claude-code-infinite 1.0.35 → 1.0.37

package/dist/desktop-service.js

@@ -0,0 +1,449 @@
+/**
+ * MemTree for the Claude desktop app's Code tab.
+ *
+ * The desktop app starts its own Claude Code binary with ANTHROPIC_BASE_URL
+ * forced to api.anthropic.com and its own OAuth token in the env, so ccc can't
+ * wrap it or be its base URL. What the Code tab does honour is HTTPS_PROXY and
+ * NODE_EXTRA_CA_CERTS from a saved local environment (Desktop's environment
+ * editor), which applies only to the sessions started from that environment.
+ *
+ * So `ccc desktop setup` makes a long-lived loopback service (a launchd agent on
+ * macOS) that is those sessions' HTTPS proxy:
+ *
+ * - CONNECT api.anthropic.com:443 with the service token: TLS is terminated with
+ *   a leaf from a CA name-constrained to api.anthropic.com (mitm-ca.ts). The CA
+ *   key is discarded at setup; only the leaf key is kept (0600). Every other
+ *   CONNECT is a blind tunnel (https-proxy-mode.ts, unchanged).
+ * - Each decrypted POST /v1/messages and /v1/messages/count_tokens goes to a
+ *   per-session ccc proxy (proxy.ts's startProxy, in this process, on its own
+ *   loopback port), picked by Claude Code's `x-claude-code-session-id` and made
+ *   on that session's first request with the session's project (its working
+ *   directory, read from the request's system prompt). Everything else
+ *   (bridge/Remote Control, OAuth, telemetry, files) and session-less model
+ *   calls go to a shared "default" proxy, whose intercepted handling passes them
+ *   through verbatim as in terminal proxy mode.
+ * - The loopback routes (`/memtree/*` for the MemTree MCP server) need the
+ *   service token (header) as well, since this port is fixed and long-lived.
+ * - Idle sessions (no request for SESSION_IDLE_MS) are drained and closed.
+ */
+import http from "node:http";
+import path from "node:path";
+import fs from "node:fs";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { attachHttpsProxyMode } from "./https-proxy-mode.js";
+import { INTERCEPT_HOST } from "./mitm-ca.js";
+import { HTTPS_PROXY_MODE_ENV, httpsProxyModeDecision } from "./https-proxy-eligibility.js";
+import { INNER_INTERCEPTED_HEADER, INNER_TOKEN_HEADER, startProxy, } from "./proxy.js";
+import { MemtreeClient } from "./memtree.js";
+import { RequestLogger } from "./reqlog.js";
+import { readProjectMeta } from "./project-meta.js";
+import { ClaudeTranscriptUsage } from "./transcript-usage.js";
+import { StablePrefixStore } from "./prefix-store.js";
+import { ToolOutputStore } from "./tool-output-store.js";
+import { MEMTREE_TOOLS_HEADER_VALUE } from "./memtree-mcp-config.js";
+import { MEMTREE_MCP_SERVER_NAME, PROXY_TOKEN_HEADER } from "./memtree-mcp.js";
+/** A session idle this long is closed and final-indexed (as a terminal ccc at exit). */
+const SESSION_IDLE_MS = 30 * 60_000;
+const SWEEP_MS = 10 * 60_000;
+/** How long a closing session's final index and background calls may take. */
+const FINAL_DRAIN_MS = 10_000;
+/**
+ * The session's directory, from Claude Code's environment block ("Primary working
+ * directory: ..."): in the top-level `system` text, or (Claude Code 2.1.322) in a
+ * `role: "system"` entry of `messages`. Never user or assistant text.
+ */
+export function workingDirectoryFromBody(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+    const textsOf = (content) => typeof content === "string" ? [content]
+        : Array.isArray(content) ? content.map((b) => (b && typeof b === "object" && typeof b.text === "string"
+            ? b.text : "")) : [];
+    const systemMessages = Array.isArray(parsed.messages)
+        ? parsed.messages.filter((m) => m?.role === "system")
+            .flatMap((m) => textsOf(m.content))
+        : [];
+    for (const text of [...textsOf(parsed.system), ...systemMessages]) {
+        const m = /^\s*-?\s*Primary working directory: (.+)$/m.exec(text);
+        const dir = m?.[1]?.trim();
+        if (dir && path.isAbsolute(dir))
+            return dir;
+    }
+    return undefined;
+}
+export async function startDesktopService(opts) {
+    const log = opts.log ?? ((line) => process.stderr.write(`${new Date().toISOString()} ${line}\n`));
+    const reqlog = new RequestLogger(path.join(opts.paths.dir, "requests.jsonl"));
+    // The inner proxies answer only this process (ProxyOptions.innerToken): they are
+    // ordinary loopback listeners, so without it any local user could reach them.
