botmux 3.10.0 → 3.11.0

package/dist/core/explicit-session-backing-cleanup.d.ts

@@ -0,0 +1,49 @@
+import type { BackendType } from '../adapters/backend/types.js';
+import type { RiffBackendConfig } from '../adapters/backend/riff-backend.js';
+import { cancelRiffTaskById } from '../adapters/backend/riff-backend.js';
+import { killPersistentSession, probePersistentSession } from './persistent-backend.js';
+export type ExplicitSessionBackingCleanupResult = {
+    ok: true;
+    kind: 'skipped_adopted' | 'no_backing';
+} | {
+    ok: true;
+    kind: 'destroyed_persistent';
+    backendType: 'tmux' | 'herdr' | 'zellij' | 'zmx';
+    name: string;
+} | {
+    ok: true;
+    kind: 'cancelled_riff';
+    taskId: string;
+} | {
+    ok: false;
+    kind: 'persistent_destroy_failed' | 'riff_config_missing' | 'riff_cancel_failed';
+    backendType: BackendType;
+    taskId?: string;
+    error?: string;
+};
+export interface ExplicitSessionBackingCleanupInput {
+    sessionId: string;
+    backendType?: BackendType;
+    riffParentTaskId?: string;
+    /** Adopted panes/agents are user-owned. Explicit Botmux close only detaches
+     * its logical row and must never destroy the observed backing resource. */
+    adopted?: boolean;
+    /** Current authoritative config for the row's bot. Required only when the
+     * row is frozen to Riff and still carries a remote task id. */
+    riffConfig?: RiffBackendConfig;
+}
+export interface ExplicitSessionBackingCleanupDeps {
+    cancelRiffTask?: typeof cancelRiffTaskById;
+    killPersistent?: typeof killPersistentSession;
+    probePersistent?: typeof probePersistentSession;
+}
+/**
+ * Destroy the Botmux-owned backing resource before an offline/worker-less
+ * explicit close is published.
+ *
+ * This helper never mutates the session record. In particular, callers may
+ * erase `riffParentTaskId` only after `kind === 'cancelled_riff'`; a failed or
+ * unconfigurable cancellation therefore retains the durable retry handle.
+ */
+export declare function cleanupExplicitSessionBacking(input: ExplicitSessionBackingCleanupInput, deps?: ExplicitSessionBackingCleanupDeps): Promise<ExplicitSessionBackingCleanupResult>;
+//# sourceMappingURL=explicit-session-backing-cleanup.d.ts.map

package/dist/core/explicit-session-backing-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"explicit-session-backing-cleanup.d.ts","sourceRoot":"","sources":["../../src/core/explicit-session-backing-cleanup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAEL,qBAAqB,EAErB,sBAAsB,EACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,MAAM,mCAAmC,GAC3C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,GAAG,YAAY,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1G;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,2BAA2B,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;IACjF,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,MAAM,WAAW,kCAAkC;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;+EAC2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;mEAC+D;IAC/D,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED,MAAM,WAAW,iCAAiC;IAChD,cAAc,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC3C,cAAc,CAAC,EAAE,OAAO,qBAAqB,CAAC;IAC9C,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,kCAAkC,EACzC,IAAI,GAAE,iCAAsC,GAC3C,OAAO,CAAC,mCAAmC,CAAC,CA6D9C"}

