@xelauvas/xela-cli 0.1.0

package/src/commands/review/reviewRemote.ts

@@ -0,0 +1,316 @@
+/**
+ * Teleported /ultrareview execution. Creates a CCR session with the current repo,
+ * sends the review prompt as the initial message, and registers a
+ * RemoteAgentTask so the polling loop pipes results back into the local
+ * session via task-notification. Mirrors the /ultraplan → CCR flow.
+ *
+ * TODO(#22051): pass useBundleMode once landed so local-only / uncommitted
+ * repo state is captured. The GitHub-clone path (current) only works for
+ * pushed branches on repos with the Claude GitHub app installed.
+ */
+
+import type { ContentBlockParam } from '@anthropic-ai/sdk/resources/messages.js'
+import { getFeatureValue_CACHED_MAY_BE_STALE } from '../../services/analytics/growthbook.js'
+import {
+  type AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+  logEvent,
+} from '../../services/analytics/index.js'
+import { fetchUltrareviewQuota } from '../../services/api/ultrareviewQuota.js'
+import { fetchUtilization } from '../../services/api/usage.js'
+import type { ToolUseContext } from '../../Tool.js'
+import {
+  checkRemoteAgentEligibility,
+  formatPreconditionError,
+  getRemoteTaskSessionUrl,
+  registerRemoteAgentTask,
+} from '../../tasks/RemoteAgentTask/RemoteAgentTask.js'
+import { isEnterpriseSubscriber, isTeamSubscriber } from '../../utils/auth.js'
+import { detectCurrentRepositoryWithHost } from '../../utils/detectRepository.js'
+import { execFileNoThrow } from '../../utils/execFileNoThrow.js'
+import { getDefaultBranch, gitExe } from '../../utils/git.js'
+import { teleportToRemote } from '../../utils/teleport.js'
+
+// One-time session flag: once the user confirms overage billing via the
+// dialog, all subsequent /ultrareview invocations in this session proceed
+// without re-prompting.
+let sessionOverageConfirmed = false
+
+export function confirmOverage(): void {
+  sessionOverageConfirmed = true
+}
+
+export type OverageGate =
+  | { kind: 'proceed'; billingNote: string }
+  | { kind: 'not-enabled' }
+  | { kind: 'low-balance'; available: number }
+  | { kind: 'needs-confirm' }
+
+/**
+ * Determine whether the user can launch an ultrareview and under what
+ * billing terms. Fetches quota and utilization in parallel.
+ */
+export async function checkOverageGate(): Promise<OverageGate> {
+  // Team and Enterprise plans include ultrareview — no free-review quota
+  // or Extra Usage dialog. The quota endpoint is scoped to consumer plans
+  // (pro/max); hitting it on team/ent would surface a confusing dialog.
+  if (isTeamSubscriber() || isEnterpriseSubscriber()) {
+    return { kind: 'proceed', billingNote: '' }
+  }
+
+  const [quota, utilization] = await Promise.all([
+    fetchUltrareviewQuota(),
+    fetchUtilization().catch(() => null),
+  ])
+
+  // No quota info (non-subscriber or endpoint down) — let it through,
+  // server-side billing will handle it.
+  if (!quota) {
+    return { kind: 'proceed', billingNote: '' }
+  }
+
+  if (quota.reviews_remaining > 0) {
+    return {
+      kind: 'proceed',
+      billingNote: ` This is free ultrareview ${quota.reviews_used + 1} of ${quota.reviews_limit}.`,
+    }
+  }
+
+  // Utilization fetch failed (transient network error, timeout, etc.) —
+  // let it through, same rationale as the quota fallback above.
+  if (!utilization) {
+    return { kind: 'proceed', billingNote: '' }
+  }
+
+  // Free reviews exhausted — check Extra Usage setup.
+  const extraUsage = utilization.extra_usage
+  if (!extraUsage?.is_enabled) {
+    logEvent('tengu_review_overage_not_enabled', {})
+    return { kind: 'not-enabled' }
+  }
+
+  // Check available balance (null monthly_limit = unlimited).
+  const monthlyLimit = extraUsage.monthly_limit
+  const usedCredits = extraUsage.used_credits ?? 0
+  const available =
+    monthlyLimit === null || monthlyLimit === undefined
+      ? Infinity
+      : monthlyLimit - usedCredits
+
+  if (available < 10) {
+    logEvent('tengu_review_overage_low_balance', { available })
+    return { kind: 'low-balance', available }
+  }
+
+  if (!sessionOverageConfirmed) {
+    logEvent('tengu_review_overage_dialog_shown', {})
+    return { kind: 'needs-confirm' }
+  }
+
+  return {
+    kind: 'proceed',
+    billingNote: ' This review bills as Extra Usage.',
+  }
+}
+
+/**
+ * Launch a teleported review session. Returns ContentBlockParam[] describing
+ * the launch outcome for injection into the local conversation (model is then
+ * queried with this content, so it can narrate the launch to the user).
+ *
+ * Returns ContentBlockParam[] with user-facing error messages on recoverable
+ * failures (missing merge-base, empty diff, bundle too large), or null on
+ * other failures so the caller falls through to the local-review prompt.
+ * Reason is captured in analytics.
+ *
+ * Caller must run checkOverageGate() BEFORE calling this function
+ * (ultrareviewCommand.tsx handles the dialog).
+ */
+export async function launchRemoteReview(
+  args: string,
+  context: ToolUseContext,
+  billingNote?: string,
+): Promise<ContentBlockParam[] | null> {
+  const eligibility = await checkRemoteAgentEligibility()
+  // Synthetic DEFAULT_CODE_REVIEW_ENVIRONMENT_ID works without per-org CCR
+  // setup, so no_remote_environment isn't a blocker. Server-side quota
+  // consume at session creation routes billing: first N zero-rate, then
+  // anthropic:cccr org-service-key (overage-only).
+  if (!eligibility.eligible) {
+    const blockers = eligibility.errors.filter(
+      e => e.type !== 'no_remote_environment',
+    )
+    if (blockers.length > 0) {
+      logEvent('tengu_review_remote_precondition_failed', {
+        precondition_errors: blockers
+          .map(e => e.type)
+          .join(
+            ',',
+          ) as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      })
+      const reasons = blockers.map(formatPreconditionError).join('\n')
+      return [
+        {
+          type: 'text',
+          text: `Ultrareview cannot launch:\n${reasons}`,
+        },
+      ]
+    }
+  }
+
+  const resolvedBillingNote = billingNote ?? ''
+
