@zihanw/pi-forge 0.4.0-beta.1 → 0.4.0

package/SUBAGENT_ADAPTER_CONTRACT.md

@@ -1,199 +1,5 @@
-# Subagent Adapter Contract
+# Subagent adapter contract
 
-Status: exported pure contract, host-preparation utilities, optional backend registry, retained `pi-sdk-isolated` compatibility adapter, and a default-approval `pi-subprocess-readonly` foreground path for the 0.4 beta. This is a narrow one-shot delegation boundary, not a background orchestration runner or an OS sandbox.
+The authoritative experimental contract moved to [`docs/reference/subagent-adapter.md`](docs/reference/subagent-adapter.md).
 
-## Public Surface
-
-New integrations should import this experimental 0.4 surface from `@zihanw/pi-forge/subagent`. The package root retains the same exports through the 0.4 prereleases for compatibility. Stability classifications and compatibility-path policy are recorded in [`PUBLIC_API.md`](PUBLIC_API.md).
-
-The package root exports:
-
-- `AgentRequest`, `AgentProfileSnapshot`, `BackendPreflightResult`, `AgentExecutionPlan`, and `AgentResponse`.
-- Granular access, limit, tool, media, context, artifact, trace, usage, and diagnostic types.
-- Host resolution through `resolveSubagentHostProfile()`.
-- Tool negotiation through `negotiateSubagentTools()`.
-- Deterministic context preparation through `budgetSubagentContext()`, `renderSubagentSelectedContext()`, and `prepareSubagentInitialMessages()`.
-- Protected Pi-message helpers used by the SDK spike.
-- Plan construction through `createAgentExecutionPlan()`.
-- Pure request, snapshot, preflight, plan, response, artifact, and trace validators.
-- Canonical `sha256:v1` profile, stack, and execution fingerprints.
-- Optional backend registration, validated dispatch, cancellation/timeout arbitration, response normalization, and authorization-scoped trace routing through `SubagentBackendRegistry`.
-- Experimental `PiSdkIsolatedBackend` compatibility adapter and the default `PiSubprocessBackend`, including their descriptors/IDs, report types, and host preparation through `prepareSubagentHostPlan()`.
-
-The existing `agentProfileFingerprint()` remains unchanged. It is still the legacy JSON provenance value used for branch drift. New portable fingerprints use separately named functions and semantics.
-
-## Required Flow
-
-```text
-AgentRequest
-    -> resolveSubagentHostProfile
-    -> SubagentBackendRegistry discovery/preflight
-    -> registry-mediated exact or backend-assisted preparation
-    -> createAgentExecutionPlan
-    -> registry-validated backend execution
-    -> validateAgentResponse
-```
-
-No stage may substitute parent-runtime model objects, credentials, source file paths, or raw session history for the portable artifacts.
-
-### 1. Request validation
-
-`validateAgentRequest()` checks:
-
-- Schema, IDs, task text/media references, and media digests.
-- Explicit selected-context byte budgets and provenance.
-- Delegation depth.
-- Access-level/workspace/working-directory/network/process combinations.
-- Required versus best-effort hard limits.
-- Result-projection bounds and remote-egress consent.
-
-Media references are opaque host resources with content digests. The contract does not place local absolute paths or media bytes in the portable request.
-
-### 2. Host resolution
-
-`resolveSubagentHostProfile()` performs only backend-independent work:
-
-- Validates the loaded profile and exact prompt-stack reference.
-- Accepts null, default/replace, append, and prepend stack modes.
-- Scans prompt-stack items for custom macro and slot dependencies.
-- Requires those registrations to be loaded before final resolution.
-- Produces a path-free immutable profile snapshot and portable fingerprints.
-
-It deliberately does not inspect a model registry, authentication, backend tools, mounts, or limits. Parent `/profile use` resolution remains separate.
-
-Unknown macro commands and custom slots are treated as missing subagent dependencies. Static stack variables and built-in macros/slots are excluded. Custom registrations without a `source` still resolve but produce a warning because their dependency identity is anonymous.
-
-### 3. Backend preflight
-
-An accepted `BackendPreflightResult` must identify the exact model/thinking level, dynamic tool catalog, granular capabilities, effective access receipt, and accepted limit receipt.
-
-`validateBackendPreflight()` enforces:
-
-- Exact profile model and thinking-level agreement.
-- Explicit consent for remote provider transport.
-- Requested media MIME support.
-- No missing, extra, upgraded, or mode-mismatched mounts.
-- Working-directory containment through backend mount IDs.
-- Read/write, symlink, process, and denied-network enforcement claims.
-- Every required limit uses `backend-hard` enforcement.
-- Best-effort limits are reported honestly, such as Pi SDK host-abort timeouts.
-- Rejected preflight results contain at least one error diagnostic.
-
-Prompt tool filtering is not accepted as an access receipt.
-
-### 4. Tool negotiation
-
-Each backend tool declares a stable backend ID, policy-facing name, and effects:
-
-- `filesystem-read`
-- `filesystem-write`
-- `process`
-- `network`
-
-`negotiateSubagentTools()` applies prompt-stack policy to names, then removes tools whose declared effects exceed request access. Effect-free tools may remain under filesystem access `none`; network and process are independently controlled. Unmatched allow patterns remain warnings.
-
-Adapters must classify tool effects conservatively. A tool with undeclared effects invalidates the backend's enforcement claim even if name filtering succeeds.