package/dist/core/explicit-session-backing-cleanup.js

@@ -0,0 +1,76 @@
+import { cancelRiffTaskById } from '../adapters/backend/riff-backend.js';
+import { isSuspendableBackendType, killPersistentSession, persistentSessionName, probePersistentSession, } from './persistent-backend.js';
+/**
+ * Destroy the Botmux-owned backing resource before an offline/worker-less
+ * explicit close is published.
+ *
+ * This helper never mutates the session record. In particular, callers may
+ * erase `riffParentTaskId` only after `kind === 'cancelled_riff'`; a failed or
+ * unconfigurable cancellation therefore retains the durable retry handle.
+ */
+export async function cleanupExplicitSessionBacking(input, deps = {}) {
+    if (input.adopted)
+        return { ok: true, kind: 'skipped_adopted' };
+    if (input.backendType === 'riff') {
+        const taskId = input.riffParentTaskId;
+        if (!taskId)
+            return { ok: true, kind: 'no_backing' };
+        if (!input.riffConfig?.baseUrl) {
+            return { ok: false, kind: 'riff_config_missing', backendType: 'riff', taskId };
+        }
+        const cancel = deps.cancelRiffTask ?? cancelRiffTaskById;
+        try {
+            const cancelled = await cancel(input.riffConfig, taskId);
+            return cancelled
+                ? { ok: true, kind: 'cancelled_riff', taskId }
+                : { ok: false, kind: 'riff_cancel_failed', backendType: 'riff', taskId };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                kind: 'riff_cancel_failed',
+                backendType: 'riff',
+                taskId,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    }
+    if (!isSuspendableBackendType(input.backendType)) {
+        // Explicit pty and legacy unstamped rows have no deterministic persistent
+        // backing session to destroy. Never guess that an unstamped row was tmux.
+        return { ok: true, kind: 'no_backing' };
+    }
+    const name = persistentSessionName(input.backendType, input.sessionId);
+    const kill = deps.killPersistent ?? killPersistentSession;
+    const probe = deps.probePersistent ?? probePersistentSession;
+    try {
+        // ZMX destruction is identity-verified and refuses a name-only kill. Keep
+        // the established two-argument contract for the other backends.
+        if (input.backendType === 'zmx')
+            kill(input.backendType, name, input.sessionId);
+        else
+            kill(input.backendType, name);
+        // Backend kill helpers are intentionally idempotent and historically
+        // swallow command errors. Offline explicit abandon needs a stronger
+        // contract: only publish closed after a post-kill probe confirms absence.
+        const after = probe(input.backendType, name);
+        if (after !== 'missing') {
+            return {
+                ok: false,
+                kind: 'persistent_destroy_failed',
+                backendType: input.backendType,
+                error: after === 'exists' ? 'backing_session_still_exists' : 'backing_session_state_unknown',
+            };
+        }
+        return { ok: true, kind: 'destroyed_persistent', backendType: input.backendType, name };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            kind: 'persistent_destroy_failed',
+            backendType: input.backendType,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+//# sourceMappingURL=explicit-session-backing-cleanup.js.map

package/dist/core/explicit-session-backing-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"explicit-session-backing-cleanup.js","sourceRoot":"","sources":["../../src/core/explicit-session-backing-cleanup.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAgCjC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAyC,EACzC,OAA0C,EAAE;IAE5C,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAEhE,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,kBAAkB,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACzD,OAAO,SAAS;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE;gBAC9C,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,WAAW,EAAE,MAAM;gBACnB,MAAM;gBACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,0EAA0E;QAC1E,0EAA0E;QAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,IAAI,qBAAqB,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,IAAI,sBAAsB,CAAC;IAC7D,IAAI,CAAC;QACH,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;;YAC3E,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACnC,qEAAqE;QACrE,oEAAoE;QACpE,0EAA0E;QAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,2BAA2B;gBACjC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,+BAA+B;aAC7F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,2BAA2B;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/idle-worker-sweeper.d.ts

