claude-opencode-mcp 1.0.0

package/dist/opencode/setup.d.ts

@@ -0,0 +1,38 @@
+import type { OpencodeClient } from "@opencode-ai/sdk";
+import type { LoadedConfig, ResolvedConfig } from "../config/config.js";
+import type { ProfileCapabilities } from "../security/policy.js";
+import type { AgentDefinition, AgentWorkspace } from "../types/index.js";
+import type { Logger } from "../util/logger.js";
+import type { OpenCodeManager } from "./manager.js";
+import { type ModelRef } from "./run.js";
+export interface PrepareRunInput {
+    cwd?: string | undefined;
+    agent?: string | undefined;
+    model?: string | undefined;
+}
+export interface PreparedRun {
+    workspace: AgentWorkspace;
+    config: ResolvedConfig;
+    definitions: AgentDefinition[];
+    definition: AgentDefinition;
+    capabilities: ProfileCapabilities;
+    client: OpencodeClient;
+    serverKey: string;
+    model: ModelRef | null;
+    modelString: string | null;
+}
+export interface PrepareDeps {
+    manager: OpenCodeManager;
+    logger: Logger;
+    env: NodeJS.ProcessEnv;
+    globalConfig: ResolvedConfig;
+    /** Override per-workspace config loading (tests/embedding). */
+    loadProjectConfig?: (cwd: string) => Promise<LoadedConfig>;
+}
+export declare function getBuiltinDefinitions(): Promise<AgentDefinition[]>;
+export declare function clearBuiltinCache(): void;
+export declare function prepareRun(deps: PrepareDeps, input: PrepareRunInput, workspaceOverride?: AgentWorkspace): Promise<PreparedRun>;
+export declare function getClientForWorkspace(deps: PrepareDeps, workspace: AgentWorkspace, definitions: AgentDefinition[], config: ResolvedConfig): Promise<{
+    client: OpencodeClient;
+    serverKey: string;
+}>;

package/dist/opencode/setup.js

@@ -0,0 +1,109 @@
+import fs from "node:fs";
+import { BridgeError } from "../errors.js";
+import { resolveWorkspace } from "../workspace/resolver.js";
+import { agentCapabilities, buildAgentDefinitions, findAgentDefinition, loadBuiltinAgentDefinitions, loadProjectAgentDefinitions, toOpenCodeAgentConfig, } from "./agents.js";
+import { formatModelRef, resolveModel } from "./run.js";
+let builtinCache = null;
+const verifiedClients = new WeakSet();
+/**
+ * Ask the OpenCode instance which directory it is serving and refuse to
+ * delegate when it is not the requested workspace. This is the last line of
+ * defence against a misrouted request reaching the wrong repository.
+ */
+async function assertWorkspaceRouting(client, workspace, logger) {
+    if (verifiedClients.has(client))
+        return;
+    let served;
+    try {
+        const result = await client.path.get();
+        if (result.error) {
+            logger.debug("workspace routing probe returned an error", {
+                error: JSON.stringify(result.error),
+            });
+            return;
+        }
+        served = result.data?.directory;
+    }
+    catch (error) {
+        logger.debug("workspace routing probe failed; continuing without it", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return;
+    }
+    if (!served)
+        return;
+    let servedCanonical = served;
+    try {
+        servedCanonical = await fs.promises.realpath(served);
+    }
+    catch {
+        // keep the server-reported path
+    }
+    if (servedCanonical !== workspace.cwd) {
+        throw new BridgeError("WORKSPACE_MISMATCH", `OpenCode is serving ${servedCanonical} but the workspace is ${workspace.cwd}.`, { details: { requested: workspace.cwd, served: servedCanonical } });
+    }
+    verifiedClients.add(client);
+}
+export async function getBuiltinDefinitions() {
+    if (!builtinCache)
+        builtinCache = await loadBuiltinAgentDefinitions();
+    return builtinCache;
+}
+export function clearBuiltinCache() {
+    builtinCache = null;
+}
+export async function prepareRun(deps, input, workspaceOverride) {
+    const resolution = workspaceOverride
+        ? null
+        : await resolveWorkspace({
+            cwd: input.cwd,
+            env: deps.env,
+            globalConfig: deps.globalConfig,
+            ...(deps.loadProjectConfig ? { loadProjectConfig: deps.loadProjectConfig } : {}),
+        });
+    const workspace = workspaceOverride ?? resolution.workspace;
+    const config = resolution?.config ?? deps.globalConfig;
+    const [builtin, project] = await Promise.all([
+        getBuiltinDefinitions(),
+        loadProjectAgentDefinitions(workspace.cwd),
+    ]);
+    const definitions = buildAgentDefinitions({ builtin, project, config });
+    const agentName = (input.agent ?? config.defaults.agent).trim();
+    const definition = findAgentDefinition(definitions, agentName);
+    if (!definition) {
+        throw new BridgeError("AGENT_NOT_FOUND", `Unknown agent: ${agentName}`, {
+            details: {
+                requested: agentName,
+                available: definitions.map((entry) => entry.name),
+            },
+        });
+    }
+    const agentConfig = toOpenCodeAgentConfig(definitions, config);
+    const serverKey = await deps.manager.ensure({
+        cwd: workspace.cwd,
+        config,
+        agentConfig,
+    });
+    const client = await deps.manager.clientFor({ cwd: workspace.cwd, config, agentConfig });
+    await assertWorkspaceRouting(client, workspace, deps.logger);
+    const resolved = await resolveModel(client, config, input.model ?? definition.model);
+    return {
+        workspace: { ...workspace, readOnly: agentCapabilities(definition).readOnly },
+        config,
+        definitions,
+        definition,
+        capabilities: agentCapabilities(definition),
+        client,
+        serverKey,
+        model: resolved,
+        modelString: formatModelRef(resolved),
+    };
+}
+export async function getClientForWorkspace(deps, workspace, definitions, config) {
+    const agentConfig = toOpenCodeAgentConfig(definitions, config);
+    const serverKey = await deps.manager.ensure({ cwd: workspace.cwd, config, agentConfig });
+    const client = await deps.manager.clientFor({ cwd: workspace.cwd, config, agentConfig });
+    await assertWorkspaceRouting(client, workspace, deps.logger);
+    return { client, serverKey };
+}
+//# sourceMappingURL=setup.js.map

