@xelauvas/xela-cli 0.1.0

package/src/tools/WebFetchTool/prompt.ts

@@ -0,0 +1,46 @@
+export const WEB_FETCH_TOOL_NAME = 'WebFetch'
+
+export const DESCRIPTION = `
+- Fetches content from a specified URL and processes it using an AI model
+- Takes a URL and a prompt as input
+- Fetches the URL content, converts HTML to markdown
+- Processes the content with the prompt using a small, fast model
+- Returns the model's response about the content
+- Use this tool when you need to retrieve and analyze web content
+
+Usage notes:
+  - IMPORTANT: If an MCP-provided web fetch tool is available, prefer using that tool instead of this one, as it may have fewer restrictions.
+  - The URL must be a fully-formed valid URL
+  - HTTP URLs will be automatically upgraded to HTTPS
+  - The prompt should describe what information you want to extract from the page
+  - This tool is read-only and does not modify any files
+  - Results may be summarized if the content is very large
+  - Includes a self-cleaning 15-minute cache for faster responses when repeatedly accessing the same URL
+  - When a URL redirects to a different host, the tool will inform you and provide the redirect URL in a special format. You should then make a new WebFetch request with the redirect URL to fetch the content.
+  - For GitHub URLs, prefer using the gh CLI via Bash instead (e.g., gh pr view, gh issue view, gh api).
+`
+
+export function makeSecondaryModelPrompt(
+  markdownContent: string,
+  prompt: string,
+  isPreapprovedDomain: boolean,
+): string {
+  const guidelines = isPreapprovedDomain
+    ? `Provide a concise response based on the content above. Include relevant details, code examples, and documentation excerpts as needed.`
+    : `Provide a concise response based only on the content above. In your response:
+ - Enforce a strict 125-character maximum for quotes from any source document. Open Source Software is ok as long as we respect the license.
+ - Use quotation marks for exact language from articles; any language outside of the quotation should never be word-for-word the same.
+ - You are not a lawyer and never comment on the legality of your own prompts and responses.
+ - Never produce or reproduce exact song lyrics.`
+
+  return `
+Web page content:
+---
+${markdownContent}
+---
+
+${prompt}
+
+${guidelines}
+`
+}

package/src/tools/WebFetchTool/utils.ts

@@ -0,0 +1,530 @@
+import axios, { type AxiosResponse } from 'axios'
+import { LRUCache } from 'lru-cache'
+import {
+  type AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+  logEvent,
+} from '../../services/analytics/index.js'
+import { queryHaiku } from '../../services/api/claude.js'
+import { AbortError } from '../../utils/errors.js'
+import { getWebFetchUserAgent } from '../../utils/http.js'
+import { logError } from '../../utils/log.js'
+import {
+  isBinaryContentType,
+  persistBinaryContent,
+} from '../../utils/mcpOutputStorage.js'
+import { getSettings_DEPRECATED } from '../../utils/settings/settings.js'
+import { asSystemPrompt } from '../../utils/systemPromptType.js'
+import { isPreapprovedHost } from './preapproved.js'
+import { makeSecondaryModelPrompt } from './prompt.js'
+
+// Custom error classes for domain blocking
+class DomainBlockedError extends Error {
+  constructor(domain: string) {
+    super(`Claude Code is unable to fetch from ${domain}`)
+    this.name = 'DomainBlockedError'
+  }
+}
+
+class DomainCheckFailedError extends Error {
+  constructor(domain: string) {
+    super(
+      `Unable to verify if domain ${domain} is safe to fetch. This may be due to network restrictions or enterprise security policies blocking claude.ai.`,
+    )
+    this.name = 'DomainCheckFailedError'
+  }
+}
+
+class EgressBlockedError extends Error {
+  constructor(public readonly domain: string) {
+    super(
+      JSON.stringify({
+        error_type: 'EGRESS_BLOCKED',
+        domain,
+        message: `Access to ${domain} is blocked by the network egress proxy.`,
+      }),
+    )
+    this.name = 'EgressBlockedError'
+  }
+}
+
+// Cache for storing fetched URL content
+type CacheEntry = {
+  bytes: number
+  code: number
+  codeText: string
+  content: string
+  contentType: string
+  persistedPath?: string
+  persistedSize?: number
+}
+
+// Cache with 15-minute TTL and 50MB size limit
+// LRUCache handles automatic expiration and eviction
+const CACHE_TTL_MS = 15 * 60 * 1000 // 15 minutes
+const MAX_CACHE_SIZE_BYTES = 50 * 1024 * 1024 // 50MB
+
+const URL_CACHE = new LRUCache<string, CacheEntry>({
+  maxSize: MAX_CACHE_SIZE_BYTES,
+  ttl: CACHE_TTL_MS,
+})
+
+// Separate cache for preflight domain checks. URL_CACHE is URL-keyed, so
+// fetching two paths on the same domain triggers two identical preflight
+// HTTP round-trips to api.anthropic.com. This hostname-keyed cache avoids
+// that. Only 'allowed' is cached — blocked/failed re-check on next attempt.
+const DOMAIN_CHECK_CACHE = new LRUCache<string, true>({
+  max: 128,
+  ttl: 5 * 60 * 1000, // 5 minutes — shorter than URL_CACHE TTL
+})
+
+export function clearWebFetchCache(): void {
+  URL_CACHE.clear()
+  DOMAIN_CHECK_CACHE.clear()
+}
+
+// Lazy singleton — defers the turndown → @mixmark-io/domino import (~1.4MB
+// retained heap) until the first HTML fetch, and reuses one instance across
+// calls (construction builds 15 rule objects; .turndown() is stateless).