@@ -8,6 +8,7 @@ import type { DaemonSession } from './types.js';
  * ('botDefaults.maxLiveWorkers*' i18n) — keep them in sync.
  */
 export declare const DEFAULT_MAX_LIVE_WORKERS = 30;
+export declare const IDLE_WORKER_SWEEP_MUTATION_ACQUIRE_TIMEOUT_MS = 1000;
 export interface IdleWorkerSweepOptions {
     /**
      * Explicit per-bot cap for THIS bot (one daemon = one bot, so the whole
@@ -16,6 +17,11 @@ export interface IdleWorkerSweepOptions {
      * never suspend).
      */
     maxLiveWorkers?: number;
+    /**
+     * Bound how long a detached sweep may wait for already-admitted turns.
+     * A wedged admission must not hold the bot-wide mutation gate forever.
+     */
+    mutationAcquireTimeoutMs?: number;
 }
 export interface IdleWorkerSweepResult {
     sessionId: string;
@@ -36,4 +42,18 @@ export interface IdleWorkerSweepResult {
  * session is busy, none are suspended this round and the next sweep retries.
  */
 export declare function sweepIdleWorkers(activeSessions: Map<string, DaemonSession>, opts?: IdleWorkerSweepOptions): IdleWorkerSweepResult[];
+/**
+ * Run a cap sweep only after every already-admitted inbound turn has either
+ * durably accepted its input or finished.  A worker spawn can put the bot over
+ * cap while another handler is paused in sender/reaction setup, before that
+ * handler has changed its screen status or dispatch ledger.  A synchronous
+ * sweep could otherwise mistake that handler's worker for idle, suspend it,
+ * and make the subsequent send fail before acceptance.
+ *
+ * Spawn/idle callbacks commonly run inside an admission, so the mutation gate
+ * upgrades the current lease when possible. Otherwise acquisition is bounded:
+ * a wedged admission skips this sweep instead of freezing every later turn for
+ * the bot. The next idle/spawn callback retries.
+ */
+export declare function sweepIdleWorkersAfterTurnDrain(larkAppId: string, activeSessions: Map<string, DaemonSession>, opts?: IdleWorkerSweepOptions): Promise<IdleWorkerSweepResult[]>;
 //# sourceMappingURL=idle-worker-sweeper.d.ts.map

package/dist/core/idle-worker-sweeper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idle-worker-sweeper.d.ts","sourceRoot":"","sources":["../../src/core/idle-worker-sweeper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC1C,IAAI,GAAE,sBAA2B,GAChC,qBAAqB,EAAE,CA+BzB"}
+{"version":3,"file":"idle-worker-sweeper.d.ts","sourceRoot":"","sources":["../../src/core/idle-worker-sweeper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,6CAA6C,OAAQ,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC1C,IAAI,GAAE,sBAA2B,GAChC,qBAAqB,EAAE,CA+BzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC1C,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAMlC"}

package/dist/core/idle-worker-sweeper.js

@@ -1,5 +1,6 @@
 import { suspendWorker } from './worker-pool.js';
 import { isSuspendableBackendType } from './persistent-backend.js';
+import { tryWithBotTurnMutation } from './bot-turn-mutation-gate.js';
 /**
  * Default per-bot live-session cap applied when a bot has no explicit
  * `maxLiveWorkers` configured. Keeps memory bounded out of the box: beyond this
@@ -9,6 +10,7 @@ import { isSuspendableBackendType } from './persistent-backend.js';
  * ('botDefaults.maxLiveWorkers*' i18n) — keep them in sync.
  */
 export const DEFAULT_MAX_LIVE_WORKERS = 30;
+export const IDLE_WORKER_SWEEP_MUTATION_ACQUIRE_TIMEOUT_MS = 1_000;
 function liveWorkers(activeSessions) {
     return [...activeSessions.values()].filter(ds => !!ds.worker && !ds.worker.killed);
 }
@@ -60,4 +62,20 @@ export function sweepIdleWorkers(activeSessions, opts = {}) {
     }
     return suspended;
 }
+/**
+ * Run a cap sweep only after every already-admitted inbound turn has either
+ * durably accepted its input or finished.  A worker spawn can put the bot over
+ * cap while another handler is paused in sender/reaction setup, before that
+ * handler has changed its screen status or dispatch ledger.  A synchronous
+ * sweep could otherwise mistake that handler's worker for idle, suspend it,
+ * and make the subsequent send fail before acceptance.
+ *
+ * Spawn/idle callbacks commonly run inside an admission, so the mutation gate
+ * upgrades the current lease when possible. Otherwise acquisition is bounded:
+ * a wedged admission skips this sweep instead of freezing every later turn for
+ * the bot. The next idle/spawn callback retries.
+ */
+export function sweepIdleWorkersAfterTurnDrain(larkAppId, activeSessions, opts = {}) {
+    return tryWithBotTurnMutation(larkAppId, opts.mutationAcquireTimeoutMs ?? IDLE_WORKER_SWEEP_MUTATION_ACQUIRE_TIMEOUT_MS, () => sweepIdleWorkers(activeSessions, opts)).then(result => result.acquired ? result.value : []);
+}
 //# sourceMappingURL=idle-worker-sweeper.js.map

