anon-pi 0.1.1 → 0.3.0

package/dist/anon-pi.js

@@ -17,46 +17,66 @@
 //     trust.json that trusts /work). anon-pi does not synthesize pi's trust.json.
 //   - Session identity = the ABSOLUTE workdir path (hashed). Same folder resumes
 //     the same session config+state; reseed is manual (delete the session dir).
-import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { isAbsolute, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 /** The container path the workdir is mounted at (pi's cwd). */
 export const CONTAINER_WORKDIR = '/work';
 /**
- * The DEFAULT container path the seeded pi config is mounted at (the pi global).
- * Absolute and image-independent: both podman (the -v target) and pi (the
- * PI_CODING_AGENT_DIR env) agree on it with no home-resolution guessing. A user
- * who knows their image's home can override it (ANON_PI_AGENT_MOUNT) to the
- * standard `~/.pi/agent` location, e.g. /root/.pi/agent for a root image.
+ * The container path pi uses as its config+state home. anon-pi mounts a
+ * PERSISTENT host dir here (Model B), so everything pi writes, sessions,
+ * history, settings (your model choice), `pi install`ed extensions, downloaded
+ * bin/fd, survives across launches. Statefulness is the default; --ephemeral
+ * mounts a throwaway dir here instead.
  */
-export const DEFAULT_CONTAINER_AGENT_DIR = '/opt/pi-agent';
-/** The pi env var that overrides its config dir (see pi config.ts getAgentDir). */
-export const PI_AGENT_DIR_ENV = 'PI_CODING_AGENT_DIR';
-const DEFAULT_PROXY = 'socks5h://127.0.0.1:9050';
-/** A user-facing error whose message is meant to be printed verbatim (no stack). */
-export class AnonPiError extends Error {
-}
+export const CONTAINER_AGENT_DIR = '/root/.pi/agent';
 /**
- * Resolve the container agent-mount path: ANON_PI_AGENT_MOUNT or the default.
- * It MUST be an absolute container path, because it is BOTH the podman `-v`
- * target AND pi's PI_CODING_AGENT_DIR, and podman (unlike pi) does not expand
- * `~`. A `~`-relative or relative value is rejected loudly rather than silently
- * mounted at a literal `~` directory or a cwd-relative path.
+ * Where the image STAGES its first-launch defaults (extensions + trust.json).
+ * NOT the agent dir, so it never conflicts with the persistent mount. The
+ * entrypoint promotes these into the mounted agent dir only when the home is
+ * FRESH (Model C seed-if-fresh).
  */
-export function resolveAgentMount(env) {
-    const raw = env.agentMount && env.agentMount.trim() !== ''
-        ? env.agentMount.trim()
-        : DEFAULT_CONTAINER_AGENT_DIR;
-    if (raw.startsWith('~')) {
-        throw new AnonPiError(`anon-pi: ANON_PI_AGENT_MOUNT must be an ABSOLUTE container path, not \`${raw}\`. ` +
-            'podman does not expand `~`; use the concrete home, e.g. /root/.pi/agent.');
-    }
-    if (!raw.startsWith('/')) {
-        throw new AnonPiError(`anon-pi: ANON_PI_AGENT_MOUNT must be an ABSOLUTE container path, not \`${raw}\` (it is both the mount target and pi's config dir).`);
-    }
-    return raw;
+export const CONTAINER_STAGE_DIR = '/opt/anon-pi-seed/agent';
+/**
+ * Where anon-pi mounts the canonical models.json (from `import`) read-only, so
+ * the first-launch seed can copy it into the fresh home alongside the image's
+ * staged defaults. Read-only: the container never writes back to the host seed.
+ */
+export const CONTAINER_MODELS_SEED = '/anon-pi-seed/models.json';
+/** Marker file written into the agent dir after seeding; holds the seed version. */
+export const SEED_MARKER = '.anon-pi-seed';
+/** The single file the host-side seed carries: pi's model/provider registry. */
+export const MODELS_FILE = 'models.json';
+/**
+ * containerRunCmd builds the container command: on a FRESH home (no seed
+ * marker), promote the image's staged defaults + the mounted models.json into
+ * the persistent agent dir and stamp the marker; then exec pi. On a seeded home
+ * it does nothing but exec pi, so pi's persisted state (incl. anything you
+ * `pi install`ed or models pi added) is used as-is and NEVER clobbered.
+ *
+ * seedVersion is written into the marker so a future image can re-seed changed
+ * defaults on a version bump; v1 only seeds when the marker is absent.