+  const prNumber = args.trim()
+  const isPrNumber = /^\d+$/.test(prNumber)
+  // Synthetic code_review env. Go taggedid.FromUUID(TagEnvironment,
+  // UUID{...,0x02}) encodes with version prefix '01' — NOT Python's
+  // legacy tagged_id() format. Verified in prod.
+  const CODE_REVIEW_ENV_ID = 'env_011111111111111111111113'
+  // Lite-review bypasses bughunter.go entirely, so it doesn't see the
+  // webhook's bug_hunter_config (different GB project). These env vars are
+  // the only tuning surface — without them, run_hunt.sh's bash defaults
+  // apply (60min, 120s agent timeout), and 120s kills verifiers mid-run
+  // which causes infinite respawn.
+  //
+  // total_wallclock must stay below RemoteAgentTask's 30min poll timeout
+  // with headroom for finalization (~3min synthesis). Per-field guards
+  // match autoDream.ts — GB cache can return stale wrong-type values.
+  const raw = getFeatureValue_CACHED_MAY_BE_STALE<Record<
+    string,
+    unknown
+  > | null>('tengu_review_bughunter_config', null)
+  const posInt = (v: unknown, fallback: number, max?: number): number => {
+    if (typeof v !== 'number' || !Number.isFinite(v)) return fallback
+    const n = Math.floor(v)
+    if (n <= 0) return fallback
+    return max !== undefined && n > max ? fallback : n
+  }
+  // Upper bounds: 27min on wallclock leaves ~3min for finalization under
+  // RemoteAgentTask's 30min poll timeout. If GB is set above that, the
+  // hang we're fixing comes back — fall to the safe default instead.
+  const commonEnvVars = {
+    BUGHUNTER_DRY_RUN: '1',
+    BUGHUNTER_FLEET_SIZE: String(posInt(raw?.fleet_size, 5, 20)),
+    BUGHUNTER_MAX_DURATION: String(posInt(raw?.max_duration_minutes, 10, 25)),
+    BUGHUNTER_AGENT_TIMEOUT: String(
+      posInt(raw?.agent_timeout_seconds, 600, 1800),
+    ),
+    BUGHUNTER_TOTAL_WALLCLOCK: String(
+      posInt(raw?.total_wallclock_minutes, 22, 27),
+    ),
+    ...(process.env.BUGHUNTER_DEV_BUNDLE_B64 && {
+      BUGHUNTER_DEV_BUNDLE_B64: process.env.BUGHUNTER_DEV_BUNDLE_B64,
+    }),
+  }
+
+  let session
+  let command
+  let target
+  if (isPrNumber) {
+    // PR mode: refs/pull/N/head via github.com. Orchestrator --pr N.
+    const repo = await detectCurrentRepositoryWithHost()
+    if (!repo || repo.host !== 'github.com') {
+      logEvent('tengu_review_remote_precondition_failed', {})
+      return null
+    }
+    session = await teleportToRemote({
+      initialMessage: null,
+      description: `ultrareview: ${repo.owner}/${repo.name}#${prNumber}`,
+      signal: context.abortController.signal,
+      branchName: `refs/pull/${prNumber}/head`,
+      environmentId: CODE_REVIEW_ENV_ID,
+      environmentVariables: {
+        BUGHUNTER_PR_NUMBER: prNumber,
+        BUGHUNTER_REPOSITORY: `${repo.owner}/${repo.name}`,
+        ...commonEnvVars,
+      },
+    })
+    command = `/ultrareview ${prNumber}`
+    target = `${repo.owner}/${repo.name}#${prNumber}`
+  } else {
+    // Branch mode: bundle the working tree, orchestrator diffs against
+    // the fork point. No PR, no existing comments, no dedup.
+    const baseBranch = (await getDefaultBranch()) || 'main'
+    // Env-manager's `git remote remove origin` after bundle-clone
+    // deletes refs/remotes/origin/* — the base branch name won't resolve
+    // in the container. Pass the merge-base SHA instead: it's reachable
+    // from HEAD's history so `git diff <sha>` works without a named ref.
+    const { stdout: mbOut, code: mbCode } = await execFileNoThrow(
+      gitExe(),
+      ['merge-base', baseBranch, 'HEAD'],
+      { preserveOutputOnError: false },
+    )
+    const mergeBaseSha = mbOut.trim()
+    if (mbCode !== 0 || !mergeBaseSha) {
+      logEvent('tengu_review_remote_precondition_failed', {})
+      return [
+        {
+          type: 'text',
+          text: `Could not find merge-base with ${baseBranch}. Make sure you're in a git repo with a ${baseBranch} branch.`,
+        },
+      ]
+    }
+
+    // Bail early on empty diffs instead of launching a container that
+    // will just echo "no changes".
+    const { stdout: diffStat, code: diffCode } = await execFileNoThrow(
+      gitExe(),
+      ['diff', '--shortstat', mergeBaseSha],
+      { preserveOutputOnError: false },
+    )
+    if (diffCode === 0 && !diffStat.trim()) {
+      logEvent('tengu_review_remote_precondition_failed', {})
+      return [
+        {
+          type: 'text',
+          text: `No changes against the ${baseBranch} fork point. Make some commits or stage files first.`,
+        },
+      ]
+    }
+
+    session = await teleportToRemote({
+      initialMessage: null,
+      description: `ultrareview: ${baseBranch}`,
+      signal: context.abortController.signal,
+      useBundle: true,
+      environmentId: CODE_REVIEW_ENV_ID,
+      environmentVariables: {
+        BUGHUNTER_BASE_BRANCH: mergeBaseSha,
+        ...commonEnvVars,
+      },
+    })
+    if (!session) {
+      logEvent('tengu_review_remote_teleport_failed', {})
+      return [
+        {
+          type: 'text',
+          text: 'Repo is too large. Push a PR and use `/ultrareview <PR#>` instead.',
+        },
+      ]
+    }
+    command = '/ultrareview'
+    target = baseBranch
+  }
+
+  if (!session) {
+    logEvent('tengu_review_remote_teleport_failed', {})
+    return null
+  }
+  registerRemoteAgentTask({
+    remoteTaskType: 'ultrareview',
+    session,
+    command,
+    context,
+    isRemoteReview: true,
+  })
+  logEvent('tengu_review_remote_launched', {})
+  const sessionUrl = getRemoteTaskSessionUrl(session.id)
+  // Concise — the tool-output block is visible to the user, so the model
+  // shouldn't echo the same info. Just enough for Claude to acknowledge the
+  // launch without restating the target/URL (both already printed above).
+  return [
+    {
+      type: 'text',
+      text: `Ultrareview launched for ${target} (~10–20 min, runs in the cloud). Track: ${sessionUrl}${resolvedBillingNote} Findings arrive via task-notification. Briefly acknowledge the launch to the user without repeating the target or URL — both are already visible in the tool output above.`,
+    },
+  ]
+}