package/dist/core/idle-worker-sweeper.js.map

@@ -1 +1 @@
-{"version":3,"file":"idle-worker-sweeper.js","sourceRoot":"","sources":["../../src/core/idle-worker-sweeper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAiB3C,SAAS,WAAW,CAAC,cAA0C;IAC7D,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,cAA0C,EAC1C,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAC5D,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC,CAAE,uCAAuC;IACjE,MAAM,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,UAAU,GAAG,OAAO;QACxB,+DAA+D;QAC/D,8EAA8E;QAC9E,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,4EAA4E;QAC5E,sDAAsD;SACrD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;SACxD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACnE,qEAAqE;QACrE,sEAAsE;SACrE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,gBAAgB,KAAK,MAAM,CAAC;SAC5C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC;IAEnE,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,SAAS,IAAI,GAAG;YAAE,MAAM;QAC5B,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,iBAAiB,CAAC;YAAE,SAAS;QACpD,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC/E,SAAS,EAAE,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"idle-worker-sweeper.js","sourceRoot":"","sources":["../../src/core/idle-worker-sweeper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,6CAA6C,GAAG,KAAK,CAAC;AAsBnE,SAAS,WAAW,CAAC,cAA0C;IAC7D,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,cAA0C,EAC1C,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAC5D,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC,CAAE,uCAAuC;IACjE,MAAM,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,UAAU,GAAG,OAAO;QACxB,+DAA+D;QAC/D,8EAA8E;QAC9E,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,4EAA4E;QAC5E,sDAAsD;SACrD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;SACxD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACnE,qEAAqE;QACrE,sEAAsE;SACrE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,gBAAgB,KAAK,MAAM,CAAC;SAC5C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC;IAEnE,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,SAAS,IAAI,GAAG;YAAE,MAAM;QAC5B,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,iBAAiB,CAAC;YAAE,SAAS;QACpD,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC/E,SAAS,EAAE,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAAiB,EACjB,cAA0C,EAC1C,OAA+B,EAAE;IAEjC,OAAO,sBAAsB,CAC3B,SAAS,EACT,IAAI,CAAC,wBAAwB,IAAI,6CAA6C,EAC9E,GAAG,EAAE,CAAC,gBAAgB,CAAC,cAAc,EAAE,IAAI,CAAC,CAC7C,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/core/inflight-input-tracker.d.ts

@@ -24,15 +24,25 @@ export type InflightItem = {
     content: string;
     logicalContent?: string;
     turnId?: string;
+    replyTurnId?: string;
     dispatchAttempt?: number;
+    codexAppDispatchId?: string;
+    queuedActivationToken?: string;
     vcMeetingImTurnOrigin?: VcMeetingImTurnOrigin;
     codexAppInput?: CodexAppTurnInput;
+    /** At-most-once turn (idempotency lease): must NEVER be carried over to a
+     *  respawned CLI (codex #776 round-7 finding #1). See PendingCliInput.noReplay. */
+    noReplay?: boolean;
 };
 export declare class InflightInputTracker {
     private unacked;
     private carryOver;
     /** An input just went onto the CLI's PTY. */
     onWrite(item: InflightItem): void;
+    /** Remove one exact item after a definitive local write failure before the
+     * caller re-queues it. Covers both the live in-flight set and a synchronous
+     * backend-exit handoff that may already have moved it to carryOver. */
+    forget(item: InflightItem): void;
     /** Retire one exact write whose transport outcome is ambiguous and must not
      * be replayed automatically. Other type-ahead items remain tracked. */
     retire(item: InflightItem): boolean;

