aicodeman 1.41.0 → 1.42.0

package/dist/folder-listing.js

@@ -0,0 +1,241 @@
+/**
+ * @fileoverview Folder listings for the file-preview folder grid.
+ *
+ * A folder the user opens (a clicked folder path, or "Folder" in the file
+ * preview) is resolved, checked against the same attachment guard a single file
+ * goes through, and GRANTED an id. The grid then asks for files by
+ * `folderId + file name` only, so browser requests never carry arbitrary paths —
+ * the rule the attachment routes follow for single files.
+ *
+ * Grants live in their own small registry, not in the attachment registry: that one
+ * is capped at 200 records per session, and a folder of 300 renders would evict the
+ * session's real attachments.
+ *
+ * Listings contain non-hidden subfolders and files whose type the preview supports
+ * (`isSupportedAttachmentExtension`), newest first, capped at
+ * {@link MAX_FOLDER_ENTRIES}. Local folders are read with `fs`; a remote (SSH) case's
+ * folder is listed on its host in one ssh round trip (`remoteListFolder`).
+ */
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { extname, isAbsolute, join, posix } from 'node:path';
+import { getAttachmentType, isSupportedAttachmentExtension, supportedAttachmentExtensions, } from './attachment-registry.js';
+import { isBlockedAttachmentPath, isUnderTree, loadAttachmentGuardConfig } from './config/attachment-guard.js';
+import { isMultiUserMode, userSpacePath } from './config/multiuser.js';
+import { remoteListFolder, RemoteFileAccessError } from './remote-files.js';
+import { describeUnknownPath, probePathKind } from './utils/bounded-path-probe.js';
+import { validateSessionFilePath } from './web/route-helpers.js';
+/** Most entries (files + subfolders) one listing returns. */
+export const MAX_FOLDER_ENTRIES = 1000;
+/** Folder grants kept per session; the oldest is dropped beyond this. */
+const MAX_FOLDER_GRANTS_PER_SESSION = 32;
+export class FolderListingError extends Error {
+    statusCode;
+    constructor(message, statusCode = 400) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
+class FolderGrants {
+    bySession = new Map();
+    grant(sessionId, dir) {
+        let grants = this.bySession.get(sessionId);
+        if (!grants) {
+            grants = new Map();
+            this.bySession.set(sessionId, grants);
+        }
+        for (const existing of grants.values()) {
+            if (existing.dir === dir) {
+                // Refresh its position so an often-used folder is the last to be dropped.
+                grants.delete(existing.folderId);
+                grants.set(existing.folderId, existing);
+                return existing.folderId;
+            }
+        }
+        const folderId = `fld_${randomUUID()}`;
+        grants.set(folderId, { folderId, dir });
+        while (grants.size > MAX_FOLDER_GRANTS_PER_SESSION) {
+            const oldest = grants.keys().next().value;
+            if (oldest === undefined)
+                break;
+            grants.delete(oldest);
+        }
+        return folderId;
+    }
+    get(sessionId, folderId) {
+        return this.bySession.get(sessionId)?.get(folderId);
+    }
+    clearSession(sessionId) {
+        this.bySession.delete(sessionId);
+    }
+}
+export const folderGrants = new FolderGrants();
+/**
+ * A file name inside a granted folder, or null when it is not one: no path
+ * separator, not hidden (which also rules out `.`/`..`; the listing leaves hidden
+ * entries out, so the routes do too), no NUL, and a type the preview supports.
+ */
+export function validFolderFileName(name) {
+    if (typeof name !== 'string' || !name || name.length > 255)
+        return null;
+    if (name.startsWith('.') || name.includes('/') || name.includes('\\') || name.includes('\0'))
+        return null;
+    const extension = extname(name).toLowerCase().replace(/^\./, '');
+    return isSupportedAttachmentExtension(extension) ? name : null;
+}
+/** Where a granted folder's file lives (on the session's host). */
+export function folderFilePath(dir, name) {
+    return posix.join(dir, name);
+}
+/**
+ * Multi-user rule for folder grants, the same one the filesystem path picker follows:
+ * a regular user reaches only their own space (`userSpacePath`) or the session's
+ * `workingDir`. User spaces live inside `homedir()`, so without it a user could list
+ * and read another user's space. Always true in single-user mode and for admins; a
+ * remote session's folders are on its host, where only the `workingDir` applies.
