aicodeman 0.9.2 → 0.9.4

package/dist/web/self-update.d.ts

@@ -0,0 +1,112 @@
+/**
+ * @fileoverview Server-side logic for the in-app self-updater.
+ *
+ * Powers App Settings → Updates. Codeman is installed as a git clone and run
+ * under systemd (Linux) or launchd (macOS); updating means `git checkout <release
+ * tag> && npm install && npm run build && restart-the-service`. The hard part is
+ * that the update restarts the very process performing it, so the actual work
+ * runs in a DETACHED `scripts/self-update.sh` that outlives the restart, writing
+ * progress to `dataPath('update-status.json')` which the browser polls across the
+ * connection drop.
+ *
+ * Channel: latest tagged RELEASE (tags look like `codeman@0.9.3`). Dirty trees
+ * are auto-stashed (stash left for the user). Detection is manual (a button).
+ *
+ * Split into PURE helpers (semver/tag parsing, reconcile decision) that are unit
+ * tested, and IO wrappers (`getInstallInfo`, `checkForUpdate`, `startUpdate`,
+ * `reconcileUpdateOnBoot`) that touch git/network/fs.
+ *
+ * Related: `src/types/update.ts`, `scripts/self-update.sh`, routes in
+ * `src/web/routes/system-routes.ts`.
+ *
+ * @module web/self-update
+ */
+import type { InstallInfo, SupervisorKind, UpdateCheckResult, UpdateStatus } from '../types/update.js';
+export declare function isInFlight(status: UpdateStatus | null | undefined): boolean;
+export interface ParsedVersion {
+    major: number;
+    minor: number;
+    patch: number;
+    /** Non-empty for prereleases like `0.9.3-rc1`. */
+    prerelease: string;
+}
+/**
+ * Parse a semver out of a release tag. Accepts `codeman@0.9.3`, `aicodeman@0.9.3`,
+ * `v0.9.3`, and bare `0.9.3` (with optional `-prerelease`). Returns null if no
+ * `X.Y.Z` is present.
+ */
+export declare function parseVersionFromTag(tag: string): ParsedVersion | null;
+/** Compare two parsed versions. Returns >0 if a>b, <0 if a<b, 0 if equal. A release outranks a prerelease of the same X.Y.Z. */
+export declare function compareVersions(a: ParsedVersion, b: ParsedVersion): number;
+/** True when `latest` is a strictly newer STABLE version than `current`. */
+export declare function isNewerStableVersion(current: string, latest: string): boolean;
+/**
+ * From a list of `refs/tags/...` (or bare tag names), pick the highest STABLE
+ * release tag we recognize. Skips prereleases and unrecognized tags.
+ */
+export declare function pickLatestStableTag(tagRefs: string[]): {
+    tag: string;
+    version: string;
+} | null;
+/** Tags must match this before they're ever passed to the shell. */
+export declare function isValidReleaseTag(tag: string): boolean;
+/** Derive `{owner, repo}` from a GitHub SSH or HTTPS remote URL. */
+export declare function parseGitHubRepo(remoteUrl: string): {
+    owner: string;
+    repo: string;
+} | null;
+/**
+ * PURE boot-time reconcile decision. Given the persisted status, the version the
+ * freshly-booted process is actually running, and `now`, return the status to
+ * persist — or null to leave it untouched.
+ *
+ * Rules (see plan "Hardening"):
+ * - Terminal phases → untouched.
+ * - Only the `restarting` marker (written right before the updater triggers our
+ *   restart) flips to completed/failed by comparing running version vs. target.
+ * - Other in-flight phases are owned by the still-running updater scope — leave
+ *   them alone so a normal/crash restart mid-update isn't misreported.
+ * - A backstop staleness guard fails any in-flight status older than the window.
+ */
+export declare function reconcileStatusDecision(status: UpdateStatus | null, runningVersion: string, now: number): UpdateStatus | null;
+/** Read the persisted status; tolerant of a missing/torn file (returns null). */
+export declare function readUpdateStatus(): UpdateStatus | null;
+/** Write the status atomically (temp + rename — readers never see a torn file). */
+export declare function writeUpdateStatusAtomic(status: UpdateStatus): void;
+/** Reconcile the status file on server boot (call once, early in start()). */
+export declare function reconcileUpdateOnBoot(now?: number): void;
+/**
+ * Resolve the repo root from this module's location. Compiled to
+ * `dist/web/self-update.js` (or `src/web/self-update.ts` under tsx) → two levels
+ * up is the package root that holds `package.json` and `.git`. Matches the
+ * `require('../../package.json')` resolution in `server.ts`.