package/dist/core/inflight-input-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inflight-input-tracker.d.ts","sourceRoot":"","sources":["../../src/core/inflight-input-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,aAAa,CAAC,EAAE,iBAAiB,CAAC;CACnC,CAAC;AAEF,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,SAAS,CAAsB;IAEvC,6CAA6C;IAC7C,OAAO,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAIjC;2EACuE;IACvE,MAAM,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO;IAOnC;;2DAEuD;IACvD,cAAc,IAAI,IAAI;IAItB;;;iDAG6C;IAC7C,SAAS,CAAC,WAAW,GAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAoB,GAAG,MAAM;IAO5E;;;gCAG4B;IAC5B,aAAa,IAAI,YAAY,EAAE;CAIhC"}
+{"version":3,"file":"inflight-input-tracker.d.ts","sourceRoot":"","sources":["../../src/core/inflight-input-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC;uFACmF;IACnF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,SAAS,CAAsB;IAEvC,6CAA6C;IAC7C,OAAO,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAIjC;;2EAEuE;IACvE,MAAM,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAKhC;2EACuE;IACvE,MAAM,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO;IAOnC;;2DAEuD;IACvD,cAAc,IAAI,IAAI;IAItB;;;iDAG6C;IAC7C,SAAS,CAAC,WAAW,GAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAoB,GAAG,MAAM;IAO5E;;;gCAG4B;IAC5B,aAAa,IAAI,YAAY,EAAE;CAIhC"}

package/dist/core/inflight-input-tracker.js

@@ -26,6 +26,13 @@ export class InflightInputTracker {
     onWrite(item) {
         this.unacked.push(item);
     }
+    /** Remove one exact item after a definitive local write failure before the
+     * caller re-queues it. Covers both the live in-flight set and a synchronous
+     * backend-exit handoff that may already have moved it to carryOver. */
+    forget(item) {
+        this.unacked = this.unacked.filter(candidate => candidate !== item);
+        this.carryOver = this.carryOver.filter(candidate => candidate !== item);
+    }
     /** Retire one exact write whose transport outcome is ambiguous and must not
      * be replayed automatically. Other type-ahead items remain tracked. */
     retire(item) {

package/dist/core/inflight-input-tracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"inflight-input-tracker.js","sourceRoot":"","sources":["../../src/core/inflight-input-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAaH,MAAM,OAAO,oBAAoB;IACvB,OAAO,GAAmB,EAAE,CAAC;IAC7B,SAAS,GAAmB,EAAE,CAAC;IAEvC,6CAA6C;IAC7C,OAAO,CAAC,IAAkB;QACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;2EACuE;IACvE,MAAM,CAAC,IAAkB;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;2DAEuD;IACvD,cAAc;QACZ,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED;;;iDAG6C;IAC7C,SAAS,CAAC,cAA+C,GAAG,EAAE,CAAC,IAAI;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED;;;gCAG4B;IAC5B,aAAa;QACX,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"inflight-input-tracker.js","sourceRoot":"","sources":["../../src/core/inflight-input-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAmBH,MAAM,OAAO,oBAAoB;IACvB,OAAO,GAAmB,EAAE,CAAC;IAC7B,SAAS,GAAmB,EAAE,CAAC;IAEvC,6CAA6C;IAC7C,OAAO,CAAC,IAAkB;QACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;2EAEuE;IACvE,MAAM,CAAC,IAAkB;QACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED;2EACuE;IACvE,MAAM,CAAC,IAAkB;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;2DAEuD;IACvD,cAAc;QACZ,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED;;;iDAG6C;IAC7C,SAAS,CAAC,cAA+C,GAAG,EAAE,CAAC,IAAI;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED;;;gCAG4B;IAC5B,aAAa;QACX,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;CACF"}