+ *
+ * @param path Already resolved (realpath on the session's host).
+ */
+export function folderAllowedForUser(path, user, scope) {
+    if (!isMultiUserMode())
+        return true;
+    if (!user)
+        return false;
+    if (user.role === 'admin')
+        return true;
+    if (scope.remote)
+        return !!scope.workingDir && isUnderTree(path, scope.workingDir);
+    return [userSpacePath(user.username), scope.workingDir].some((root) => !!root && !!validateSessionFilePath(root, path));
+}
+/**
+ * Resolve, guard, list and grant a folder for `sessionId`.
+ *
+ * A local folder is probed bounded first (`probePathKind`): one on a network mount
+ * that stopped answering must not freeze the server, and "did not answer" is never
+ * reported as "not found". The guard runs on the resolved folder before it is read.
+ *
+ * @param requestedPath Absolute, or `~/…` (the home of the session's host).
+ * @throws FolderListingError 400 not absolute / not a folder, 403 blocked or outside the
+ *   user's space, 404 missing, 502 remote unreachable, 503 local folder not answering.
+ */
+export async function listFolder(sessionId, requestedPath, options = {}) {
+    const homeRelative = typeof requestedPath === 'string' && (requestedPath === '~' || requestedPath.startsWith('~/'));
+    if (!requestedPath || typeof requestedPath !== 'string' || (!isAbsolute(requestedPath) && !homeRelative)) {
+        throw new FolderListingError('Folder path must be absolute');
+    }
+    const guard = await loadAttachmentGuardConfig();
+    const workingDir = options.sessionWorkingDir;
+    const assertAllowed = (dir) => {
+        const confined = !guard.confineToWorkspace
+            ? true
+            : options.remote
+                ? !!workingDir && isUnderTree(dir, workingDir)
+                : !!workingDir && !!validateSessionFilePath(workingDir, dir);
+        if (!confined || isBlockedAttachmentPath(dir, guard.blockedTrees)) {
+            throw new FolderListingError('Access to this folder is blocked', 403);
+        }
+        if (!folderAllowedForUser(dir, options.user, { workingDir, remote: options.remote })) {
+            throw new FolderListingError('Folder is outside your space', 403);
+        }
+    };
+    let dir;
+    let entries;
+    let truncated = false;
+    if (options.remote) {
+        const remotePath = requestedPath === '~' ? '~/' : requestedPath;
+        let listing;
+        try {
+            listing = await remoteListFolder(options.remote, remotePath, supportedAttachmentExtensions(), MAX_FOLDER_ENTRIES);
+        }
+        catch (err) {
+            throw new FolderListingError(err instanceof RemoteFileAccessError ? err.message : 'remote host unreachable', 502);
+        }
+        if (!listing)
+            throw new FolderListingError('Folder not found', 404);
+        if (listing === 'not-a-folder')
+            throw new FolderListingError('Not a folder');
+        ({ dir, entries, truncated } = listing);
+        // One ssh call lists and resolves together, so the guard can only run after it;
+        // nothing of a refused listing leaves this function.