+// @types/turndown ships only `export =` (no .d.mts), so TS types the import
+// as the class itself while Bun wraps CJS in { default } — hence the cast.
+type TurndownCtor = typeof import('turndown')
+let turndownServicePromise: Promise<InstanceType<TurndownCtor>> | undefined
+function getTurndownService(): Promise<InstanceType<TurndownCtor>> {
+  return (turndownServicePromise ??= import('turndown').then(m => {
+    const Turndown = (m as unknown as { default: TurndownCtor }).default
+    return new Turndown()
+  }))
+}
+
+// PSR requested limiting the length of URLs to 250 to lower the potential
+// for a data exfiltration. However, this is too restrictive for some customers'
+// legitimate use cases, such as JWT-signed URLs (e.g., cloud service signed URLs)
+// that can be much longer. We already require user approval for each domain,
+// which provides a primary security boundary. In addition, Claude Code has
+// other data exfil channels, and this one does not seem relatively high risk,
+// so I'm removing that length restriction. -ab
+const MAX_URL_LENGTH = 2000
+
+// Per PSR:
+// "Implement resource consumption controls because setting limits on CPU,
+// memory, and network usage for the Web Fetch tool can prevent a single
+// request or user from overwhelming the system."
+const MAX_HTTP_CONTENT_LENGTH = 10 * 1024 * 1024
+
+// Timeout for the main HTTP fetch request (60 seconds).
+// Prevents hanging indefinitely on slow/unresponsive servers.
+const FETCH_TIMEOUT_MS = 60_000
+
+// Timeout for the domain blocklist preflight check (10 seconds).
+const DOMAIN_CHECK_TIMEOUT_MS = 10_000
+
+// Cap same-host redirect hops. Without this a malicious server can return
+// a redirect loop (/a → /b → /a …) and the per-request FETCH_TIMEOUT_MS
+// resets on every hop, hanging the tool until user interrupt. 10 matches
+// common client defaults (axios=5, follow-redirects=21, Chrome=20).
+const MAX_REDIRECTS = 10
+
+// Truncate to not spend too many tokens
+export const MAX_MARKDOWN_LENGTH = 100_000
+
+export function isPreapprovedUrl(url: string): boolean {
+  try {
+    const parsedUrl = new URL(url)
+    return isPreapprovedHost(parsedUrl.hostname, parsedUrl.pathname)
+  } catch {
+    return false
+  }
+}
+
+export function validateURL(url: string): boolean {
+  if (url.length > MAX_URL_LENGTH) {
+    return false
+  }
+
+  let parsed
+  try {
+    parsed = new URL(url)
+  } catch {
+    return false
+  }
+
+  // We don't need to check protocol here, as we'll upgrade http to https when making the request
+
+  // As long as we aren't supporting aiming to cookies or internal domains,
+  // we should block URLs with usernames/passwords too, even though these
+  // seem exceedingly unlikely.
+  if (parsed.username || parsed.password) {
+    return false
+  }
+
+  // Initial filter that this isn't a privileged, company-internal URL
+  // by checking that the hostname is publicly resolvable
+  const hostname = parsed.hostname
+  const parts = hostname.split('.')
+  if (parts.length < 2) {
+    return false
+  }
+
+  return true
+}
+
+type DomainCheckResult =
+  | { status: 'allowed' }
+  | { status: 'blocked' }
+  | { status: 'check_failed'; error: Error }
+
+export async function checkDomainBlocklist(
+  domain: string,
+): Promise<DomainCheckResult> {
+  if (DOMAIN_CHECK_CACHE.has(domain)) {
+    return { status: 'allowed' }
+  }
+  try {
+    const response = await axios.get(
+      `https://api.anthropic.com/api/web/domain_info?domain=${encodeURIComponent(domain)}`,
+      { timeout: DOMAIN_CHECK_TIMEOUT_MS },
+    )
+    if (response.status === 200) {
+      if (response.data.can_fetch === true) {
+        DOMAIN_CHECK_CACHE.set(domain, true)
+        return { status: 'allowed' }
+      }
+      return { status: 'blocked' }
+    }
+    // Non-200 status but didn't throw
+    return {
+      status: 'check_failed',
+      error: new Error(`Domain check returned status ${response.status}`),
+    }
+  } catch (e) {
+    logError(e)
+    return { status: 'check_failed', error: e as Error }
+  }
+}
+
+/**
+ * Check if a redirect is safe to follow
+ * Allows redirects that:
+ * - Add or remove "www." in the hostname
+ * - Keep the origin the same but change path/query params
+ * - Or both of the above
+ */
+export function isPermittedRedirect(
+  originalUrl: string,
+  redirectUrl: string,
+): boolean {
+  try {
+    const parsedOriginal = new URL(originalUrl)
+    const parsedRedirect = new URL(redirectUrl)
+
+    if (parsedRedirect.protocol !== parsedOriginal.protocol) {
+      return false
+    }
+
+    if (parsedRedirect.port !== parsedOriginal.port) {
+      return false
+    }
+
+    if (parsedRedirect.username || parsedRedirect.password) {
+      return false
+    }
+
+    // Now check hostname conditions
+    // 1. Adding www. is allowed: example.com -> www.example.com
+    // 2. Removing www. is allowed: www.example.com -> example.com
+    // 3. Same host (with or without www.) is allowed: paths can change
+    const stripWww = (hostname: string) => hostname.replace(/^www\./, '')
+    const originalHostWithoutWww = stripWww(parsedOriginal.hostname)
+    const redirectHostWithoutWww = stripWww(parsedRedirect.hostname)
+    return originalHostWithoutWww === redirectHostWithoutWww
+  } catch (_error) {
+    return false
+  }
+}
+
+/**