+ */
+export declare function resolveInstallDir(): string;
+/**
+ * Detect which init system supervises us. Detection happens HERE (in the running
+ * server, which has a rich env) and the result is passed to the updater script —
+ * the detached child must not re-probe with a stripped-down environment.
+ */
+export declare function detectSupervisor(): SupervisorKind;
+/** Inspect the running install: kind, dir, branch, dirtiness, supervisor, version. */
+export declare function getInstallInfo(): InstallInfo;
+/** Check the configured remote for a newer release than the running version. */
+export declare function checkForUpdate(): Promise<UpdateCheckResult>;
+export type StartUpdateResult = {
+    ok: true;
+    updateId: string;
+    toTag: string;
+    toVersion: string | null;
+} | {
+    ok: false;
+    code: 'disabled' | 'not-git' | 'in-flight' | 'up-to-date' | 'bad-tag' | 'error';
+    message: string;
+};
+/**
+ * Validate, snapshot the current commit, write the initial status, and spawn the
+ * detached updater. Returns immediately — progress is reported via the status file.
+ */
+export declare function startUpdate(): Promise<StartUpdateResult>;
+/** Current status for the polling endpoint; null collapses to an explicit idle. */
+export declare function getUpdateStatusForApi(): UpdateStatus;
+//# sourceMappingURL=self-update.d.ts.map

package/dist/web/self-update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-update.d.ts","sourceRoot":"","sources":["../../src/web/self-update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAWH,OAAO,KAAK,EACV,WAAW,EAEX,cAAc,EACd,iBAAiB,EAEjB,YAAY,EACb,MAAM,oBAAoB,CAAC;AA4B5B,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE3E;AAMD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CASrE;AAED,gIAAgI;AAChI,wBAAgB,eAAe,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,MAAM,CAS1E;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAM7E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkB9F;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIzF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,YAAY,GAAG,IAAI,EAC3B,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,MAAM,GACV,YAAY,GAAG,IAAI,CA4BrB;AAMD,iFAAiF;AACjF,wBAAgB,gBAAgB,IAAI,YAAY,GAAG,IAAI,CAOtD;AAED,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAIlE;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,GAAG,SAAa,GAAG,IAAI,CAI5D;AAmBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAK1C;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,cAAc,CAajD;AAMD,sFAAsF;AACtF,wBAAgB,cAAc,IAAI,WAAW,CAmB5C;AAyCD,gFAAgF;AAChF,wBAAsB,cAAc,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAgDjE;AAMD,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACvE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,GAAG,SAAS,GAAG,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAwDpH;;;GAGG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAwE9D;AAED,mFAAmF;AACnF,wBAAgB,qBAAqB,IAAI,YAAY,CAWpD"}

package/dist/web/self-update.js

@@ -0,0 +1,518 @@
+/**
+ * @fileoverview Server-side logic for the in-app self-updater.
+ *
+ * Powers App Settings → Updates. Codeman is installed as a git clone and run
+ * under systemd (Linux) or launchd (macOS); updating means `git checkout <release
+ * tag> && npm install && npm run build && restart-the-service`. The hard part is
+ * that the update restarts the very process performing it, so the actual work
+ * runs in a DETACHED `scripts/self-update.sh` that outlives the restart, writing
+ * progress to `dataPath('update-status.json')` which the browser polls across the
+ * connection drop.
+ *
+ * Channel: latest tagged RELEASE (tags look like `codeman@0.9.3`). Dirty trees
+ * are auto-stashed (stash left for the user). Detection is manual (a button).
+ *
+ * Split into PURE helpers (semver/tag parsing, reconcile decision) that are unit
+ * tested, and IO wrappers (`getInstallInfo`, `checkForUpdate`, `startUpdate`,
+ * `reconcileUpdateOnBoot`) that touch git/network/fs.
+ *
+ * Related: `src/types/update.ts`, `scripts/self-update.sh`, routes in
+ * `src/web/routes/system-routes.ts`.