+    const innerToken = randomBytes(24).toString("hex");
+    const newMemtree = () => new MemtreeClient({
+        baseUrl: opts.memtreeBaseUrl,
+        apiKey: opts.apiKey,
+        debug: opts.debug,
+        reqlog,
+        // Set per session from its model calls' tool list (toolsOffered).
+        memtreeTools: undefined,
+    });
+    const proxyOptions = (memtree, transcriptUsage) => ({
+        memtree,
+        reqlog,
+        innerToken,
+        stablePrefixStore,
+        toolOutputs,
+        debug: opts.debug,
+        nativeOneMillionContext: true,
+        toolRouteRecovery: true,
+        countTokens: true,
+        claudeCodeOnly: true,
+        // Usage and the final reply come from the session's transcript, as in terminal ccc.
+        ...(transcriptUsage ? { transcriptUsage } : {}),
+        ...(opts.upstreamOrigin ? { upstreamOrigin: opts.upstreamOrigin } : {}),
+        // Test-only, as in terminal ccc: a small budget so a cheap session crosses it.
+        ...(Number(process.env.CCC_BUDGET_TOKENS) > 0 ? { budgetTokensOverride: Number(process.env.CCC_BUDGET_TOKENS) } : {}),
+    });
+    // As in terminal ccc (cli-main.ts): a session's adopted compressed prefix, so a fresh
+    // proxy for it (after an idle close or a restart) rides it instead of blocking on a
+    // compress; and full copies of tool results shortened to fit the window (the safety net).
+    const stablePrefixStore = new StablePrefixStore();
+    const toolOutputs = new ToolOutputStore();
+    const fallbackMemtree = newMemtree();
+    const fallback = await startProxy(proxyOptions(fallbackMemtree));
+    const sessions = new Map();
+    /**
+     * The session's proxy, made on its first request. Its project is set once a
+     * request names the working directory (Claude Code's first request in a
+     * session is often a title or quota call without one); proxy.ts reads
+     * `opts.projectMeta` per request, so setting it later on the same object works.
+     * A session seen again after it was closed (resumed) gets a fresh proxy, as a
+     * terminal `ccc --resume` gets a fresh process: its transcript is caught up first.
+     */
+    const sessionProxy = (id, cwd) => {
+        let entry = sessions.get(id);
+        if (!entry) {
+            const started = Date.now();
+            const memtree = newMemtree();
+            const transcriptUsage = new ClaudeTranscriptUsage();
+            transcriptUsage.catchUp(id);
+            const popts = proxyOptions(memtree, transcriptUsage);
+            entry = {
+                lastUsed: started,
+                inFlight: 0,
+                memtree,
+                opts: popts,
+                proxy: startProxy(popts).then((proxy) => {
+                    log(`session ${id.slice(0, 8)} proxy on :${proxy.port} (${Date.now() - started} ms)`);
+                    return proxy;
+                }),
+            };
+            const created = entry;
+            // A failed start (EMFILE, ...) must not stick: the next request retries.
+            created.proxy.catch((err) => {
+                if (sessions.get(id) === created)
+                    sessions.delete(id);
+                log(`session ${id.slice(0, 8)} proxy failed to start: ${String(err)}`);
+            });
+            sessions.set(id, entry);
+        }
+        if (cwd && entry.cwd === undefined) {
+            const target = entry;
+            target.cwd = cwd;
+            target.refused = projectRefusal(cwd, opts.state.claudeConfigDir);
+            if (target.refused)
+                log(`session ${id.slice(0, 8)} refused: ${target.refused}`);
+            target.projectReady = readProjectMeta(cwd).then((meta) => {
+                target.opts.projectMeta = meta;
+                log(`session ${id.slice(0, 8)} project ${meta.git_repo ?? path.basename(cwd)}${meta.git_branch ? `@${meta.git_branch}` : ""}`);
+            }, () => { });
+        }
+        entry.lastUsed = Date.now();
+        return entry;
+    };
+    /** As at a terminal ccc's exit: drain, final-index the conversation, finish background calls. */
+    const closeSession = async (entry, drainMs) => {
+        const proxy = await entry.proxy;
+        await proxy.drain(drainMs);
+        entry.memtree.flushFinalIndexes(FINAL_DRAIN_MS);
+        await entry.memtree.drainBackground(FINAL_DRAIN_MS);
+        proxy.close();
+    };
+    // `intercepted`: decrypted from a token-authenticated CONNECT api.anthropic.com:443.