+ */
+export function containerRunCmd(seedVersion) {
+    const agent = CONTAINER_AGENT_DIR;
+    const marker = `${agent}/${SEED_MARKER}`;
+    return (`mkdir -p "${agent}" && ` +
+        `if [ ! -f "${marker}" ]; then ` +
+        // image-staged defaults (extensions, trust.json), if the image provides them
+        `{ [ -d "${CONTAINER_STAGE_DIR}" ] && cp -a "${CONTAINER_STAGE_DIR}/." "${agent}/" || true; } && ` +
+        // the host-imported models.json, if mounted
+        `{ [ -f "${CONTAINER_MODELS_SEED}" ] && cp "${CONTAINER_MODELS_SEED}" "${agent}/${MODELS_FILE}" || true; } && ` +
+        `printf '%s\\n' "${seedVersion}" > "${marker}"; ` +
+        `fi && ` +
+        `exec pi`);
+}
+/** The seed version anon-pi stamps when it seeds a fresh home (bump to re-seed). */
+export const SEED_VERSION = '1';
+/** A user-facing error whose message is meant to be printed verbatim (no stack). */
+export class AnonPiError extends Error {
 }
-/** Resolve the anon-pi home dir (holds the canonical seed + per-session state). */
+/** Resolve the anon-pi home dir (holds the seed). */
 export function resolveAnonPiHome(env) {
     if (env.anonPiHome)
         return resolve(env.anonPiHome);
@@ -65,99 +85,258 @@ export function resolveAnonPiHome(env) {
         : join(env.home, '.config');
     return join(base, 'anon-pi');
 }
-/** The canonical seed dir (copied FROM, never mounted). */
+/**
+ * The CANONICAL host seed dir holding models.json (written by `anon-pi import`).
+ * Mounted read-only so the first-launch seed can copy models.json into a fresh
+ * persistent home. Workdir-independent (import does not need a workdir).
+ */
 export function resolveConfigSeed(env) {
     if (env.configSeed)
         return resolve(env.configSeed);
     return join(resolveAnonPiHome(env), 'agent');
 }
 /**
- * Session id = a stable short hash of the ABSOLUTE workdir path, so re-running
- * anon-pi on the same folder resumes the same session config+state, and moving
- * the folder starts a new session (documented, accepted).
+ * Encode an absolute path into a directory name using pi's OWN convention (see
+ * pi coding-agent session-manager: `--${cwd without leading slash, / \ : -> -}--`),
+ * so an anon-pi state dir is readable and matches pi's mental model (no opaque
+ * hash). e.g. /home/u/dev/x -> --home-u-dev-x--
  */
-export function sessionId(absWorkdir) {
-    return createHash('sha256').update(absWorkdir).digest('hex').slice(0, 16);
+export function pathSlug(absPath) {
+    return `--${absPath.replace(/^[/\\]/, '').replace(/[/\\:]/g, '-')}--`;
 }
-/** The per-session seeded config dir on the host for a given workdir. */
-export function sessionAgentDir(env, absWorkdir) {
-    return join(resolveAnonPiHome(env), 'sessions', sessionId(absWorkdir), 'agent');
+/**
+ * The persistent per-workdir state dir on the host (mounted at the container's
+ * ~/.pi/agent). Keyed by the workdir via pi's path-slug convention:
+ *   <anonPiHome>/state/<slug>/agent
+ */
+export function stateAgentDir(env, absWorkdir) {
+    return join(resolveAnonPiHome(env), 'state', pathSlug(absWorkdir), 'agent');
+}
+/**
+ * Normalise a proxy-less host:port key from an ANON_PI_LLM value or a provider
+ * baseUrl, so `192.168.1.150:8080` matches `http://192.168.1.150:8080/v1`.
+ * Returns `host` (no port) or `host:port`, lowercased, scheme/path stripped.
+ */
+export function hostPortKey(value) {
+    let v = value.trim();
+    const scheme = v.indexOf('://');
+    if (scheme >= 0)
+        v = v.slice(scheme + 3);
+    v = v.split('/')[0]; // drop path (/v1, ...)
+    v = v.replace(/^[^@]*@/, ''); // drop any user:pass@
+    return v.toLowerCase();
+}
+/** apiKey values that are NOT real secrets (safe to carry into the seed). */
+const BENIGN_API_KEYS = new Set(['', 'none', 'ollama', 'no-key', 'local']);
+/**
+ * PURE: given a parsed host models.json and the ANON_PI_LLM value, select the
+ * provider whose baseUrl points at that host:port and return a barebones
+ * models.json carrying ONLY that provider (verbatim, with its models). Throws
+ * AnonPiError if nothing matches. Carries no other provider (so etherplay /
+ * google / paid API keys never enter the seed).