+        assertAllowed(dir);
+    }
+    else {
+        const expanded = homeRelative ? join(homedir(), requestedPath.slice(2)) : requestedPath;
+        const kind = await probePathKind(expanded, { pastCap: true });
+        if (kind === 'unknown') {
+            throw new FolderListingError(describeUnknownPath('Folder', expanded, { pastCap: true }), 503);
+        }
+        if (kind === 'absent')
+            throw new FolderListingError('Folder not found', 404);
+        if (kind !== 'directory')
+            throw new FolderListingError('Not a folder');
+        try {
+            dir = await fs.realpath(expanded);
+        }
+        catch {
+            throw new FolderListingError('Folder not found', 404);
+        }
+        assertAllowed(dir);
+        ({ entries, truncated } = await listLocalFolder(dir));
+    }
+    const files = [];
+    const folders = [];
+    for (const entry of entries) {
+        if (entry.name.startsWith('.'))
+            continue;
+        // A secret that happens to sit in an open folder stays out of the grid too.
+        if (isBlockedAttachmentPath(folderFilePath(dir, entry.name), guard.blockedTrees))
+            continue;
+        if (entry.kind === 'directory') {
+            folders.push(entry.name);
+            continue;
+        }
+        const extension = extname(entry.name).toLowerCase().replace(/^\./, '');
+        if (!isSupportedAttachmentExtension(extension))
+            continue;
+        files.push({
+            name: entry.name,
+            extension,
+            attachmentType: getAttachmentType(extension),
+            size: entry.size,
+            mtimeMs: entry.mtimeMs,
+        });
+    }
+    files.sort((a, b) => b.mtimeMs - a.mtimeMs || a.name.localeCompare(b.name));
+    folders.sort((a, b) => a.localeCompare(b));
+    return { folderId: folderGrants.grant(sessionId, dir), path: dir, files, folders, truncated };
+}
+/** Local counterpart of the remote listing script: subfolders + supported files, stat'ed through symlinks. */
+async function listLocalFolder(dir) {
+    const dirents = await fs.readdir(dir, { withFileTypes: true });
+    const entries = [];
+    let truncated = false;
+    for (const dirent of dirents) {
+        if (dirent.name.startsWith('.'))
+            continue;
+        if (entries.length >= MAX_FOLDER_ENTRIES) {
+            truncated = true;
+            break;
+        }
+        const extension = extname(dirent.name).toLowerCase().replace(/^\./, '');
+        const maybeFile = isSupportedAttachmentExtension(extension);
+        if (!dirent.isDirectory() && !maybeFile && !dirent.isSymbolicLink())
+            continue;
+        let stat;
+        try {
+            stat = await fs.stat(join(dir, dirent.name));
+        }
+        catch {
+            continue; // dangling symlink, or gone since readdir
+        }
+        if (stat.isDirectory()) {
+            entries.push({ kind: 'directory', name: dirent.name, size: 0, mtimeMs: 0 });
+        }
+        else if (stat.isFile() && maybeFile) {
+            entries.push({ kind: 'file', name: dirent.name, size: stat.size, mtimeMs: stat.mtimeMs });
+        }
+    }
+    return { entries, truncated };
+}
+//# sourceMappingURL=folder-listing.js.map

package/dist/folder-listing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"folder-listing.js","sourceRoot":"","sources":["../src/folder-listing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC/G,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAA0B,MAAM,mBAAmB,CAAC;AAGpG,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC,yEAAyE;AACzE,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAoBzC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGhC;IAFX,YACE,OAAe,EACN,aAAqB,GAAG;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,eAAU,GAAV,UAAU,CAAc;IAGnC,CAAC;CACF;AAOD,MAAM,YAAY;IACR,SAAS,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEhE,KAAK,CAAC,SAAiB,EAAE,GAAW;QAClC,IAAI,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;gBACzB,0EAA0E;gBAC1E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACxC,OAAO,QAAQ,CAAC,QAAQ,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,UAAU,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,IAAI,GAAG,6BAA6B,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC1C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,GAAG,CAAC,SAAiB,EAAE,QAAgB;QACrC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;AAE/C;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1G,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,8BAA8B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,IAAY;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,IAA0B,EAC1B,KAAsD;IAEtD,IAAI,CAAC,eAAe,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACnF,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAC1D,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