+ *
+ * @module web/self-update
+ */
+import { spawn, execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync, renameSync, copyFileSync, chmodSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { homedir, tmpdir } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { dataPath } from '../config/instance.js';
+import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js';
+const require = createRequire(import.meta.url);
+const { version: APP_VERSION } = require('../../package.json');
+/** systemd unit name (matches install.sh + scripts/codeman-web.service). */
+const SYSTEMD_UNIT = 'codeman-web.service';
+/** launchd agent label (matches install.sh setup_launchd_service). */
+const LAUNCHD_LABEL = 'com.codeman.web';
+/** Path to the persisted update status file. */
+const STATUS_FILE = dataPath('update-status.json');
+/** Network/git timeout for the "check" path (longer than EXEC_TIMEOUT_MS — ls-remote hits the network). */
+const CHECK_TIMEOUT_MS = 12_000;
+/** How long after `startedAt` a non-terminal status is treated as abandoned on boot. */
+const RECONCILE_STALE_MS = 15 * 60 * 1000;
+/** Phases that mean "an update is currently running". */
+const IN_FLIGHT_PHASES = new Set([
+    'queued',
+    'preparing',
+    'stashing',
+    'fetching',
+    'checkout',
+    'installing',
+    'building',
+    'restarting',
+]);
+export function isInFlight(status) {
+    return !!status && IN_FLIGHT_PHASES.has(status.phase);
+}
+/**
+ * Parse a semver out of a release tag. Accepts `codeman@0.9.3`, `aicodeman@0.9.3`,
+ * `v0.9.3`, and bare `0.9.3` (with optional `-prerelease`). Returns null if no
+ * `X.Y.Z` is present.
+ */
+export function parseVersionFromTag(tag) {
+    const m = tag.trim().match(/(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?\s*$/);
+    if (!m)
+        return null;
+    return {
+        major: parseInt(m[1], 10),
+        minor: parseInt(m[2], 10),
+        patch: parseInt(m[3], 10),
+        prerelease: m[4] ?? '',
+    };
+}
+/** Compare two parsed versions. Returns >0 if a>b, <0 if a<b, 0 if equal. A release outranks a prerelease of the same X.Y.Z. */
+export function compareVersions(a, b) {
+    if (a.major !== b.major)
+        return a.major - b.major;
+    if (a.minor !== b.minor)
+        return a.minor - b.minor;
+    if (a.patch !== b.patch)
+        return a.patch - b.patch;
+    // Equal core: a release (no prerelease) is greater than a prerelease.
+    if (a.prerelease === b.prerelease)
+        return 0;
+    if (!a.prerelease)
+        return 1;
+    if (!b.prerelease)
+        return -1;
+    return a.prerelease < b.prerelease ? -1 : 1;
+}
+/** True when `latest` is a strictly newer STABLE version than `current`. */
+export function isNewerStableVersion(current, latest) {
+    const c = parseVersionFromTag(current);
+    const l = parseVersionFromTag(latest);
+    if (!c || !l)
+        return false;
+    if (l.prerelease)
+        return false; // never offer a prerelease as an update
+    return compareVersions(l, c) > 0;
+}
+/**
+ * From a list of `refs/tags/...` (or bare tag names), pick the highest STABLE
+ * release tag we recognize. Skips prereleases and unrecognized tags.
+ */
+export function pickLatestStableTag(tagRefs) {
+    let best = null;
+    for (const raw of tagRefs) {
+        // Accept `refs/tags/codeman@0.9.3`, dereferenced `...^{}`, or bare tag names.