+ */
+export function pickProviderForLlm(hostModels, llmDirect) {
+    const providers = hostModels.providers ?? {};
+    const want = hostPortKey(llmDirect);
+    const matches = [];
+    for (const [name, p] of Object.entries(providers)) {
+        if (!p || typeof p !== 'object' || !p.baseUrl)
+            continue;
+        if (hostPortKey(p.baseUrl) === want)
+            matches.push(name);
+    }
+    if (matches.length === 0) {
+        const known = Object.entries(providers)
+            .filter(([, p]) => p && p.baseUrl)
+            .map(([n, p]) => `  ${n}: ${p.baseUrl}`)
+            .join('\n');
+        throw new AnonPiError(`anon-pi import: no provider in your host models.json points at ANON_PI_LLM (${want}).\n` +
+            (known
+                ? `Providers found:\n${known}\n`
+                : 'No providers with a baseUrl were found.\n') +
+            'Set ANON_PI_LLM to the host:port of a provider above, or add that provider to pi first.');
+    }
+    const name = matches[0];
+    const provider = providers[name];
+    const key = (provider.apiKey ?? '').trim().toLowerCase();
+    const apiKeyLooksReal = !BENIGN_API_KEYS.has(key);
+    return {
+        name,
+        models: { providers: { [name]: provider } },
+        apiKeyLooksReal,
+    };
+}
+/**
+ * The default host models.json path `import` reads FROM. Overridable via
+ * ANON_PI_SOURCE_MODELS; defaults to the real pi config (~/.pi/agent/models.json
+ * under the container-less host HOME, or PI_CODING_AGENT_DIR if the user set it).
+ */
+export function resolveSourceModelsPath(env) {
+    if (env.sourceModels && env.sourceModels.trim() !== '') {
+        return resolve(env.sourceModels);
+    }
+    const agentDir = env.piAgentDir && env.piAgentDir.trim() !== ''
+        ? env.piAgentDir
+        : join(env.home, '.pi', 'agent');
+    return join(agentDir, MODELS_FILE);
 }
 /**
  * Build the run plan from the environment + the (optional) workdir arg. PURE: it
- * resolves paths and composes the netcage argv, and reports whether a seed copy
- * is needed, but performs NO filesystem writes or spawns. It THROWS AnonPiError
- * for the two hard preconditions (missing image, missing llm) so the required
- * inputs fail loud; the missing-SEED check is left to cli.ts (it needs a real
- * `existsSync`), but `needsSeed` is derived from the injected `seedExists`.
+ * resolves paths and composes the netcage argv, performing NO filesystem writes
+ * or spawns. It THROWS AnonPiError for the required inputs (image, llm, proxy).
+ *
+ * Statefulness (Model B): a persistent per-workdir host dir is mounted at the
+ * container's ~/.pi/agent, so pi's sessions/history/settings/extensions persist.
+ * First-launch seed (Model C): when that home is FRESH, the container run
+ * command promotes the image's staged defaults + the imported models.json into
+ * it and stamps a marker; thereafter pi OWNS the home and nothing is clobbered.
+ *
+ * `modelsSeedExists` reports whether the canonical import models.json exists (so
+ * it is mounted for the seed); `stateExists` reports whether this workdir's
+ * state home already exists (so `fresh` is known).
+ *
+ * --ephemeral mounts NO writable state: pi writes to the container's own
+ * filesystem, which netcage runs with `--rm`, so it is destroyed when the
+ * container exits. Nothing writable ever touches a host path; there is no
+ * cleanup and no leftover-on-crash. (The read-only models.json seed is still
+ * mounted; it is a single file anon-pi never writes to.)
  */
-export function buildRunPlan(env, workdirArg, seedExists, sessionExists) {
+export function buildRunPlan(env, workdirArg, modelsSeedExists, stateExists) {
     if (!env.image || env.image.trim() === '') {
+        // dockerfilePath is injected (cli.ts resolves the shipped Dockerfile.pi via
+        // import.meta.url; tests pass a fixed path). Every command is emitted
+        // flush-left so it copy-pastes cleanly: an indented heredoc would bake
+        // leading spaces into the Dockerfile and break the EOF terminator, so we
+        // point at the shipped file instead of printing a heredoc.