,aAAqB,EACrB,UAA6B,EAAE;IAE/B,MAAM,YAAY,GAAG,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa,KAAK,GAAG,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACpH,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACzG,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC7C,MAAM,aAAa,GAAG,CAAC,GAAW,EAAQ,EAAE;QAC1C,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,kBAAkB;YACxC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,CAAC,MAAM;gBACd,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC;gBAC9C,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,uBAAuB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,IAAI,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,GAAW,CAAC;IAChB,IAAI,OAA4B,CAAC;IACjC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,aAAa,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAChE,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,6BAA6B,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACpH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,GAAG,YAAY,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,OAAO,KAAK,cAAc;YAAE,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;QAC7E,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC;QACxC,gFAAgF;QAChF,qDAAqD;QACrD,aAAa,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACxF,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC7E,IAAI,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACzC,4EAA4E;QAC5E,IAAI,uBAAuB,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC;YAAE,SAAS;QAC3F,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC;YAAE,SAAS;QACzD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS;YACT,cAAc,EAAE,iBAAiB,CAAC,SAAS,CAAC;YAC5C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3C,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChG,CAAC;AAED,8GAA8G;AAC9G,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1C,IAAI,OAAO,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACzC,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM;QACR,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE;YAAE,SAAS;QAC9E,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,0CAA0C;QACtD,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC"}

package/dist/git-worktrees.d.ts

@@ -0,0 +1,292 @@
+/**
+ * @fileoverview Git worktrees for a LOCAL case: list, create and remove the worktrees a
+ * repository-backed case keeps under `<repo>/.claude/worktrees/<name>`, so several agents working
+ * on one repository each get their own working tree instead of sharing the case folder (sessions
+ * in one case share its folder, and two agents editing, building and committing in one checkout
+ * step on each other). Routes: `src/web/routes/worktree-routes.ts`; a session starts in one
+ * through the existing create paths (`POST /api/quick-start` with `worktree`, or
+ * `POST /api/sessions` with the worktree as `workingDir`).
+ *
+ * WHERE. `<repo>/.claude/worktrees/<name>` on a new branch `worktree-<name>` is Claude Code's own
+ * `--worktree` layout (measured in Claude Code 2.1.296: path `<repo>/.claude/worktrees/<name>`,
+ * branch `worktree-<name>`, names of letters, digits, `.`, `_`, `-`, at most 64 characters), and
+ * Codeman already recognizes it (the worktree pill, `CLAUDE_WORKTREE_PATH` in session-routes.ts).
+ * Names here are a strict subset of Claude's (one segment, starting with a letter or digit), so a
+ * worktree made here is one `claude --worktree <name>` would also find. The main checkout must not
+ * show the worktrees as untracked, so `/.claude/worktrees/` is appended to the repository's LOCAL
+ * `info/exclude` (in the real common git dir, never a tracked `.gitignore`) when git does not
+ * already ignore it. `/.claude/settings.local.json` gets the same treatment: Codeman installs its
+ * hooks there for every claude session, and an untracked copy in a worktree makes
+ * `git worktree remove` refuse forever (Claude Code itself ignores that file through the global
+ * excludes file, which is not guaranteed to be set up on a given machine). The copy of Codeman's
+ * agent skill (`<skills dir>/codeman/`, injected while `agentSkillEnabled` is on) is excluded for
+ * the same reason, for every skills folder the registry names (`WorktreeOptions.agentSkillDirs`).
+ *
+ * Split like the other git modules: a PURE half (name and branch validation, `worktree list`
+ * parsing, exclude text, the managed-path rule) unit-tested without git, and an IO half that
+ * spawns git through an injectable runner.
+ *
+ * Rules the code keeps and the tests pin:
+ *   - git is spawned with an argv array, never a shell, with `--` before every path operand, the
+ *     non-interactive environment of `gitNonInteractiveEnv()`, a timeout that kills the whole
+ *     process group, and capped output. Read-only calls add `--no-optional-locks`.