package/dist/opencode/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/opencode/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAGzB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAI3C,OAAO,EAA8B,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACxF,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,cAAc,EAAiB,YAAY,EAAE,MAAM,UAAU,CAAC;AA6BvE,IAAI,YAAY,GAA6B,IAAI,CAAC;AAElD,MAAM,eAAe,GAAG,IAAI,OAAO,EAAkB,CAAC;AAEtD;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAsB,EACtB,SAAyB,EACzB,MAAc;IAEd,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO;IAExC,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;gBACxD,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;YACpE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,IAAI,eAAe,GAAG,MAAM,CAAC;IAC7B,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IACD,IAAI,eAAe,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;QACtC,MAAM,IAAI,WAAW,CACnB,oBAAoB,EACpB,uBAAuB,eAAe,yBAAyB,SAAS,CAAC,GAAG,GAAG,EAC/E,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,CACnE,CAAC;IACJ,CAAC;IACD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,CAAC,YAAY;QAAE,YAAY,GAAG,MAAM,2BAA2B,EAAE,CAAC;IACtE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAiB,EACjB,KAAsB,EACtB,iBAAkC;IAElC,MAAM,UAAU,GAAG,iBAAiB;QAClC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,gBAAgB,CAAC;YACrB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;IAEhC,MAAM,SAAS,GAAG,iBAAiB,IAAI,UAAW,CAAC,SAAS,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC;IAEvD,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,qBAAqB,EAAE;QACvB,2BAA2B,CAAC,SAAS,CAAC,GAAG,CAAC;KAC3C,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAExE,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,kBAAkB,SAAS,EAAE,EAAE;YACtE,OAAO,EAAE;gBACP,SAAS,EAAE,SAAS;gBACpB,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAClD;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzF,MAAM,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAErF,OAAO;QACL,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;QAC7E,MAAM;QACN,WAAW;QACX,UAAU;QACV,YAAY,EAAE,iBAAiB,CAAC,UAAU,CAAC;QAC3C,MAAM;QACN,SAAS;QACT,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAiB,EACjB,SAAyB,EACzB,WAA8B,EAC9B,MAAsB;IAEtB,MAAM,WAAW,GAAG,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzF,MAAM,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC"}