+    const handler = (intercepted) => (req, res) => void route(req, res, intercepted).catch((err) => {
+        log(`route error: ${String(err)}`);
+        if (res.destroyed)
+            return;
+        if (!res.headersSent)
+            res.writeHead(502, { "content-type": "application/json" });
+        res.end(JSON.stringify({ type: "error",
+            error: { type: "api_error", message: "ccc desktop service error" } }));
+    });
+    const server = http.createServer(handler(false));
+    const tunnels = attachHttpsProxyMode(server, handler(true), interceptUpstream(opts.upstreamOrigin), {
+        ca: {
+            leafCertPem: fs.readFileSync(opts.paths.leafPem, "utf8"),
+            leafKeyPem: fs.readFileSync(opts.paths.leafKey, "utf8"),
+        },
+        proxyToken: opts.state.token,
+        ...(opts.tracePath ? { tracePath: opts.tracePath } : {}),
+    });
+    let closing = false;
+    const pendingRoutes = new Set();
+    async function route(req, res, intercepted) {
+        if (closing) {
+            res.writeHead(503, { "content-type": "application/json", connection: "close" });
+            res.end(JSON.stringify({ type: "error", error: { type: "overloaded_error", message: "ccc desktop service is restarting" } }));
+            return;
+        }
+        const task = routeInner(req, res, intercepted);
+        pendingRoutes.add(task);
+        try {
+            await task;
+        }
+        finally {
+            pendingRoutes.delete(task);
+        }
+    }
+    async function routeInner(req, res, intercepted) {
+        // A client that goes away while we wait (body, git, proxy start) must not still be sent upstream.
+        let gone = false;
+        res.on("close", () => { if (!res.writableFinished)
+            gone = true; });
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        const sessionId = header(req, "x-claude-code-session-id");
+        if (intercepted) {
+            const isModelCall = req.method === "POST" &&
+                (url.pathname === "/v1/messages" || url.pathname === "/v1/messages/count_tokens");
+            if (isModelCall && sessionId) {
+                const body = await readBody(req);
+                const known = sessions.get(sessionId)?.cwd;
+                const text = body.toString("utf8");
+                const entry = sessionProxy(sessionId, known ?? workingDirectoryFromBody(text));
+                // Say the memory tools exist once this session's model calls carry them (an inert or
+                // disabled MCP server never sends them). Sticky per session: a concurrent side call
+                // with another tool list (WebSearch helper, a restricted subagent) must not clear it
+                // under the main conversation's compress (Codex r3). The client holds one value per
+                // session, so per-call precision would need it carried with each compress call.
+                if (url.pathname === "/v1/messages" && toolsOffered(text) === true) {
+                    entry.memtree.setMemtreeTools(MEMTREE_TOOLS_HEADER_VALUE);
+                }
+                if (entry.refused)
+                    return refuseSession(res, entry.refused);
+                entry.inFlight++;
+                try {
+                    // A few ms of git on the session's first request with a directory, so its MemTree calls carry the project.
+                    await entry.projectReady;
+                    const port = (await entry.proxy).port;
+                    if (gone)
+                        return;
+                    await forward(req, res, port, innerToken, true, body);
+                }
+                finally {
+                    entry.inFlight--;
+                    entry.lastUsed = Date.now();
+                }
+                return;
+            }
+            return forward(req, res, fallback.port, innerToken, true);
+        }
+        // Loopback routes (the MCP server's /memtree reads): the token, then the session's proxy.