package/dist/core/managed-origin-attestation.d.ts

@@ -0,0 +1,51 @@
+export declare const MANAGED_ORIGIN_ATTEST_ROUTE = "/api/session-origin/attest";
+export declare const MANAGED_ORIGIN_PROOF_DOMAIN = "botmux.managed-origin-attestation.v1";
+export declare const MANAGED_ORIGIN_PROOF_TTL_MS = 5000;
+export interface ManagedOriginAttestationContext {
+    sessionId: string;
+    channelId: string;
+    capability: string;
+    dataDir: string;
+    /** Routing hints only; the daemon derives identity from its live registry. */
+    larkAppId?: string;
+    ipcPortFallback?: number;
+}
+export interface ManagedOriginAttestation {
+    sessionId: string;
+    turnId: string;
+    dispatchAttempt?: number;
+    requiresCodexAppLedger: boolean;
+}
+export interface ManagedOriginAttestationProof extends ManagedOriginAttestation {
+    domain: typeof MANAGED_ORIGIN_PROOF_DOMAIN;
+    version: 1;
+    nonce: string;
+    channelId: string;
+    issuedAtMs: number;
+}
+export declare class ManagedOriginAttestationError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+/** Daemon-side proof creation. The nonce is strict and the destination is
+ * derived only from the authenticated session + daemon data root. O_EXCL and
+ * O_NOFOLLOW make a pre-existing leaf fail closed rather than follow it. */
+export declare function writeManagedOriginAttestationProof(input: {
+    dataDir: string;
+    proof: ManagedOriginAttestationProof;
+}): string;
+/**
+ * Exchange a rotating capability for a host-file proof of the daemon's exact
+ * live tuple. HTTP is transport only: a stale child can bind a released port
+ * and forge a response, but Seatbelt prevents it from creating the random
+ * nonce proof in the host-owned read-only directory.
+ */
+export declare function attestManagedOrigin(input: {
+    context: ManagedOriginAttestationContext;
+    resolveIpcPort?: (larkAppId: string | undefined) => number | undefined;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    nonce?: string;
+    now?: () => number;
+    wait?: (delayMs: number) => Promise<void>;
+}): Promise<ManagedOriginAttestation>;
+//# sourceMappingURL=managed-origin-attestation.d.ts.map

package/dist/core/managed-origin-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-origin-attestation.d.ts","sourceRoot":"","sources":["../../src/core/managed-origin-attestation.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,eAAO,MAAM,2BAA2B,yCAAyC,CAAC;AAClF,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAGjD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,6BAA8B,SAAQ,wBAAwB;IAC7E,MAAM,EAAE,OAAO,2BAA2B,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAED;;4EAE4E;AAC5E,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,6BAA6B,CAAC;CACtC,GAAG,MAAM,CAkDT;AAqED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,OAAO,EAAE,+BAA+B,CAAC;IACzC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACvE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA4EpC"}