package/dist/security/paths.d.ts

@@ -0,0 +1,20 @@
+/** Convert an OpenCode-style wildcard pattern (`*`, `?`) to a RegExp. */
+export declare function wildcardToRegExp(pattern: string): RegExp;
+export declare function matchesPattern(target: string, pattern: string): boolean;
+export declare function matchesAnyPattern(target: string, patterns: string[]): boolean;
+/** Patterns for sensitive files that should not be read or written by agents. */
+export declare const DEFAULT_SENSITIVE_PATTERNS: readonly ["*.env", "*.env.*", "*.pem", "*.key", "*.p12", "*.pfx", "id_rsa*", "id_ed25519*", "id_ecdsa*", "credentials", "credentials.*", ".ssh/*", "*.npmrc"];
+/** Patterns that stay readable even when sensitive-file protection is on. */
+export declare const SENSITIVE_ALLOWLIST: readonly ["*.env.example", "*.env.sample", "*.env.template"];
+export declare function isSensitivePath(target: string, extraPatterns?: string[]): boolean;
+/** Canonicalize a path to its real path. Throws INVALID_PATH when it does not exist. */
+export declare function canonicalize(target: string): Promise<string>;
+/** True when `child` is the same as, or inside, `parent` (both canonical). */
+export declare function isPathInside(parent: string, child: string): boolean;
+export declare function assertNoNullBytes(value: string, label: string): void;
+/**
+ * Resolve a task path hint relative to the workspace and make sure it stays
+ * inside the workspace. Hints are advisory for exploration, but they must not
+ * point outside the delegated workspace.
+ */
+export declare function resolvePathHint(cwd: string, hint: string): string;

package/dist/security/paths.js

@@ -0,0 +1,93 @@
+import path from "node:path";
+import { BridgeError } from "../errors.js";
+/** Convert an OpenCode-style wildcard pattern (`*`, `?`) to a RegExp. */
+export function wildcardToRegExp(pattern) {
+    let output = "^";
+    for (const char of pattern) {
+        if (char === "*")
+            output += ".*";
+        else if (char === "?")
+            output += ".";
+        else
+            output += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+    output += "$";
+    return new RegExp(output);
+}
+export function matchesPattern(target, pattern) {
+    if (pattern === "*")
+        return true;
+    const regex = wildcardToRegExp(pattern);
+    if (regex.test(target))
+        return true;
+    return regex.test(path.basename(target));
+}
+export function matchesAnyPattern(target, patterns) {
+    return patterns.some((pattern) => matchesPattern(target, pattern));
+}
+/** Patterns for sensitive files that should not be read or written by agents. */
+export const DEFAULT_SENSITIVE_PATTERNS = [
+    "*.env",
+    "*.env.*",
+    "*.pem",
+    "*.key",
+    "*.p12",
+    "*.pfx",
+    "id_rsa*",
+    "id_ed25519*",
+    "id_ecdsa*",
+    "credentials",
+    "credentials.*",
+    ".ssh/*",
+    "*.npmrc",
+];
+/** Patterns that stay readable even when sensitive-file protection is on. */
+export const SENSITIVE_ALLOWLIST = ["*.env.example", "*.env.sample", "*.env.template"];
+export function isSensitivePath(target, extraPatterns = []) {
+    if (matchesAnyPattern(target, [...SENSITIVE_ALLOWLIST]))
+        return false;
+    return matchesAnyPattern(target, [...DEFAULT_SENSITIVE_PATTERNS, ...extraPatterns]);
+}
+/** Canonicalize a path to its real path. Throws INVALID_PATH when it does not exist. */
+export async function canonicalize(target) {
+    const fs = await import("node:fs");
+    try {
+        return await fs.promises.realpath(target);
+    }
+    catch (error) {
+        throw new BridgeError("INVALID_PATH", `Path does not exist or cannot be resolved: ${target}`, {
+            details: { path: target },
+            cause: error,
+        });
+    }
+}
+/** True when `child` is the same as, or inside, `parent` (both canonical). */
+export function isPathInside(parent, child) {
+    const relative = path.relative(parent, child);
+    if (relative === "")
+        return true;
+    return !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+export function assertNoNullBytes(value, label) {
+    if (value.includes("\u0000")) {
+        throw new BridgeError("INVALID_PATH", `${label} contains a null byte`, {
+            details: { [label]: value },
+        });
+    }
+}
+/**
+ * Resolve a task path hint relative to the workspace and make sure it stays
+ * inside the workspace. Hints are advisory for exploration, but they must not
+ * point outside the delegated workspace.
+ */
+export function resolvePathHint(cwd, hint) {
+    assertNoNullBytes(hint, "path hint");
+    const absolute = path.isAbsolute(hint) ? path.resolve(hint) : path.resolve(cwd, hint);
+    if (!isPathInside(cwd, absolute)) {
+        throw new BridgeError("INVALID_PATH", `Path hint escapes the workspace: ${hint}`, {
+            details: { hint, cwd, resolved: absolute },
+        });
+    }
+    return absolute;
+}
+//# sourceMappingURL=paths.js.map