+        const tag = raw
+            .replace(/^.*refs\/tags\//, '')
+            .replace(/\^\{\}$/, '')
+            .trim();
+        if (!tag)
+            continue;
+        if (!/^(codeman|aicodeman)@\d+\.\d+\.\d+$/.test(tag) && !/^v?\d+\.\d+\.\d+$/.test(tag))
+            continue;
+        const parsed = parseVersionFromTag(tag);
+        if (!parsed || parsed.prerelease)
+            continue;
+        if (!best || compareVersions(parsed, best.parsed) > 0) {
+            best = { tag, parsed };
+        }
+    }
+    if (!best)
+        return null;
+    return { tag: best.tag, version: `${best.parsed.major}.${best.parsed.minor}.${best.parsed.patch}` };
+}
+/** Tags must match this before they're ever passed to the shell. */
+export function isValidReleaseTag(tag) {
+    return /^(codeman|aicodeman)@\d+\.\d+\.\d+$/.test(tag);
+}
+/** Derive `{owner, repo}` from a GitHub SSH or HTTPS remote URL. */
+export function parseGitHubRepo(remoteUrl) {
+    const m = remoteUrl.trim().match(/github\.com[:/]+([^/]+)\/(.+?)(?:\.git)?\/?$/);
+    if (!m)
+        return null;
+    return { owner: m[1], repo: m[2] };
+}
+/**
+ * PURE boot-time reconcile decision. Given the persisted status, the version the
+ * freshly-booted process is actually running, and `now`, return the status to
+ * persist — or null to leave it untouched.
+ *
+ * Rules (see plan "Hardening"):
+ * - Terminal phases → untouched.
+ * - Only the `restarting` marker (written right before the updater triggers our
+ *   restart) flips to completed/failed by comparing running version vs. target.
+ * - Other in-flight phases are owned by the still-running updater scope — leave
+ *   them alone so a normal/crash restart mid-update isn't misreported.
+ * - A backstop staleness guard fails any in-flight status older than the window.
+ */
+export function reconcileStatusDecision(status, runningVersion, now) {
+    if (!status)
+        return null;
+    if (!IN_FLIGHT_PHASES.has(status.phase))
+        return null;
+    if (status.phase === 'restarting') {
+        if (status.toVersion && runningVersion === status.toVersion) {
+            return { ...status, phase: 'completed', message: `Updated to v${runningVersion}`, updatedAt: now };
+        }
+        return {
+            ...status,
+            phase: 'failed',
+            message: 'Restarted but version did not change',
+            error: `expected ${status.toVersion ?? '?'}, running ${runningVersion}`,
+            updatedAt: now,
+        };
+    }
+    // Not the restart marker: only intervene if clearly abandoned.
+    if (now - status.startedAt > RECONCILE_STALE_MS) {
+        return {
+            ...status,
+            phase: 'failed',
+            message: 'Update did not complete',
+            error: `abandoned during "${status.phase}"`,
+            updatedAt: now,
+        };
+    }
+    return null;
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Status file IO
+// ─────────────────────────────────────────────────────────────────────────────
+/** Read the persisted status; tolerant of a missing/torn file (returns null). */
+export function readUpdateStatus() {
+    try {
+        if (!existsSync(STATUS_FILE))
+            return null;
+        return JSON.parse(readFileSync(STATUS_FILE, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Write the status atomically (temp + rename — readers never see a torn file). */
+export function writeUpdateStatusAtomic(status) {
+    const tmp = `${STATUS_FILE}.tmp-${process.pid}`;
+    writeFileSync(tmp, JSON.stringify(status, null, 2));
+    renameSync(tmp, STATUS_FILE);
+}
+/** Reconcile the status file on server boot (call once, early in start()). */
+export function reconcileUpdateOnBoot(now = Date.now()) {
+    const status = readUpdateStatus();
+    const next = reconcileStatusDecision(status, APP_VERSION, now);
+    if (next)
+        writeUpdateStatusAtomic(next);
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Environment probing (git / supervisor / install kind)
+// ─────────────────────────────────────────────────────────────────────────────
+/** Run a command, returning trimmed stdout, or null on any error. */
+function tryExec(cmd, args, cwd, timeout = EXEC_TIMEOUT_MS) {
+    try {
+        return execFileSync(cmd, args, { cwd, encoding: 'utf-8', timeout, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+function commandExists(cmd) {
+    return tryExec('sh', ['-c', `command -v ${cmd}`]) !== null;
+}
+/**
+ * Resolve the repo root from this module's location. Compiled to
+ * `dist/web/self-update.js` (or `src/web/self-update.ts` under tsx) → two levels
+ * up is the package root that holds `package.json` and `.git`. Matches the
+ * `require('../../package.json')` resolution in `server.ts`.