+        if (!tokenMatches(header(req, PROXY_TOKEN_HEADER), opts.state.token)) {
+            res.writeHead(403, { "content-type": "application/json" });
+            res.end(JSON.stringify({ detail: "ccc desktop service: missing or wrong token" }));
+            return;
+        }
+        if (url.pathname === "/ccc-desktop/status") {
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ service: "ccc-desktop", mode: opts.state.mode, sessions: sessions.size }));
+            return;
+        }
+        if (!url.pathname.startsWith("/memtree/")) {
+            res.writeHead(404, { "content-type": "application/json" });
+            res.end(JSON.stringify({ detail: "ccc desktop service: not found" }));
+            return;
+        }
+        // The MCP server names the session in a header, or as `?session=` (/memtree/current).
+        const forSession = sessionId ?? (url.searchParams.get("session") || undefined);
+        const entry = forSession ? sessions.get(forSession) : undefined;
+        const port = entry ? (await entry.proxy).port : fallback.port;
+        if (gone)
+            return;
+        return forward(req, res, port, innerToken, false);
+    }
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(opts.state.port, "127.0.0.1", () => resolve());
+    });
+    log(`ccc desktop service (${opts.state.mode}) listening on 127.0.0.1:${opts.state.port}`);
+    // Idle closes in progress, so shutdown waits for their final indexes too (Codex r3).
+    const idleClosing = new Set();
+    const closeIdle = async (idleMs = SESSION_IDLE_MS) => {
+        const now = Date.now();
+        const closing = [];
+        for (const [id, entry] of sessions) {
+            if (entry.inFlight > 0 || now - entry.lastUsed < idleMs)
+                continue;
+            sessions.delete(id);
+            log(`session ${id.slice(0, 8)} idle: closing (final index)`);
+            const done = closeSession(entry, 30_000).catch((err) => log(`session ${id.slice(0, 8)} close: ${String(err)}`));
+            idleClosing.add(done);
+            void done.finally(() => idleClosing.delete(done));
+            closing.push(done);
+        }
+        await Promise.all(closing);
+    };
+    const sweep = setInterval(() => void closeIdle(), SWEEP_MS);
+    sweep.unref();
+    return {
+        port: opts.state.port,
+        sessions: () => [...sessions.keys()],
+        closeIdle,
+        close: async () => {
+            clearInterval(sweep);
+            closing = true;
+            server.close();
+            tunnels.blind();
+            // Requests already being routed get a moment to reach their session proxy before the
+            // snapshot. Bounded: a long stream or long-poll is cut by the proxies' own drain
+            // deadline below, not waited for here (Codex r3).
+            await Promise.race([
+                Promise.allSettled([...pendingRoutes]),
+                new Promise((resolve) => setTimeout(resolve, 3_000).unref()),
+            ]);
+            const all = [...sessions.values()];
+            sessions.clear();
+            await Promise.allSettled([
+                ...all.map((e) => closeSession(e, 10_000)),
+                ...idleClosing,
+                (async () => {
+                    await fallback.drain(10_000);
+                    await fallbackMemtree.drainBackground(FINAL_DRAIN_MS);
+                    fallback.close();
+                })(),
+            ]);
+            tunnels.all();
+            await reqlog.flush(2_000);
+        },
+    };
+}
+/**
+ * Whether a /v1/messages body offers the memtree tools: true / false when it has a
+ * `tools` list with or without them, undefined when it has none (a side call: no change).
+ */
+export function toolsOffered(body) {
+    if (!body.includes('"tools"'))
+        return undefined;
+    try {
+        const tools = JSON.parse(body).tools;
+        if (!Array.isArray(tools) || tools.length === 0)
+            return undefined;
+        return tools.some((t) => typeof t?.name === "string" && t.name.startsWith(`mcp__${MEMTREE_MCP_SERVER_NAME}__`));
+    }
+    catch {
+        return undefined;
+    }
+}
+function header(req, name) {
+    const v = req.headers[name];
+    const s = Array.isArray(v) ? v[0] : v;
+    return s && s.trim() ? s.trim() : undefined;
+}
+function tokenMatches(got, expected) {
+    if (!got)
+        return false;
+    const a = Buffer.from(got);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on("data", (c) => chunks.push(c));
+        req.on("end", () => resolve(Buffer.concat(chunks)));
+        req.on("error", reject);
+    });
+}
+/**
+ * Plain HTTP to one of this process's inner proxies, with the inner token and, for a
+ * request decrypted from api.anthropic.com, the intercepted marker (proxy.ts
+ * acceptInnerRequest). Status, headers and body are streamed back.