-
-### 5. Context and exact preparation
-
-`budgetSubagentContext()` measures the exact UTF-8 bytes of the rendered selected-context envelope. Required items are retained first. Optional items are considered newest-to-oldest without partial item truncation, and returned in original order. Required overflow fails preparation.
-
-`prepareSubagentInitialMessages()` creates:
-
-1. One quoted selected-context message when the budget retains context.
-2. Host-prepared prompt-stack messages.
-3. The complete protected task/media message as the final user message.
-
-Prompt-stack messages cannot claim reserved selected-context or delegated-task markers.
-
-Backends such as Pi SDK may expose exact base-prompt runtime inputs only in a pre-provider hook. They may call the host preparer there, but provider transport must remain blocked until `createAgentExecutionPlan()` succeeds. A `partial` prompt-runtime preflight cannot produce an execution plan.
-
-### 6. Plan and fingerprints
-
-`createAgentExecutionPlan()` revalidates the request, snapshot, preflight, deterministic context receipt, tool negotiation, runtime fidelity, and protected final task. It creates the run ID correlation and execution fingerprint before provider transport.
-
-The execution fingerprint covers all serialized plan fields except itself, including compiled system/messages, profile/stack/dependency provenance, the complete preflight receipt and adapter version, exact model/thinking, effective backend tool IDs, access and limit receipts, prompt-runtime fingerprint, context receipt, and result-projection bound.
-
-Canonical serialization sorts object keys, omits undefined object fields, rejects cycles/non-finite numbers/non-JSON values, preserves array order, and normalizes negative zero.
-
-### 7. Response validation
-
-`validateAgentResponse()` enforces the terminal status matrix:
-
-| Status | Required terminal field | Output rule |
-|---|---|---|
-| `completed` | none | absent or `partial: false` |
-| `failed` | structured `error` | absent or `partial: true` |
-| `cancelled` | `reason` | absent or `partial: true` |
-| `timed-out` | `reason`, `enforcedTimeoutMs` | absent or `partial: true` |
-| `limit-reached` | `reachedLimit` | absent or `partial: true` |
-
-It also validates request/run/backend correlation, model and fingerprints, effective backend tool IDs, backend-produced enforcement receipts, duration, token/cost units, artifact namespaces, relative paths, cleanup ownership, and authorized trace handles. Cost requires an ISO 4217 currency code.
-
-### 8. Optional backend registry
-
-`SubagentBackendRegistry` starts empty and never installs a default backend. It:
-
-- Validates backend descriptors and rejects duplicate identities.
-- Binds accepted preflight IDs to the exact backend, request, and profile fingerprint used during discovery.
-- Routes exact-preflight preparation directly to the host preparer and requires backend-assisted adapters to invoke the same host boundary.
-- Binds the exact runtime fingerprint, compiled system/messages, effective tools, and context receipt returned by host preparation; recomputing an execution fingerprint cannot substitute a different plan.
-- Routes dry-plan discard through the owning backend before forgetting the preflight binding.
-- Rejects malformed, tampered, foreign, or unbound execution plans before transport.
-- Arbitrates backend completion, explicit user cancellation, external abort signals, and declared host-abort timeouts through one terminal result.
-- Discards prepared backend state without invoking execution when cancellation wins before backend dispatch.
-- Normalizes thrown provider failures and malformed backend responses into contract-valid failed responses.
-- Replaces backend-reported duration with host-observed duration.
-- Keeps opaque backend trace IDs behind host-generated handles and enforces authorization scope, backend routing, expiry, and explicit forgetting during inspection.
-- Refuses backend unregistration while an execution remains active or is draining after cancellation.
-
-The registry validates receipts but does not manufacture filesystem, process, network, token, turn, or output isolation. Those remain adapter responsibilities.
-
-Access receipts may explicitly declare `executionBoundary: "shared-user"`. This boundary means the subprocess retains the invoking user's operating-system permissions and its effective access is constrained only by the tools exposed to the model. A shared-user receipt cannot claim mount, symlink, process, or network isolation. Omitting the field preserves the legacy `isolated` interpretation.
-
-### 9. Experimental foreground subprocess and approval path
-
-`PiSubprocessBackend` is the extension's deliberately narrow default adapter:
-
-- It resolves the exact profile model through Pi's existing `ModelRegistry`, reuses the parent Pi 0.80.10 `ModelRuntime` so preparation sees the same authentication, and prepares the exact prompt inside an in-process Pi session held behind a provider gate.
-- After approval, it disposes the preparation session and launches a fresh foreground Pi subprocess with the approved model, thinking level, system prompt, messages, and tool IDs. Pi's ordinary text stdout is drained separately from a dedicated newline-delimited report channel.
-- Its bridge preserves the exact prepared messages and rejects tools outside the approved allowlist. Candidate tools are limited to `read`, `grep`, `find`, and `ls`, then intersected with prompt-stack policy.
-- It loads no write/edit/shell tools, skills, prompt templates, context files, themes, or third-party Pi extensions and writes no child session file.
-- It accepts text-only, one-shot, sequential `read-only` requests rooted at the project working directory, with no process tool and optional host-abort timeout. It advertises no artifact retention or contract trace inspection.
-- It records a bounded foreground execution report containing sanitized transcript events, tool calls/results, usage, stderr, status, and execution identity. Inline images remain available to the child model but cross the report boundary only as MIME/encoded-size metadata. Base64-like text is redacted, individual strings are capped, and retained messages form a 512 KiB rolling tail so large tool histories cannot make the parent TUI/session retain unbounded data. Temporary bridge inputs are mode `0600` and removed during cleanup.