+ */
+export function resolveInstallDir() {
+    const moduleDir = dirname(fileURLToPath(import.meta.url));
+    const root = join(moduleDir, '..', '..');
+    if (existsSync(join(root, 'package.json')))
+        return root;
+    return process.cwd();
+}
+function detectInstallKind(dir) {
+    if (existsSync(join(dir, '.git')))
+        return 'git';
+    // Global npm install ships only dist/ (no src/, no .git).
+    if (!existsSync(join(dir, 'src')))
+        return 'npm';
+    return 'unknown';
+}
+/**
+ * Detect which init system supervises us. Detection happens HERE (in the running
+ * server, which has a rich env) and the result is passed to the updater script —
+ * the detached child must not re-probe with a stripped-down environment.
+ */
+export function detectSupervisor() {
+    if (process.platform === 'darwin') {
+        if (existsSync(join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`)))
+            return 'launchd';
+        return 'none';
+    }
+    if (process.platform === 'linux') {
+        // INVOCATION_ID is set by systemd for service processes; confirm with is-active.
+        if (process.env.INVOCATION_ID && tryExec('systemctl', ['--user', 'is-active', SYSTEMD_UNIT]) === 'active') {
+            return 'systemd';
+        }
+        if (tryExec('systemctl', ['--user', 'is-active', SYSTEMD_UNIT]) === 'active')
+            return 'systemd';
+    }
+    return 'none';
+}
+function isSelfUpdateEnabled() {
+    return process.env.CODEMAN_DISABLE_SELF_UPDATE !== '1';
+}
+/** Inspect the running install: kind, dir, branch, dirtiness, supervisor, version. */
+export function getInstallInfo() {
+    const installDir = resolveInstallDir();
+    const installKind = detectInstallKind(installDir);
+    let branch;
+    let dirty = false;
+    if (installKind === 'git') {
+        branch = tryExec('git', ['rev-parse', '--abbrev-ref', 'HEAD'], installDir) ?? undefined;
+        const porcelain = tryExec('git', ['status', '--porcelain'], installDir);
+        dirty = !!porcelain && porcelain.length > 0;
+    }
+    return {
+        installKind,
+        installDir,
+        branch,
+        dirty,
+        supervisor: detectSupervisor(),
+        currentVersion: APP_VERSION,
+        selfUpdateEnabled: isSelfUpdateEnabled(),
+    };
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Update check (network)
+// ─────────────────────────────────────────────────────────────────────────────
+async function fetchLatestReleaseFromGitHub(owner, repo) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), CHECK_TIMEOUT_MS);
+    try {
+        const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/releases/latest`, {
+            headers: { 'User-Agent': 'codeman-self-update', Accept: 'application/vnd.github+json' },
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        if (!data.tag_name)
+            return null;
+        const parsed = parseVersionFromTag(data.tag_name);
+        if (!parsed || parsed.prerelease)
+            return null;
+        return {
+            tag: data.tag_name,
+            version: `${parsed.major}.${parsed.minor}.${parsed.patch}`,
+            notes: data.body ?? null,
+            htmlUrl: data.html_url ?? null,
+        };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function fetchLatestTagViaGit(installDir) {
+    const out = tryExec('git', ['ls-remote', '--tags', 'origin'], installDir, CHECK_TIMEOUT_MS);
+    if (!out)
+        return null;
+    return pickLatestStableTag(out.split('\n').filter(Boolean));
+}
+/** Check the configured remote for a newer release than the running version. */
+export async function checkForUpdate() {
+    const info = getInstallInfo();
+    const checkedAt = Date.now();
+    const base = {
+        currentVersion: info.currentVersion,
+        latestVersion: null,
+        latestTag: null,
+        updateAvailable: false,
+        notes: null,
+        htmlUrl: null,
+        checkedAt,
+        source: 'none',
+    };
+    if (info.installKind !== 'git') {
+        return { ...base, error: 'Not a git install — self-update is unavailable.' };
+    }
+    const remote = tryExec('git', ['remote', 'get-url', 'origin'], info.installDir);
+    const gh = remote ? parseGitHubRepo(remote) : null;
+    if (gh) {
+        const rel = await fetchLatestReleaseFromGitHub(gh.owner, gh.repo);
+        if (rel) {
+            return {
+                ...base,
+                latestVersion: rel.version,
+                latestTag: rel.tag,
+                notes: rel.notes,
+                htmlUrl: rel.htmlUrl,
+                updateAvailable: isNewerStableVersion(info.currentVersion, rel.version),
+                source: 'github-api',
+            };
+        }
+    }
+    // Fallback: enumerate remote tags directly (works for non-GitHub remotes too).