+        const df = env.dockerfilePath ?? 'Dockerfile.pi';
+        const wv = env.webveilDockerfilePath ?? 'examples/Dockerfile.pi-webveil';
         throw new AnonPiError('anon-pi: set ANON_PI_IMAGE to a container image that has `pi` on its PATH.\n' +
             '\n' +
-            'No such image yet? Build a small one from the upstream-documented recipe\n' +
-            '(it installs the official @earendil-works/pi-coding-agent npm package):\n' +
+            'No image yet? A ready Dockerfile.pi ships with anon-pi (it installs the\n' +
+            'official @earendil-works/pi-coding-agent). Build it and point at it:\n' +
+            '\n' +
+            `podman build -t localhost/anon-pi-pi:latest -f "${df}" "$(dirname "${df}")"\n` +
+            'export ANON_PI_IMAGE=localhost/anon-pi-pi:latest\n' +
             '\n' +
-            "  cat > Dockerfile.pi <<'EOF'\n" +
-            '  FROM node:24-bookworm-slim\n' +
-            '  RUN apt-get update && apt-get install -y --no-install-recommends \\\n' +
-            '        bash ca-certificates git ripgrep && rm -rf /var/lib/apt/lists/*\n' +
-            '  RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent\n' +
-            '  WORKDIR /work\n' +
-            '  EOF\n' +
-            '  podman build -t localhost/anon-pi-pi:latest -f Dockerfile.pi .\n' +
-            '  export ANON_PI_IMAGE=localhost/anon-pi-pi:latest\n' +
+            'Or the fuller example with the pi-webveil extension + a local SearXNG\n' +
+            '(anonymized web search):\n' +
             '\n' +
-            'A ready Dockerfile.pi also ships with this package. See the README\n' +
-            '(Providing a pi image) for details and a community-image note.');
+            `podman build -t localhost/anon-pi-webveil:latest -f "${wv}" "$(dirname "${wv}")"\n` +
+            'export ANON_PI_IMAGE=localhost/anon-pi-webveil:latest\n' +
+            '\n' +
+            'See the README (Providing a pi image) for details and a community-image note.');
     }
     if (!env.llmDirect || env.llmDirect.trim() === '') {
         throw new AnonPiError('anon-pi: set ANON_PI_LLM to the RFC1918/link-local IP[:port] of the local model pi should reach directly (e.g. ANON_PI_LLM=192.168.1.150:8080). All other egress stays forced through the proxy.');
     }
+    if (!env.proxy || env.proxy.trim() === '') {
+        // No default: this is an anonymity tool, so the proxy is REQUIRED and never
+        // guessed (mirrors netcage, which fails closed without --proxy). A silent
+        // default would anonymize through the wrong endpoint, or fail deep in the
+        // jail with a confusing DNS error, if the guessed proxy is not actually up.
+        throw new AnonPiError('anon-pi: set ANON_PI_PROXY to your socks5h proxy. anon-pi has no default:\n' +
+            'the proxy is what makes the session anonymous, so it is never guessed.\n' +
+            '\n' +
+            'Pick the one you run (copy-paste), then re-run anon-pi:\n' +
+            '\n' +
+            '# Tor (system tor / Tor Browser bundle default port)\n' +
+            'export ANON_PI_PROXY=socks5h://127.0.0.1:9050\n' +
+            '\n' +
+            '# wireproxy -> a WireGuard VPN (Mullvad, Proton, ...); use YOUR configured\n' +
+            '# [Socks5] BindAddress port (1080 in wireproxy examples):\n' +
+            'export ANON_PI_PROXY=socks5h://127.0.0.1:1080\n' +
+            '\n' +
+            '# an SSH dynamic-forward (ssh -D 1080 host) or any other socks5h endpoint\n' +
+            'export ANON_PI_PROXY=socks5h://127.0.0.1:1080\n' +
+            '\n' +
+            'Only socks5h:// is accepted (plain socks5:// resolves DNS locally and leaks).');
+    }
     const home = env.home;
     if (!home || home.trim() === '') {
         throw new AnonPiError('anon-pi: could not resolve HOME.');
     }
     const raw = workdirArg && workdirArg.trim() !== '' ? workdirArg : process.cwd();
     const workdir = isAbsolute(raw) ? raw : resolve(raw);
-    const configSeed = resolveConfigSeed(env);
-    if (!seedExists(configSeed)) {
-        throw new AnonPiError(`anon-pi: canonical config not found at ${configSeed}.\n` +
-            'anon-pi never populates it for you. Create it yourself with the pi config you want\n' +
-            '(anon accounts, chosen models/skills, and a trust.json that trusts /work), e.g.:\n' +
-            `  mkdir -p ${configSeed}\n` +
-            `  cp -a ~/.pi/agent/. ${configSeed}/    # then remove any identity you do not want anonymized\n` +
-            'See the README (Populating the seed) for the trust.json requirement.');
-    }
-    const sessionDir = sessionAgentDir(env, workdir);
-    const needsSeed = !sessionExists(sessionDir);
-    const agentMount = resolveAgentMount(env);
-    const proxy = env.proxy && env.proxy.trim() !== '' ? env.proxy : DEFAULT_PROXY;
+    // Persistent per-workdir state home, unless --ephemeral (no writable mount).
+    const ephemeral = env.ephemeral === true;
+    const stateDir = ephemeral ? '' : stateAgentDir(env, workdir);
+    // Ephemeral home is always fresh (the container's throwaway layer); a
+    // persistent home is fresh iff its dir is absent.
+    const fresh = ephemeral ? true : !stateExists(stateDir);
+    // The canonical imported models.json is mounted (read-only) for the seed only
+    // when it exists; pi can also start with no models and you add them in-session.