-- Retained textual tool results are ordinary parent-session tool details. `/tree` can move the active branch away from them but does not erase abandoned entries from Pi's on-disk session JSONL; callers handling sensitive files must treat session-data deletion as a separate operation.
-
-This backend declares `executionBoundary: "shared-user"`. It does not create allowed-root mount containment, symlink-safe path containment, process isolation, or agent-network isolation. The subprocess retains the invoking user's OS permissions; `read-only` describes the tools exposed to the model, not a security sandbox. Network is therefore honestly recorded as allowed even though no dedicated network or shell tool is exposed.
-
-The model-callable `forge_subagent_profiles` tool reads the already-loaded host profile catalog without preparing a prompt or contacting a provider. It exposes IDs, names, descriptions, declared model/thinking/stack metadata, ready/unavailable resolution diagnostics, and whether parent policy currently exposes the invocation tool. A restrictive parent stack must allow both `forge_subagent_profiles` and `forge_subagent` for discovery followed by delegation.
-
-The model-callable `forge_subagent` tool and `/forge-agent run` use the same registry path. Both prepare an exact immutable plan while provider transport remains closed. `/forge-agent run` always shows a compact approval summary, allows inspection of the complete prompt, and requires interactive approval bound to the execution fingerprint. The tool does the same by default, but a trusted project may set `subagents.allowAgentInvocationWithoutApproval: true` in `.pi/forge/config.json`; this permits non-UI model invocation and records `trusted-project-config` in the result receipt without weakening preflight or plan binding. Missing, malformed, and untrusted-project settings fail closed. The tool returns bounded content to the parent model and expandable execution details to the human. `/forge-agent plan` still prepares and discards without provider transport; `/forge-agent backends` shows capabilities. The older access-none `PiSdkIsolatedBackend` remains exported and tested for compatibility but is not the extension default.
-
-## Adapter-Enforced Responsibilities
-
-The exported validators cannot create isolation. Every adapter remains responsible for:
-
-- Credential and model availability in its own runtime.
-- Backend-side mount materialization and path canonicalization immediately before access.
-- Symlink-race-safe containment.
-- Process and agent-network isolation.
-- Accurate tool effects and stable tool mappings.
-- Required hard timeout, turn, token, and output limits.
-- Cancellation settlement and cleanup.
-- Media transport and remote-egress behavior.
-- Artifact authorization, retention, and cleanup.
-- Trace storage, authorization, redaction, pagination, and expiry.
-- Returning actual enforcement receipts rather than echoing request fields.
-
-An adapter must reject preflight when it cannot enforce a required field. The retained Pi SDK adapter can execute only access `none`; the subprocess adapter accepts shared-user read-only access and network allow. Both use best-effort host abort rather than a backend-hard timeout. Provider transport is always a separate, explicitly approved egress path.
-
-## Deliberately Not Included
-
-- Filesystem writes, process/shell tools, media input, background runs, or general backend selection/configuration in the shipped path.
-- OS-level filesystem, process, or network sandboxing for the shared-user subprocess.
-- Automatic parent-history/context selection; the delegated task is explicit and starts a clean conversation.
-- Session resume, retries, queues, chains, or pipelines.
-- Artifact/trace storage implementations.
-- Automatic provider fallback.
-
-Those belong to later iterations and cannot be inferred from these pure types alone.
+This compatibility pointer remains at the published root path so existing links continue to work.

package/dist/forge-config.d.ts

@@ -1,8 +1,88 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+/** Backend used when neither a per-run override nor a configured default applies. */
+export declare const DEFAULT_SUBAGENT_BACKEND_ID = "pi-subprocess-readonly";
+/** Preserve the original foreground-run timeout unless the user configures one. */
+export declare const DEFAULT_SUBAGENT_TIMEOUT_MS = 60000;
+export declare const MIN_SUBAGENT_TIMEOUT_MS = 1000;
+export declare const MAX_SUBAGENT_TIMEOUT_MS = 3600000;
+/**
+ * Development/test override for the global config location. Keeps automated
+ * tests hermetic regardless of the developer's real ~/.pi/forge/config.json.
+ * Not part of the supported user-facing configuration surface.
+ */
+export declare const GLOBAL_FORGE_CONFIG_PATH_ENV = "PI_FORGE_GLOBAL_CONFIG_PATH";
+export type ForgeSubagentBackendSource = "explicit" | "project-profile" | "project" | "global" | "built-in";
+export type ForgeSubagentConfigSource = "project" | "global";
+export type ForgeSubagentProfileSource = "project-profile";
+export interface ForgeSubagentProfileSettings {
+    enabled?: boolean;
+    enabledSource?: ForgeSubagentProfileSource;
+    backend?: string;
+    backendSource?: ForgeSubagentProfileSource;
+    timeoutMs?: number;
+    timeoutSource?: ForgeSubagentProfileSource;
+}
 export interface ForgeSubagentSettings {
     allowAgentInvocationWithoutApproval: boolean;
+    /** Configured default backend ID; a trusted project config wins over the global config. */
+    backend?: string;
+    backendSource?: ForgeSubagentConfigSource;
+    /** Best-effort foreground timeout; a trusted project config wins over the global config. */
+    timeoutMs: number;
+    timeoutSource: ForgeSubagentConfigSource | "built-in";
+    /** Per-profile delegation allowlist and execution overrides. Unlisted profiles are not delegatable. */
+    profiles: Record<string, ForgeSubagentProfileSettings>;
     configPath: string;
+    globalConfigPath: string;
     warnings: string[];
 }
+export interface ResolvedSubagentBackend {
+    id: string;
+    source: ForgeSubagentBackendSource;
+}
+export interface ResolvedSubagentTimeout {
+    milliseconds: number;
+    source: Exclude<ForgeSubagentBackendSource, "explicit">;
+}
+export interface ResolvedSubagentProfilePolicy {
+    profileId: string;
+    enabled: boolean;
+    enabledSource: ForgeSubagentProfileSource | "built-in";
+    backend: ResolvedSubagentBackend;
+    timeout: ResolvedSubagentTimeout;
+}
+/**
+ * Resolve the effective backend for one run: explicit per-run override, then
+ * a trusted-project per-profile override, then trusted-project/global defaults,
+ * then the built-in subprocess backend. There is deliberately no fallback when
+ * the resolved backend is missing or rejects the intent.