+    const viaGit = fetchLatestTagViaGit(info.installDir);
+    if (viaGit) {
+        return {
+            ...base,
+            latestVersion: viaGit.version,
+            latestTag: viaGit.tag,
+            updateAvailable: isNewerStableVersion(info.currentVersion, viaGit.version),
+            source: 'git-ls-remote',
+        };
+    }
+    return { ...base, error: 'Could not reach the update server (GitHub API + git ls-remote both failed).' };
+}
+/**
+ * Copy the updater script OUT of the repo before running it. The script lives in
+ * the very repo it's about to `git checkout`, and bash reads scripts lazily — so
+ * running the in-repo copy risks executing torn/old-tag bytes after checkout.
+ * Run a snapshot under ~/.codeman instead (git never touches it).
+ */
+function stageRunner(installDir) {
+    const src = join(installDir, 'scripts', 'self-update.sh');
+    if (!existsSync(src))
+        return null;
+    const runner = dataPath('self-update-runner.sh');
+    copyFileSync(src, runner);
+    chmodSync(runner, 0o755);
+    return runner;
+}
+/**
+ * Launch the updater so it OUTLIVES the service restart it triggers.
+ * - Linux + systemd: a transient `--scope` cgroup, independent of the
+ *   codeman-web service lifecycle (survives `systemctl restart` regardless of
+ *   the unit's KillMode). Inherits our env so node/npm/git stay on PATH.
+ * - Everything else: `setsid` into a new session (escapes launchd's process-group
+ *   kill); plain detached spawn as the last resort.
+ */
+function launchDetached(runner, args) {
+    const useScope = process.platform === 'linux' && !!process.env.XDG_RUNTIME_DIR && commandExists('systemd-run');
+    let cmd;
+    let cmdArgs;
+    if (useScope) {
+        cmd = 'systemd-run';
+        cmdArgs = ['--user', '--scope', '--collect', '--quiet', 'bash', runner, ...args];
+    }
+    else if (commandExists('setsid')) {
+        cmd = 'setsid';
+        cmdArgs = ['bash', runner, ...args];
+    }
+    else {
+        cmd = 'bash';
+        cmdArgs = [runner, ...args];
+    }
+    const child = spawn(cmd, cmdArgs, { detached: true, stdio: 'ignore', env: process.env });
+    child.on('error', () => {
+        // Surface the failure in the status file so the UI doesn't hang on "queued".
+        const status = readUpdateStatus();
+        if (status && isInFlight(status)) {
+            writeUpdateStatusAtomic({
+                ...status,
+                phase: 'failed',
+                message: 'Could not launch the updater process',
+                error: `spawn ${cmd} failed`,
+                updatedAt: Date.now(),
+            });
+        }
+    });
+    child.unref();
+}
+/**
+ * Validate, snapshot the current commit, write the initial status, and spawn the
+ * detached updater. Returns immediately — progress is reported via the status file.