package/src/commands/review/ultrareviewCommand.tsx

@@ -0,0 +1,58 @@
+import type { ContentBlockParam } from '@anthropic-ai/sdk/resources/messages.js';
+import React from 'react';
+import type { LocalJSXCommandCall, LocalJSXCommandOnDone } from '../../types/command.js';
+import { checkOverageGate, confirmOverage, launchRemoteReview } from './reviewRemote.js';
+import { UltrareviewOverageDialog } from './UltrareviewOverageDialog.js';
+function contentBlocksToString(blocks: ContentBlockParam[]): string {
+  return blocks.map(b => b.type === 'text' ? b.text : '').filter(Boolean).join('\n');
+}
+async function launchAndDone(args: string, context: Parameters<LocalJSXCommandCall>[1], onDone: LocalJSXCommandOnDone, billingNote: string, signal?: AbortSignal): Promise<void> {
+  const result = await launchRemoteReview(args, context, billingNote);
+  // User hit Escape during the ~5s launch — the dialog already showed
+  // "cancelled" and unmounted, so skip onDone (would write to a dead
+  // transcript slot) and let the caller skip confirmOverage.
+  if (signal?.aborted) return;
+  if (result) {
+    onDone(contentBlocksToString(result), {
+      shouldQuery: true
+    });
+  } else {
+    // Precondition failures now return specific ContentBlockParam[] above.
+    // null only reaches here on teleport failure (PR mode) or non-github
+    // repo — both are CCR/repo connectivity issues.
+    onDone('Ultrareview failed to launch the remote session. Check that this is a GitHub repo and try again.', {
+      display: 'system'
+    });
+  }
+}
+export const call: LocalJSXCommandCall = async (onDone, context, args) => {
+  const gate = await checkOverageGate();
+  if (gate.kind === 'not-enabled') {
+    onDone('Free ultrareviews used. Enable Extra Usage at https://claude.ai/settings/billing to continue.', {
+      display: 'system'
+    });
+    return null;
+  }
+  if (gate.kind === 'low-balance') {
+    onDone(`Balance too low to launch ultrareview ($${gate.available.toFixed(2)} available, $10 minimum). Top up at https://claude.ai/settings/billing`, {
+      display: 'system'
+    });
+    return null;
+  }
+  if (gate.kind === 'needs-confirm') {
+    return <UltrareviewOverageDialog onProceed={async signal => {
+      await launchAndDone(args, context, onDone, ' This review bills as Extra Usage.', signal);
+      // Only persist the confirmation flag after a non-aborted launch —
+      // otherwise Escape-during-launch would leave the flag set and
+      // skip this dialog on the next attempt.
+      if (!signal.aborted) confirmOverage();
+    }} onCancel={() => onDone('Ultrareview cancelled.', {
+      display: 'system'
+    })} />;
+  }
+
+  // gate.kind === 'proceed'
+  await launchAndDone(args, context, onDone, gate.billingNote);
+  return null;
+};
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJDb250ZW50QmxvY2tQYXJhbSIsIlJlYWN0IiwiTG9jYWxKU1hDb21tYW5kQ2FsbCIsIkxvY2FsSlNYQ29tbWFuZE9uRG9uZSIsImNoZWNrT3ZlcmFnZUdhdGUiLCJjb25maXJtT3ZlcmFnZSIsImxhdW5jaFJlbW90ZVJldmlldyIsIlVsdHJhcmV2aWV3T3ZlcmFnZURpYWxvZyIsImNvbnRlbnRCbG9ja3NUb1N0cmluZyIsImJsb2NrcyIsIm1hcCIsImIiLCJ0eXBlIiwidGV4dCIsImZpbHRlciIsIkJvb2xlYW4iLCJqb2luIiwibGF1bmNoQW5kRG9uZSIsImFyZ3MiLCJjb250ZXh0IiwiUGFyYW1ldGVycyIsIm9uRG9uZSIsImJpbGxpbmdOb3RlIiwic2lnbmFsIiwiQWJvcnRTaWduYWwiLCJQcm9taXNlIiwicmVzdWx0IiwiYWJvcnRlZCIsInNob3VsZFF1ZXJ5IiwiZGlzcGxheSIsImNhbGwiLCJnYXRlIiwia2luZCIsImF2YWlsYWJsZSIsInRvRml4ZWQiXSwic291cmNlcyI6WyJ1bHRyYXJldmlld0NvbW1hbmQudHN4Il0sInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB0eXBlIHsgQ29udGVudEJsb2NrUGFyYW0gfSBmcm9tICdAYW50aHJvcGljLWFpL3Nkay9yZXNvdXJjZXMvbWVzc2FnZXMuanMnXG5pbXBvcnQgUmVhY3QgZnJvbSAncmVhY3QnXG5pbXBvcnQgdHlwZSB7XG4gIExvY2FsSlNYQ29tbWFuZENhbGwsXG4gIExvY2FsSlNYQ29tbWFuZE9uRG9uZSxcbn0gZnJvbSAnLi4vLi4vdHlwZXMvY29tbWFuZC5qcydcbmltcG9ydCB7XG4gIGNoZWNrT3ZlcmFnZUdhdGUsXG4gIGNvbmZpcm1PdmVyYWdlLFxuICBsYXVuY2hSZW1vdGVSZXZpZXcsXG59IGZyb20gJy4vcmV2aWV3UmVtb3RlLmpzJ1xuaW1wb3J0IHsgVWx0cmFyZXZpZXdPdmVyYWdlRGlhbG9nIH0gZnJvbSAnLi9VbHRyYXJldmlld092ZXJhZ2VEaWFsb2cuanMnXG5cbmZ1bmN0aW9uIGNvbnRlbnRCbG9ja3NUb1N0cmluZyhibG9ja3M6IENvbnRlbnRCbG9ja1BhcmFtW10pOiBzdHJpbmcge1xuICByZXR1cm4gYmxvY2tzXG4gICAgLm1hcChiID0+IChiLnR5cGUgPT09ICd0ZXh0JyA/IGIudGV4dCA6ICcnKSlcbiAgICAuZmlsdGVyKEJvb2xlYW4pXG4gICAgLmpvaW4oJ1xcbicpXG59XG5cbmFzeW5jIGZ1bmN0aW9uIGxhdW5jaEFuZERvbmUoXG4gIGFyZ3M6IHN0cmluZyxcbiAgY29udGV4dDogUGFyYW1ldGVyczxMb2NhbEpTWENvbW1hbmRDYWxsPlsxXSxcbiAgb25Eb25lOiBMb2NhbEpTWENvbW1hbmRPbkRvbmUsXG4gIGJpbGxpbmdOb3RlOiBzdHJpbmcsXG4gIHNpZ25hbD86IEFib3J0U2lnbmFsLFxuKTogUHJvbWlzZTx2b2lkPiB7XG4gIGNvbnN0IHJlc3VsdCA9IGF3YWl0IGxhdW5jaFJlbW90ZVJldmlldyhhcmdzLCBjb250ZXh0LCBiaWxsaW5nTm90ZSlcbiAgLy8gVXNlciBoaXQgRXNjYXBlIGR1cmluZyB0aGUgfjVzIGxhdW5jaCDigJQgdGhlIGRpYWxvZyBhbHJlYWR5IHNob3dlZFxuICAvLyBcImNhbmNlbGxlZFwiIGFuZCB1bm1vdW50ZWQsIHNvIHNraXAgb25Eb25lICh3b3VsZCB3cml0ZSB0byBhIGRlYWRcbiAgLy8gdHJhbnNjcmlwdCBzbG90KSBhbmQgbGV0IHRoZSBjYWxsZXIgc2tpcCBjb25maXJtT3ZlcmFnZS5cbiAgaWYgKHNpZ25hbD8uYWJvcnRlZCkgcmV0dXJuXG4gIGlmIChyZXN1bHQpIHtcbiAgICBvbkRvbmUoY29udGVudEJsb2Nrc1RvU3RyaW5nKHJlc3VsdCksIHsgc2hvdWxkUXVlcnk6IHRydWUgfSlcbiAgfSBlbHNlIHtcbiAgICAvLyBQcmVjb25kaXRpb24gZmFpbHVyZXMgbm93IHJldHVybiBzcGVjaWZpYyBDb250ZW50QmxvY2tQYXJhbVtdIGFib3ZlLlxuICAgIC8vIG51bGwgb25seSByZWFjaGVzIGhlcmUgb24gdGVsZXBvcnQgZmFpbHVyZSAoUFIgbW9kZSkgb3Igbm9uLWdpdGh1YlxuICAgIC8vIHJlcG8g4oCUIGJvdGggYXJlIENDUi9yZXBvIGNvbm5lY3Rpdml0eSBpc3N1ZXMuXG4gICAgb25Eb25lKFxuICAgICAgJ1VsdHJhcmV2aWV3IGZhaWxlZCB0byBsYXVuY2ggdGhlIHJlbW90ZSBzZXNzaW9uLiBDaGVjayB0aGF0IHRoaXMgaXMgYSBHaXRIdWIgcmVwbyBhbmQgdHJ5IGFnYWluLicsXG4gICAgICB7IGRpc3BsYXk6ICdzeXN0ZW0nIH0sXG4gICAgKVxuICB9XG59XG5cbmV4cG9ydCBjb25zdCBjYWxsOiBMb2NhbEpTWENvbW1hbmRDYWxsID0gYXN5bmMgKG9uRG9uZSwgY29udGV4dCwgYXJncykgPT4ge1xuICBjb25zdCBnYXRlID0gYXdhaXQgY2hlY2tPdmVyYWdlR2F0ZSgpXG5cbiAgaWYgKGdhdGUua2luZCA9PT0gJ25vdC1lbmFibGVkJykge1xuICAgIG9uRG9uZShcbiAgICAgICdGcmVlIHVsdHJhcmV2aWV3cyB1c2VkLiBFbmFibGUgRXh0cmEgVXNhZ2UgYXQgaHR0cHM6Ly9jbGF1ZGUuYWkvc2V0dGluZ3MvYmlsbGluZyB0byBjb250aW51ZS4nLFxuICAgICAgeyBkaXNwbGF5OiAnc3lzdGVtJyB9LFxuICAgIClcbiAgICByZXR1cm4gbnVsbFxuICB9XG5cbiAgaWYgKGdhdGUua2luZCA9PT0gJ2xvdy1iYWxhbmNlJykge1xuICAgIG9uRG9uZShcbiAgICAgIGBCYWxhbmNlIHRvbyBsb3cgdG8gbGF1bmNoIHVsdHJhcmV2aWV3ICgkJHtnYXRlLmF2YWlsYWJsZS50b0ZpeGVkKDIpfSBhdmFpbGFibGUsICQxMCBtaW5pbXVtKS4gVG9wIHVwIGF0IGh0dHBzOi8vY2xhdWRlLmFpL3NldHRpbmdzL2JpbGxpbmdgLFxuICAgICAgeyBkaXNwbGF5OiAnc3lzdGVtJyB9LFxuICAgIClcbiAgICByZXR1cm4gbnVsbFxuICB9XG5cbiAgaWYgKGdhdGUua2luZCA9PT0gJ25lZWRzLWNvbmZpcm0nKSB7XG4gICAgcmV0dXJuIChcbiAgICAgIDxVbHRyYXJldmlld092ZXJhZ2VEaWFsb2dcbiAgICAgICAgb25Qcm9jZWVkPXthc3luYyBzaWduYWwgPT4ge1xuICAgICAgICAgIGF3YWl0IGxhdW5jaEFuZERvbmUoXG4gICAgICAgICAgICBhcmdzLFxuICAgICAgICAgICAgY29udGV4dCxcbiAgICAgICAgICAgIG9uRG9uZSxcbiAgICAgICAgICAgICcgVGhpcyByZXZpZXcgYmlsbHMgYXMgRXh0cmEgVXNhZ2UuJyxcbiAgICAgICAgICAgIHNpZ25hbCxcbiAgICAgICAgICApXG4gICAgICAgICAgLy8gT25seSBwZXJzaXN0IHRoZSBjb25maXJtYXRpb24gZmxhZyBhZnRlciBhIG5vbi1hYm9ydGVkIGxhdW5jaCDigJRcbiAgICAgICAgICAvLyBvdGhlcndpc2UgRXNjYXBlLWR1cmluZy1sYXVuY2ggd291bGQgbGVhdmUgdGhlIGZsYWcgc2V0IGFuZFxuICAgICAgICAgIC8vIHNraXAgdGhpcyBkaWFsb2cgb24gdGhlIG5leHQgYXR0ZW1wdC5cbiAgICAgICAgICBpZiAoIXNpZ25hbC5hYm9ydGVkKSBjb25maXJtT3ZlcmFnZSgpXG4gICAgICAgIH19XG4gICAgICAgIG9uQ2FuY2VsPXsoKSA9PiBvbkRvbmUoJ1VsdHJhcmV2aWV3IGNhbmNlbGxlZC4nLCB7IGRpc3BsYXk6ICdzeXN0ZW0nIH0pfVxuICAgICAgLz5cbiAgICApXG4gIH1cblxuICAvLyBnYXRlLmtpbmQgPT09ICdwcm9jZWVkJ1xuICBhd2FpdCBsYXVuY2hBbmREb25lKGFyZ3MsIGNvbnRleHQsIG9uRG9uZSwgZ2F0ZS5iaWxsaW5nTm90ZSlcbiAgcmV0dXJuIG51bGxcbn1cbiJdLCJtYXBwaW5ncyI6IkFBQUEsY0FBY0EsaUJBQWlCLFFBQVEseUNBQXlDO0FBQ2hGLE9BQU9DLEtBQUssTUFBTSxPQUFPO0FBQ3pCLGNBQ0VDLG1CQUFtQixFQUNuQkMscUJBQXFCLFFBQ2hCLHdCQUF3QjtBQUMvQixTQUNFQyxnQkFBZ0IsRUFDaEJDLGNBQWMsRUFDZEMsa0JBQWtCLFFBQ2IsbUJBQW1CO0FBQzFCLFNBQVNDLHdCQUF3QixRQUFRLCtCQUErQjtBQUV4RSxTQUFTQyxxQkFBcUJBLENBQUNDLE1BQU0sRUFBRVQsaUJBQWlCLEVBQUUsQ0FBQyxFQUFFLE1BQU0sQ0FBQztFQUNsRSxPQUFPUyxNQUFNLENBQ1ZDLEdBQUcsQ0FBQ0MsQ0FBQyxJQUFLQSxDQUFDLENBQUNDLElBQUksS0FBSyxNQUFNLEdBQUdELENBQUMsQ0FBQ0UsSUFBSSxHQUFHLEVBQUcsQ0FBQyxDQUMzQ0MsTUFBTSxDQUFDQyxPQUFPLENBQUMsQ0FDZkMsSUFBSSxDQUFDLElBQUksQ0FBQztBQUNmO0FBRUEsZUFBZUMsYUFBYUEsQ0FDMUJDLElBQUksRUFBRSxNQUFNLEVBQ1pDLE9BQU8sRUFBRUMsVUFBVSxDQUFDbEIsbUJBQW1CLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFDM0NtQixNQUFNLEVBQUVsQixxQkFBcUIsRUFDN0JtQixXQUFXLEVBQUUsTUFBTSxFQUNuQkMsTUFBb0IsQ0FBYixFQUFFQyxXQUFXLENBQ3JCLEVBQUVDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztFQUNmLE1BQU1DLE1BQU0sR0FBRyxNQUFNcEIsa0JBQWtCLENBQUNZLElBQUksRUFBRUMsT0FBTyxFQUFFRyxXQUFXLENBQUM7RUFDbkU7RUFDQTtFQUNBO0VBQ0EsSUFBSUMsTUFBTSxFQUFFSSxPQUFPLEVBQUU7RUFDckIsSUFBSUQsTUFBTSxFQUFFO0lBQ1ZMLE1BQU0sQ0FBQ2IscUJBQXFCLENBQUNrQixNQUFNLENBQUMsRUFBRTtNQUFFRSxXQUFXLEVBQUU7SUFBSyxDQUFDLENBQUM7RUFDOUQsQ0FBQyxNQUFNO0lBQ0w7SUFDQTtJQUNBO0lBQ0FQLE1BQU0sQ0FDSixrR0FBa0csRUFDbEc7TUFBRVEsT0FBTyxFQUFFO0lBQVMsQ0FDdEIsQ0FBQztFQUNIO0FBQ0Y7QUFFQSxPQUFPLE1BQU1DLElBQUksRUFBRTVCLG1CQUFtQixHQUFHLE1BQUE0QixDQUFPVCxNQUFNLEVBQUVGLE9BQU8sRUFBRUQsSUFBSSxLQUFLO0VBQ3hFLE1BQU1hLElBQUksR0FBRyxNQUFNM0IsZ0JBQWdCLENBQUMsQ0FBQztFQUVyQyxJQUFJMkIsSUFBSSxDQUFDQyxJQUFJLEtBQUssYUFBYSxFQUFFO0lBQy9CWCxNQUFNLENBQ0osK0ZBQStGLEVBQy9GO01BQUVRLE9BQU8sRUFBRTtJQUFTLENBQ3RCLENBQUM7SUFDRCxPQUFPLElBQUk7RUFDYjtFQUVBLElBQUlFLElBQUksQ0FBQ0MsSUFBSSxLQUFLLGFBQWEsRUFBRTtJQUMvQlgsTUFBTSxDQUNKLDJDQUEyQ1UsSUFBSSxDQUFDRSxTQUFTLENBQUNDLE9BQU8sQ0FBQyxDQUFDLENBQUMsd0VBQXdFLEVBQzVJO01BQUVMLE9BQU8sRUFBRTtJQUFTLENBQ3RCLENBQUM7SUFDRCxPQUFPLElBQUk7RUFDYjtFQUVBLElBQUlFLElBQUksQ0FBQ0MsSUFBSSxLQUFLLGVBQWUsRUFBRTtJQUNqQyxPQUNFLENBQUMsd0JBQXdCLENBQ3ZCLFNBQVMsQ0FBQyxDQUFDLE1BQU1ULE1BQU0sSUFBSTtNQUN6QixNQUFNTixhQUFhLENBQ2pCQyxJQUFJLEVBQ0pDLE9BQU8sRUFDUEUsTUFBTSxFQUNOLG9DQUFvQyxFQUNwQ0UsTUFDRixDQUFDO01BQ0Q7TUFDQTtNQUNBO01BQ0EsSUFBSSxDQUFDQSxNQUFNLENBQUNJLE9BQU8sRUFBRXRCLGNBQWMsQ0FBQyxDQUFDO0lBQ3ZDLENBQUMsQ0FBQyxDQUNGLFFBQVEsQ0FBQyxDQUFDLE1BQU1nQixNQUFNLENBQUMsd0JBQXdCLEVBQUU7TUFBRVEsT0FBTyxFQUFFO0lBQVMsQ0FBQyxDQUFDLENBQUMsR0FDeEU7RUFFTjs7RUFFQTtFQUNBLE1BQU1aLGFBQWEsQ0FBQ0MsSUFBSSxFQUFFQyxPQUFPLEVBQUVFLE1BQU0sRUFBRVUsSUFBSSxDQUFDVCxXQUFXLENBQUM7RUFDNUQsT0FBTyxJQUFJO0FBQ2IsQ0FBQyIsImlnbm9yZUxpc3QiOltdfQ==