+    const modelsSeed = join(resolveConfigSeed(env), MODELS_FILE);
+    const haveModelsSeed = modelsSeedExists(modelsSeed);
+    const proxy = env.proxy.trim();
+    // netcage's --allow-direct wants a bare IP[:port]/CIDR (no scheme/path), but a
+    // user naturally sets ANON_PI_LLM to a URL (http://192.168.1.150:8080). Strip
+    // it to host:port with the same helper `import` uses to match providers, so a
+    // URL, an ip:port, or a bare ip all work.
+    const directTarget = hostPortKey(env.llmDirect);
+    const seedVersion = env.seedVersion ?? SEED_VERSION;
     const netcageArgs = [
         'run',
         '--proxy',
         proxy,
         '--allow-direct',
-        env.llmDirect,
+        directTarget,
         '-it',
         '-v',
         workdir, // netcage defaults a target-less -v to /work and cwd to /work
-        '-v',
-        `${sessionDir}:${agentMount}`,
-        '-e',
-        `${PI_AGENT_DIR_ENV}=${agentMount}`,
-        env.image,
-        'pi',
     ];
+    // Persistent mode ONLY: mount the per-workdir state home at ~/.pi/agent
+    // (Model B). --ephemeral mounts nothing writable: pi writes to the container's
+    // own --rm layer, gone on exit, no host state.
+    if (!ephemeral) {
+        netcageArgs.push('-v', `${stateDir}:${CONTAINER_AGENT_DIR}`);
+    }
+    // Mount the imported models.json read-only for the first-launch seed, if any.
+    if (haveModelsSeed) {
+        netcageArgs.push('-v', `${modelsSeed}:${CONTAINER_MODELS_SEED}:ro`);
+    }
+    netcageArgs.push(env.image, 'sh', '-c', containerRunCmd(seedVersion));
     return {
         workdir,
-        sessionAgentDir: sessionDir,
-        configSeed,
-        agentMount,
-        needsSeed,
+        stateDir,
+        configSeed: haveModelsSeed ? modelsSeed : '',
+        fresh,
         netcageArgs,
     };
 }
+/**
+ * Absolute path to the Dockerfile.pi that ships with anon-pi, resolved from this
+ * module's location (package root, one level up from dist/anon-pi.js), or
+ * undefined if it cannot be found. Used only to make the missing-image error's
+ * build command concrete.
+ */
+export function shippedDockerfilePath() {
+    return shippedFile('Dockerfile.pi');
+}
+/**
+ * Absolute path to the fuller pi-webveil + SearXNG example that ships with
+ * anon-pi (examples/Dockerfile.pi-webveil), or undefined if not found.
+ */
+export function shippedWebveilDockerfilePath() {
+    return shippedFile(join('examples', 'Dockerfile.pi-webveil'));
+}
+/**
+ * Resolve a file shipped in the package root, from this module's location
+ * (package root is one level up from dist/anon-pi.js). Returns undefined if it
+ * cannot be found or import.meta.url is unavailable.
+ */
+function shippedFile(rel) {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        for (const p of [join(here, '..', rel), join(here, rel)]) {
+            if (existsSync(p))
+                return p;
+        }
+    }
+    catch {
+        // import.meta.url unavailable (e.g. some test bundlers): fall through.
+    }
+    return undefined;
+}
 /** Read the AnonPiEnv from a process env map (kept separate so tests inject one). */
 export function envFromProcess(penv) {
     return {
@@ -168,40 +347,68 @@ export function envFromProcess(penv) {
         image: penv.ANON_PI_IMAGE,
         llmDirect: penv.ANON_PI_LLM,
         xdgConfigHome: penv.XDG_CONFIG_HOME,
-        agentMount: penv.ANON_PI_AGENT_MOUNT,
+        dockerfilePath: shippedDockerfilePath(),
+        webveilDockerfilePath: shippedWebveilDockerfilePath(),
+        sourceModels: penv.ANON_PI_SOURCE_MODELS,
+        piAgentDir: penv.PI_CODING_AGENT_DIR,
+        ephemeral: isTruthy(penv.ANON_PI_EPHEMERAL),
     };
 }
+/** Whether an env-var string is set to a truthy value (1/true/yes, any case). */
+function isTruthy(v) {
+    if (!v)
+        return false;
+    const s = v.trim().toLowerCase();
+    return s === '1' || s === 'true' || s === 'yes' || s === 'on';
+}
 /** The --help text (kept here so it is covered by the same module). */
 export const HELP = `anon-pi - launch pi inside a netcage (anonymized egress + one direct local model)
 
 USAGE
-  anon-pi [WORKDIR]
+  anon-pi [WORKDIR]     launch pi jailed, working in WORKDIR (default: cwd)
+  anon-pi import        seed models.json from your local model
 
-  WORKDIR   the host folder pi works in (mounted at /work). Defaults to the
-            current directory. The session config+state is keyed to this folder.
+  WORKDIR   the host folder pi works in (mounted at ${CONTAINER_WORKDIR}; pi's cwd). Files pi
+            writes there land on the host.