+ */
+export async function startUpdate() {
+    const info = getInstallInfo();
+    if (!info.selfUpdateEnabled) {
+        return { ok: false, code: 'disabled', message: 'Self-update is disabled (CODEMAN_DISABLE_SELF_UPDATE=1).' };
+    }
+    if (info.installKind !== 'git') {
+        return {
+            ok: false,
+            code: 'not-git',
+            message: 'This is not a git install. Update with: npm i -g aicodeman@latest',
+        };
+    }
+    const existing = readUpdateStatus();
+    if (isInFlight(existing)) {
+        return { ok: false, code: 'in-flight', message: 'An update is already in progress.' };
+    }
+    const check = await checkForUpdate();
+    if (!check.latestTag || !check.updateAvailable) {
+        return { ok: false, code: 'up-to-date', message: 'Already up to date.' };
+    }
+    if (!isValidReleaseTag(check.latestTag)) {
+        return { ok: false, code: 'bad-tag', message: `Refusing to update to an unrecognized tag: ${check.latestTag}` };
+    }
+    const prevSha = tryExec('git', ['rev-parse', 'HEAD'], info.installDir);
+    const runner = stageRunner(info.installDir);
+    if (!runner) {
+        return { ok: false, code: 'error', message: 'scripts/self-update.sh not found in the install.' };
+    }
+    const updateId = randomUUID();
+    const now = Date.now();
+    const status = {
+        updateId,
+        phase: 'queued',
+        message: `Preparing update to v${check.latestVersion}…`,
+        fromVersion: info.currentVersion,
+        toVersion: check.latestVersion ?? undefined,
+        toTag: check.latestTag,
+        prevSha: prevSha ?? undefined,
+        stashRef: null,
+        supervisor: info.supervisor,
+        startedAt: now,
+        updatedAt: now,
+    };
+    writeUpdateStatusAtomic(status);
+    const logFile = join(tmpdir(), `codeman-update-${updateId}.log`);
+    const args = [
+        '--repo',
+        info.installDir,
+        '--tag',
+        check.latestTag,
+        '--supervisor',
+        info.supervisor,
+        '--status-file',
+        STATUS_FILE,
+        '--update-id',
+        updateId,
+        '--from-version',
+        info.currentVersion,
+        '--node',
+        process.execPath,
+        '--log',
+        logFile,
+    ];
+    if (prevSha)
+        args.push('--prev-sha', prevSha);
+    if (info.dirty)
+        args.push('--stash');
+    launchDetached(runner, args);
+    return { ok: true, updateId, toTag: check.latestTag, toVersion: check.latestVersion };
+}
+/** Current status for the polling endpoint; null collapses to an explicit idle. */
+export function getUpdateStatusForApi() {
+    const status = readUpdateStatus();
+    if (status)
+        return status;
+    return {
+        updateId: '',
+        phase: 'idle',
+        message: '',
+        fromVersion: APP_VERSION,
+        startedAt: 0,
+        updatedAt: 0,
+    };
+}
+//# sourceMappingURL=self-update.js.map

package/dist/web/self-update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-update.js","sourceRoot":"","sources":["../../src/web/self-update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACvG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAU5D,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAwB,CAAC;AAEtF,4EAA4E;AAC5E,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C,sEAAsE;AACtE,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,gDAAgD;AAChD,MAAM,WAAW,GAAG,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AACnD,2GAA2G;AAC3G,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,yDAAyD;AACzD,MAAM,gBAAgB,GAA6B,IAAI,GAAG,CAAc;IACtE,QAAQ;IACR,WAAW;IACX,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,UAAU,UAAU,CAAC,MAAuC;IAChE,OAAO,CAAC,CAAC,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzB,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;KACvB,CAAC;AACJ,CAAC;AAED,gIAAgI;AAChI,MAAM,UAAU,eAAe,CAAC,CAAgB,EAAE,CAAgB;IAChE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,sEAAsE;IACtE,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,CAAC,UAAU;QAAE,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,CAAC,UAAU;QAAE,OAAO,CAAC,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,MAAc;IAClE,MAAM,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC,CAAC,wCAAwC;IACxE,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAiB;IACnD,IAAI,IAAI,GAAkD,IAAI,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,8EAA8E;QAC9E,MAAM,GAAG,GAAG,GAAG;aACZ,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;aAC9B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;aACtB,IAAI,EAAE,CAAC;QACV,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACjG,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU;YAAE,SAAS;QAC3C,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,IAAI,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;AACtG,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA2B,EAC3B,cAAsB,EACtB,GAAW;IAEX,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,SAAS,IAAI,cAAc,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5D,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,cAAc,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACrG,CAAC;QACD,OAAO;YACL,GAAG,MAAM;YACT,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,sCAAsC;YAC/C,KAAK,EAAE,YAAY,MAAM,CAAC,SAAS,IAAI,GAAG,aAAa,cAAc,EAAE;YACvE,SAAS,EAAE,GAAG;SACf,