package/src/commands/review/ultrareviewEnabled.ts

@@ -0,0 +1,14 @@
+import { getFeatureValue_CACHED_MAY_BE_STALE } from '../../services/analytics/growthbook.js'
+
+/**
+ * Runtime gate for /ultrareview. GB config's `enabled` field controls
+ * visibility — isEnabled() on the command filters it from getCommands()
+ * when false, so ungated users don't see the command at all.
+ */
+export function isUltrareviewEnabled(): boolean {
+  const cfg = getFeatureValue_CACHED_MAY_BE_STALE<Record<
+    string,
+    unknown
+  > | null>('tengu_review_bughunter_config', null)
+  return cfg?.enabled === true
+}

package/src/commands/review.ts

@@ -0,0 +1,57 @@
+import type { ContentBlockParam } from '@anthropic-ai/sdk/resources/messages.js'
+import type { Command } from '../commands.js'
+import { isUltrareviewEnabled } from './review/ultrareviewEnabled.js'
+
+// Legal wants the explicit surface name plus a docs link visible before the
+// user triggers, so the description carries "Claude Code on the web" + URL.
+const CCR_TERMS_URL = 'https://code.claude.com/docs/en/claude-code-on-the-web'
+
+const LOCAL_REVIEW_PROMPT = (args: string) => `
+      You are an expert code reviewer. Follow these steps:
+
+      1. If no PR number is provided in the args, run \`gh pr list\` to show open PRs
+      2. If a PR number is provided, run \`gh pr view <number>\` to get PR details
+      3. Run \`gh pr diff <number>\` to get the diff
+      4. Analyze the changes and provide a thorough code review that includes:
+         - Overview of what the PR does
+         - Analysis of code quality and style
+         - Specific suggestions for improvements
+         - Any potential issues or risks
+
+      Keep your review concise but thorough. Focus on:
+      - Code correctness
+      - Following project conventions
+      - Performance implications
+      - Test coverage
+      - Security considerations
+
+      Format your review with clear sections and bullet points.
+
+      PR number: ${args}
+    `
+
+const review: Command = {
+  type: 'prompt',
+  name: 'review',
+  description: 'Review a pull request',
+  progressMessage: 'reviewing pull request',
+  contentLength: 0,
+  source: 'builtin',
+  async getPromptForCommand(args): Promise<ContentBlockParam[]> {
+    return [{ type: 'text', text: LOCAL_REVIEW_PROMPT(args) }]
+  },
+}
+
+// /ultrareview is the ONLY entry point to the remote bughunter path —
+// /review stays purely local. local-jsx type renders the overage permission
+// dialog when free reviews are exhausted.
+const ultrareview: Command = {
+  type: 'local-jsx',
+  name: 'ultrareview',
+  description: `~10–20 min · Finds and verifies bugs in your branch. Runs in Claude Code on the web. See ${CCR_TERMS_URL}`,
+  isEnabled: () => isUltrareviewEnabled(),
+  load: () => import('./review/ultrareviewCommand.js'),
+}
+
+export default review
+export { ultrareview }

package/src/commands/rewind/index.ts

@@ -0,0 +1,13 @@
+import type { Command } from '../../commands.js'
+
+const rewind = {
+  description: `Restore the code and/or conversation to a previous point`,
+  name: 'rewind',
+  aliases: ['checkpoint'],
+  argumentHint: '',
+  type: 'local',
+  supportsNonInteractive: false,
+  load: () => import('./rewind.js'),
+} satisfies Command
+
+export default rewind

package/src/commands/rewind/rewind.ts

@@ -0,0 +1,13 @@
+import type { LocalCommandResult } from '../../commands.js'
+import type { ToolUseContext } from '../../Tool.js'
+
+export async function call(
+  _args: string,
+  context: ToolUseContext,
+): Promise<LocalCommandResult> {
+  if (context.openMessageSelector) {
+    context.openMessageSelector()
+  }
+  // Return a skip message to not append any messages.
+  return { type: 'skip' }
+}

package/src/commands/sandbox-toggle/index.ts

@@ -0,0 +1,50 @@
+import figures from 'figures'
+import type { Command } from '../../commands.js'
+import { SandboxManager } from '../../utils/sandbox/sandbox-adapter.js'
+
+const command = {
+  name: 'sandbox',
+  get description() {
+    const currentlyEnabled = SandboxManager.isSandboxingEnabled()
+    const autoAllow = SandboxManager.isAutoAllowBashIfSandboxedEnabled()
+    const allowUnsandboxed = SandboxManager.areUnsandboxedCommandsAllowed()
+    const isLocked = SandboxManager.areSandboxSettingsLockedByPolicy()
+    const hasDeps = SandboxManager.checkDependencies().errors.length === 0
+
+    // Show warning icon if dependencies missing, otherwise enabled/disabled status
+    let icon: string
+    if (!hasDeps) {
+      icon = figures.warning
+    } else {
+      icon = currentlyEnabled ? figures.tick : figures.circle
+    }
+
+    let statusText = 'sandbox disabled'
+    if (currentlyEnabled) {
+      statusText = autoAllow
+        ? 'sandbox enabled (auto-allow)'
+        : 'sandbox enabled'
+
+      // Add unsandboxed fallback status
+      statusText += allowUnsandboxed ? ', fallback allowed' : ''
+    }
+
+    if (isLocked) {
+      statusText += ' (managed)'
+    }
+
+    return `${icon} ${statusText} (⏎ to configure)`
+  },
+  argumentHint: 'exclude "command pattern"',
+  get isHidden() {
+    return (
+      !SandboxManager.isSupportedPlatform() ||
+      !SandboxManager.isPlatformInEnabledList()
+    )
+  },
+  immediate: true,
+  type: 'local-jsx',
+  load: () => import('./sandbox-toggle.js'),
+} satisfies Command
+
+export default command