+ *   - Names and branches are validated BEFORE they reach git (charset, length, then
+ *     `git check-ref-format --branch`, whose answer must equal the input: `@{-1}` style shorthands
+ *     are refused up front, since `--branch` would expand them).
+ *   - Only `<repo>/.claude/worktrees/<valid-name>` is ever created or removed. Every component of
+ *     that path is `lstat`ed (a symlinked `.claude` or `worktrees` directory, or a symlink at the
+ *     worktree itself, is refused) and its real path must be exactly the expected one, so a
+ *     repository cannot redirect a create or a remove outside itself. What is left is a same-user
+ *     race (an agent swapping a directory between the check and git), which is accepted: that
+ *     agent already runs code as this user.
+ *   - Removal is `git worktree remove` WITHOUT `--force` (git refuses a tree with modified or
+ *     untracked files, and that refusal is the answer), refused while a live session runs inside
+ *     the worktree, and the optional branch delete is `git branch -d` (never `-D`, so an unmerged
+ *     branch survives).
+ *   - git never runs for a case at or inside a Docker case workspace (or whose common git dir is
+ *     there): a container could plant a checkout filter or a hook, and `git worktree add` runs the
+ *     repository's post-checkout hook and filters on the HOST. On a local case that is acceptable,
+ *     since the user's agent runs code there anyway. A managed worktree that is, sits inside, or
+ *     holds a Docker case workspace is never removed either: `git worktree remove` runs a status
+ *     inside the tree, then deletes it under the container.
+ *   - A repository that merely encloses the case and is the home folder or above (a dotfiles repo
+ *     in `$HOME`) is not the case's repository, and a case folder below a repository's top level
+ *     is refused: the worktrees would not be where the case is.
+ *
+ * @module git-worktrees
+ */
+/** Claude Code's own limit for a `--worktree` name (2.1.296). */
+export declare const MAX_WORKTREE_NAME_LENGTH = 64;
+/** Longest accepted branch name. git allows more; 200 covers every real one. */
+export declare const MAX_WORKTREE_BRANCH_LENGTH = 200;
+/** A read-only git call (rev-parse, worktree list, check-ignore, check-ref-format). */
+export declare const WORKTREE_READ_TIMEOUT_MS = 15000;
+/**
+ * `git worktree add` checks out a whole tree and runs the repository's post-checkout hook and
+ * smudge filters (Git LFS downloads objects there), so it gets the longest budget.
+ */
+export declare const WORKTREE_ADD_TIMEOUT_MS = 180000;
+/** `git worktree remove` runs a status of the tree first, then deletes it. */
+export declare const WORKTREE_REMOVE_TIMEOUT_MS = 60000;
+/** Worktrees listed. A repository with more is unusual; the count says when it was cut. */
+export declare const MAX_WORKTREES_LISTED = 200;
+/** Path segments of the managed worktrees folder, relative to the repository root. */
+export declare const WORKTREES_DIR_SEGMENTS: readonly [".claude", "worktrees"];
+/** The `info/exclude` line that hides the managed worktrees from the main checkout. */
+export declare const WORKTREES_EXCLUDE_LINE = "/.claude/worktrees/";
+/** The `info/exclude` line for the hooks file Codeman writes into every claude workspace. */
+export declare const SETTINGS_LOCAL_EXCLUDE_LINE = "/.claude/settings.local.json";
+/**
+ * The `info/exclude` line for the copy of Codeman's agent skill in `skillsDir` of a workspace
+ * (`<skillsDir>/codeman/`, written into the folder a session runs in while `agentSkillEnabled`
+ * is on), or null for a folder that is not a plain relative path.
+ */
+export declare function agentSkillExcludeLine(skillsDir: string): string | null;
+/**
+ * Why `name` cannot be a worktree name, or null when it can. One path segment of letters, digits,
+ * `.`, `_` and `-`, starting with a letter or digit, at most 64 characters, never `..` (the
+ * session path schema refuses any path containing it), and not ending in `.` or `.lock` (git's
+ * own ref rules, since the default branch is derived from the name).