+ */
+export declare function resolveSubagentBackend(settings: ForgeSubagentSettings, explicitBackend?: string, profileId?: string): ResolvedSubagentBackend;
+export declare function resolveSubagentTimeout(settings: ForgeSubagentSettings, profileId?: string): ResolvedSubagentTimeout;
+export declare function resolveSubagentProfilePolicy(settings: ForgeSubagentSettings, profileId: string, explicitBackend?: string): ResolvedSubagentProfilePolicy;
 export declare function loadForgeSubagentSettings(ctx: ExtensionContext): ForgeSubagentSettings;
+export declare function isValidSubagentTimeoutMs(value: unknown): value is number;
+/**
+ * One trusted-project per-profile delegation update. `enabled: false`,
+ * `backend: null`, and `timeoutMs: null` remove the explicit value; entries
+ * that become empty are removed so the file only records real overrides.
+ */
+export interface ForgeSubagentProfileConfigUpdate {
+    enabled?: boolean;
+    backend?: string | null;
+    timeoutMs?: number | null;
+}
+export type ForgeSubagentProfileConfigResult = {
+    ok: true;
+    configPath: string;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Update `subagents.profiles.<id>` in the project's `.pi/forge/config.json`,
+ * preserving unknown top-level, `subagents`, and per-entry fields. Callers
+ * must gate this on project trust; the project config is ignored otherwise.
+ */
+export declare function updateForgeSubagentProfileConfig(cwd: string, profileId: string, update: ForgeSubagentProfileConfigUpdate): ForgeSubagentProfileConfigResult;
 //# sourceMappingURL=forge-config.d.ts.map

package/dist/forge-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forge-config.d.ts","sourceRoot":"","sources":["../src/forge-config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE,MAAM,WAAW,qBAAqB;IACrC,mCAAmC,EAAE,OAAO,CAAC;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,GAAG,qBAAqB,CA8BtF"}
+{"version":3,"file":"forge-config.d.ts","sourceRoot":"","sources":["../src/forge-config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAIxE,qFAAqF;AACrF,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AACpE,mFAAmF;AACnF,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAClD,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAC7C,eAAO,MAAM,uBAAuB,UAAY,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,gCAAgC,CAAC;AAE1E,MAAM,MAAM,0BAA0B,GACnC,UAAU,GACV,iBAAiB,GACjB,SAAS,GACT,QAAQ,GACR,UAAU,CAAC;AACd,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC7D,MAAM,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;AAE3D,MAAM,WAAW,4BAA4B;IAC5C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,0BAA0B,CAAC;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,0BAA0B,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,0BAA0B,CAAC;CAC3C;AAED,MAAM,WAAW,qBAAqB;IACrC,mCAAmC,EAAE,OAAO,CAAC;IAC7C,2FAA2F;IAC3F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,yBAAyB,CAAC;IAC1C,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,yBAAyB,GAAG,UAAU,CAAC;IACtD,uGAAuG;IACvG,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,0BAA0B,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC,0BAA0B,EAAE,UAAU,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,6BAA6B;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,0BAA0B,GAAG,UAAU,CAAC;IACvD,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,uBAAuB,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,qBAAqB,EAC/B,eAAe,CAAC,EAAE,MAAM,EACxB,SAAS,CAAC,EAAE,MAAM,GAChB,uBAAuB,CAMzB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,qBAAqB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,uBAAuB,CAMnH;AAED,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,qBAAqB,EAC/B,SAAS,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,MAAM,GACtB,6BAA6B,CAS/B;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,GAAG,qBAAqB,CA0BtF;AA0ID,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAIxE;AAED;;;;GAIG;AACH,MAAM,WAAW,gCAAgC;IAChD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,gCAAgC,GACzC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhC;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC/C,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gCAAgC,GACtC,gCAAgC,CAuElC"}

package/dist/forge-config.js

@@ -1,38 +1,288 @@
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { isValidAgentProfileId } from "./agent-profile.js";
+import { globalForgeDir } from "./storage.js";
+/** Backend used when neither a per-run override nor a configured default applies. */
+export const DEFAULT_SUBAGENT_BACKEND_ID = "pi-subprocess-readonly";
+/** Preserve the original foreground-run timeout unless the user configures one. */
+export const DEFAULT_SUBAGENT_TIMEOUT_MS = 60_000;
+export const MIN_SUBAGENT_TIMEOUT_MS = 1_000;
+export const MAX_SUBAGENT_TIMEOUT_MS = 3_600_000;
+/**
+ * Development/test override for the global config location. Keeps automated
+ * tests hermetic regardless of the developer's real ~/.pi/forge/config.json.