+ * Helper function to handle fetching URLs with custom redirect handling
+ * Recursively follows redirects if they pass the redirectChecker function
+ *
+ * Per PSR:
+ * "Do not automatically follow redirects because following redirects could
+ * allow for an attacker to exploit an open redirect vulnerability in a
+ * trusted domain to force a user to make a request to a malicious domain
+ * unknowingly"
+ */
+type RedirectInfo = {
+  type: 'redirect'
+  originalUrl: string
+  redirectUrl: string
+  statusCode: number
+}
+
+export async function getWithPermittedRedirects(
+  url: string,
+  signal: AbortSignal,
+  redirectChecker: (originalUrl: string, redirectUrl: string) => boolean,
+  depth = 0,
+): Promise<AxiosResponse<ArrayBuffer> | RedirectInfo> {
+  if (depth > MAX_REDIRECTS) {
+    throw new Error(`Too many redirects (exceeded ${MAX_REDIRECTS})`)
+  }
+  try {
+    return await axios.get(url, {
+      signal,
+      timeout: FETCH_TIMEOUT_MS,
+      maxRedirects: 0,
+      responseType: 'arraybuffer',
+      maxContentLength: MAX_HTTP_CONTENT_LENGTH,
+      headers: {
+        Accept: 'text/markdown, text/html, */*',
+        'User-Agent': getWebFetchUserAgent(),
+      },
+    })
+  } catch (error) {
+    if (
+      axios.isAxiosError(error) &&
+      error.response &&
+      [301, 302, 307, 308].includes(error.response.status)
+    ) {
+      const redirectLocation = error.response.headers.location
+      if (!redirectLocation) {
+        throw new Error('Redirect missing Location header')
+      }
+
+      // Resolve relative URLs against the original URL
+      const redirectUrl = new URL(redirectLocation, url).toString()
+
+      if (redirectChecker(url, redirectUrl)) {
+        // Recursively follow the permitted redirect
+        return getWithPermittedRedirects(
+          redirectUrl,
+          signal,
+          redirectChecker,
+          depth + 1,
+        )
+      } else {
+        // Return redirect information to the caller
+        return {
+          type: 'redirect',
+          originalUrl: url,
+          redirectUrl,
+          statusCode: error.response.status,
+        }
+      }
+    }
+
+    // Detect egress proxy blocks: the proxy returns 403 with
+    // X-Proxy-Error: blocked-by-allowlist when egress is restricted
+    if (
+      axios.isAxiosError(error) &&
+      error.response?.status === 403 &&
+      error.response.headers['x-proxy-error'] === 'blocked-by-allowlist'
+    ) {
+      const hostname = new URL(url).hostname
+      throw new EgressBlockedError(hostname)
+    }
+
+    throw error
+  }
+}
+
+function isRedirectInfo(
+  response: AxiosResponse<ArrayBuffer> | RedirectInfo,
+): response is RedirectInfo {
+  return 'type' in response && response.type === 'redirect'
+}
+
+export type FetchedContent = {
+  content: string
+  bytes: number
+  code: number
+  codeText: string
+  contentType: string
+  persistedPath?: string
+  persistedSize?: number
+}
+
+export async function getURLMarkdownContent(
+  url: string,
+  abortController: AbortController,
+): Promise<FetchedContent | RedirectInfo> {
+  if (!validateURL(url)) {
+    throw new Error('Invalid URL')
+  }
+
+  // Check cache (LRUCache handles TTL automatically)
+  const cachedEntry = URL_CACHE.get(url)
+  if (cachedEntry) {
+    return {
+      bytes: cachedEntry.bytes,
+      code: cachedEntry.code,
+      codeText: cachedEntry.codeText,
+      content: cachedEntry.content,
+      contentType: cachedEntry.contentType,
+      persistedPath: cachedEntry.persistedPath,
+      persistedSize: cachedEntry.persistedSize,
+    }
+  }
+
+  let parsedUrl: URL
+  let upgradedUrl = url
+
+  try {
+    parsedUrl = new URL(url)
+
+    // Upgrade http to https if needed
+    if (parsedUrl.protocol === 'http:') {
+      parsedUrl.protocol = 'https:'
+      upgradedUrl = parsedUrl.toString()
+    }
+
+    const hostname = parsedUrl.hostname
+
+    // Check if the user has opted to skip the blocklist check
+    // This is for enterprise customers with restrictive security policies
+    // that prevent outbound connections to claude.ai
+    const settings = getSettings_DEPRECATED()
+    if (!settings.skipWebFetchPreflight) {
+      const checkResult = await checkDomainBlocklist(hostname)
+      switch (checkResult.status) {
+        case 'allowed':
+          // Continue with the fetch
+          break
+        case 'blocked':
+          throw new DomainBlockedError(hostname)
+        case 'check_failed':
+          throw new DomainCheckFailedError(hostname)
+      }
+    }
+
+    if (process.env.USER_TYPE === 'ant') {
+      logEvent('tengu_web_fetch_host', {
+        hostname:
+          hostname as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      })
+    }
+  } catch (e) {
+    if (
+      e instanceof DomainBlockedError ||
+      e instanceof DomainCheckFailedError
+    ) {
+      // Expected user-facing failures - re-throw without logging as internal error
+      throw e
+    }
+    logError(e)
+  }
+
+  const response = await getWithPermittedRedirects(
+    upgradedUrl,
+    abortController.signal,
+    isPermittedRedirect,
+  )
+
+  // Check if we got a redirect response
+  if (isRedirectInfo(response)) {
+    return response
+  }
+
+  const rawBuffer = Buffer.from(response.data)
+  // Release the axios-held ArrayBuffer copy; rawBuffer owns the bytes now.