 
 WHAT IT DOES
-  Seeds a per-workdir writable copy of your canonical anon-pi config into
-  ~/.config/anon-pi/sessions/<hash>/agent, mounts it as pi's global config
-  (${PI_AGENT_DIR_ENV}=<mount>, default ${DEFAULT_CONTAINER_AGENT_DIR}), mounts WORKDIR at
-  ${CONTAINER_WORKDIR}, opens ONE direct hole to your local model, and runs pi with all other
-  egress forced through the socks5h proxy, fail-closed. Requires \`netcage\`.
+  Runs pi inside netcage with all web/DNS egress forced through the socks5h
+  proxy (fail-closed) and ONE direct hole to your local model (ANON_PI_LLM).
+
+  STATEFUL by default: a persistent per-workdir home
+  (<ANON_PI_HOME>/state/<workdir>/agent) is mounted at the container's
+  ~/.pi/agent, so your conversations, history, settings (model choice), and any
+  extensions you \`pi install\` persist across launches. Re-running in the same
+  folder resumes it. On a FRESH home, the image's staged defaults (extensions,
+  trust) and your imported models.json are seeded in once; after that pi owns the
+  home and nothing is overwritten. Requires \`netcage\`.
+
+  --ephemeral (or ANON_PI_EPHEMERAL=1): mount NO writable state; pi writes to the
+  container's own --rm layer, gone on exit. Nothing writable touches the host,
+  no cleanup, no leftover-on-crash.
+
+import
+  Reads your host ~/.pi/agent/models.json, picks the provider whose baseUrl
+  serves ANON_PI_LLM, and writes JUST that provider to the canonical seed
+  (<ANON_PI_CONFIG>/models.json). No other provider's API keys, no sessions, no
+  identity. It SEEDS a fresh home; models you later add inside pi persist and are
+  never clobbered. Re-run with --force to overwrite the canonical seed.
 
 ENVIRONMENT
-  ANON_PI_IMAGE   (required) image with \`pi\` on PATH. No image yet? Running
-                  anon-pi without it prints a ready-to-build Dockerfile.pi
-                  recipe; see the README (Providing a pi image).
+  ANON_PI_IMAGE   (required for run) image with \`pi\` on PATH. No image yet?
+                  Running anon-pi without it prints a ready-to-build
+                  Dockerfile.pi recipe; see the README (Providing a pi image).
   ANON_PI_LLM     (required) RFC1918/link-local IP[:port] of the local model
-  ANON_PI_PROXY   socks5h URL (default ${DEFAULT_PROXY})
+  ANON_PI_PROXY   (required) socks5h URL of your proxy (Tor/wireproxy/ssh -D).
+                  No default: the proxy is what anonymizes, so it is never guessed.
+  ANON_PI_EPHEMERAL  set to 1 for a throwaway (non-persistent) session
   ANON_PI_HOME    anon-pi home (default $XDG_CONFIG_HOME/anon-pi or ~/.config/anon-pi)
-  ANON_PI_CONFIG  canonical seed dir (default <ANON_PI_HOME>/agent)
-  ANON_PI_AGENT_MOUNT  absolute container path for pi's config (default
-                  ${DEFAULT_CONTAINER_AGENT_DIR}; set to your image's ~/.pi/agent, e.g. /root/.pi/agent)
+  ANON_PI_CONFIG  canonical seed dir holding models.json (default <ANON_PI_HOME>/agent)
+  ANON_PI_SOURCE_MODELS  (import) host models.json to read (default ~/.pi/agent/models.json)
 
-RESEED
-  Reseed is manual: delete the session dir, e.g.
-    rm -rf ~/.config/anon-pi/sessions/<hash>/agent
-  and the next run re-seeds it from the canonical config.