+ * Not part of the supported user-facing configuration surface.
+ */
+export const GLOBAL_FORGE_CONFIG_PATH_ENV = "PI_FORGE_GLOBAL_CONFIG_PATH";
+/**
+ * Resolve the effective backend for one run: explicit per-run override, then
+ * a trusted-project per-profile override, then trusted-project/global defaults,
+ * then the built-in subprocess backend. There is deliberately no fallback when
+ * the resolved backend is missing or rejects the intent.
+ */
+export function resolveSubagentBackend(settings, explicitBackend, profileId) {
+    if (explicitBackend)
+        return { id: explicitBackend, source: "explicit" };
+    const profile = profileId ? configuredProfile(settings, profileId) : undefined;
+    if (profile?.backend)
+        return { id: profile.backend, source: profile.backendSource ?? "project-profile" };
+    if (settings.backend)
+        return { id: settings.backend, source: settings.backendSource ?? "global" };
+    return { id: DEFAULT_SUBAGENT_BACKEND_ID, source: "built-in" };
+}
+export function resolveSubagentTimeout(settings, profileId) {
+    const profile = profileId ? configuredProfile(settings, profileId) : undefined;
+    if (profile?.timeoutMs !== undefined) {
+        return { milliseconds: profile.timeoutMs, source: profile.timeoutSource ?? "project-profile" };
+    }
+    return { milliseconds: settings.timeoutMs, source: settings.timeoutSource };
+}
+export function resolveSubagentProfilePolicy(settings, profileId, explicitBackend) {
+    const profile = configuredProfile(settings, profileId);
+    return {
+        profileId,
+        enabled: profile?.enabled === true,
+        enabledSource: profile?.enabledSource ?? "built-in",
+        backend: resolveSubagentBackend(settings, explicitBackend, profileId),
+        timeout: resolveSubagentTimeout(settings, profileId),
+    };
+}
 export function loadForgeSubagentSettings(ctx) {
     const configPath = join(ctx.cwd, ".pi", "forge", "config.json");
-    const defaults = { allowAgentInvocationWithoutApproval: false, configPath, warnings: [] };
-    if (!ctx.isProjectTrusted() || !existsSync(configPath))
-        return defaults;
+    const globalConfigPath = process.env[GLOBAL_FORGE_CONFIG_PATH_ENV] ?? join(globalForgeDir(), "config.json");
+    const settings = {
+        allowAgentInvocationWithoutApproval: false,
+        timeoutMs: DEFAULT_SUBAGENT_TIMEOUT_MS,
+        timeoutSource: "built-in",
+        profiles: Object.create(null),
+        configPath,
+        globalConfigPath,
+        warnings: [],
+    };
+    // The global config is user-owned and always applies. The project config is
+    // honored only for trusted projects and overrides global values.
+    const globalSection = readSubagentsSection(globalConfigPath, settings.warnings);
+    applyBackend(globalSection, globalConfigPath, "global", settings);
+    applyTimeout(globalSection, globalConfigPath, "global", settings);
+    warnIgnoredGlobalProfiles(globalSection, globalConfigPath, settings);
+    if (!ctx.isProjectTrusted())
+        return settings;
+    const projectSection = readSubagentsSection(configPath, settings.warnings);
+    applyBackend(projectSection, configPath, "project", settings);
+    applyTimeout(projectSection, configPath, "project", settings);
+    applyProjectProfiles(projectSection, configPath, settings);
+    applyUnattended(projectSection, configPath, settings);
+    return settings;
+}
+function readSubagentsSection(configPath, warnings) {
+    if (!existsSync(configPath))
+        return undefined;
     let raw;
     try {
         raw = JSON.parse(readFileSync(configPath, "utf8"));
     }
     catch (error) {
-        return {
-            ...defaults,
-            warnings: [`pi-forge: failed to read ${configPath}; per-run subagent approval remains required. ${error instanceof Error ? error.message : String(error)}`],
-        };
+        warnings.push(`pi-forge: failed to read ${configPath}; its subagent settings are ignored. ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
     }
     if (!isPlainObject(raw)) {
-        return { ...defaults, warnings: [`pi-forge: ${configPath} must be a JSON object; per-run subagent approval remains required.`] };
+        warnings.push(`pi-forge: ${configPath} must be a JSON object; its subagent settings are ignored.`);
+        return undefined;
     }
     if (raw.subagents === undefined)
-        return defaults;
+        return undefined;
     if (!isPlainObject(raw.subagents)) {
-        return { ...defaults, warnings: [`pi-forge: ${configPath} subagents must be a JSON object; per-run subagent approval remains required.`] };
+        warnings.push(`pi-forge: ${configPath} subagents must be a JSON object; its subagent settings are ignored.`);
+        return undefined;
+    }
+    return raw.subagents;
+}
+function applyBackend(section, configPath, source, settings) {
+    if (!section || section.backend === undefined)
+        return;