+  // This lets GC reclaim up to MAX_HTTP_CONTENT_LENGTH (10MB) before Turndown
+  // builds its DOM tree (which can be 3-5x the HTML size).
+  ;(response as { data: unknown }).data = null
+  const contentType = response.headers['content-type'] ?? ''
+
+  // Binary content: save raw bytes to disk with a proper extension so Claude
+  // can inspect the file later. We still fall through to the utf-8 decode +
+  // Haiku path below — for PDFs in particular the decoded string has enough
+  // ASCII structure (/Title, text streams) that Haiku can summarize it, and
+  // the saved file is a supplement rather than a replacement.
+  let persistedPath: string | undefined
+  let persistedSize: number | undefined
+  if (isBinaryContentType(contentType)) {
+    const persistId = `webfetch-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
+    const result = await persistBinaryContent(rawBuffer, contentType, persistId)
+    if (!('error' in result)) {
+      persistedPath = result.filepath
+      persistedSize = result.size
+    }
+  }
+
+  const bytes = rawBuffer.length
+  const htmlContent = rawBuffer.toString('utf-8')
+
+  let markdownContent: string
+  let contentBytes: number
+  if (contentType.includes('text/html')) {
+    markdownContent = (await getTurndownService()).turndown(htmlContent)
+    contentBytes = Buffer.byteLength(markdownContent)
+  } else {
+    // It's not HTML - just use it raw. The decoded string's UTF-8 byte
+    // length equals rawBuffer.length (modulo U+FFFD replacement on invalid
+    // bytes — negligible for cache eviction accounting), so skip the O(n)
+    // Buffer.byteLength scan.
+    markdownContent = htmlContent
+    contentBytes = bytes
+  }
+
+  // Store the fetched content in cache. Note that it's stored under
+  // the original URL, not the upgraded or redirected URL.
+  const entry: CacheEntry = {
+    bytes,
+    code: response.status,
+    codeText: response.statusText,
+    content: markdownContent,
+    contentType,
+    persistedPath,
+    persistedSize,
+  }
+  // lru-cache requires positive integers; clamp to 1 for empty responses.
+  URL_CACHE.set(url, entry, { size: Math.max(1, contentBytes) })
+  return entry
+}
+
+export async function applyPromptToMarkdown(
+  prompt: string,
+  markdownContent: string,
+  signal: AbortSignal,
+  isNonInteractiveSession: boolean,
+  isPreapprovedDomain: boolean,
+): Promise<string> {
+  // Truncate content to avoid "Prompt is too long" errors from the secondary model
+  const truncatedContent =
+    markdownContent.length > MAX_MARKDOWN_LENGTH
+      ? markdownContent.slice(0, MAX_MARKDOWN_LENGTH) +
+        '\n\n[Content truncated due to length...]'
+      : markdownContent
+
+  const modelPrompt = makeSecondaryModelPrompt(
+    truncatedContent,
+    prompt,
+    isPreapprovedDomain,
+  )
+  const assistantMessage = await queryHaiku({
+    systemPrompt: asSystemPrompt([]),
+    userPrompt: modelPrompt,
+    signal,
+    options: {
+      querySource: 'web_fetch_apply',
+      agents: [],
+      isNonInteractiveSession,
+      hasAppendSystemPrompt: false,
+      mcpTools: [],
+    },
+  })
+
+  // We need to bubble this up, so that the tool call throws, causing us to return
