA,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,KAA4B;AAC3C,UAAM,UAAU,MAAM,YAAY,KAAK,QAAQ;AAC/C,QAAI;AACF,YAAM,OAAO,MAAM,iBAAiB,KAAK,YAAY;AACrD,WAAK,UAAU,OAAO,OAAO,GAAG,CAAC;AACjC,YAAM,kBAAkB,KAAK,cAAc,IAAI;AAAA,IACjD,UAAE;AACA,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAkB;AACxB,QAAI,KAAK,kBAAkB,KAAK,iBAAkB;AAElD,SAAK,mBAAmB;AACxB,SAAK,KAAK,iBAAiB,EACxB,MAAM,CAAC,QAAQ;AACd;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC,EACA,QAAQ,MAAM;AACb,WAAK,mBAAmB;AAAA,IAC1B,CAAC;AAAA,EACL;AAAA,EAEQ,UAAgB;AACtB,QAAI,KAAK,kBAAkB,KAAK,eAAgB;AAEhD,SAAK,iBAAiB;AACtB,SAAK,KAAK,oBAAoB,EAC3B,MAAM,CAAC,QAAQ;AACd;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC,EACA,QAAQ,MAAM;AACb,WAAK,iBAAiB;AAAA,IACxB,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,mBAAkC;AAC9C,UAAM,UAAU,MAAM,YAAY,KAAK,QAAQ;AAC/C,QAAI;AACF,YAAM,OAAO,MAAM,iBAAiB,KAAK,YAAY;AACrD,YAAM,MAAM,KAAK,IAAI;AAGrB,YAAM,mBAAmB,oBAAI,IAAoC;AAEjE,iBAAW,CAAC,SAAS,KAAK,KAAK,KAAK,WAAW;AAC7C,YAAI,MAAM,eAAe,KAAK,YAAY;AACxC,gBAAM,gBAAgB;AAAA,QACxB;AAEA,YAAI,MAAM,eAAe,KAAK,cAAe,MAAM,MAAM,gBAAiB,oBAAoB;AAC5F,2BAAiB,IAAI,SAAS,KAAK;AAAA,QACrC;AAAA,MACF;AAEA,WAAK,YAAY;AACjB,WAAK,cAAc;AACnB,YAAM,kBAAkB,KAAK,cAAc,IAAI;AAAA,IACjD,SAAS,KAAK;AACZ,wBAAkB,QAAQ,gCAAgC,0CAA0C,GAAG;AAAA,IACzG,UAAE;AACA,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,sBAAqC;AACjD,UAAM,UAAU,MAAM,YAAY,KAAK,QAAQ;AAC/C,QAAI;AACF,YAAM,OAAO,MAAM,iBAAiB,KAAK,YAAY;AACrD,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,YAAsB,CAAC;AAE7B,iBAAW,CAAC,SAAS,KAAK,KAAK,KAAK,WAAW;AAC7C,cAAM,MAAM,MAAM,MAAM;AAExB,YAAI,MAAM,oBAAoB;AAE5B,cAAI;AACF,gBAAI,QAAQ,aAAa,SAAS;AAChC,sBAAQ,KAAK,MAAM,KAAK,CAAC;AAAA,YAC3B,OAAO;AAEL;AAAA,gBACE;AAAA,gBACA;AAAA,gBACA,iDAAiD,MAAM,GAAG,KAAK,GAAG;AAAA,cACpE;AAAA,YACF;AAAA,UAEF,QAAQ;AAEN,sBAAU,KAAK,OAAO;AAAA,UACxB;AAAA,QACF;AAAA,MACF;AAEA,UAAI,UAAU,SAAS,GAAG;AACxB,mBAAW,UAAU,WAAW;AAC9B,eAAK,UAAU,OAAO,MAAM;AAAA,QAC9B;AACA,cAAM,kBAAkB,KAAK,cAAc,IAAI;AAAA,MACjD;AAAA,IACF,SAAS,KAAK;AACZ,wBAAkB,QAAQ,mCAAmC,6CAA6C,GAAG;AAAA,IAC/G,UAAE;AACA,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,KAA+B;AAClD,UAAM,UAAU,MAAM,YAAY,KAAK,QAAQ;AAC/C,QAAI;AACF,YAAM,OAAO,MAAM,iBAAiB,KAAK,YAAY;AACrD,YAAM,QAAQ,KAAK,UAAU,IAAI,OAAO,GAAG,CAAC;AAE5C,UAAI,CAAC,MAAO,QAAO;AAGnB,UAAK,KAAK,IAAI,IAAI,MAAM,gBAAiB,oBAAoB;AAC3D,eAAO;AAAA,MACT;AAEA,aAAO,MAAM;AAAA,IACf,UAAE;AACA,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAyC;AAC7C,UAAM,UAAU,MAAM,YAAY,KAAK,QAAQ;AAC/C,QAAI;AACF,YAAM,OAAO,MAAM,iBAAiB,KAAK,YAAY;AACrD,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,gBAA0B,CAAC;AAEjC,iBAAW,CAAC,SAAS,KAAK,KAAK,KAAK,WAAW;AAC7C,YAAI,MAAM,aAAc,MAAM,MAAM,gBAAiB,oBAAoB;AACvE,wBAAc,KAAK,MAAM,GAAG;AAAA,QAC9B;AAAA,MACF;AAEA,aAAO;AAAA,IACT,UAAE;AACA,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAKH;AACD,UAAM,UAAU,MAAM,YAAY,KAAK,QAAQ;AAC/C,QAAI;AACF,YAAM,OAAO,MAAM,iBAAiB,KAAK,YAAY;AACrD,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,YAAY,oBAAI,IAAsC;AAC5D,UAAI,iBAAiB;AACrB,UAAI,aAAa;AAEjB,iBAAW,CAAC,SAAS,KAAK,KAAK,KAAK,WAAW;AAC7C,cAAM,kBAAkB,UAAU,IAAI,MAAM,UAAU,KAAK,CAAC;AAC5D,wBAAgB,KAAK,KAAK;AAC1B,kBAAU,IAAI,MAAM,YAAY,eAAe;AAE/C,YAAI,MAAM,UAAW;AACrB,YAAK,MAAM,MAAM,gBAAiB,mBAAoB;AAAA,MACxD;AAEA,aAAO;AAAA,QACL;AAAA,QACA,gBAAgB,KAAK,UAAU;AAAA,QAC/B;AAAA,QACA;AAAA,MACF;AAAA,IACF,UAAE;AACA,