+    const value = section.backend;
+    if (typeof value !== "string" || !value.trim()) {
+        settings.warnings.push(`pi-forge: ${configPath} subagents.backend must be a non-empty string; the configured value is ignored.`);
+        return;
     }
-    const value = raw.subagents.allowAgentInvocationWithoutApproval;
-    if (value === undefined)
-        return defaults;
+    settings.backend = value;
+    settings.backendSource = source;
+}
+function applyTimeout(section, configPath, source, settings) {
+    if (!section || section.timeoutMs === undefined)
+        return;
+    const value = section.timeoutMs;
+    if (!isValidSubagentTimeoutMs(value)) {
+        settings.warnings.push(`pi-forge: ${configPath} subagents.timeoutMs must be an integer from ${MIN_SUBAGENT_TIMEOUT_MS} to ${MAX_SUBAGENT_TIMEOUT_MS}; the configured value is ignored.`);
+        return;
+    }
+    settings.timeoutMs = value;
+    settings.timeoutSource = source;
+}
+function warnIgnoredGlobalProfiles(section, configPath, settings) {
+    if (!section || section.profiles === undefined)
+        return;
+    settings.warnings.push(`pi-forge: ${configPath} subagents.profiles is project-only and ignored; configure profile delegation in the trusted project's .pi/forge/config.json.`);
+}
+function applyProjectProfiles(section, configPath, settings) {
+    if (!section || section.profiles === undefined)
+        return;
+    if (!isPlainObject(section.profiles)) {
+        settings.warnings.push(`pi-forge: ${configPath} subagents.profiles must be a JSON object; its per-profile settings are ignored.`);
+        return;
+    }
+    for (const [profileId, rawProfile] of Object.entries(section.profiles)) {
+        const path = `subagents.profiles.${profileId}`;
+        if (!isValidAgentProfileId(profileId)) {
+            settings.warnings.push(`pi-forge: ${configPath} ${path} has an invalid profile id; the entry is ignored.`);
+            continue;
+        }
+        if (!isPlainObject(rawProfile)) {
+            settings.warnings.push(`pi-forge: ${configPath} ${path} must be a JSON object; the entry is ignored.`);
+            continue;
+        }
+        for (const field of Object.keys(rawProfile)) {
+            if (field === "enabled" || field === "backend" || field === "timeoutMs")
+                continue;
+            settings.warnings.push(`pi-forge: ${configPath} ${path}.${field} is unsupported and ignored.`);
+        }
+        const target = configuredProfile(settings, profileId) ?? {};
+        const profileSource = "project-profile";
+        if (rawProfile.enabled !== undefined) {
+            if (typeof rawProfile.enabled !== "boolean") {
+                settings.warnings.push(`pi-forge: ${configPath} ${path}.enabled must be boolean; the configured value is ignored.`);
+            }
+            else {
+                target.enabled = rawProfile.enabled;
+                target.enabledSource = profileSource;
+            }
+        }
+        if (rawProfile.backend !== undefined) {
+            if (typeof rawProfile.backend !== "string" || !rawProfile.backend.trim()) {
+                settings.warnings.push(`pi-forge: ${configPath} ${path}.backend must be a non-empty string; the configured value is ignored.`);
+            }
+            else {
+                target.backend = rawProfile.backend;
+                target.backendSource = profileSource;
+            }
+        }
+        if (rawProfile.timeoutMs !== undefined) {
+            if (!isValidSubagentTimeoutMs(rawProfile.timeoutMs)) {
+                settings.warnings.push(`pi-forge: ${configPath} ${path}.timeoutMs must be an integer from ${MIN_SUBAGENT_TIMEOUT_MS} to ${MAX_SUBAGENT_TIMEOUT_MS}; the configured value is ignored.`);
+            }
+            else {
+                target.timeoutMs = rawProfile.timeoutMs;
+                target.timeoutSource = profileSource;
+            }
+        }
+        if (Object.keys(target).length > 0)
+            settings.profiles[profileId] = target;
+    }
+}
+function applyUnattended(section, configPath, settings) {
+    if (!section || section.allowAgentInvocationWithoutApproval === undefined)
+        return;
+    const value = section.allowAgentInvocationWithoutApproval;
     if (typeof value !== "boolean") {
+        settings.warnings.push(`pi-forge: ${configPath} subagents.allowAgentInvocationWithoutApproval must be boolean; per-run subagent approval remains required.`);
+        return;
+    }
+    settings.allowAgentInvocationWithoutApproval = value;
+}
+export function isValidSubagentTimeoutMs(value) {
+    return Number.isSafeInteger(value)
+        && value >= MIN_SUBAGENT_TIMEOUT_MS
+        && value <= MAX_SUBAGENT_TIMEOUT_MS;
+}
+/**
+ * Update `subagents.profiles.<id>` in the project's `.pi/forge/config.json`,
+ * preserving unknown top-level, `subagents`, and per-entry fields. Callers
+ * must gate this on project trust; the project config is ignored otherwise.