+ */
+export declare function worktreeNameError(name: unknown): string | null;
+/** The branch a new worktree gets when the caller names none: Claude Code's `worktree-<name>`. */
+export declare function defaultWorktreeBranch(name: string): string;
+/**
+ * Why `branch` cannot be a new branch name, or null when it passes the charset gate. The final
+ * word is `git check-ref-format --branch` (see `createCaseWorktree`); this gate exists so nothing
+ * option-shaped, `@{...}`-shaped or otherwise surprising ever reaches git at all.
+ */
+export declare function worktreeBranchError(branch: unknown): string | null;
+/** Why `base` cannot be a start point, or null. The same gate Clone Repo uses for a ref. */
+export declare function worktreeBaseError(base: unknown): string | null;
+/** `<repo>/.claude/worktrees`. */
+export declare function managedWorktreesDir(repoRoot: string): string;
+/** `<repo>/.claude/worktrees/<name>`. The caller validates `name` first. */
+export declare function managedWorktreePath(repoRoot: string, name: string): string;
+/**
+ * The managed worktree name of `path`, or null when it is not exactly
+ * `<repoRoot>/.claude/worktrees/<valid-name>`. Lexical: both sides must already be real paths.
+ */
+export declare function managedWorktreeName(repoRoot: string, path: string): string | null;
+/** True when `child` is `root` or inside it (lexical, on resolved paths). */
+export declare function isPathWithin(child: string, root: string): boolean;
+/**
+ * `path` as the repository spells it: a path under `alias` (the case folder as its case resolves
+ * it, which can run through a symlink) moved under `root` (the repository's real top level), else
+ * `path` unchanged. Lexical, so it costs no filesystem call per session. Sessions keep the
+ * `workingDir` they were created with, while the worktree paths git lists are real, so without
+ * this a session spelled through the case's link counted for no worktree and did not block its
+ * removal.
+ */
+export declare function respellUnder(path: string, alias: string, root: string): string;
+export interface ParsedWorktree {
+    path: string;
+    /** Commit checked out (absent for a bare entry). */
+    head: string | null;
+    /** Short branch name (`refs/heads/` stripped), null when detached or bare. */
+    branch: string | null;
+    detached: boolean;
+    bare: boolean;
+    locked: boolean;
+    lockReason?: string;
+    prunable: boolean;
+    prunableReason?: string;
+}
+/**
+ * Undo git's C-style path quoting (`"a\\"b\\303\\251"` → `a"bé`). Paths are printed quoted when
+ * they hold a `"`, a `\` or a control character even with `core.quotePath=false`; octal escapes are
+ * raw bytes, decoded as UTF-8. Text that is not quoted comes back unchanged.
+ */
+export declare function unquoteGitPath(text: string): string;
+/**
+ * Parse `git worktree list --porcelain` (newline-terminated form: `-z` needs git 2.36, and Ubuntu
+ * 22.04 ships 2.34). Records are separated by blank lines; the first is the main worktree. Paths
+ * are read through `unquoteGitPath`, which together with `-c core.quotePath=false` keeps non-ASCII
+ * repository paths readable.
+ */
+export declare function parseWorktreeList(text: string): ParsedWorktree[];
+/**
+ * What to append to an `info/exclude` holding `existing` so that every line of `lines` is in it:
+ * the text ('' when nothing is missing) and the lines it adds. A file that does not end in a
+ * newline gets one first, so an appended pattern never fuses with the user's last line.
+ */
+export declare function excludeAppendText(existing: string, lines: readonly string[]): {
+    text: string;
+    added: string[];
+};
+/**
+ * The part of git's stderr a user should see: its `fatal:`/`error:` lines (with any `hint:` lines
+ * dropped, they repeat what the UI says), sanitized and capped. Shown through `textContent` only.