package/src/commands/sandbox-toggle/sandbox-toggle.tsx

@@ -0,0 +1,83 @@
+import { relative } from 'path';
+import React from 'react';
+import { getCwdState } from '../../bootstrap/state.js';
+import { SandboxSettings } from '../../components/sandbox/SandboxSettings.js';
+import { color } from '../../ink.js';
+import { getPlatform } from '../../utils/platform.js';
+import { addToExcludedCommands, SandboxManager } from '../../utils/sandbox/sandbox-adapter.js';
+import { getSettings_DEPRECATED, getSettingsFilePathForSource } from '../../utils/settings/settings.js';
+import type { ThemeName } from '../../utils/theme.js';
+export async function call(onDone: (result?: string) => void, _context: unknown, args?: string): Promise<React.ReactNode | null> {
+  const settings = getSettings_DEPRECATED();
+  const themeName: ThemeName = settings.theme as ThemeName || 'light';
+  const platform = getPlatform();
+  if (!SandboxManager.isSupportedPlatform()) {
+    // WSL1 users will see this since isSupportedPlatform returns false for WSL1
+    const errorMessage = platform === 'wsl' ? 'Error: Sandboxing requires WSL2. WSL1 is not supported.' : 'Error: Sandboxing is currently only supported on macOS, Linux, and WSL2.';
+    const message = color('error', themeName)(errorMessage);
+    onDone(message);
+    return null;
+  }
+
+  // Check dependencies - get structured result with errors/warnings
+  const depCheck = SandboxManager.checkDependencies();
+
+  // Check if platform is in enabledPlatforms list (undocumented enterprise setting)
+  if (!SandboxManager.isPlatformInEnabledList()) {
+    const message = color('error', themeName)(`Error: Sandboxing is disabled for this platform (${platform}) via the enabledPlatforms setting.`);
+    onDone(message);
+    return null;
+  }
+
+  // Check if sandbox settings are locked by higher-priority settings
+  if (SandboxManager.areSandboxSettingsLockedByPolicy()) {
+    const message = color('error', themeName)('Error: Sandbox settings are overridden by a higher-priority configuration and cannot be changed locally.');
+    onDone(message);
+    return null;
+  }
+
+  // Parse the arguments
+  const trimmedArgs = args?.trim() || '';
+
+  // If no args, show the interactive menu
+  if (!trimmedArgs) {
+    return <SandboxSettings onComplete={onDone} depCheck={depCheck} />;
+  }
+
+  // Handle subcommands
+  if (trimmedArgs) {
+    const parts = trimmedArgs.split(' ');
+    const subcommand = parts[0];
+    if (subcommand === 'exclude') {
+      // Handle exclude subcommand
+      const commandPattern = trimmedArgs.slice('exclude '.length).trim();
+      if (!commandPattern) {
+        const message = color('error', themeName)('Error: Please provide a command pattern to exclude (e.g., /sandbox exclude "npm run test:*")');
+        onDone(message);
+        return null;
+      }
+
+      // Remove quotes if present
+      const cleanPattern = commandPattern.replace(/^["']|["']$/g, '');
+
+      // Add to excludedCommands
+      addToExcludedCommands(cleanPattern);
+
+      // Get the local settings path and make it relative to cwd
+      const localSettingsPath = getSettingsFilePathForSource('localSettings');
+      const relativePath = localSettingsPath ? relative(getCwdState(), localSettingsPath) : '.claude/settings.local.json';
+      const message = color('success', themeName)(`Added "${cleanPattern}" to excluded commands in ${relativePath}`);
+      onDone(message);
+      return null;
+    } else {
+      // Unknown subcommand
+      const message = color('error', themeName)(`Error: Unknown subcommand "${subcommand}". Available subcommand: exclude`);
+      onDone(message);
+      return null;
+    }
+  }
+
+  // Should never reach here since we handle all cases above
+  return null;
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJyZWxhdGl2ZSIsIlJlYWN0IiwiZ2V0Q3dkU3RhdGUiLCJTYW5kYm94U2V0dGluZ3MiLCJjb2xvciIsImdldFBsYXRmb3JtIiwiYWRkVG9FeGNsdWRlZENvbW1hbmRzIiwiU2FuZGJveE1hbmFnZXIiLCJnZXRTZXR0aW5nc19ERVBSRUNBVEVEIiwiZ2V0U2V0dGluZ3NGaWxlUGF0aEZvclNvdXJjZSIsIlRoZW1lTmFtZSIsImNhbGwiLCJvbkRvbmUiLCJyZXN1bHQiLCJfY29udGV4dCIsImFyZ3MiLCJQcm9taXNlIiwiUmVhY3ROb2RlIiwic2V0dGluZ3MiLCJ0aGVtZU5hbWUiLCJ0aGVtZSIsInBsYXRmb3JtIiwiaXNTdXBwb3J0ZWRQbGF0Zm9ybSIsImVycm9yTWVzc2FnZSIsIm1lc3NhZ2UiLCJkZXBDaGVjayIsImNoZWNrRGVwZW5kZW5jaWVzIiwiaXNQbGF0Zm9ybUluRW5hYmxlZExpc3QiLCJhcmVTYW5kYm94U2V0dGluZ3NMb2NrZWRCeVBvbGljeSIsInRyaW1tZWRBcmdzIiwidHJpbSIsInBhcnRzIiwic3BsaXQiLCJzdWJjb21tYW5kIiwiY29tbWFuZFBhdHRlcm4iLCJzbGljZSIsImxlbmd0aCIsImNsZWFuUGF0dGVybiIsInJlcGxhY2UiLCJsb2NhbFNldHRpbmdzUGF0aCIsInJlbGF0aXZlUGF0aCJdLCJzb3VyY2VzIjpbInNhbmRib3gtdG9nZ2xlLnRzeCJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyByZWxhdGl2ZSB9IGZyb20gJ3BhdGgnXG5pbXBvcnQgUmVhY3QgZnJvbSAncmVhY3QnXG5pbXBvcnQgeyBnZXRDd2RTdGF0ZSB9IGZyb20gJy4uLy4uL2Jvb3RzdHJhcC9zdGF0ZS5qcydcbmltcG9ydCB7IFNhbmRib3hTZXR0aW5ncyB9IGZyb20gJy4uLy4uL2NvbXBvbmVudHMvc2FuZGJveC9TYW5kYm94U2V0dGluZ3MuanMnXG5pbXBvcnQgeyBjb2xvciB9IGZyb20gJy4uLy4uL2luay5qcydcbmltcG9ydCB7IGdldFBsYXRmb3JtIH0gZnJvbSAnLi4vLi4vdXRpbHMvcGxhdGZvcm0uanMnXG5pbXBvcnQge1xuICBhZGRUb0V4Y2x1ZGVkQ29tbWFuZHMsXG4gIFNhbmRib3hNYW5hZ2VyLFxufSBmcm9tICcuLi8uLi91dGlscy9zYW5kYm94L3NhbmRib3gtYWRhcHRlci5qcydcbmltcG9ydCB7XG4gIGdldFNldHRpbmdzX0RFUFJFQ0FURUQsXG4gIGdldFNldHRpbmdzRmlsZVBhdGhGb3JTb3VyY2UsXG59IGZyb20gJy4uLy4uL3V0aWxzL3NldHRpbmdzL3NldHRpbmdzLmpzJ1xuaW1wb3J0IHR5cGUgeyBUaGVtZU5hbWUgfSBmcm9tICcuLi8uLi91dGlscy90aGVtZS5qcydcblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGNhbGwoXG4gIG9uRG9uZTogKHJlc3VsdD86IHN0cmluZykgPT4gdm9pZCxcbiAgX2NvbnRleHQ6IHVua25vd24sXG4gIGFyZ3M/OiBzdHJpbmcsXG4pOiBQcm9taXNlPFJlYWN0LlJlYWN0Tm9kZSB8IG51bGw+IHtcbiAgY29uc3Qgc2V0dGluZ3MgPSBnZXRTZXR0aW5nc19ERVBSRUNBVEVEKClcbiAgY29uc3QgdGhlbWVOYW1lOiBUaGVtZU5hbWUgPSAoc2V0dGluZ3MudGhlbWUgYXMgVGhlbWVOYW1lKSB8fCAnbGlnaHQnXG5cbiAgY29uc3QgcGxhdGZvcm0gPSBnZXRQbGF0Zm9ybSgpXG5cbiAgaWYgKCFTYW5kYm94TWFuYWdlci5pc1N1cHBvcnRlZFBsYXRmb3JtKCkpIHtcbiAgICAvLyBXU0wxIHVzZXJzIHdpbGwgc2VlIHRoaXMgc2luY2UgaXNTdXBwb3J0ZWRQbGF0Zm9ybSByZXR1cm5zIGZhbHNlIGZvciBXU0wxXG4gICAgY29uc3QgZXJyb3JNZXNzYWdlID1cbiAgICAgIHBsYXRmb3JtID09PSAnd3NsJ1xuICAgICAgICA/ICdFcnJvcjogU2FuZGJveGluZyByZXF1aXJlcyBXU0wyLiBXU0wxIGlzIG5vdCBzdXBwb3J0ZWQuJ1xuICAgICAgICA6ICdFcnJvcjogU2FuZGJveGluZyBpcyBjdXJyZW50bHkgb25seSBzdXBwb3J0ZWQgb24gbWFjT1MsIExpbnV4LCBhbmQgV1NMMi4nXG4gICAgY29uc3QgbWVzc2FnZSA9IGNvbG9yKCdlcnJvcicsIHRoZW1lTmFtZSkoZXJyb3JNZXNzYWdlKVxuICAgIG9uRG9uZShtZXNzYWdlKVxuICAgIHJldHVybiBudWxsXG4gIH1cblxuICAvLyBDaGVjayBkZXBlbmRlbmNpZXMgLSBnZXQgc3RydWN0dXJlZCByZXN1bHQgd2l0aCBlcnJvcnMvd2FybmluZ3NcbiAgY29uc3QgZGVwQ2hlY2sgPSBTYW5kYm94TWFuYWdlci5jaGVja0RlcGVuZGVuY2llcygpXG5cbiAgLy8gQ2hlY2sgaWYgcGxhdGZvcm0gaXMgaW4gZW5hYmxlZFBsYXRmb3JtcyBsaXN0ICh1bmRvY3VtZW50ZWQgZW50ZXJwcmlzZSBzZXR0aW5nKVxuICBpZiAoIVNhbmRib3hNYW5hZ2VyLmlzUGxhdGZvcm1JbkVuYWJsZWRMaXN0KCkpIHtcbiAgICBjb25zdCBtZXNzYWdlID0gY29sb3IoXG4gICAgICAnZXJyb3InLFxuICAgICAgdGhlbWVOYW1lLFxuICAgICkoXG4gICAgICBgRXJyb3I6IFNhbmRib3hpbmcgaXMgZGlzYWJsZWQgZm9yIHRoaXMgcGxhdGZvcm0gKCR7cGxhdGZvcm19KSB2aWEgdGhlIGVuYWJsZWRQbGF0Zm9ybXMgc2V0dGluZy5gLFxuICAgIClcbiAgICBvbkRvbmUobWVzc2FnZSlcbiAgICByZXR1cm4gbnVsbFxuICB9XG5cbiAgLy8gQ2hlY2sgaWYgc2FuZGJveCBzZXR0aW5ncyBhcmUgbG9ja2VkIGJ5IGhpZ2hlci1wcmlvcml0eSBzZXR0aW5nc1xuICBpZiAoU2FuZGJveE1hbmFnZXIuYXJlU2FuZGJveFNldHRpbmdzTG9ja2VkQnlQb2xpY3koKSkge1xuICAgIGNvbnN0IG1lc3NhZ2UgPSBjb2xvcihcbiAgICAgICdlcnJvcicsXG4gICAgICB0aGVtZU5hbWUsXG4gICAgKShcbiAgICAgICdFcnJvcjogU2FuZGJveCBzZXR0aW5ncyBhcmUgb3ZlcnJpZGRlbiBieSBhIGhpZ2hlci1wcmlvcml0eSBjb25maWd1cmF0aW9uIGFuZCBjYW5ub3QgYmUgY2hhbmdlZCBsb2NhbGx5LicsXG4gICAgKVxuICAgIG9uRG9uZShtZXNzYWdlKVxuICAgIHJldHVybiBudWxsXG4gIH1cblxuICAvLyBQYXJzZSB0aGUgYXJndW1lbnRzXG4gIGNvbnN0IHRyaW1tZWRBcmdzID0gYXJncz8udHJpbSgpIHx8ICcnXG5cbiAgLy8gSWYgbm8gYXJncywgc2hvdyB0aGUgaW50ZXJhY3RpdmUgbWVudVxuICBpZiAoIXRyaW1tZWRBcmdzKSB7XG4gICAgcmV0dXJuIDxTYW5kYm94U2V0dGluZ3Mgb25Db21wbGV0ZT17b25Eb25lfSBkZXBDaGVjaz17ZGVwQ2hlY2t9IC8+XG4gIH1cblxuICAvLyBIYW5kbGUgc3ViY29tbWFuZHNcbiAgaWYgKHRyaW1tZWRBcmdzKSB7XG4gICAgY29uc3QgcGFydHMgPSB0cmltbWVkQXJncy5zcGxpdCgnICcpXG4gICAgY29uc3Qgc3ViY29tbWFuZCA9IHBhcnRzWzBdXG5cbiAgICBpZiAoc3ViY29tbWFuZCA9PT0gJ2V4Y2x1ZGUnKSB7XG4gICAgICAvLyBIYW5kbGUgZXhjbHVkZSBzdWJjb21tYW5kXG4gICAgICBjb25zdCBjb21tYW5kUGF0dGVybiA9IHRyaW1tZWRBcmdzLnNsaWNlKCdleGNsdWRlICcubGVuZ3RoKS50cmltKClcblxuICAgICAgaWYgKCFjb21tYW5kUGF0dGVybikge1xuICAgICAgICBjb25zdCBtZXNzYWdlID0gY29sb3IoXG4gICAgICAgICAgJ2Vycm9yJyxcbiAgICAgICAgICB0aGVtZU5hbWUsXG4gICAgICAgICkoXG4gICAgICAgICAgJ0Vycm9yOiBQbGVhc2UgcHJvdmlkZSBhIGNvbW1hbmQgcGF0dGVybiB0byBleGNsdWRlIChlLmcuLCAvc2FuZGJveCBleGNsdWRlIFwibnBtIHJ1biB0ZXN0OipcIiknLFxuICAgICAgICApXG4gICAgICAgIG9uRG9uZShtZXNzYWdlKVxuICAgICAgICByZXR1cm4gbnVsbFxuICAgICAgfVxuXG4gICAgICAvLyBSZW1vdmUgcXVvdGVzIGlmIHByZXNlbnRcbiAgICAgIGNvbnN0IGNsZWFuUGF0dGVybiA9IGNvbW1hbmRQYXR0ZXJuLnJlcGxhY2UoL15bXCInXXxbXCInXSQvZywgJycpXG5cbiAgICAgIC8vIEFkZCB0byBleGNsdWRlZENvbW1hbmRzXG4gICAgICBhZGRUb0V4Y2x1ZGVkQ29tbWFuZHMoY2xlYW5QYXR0ZXJuKVxuXG4gICAgICAvLyBHZXQgdGhlIGxvY2FsIHNldHRpbmdzIHBhdGggYW5kIG1ha2UgaXQgcmVsYXRpdmUgdG8gY3dkXG4gICAgICBjb25zdCBsb2NhbFNldHRpbmdzUGF0aCA9IGdldFNldHRpbmdzRmlsZVBhdGhGb3JTb3VyY2UoJ2xvY2FsU2V0dGluZ3MnKVxuICAgICAgY29uc3QgcmVsYXRpdmVQYXRoID0gbG9jYWxTZXR0aW5nc1BhdGhcbiAgICAgICAgPyByZWxhdGl2ZShnZXRDd2RTdGF0ZSgpLCBsb2NhbFNldHRpbmdzUGF0aClcbiAgICAgICAgOiAnLmNsYXVkZS9zZXR0aW5ncy5sb2NhbC5qc29uJ1xuXG4gICAgICBjb25zdCBtZXNzYWdlID0gY29sb3IoXG4gICAgICAgICdzdWNjZXNzJyxcbiAgICAgICAgdGhlbWVOYW1lLFxuICAgICAgKShgQWRkZWQgXCIke2NsZWFuUGF0dGVybn1cIiB0byBleGNsdWRlZCBjb21tYW5kcyBpbiAke3JlbGF0aXZlUGF0aH1gKVxuXG4gICAgICBvbkRvbmUobWVzc2FnZSlcbiAgICAgIHJldHVybiBudWxsXG4gICAgfSBlbHNlIHtcbiAgICAgIC8vIFVua25vd24gc3ViY29tbWFuZFxuICAgICAgY29uc3QgbWVzc2FnZSA9IGNvbG9yKFxuICAgICAgICAnZXJyb3InLFxuICAgICAgICB0aGVtZU5hbWUsXG4gICAgICApKFxuICAgICAgICBgRXJyb3I6IFVua25vd24gc3ViY29tbWFuZCBcIiR7c3ViY29tbWFuZH1cIi4gQXZhaWxhYmxlIHN1YmNvbW1hbmQ6IGV4Y2x1ZGVgLFxuICAgICAgKVxuICAgICAgb25Eb25lKG1lc3NhZ2UpXG4gICAgICByZXR1cm4gbnVsbFxuICAgIH1cbiAgfVxuXG4gIC8vIFNob3VsZCBuZXZlciByZWFjaCBoZXJlIHNpbmNlIHdlIGhhbmRsZSBhbGwgY2FzZXMgYWJvdmVcbiAgcmV0dXJuIG51bGxcbn1cbiJdLCJtYXBwaW5ncyI6IkFBQUEsU0FBU0EsUUFBUSxRQUFRLE1BQU07QUFDL0IsT0FBT0MsS0FBSyxNQUFNLE9BQU87QUFDekIsU0FBU0MsV0FBVyxRQUFRLDBCQUEwQjtBQUN0RCxTQUFTQyxlQUFlLFFBQVEsNkNBQTZDO0FBQzdFLFNBQVNDLEtBQUssUUFBUSxjQUFjO0FBQ3BDLFNBQVNDLFdBQVcsUUFBUSx5QkFBeUI7QUFDckQsU0FDRUMscUJBQXFCLEVBQ3JCQyxjQUFjLFFBQ1Qsd0NBQXdDO0FBQy9DLFNBQ0VDLHNCQUFzQixFQUN0QkMsNEJBQTRCLFFBQ3ZCLGtDQUFrQztBQUN6QyxjQUFjQyxTQUFTLFFBQVEsc0JBQXNCO0FBRXJELE9BQU8sZUFBZUMsSUFBSUEsQ0FDeEJDLE1BQU0sRUFBRSxDQUFDQyxNQUFlLENBQVIsRUFBRSxNQUFNLEVBQUUsR0FBRyxJQUFJLEVBQ2pDQyxRQUFRLEVBQUUsT0FBTyxFQUNqQkMsSUFBYSxDQUFSLEVBQUUsTUFBTSxDQUNkLEVBQUVDLE9BQU8sQ0FBQ2YsS0FBSyxDQUFDZ0IsU0FBUyxHQUFHLElBQUksQ0FBQyxDQUFDO0VBQ2pDLE1BQU1DLFFBQVEsR0FBR1Ysc0JBQXNCLENBQUMsQ0FBQztFQUN6QyxNQUFNVyxTQUFTLEVBQUVULFNBQVMsR0FBSVEsUUFBUSxDQUFDRSxLQUFLLElBQUlWLFNBQVMsSUFBSyxPQUFPO0VBRXJFLE1BQU1XLFFBQVEsR0FBR2hCLFdBQVcsQ0FBQyxDQUFDO0VBRTlCLElBQUksQ0FBQ0UsY0FBYyxDQUFDZSxtQkFBbUIsQ0FBQyxDQUFDLEVBQUU7SUFDekM7SUFDQSxNQUFNQyxZQUFZLEdBQ2hCRixRQUFRLEtBQUssS0FBSyxHQUNkLHlEQUF5RCxHQUN6RCwwRUFBMEU7SUFDaEYsTUFBTUcsT0FBTyxHQUFHcEIsS0FBSyxDQUFDLE9BQU8sRUFBRWUsU0FBUyxDQUFDLENBQUNJLFlBQVksQ0FBQztJQUN2RFgsTUFBTSxDQUFDWSxPQUFPLENBQUM7SUFDZixPQUFPLElBQUk7RUFDYjs7RUFFQTtFQUNBLE1BQU1DLFFBQVEsR0FBR2xCLGNBQWMsQ0FBQ21CLGlCQUFpQixDQUFDLENBQUM7O0VBRW5EO0VBQ0EsSUFBSSxDQUFDbkIsY0FBYyxDQUFDb0IsdUJBQXVCLENBQUMsQ0FBQyxFQUFFO0lBQzdDLE1BQU1ILE9BQU8sR0FBR3BCLEtBQUssQ0FDbkIsT0FBTyxFQUNQZSxTQUNGLENBQUMsQ0FDQyxvREFBb0RFLFFBQVEscUNBQzlELENBQUM7SUFDRFQsTUFBTSxDQUFDWSxPQUFPLENBQUM7SUFDZixPQUFPLElBQUk7RUFDYjs7RUFFQTtFQUNBLElBQUlqQixjQUFjLENBQUNxQixnQ0FBZ0MsQ0FBQyxDQUFDLEVBQUU7SUFDckQsTUFBTUosT0FBTyxHQUFHcEIsS0FBSyxDQUNuQixPQUFPLEVBQ1BlLFNBQ0YsQ0FBQyxDQUNDLDBHQUNGLENBQUM7SUFDRFAsTUFBTSxDQUFDWSxPQUFPLENBQUM7SUFDZixPQUFPLElBQUk7RUFDYjs7RUFFQTtFQUNBLE1BQU1LLFdBQVcsR0FBR2QsSUFBSSxFQUFFZSxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUU7O0VBRXRDO0VBQ0EsSUFBSSxDQUFDRCxXQUFXLEVBQUU7SUFDaEIsT0FBTyxDQUFDLGVBQWUsQ0FBQyxVQUFVLENBQUMsQ0FBQ2pCLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDYSxRQUFRLENBQUMsR0FBRztFQUNwRTs7RUFFQTtFQUNBLElBQUlJLFdBQVcsRUFBRTtJQUNmLE1BQU1FLEtBQUssR0FBR0YsV0FBVyxDQUFDRyxLQUFLLENBQUMsR0FBRyxDQUFDO0lBQ3BDLE1BQU1DLFVBQVUsR0FBR0YsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUUzQixJQUFJRSxVQUFVLEtBQUssU0FBUyxFQUFFO01BQzVCO01BQ0EsTUFBTUMsY0FBYyxHQUFHTCxXQUFXLENBQUNNLEtBQUssQ0FBQyxVQUFVLENBQUNDLE1BQU0sQ0FBQyxDQUFDTixJQUFJLENBQUMsQ0FBQztNQUVsRSxJQUFJLENBQUNJLGNBQWMsRUFBRTtRQUNuQixNQUFNVixPQUFPLEdBQUdwQixLQUFLLENBQ25CLE9BQU8sRUFDUGUsU0FDRixDQUFDLENBQ0MsOEZBQ0YsQ0FBQztRQUNEUCxNQUFNLENBQUNZLE9BQU8sQ0FBQztRQUNmLE9BQU8sSUFBSTtNQUNiOztNQUVBO01BQ0EsTUFBTWEsWUFBWSxHQUFHSCxjQUFjLENBQUNJLE9BQU8sQ0FBQyxjQUFjLEVBQUUsRUFBRSxDQUFDOztNQUUvRDtNQUNBaEMscUJBQXFCLENBQUMrQixZQUFZLENBQUM7O01BRW5DO01BQ0EsTUFBTUUsaUJBQWlCLEdBQUc5Qiw0QkFBNEIsQ0FBQyxlQUFlLENBQUM7TUFDdkUsTUFBTStCLFlBQVksR0FBR0QsaUJBQWlCLEdBQ2xDdkMsUUFBUSxDQUFDRSxXQUFXLENBQUMsQ0FBQyxFQUFFcUMsaUJBQWlCLENBQUMsR0FDMUMsNkJBQTZCO01BRWpDLE1BQU1mLE9BQU8sR0FBR3BCLEtBQUssQ0FDbkIsU0FBUyxFQUNUZSxTQUNGLENBQUMsQ0FBQyxVQUFVa0IsWUFBWSw2QkFBNkJHLFlBQVksRUFBRSxDQUFDO01BRXBFNUIsTUFBTSxDQUFDWSxPQUFPLENBQUM7TUFDZixPQUFPLElBQUk7SUFDYixDQUFDLE1BQU07TUFDTDtNQUNBLE1BQU1BLE9BQU8sR0FBR3BCLEtBQUssQ0FDbkIsT0FBTyxFQUNQZSxTQUNGLENBQUMsQ0FDQyw4QkFBOEJjLFVBQVUsa0NBQzFDLENBQUM7TUFDRHJCLE1BQU0sQ0FBQ1ksT0FBTyxDQUFDO01BQ2YsT0FBTyxJQUFJO0lBQ2I7RUFDRjs7RUFFQTtFQUNBLE9BQU8sSUFBSTtBQUNiIiwiaWdub3JlTGlzdCI6W119