+ */
+export function updateForgeSubagentProfileConfig(cwd, profileId, update) {
+    if (!isValidAgentProfileId(profileId)) {
+        return { ok: false, error: `Invalid agent profile id: ${profileId}` };
+    }
+    if (update.backend !== undefined && update.backend !== null && (typeof update.backend !== "string" || !update.backend.trim())) {
+        return { ok: false, error: "subagent backend must be a non-empty string or null to clear the override." };
+    }
+    if (update.timeoutMs !== undefined && update.timeoutMs !== null && !isValidSubagentTimeoutMs(update.timeoutMs)) {
         return {
-            ...defaults,
-            warnings: [`pi-forge: ${configPath} subagents.allowAgentInvocationWithoutApproval must be boolean; per-run subagent approval remains required.`],
+            ok: false,
+            error: `subagent timeoutMs must be an integer from ${MIN_SUBAGENT_TIMEOUT_MS} to ${MAX_SUBAGENT_TIMEOUT_MS} or null to clear the override.`,
         };
     }
-    return { ...defaults, allowAgentInvocationWithoutApproval: value };
+    const configPath = join(cwd, ".pi", "forge", "config.json");
+    let root = {};
+    if (existsSync(configPath)) {
+        let raw;
+        try {
+            raw = JSON.parse(readFileSync(configPath, "utf8"));
+        }
+        catch (error) {
+            return {
+                ok: false,
+                error: `Refusing to update unreadable ${configPath}: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+        if (!isPlainObject(raw)) {
+            return { ok: false, error: `Refusing to update ${configPath}: the config root must be a JSON object.` };
+        }
+        root = raw;
+    }
+    if (root.subagents !== undefined && !isPlainObject(root.subagents)) {
+        return { ok: false, error: `Refusing to update ${configPath}: subagents must be a JSON object.` };
+    }
+    const subagents = isPlainObject(root.subagents) ? root.subagents : {};
+    if (subagents.profiles !== undefined && !isPlainObject(subagents.profiles)) {
+        return { ok: false, error: `Refusing to update ${configPath}: subagents.profiles must be a JSON object.` };
+    }
+    const profiles = isPlainObject(subagents.profiles) ? subagents.profiles : {};
+    if (profiles[profileId] !== undefined && !isPlainObject(profiles[profileId])) {
+        return { ok: false, error: `Refusing to update ${configPath}: subagents.profiles.${profileId} must be a JSON object.` };
+    }
+    const entry = isPlainObject(profiles[profileId]) ? { ...profiles[profileId] } : {};
+    if (update.enabled !== undefined) {
+        if (update.enabled)
+            entry.enabled = true;
+        else
+            delete entry.enabled;
+    }
+    if (update.backend !== undefined) {
+        if (typeof update.backend === "string" && update.backend.trim())
+            entry.backend = update.backend.trim();
+        else
+            delete entry.backend;
+    }
+    if (update.timeoutMs !== undefined) {
+        if (update.timeoutMs === null)
+            delete entry.timeoutMs;
+        else
+            entry.timeoutMs = update.timeoutMs;
+    }
+    if (Object.keys(entry).length > 0)
+        profiles[profileId] = entry;
+    else
+        delete profiles[profileId];
+    if (Object.keys(profiles).length > 0)
+        subagents.profiles = profiles;
+    else
+        delete subagents.profiles;
+    if (Object.keys(subagents).length > 0)
+        root.subagents = subagents;
+    else
+        delete root.subagents;
+    try {
+        mkdirSync(dirname(configPath), { recursive: true });
+        writeFileSync(configPath, `${JSON.stringify(root, null, 2)}\n`, "utf8");
+        return { ok: true, configPath };
+    }
+    catch (error) {
+        return { ok: false, error: `Failed to write ${configPath}: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+function configuredProfile(settings, profileId) {
+    return Object.hasOwn(settings.profiles, profileId) ? settings.profiles[profileId] : undefined;
 }
 function isPlainObject(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);

package/dist/forge-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"forge-config.js","sourceRoot":"","sources":["../src/forge-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC,MAAM,UAAU,yBAAyB,CAAC,GAAqB;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,EAAE,mCAAmC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAc,EAAE,CAAC;IACtG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExE,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,GAAG,QAAQ;YACX,QAAQ,EAAE,CAAC,4BAA4B,UAAU,iDAAiD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SAC3J,CAAC;IACH,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC,aAAa,UAAU,qEAAqE,CAAC,EAAE,CAAC;IAClI,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACjD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC,aAAa,UAAU,+EAA+E,CAAC,EAAE,CAAC;IAC5I,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,mCAAmC,CAAC;IAChE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO;YACN,GAAG,QAAQ;YACX,QAAQ,EAAE,CAAC,aAAa,UAAU,6GAA6G,CAAC;SAChJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,mCAAmC,EAAE,KAAK,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"forge-config.js","sourceRoot":"","sources":["../src/forge-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,qFAAqF;AACrF,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AACpE,mFAAmF;AACnF,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAClD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,6BAA6B,CAAC;AAqD1E;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACrC,QAA+B,EAC/B,eAAwB,EACxB,SAAkB;IAElB,IAAI,eAAe;QAAE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,IAAI,OAAO,EAAE,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,aAAa,IAAI,iBAAiB,EAAE,CAAC;IACzG,IAAI,QAAQ,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,aAAa,IAAI,QAAQ,EAAE,CAAC;IAClG,OAAO,EAAE,EAAE,EAAE,2BAA2B,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAA+B,EAAE,SAAkB;IACzF,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,aAAa,IAAI,iBAAiB,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,QAA+B,EAC/B,SAAiB,EACjB,eAAwB;IAExB,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,OAAO;QACN,SAAS;QACT,OAAO,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI;QAClC,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,UAAU;QACnD,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,SAAS,CAAC;QACrE,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC;KACpD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAqB;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,aAAa,CAAC,CAAC;IAC5G,MAAM,QAAQ,GAA0B;QACvC,mCAAmC,EAAE,KAAK;QAC1C,SAAS,EAAE,2BAA2B;QACtC,aAAa,EAAE,UAAU;QACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAiD;QAC7E,UAAU;QACV,gBAAgB;QAChB,QAAQ,EAAE,EAAE;KACZ,CAAC;IAEF,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,aAAa,GAAG,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChF,YAAY,CAAC,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClE,YAAY,CAAC,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClE,yBAAyB,CAAC,aAAa,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACrE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC7C,MAAM,cAAc,GAAG,oBAAoB,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,YAAY,CAAC,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9D,YAAY,CAAC,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9D,oBAAoB,CAAC,cAAc,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3D,eAAe,CAAC,cAAc,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB,EAAE,QAAkB;IACnE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,4BAA4B,UAAU,wCAAwC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtJ,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,aAAa,UAAU,4DAA4D,CAAC,CAAC;QACnG,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,aAAa,UAAU,sEAAsE,CAAC,CAAC;QAC7G,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC,SAAS,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CACpB,OAA4C,EAC5C,UAAkB,EAClB,MAAiC,EACjC,QAA+B;IAE/B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,UAAU,iFAAiF,CAAC,CAAC;QACjI,OAAO;IACR,CAAC;IACD,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;IACzB,QAAQ,CAAC,aAAa,GAAG,MAAM,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CACpB,OAA4C,EAC5C,UAAkB,EAClB,MAAiC,EACjC,QAA+B;IAE/B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC;IAChC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CACrB,aAAa,UAAU,gDAAgD,uBAAuB,OAAO,uBAAuB,oCAAoC,CAChK,CAAC;QACF,OAAO;IACR,CAAC;IACD,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,aAAa,GAAG,MAAM,CAAC;AACjC,CAAC;AAED,SAAS,yBAAyB,CACjC,OAA4C,EAC5C,UAAkB,EAClB,QAA+B;IAE/B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO;IACvD,QAAQ,CAAC,QAAQ,CAAC,IAAI,CACrB,aAAa,UAAU,+HAA+H,CACtJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC5B,OAA4C,EAC5C,UAAkB,EAClB,QAA+B;IAE/B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO;IACvD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,UAAU,kFAAkF,CAAC,CAAC;QAClI,OAAO;IACR,CAAC;IACD,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,sBAAsB,SAAS,EAAE,CAAC;QAC/C,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,UAAU,IAAI,IAAI,mDAAmD,CAAC,CAAC;YAC3G,SAAS;QACV,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,UAAU,IAAI,IAAI,+CAA+C,CAAC,CAAC;YACvG,SAAS;QACV,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW;gBAAE,SAAS;YAClF,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,UAAU,IAAI,IAAI,IAAI,KAAK,8BAA8B,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,aAAa,GAA+B,iBAAiB,CAAC;QACpE,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC7C,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,UAAU,IAAI,IAAI,4DAA4D,CAAC,CAAC;YACrH,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;gBACpC,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;YACtC,CAAC;QACF,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1E,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,UAAU,IAAI,IAAI,uEAAuE,CAAC,CAAC;YAChI,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;gBACpC,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;YACtC,CAAC;QACF,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,QAAQ,CAAC,QAAQ,CAAC,IAAI,CACrB,aAAa,UAAU,IAAI,IAAI,sCAAsC,uBAAuB,OAAO,uBAAuB,oCAAoC,CAC9J,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;gBACxC,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;YACtC,CAAC;QACF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;IAC3E,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CACvB,OAA4C,EAC5C,UAAkB,EAClB,QAA+B;IAE/B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,mCAAmC,KAAK,SAAS;QAAE,OAAO;IAClF,MAAM,KAAK,GAAG,OAAO,CAAC,mCAAmC,CAAC;IAC1D,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,UAAU,6GAA6G,CAAC,CAAC;QAC7J,OAAO;IACR,CAAC;IACD,QAAQ,CAAC,mCAAmC,GAAG,KAAK,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACtD,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;WAC7B,KAAgB,IAAI,uBAAuB;WAC3C,KAAgB,IAAI,uBAAuB,CAAC;AAClD,CAAC;AAiBD;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC/C,GAAW,EACX,SAAiB,EACjB,MAAwC;IAExC,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,SAAS,EAAE,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/H,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4EAA4E,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAChH,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,8CAA8C,uBAAuB,OAAO,uBAAuB,iCAAiC;SAC3I,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACJ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,iCAAiC,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/G,CAAC;QACH,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,UAAU,0CAA0C,EAAE,CAAC;QACzG,CAAC;QACD,IAAI,GAAG,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,UAAU,oCAAoC,EAAE,CAAC;IACnG,CAAC;IACD,MAAM,SAAS,GAA4B,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,UAAU,6CAA6C,EAAE,CAAC;IAC5G,CAAC;IACD,MAAM,QAAQ,GAA4B,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,UAAU,wBAAwB,SAAS,yBAAyB,EAAE,CAAC;IACzH,CAAC;IACD,MAAM,KAAK,GAA4B,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5G,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,OAAO;YAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;;YACpC,OAAO,KAAK,CAAC,OAAO,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;;YAClG,OAAO,KAAK,CAAC,OAAO,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,SAAS,CAAC;;YACjD,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACzC,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;;QAC1D,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;;QAC/D,OAAO,SAAS,CAAC,QAAQ,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;;QAC7D,OAAO,IAAI,CAAC,SAAS,CAAC;IAE3B,IAAI,CAAC;QACJ,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACzH,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA+B,EAAE,SAAiB;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/F,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC"}