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAwB;AACtB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,KAA+B;AACnD,UAAM,gBAAgB,MAAM,KAAK,oBAAoB;AACrD,WAAO,cAAc,SAAS,GAAG;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAoB,SAAgC;AACxD,UAAM,UAAU,MAAM,YAAY,KAAK,QAAQ;AAC/C,QAAI;AACF,YAAM,OAAO,MAAM,iBAAiB,KAAK,YAAY;AACrD,UAAI,CAAC,KAAK,kBAAkB,SAAS,OAAO,GAAG;AAC7C,aAAK,kBAAkB,KAAK,OAAO;AACnC,cAAM,kBAAkB,KAAK,cAAc,IAAI;AAAA,MACjD;AAAA,IACF,UAAE;AACA,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AACF;AAGA,IAAI;AAEG,SAAS,+BAA0D;AACxE,MAAI,CAAC,qBAAqB;AACxB,0BAAsB,IAAI,0BAA0B;AAAA,EACtD;AACA,SAAO;AACT;;;ADznBA,IAAM,QAAW,aAAS,MAAM;AAYhC,eAAsB,qBACpB,KACA,MAC8B;AAC9B,MAAI,CAAC,IAAK,QAAO,EAAE,SAAS,MAAM;AAElC,QAAM,WAAW,IAAI,YAAY,EAAE,KAAK;AACxC,QAAM,cAAc,CAAC,UAAU,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAG5E,MAAI,OAAO;AAET,QAAI,aAAa,cAAc,aAAa,gBAAgB;AAC1D,YAAM,WAAW,KAAK,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,QAAQ,EAAE,YAAY,MAAM,IAAI;AACtF,YAAM,SAAS,WAAW,UAAU;AAGpC,eAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,cAAM,IAAI,KAAK,CAAC;AAChB,YAAI,EAAE,YAAY,MAAM,SAAS,EAAE,YAAY,MAAM,OAAO;AAC1D,gBAAM,UAAU,KAAK,IAAI,CAAC;AAC1B,cAAI,SAAS;AACX,kBAAM,SAAS,MAAM,gBAAgB,EAAE,MAAM,SAAS,QAAQ,KAAK,YAAY,CAAC;AAChF,gBAAI,OAAO,QAAS,QAAO;AAAA,UAC7B;AAAA,QACF;AAAA,MACF;AAEA,eAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,cAAM,IAAI,KAAK,CAAC;AAChB,YAAI,EAAE,YAAY,MAAM,UAAU,EAAE,YAAY,MAAM,QAAQ;AAC5D,gBAAM,SAAS,KAAK,IAAI,CAAC;AACzB,cAAI,UAAU,QAAQ,KAAK,MAAM,GAAG;AAClC,kBAAM,SAAS,MAAM,gBAAgB;AAAA,cACnC,KAAK,SAAS,QAAQ,EAAE;AAAA,cACxB;AAAA,cACA,KAAK;AAAA,YACP,CAAC;AACD,gBAAI,OAAO,QAAS,QAAO;AAAA,UAC7B;AAAA,QACF;AAAA,MACF;AAGA,eAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,cAAM,IAAI,KAAK,CAAC;AAChB,YAAI,EAAE,YAAY,MAAM,SAAS,EAAE,YAAY,MAAM,OAAO;AAC1D,gBAAM,YAAY,KAAK,IAAI,CAAC;AAC5B,cAAI,WAAW;AACb,kBAAM,YAAY,UAAU,MAAM,+BAA+B;AACjE,gBAAI,YAAY,CAAC,GAAG;AAClB,oBAAM,SAAS,MAAM,gBAAgB,EAAE,MAAM,UAAU,CAAC,GAAG,QAAQ,KAAK,YAAY,CAAC;AACrF,kBAAI,OAAO,QAAS,QAAO;AAAA,YAC7B;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAGA,aAAO,EAAE,SAAS,MAAM;AAAA,IAC1B;AAKA,QACE,aAAa,gBACb,aAAa,oBACb,aAAa,UACb,aAAa,cACb,aAAa,SACb,aAAa,WACb;AACA,YAAM,iBAAiB,KAAK,UAAU,CAAC,QAAQ;AAC7C,cAAM,QAAQ,IAAI,YAAY;AAC9B,eAAO,UAAU,QAAQ,UAAU,cAAc,UAAU;AAAA,MAC7D,CAAC;AACD,UAAI,kBAAkB,GAAG;AACvB,cAAM,cAAc,qBAAqB,KAAK,MAAM,iBAAiB,CAAC,EAAE,KAAK,GAAG,CAAC;AACjF,cAAM,eAAe,YAAY,CAAC;AAClC,YAAI,cAAc;AAChB,gBAAM,SAAS,MAAM,qBAAqB,cAAc,YAAY,MAAM,CAAC,CAAC;AAC5E,cAAI,OAAO,QAAS,QAAO;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAGA,QAAI,aAAa,kBAAkB,aAAa,QAAQ;AACtD,eAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,cAAM,IAAI,KAAK,CAAC;AAEhB,YAAI,MAAM,WAAW,MAAM,MAAM;AAC/B,gBAAM,UAAU,KAAK,IAAI,CAAC,GAAG,QAAQ,gBAAgB,EAAE;AACvD,cAAI,SAAS;AACX,kBAAM,SAAS,MAAM,gBAAgB;AAAA,cACnC,MAAM;AAAA,cACN,QAAQ;AAAA,cACR,KAAK;AAAA,YACP,CAAC;AACD,gBAAI,OAAO,QAAS,QAAO;AAAA,UAC7B;AAAA,QACF;AAEA,YAAI,MAAM,SAAS,MAAM,UAAU,MAAM,QAAQ;AAC/C,gBAAM,SAAS,KAAK,IAAI,CAAC;AACzB,cAAI,UAAU,QAAQ,KAAK,MAAM,GAAG;AAClC,kBAAM,SAAS,MAAM,gBAAgB;AAAA,cACnC,KAAK,SAAS,QAAQ,EAAE;AAAA,cACxB,QAAQ;AAAA,cACR,KAAK;AAAA,YACP,CAAC;AACD,gBAAI,OAAO,QAAS,QAAO;AAAA,UAC7B;AAAA,QACF;AAAA,MACF;AAEA,YAAM,eAAe,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AACxD,UAAI,cAAc;AAChB,cAAM,OAAO,aAAa,QAAQ,gBAAgB,EAAE;AAEpD,cAAM,SAAS,MAAM