package/dist/core/managed-origin-attestation.js

@@ -0,0 +1,208 @@
+import { randomBytes } from 'node:crypto';
+import { closeSync, constants as fsConstants, fstatSync, openSync, readSync, unlinkSync, writeSync, } from 'node:fs';
+import { ensureManagedOriginAttestationDirectory, managedOriginAttestationProofPath, } from './managed-origin-capability.js';
+export const MANAGED_ORIGIN_ATTEST_ROUTE = '/api/session-origin/attest';
+export const MANAGED_ORIGIN_PROOF_DOMAIN = 'botmux.managed-origin-attestation.v1';
+export const MANAGED_ORIGIN_PROOF_TTL_MS = 5_000;
+const MAX_PROOF_BYTES = 8 * 1024;
+export class ManagedOriginAttestationError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'ManagedOriginAttestationError';
+    }
+}
+/** Daemon-side proof creation. The nonce is strict and the destination is
+ * derived only from the authenticated session + daemon data root. O_EXCL and
+ * O_NOFOLLOW make a pre-existing leaf fail closed rather than follow it. */
+export function writeManagedOriginAttestationProof(input) {
+    const dir = ensureManagedOriginAttestationDirectory(input.dataDir, input.proof.sessionId, input.proof.channelId);
+    const path = managedOriginAttestationProofPath(input.dataDir, input.proof.sessionId, input.proof.channelId, input.proof.nonce);
+    let fd;
+    let created = false;
+    try {
+        fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL
+            | (fsConstants.O_NOFOLLOW ?? 0), 0o600);
+        created = true;
+        const stat = fstatSync(fd);
+        const expectedUid = process.getuid?.();
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1
+            || (stat.mode & 0o777) !== 0o600
+            || (expectedUid !== undefined && stat.uid !== expectedUid)) {
+            throw new Error(`unsafe managed origin proof file under ${dir}`);
+        }
+        const body = Buffer.from(JSON.stringify(input.proof), 'utf8');
+        if (body.length === 0 || body.length > MAX_PROOF_BYTES) {
+            throw new Error('managed origin proof exceeds size limit');
+        }
+        let offset = 0;
+        while (offset < body.length) {
+            const written = writeSync(fd, body, offset, body.length - offset, null);
+            if (written <= 0)
+                throw new Error('managed origin proof write made no progress');
+            offset += written;
+        }
+        return path;
+    }
+    catch (err) {
+        if (created) {
+            try {
+                unlinkSync(path);
+            }
+            catch { /* best effort */ }
+        }
+        throw err;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+function readManagedOriginAttestationProof(path) {
+    let fd;
+    try {
+        fd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | fsConstants.O_NONBLOCK);
+        const stat = fstatSync(fd);
+        const expectedUid = process.getuid?.();
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1
+            || (stat.mode & 0o777) !== 0o600
+            || (expectedUid !== undefined && stat.uid !== expectedUid)
+            || stat.size <= 0 || stat.size > MAX_PROOF_BYTES) {
+            return undefined;
+        }
+        const body = Buffer.alloc(stat.size);
+        let offset = 0;
+        while (offset < body.length) {
+            const read = readSync(fd, body, offset, body.length - offset, null);
+            if (read <= 0)
+                return undefined;
+            offset += read;
+        }
+        return JSON.parse(body.toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+function validateProof(input) {
+    if (!input.value || typeof input.value !== 'object' || Array.isArray(input.value))
+        return undefined;
+    const proof = input.value;
+    if (proof.domain !== MANAGED_ORIGIN_PROOF_DOMAIN || proof.version !== 1
+        || proof.nonce !== input.nonce
+        || proof.sessionId !== input.context.sessionId
+        || proof.channelId !== input.context.channelId
+        || typeof proof.turnId !== 'string' || proof.turnId.length === 0 || proof.turnId.length > 256
+        || typeof proof.issuedAtMs !== 'number' || !Number.isFinite(proof.issuedAtMs)
+        || proof.issuedAtMs > input.nowMs + 1_000
+        || input.nowMs - proof.issuedAtMs > MANAGED_ORIGIN_PROOF_TTL_MS
+        || typeof proof.requiresCodexAppLedger !== 'boolean') {
+        return undefined;
+    }
+    const dispatchAttempt = proof.dispatchAttempt === undefined
+        ? undefined
+        : typeof proof.dispatchAttempt === 'number'
+            && Number.isSafeInteger(proof.dispatchAttempt)
+            && proof.dispatchAttempt > 0
+            ? proof.dispatchAttempt
+            : null;
+    if (dispatchAttempt === null)
+        return undefined;
+    return {
+        sessionId: input.context.sessionId,
+        turnId: proof.turnId,
+        ...(dispatchAttempt !== undefined ? { dispatchAttempt } : {}),
+        requiresCodexAppLedger: proof.requiresCodexAppLedger,
+    };
+}
+/**
+ * Exchange a rotating capability for a host-file proof of the daemon's exact
+ * live tuple. HTTP is transport only: a stale child can bind a released port
+ * and forge a response, but Seatbelt prevents it from creating the random
+ * nonce proof in the host-owned read-only directory.
+ */
+export async function attestManagedOrigin(input) {
+    const discovered = input.resolveIpcPort?.(input.context.larkAppId);
+    // The capability leaf is host-written and read-only in Seatbelt. Daemon
+    // discovery descriptors remain ordinary filesystem data that the confined
+    // child may poison, so they are only a compatibility fallback when an older
+    // capability lacks the owning port.
+    const port = input.context.ipcPortFallback ?? discovered;
+    if (!Number.isSafeInteger(port) || !port || port <= 0) {
+        throw new ManagedOriginAttestationError('找不到目标 daemon 端口；无法验证当前 worker 的 managed origin');
+    }
+    const nonce = input.nonce ?? randomBytes(32).toString('hex');
+    if (!/^[a-f0-9]{64}$/.test(nonce)) {
+        throw new ManagedOriginAttestationError('managed origin challenge nonce 无效');
+    }
+    const proofPath = managedOriginAttestationProofPath(input.context.dataDir, input.context.sessionId, input.context.channelId, nonce);
+    const timeoutMs = input.timeoutMs ?? 3_000;
+    const now = input.now ?? Date.now;
+    const wait = input.wait ?? (delayMs => new Promise(resolve => setTimeout(resolve, delayMs)));
+    const deadline = now() + timeoutMs;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    timer.unref?.();
+    let response;
+    try {
+        response = await (input.fetchImpl ?? fetch)(`http://127.0.0.1:${port}${MANAGED_ORIGIN_ATTEST_ROUTE}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+                sessionId: input.context.sessionId,
+                channelId: input.context.channelId,
+                originCapability: input.context.capability,
+                nonce,
+            }),
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        throw new ManagedOriginAttestationError(controller.signal.aborted
+            ? 'daemon managed-origin 验证超时'
+            : `无法连接 owning daemon 验证 managed origin: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        try {
+            await response.body?.cancel();
+        }
+        catch { /* transport body is untrusted */ }
+        throw new ManagedOriginAttestationError(`daemon 拒绝 managed origin: HTTP ${response.status}`);
+    }
+    // Ignore the response body completely. Only a valid protected proof is
+    // authority, and a fake loopback listener cannot write one.
+    try {
+        await response.body?.cancel();
+    }
+    catch { /* authority never comes from HTTP */ }
+    for (;;) {
+        const nowMs = now();
+        const proof = validateProof({
+            value: readManagedOriginAttestationProof(proofPath),
+            context: input.context,
+            nonce,
+            nowMs,
+        });
+        if (proof)
+            return proof;
+        if (nowMs >= deadline) {
+            throw new ManagedOriginAttestationError('daemon 未生成有效的 managed-origin host proof');
+        }
+        await wait(Math.min(20, Math.max(1, deadline - nowMs)));
+    }
+}
+//# sourceMappingURL=managed-origin-attestation.js.map