+ */
+export declare function gitRefusalText(stderr: string): string;
+export interface WorktreeGitResult {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+    spawnError?: string;
+}
+/** Runs `git <args>` in `cwd`; never throws. Injected so tests can refuse to run git at all. */
+export type WorktreeGitRunner = (cwd: string, args: string[], opts?: {
+    timeoutMs?: number;
+}) => Promise<WorktreeGitResult>;
+/**
+ * The production runner: argv only (no shell), the non-interactive environment, captured output
+ * caps, and a timeout that signals the whole process group (`detached: true`), because
+ * `git worktree add` fans out into checkout children, hooks and filters that a signal to the
+ * parent alone would leave running.
+ */
+export declare const runWorktreeGit: WorktreeGitRunner;
+/** Failure codes, named after the API error codes the routes map them to. */
+export type WorktreeFailureCode = 'INVALID_INPUT' | 'NOT_FOUND' | 'ALREADY_EXISTS' | 'CONFLICT' | 'OPERATION_FAILED';
+export interface WorktreeFailure {
+    ok: false;
+    code: WorktreeFailureCode;
+    message: string;
+    /** git's own words, when git refused (sanitized; render as text). */
+    gitMessage?: string;
+}
+export interface CaseRepository {
+    /** The repository's top level, which is the case folder (real path). */
+    repoRoot: string;
+    /** The real common git dir (`.git` of the main checkout), where `info/exclude` lives. */
+    commonDir: string;
+}
+export interface WorktreeOptions {
+    git?: WorktreeGitRunner;
+    /** Host paths of every Docker case workspace: git never runs at or inside one. */
+    dockerWorkspaces?: string[];
+    /** Overrides `os.homedir()` for the unrelated-ancestor rule (tests). */
+    home?: string;
+    /**
+     * Every workspace skills folder a session can get Codeman's agent skill in (the registry's
+     * `capabilities.agentSkillDir` values, passed in as data by the caller). A create excludes
+     * `<dir>/codeman/` for each, like the hooks file: a session in a worktree gets an untracked
+     * copy there, and `git worktree remove` would refuse that worktree forever.
+     */
+    agentSkillDirs?: readonly string[];
+}
+/**
+ * The repository a case folder IS, or why it is not one Codeman makes worktrees for. Never runs
+ * git when the folder (or the repository's common git dir) is at or inside a Docker case workspace.
+ */
+export declare function resolveCaseRepository(casePath: string, opts?: WorktreeOptions): Promise<{
+    ok: true;
+    repo: CaseRepository;
+} | WorktreeFailure>;
+export interface CaseWorktree extends ParsedWorktree {
+    /** The repository's main checkout (git lists it first). */
+    main: boolean;
+    /** The case folder itself (the main checkout, or a linked worktree linked as the case). */
+    isCase: boolean;
+    /** Under `<repo>/.claude/worktrees/<valid-name>`: Codeman may start sessions in it and remove it. */
+    managed: boolean;
+    /** The managed name, when `managed`. */
+    name?: string;
+}
+export declare function listCaseWorktrees(repo: CaseRepository, opts?: WorktreeOptions): Promise<{
+    ok: true;
+    worktrees: CaseWorktree[];
+    truncated: boolean;
+} | WorktreeFailure>;
+/**
+ * The managed worktree `name` of `repo` as it is on disk now: every component a real directory
+ * (no symlinks), the real path the expected one, and git listing it as a worktree of this
+ * repository. Used by removal and by starting a session in it.
+ *
+ * `allowMissing` (removal only, never a session start) also accepts a worktree whose folder is
+ * GONE (deleted by hand, or by an agent) while git still lists it, as prunable, at exactly the
+ * managed path: no component on the way may be a symlink or a file, and `missing` says so.
+ * Without it such a worktree was a dead end: it could not be removed, and its name could not be
+ * used again (the branch exists, then git refuses "a missing but already registered worktree").