,gBAAgB,EAAE,MAAM,QAAQ,QAAQ,KAAK,YAAY,CAAC;AAC/E,YAAI,OAAO,QAAS,QAAO;AAAA,MAC7B;AAAA,IACF;AAGA,QAAI,aAAa,UAAU,aAAa,YAAY;AAClD,YAAM,SAAS,KAAK,KAAK,GAAG,EAAE,YAAY;AAC1C,UAAI,cAAc,KAAK,MAAM,KAAK,aAAa,KAAK,MAAM,GAAG;AAE3D,cAAM,YAAY,OAAO,MAAM,0BAA0B;AACzD,YAAI,YAAY,CAAC,GAAG;AAClB,gBAAM,SAAS,MAAM,gBAAgB;AAAA,YACnC,MAAM,UAAU,CAAC,EAAE,KAAK;AAAA,YACxB,QAAQ;AAAA,YACR,KAAK;AAAA,UACP,CAAC;AACD,cAAI,OAAO,QAAS,QAAO;AAAA,QAC7B;AAEA,eAAO;AAAA,UACL,SAAS;AAAA,UACT,QACE;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAGA,QAAI,aAAa,UAAU,aAAa,YAAY;AAClD,UAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,QAAQ,GAAG;AAClD,cAAM,UAAU,KAAK,QAAQ,IAAI,MAAM,KAAK,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,QAAQ;AACtF,cAAM,WAAW,KAAK,UAAU,CAAC,KAAK;AACtC,YAAI,uBAAuB,KAAK,QAAQ,GAAG;AAEzC,gBAAM,WAAW,SAAS,MAAM,4BAA4B;AAC5D,cAAI,WAAW,CAAC,GAAG;AACjB,kBAAM,MAAM,SAAS,SAAS,CAAC,GAAG,EAAE;AACpC,kBAAM,SAAS,MAAM,gBAAgB,EAAE,KAAK,QAAQ,WAAW,KAAK,YAAY,CAAC;AACjF,gBAAI,OAAO,QAAS,QAAO;AAAA,UAC7B;AAEA,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,QACE;AAAA,UACJ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AAGL,QAAI,aAAa,QAAQ;AACvB,iBAAW,KAAK,MAAM;AAEpB,cAAM,MAAM,EAAE,QAAQ,MAAM,EAAE;AAC9B,YAAI,QAAQ,KAAK,GAAG,GAAG;AACrB,gBAAM,MAAM,SAAS,KAAK,EAAE;AAC5B,gBAAM,SAAS,MAAM,gBAAgB,EAAE,KAAK,QAAQ,WAAW,KAAK,YAAY,CAAC;AACjF,cAAI,OAAO,QAAS,QAAO;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AACA,QAAI,aAAa,WAAW,aAAa,WAAW;AAClD,YAAM,eAAe,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AACxD,UAAI,cAAc;AAChB,cAAM,SAAS,MAAM,gBAAgB;AAAA,UACnC,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,KAAK;AAAA,QACP,CAAC;AACD,YAAI,OAAO,QAAS,QAAO;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,MAAM;AAC1B;AAKA,SAAS,qBAAqB,SAA2B;AACvD,QAAM,SAAmB,CAAC;AAC1B,MAAI,UAAU;AACd,MAAI,QAA0B;AAE9B,aAAW,QAAQ,QAAQ,KAAK,GAAG;AACjC,QAAI,OAAO;AACT,UAAI,SAAS,MAAO,SAAQ;AAAA,UACvB,YAAW;AAChB;AAAA,IACF;AACA,QAAI,SAAS,OAAO,SAAS,KAAK;AAChC,cAAQ;AAAA,IACV,WAAW,KAAK,KAAK,IAAI,GAAG;AAC1B,UAAI,SAAS;AACX,eAAO,KAAK,OAAO;AACnB,kBAAU;AAAA,MACZ;AAAA,IACF,OAAO;AACL,iBAAW;AAAA,IACb;AAAA,EACF;AAEA,MAAI,QAAS,QAAO,KAAK,OAAO;AAChC,SAAO;AACT;AAaA,eAAe,gBAAgB,QAAkD;AAC/E,QAAM,WAAW,6BAA6B;AAG9C,MAAI,OAAO,QAAQ,QAAW;AAC5B,UAAM,UAAU,MAAM,SAAS,gBAAgB,OAAO,GAAG;AACzD,QAAI,SAAS;AACX,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,iBAAiB,OAAO,MAAM,QAAQ,OAAO,GAAG,4CAA4C,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC;AAAA,MAC7H;AAAA,IACF;AAEA,QAAI,OAAO,QAAQ,QAAQ,KAAK;AAC9B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AACA,QAAI,OAAO,QAAQ,QAAQ,MAAM;AAC/B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AACA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AAGA,MAAI,OAAO,MAAM;AACf,UAAM,YAAY,OAAO,KAAK,YAAY,EAAE,QAAQ,UAAU,EAAE;AAGhE,QAAI,UAAU,SAAS,YAAY,GAAG;AACpC,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,iBAAiB,OAAO,MAAM,KAAK,OAAO,IAAI;AAAA,MACxD;AAAA,IACF;AAMA,UAAM,eACH,eAAS,QAAQ,QAAQ,EACzB,YAAY,EACZ,QAAQ,UAAU,EAAE;AACvB,UAAM,qBAAqB,cAAc,UAAU,UAAU,WAAW,MAAM;AAC9E,QAAI,sBAAsB,iBAAiB,QAAQ;AACjD,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,iBAAiB,OAAO,MAAM,KAAK,OAAO,IAAI;AAAA,MACxD;AAAA,IACF;AAIA,UAAM,gBAAgB,MAAM,SAAS,oBAAoB;AACzD,QAAI,cAAc,SAAS,KAAK,oBAAoB;AAClD,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,iBAAiB,OAAO,MAAM,KAAK,OAAO,IAAI;AAAA,MACxD;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AAEA,SAAO,EAAE,SAAS,MAAM;AAC1B;;;ATxUA,IAAMC,SAAQ,QAAQ,aAAa;AAWnC,IAAM,2BAAgD,oBAAI,IAAI;AAAA;AAAA,EAE5D;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAC7C;AAAA,EAAY;AAAA,EAAO;AAAA,EAAO;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAU;AAAA,EACvD;AAAA,EAAS;AAAA,EAAU;AAAA,EAAY;AAAA,EAAS;AAAA,EAAM;AAAA,EAAW;AAAA,EACzD;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAc;AAAA;AAAA,EAEzC;AAAA;AAAA,EAEA;AAAA,EAAS;AAAA;AAAA,EAET;AAAA;AAAA,EAEA;AAAA,EAAU;AAAA,EAAW;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAQ;AAAA,EACtD;AAAA,EAAM;AAAA,EAAO;AAAA,EAAU;AAAA,EAAS;AAAA;AAAA,EAEhC;AAAA,EAAQ;AAAA,EAAO;AAAA;AAAA,EAEf;AAAA,EAAO;AAAA,EAAY;AAAA;AAAA,EAEnB;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAO;AAAA,EAAU;AAAA;AAAA,EAElC;AAAA;AAAA,EAEA;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAY;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AAAA;AAAA,EAErE;AAAA,EAAU;AAAA,EAAU;AAAA;AAAA,EAEpB;AAAA,EAAQ;AAAA;AAAA,EAER;AAAA,EAAO;AAAA,EAAM;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAQ;AAAA,EAAM;AAAA,EACxD;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAS;AAAA,EAAM;AAAA,EAAM;AAAA,EAC3D;AAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMT;AAAA,EACA;AAAA,EAAS;AAAA,EAAY;AAAA,EAAc;AAAA,EAAQ;AAAA,EAC3C;AAAA,EAAW;AAAA,EAAY;AAAA,EAAY;AAAA,EAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ9C;AAAA,EAAO;AAAA,EAAW;AAAA,EAAc;AAAA,EAAkB;AAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1D;AAAA,EAAM;AAAA,EAAO;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAS;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAO;AAAA;AAAA,EAErF;AAAA,EAAO;AAAA,EAAY;AAAA;AAAA,EAEnB;AAAA,EAAW;AAAA,EAAoB;AAAA,EAAiB;AAAA,EAAgB;AAAA,EAAkB;AAAA;AAAA,EAElF;AAAA,EAAO;AAAA,EAAa;AAAA,EAAY;AAAA,EAAM;AAAA,EAAU;AAAA,EAAU;AAAA,EAAU;AAAA,EAAS;AAAA;AAAA,EAE7E;AAAA,EAAW;AAAA,EAAgB;AAAA,EAAc;AAAA,EAAU;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAW;AAAA;AAAA,EAE5I;AAAA,EAAW;AAAA,EAAU;AAAA,EAAW;AAAA,EAAU;AAAA,EAAM;AAAA;AAAA,EAEhD;AAAA,EAAS;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAO;AAAA,EAAM;AAAA,EAAO;AAAA;AAAA,EAEzD;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAU;AAAA;AAAA,EAE5C;AAAA,EAAY;AAAA,EAAY;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAW;AAAA,EAAM;AAAA;AAAA,EAEzE;AAAA,EAAO;AAAA,EAAW;AAAA,EAAc;AAAA,EAAe;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAa;AAAA,EAAW;AAAA,EAAQ;AAAA;AAAA,EAEtH;AAAA,EAAS;AAAA,EAAS;AAAA,EAAM;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAM;AAAA,EAAU;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA;AAAA,EAExF;AAAA,EAAe;AAAA,EAAW;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAa;AAAA,EAAY;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAQ;AAAA,EAAO;AAAA,EAChH;AAAA,EAAkB;AAAA,EAAW;AAAA,EAAU;AAAA,EAAW;AAAA,EAAO;AAAA;AAAA,EAEzD;AAAA,EAAW;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAc;AAAA,EAAS;AAAA,EAAc;AAAA,EAAa;AAAA,EAAW;AAAA,EACrG;AAAA,EAAa;AAAA,EAAgB;AAAA,EAAa;AAAA,EAAW;AAAA,EAAU;AAAA,EAAS;AAAA,EACxE;AAAA,EAAW;AAAA,EAAS;AAAA,EAAe;AAAA,EAAe;AAAA,EAAa;AAAA;AAAA,EAE/D;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAU;AAAA,EAAO;AAAA,EAAO;AAAA;AAAA,EAExE;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAW;AAAA,EAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxC;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAO;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAY;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAM;AAAA,EAAM;AAAA,EAAU;AAAA,EACzG;AAAA,EAAO;AAAA,EAAM;AAAA,EAAS;AAAA,EAAU;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAK;AAAA,EAC5F;AAAA,EACA;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAS;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAM;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAM;AAAA,EACpH;AAAA,EAAU;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAU;AAAA,EAAK;AAAA,EAAS;AAAA,EACzG;AAAA,EAAO;AAAA,EAAS;AAAA,EAAU;AAAA,EAAY;AAAA,EAAW;AAAA,EAAW;AAAA,EAAS;AAAA,EAAQ;AAAA;AAAA,EAE7E;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAS;AAAA,EAAW;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAU;AAAA,EAAW;AAAA,EAAU;AAAA,EAAU;AAAA,EAAU;AAAA,EACpI;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAM;AAAA,EAAS;AAAA,EAAU;AAAA,EAAS;AAAA,EAChD;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAM;AAAA;AAAA,EAEpD;AAAA,EAAM;AAAA,EAAM;AAAA,EAAS;AAAA,EAAO;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAU;AAAA,EAAO;AAAA,EAAa;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAM;AAAA,EAAQ;AAAA;AAAA,EAEhI;AAAA,EAAU;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAa;AAAA,EAAa;AAAA,EAAa;AAAA;AAAA,EAEnE;AAAA,EAAW;AAAA,EAAW;AAAA,EAAW;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAW;AAAA,EAAW;AAAA,EAAU;AAAA;AAAA,EAEhI;AAAA,EAAW;AAAA,EAAU;AAAA;AAAA,EAErB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAiB;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAS;AAAA,EAAS;AAAA,EAAM;AAAA,EAAS;AAAA,EAAO;AAAA,EAAM;AAAA,EAAM;AAAA;AAAA,EAEpI;AAAA,EAAa;AAAA,EAAU;AAAA,EAAgB;AAAA,EAAU;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAS;AAAA;AAAA,EAErF;AAAA,EAAM;AAAA,EAAM;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAU;AAAA,EAAK;AAAA,EAAW;AAAA,EAAS;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAS;AAAA;AAAA,EAEjH;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAU;AAAA,EAAS;AAAA,EAAW;AAAA,EACvD;AAAA,EAAO;AAAA,EAAU;AAAA,EAAU;AAAA,EAAU;AAAA,EAAU;AAAA,EAC/C;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAS;AAAA,EACzB;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAU;AAAA,EAAY;AAAA;AAAA,EAEvC;AAAA,EAAY;AAAA,EAAoB;AAAA,EAAkB;AAAA,EAAgB;AAAA,EAAO;AAAA,EAAW;AAAA,EACpF;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAa;AAAA;AAAA,EAEzC;AAAA,EAAU;AAAA,EAAa;AAAA,EAAY;AAAA,EAAU;AAAA,EAAU;AAAA;AAAA,EAEvD;AAAA,EAAU;AAAA,EAAc;AAAA,EAAe;AAAA,EAAiB;AAAA,EAAU;AAAA,EAAO;AAAA,EAAY;AAAA,EAAiB;AAAA,EAAS;AAAA;AAAA,EAE/G;AAAA,EAAW;AAAA,EAAe;AAAA,EAAW;AAAA,EAAW;AAAA;AAAA,EAEhD;AAAA,EAAU;AAAA,EAAY;AAAA,EAAW;AAAA;AAAA,EAEjC;AAAA,EAAS;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAa;AAAA,EAAoB;AAAA;AAAA,EAE/D;AAAA,EAAS;AAAA,EAAgB;AAAA,EAAM;AAAA,EAAM;AAAA,EAAO;AAAA,EAAW;AAAA,EAAS;AAAA,EAAU;AAAA,EAAe;AAAA;AAAA,EAEzF;AAAA,EAAW;AAAA,EAAe;AAAA,EAAS;AAAA,EAAY;AAAA,EAAS;AAAA,EAAW;AAAA;AAAA,EAEnE;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAS;AAAA,EAAa;AAAA,EAAS;AAAA,EAAU;AAAA,EAAS;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAe;AAAA,EAAa;AAAA,EAAO;AAAA,EAAe;AAAA,EAAY;AAAA,EAAO;AAAA,EAAW;AAAA,EAAW;AAChM,CAAC;AAID,IAAI,kBAA+B,IAAI,IAAI,wBAAwB;AAEnE,IAAM,eAAe,CAAC,MAAsB,EAAE,KAAK;AAW5C,SAAS,oBAAoB,OAAwF,CAAC,GAAS;AACpI,QAAM,OAAO