+RESET A SESSION
+  Delete its state home to start fresh (re-seeds next launch):
+    rm -rf <ANON_PI_HOME>/state/<workdir-slug>/agent
 
 PLATFORM
   Linux only (via netcage's netns/nft jail). On macOS/Windows it works only

package/dist/anon-pi.js.map

@@ -1 +1 @@
-{"version":3,"file":"anon-pi.js","sourceRoot":"","sources":["../src/anon-pi.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,EAAE;AACF,sCAAsC;AACtC,8EAA8E;AAC9E,iFAAiF;AACjF,yEAAyE;AACzE,+EAA+E;AAC/E,kCAAkC;AAClC,gFAAgF;AAChF,sEAAsE;AACtE,6EAA6E;AAC7E,kFAAkF;AAClF,2EAA2E;AAC3E,kFAAkF;AAClF,yEAAyE;AACzE,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAEhF,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,OAAO,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AAChC,OAAO,EAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAC,MAAM,WAAW,CAAC;AAEpD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAE3D,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AA4CtD,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,oFAAoF;AACpF,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAc;IAC/C,MAAM,GAAG,GACR,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAC7C,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;QACvB,CAAC,CAAC,2BAA2B,CAAC;IAChC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,WAAW,CACpB,0EAA0E,GAAG,MAAM;YAClF,0EAA0E,CAC3E,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,WAAW,CACpB,0EAA0E,GAAG,uDAAuD,CACpI,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,GAAc;IAC/C,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,IAAI,GACT,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE;QACnD,CAAC,CAAC,GAAG,CAAC,aAAa;QACnB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC9B,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,iBAAiB,CAAC,GAAc;IAC/C,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,UAAkB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,GAAc,EAAE,UAAkB;IACjE,OAAO,IAAI,CACV,iBAAiB,CAAC,GAAG,CAAC,EACtB,UAAU,EACV,SAAS,CAAC,UAAU,CAAC,EACrB,OAAO,CACP,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC3B,GAAc,EACd,UAA8B,EAC9B,UAAoC,EACpC,aAAuC;IAEvC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CACpB,8EAA8E;YAC7E,IAAI;YACJ,4EAA4E;YAC5E,2EAA2E;YAC3E,IAAI;YACJ,iCAAiC;YACjC,gCAAgC;YAChC,yEAAyE;YACzE,2EAA2E;YAC3E,yEAAyE;YACzE,mBAAmB;YACnB,SAAS;YACT,oEAAoE;YACpE,sDAAsD;YACtD,IAAI;YACJ,sEAAsE;YACtE,gEAAgE,CACjE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,WAAW,CACpB,kMAAkM,CAClM,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,WAAW,CAAC,kCAAkC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GACR,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,WAAW,CACpB,0CAA0C,UAAU,KAAK;YACxD,sFAAsF;YACtF,oFAAoF;YACpF,cAAc,UAAU,IAAI;YAC5B,yBAAyB,UAAU,8DAA8D;YACjG,sEAAsE,CACvE,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAE7C,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,KAAK,GACV,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IAElE,MAAM,WAAW,GAAG;QACnB,KAAK;QACL,SAAS;QACT,KAAK;QACL,gBAAgB;QAChB,GAAG,CAAC,SAAS;QACb,KAAK;QACL,IAAI;QACJ,OAAO,EAAE,8DAA8D;QACvE,IAAI;QACJ,GAAG,UAAU,IAAI,UAAU,EAAE;QAC7B,IAAI;QACJ,GAAG,gBAAgB,IAAI,UAAU,EAAE;QACnC,GAAG,CAAC,KAAK;QACT,IAAI;KACJ,CAAC;IAEF,OAAO;QACN,OAAO;QACP,eAAe,EAAE,UAAU;QAC3B,UAAU;QACV,UAAU;QACV,SAAS;QACT,WAAW;KACX,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAC7B,IAAwC;IAExC,OAAO;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE;QAC5B,KAAK,EAAE,IAAI,CAAC,aAAa;QACzB,UAAU,EAAE,IAAI,CAAC,YAAY;QAC7B,UAAU,EAAE,IAAI,CAAC,cAAc;QAC/B,KAAK,EAAE,IAAI,CAAC,aAAa;QACzB,SAAS,EAAE,IAAI,CAAC,WAAW;QAC3B,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,UAAU,EAAE,IAAI,CAAC,mBAAmB;KACpC,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;;;;;;KAWf,gBAAgB,qBAAqB,2BAA2B;IACjE,iBAAiB;;;;;;;;yCAQoB,aAAa;;;;oBAIlC,2BAA2B;;;;;;;;;;CAU9C,CAAC"}
+{"version":3,"file":"anon-pi.js","sourceRoot":"","sources":["../src/anon-pi.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,EAAE;AACF,sCAAsC;AACtC,8EAA8E;AAC9E,iFAAiF;AACjF,yEAAyE;AACzE,+EAA+E;AAC/E,kCAAkC;AAClC,gFAAgF;AAChF,sEAAsE;AACtE,6EAA6E;AAC7E,kFAAkF;AAClF,2EAA2E;AAC3E,kFAAkF;AAClF,yEAAyE;AACzE,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAEhF,OAAO,EAAC,UAAU,EAAC,MAAM,SAAS,CAAC;AACnC,OAAO,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AAChC,OAAO,EAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAC,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAC,aAAa,EAAC,MAAM,UAAU,CAAC;AAEvC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAEjE,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAE3C,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IAClD,MAAM,KAAK,GAAG,mBAAmB,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,WAAW,EAAE,CAAC;IACzC,OAAO,CACN,aAAa,KAAK,OAAO;QACzB,cAAc,MAAM,YAAY;QAChC,6EAA6E;QAC7E,WAAW,mBAAmB,iBAAiB,mBAAmB,QAAQ,KAAK,mBAAmB;QAClG,4CAA4C;QAC5C,