+ */
+function forward(req, res, port, innerToken, intercepted, body) {
+    return new Promise((resolve) => {
+        const headers = { ...req.headers };
+        delete headers[PROXY_TOKEN_HEADER];
+        delete headers[INNER_INTERCEPTED_HEADER];
+        headers[INNER_TOKEN_HEADER] = innerToken;
+        if (intercepted)
+            headers[INNER_INTERCEPTED_HEADER] = "1";
+        // A loopback (MCP) call keeps the loopback-caller checks of the inner proxy.
+        else
+            headers.host = `127.0.0.1:${port}`;
+        if (body) {
+            headers["content-length"] = String(body.length);
+            delete headers["transfer-encoding"];
+        }
+        const out = http.request({
+            host: "127.0.0.1", port, method: req.method, path: req.url, headers,
+        }, (upstream) => {
+            res.writeHead(upstream.statusCode ?? 502, upstream.statusMessage, upstream.rawHeaders);
+            upstream.pipe(res);
+            upstream.on("end", resolve);
+            upstream.on("error", () => { res.destroy(); resolve(); });
+        });
+        out.on("error", () => {
+            if (res.destroyed)
+                return resolve();
+            if (!res.headersSent)
+                res.writeHead(502, { "content-type": "application/json" });
+            res.end(JSON.stringify({ type: "error", error: { type: "api_error", message: "ccc desktop service: session proxy unavailable" } }));
+            resolve();
+        });
+        res.on("close", () => { if (!res.writableFinished) {
+            out.destroy();
+            resolve();
+        } });
+        if (body)
+            out.end(body);
+        else
+            req.pipe(out);
+    });
+}
+/** Where a WebSocket upgrade on a decrypted stream goes: api.anthropic.com, or a test's mock. */
+function interceptUpstream(origin) {
+    const url = new URL(origin ?? `https://${INTERCEPT_HOST}`);
+    const secure = url.protocol === "https:";
+    return { host: url.hostname, port: url.port ? Number(url.port) : secure ? 443 : 80, secure };
+}
+/**
+ * Why a Desktop session in `cwd` must not run through ccc: its project's (or the user's,
+ * re-read now) Claude Code settings turn on the Bash sandbox, whose proxy would forward
+ * through this service with the token and lose its private-address check, or set a proxy,
+ * NO_PROXY, CA or env file that breaks the routing (Codex r1 P1). Setup checks only what
+ * it can see; each project is checked here, on its session's first model call.
+ */
+export function projectRefusal(cwd, claudeConfigDir) {
+    // The service can't see which config dir a session uses: check the default one and the
+    // one setup ran with (Codex r2 P1), and refuse if either says so.
+    for (const dir of [undefined, claudeConfigDir]) {
+        const env = { [HTTPS_PROXY_MODE_ENV]: "1",
+            ...(dir ? { CLAUDE_CONFIG_DIR: dir } : {}) };
+        const decision = httpsProxyModeDecision({
+            env, platform: process.platform, claudeArgs: [], cwd,
+        });
+        if (decision.mode === "base-url" && decision.requested)
+            return decision.reason;
+    }
+    return undefined;
+}
+/** The session's model calls get an error it shows, instead of running unprotected. */
+function refuseSession(res, reason) {
+    const message = `ccc desktop can't serve this session: ${reason}. Start it from another ` +
+        "Desktop environment (without the ccc lines), or change that setting.";
+    res.writeHead(400, { "content-type": "application/json" });
+    res.end(JSON.stringify({ type: "error", error: { type: "invalid_request_error", message } }));
+}
+//# sourceMappingURL=desktop-service.js.map

package/dist/desktop-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-service.js","sourceRoot":"","sources":["../src/desktop-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAA0B,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EACL,wBAAwB,EAAE,kBAAkB,EAAE,UAAU,GACzD,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG/E,wFAAwF;AACxF,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC;AAsC7B,8EAA8E;AAC9E,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,IAAI,MAAgD,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAY,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACrF,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ;YAC7H,CAAC,CAAE,CAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAwB,EAAE,IAAI,KAAK,QAAQ,CAAC;aAC1E,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAE,CAA2B,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC,CAAC,EAAE,CAAC;IACP,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,GAAG,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3B,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAA2B;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC9E,iFAAiF;IACjF,8EAA8E;IAC9E,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,GAAkB,EAAE,CAAC,IAAI,aAAa,CAAC;QACxD,OAAO,EAAE,IAAI,CAAC,cAAc;QAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM;QACN,kEAAkE;QAClE,YAAY,EAAE,SAAS;KACxB,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,CAAC,OAAsB,EAAE,eAAuC,EAAgB,EAAE,CAAC,CAAC;QACvG,OAAO;QACP,MAAM;QACN,UAAU;QACV,iBAAiB;QACjB,WAAW;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,uBAAuB,EAAE,IAAI;QAC7B,iBAAiB,EAAE,IAAI;QACvB,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,IAAI;QACpB,oFAAoF;QACpF,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,+EAA+E;QAC/E,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAA,CAAC;IACnB,sFAAsF;IACtF,oFAAoF;IACpF,0FAA0F;IAC1F,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAClD,MAAM,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;IAC1C,MAAM,eAAe,GAAG,UAAU,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IACjD;;;;;;;OAOG;IACH,MAAM,YAAY,GAAG,CAAC,EAAU,EAAE,GAAuB,EAAgB,EAAE;QACzE,IAAI,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,MAAM,eAAe,GAAG,IAAI,qBAAqB,EAAE,CAAC;YACpD,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACrD,KAAK,GAAG;gBACN,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,CAAC;gBACX,OAAO;gBACP,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;oBACtC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,MAAM,CAAC,CAAC;oBACtF,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC;aACH,CAAC;YACF,MAAM,OAAO,GAAG,KAAK,CAAC;YACtB,yEAAyE;YACzE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC1B,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,OAAO;oBAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACtD,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,2BAA2B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;YACjB,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,OAAO;gBAAE,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,MAAM,CAAC,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACvD,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC/B,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjI,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACf,CAAC;QACD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,iGAAiG;IACjG,MAAM,YAAY,GAAG,KAAK,EAAE,KAAmB,EAAE,OAAe,EAAiB,EAAE;QACjF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC;QAChC,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;QACpD,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,qFAAqF;IACrF,MAAM,OAAO,GAAG,CAAC,WAAoB,EAAwB,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC3E,KAAK,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9C,GAAG,CAAC,gBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,SAAS;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACjF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO;YACpC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;QAClG,EAAE,EAAE;YACF,WAAW,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;YACxD,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;SACxD;QACD,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;QAC5B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC/C,KAAK,UAAU,KAAK,CAClB,GAAyB,EAAE,GAAwB,EAAE,WAAoB;QAEzE,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,mCAAmC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9H,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAC/C,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IAC7D,CAAC;IAED,KAAK,UAAU,UAAU,CACvB,GAAyB,EAAE,GAAwB,EAAE,WAAoB;QAEzE,kGAAkG;QAClG,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB;YAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM;gBACvC,CAAC,GAAG,CAAC,QAAQ,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,KAAK,2BAA2B,CAAC,CAAC;YACpF,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnC,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,EAAE,KAAK,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/E,qFAAqF;gBACrF,oFAAoF;gBACpF,qFAAqF;gBACrF,oFAAoF;gBACpF,gFAAgF;gBAChF,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnE,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,0BAA0B,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO;oBAAE,OAAO,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5D,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,2GAA2G;oBAC3G,MAAM,KAAK,CAAC,YAAY,CAAC;oBACzB,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;oBACtC,IAAI,IAAI;wBAAE,OAAO;oBACjB,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACxD,CAAC;wBAAS,CAAC;oBACT,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACjB,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC9B,CAAC;gBACD,OAAO;YACT,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAC5D,CAAC;QACD,0FAA0F;QAC1F,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,sFAAsF;QACtF,MAAM,UAAU,GAAG,SAAS,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC9D,IAAI,IAAI;YAAE,OAAO;QACjB,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,wBAAwB,IAAI,CAAC,KAAK,CAAC,IAAI,4BAA4B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAE1F,qFAAqF;IACrF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,EAAE,MAAM,GAAG,eAAe,EAAiB,EAAE;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,MAAM;gBAAE,SAAS;YAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,8BAA8B,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAChH,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5D,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;QACrB,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,SAAS;QACT,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,qFAAqF;YACrF,iFAAiF;YACjF,kDAAkD;YAClD,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC;gBACtC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;aAC7D,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACnC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvB,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC1C,GAAG,WAAW;gBACd,CAAC,KAAK,IAAI,EAAE;oBACV,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC7B,MAAM,eAAe,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;oBACtD,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,CAAC,CAAC,EAAE;aACL,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsC,CAAC,KAAK,CAAC;QAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAClE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,uBAAuB,IAAI,CAAC,CAAC,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,GAAyB,EAAE,IAAY;IACrD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB,EAAE,QAAgB;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAyB;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CACd,GAAyB,EAAE,GAAwB,EAAE,IAAY,EAAE,UAAkB,EACrF,WAAoB,EAAE,IAAa;IAEnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACzC,OAAO,CAAC,kBAAkB,CAAC,GAAG,UAAU,CAAC;QACzC,IAAI,WAAW;YAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,GAAG,CAAC;QACzD,6EAA6E;;YACxE,OAAO,CAAC,IAAI,GAAG,aAAa,IAAI,EAAE,CAAC;QACxC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO;SACpE,EAAE,CAAC,QAAQ,EAAE,EAAE;YACd,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAiD,CAAC,CAAC;YAC9H,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC5B,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,IAAI,GAAG,CAAC,SAAS;gBAAE,OAAO,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACjF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gDAAgD,EAAE,EAAE,CAAC,CAAC,CAAC;YACpI,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;;YACnB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iGAAiG;AACjG,SAAS,iBAAiB,CAAC,MAA0B;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,WAAW,cAAc,EAAE,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACzC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;AAC/F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,eAAwB;IAClE,uFAAuF;IACvF,kEAAkE;IAClE,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAsB,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG;YAC1D,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,sBAAsB,CAAC;YACtC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG;SACrD,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,QAAQ,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IACjF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,GAAwB,EAAE,MAAc;IAC7D,MAAM,OAAO,GAAG,yCAAyC,MAAM,0BAA0B;QACvF,sEAAsE,CAAC;IACzE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChG,CAAC"}

package/dist/desktop-setup.d.ts

@@ -0,0 +1,94 @@
+export type DesktopMode = "production" | "staging" | "local";
+export interface DesktopPaths {
+    dir: string;
+    /** The pasted NODE_EXTRA_CA_CERTS: the user's own extra CAs at setup, then ccc's CA. */
+    caPem: string;
+    /** ccc's CA certificate alone (public; its key was never kept). */
+    caCert: string;
+    /** The user's own extra CAs, for the service's own upstream TLS (only when there are some). */
+    upstreamCa: string;
+    leafPem: string;
+    leafKey: string;
+    state: string;
+    bashEnv: string;
+    log: string;
+    plist: string;
+}
+export interface DesktopState {
+    mode: DesktopMode;
+    port: number;
+    token: string;
+    /** ISO times: the CA (and leaf) validity, for the rotation notice. */
+    createdAt: string;
+    notAfter: string;
+    /** Setup registered the memtree MCP server, so compress calls may say the tools exist. */
+    mcpRegistered?: boolean;
+    /** CLAUDE_CONFIG_DIR when setup ran, if any: its settings are checked for each session too. */
+    claudeConfigDir?: string;
+}
+export declare function desktopPaths(configDir: string, mode: DesktopMode): DesktopPaths;
+export declare function desktopLaunchdLabel(mode: DesktopMode): string;
+/** The lines to paste into Desktop's environment editor (one KEY=value per line). */
+export declare function desktopEnvLines(paths: DesktopPaths, state: DesktopState): string[];
+/**
+ * Bash-tool commands get the session's env minus ccc's proxy and CA (else curl, Python
+ * and others would fail TLS to api.anthropic.com), each only while it still holds ccc's
+ * value (Claude Code's sandbox sets its own first; the token is matched by pattern, never
+ * written). Programs started from Bash (a nested `claude -p`, an SDK script) aren't routed
+ * through ccc, so they get Claude Code's own compaction back.