,IAAI,IAAI,wBAAwB;AAC7C,aAAW,KAAK,KAAK,SAAS,CAAC,GAAG;AAChC,UAAM,IAAI,aAAa,CAAC;AACxB,QAAI,EAAG,MAAK,IAAI,CAAC;AAAA,EACnB;AACA,aAAW,KAAK,KAAK,QAAQ,CAAC,EAAG,MAAK,OAAO,aAAa,CAAC,CAAC;AAC5D,oBAAkB;AACpB;AAGO,SAAS,kBAAwB;AACtC,oBAAkB,IAAI,IAAI,wBAAwB;AACpD;AAgBA,IAAI,eAAoC,oBAAI,IAAI;AAQzC,SAAS,sBAAsB,OAAmD,CAAC,GAAS;AACjG,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,MAAM,KAAK,UAAU,CAAC,GAAG;AAClC,UAAM,UAAU,GAAG,KAAK;AACxB,QAAI,QAAS,MAAK,IAAI,OAAO;AAAA,EAC/B;AACA,iBAAe;AACjB;AAGO,SAAS,oBAA0B;AACxC,iBAAe,oBAAI,IAAI;AACzB;AAOO,SAAS,kBAAuC;AACrD,SAAO;AACT;AAGO,SAAS,qBAAqB,KAAsB;AACzD,SAAO,gBAAgB,IAAI,aAAa,GAAG,CAAC;AAC9C;AAGO,SAAS,mBAA6B;AAC3C,SAAO,CAAC,GAAG,eAAe,EAAE,KAAK;AACnC;AAEA,IAAM,WAAW;AAKjB,IAAM,aAAa;AACnB,IAAM,qBAAqB;AAM3B,IAAM,uBAAiD;AAAA,EACrD,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKT,KAAK;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,MAAM,CAAC;AAAA,EACP,IAAI,CAAC;AAAA,EACL,KAAK,CAAC;AAAA,EACN,QAAQ,CAAC;AAAA;AAAA,EAET,MAAM,CAAC,WAAW,YAAY,SAAS,UAAU,cAAc,eAAe,WAAW,SAAS,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9G,IAAI,CAAC,OAAO,mBAAmB,QAAQ,OAAO,QAAQ,UAAU,OAAO,OAAO,SAAS,MAAM;AAAA;AAAA;AAAA,EAG7F,KAAK,CAAC;AAAA,EACN,MAAM,CAAC;AAAA,EACP,KAAK,CAAC;AACR;AAKA,IAAM,sBAA2D;AAAA,EAC/D,QAAQ,oBAAI,IAAI,CAAC,MAAM,CAAC;AAAA,EACxB,QAAQ,oBAAI,IAAI,CAAC,MAAM,CAAC;AAAA,EACxB,KAAK,oBAAI,IAAI,CAAC,WAAW,QAAQ,CAAC;AAAA,EAClC,MAAM,oBAAI,IAAI,CAAC,WAAW,QAAQ,CAAC;AAAA,EACnC,MAAM,oBAAI,IAAI,CAAC,SAAS,CAAC;AAC3B;AAEA,IAAM,+BAA+E;AAAA,EACnF,MAAM,CAAC,CAAC,OAAO,SAAS,CAAC;AAC3B;AAEA,SAAS,gBAAgB,MAA+B;AACtD,aAAW,OAAO,MAAM;AACtB,QAAI,QAAQ,KAAM,QAAO;AACzB,QAAI,CAAC,IAAI,WAAW,GAAG,EAAG,QAAO;AAAA,EACnC;AACA,SAAO;AACT;AAEA,SAAS,eAAe,MAA0B;AAChD,QAAM,MAAgB,CAAC;AACvB,aAAW,OAAO,MAAM;AACtB,QAAI,QAAQ,KAAM;AAClB,QAAI,CAAC,IAAI,WAAW,GAAG,EAAG,KAAI,KAAK,GAAG;AAAA,EACxC;AACA,SAAO;AACT;AAEA,SAAS,aAAa,KAAa,MAA+B;AAChE,QAAM,qBAAqB,oBAAoB,GAAG;AAClD,QAAM,aAAa,gBAAgB,IAAI;AACvC,MAAI,sBAAsB,cAAc,mBAAmB,IAAI,UAAU,GAAG;AAC1E,WAAO,uBAAuB,UAAU,kBAAkB,GAAG;AAAA,EAC/D;AAEA,QAAM,mBAAmB,6BAA6B,GAAG;AACzD,MAAI,kBAAkB;AACpB,UAAM,SAAS,eAAe,IAAI;AAClC,UAAMC,WAAU,iBAAiB,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,QAAQ,OAAO,GAAG,MAAM,IAAI,CAAC;AAC7F,QAAIA,SAAS,QAAO,uBAAuBA,SAAQ,KAAK,GAAG,CAAC,kBAAkB,GAAG;AAAA,EACnF;AAEA,QAAM,UAAU,qBAAqB,GAAG;AACxC,MAAI,CAAC,QAAS,QAAO;AAErB,aAAW,OAAO,MAAM;AACtB,eAAW,WAAW,SAAS;AAC7B,UAAI,QAAQ,KAAK,GAAG,GAAG;AACrB,eAAO,qBAAqB,GAAG,kBAAkB,GAAG,+BAA+B,OAAO;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AA8BA,IAAM,cAAgC,EAAE,OAAO,QAAQ,SAAS,CAAC,EAAE;AAE5D,IAAM,WAAwC;AAAA,EACnD,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aACE;AAAA,EAGF,WACE;AAAA,EAOF,WAAW;AAAA,IACT,cAAc;AAAA,IACd,YAAY,CAAC,MAAM;AAAA,EACrB;AAAA,EACA,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,UAAU;AAAA,EACV,WAAW;AAAA,EACX,cAAc,CAAC,kBAAkB;AAAA,EACjC,MAAM;AAAA,EACN,aAAa;AAAA,IACX,MAAM;AAAA,IACN,YAAY;AAAA,MACV,SAAS;AAAA,QACP,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,MAAM;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,MAAM,SAAS;AAAA,QACxB,aAAa;AAAA,MACf;AAAA,MACA,KAAK;AAAA,QACH,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,SAAS;AAAA,QACP,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,UAAU,CAAC,SAAS;AAAA,EACtB;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK,MAAM;AAC9B,UAAM,WAAW,mBAAmB;AACpC,QAAI