WAAW,qBAAqB,cAAc,qBAAqB,MAAM,KAAK,IAAI,WAAW,kBAAkB;QAC/G,mBAAmB,WAAW,QAAQ,MAAM,KAAK;QACjD,QAAQ;QACR,SAAS,CACT,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC;AA0DhC,oFAAoF;AACpF,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,GAAc;IAC/C,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,IAAI,GACT,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE;QACnD,CAAC,CAAC,GAAG,CAAC,aAAa;QACnB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAc;IAC/C,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACvC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAc,EAAE,UAAkB;IAC/D,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACxC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;IAC5C,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB;IACpD,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACxB,CAAC;AA8BD,6EAA6E;AAC7E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CACjC,UAAwB,EACxB,SAAiB;IAEjB,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,SAAS;QACxD,IAAI,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;aACrC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACvC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,IAAI,WAAW,CACpB,+EAA+E,IAAI,MAAM;YACxF,CAAC,KAAK;gBACL,CAAC,CAAC,qBAAqB,KAAK,IAAI;gBAChC,CAAC,CAAC,2CAA2C,CAAC;YAC/C,yFAAyF,CAC1F,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,eAAe,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAElD,OAAO;QACN,IAAI;QACJ,MAAM,EAAE,EAAC,SAAS,EAAE,EAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAC,EAAC;QACvC,eAAe;KACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAc;IACrD,IAAI,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,QAAQ,GACb,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAC7C,CAAC,CAAC,GAAG,CAAC,UAAU;QAChB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY,CAC3B,GAAc,EACd,UAA8B,EAC9B,gBAAqD,EACrD,WAA0C;IAE1C,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,4EAA4E;QAC5E,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,IAAI,eAAe,CAAC;QACjD,MAAM,EAAE,GAAG,GAAG,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;QACzE,MAAM,IAAI,WAAW,CACpB,8EAA8E;YAC7E,IAAI;YACJ,2EAA2E;YAC3E,wEAAwE;YACxE,IAAI;YACJ,mDAAmD,EAAE,iBAAiB,EAAE,OAAO;YAC/E,oDAAoD;YACpD,IAAI;YACJ,yEAAyE;YACzE,4BAA4B;YAC5B,IAAI;YACJ,wDAAwD,EAAE,iBAAiB,EAAE,OAAO;YACpF,yDAAyD;YACzD,IAAI;YACJ,+EAA+E,CAChF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,WAAW,CACpB,kMAAkM,CAClM,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,IAAI,WAAW,CACpB,6EAA6E;YAC5E,0EAA0E;YAC1E,IAAI;YACJ,2DAA2D;YAC3D,IAAI;YACJ,wDAAwD;YACxD,iDAAiD;YACjD,IAAI;YACJ,8EAA8E;YAC9E,6DAA6D;YAC7D,iDAAiD;YACjD,IAAI;YACJ,6EAA6E;YAC7E,iDAAiD;YACjD,IAAI;YACJ,+EAA+E,CAChF,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,WAAW,CAAC,kCAAkC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GACR,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAErD,6EAA6E;IAC7E,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9D,sEAAsE;IACtE,kDAAkD;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAExD,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAE/B,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,YAAY,CAAC;IAEpD,MAAM,WAAW,GAAG;QACnB,KAAK;QACL,SAAS;QACT,KAAK;QACL,gBAAgB;QAChB,YAAY;QACZ,KAAK;QACL,IAAI;QACJ,OAAO,EAAE,8DAA8D;KACvE,CAAC;IACF,wEAAwE;IACxE,+EAA+E;IAC/E,+CAA+C;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,IAAI,mBAAmB,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,8EAA8E;IAC9E,IAAI,cAAc,EAAE,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,IAAI,qBAAqB,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;IAEtE,OAAO;QACN,OAAO;QACP,QAAQ;QACR,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;QAC5C,KAAK;QACL,WAAW;KACX,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB;IACpC,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B;IAC3C,OAAO,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,GAAW;IAC/B,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1D,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC7B,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,uEAAuE;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAC7B,IAAwC;IAExC,OAAO;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE;QAC5B,KAAK,EAAE,IAAI,CAAC,aAAa;QACzB,UAAU,EAAE,IAAI,CAAC,YAAY;QAC7B,UAAU,EAAE,IAAI,CAAC,cAAc;QAC/B,KAAK,EAAE,IAAI,CAAC,aAAa;QACzB,SAAS,EAAE,IAAI,CAAC,WAAW;QAC3B,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,cAAc,EAAE,qBAAqB,EAAE;QACvC,qBAAqB,EAAE,4BAA4B,EAAE;QACrD,YAAY,EAAE,IAAI,CAAC,qBAAqB;QACxC,UAAU,EAAE,IAAI,CAAC,mBAAmB;QACpC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC;KAC3C,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAAC,CAAqB;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAC/D,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;sDAMkC,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CtE,CAAC"}