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,kBAAkB,EAAE,CAAC;QAChD,OAAO;YACL,GAAG,MAAM;YACT,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,yBAAyB;YAClC,KAAK,EAAE,qBAAqB,MAAM,CAAC,KAAK,GAAG;YAC3C,SAAS,EAAE,GAAG;SACf,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,iFAAiF;AACjF,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAiB,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,MAAoB;IAC1D,MAAM,GAAG,GAAG,GAAG,WAAW,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IAChD,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACpD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,IAAI;QAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,wDAAwD;AACxD,gFAAgF;AAEhF,qEAAqE;AACrE,SAAS,OAAO,CAAC,GAAW,EAAE,IAAc,EAAE,GAAY,EAAE,OAAO,GAAG,eAAe;IACnF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,cAAc,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,0DAA0D;IAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,aAAa,QAAQ,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACvG,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,iFAAiF;QACjF,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1G,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAAC;AACzD,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc;IAC5B,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,IAAI,SAAS,CAAC;QACxF,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;QACxE,KAAK,GAAG,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,WAAW;QACX,UAAU;QACV,MAAM;QACN,KAAK;QACL,UAAU,EAAE,gBAAgB,EAAE;QAC9B,cAAc,EAAE,WAAW;QAC3B,iBAAiB,EAAE,mBAAmB,EAAE;KACzC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,KAAK,UAAU,4BAA4B,CACzC,KAAa,EACb,IAAY;IAEZ,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gCAAgC,KAAK,IAAI,IAAI,kBAAkB,EAAE;YACvF,OAAO,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,EAAE,6BAA6B,EAAE;YACvF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4D,CAAC;QAC3F,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE;YAC1D,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;YACxB,OAAO,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;SAC/B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAC5F,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAsB;QAC9B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,IAAI;QACnB,SAAS,EAAE,IAAI;QACf,eAAe,EAAE,KAAK;QACtB,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,IAAI;QACb,SAAS;QACT,MAAM,EAAE,MAAM;KACf,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnD,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,GAAG,EAAE,CAAC;YACR,OAAO;gBACL,GAAG,IAAI;gBACP,aAAa,EAAE,GAAG,CAAC,OAAO;gBAC1B,SAAS,EAAE,GAAG,CAAC,GAAG;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,eAAe,EAAE,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC;gBACvE,MAAM,EAAE,YAAY;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,GAAG,IAAI;YACP,aAAa,EAAE,MAAM,CAAC,OAAO;YAC7B,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,eAAe,EAAE,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;YAC1E,MAAM,EAAE,eAAe;SACxB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,6EAA6E,EAAE,CAAC;AAC3G,CAAC;AAUD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,UAAkB;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IACjD,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1B,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAc,EAAE,IAAc;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,aAAa,CAAC,aAAa,CAAC,CAAC;IAC/G,IAAI,GAAW,CAAC;IAChB,IAAI,OAAiB,CAAC;IACtB,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,GAAG,aAAa,CAAC;QACpB,OAAO,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IACnF,CAAC;SAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,GAAG,GAAG,QAAQ,CAAC;QACf,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,MAAM,CAAC;QACb,OAAO,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACrB,6EAA6E;QAC7E,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,IAAI,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,uBAAuB,CAAC;gBACtB,GAAG,MAAM;gBACT,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,sCAAsC;gBAC/C,KAAK,EAAE,SAAS,GAAG,SAAS;gBAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,mEAAmE;SAC7E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,8CAA8C,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;IAClH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAiB;QAC3B,QAAQ;QACR,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,wBAAwB,KAAK,CAAC,aAAa,GAAG;QACvD,WAAW,EAAE,IAAI,CAAC,cAAc;QAChC,SAAS,EAAE,KAAK,CAAC,aAAa,IAAI,SAAS;QAC3C,KAAK,EAAE,KAAK,CAAC,SAAS;QACtB,OAAO,EAAE,OAAO,IAAI,SAAS;QAC7B,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;IACF,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,QAAQ,MAAM,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG;QACX,QAAQ;QACR,IAAI,CAAC,UAAU;QACf,OAAO;QACP,KAAK,CAAC,SAAS;QACf,cAAc;QACd,IAAI,CAAC,UAAU;QACf,eAAe;QACf,WAAW;QACX,aAAa;QACb,QAAQ;QACR,gBAAgB;QAChB,IAAI,CAAC,cAAc;QACnB,QAAQ;QACR,OAAO,CAAC,QAAQ;QAChB,OAAO;QACP,OAAO;KACR,CAAC;IACF,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAErC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;AACxF,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qBAAqB;IACnC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO;QACL,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,WAAW;QACxB,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC"}