,CAAC,SAAS,YAAY;AACxB,aAAO;AAAA,QACL,SAAS,MAAM;AAAA,QACf,MAAM,MAAM,QAAQ,CAAC;AAAA,QACrB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,WAAW;AAAA,QACX,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,UAAM,MAAM,MAAM,QAAQ,KAAK;AAC/B,QAAI,CAAC;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,MAAM,CAAC;AAAA,QACP,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,WAAW;AAAA,QACX,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAEF,QAAI,CAAC,qBAAqB,GAAG,GAAG;AAC9B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,MAAM,MAAM,QAAQ,CAAC;AAAA,QACrB,QAAQ;AAAA,QACR,QACE,YAAY,GAAG,8IAE0B,GAAG;AAAA,QAE9C,UAAU;AAAA,QACV,WAAW;AAAA,QACX,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,UAAM,QAAQ,MAAM,QAAQ,CAAC,GAAG,MAAM,GAAG,QAAQ;AACjD,UAAM,UAAU,KAAK,IAAI,GAAG,KAAK,IAAI,MAAM,WAAW,oBAAoB,kBAAkB,CAAC;AAO7F,UAAM,SAA2B,aAAa,KAAK,MAAM,YAAY;AAIrE,UAAM,YAAY,MAAM,qBAAqB,KAAK,IAAI;AACtD,QAAI,UAAU,SAAS;AACrB,aAAO;AAAA,QACL,SAAS;AAAA,QACT;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,UAAU,UAAU;AAAA,QAC5B,UAAU;AAAA,QACV,WAAW;AAAA,QACX,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAGA,UAAM,WAAW,aAAa,KAAK,IAAI;AACvC,QAAI,UAAU;AACZ,aAAO;AAAA,QACL,SAAS;AAAA,QACT;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,WAAW;AAAA,QACX,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AAGF,YAAM,MAAM,MAAM,MAAM,gBAAgB,MAAM,KAAK,GAAG,IAAI,MAAM,gBAAgB,IAAI,KAAK,GAAG;AAAA,IAC9F,QAAQ;AACN,aAAO;AAAA,QACL,SAAS;AAAA,QACT;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,QAAQ,MAAM,OAAO,IAAI,GAAG;AAAA,QACpC,UAAU;AAAA,QACV,WAAW;AAAA,QACX,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,KAAK;AAEpB,WAAO,WAAW,KAAK,MAAM,KAAK,SAAS,QAAQ,IAAI,SAAS,IAAI,MAAM;AAAA,EAC5E;AACF;AAEA,SAAS,WACP,KACA,MACA,KACA,SACA,QACA,WACA,QACqB;AACrB,SAAO,IAAI,QAAQ,CAACC,aAAY;AAC9B,QAAI,SAAS;AACb,QAAI,SAAS;AACb,QAAI,SAAS;AACb,UAAM,eAAe,EAAE,OAAO,MAAM;AACpC,UAAM,SAAS,CAAC,WAA6B;AAK3C,UAAI,aAAa,MAAO;AACxB,mBAAa,QAAQ;AACrB,MAAAA,SAAQ,MAAM;AAAA,IAChB;AACA,UAAM,YAAY,KAAK,IAAI;AAC3B,QAAI,cAAc;AAClB,QAAI,cAAc;AAClB,QAAI,qBAAqB;AACzB,QAAI,WAAW;AAIf,UAAM,QAAQ,kBAAkB,EAAE,MAAM,QAAQ,GAAG,IAAI,gBAAgB,WAAW,CAAC;AAKnF,UAAM,WAAW,oBAAoB,GAAG;AACxC,UAAM,aAAaF,WAAU,SAAS,SAAS,MAAM,KAAK,SAAS,SAAS,MAAM;AAClF,UAAM,OAAO,aAAa,4BAA4B,UAAU,IAAI,IAAI;AACxE,UAAM,WAAW,MAAM,WAAW;AAClC,UAAM,YAAY,MAAM,QAAQ;AAEhC,UAAM,oBAAoB,CACxB,UACAG,MACAC,YACS;AACT,UAAI,mBAAoB;AACxB,2BAAqB;AACrB,2BAAqB;AAAA,QACnB,GAAID,SAAQ,SAAY,EAAE,KAAAA,KAAI,IAAI,CAAC;AAAA,QACnC;AAAA,QACA,GAAIC,UAAS,EAAE,QAAAA,QAAO,IAAI,CAAC;AAAA,QAC3B,YAAY,KAAK,IAAI,IAAI;AAAA,QACzB;AAAA,QACA;AAAA,QACA;AAAA,QACA,UAAS,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,CAAC;AAAA,IACH;AAQA,QAAI;AACJ,QAAI;AAKF,cAAQC,OAAM,UAAU,WAAW;AAAA,QACjC;AAAA,QACA,KAAK,cAAc,SAAS;AAAA,QAC5B,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,QAChC,aAAa;AAAA,QACb,GAAIL,SAAQ,CAAC,IAAI,EAAE,OAAO;AAAA,QAC1B,GAAI,OAAO,EAAE,0BAA0B,KAAK,yBAAyB,IAAI,CAAC;AAAA,MAC5E,CAAC;AAAA,IACH,SAAS,KAAK;AAMZ,YAAM,SAAS;AACf,yBAAmB;AAAA,QACjB,WAAW,QAAQ;AAAA,QACnB,SAAS,cAAc,GAAG,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,EAAE;AAAA,QACjD,MAAM,cAAc,KAAK,KAAK,GAAG,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA,QAC7D;AAAA,QACA,YAAY;AAAA,QACZ,WAAW,IAAI,KAAK,SAAS,EAAE,YAAY;AAAA,MAC7C,CAAC;AACD,wBAAkB,GAAG,MAAS;AAC9B,aAAO;AAAA,QACL,SAAS;AAAA,QACT;