+ */
+export declare function desktopBashEnvScript(paths: DesktopPaths, state: DesktopState, userEnv?: DesktopUserEnv): string;
+/** The shell values setup saw that the pasted lines replace for the session. */
+export interface DesktopUserEnv {
+    NODE_EXTRA_CA_CERTS?: string;
+    CLAUDE_ENV_FILE?: string;
+}
+export declare function readDesktopState(paths: DesktopPaths): DesktopState | undefined;
+/** Setup rotates the CA when it expires within this. */
+export declare const CA_ROTATE_BEFORE_MS: number;
+/**
+ * Make the CA and leaf, the token, the port and the Bash env file. A re-run keeps
+ * the port and token (the pasted lines stay valid) unless `rotateToken`, and keeps
+ * the CA (live sessions trust only the one they started with) unless `rotateCa`,
+ * it is missing or unreadable, or it expires within CA_ROTATE_BEFORE_MS.
+ */
+export declare function setupDesktopFiles(paths: DesktopPaths, mode: DesktopMode, opts?: {
+    rotateToken?: boolean;
+    rotateCa?: boolean;
+    userExtraCaPem?: string;
+    userEnv?: DesktopUserEnv;
+    claudeConfigDir?: string;
+}): Promise<DesktopState & {
+    caRotated: boolean;
+}>;
+export declare function writeDesktopState(paths: DesktopPaths, state: DesktopState): void;
+/** The launchd agent: `node <cli.js> [staging|local] desktop serve`, kept alive. */
+export declare function launchdPlist(mode: DesktopMode, paths: DesktopPaths, cliPath: string): string;
+export declare function installLaunchAgent(mode: DesktopMode, paths: DesktopPaths, cliPath: string): void;
+export declare function uninstallLaunchAgent(mode: DesktopMode, paths: DesktopPaths): void;
+/**
+ * The `memtree` MCP server for every Claude Code on this account (Desktop
+ * re-delivers ~/.claude.json's stdio servers to its sessions). It is inert
+ * (no tools) unless the session's HTTPS_PROXY is a ccc proxy or it runs
+ * under terminal ccc (memtree-mcp.ts desktopMcpTarget). Registered through
+ * `claude mcp add-json --scope user`, never by editing ~/.claude.json directly.
+ */
+export declare function desktopMcpServerJson(): string;
+/** The file `claude mcp --scope user` edits: `$CLAUDE_CONFIG_DIR/.claude.json`, else `~/.claude.json`. */
+export declare function userClaudeJsonPath(env?: NodeJS.ProcessEnv): string;
+/**
+ * Who owns the user-scope `memtree` entry (read only; never written here). A file that
+ * exists but can't be read or parsed is "other": ccc then touches nothing.
+ */
+export declare function userMcpOwner(claudeJsonPath?: string): "none" | "ccc-desktop" | "other";
+/**
+ * Register (or refresh) ccc's entry. Someone else's `memtree` entry is left alone
+ * (false, with the reason): the user decides.
+ */
+export declare function registerDesktopMcp(claudeCommand: string, env?: NodeJS.ProcessEnv): {
+    ok: boolean;
+    reason?: string;
+};
+/** Remove ccc's entry only, and only when no other ccc desktop mode still uses it. */
+export declare function unregisterDesktopMcp(claudeCommand: string, otherModesInstalled: boolean, env?: NodeJS.ProcessEnv): void;
+//# sourceMappingURL=desktop-setup.d.ts.map

package/dist/desktop-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-setup.d.ts","sourceRoot":"","sources":["../src/desktop-setup.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,SAAS,GAAG,OAAO,CAAC;AAI7D,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,YAAY,CAe/E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAE7D;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,MAAM,EAAE,CAOlF;AAUD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,cAAmB,GACrE,MAAM,CAeR;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAaD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,GAAG,SAAS,CAM9E;AAED,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,QAAqB,CAAC;AAEtD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EACtC,IAAI,GAAE;IACJ,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAC7F,eAAe,CAAC,EAAE,MAAM,CAAC;CACrB,GACL,OAAO,CAAC,YAAY,GAAG;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CAyChD;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAMhF;AAsBD,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CA8B5F;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAkBhG;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAIjF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAQ7C;AAED,0GAA0G;AAC1G,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,cAAc,SAAuB,GAAG,MAAM,GAAG,aAAa,GAAG,OAAO,CAUpG;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAC1D;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAYlC;AAED,sFAAsF;AACtF,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GACxF,IAAI,CAGN"}