+ */
+export declare function resolveManagedWorktree(repo: CaseRepository, name: string, opts?: WorktreeOptions & {
+    allowMissing?: boolean;
+}): Promise<{
+    ok: true;
+    path: string;
+    worktree: CaseWorktree;
+    missing: boolean;
+} | WorktreeFailure>;
+export interface CreateWorktreeRequest {
+    name: string;
+    /** New branch; default `worktree-<name>`. */
+    branch?: string;
+    /** Start point; default `HEAD` (the case's current commit). */
+    base?: string;
+}
+export interface CreatedWorktree {
+    name: string;
+    path: string;
+    branch: string;
+    base: string;
+    /** The commit the new branch starts at. */
+    head: string;
+    /** Lines appended to the repository's `info/exclude` (empty when git already ignored them). */
+    excludeAdded: string[];
+    warnings: string[];
+}
+export declare function createCaseWorktree(repo: CaseRepository, req: CreateWorktreeRequest, opts?: WorktreeOptions): Promise<{
+    ok: true;
+    worktree: CreatedWorktree;
+} | WorktreeFailure>;
+export interface RemoveWorktreeRequest {
+    name: string;
+    /** Also `git branch -d` the worktree's branch (never `-D`). */
+    deleteBranch?: boolean;
+    /** True when a live session runs at or inside `path`: the removal is refused. */
+    isInUse: (path: string) => boolean | Promise<boolean>;
+}
+export interface RemovedWorktree {
+    name: string;
+    path: string;
+    branch: string | null;
+    branchDeleted: boolean;
+    /** git's refusal to delete the branch (typically "not fully merged"); the worktree is gone regardless. */
+    branchError?: string;
+}
+export declare function removeCaseWorktree(repo: CaseRepository, req: RemoveWorktreeRequest, opts?: WorktreeOptions): Promise<{
+    ok: true;
+    removed: RemovedWorktree;
+} | WorktreeFailure>;
+//# sourceMappingURL=git-worktrees.d.ts.map

package/dist/git-worktrees.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-worktrees.d.ts","sourceRoot":"","sources":["../src/git-worktrees.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAWH,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAC/C;;;GAGG;AACH,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAC/C,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,QAAS,CAAC;AAKjD,2FAA2F;AAC3F,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,mCAAoC,CAAC;AACxE,uFAAuF;AACvF,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAC5D,6FAA6F;AAC7F,eAAO,MAAM,2BAA2B,iCAAiC,CAAC;AAK1E;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGtE;AAOD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAU9D;AAED,kGAAkG;AAClG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWlE;AAED,4FAA4F;AAC5F,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI9D;AAID,kCAAkC;AAClC,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOjF;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAIjE;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAK9E;AAID,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBnD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CA6ChE;AAID;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAS/G;AAID;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CASrD;AAID,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1B,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAQhC;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,iBAqDzB,CAAC;AAIL,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAAG,eAAe,GAAG,WAAW,GAAG,gBAAgB,GAAG,UAAU,GAAG,kBAAkB,CAAC;AAErH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAmBD,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAgBD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GAAG,eAAe,CAAC,CAgC/D;AAID,MAAM,WAAW,YAAa,SAAQ,cAAc;IAClD,2DAA2D;IAC3D,IAAI,EAAE,OAAO,CAAC;IACd,2FAA2F;IAC3F,MAAM,EAAE,OAAO,CAAC;IAChB,qGAAqG;IACrG,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,cAAc,EACpB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,YAAY,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,eAAe,CAAC,CAmBxF;AAmDD;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,eAAe,GAAG;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACtD,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,eAAe,CAAC,CA6CjG;AA+DD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,qBAAqB,EAC1B,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GAAG,eAAe,CAAC,CAkGpE;AAID,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iFAAiF;IACjF,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,0GAA0G;IAC1G,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,qBAAqB,EAC1B,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GAAG,eAAe,CAAC,CA+DnE"}