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,iBAAiBM,gBAAe,GAAG,CAAC;AAAA,QAC5C,UAAU;AAAA,QACV,WAAW;AAAA,QACX,SAAS;AAAA,QACT;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAEA,uBAAmB;AAAA,MACjB,GAAI,MAAM,QAAQ,SAAY,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,MACpD,WAAW,QAAQ;AAAA,MACnB,SAAS,cAAc,GAAG,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,EAAE;AAAA,MACjD,MAAM,cAAc,KAAK,KAAK,GAAG,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA,MAC7D;AAAA,MACA,YAAY;AAAA,MACZ,WAAW,IAAI,KAAK,SAAS,EAAE,YAAY;AAAA,IAC7C,CAAC;AASD,UAAM,GAAG,SAAS,CAAC,QAAQ;AAKzB,YAAM,UAAU,OAAQ,IAA8B,SAAS;AAC/D,YAAM,aAAa,UAAU,YAAY,IAAI,OAAO,KAAK,IAAI;AAC7D,mBAAa,KAAK;AAClB,UAAIN,OAAO,QAAO,oBAAoB,SAAS,OAAO;AACtD,UAAI,OAAO,QAAQ,SAAU,UAAS,WAAW,GAAG;AACpD,eAAS,UAAU,KAAK,IAAI,IAAI,WAAW,IAAI;AAC/C,YAAM,SAAS;AACf,wBAAkB,UAAU,MAAM,GAAG,MAAM,KAAK,UAAU,UAAU,MAAS;AAC7E,aAAO;AAAA,QACL,SAAS;AAAA,QACT;AAAA,QACA,QAAQ,uBAAuB,MAAM;AAAA,QACrC,QAAQ;AAAA,QACR,UAAU,UAAU,MAAM;AAAA,QAC1B,WAAW,OAAO,WAAW,QAAQ,MAAM,IAAI;AAAA,QAC/C,SAAS;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,UAAM,WAAW,mBAAmB;AACpC,UAAM,MAAM,MAAM;AAClB,QAAI,OAAO,QAAQ,UAAU;AAC3B,YAAM,cAAc,GAAG,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC;AAC5C,eAAS,SAAS,EAAE,KAAK,MAAM,QAAQ,SAAS,cAAc,WAAW,GAAG,WAAW,KAAK,IAAI,GAAG,WAAW,MAAM,CAAC;AAAA,IACvH;AAEA,UAAM,QAAQ,WAAW,MAAM;AAC7B,eAAS;AACT,iBAAW;AACX,UAAI,OAAO,QAAQ,SAAU,UAAS,KAAK,GAAG;AAAA,UACzC,OAAM,KAAK,SAAS;AAAA,IAC3B,GAAG,OAAO;AAEV,UAAM,UAAU,MAAM;AACpB,eAAS;AACT,UAAI,OAAO,QAAQ,SAAU,UAAS,KAAK,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,UAC1D,OAAM,KAAK,SAAS;AAAA,IAC3B;AACA,QAAIA,QAAO;AACT,UAAI,OAAO,QAAS,SAAQ;AAAA,UACvB,QAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,IAC/D;AAEA,UAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB;AAC1C,YAAM,OAAO,MAAM,SAAS;AAC5B,qBAAe,MAAM;AACrB,wBAAkB,EAAE,KAAK,QAAQ,UAAU,MAAM,CAAC;AAClD,UAAI,OAAO,SAAS,WAAY,WAAU;AAC1C,YAAM,MAAM,IAAI;AAAA,IAClB,CAAC;AAED,UAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB;AAC1C,YAAM,OAAO,MAAM,SAAS;AAC5B,qBAAe,MAAM;AACrB,wBAAkB,EAAE,KAAK,QAAQ,UAAU,MAAM,CAAC;AAClD,UAAI,OAAO,SAAS,WAAY,WAAU;AAC1C,YAAM,MAAM,IAAI;AAAA,IAClB,CAAC;AAED,UAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,mBAAa,KAAK;AAClB,UAAIA,OAAO,QAAO,oBAAoB,SAAS,OAAO;AACtD,UAAI,OAAO,QAAQ,SAAU,UAAS,WAAW,GAAG;AACpD,YAAM,aAAa,KAAK,IAAI,IAAI;AAChC,YAAM,WAAW,SAAS,MAAO,QAAQ;AACzC,wBAAkB,UAAU,GAAG;AAC/B,eAAS,UAAU,YAAY,aAAa,CAAC;AAC7C,YAAM,UAAU,MAAM,SAAS;AAC/B,aAAO;AAAA,QACL,SAAS;AAAA,QACT;AAAA,QACA,QAAQ,uBAAuB,MAAM,KAAK,UAAU,UAAU,OAAO,IAAI;AAAA,QACzE,QAAQ,uBAAuB,MAAM;AAAA,QACrC;AAAA,QACA,WACE,OAAO,WAAW,QAAQ,MAAM,IAAI,4BACpC,OAAO,WAAW,QAAQ,MAAM,IAAI;AAAA,QACtC,SAAS;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH;",
-  "names": ["spawn", "toErrorMessage", "fsp", "path", "isWin", "path", "os", "path", "fs", "os", "wstackGlobalRoot", "path", "hostname", "wstackGlobalRoot", "isWin", "blocked", "resolve", "pid", "signal", "spawn", "toErrorMessage"]
-}

package/dist/fetch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAmB,MAAM,wBAAwB,CAAC;AA2BpE,UAAU,UAAU;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;CAClD;AAED,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAYD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEhE,eAAO,MAAM,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAuLnD,CAAC"}