+  // an is_error tool_use block to the server, and render a red dot in the UI.
+  if (signal.aborted) {
+    throw new AbortError()
+  }
+
+  const { content } = assistantMessage.message
+  if (content.length > 0) {
+    const contentBlock = content[0]
+    if ('text' in contentBlock!) {
+      return contentBlock.text
+    }
+  }
+  return 'No response from model'
+}

package/src/tools/WebSearchTool/UI.tsx

@@ -0,0 +1,101 @@
+import React from 'react';
+import { MessageResponse } from '../../components/MessageResponse.js';
+import { TOOL_SUMMARY_MAX_LENGTH } from '../../constants/toolLimits.js';
+import { Box, Text } from '../../ink.js';
+import type { ProgressMessage } from '../../types/message.js';
+import { truncate } from '../../utils/format.js';
+import type { Output, SearchResult, WebSearchProgress } from './WebSearchTool.js';
+function getSearchSummary(results: (SearchResult | string | null | undefined)[]): {
+  searchCount: number;
+  totalResultCount: number;
+} {
+  let searchCount = 0;
+  let totalResultCount = 0;
+  for (const result of results) {
+    if (result != null && typeof result !== 'string') {
+      searchCount++;
+      totalResultCount += result.content?.length ?? 0;
+    }
+  }
+  return {
+    searchCount,
+    totalResultCount
+  };
+}
+export function renderToolUseMessage({
+  query,
+  allowed_domains,
+  blocked_domains
+}: Partial<{
+  query: string;
+  allowed_domains?: string[];
+  blocked_domains?: string[];
+}>, {
+  verbose
+}: {
+  verbose: boolean;
+}): React.ReactNode {
+  if (!query) {
+    return null;
+  }
+  let message = '';
+  if (query) {
+    message += `"${query}"`;
+  }
+  if (verbose) {
+    if (allowed_domains && allowed_domains.length > 0) {
+      message += `, only allowing domains: ${allowed_domains.join(', ')}`;
+    }
+    if (blocked_domains && blocked_domains.length > 0) {
+      message += `, blocking domains: ${blocked_domains.join(', ')}`;
+    }
+  }
+  return message;
+}
+export function renderToolUseProgressMessage(progressMessages: ProgressMessage<WebSearchProgress>[]): React.ReactNode {
+  if (progressMessages.length === 0) {
+    return null;
+  }
+  const lastProgress = progressMessages[progressMessages.length - 1];
+  if (!lastProgress?.data) {
+    return null;
+  }
+  const data = lastProgress.data;
+  switch (data.type) {
+    case 'query_update':
+      return <MessageResponse>
+          <Text dimColor>Searching: {data.query}</Text>
+        </MessageResponse>;
+    case 'search_results_received':
+      return <MessageResponse>
+          <Text dimColor>
+            Found {data.resultCount} results for &quot;{data.query}&quot;
+          </Text>
+        </MessageResponse>;
+    default:
+      return null;
+  }
+}
+export function renderToolResultMessage(output: Output): React.ReactNode {
+  const {
+    searchCount
+  } = getSearchSummary(output.results ?? []);
+  const timeDisplay = output.durationSeconds >= 1 ? `${Math.round(output.durationSeconds)}s` : `${Math.round(output.durationSeconds * 1000)}ms`;
+  return <Box justifyContent="space-between" width="100%">
+      <MessageResponse height={1}>
+        <Text>
+          Did {searchCount} search