package/dist/core/managed-origin-attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-origin-attestation.js","sourceRoot":"","sources":["../../src/core/managed-origin-attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,uCAAuC,EACvC,iCAAiC,GAClC,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AACxE,MAAM,CAAC,MAAM,2BAA2B,GAAG,sCAAsC,CAAC;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC;AA2BjC,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;4EAE4E;AAC5E,MAAM,UAAU,kCAAkC,CAAC,KAGlD;IACC,MAAM,GAAG,GAAG,uCAAuC,CACjD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,KAAK,CAAC,SAAS,CACtB,CAAC;IACF,MAAM,IAAI,GAAG,iCAAiC,CAC5C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,KAAK,CAAC,KAAK,CAClB,CAAC;IACF,IAAI,EAAsB,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,IAAI,EACJ,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM;cAC3D,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,EACjC,KAAK,CACN,CAAC;QACF,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;eAC1D,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;eAC7B,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YACxE,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjF,MAAM,IAAI,OAAO,CAAC;QACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iCAAiC,CAAC,IAAY;IACrD,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,IAAI,EACJ,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,WAAW,CAAC,UAAU,CAC9E,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;eAC1D,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;eAC7B,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC;eACvD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YACpE,IAAI,IAAI,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAKtB;IACC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAgC,CAAC;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,2BAA2B,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;WAClE,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;WAC3B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS;WAC3C,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS;WAC3C,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG;WAC1F,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;WAC1E,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK;WACtC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,GAAG,2BAA2B;WAC5D,OAAO,KAAK,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,KAAK,SAAS;QACzD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;eACtC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC;eAC3C,KAAK,CAAC,eAAe,GAAG,CAAC;YAC5B,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,eAAe,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;KACrD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,oCAAoC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,IAAI,UAAU,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,6BAA6B,CACrC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,6BAA6B,CAAC,mCAAmC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,iCAAiC,CACjD,KAAK,CAAC,OAAO,CAAC,OAAO,EACrB,KAAK,CAAC,OAAO,CAAC,SAAS,EACvB,KAAK,CAAC,OAAO,CAAC,SAAS,EACvB,KAAK,CACN,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,CACzC,oBAAoB,IAAI,GAAG,2BAA2B,EAAE,EACxD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;gBAC1C,KAAK;aACN,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,6BAA6B,CACrC,UAAU,CAAC,MAAM,CAAC,OAAO;YACvB,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC/F,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC;YAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;QAClF,MAAM,IAAI,6BAA6B,CAAC,kCAAkC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,uEAAuE;IACvE,4DAA4D;IAC5D,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;IACtF,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,aAAa,CAAC;YAC1B,KAAK,EAAE,iCAAiC,CAAC,SAAS,CAAC;YACnD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,6BAA6B,CAAC,yCAAyC,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}