+          {searchCount !== 1 ? 'es' : ''} in {timeDisplay}
+        </Text>
+      </MessageResponse>
+    </Box>;
+}
+export function getToolUseSummary(input: Partial<{
+  query: string;
+}> | undefined): string | null {
+  if (!input?.query) {
+    return null;
+  }
+  return truncate(input.query, TOOL_SUMMARY_MAX_LENGTH);
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJSZWFjdCIsIk1lc3NhZ2VSZXNwb25zZSIsIlRPT0xfU1VNTUFSWV9NQVhfTEVOR1RIIiwiQm94IiwiVGV4dCIsIlByb2dyZXNzTWVzc2FnZSIsInRydW5jYXRlIiwiT3V0cHV0IiwiU2VhcmNoUmVzdWx0IiwiV2ViU2VhcmNoUHJvZ3Jlc3MiLCJnZXRTZWFyY2hTdW1tYXJ5IiwicmVzdWx0cyIsInNlYXJjaENvdW50IiwidG90YWxSZXN1bHRDb3VudCIsInJlc3VsdCIsImNvbnRlbnQiLCJsZW5ndGgiLCJyZW5kZXJUb29sVXNlTWVzc2FnZSIsInF1ZXJ5IiwiYWxsb3dlZF9kb21haW5zIiwiYmxvY2tlZF9kb21haW5zIiwiUGFydGlhbCIsInZlcmJvc2UiLCJSZWFjdE5vZGUiLCJtZXNzYWdlIiwiam9pbiIsInJlbmRlclRvb2xVc2VQcm9ncmVzc01lc3NhZ2UiLCJwcm9ncmVzc01lc3NhZ2VzIiwibGFzdFByb2dyZXNzIiwiZGF0YSIsInR5cGUiLCJyZXN1bHRDb3VudCIsInJlbmRlclRvb2xSZXN1bHRNZXNzYWdlIiwib3V0cHV0IiwidGltZURpc3BsYXkiLCJkdXJhdGlvblNlY29uZHMiLCJNYXRoIiwicm91bmQiLCJnZXRUb29sVXNlU3VtbWFyeSIsImlucHV0Il0sInNvdXJjZXMiOlsiVUkudHN4Il0sInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBSZWFjdCBmcm9tICdyZWFjdCdcbmltcG9ydCB7IE1lc3NhZ2VSZXNwb25zZSB9IGZyb20gJy4uLy4uL2NvbXBvbmVudHMvTWVzc2FnZVJlc3BvbnNlLmpzJ1xuaW1wb3J0IHsgVE9PTF9TVU1NQVJZX01BWF9MRU5HVEggfSBmcm9tICcuLi8uLi9jb25zdGFudHMvdG9vbExpbWl0cy5qcydcbmltcG9ydCB7IEJveCwgVGV4dCB9IGZyb20gJy4uLy4uL2luay5qcydcbmltcG9ydCB0eXBlIHsgUHJvZ3Jlc3NNZXNzYWdlIH0gZnJvbSAnLi4vLi4vdHlwZXMvbWVzc2FnZS5qcydcbmltcG9ydCB7IHRydW5jYXRlIH0gZnJvbSAnLi4vLi4vdXRpbHMvZm9ybWF0LmpzJ1xuaW1wb3J0IHR5cGUge1xuICBPdXRwdXQsXG4gIFNlYXJjaFJlc3VsdCxcbiAgV2ViU2VhcmNoUHJvZ3Jlc3MsXG59IGZyb20gJy4vV2ViU2VhcmNoVG9vbC5qcydcblxuZnVuY3Rpb24gZ2V0U2VhcmNoU3VtbWFyeShcbiAgcmVzdWx0czogKFNlYXJjaFJlc3VsdCB8IHN0cmluZyB8IG51bGwgfCB1bmRlZmluZWQpW10sXG4pOiB7XG4gIHNlYXJjaENvdW50OiBudW1iZXJcbiAgdG90YWxSZXN1bHRDb3VudDogbnVtYmVyXG59IHtcbiAgbGV0IHNlYXJjaENvdW50ID0gMFxuICBsZXQgdG90YWxSZXN1bHRDb3VudCA9IDBcblxuICBmb3IgKGNvbnN0IHJlc3VsdCBvZiByZXN1bHRzKSB7XG4gICAgaWYgKHJlc3VsdCAhPSBudWxsICYmIHR5cGVvZiByZXN1bHQgIT09ICdzdHJpbmcnKSB7XG4gICAgICBzZWFyY2hDb3VudCsrXG4gICAgICB0b3RhbFJlc3VsdENvdW50ICs9IHJlc3VsdC5jb250ZW50Py5sZW5ndGggPz8gMFxuICAgIH1cbiAgfVxuXG4gIHJldHVybiB7IHNlYXJjaENvdW50LCB0b3RhbFJlc3VsdENvdW50IH1cbn1cblxuZXhwb3J0IGZ1bmN0aW9uIHJlbmRlclRvb2xVc2VNZXNzYWdlKFxuICB7XG4gICAgcXVlcnksXG4gICAgYWxsb3dlZF9kb21haW5zLFxuICAgIGJsb2NrZWRfZG9tYWlucyxcbiAgfTogUGFydGlhbDx7XG4gICAgcXVlcnk6IHN0cmluZ1xuICAgIGFsbG93ZWRfZG9tYWlucz86IHN0cmluZ1tdXG4gICAgYmxvY2tlZF9kb21haW5zPzogc3RyaW5nW11cbiAgfT4sXG4gIHsgdmVyYm9zZSB9OiB7IHZlcmJvc2U6IGJvb2xlYW4gfSxcbik6IFJlYWN0LlJlYWN0Tm9kZSB7XG4gIGlmICghcXVlcnkpIHtcbiAgICByZXR1cm4gbnVsbFxuICB9XG5cbiAgbGV0IG1lc3NhZ2UgPSAnJ1xuXG4gIGlmIChxdWVyeSkge1xuICAgIG1lc3NhZ2UgKz0gYFwiJHtxdWVyeX1cImBcbiAgfVxuXG4gIGlmICh2ZXJib3NlKSB7XG4gICAgaWYgKGFsbG93ZWRfZG9tYWlucyAmJiBhbGxvd2VkX2RvbWFpbnMubGVuZ3RoID4gMCkge1xuICAgICAgbWVzc2FnZSArPSBgLCBvbmx5IGFsbG93aW5nIGRvbWFpbnM6ICR7YWxsb3dlZF9kb21haW5zLmpvaW4oJywgJyl9YFxuICAgIH1cblxuICAgIGlmIChibG9ja2VkX2RvbWFpbnMgJiYgYmxvY2tlZF9kb21haW5zLmxlbmd0aCA+IDApIHtcbiAgICAgIG1lc3NhZ2UgKz0gYCwgYmxvY2tpbmcgZG9tYWluczogJHtibG9ja2VkX2RvbWFpbnMuam9pbignLCAnKX1gXG4gICAgfVxuICB9XG5cbiAgcmV0dXJuIG1lc3NhZ2Vcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIHJlbmRlclRvb2xVc2VQcm9ncmVzc01lc3NhZ2UoXG4gIHByb2dyZXNzTWVzc2FnZXM6IFByb2dyZXNzTWVzc2FnZTxXZWJTZWFyY2hQcm9ncmVzcz5bXSxcbik6IFJlYWN0LlJlYWN0Tm9kZSB7XG4gIGlmIChwcm9ncmVzc01lc3NhZ2VzLmxlbmd0aCA9PT0gMCkge1xuICAgIHJldHVybiBudWxsXG4gIH1cblxuICBjb25zdCBsYXN0UHJvZ3Jlc3MgPSBwcm9ncmVzc01lc3NhZ2VzW3Byb2dyZXNzTWVzc2FnZXMubGVuZ3RoIC0gMV1cbiAgaWYgKCFsYXN0UHJvZ3Jlc3M/LmRhdGEpIHtcbiAgICByZXR1cm4gbnVsbFxuICB9XG5cbiAgY29uc3QgZGF0YSA9IGxhc3RQcm9ncmVzcy5kYXRhXG5cbiAgc3dpdGNoIChkYXRhLnR5cGUpIHtcbiAgICBjYXNlICdxdWVyeV91cGRhdGUnOlxuICAgICAgcmV0dXJuIChcbiAgICAgICAgPE1lc3NhZ2VSZXNwb25zZT5cbiAgICAgICAgICA8VGV4dCBkaW1Db2xvcj5TZWFyY2hpbmc6IHtkYXRhLnF1ZXJ5fTwvVGV4dD5cbiAgICAgICAgPC9NZXNzYWdlUmVzcG9uc2U+XG4gICAgICApXG4gICAgY2FzZSAnc2VhcmNoX3Jlc3VsdHNfcmVjZWl2ZWQnOlxuICAgICAgcmV0dXJuIChcbiAgICAgICAgPE1lc3NhZ2VSZXNwb25zZT5cbiAgICAgICAgICA8VGV4dCBkaW1Db2xvcj5cbiAgICAgICAgICAgIEZvdW5kIHtkYXRhLnJlc3VsdENvdW50fSByZXN1bHRzIGZvciAmcXVvdDt7ZGF0YS5xdWVyeX0mcXVvdDtcbiAgICAgICAgICA8L1RleHQ+XG4gICAgICAgIDwvTWVzc2FnZVJlc3BvbnNlPlxuICAgICAgKVxuICAgIGRlZmF1bHQ6XG4gICAgICByZXR1cm4gbnVsbFxuICB9XG59XG5cbmV4cG9ydCBmdW5jdGlvbiByZW5kZXJUb29sUmVzdWx0TWVzc2FnZShvdXRwdXQ6IE91dHB1dCk6IFJlYWN0LlJlYWN0Tm9kZSB7XG4gIGNvbnN0IHsgc2VhcmNoQ291bnQgfSA9IGdldFNlYXJjaFN1bW1hcnkob3V0cHV0LnJlc3VsdHMgPz8gW10pXG4gIGNvbnN0IHRpbWVEaXNwbGF5ID1cbiAgICBvdXRwdXQuZHVyYXRpb25TZWNvbmRzID49IDFcbiAgICAgID8gYCR7TWF0aC5yb3VuZChvdXRwdXQuZHVyYXRpb25TZWNvbmRzKX1zYFxuICAgICAgOiBgJHtNYXRoLnJvdW5kKG91dHB1dC5kdXJhdGlvblNlY29uZHMgKiAxMDAwKX1tc2BcblxuICByZXR1cm4gKFxuICAgIDxCb3gganVzdGlmeUNvbnRlbnQ9XCJzcGFjZS1iZXR3ZWVuXCIgd2lkdGg9XCIxMDAlXCI+XG4gICAgICA8TWVzc2FnZVJlc3BvbnNlIGhlaWdodD17MX0+XG4gICAgICAgIDxUZXh0PlxuICAgICAgICAgIERpZCB7c2VhcmNoQ291bnR9IHNlYXJjaFxuICAgICAgICAgIHtzZWFyY2hDb3VudCAhPT0gMSA/ICdlcycgOiAnJ30gaW4ge3RpbWVEaXNwbGF5fVxuICAgICAgICA8L1RleHQ+XG4gICAgICA8L01lc3NhZ2VSZXNwb25zZT5cbiAgICA8L0JveD5cbiAgKVxufVxuXG5leHBvcnQgZnVuY3Rpb24gZ2V0VG9vbFVzZVN1bW1hcnkoXG4gIGlucHV0OiBQYXJ0aWFsPHsgcXVlcnk6IHN0cmluZyB9PiB8IHVuZGVmaW5lZCxcbik6IHN0cmluZyB8IG51bGwge1xuICBpZiAoIWlucHV0Py5xdWVyeSkge1xuICAgIHJldHVybiBudWxsXG4gIH1cbiAgcmV0dXJuIHRydW5jYXRlKGlucHV0LnF1ZXJ5LCBUT09MX1NVTU1BUllfTUFYX0xFTkdUSClcbn1cbiJdLCJtYXBwaW5ncyI6IkFBQUEsT0FBT0EsS0FBSyxNQUFNLE9BQU87QUFDekIsU0FBU0MsZUFBZSxRQUFRLHFDQUFxQztBQUNyRSxTQUFTQyx1QkFBdUIsUUFBUSwrQkFBK0I7QUFDdkUsU0FBU0MsR0FBRyxFQUFFQyxJQUFJLFFBQVEsY0FBYztBQUN4QyxjQUFjQyxlQUFlLFFBQVEsd0JBQXdCO0FBQzdELFNBQVNDLFFBQVEsUUFBUSx1QkFBdUI7QUFDaEQsY0FDRUMsTUFBTSxFQUNOQyxZQUFZLEVBQ1pDLGlCQUFpQixRQUNaLG9CQUFvQjtBQUUzQixTQUFTQyxnQkFBZ0JBLENBQ3ZCQyxPQUFPLEVBQUUsQ0FBQ0gsWUFBWSxHQUFHLE1BQU0sR0FBRyxJQUFJLEdBQUcsU0FBUyxDQUFDLEVBQUUsQ0FDdEQsRUFBRTtFQUNESSxXQUFXLEVBQUUsTUFBTTtFQUNuQkMsZ0JBQWdCLEVBQUUsTUFBTTtBQUMxQixDQUFDLENBQUM7RUFDQSxJQUFJRCxXQUFXLEdBQUcsQ0FBQztFQUNuQixJQUFJQyxnQkFBZ0IsR0FBRyxDQUFDO0VBRXhCLEtBQUssTUFBTUMsTUFBTSxJQUFJSCxPQUFPLEVBQUU7SUFDNUIsSUFBSUcsTUFBTSxJQUFJLElBQUksSUFBSSxPQUFPQSxNQUFNLEtBQUssUUFBUSxFQUFFO01BQ2hERixXQUFXLEVBQUU7TUFDYkMsZ0JBQWdCLElBQUlDLE1BQU0sQ0FBQ0MsT0FBTyxFQUFFQyxNQUFNLElBQUksQ0FBQztJQUNqRDtFQUNGO0VBRUEsT0FBTztJQUFFSixXQUFXO0lBQUVDO0VBQWlCLENBQUM7QUFDMUM7QUFFQSxPQUFPLFNBQVNJLG9CQUFvQkEsQ0FDbEM7RUFDRUMsS0FBSztFQUNMQyxlQUFlO0VBQ2ZDO0FBS0QsQ0FKQSxFQUFFQyxPQUFPLENBQUM7RUFDVEgsS0FBSyxFQUFFLE1BQU07RUFDYkMsZUFBZSxDQUFDLEVBQUUsTUFBTSxFQUFFO0VBQzFCQyxlQUFlLENBQUMsRUFBRSxNQUFNLEVBQUU7QUFDNUIsQ0FBQyxDQUFDLEVBQ0Y7RUFBRUU7QUFBOEIsQ0FBckIsRUFBRTtFQUFFQSxPQUFPLEVBQUUsT0FBTztBQUFDLENBQUMsQ0FDbEMsRUFBRXRCLEtBQUssQ0FBQ3VCLFNBQVMsQ0FBQztFQUNqQixJQUFJLENBQUNMLEtBQUssRUFBRTtJQUNWLE9BQU8sSUFBSTtFQUNiO0VBRUEsSUFBSU0sT0FBTyxHQUFHLEVBQUU7RUFFaEIsSUFBSU4sS0FBSyxFQUFFO0lBQ1RNLE9BQU8sSUFBSSxJQUFJTixLQUFLLEdBQUc7RUFDekI7RUFFQSxJQUFJSSxPQUFPLEVBQUU7SUFDWCxJQUFJSCxlQUFlLElBQUlBLGVBQWUsQ0FBQ0gsTUFBTSxHQUFHLENBQUMsRUFBRTtNQUNqRFEsT0FBTyxJQUFJLDRCQUE0QkwsZUFBZSxDQUFDTSxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUU7SUFDckU7SUFFQSxJQUFJTCxlQUFlLElBQUlBLGVBQWUsQ0FBQ0osTUFBTSxHQUFHLENBQUMsRUFBRTtNQUNqRFEsT0FBTyxJQUFJLHVCQUF1QkosZUFBZSxDQUFDSyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUU7SUFDaEU7RUFDRjtFQUVBLE9BQU9ELE9BQU87QUFDaEI7QUFFQSxPQUFPLFNBQVNFLDRCQUE0QkEsQ0FDMUNDLGdCQUFnQixFQUFFdEIsZUFBZSxDQUFDSSxpQkFBaUIsQ0FBQyxFQUFFLENBQ3ZELEVBQUVULEtBQUssQ0FBQ3VCLFNBQVMsQ0FBQztFQUNqQixJQUFJSSxnQkFBZ0IsQ0FBQ1gsTUFBTSxLQUFLLENBQUMsRUFBRTtJQUNqQyxPQUFPLElBQUk7RUFDYjtFQUVBLE1BQU1ZLFlBQVksR0FBR0QsZ0JBQWdCLENBQUNBLGdCQUFnQixDQUFDWCxNQUFNLEdBQUcsQ0FBQyxDQUFDO0VBQ2xFLElBQUksQ0FBQ1ksWUFBWSxFQUFFQyxJQUFJLEVBQUU7SUFDdkIsT0FBTyxJQUFJO0VBQ2I7RUFFQSxNQUFNQSxJQUFJLEdBQUdELFlBQVksQ0FBQ0MsSUFBSTtFQUU5QixRQUFRQSxJQUFJLENBQUNDLElBQUk7SUFDZixLQUFLLGNBQWM7TUFDakIsT0FDRSxDQUFDLGVBQWU7QUFDeEIsVUFBVSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDRCxJQUFJLENBQUNYLEtBQUssQ0FBQyxFQUFFLElBQUk7QUFDdEQsUUFBUSxFQUFFLGVBQWUsQ0FBQztJQUV0QixLQUFLLHlCQUF5QjtNQUM1QixPQUNFLENBQUMsZUFBZTtBQUN4QixVQUFVLENBQUMsSUFBSSxDQUFDLFFBQVE7QUFDeEIsa0JBQWtCLENBQUNXLElBQUksQ0FBQ0UsV0FBVyxDQUFDLG1CQUFtQixDQUFDRixJQUFJLENBQUNYLEtBQUssQ0FBQztBQUNuRSxVQUFVLEVBQUUsSUFBSTtBQUNoQixRQUFRLEVBQUUsZUFBZSxDQUFDO0lBRXRCO01BQ0UsT0FBTyxJQUFJO0VBQ2Y7QUFDRjtBQUVBLE9BQU8sU0FBU2MsdUJBQXVCQSxDQUFDQyxNQUFNLEVBQUUxQixNQUFNLENBQUMsRUFBRVAsS0FBSyxDQUFDdUIsU0FBUyxDQUFDO0VBQ3ZFLE1BQU07SUFBRVg7RUFBWSxDQUFDLEdBQUdGLGdCQUFnQixDQUFDdUIsTUFBTSxDQUFDdEIsT0FBTyxJQUFJLEVBQUUsQ0FBQztFQUM5RCxNQUFNdUIsV0FBVyxHQUNmRCxNQUFNLENBQUNFLGVBQWUsSUFBSSxDQUFDLEdBQ3ZCLEdBQUdDLElBQUksQ0FBQ0MsS0FBSyxDQUFDSixNQUFNLENBQUNFLGVBQWUsQ0FBQyxHQUFHLEdBQ3hDLEdBQUdDLElBQUksQ0FBQ0MsS0FBSyxDQUFDSixNQUFNLENBQUNFLGVBQWUsR0FBRyxJQUFJLENBQUMsSUFBSTtFQUV0RCxPQUNFLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLE1BQU07QUFDcEQsTUFBTSxDQUFDLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDakMsUUFBUSxDQUFDLElBQUk7QUFDYixjQUFjLENBQUN2QixXQUFXLENBQUM7QUFDM0IsVUFBVSxDQUFDQSxXQUFXLEtBQUssQ0FBQyxHQUFHLElBQUksR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDc0IsV0FBVztBQUN6RCxRQUFRLEVBQUUsSUFBSTtBQUNkLE1BQU0sRUFBRSxlQUFlO0FBQ3ZCLElBQUksRUFBRSxHQUFHLENBQUM7QUFFVjtBQUVBLE9BQU8sU0FBU0ksaUJBQWlCQSxDQUMvQkMsS0FBSyxFQUFFbEIsT0FBTyxDQUFDO0VBQUVILEtBQUssRUFBRSxNQUFNO0FBQUMsQ0FBQyxDQUFDLEdBQUcsU0FBUyxDQUM5QyxFQUFFLE1BQU0sR0FBRyxJQUFJLENBQUM7RUFDZixJQUFJLENBQUNxQixLQUFLLEVBQUVyQixLQUFLLEVBQUU7SUFDakIsT0FBTyxJQUFJO0VBQ2I7RUFDQSxPQUFPWixRQUFRLENBQUNpQyxLQUFLLENBQUNyQixLQUFLLEVBQUVoQix1QkFBdUIsQ0FBQztBQUN2RCIsImlnbm9yZUxpc3QiOltdfQ==