package/dist/security/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/security/paths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM,IAAI,IAAI,CAAC;aAC5B,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM,IAAI,GAAG,CAAC;;YAChC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,GAAG,CAAC;IACd,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,OAAe;IAC5D,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,QAAkB;IAClE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,OAAO;IACP,SAAS;IACT,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,SAAS;IACT,aAAa;IACb,WAAW;IACX,aAAa;IACb,eAAe;IACf,QAAQ;IACR,SAAS;CACD,CAAC;AAEX,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,eAAe,EAAE,cAAc,EAAE,gBAAgB,CAAU,CAAC;AAEhG,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,gBAA0B,EAAE;IAC1E,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,iBAAiB,CAAC,MAAM,EAAE,CAAC,GAAG,0BAA0B,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc;IAC/C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,8CAA8C,MAAM,EAAE,EAAE;YAC5F,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACzB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,KAAa;IAC5D,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,GAAG,KAAK,uBAAuB,EAAE;YACrE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,IAAY;IACvD,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtF,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,oCAAoC,IAAI,EAAE,EAAE;YAChF,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/security/policy.d.ts

@@ -0,0 +1,17 @@
+import type { SecurityConfig } from "../config/config.js";
+import type { PermissionConfig } from "../types/index.js";
+export type AgentProfile = "read" | "review" | "code" | "test";
+export interface ProfileCapabilities {
+    readOnly: boolean;
+    canEdit: boolean;
+    canRunBash: boolean;
+}
+export declare const PROFILE_CAPABILITIES: Record<AgentProfile, ProfileCapabilities>;
+/**
+ * Build the OpenCode permission config for an agent profile.
+ *
+ * `ask` is deliberately never emitted: the bridge is headless and an `ask`
+ * rule would leave a delegated agent waiting for a human forever.
+ */
+export declare function buildPermissions(profile: AgentProfile, security: SecurityConfig): PermissionConfig;
+export declare function profileForAgent(name: string): AgentProfile | null;

package/dist/security/policy.js

@@ -0,0 +1,86 @@
+import { DEFAULT_SENSITIVE_PATTERNS, SENSITIVE_ALLOWLIST } from "./paths.js";
+export const PROFILE_CAPABILITIES = {
+    read: { readOnly: true, canEdit: false, canRunBash: false },
+    review: { readOnly: true, canEdit: false, canRunBash: false },
+    code: { readOnly: false, canEdit: true, canRunBash: true },
+    test: { readOnly: true, canEdit: false, canRunBash: true },
+};
+function sensitiveFileRules(security) {
+    if (!security.protectEnvFiles)
+        return "allow";
+    const rules = { "*": "allow" };
+    for (const pattern of DEFAULT_SENSITIVE_PATTERNS)
+        rules[pattern] = "deny";
+    for (const pattern of SENSITIVE_ALLOWLIST)
+        rules[pattern] = "allow";
+    for (const pattern of security.extraProtectedPatterns ?? [])
+        rules[pattern] = "deny";
+    return rules;
+}
+function gitSafetyBashRules(security) {
+    const rules = { "*": "allow" };
+    if (security.denyGitPush) {
+        rules["git push*"] = "deny";
+        rules["git -C * push*"] = "deny";
+        rules["git -c * push*"] = "deny";
+    }
+    if (security.denyGitCommit) {
+        rules["git commit*"] = "deny";
+        rules["git -C * commit*"] = "deny";
+        rules["git -c * commit*"] = "deny";
+    }
+    return rules;
+}
+/**
+ * Build the OpenCode permission config for an agent profile.
+ *
+ * `ask` is deliberately never emitted: the bridge is headless and an `ask`
+ * rule would leave a delegated agent waiting for a human forever.
+ */
+export function buildPermissions(profile, security) {
+    const capabilities = PROFILE_CAPABILITIES[profile];
+    const externalDirectory = security.externalDirectory ?? "deny";
+    const base = {
+        read: sensitiveFileRules(security),
+        glob: "allow",
+        grep: "allow",
+        list: "allow",
+        todowrite: "allow",
+        webfetch: "allow",
+        websearch: "allow",
+        lsp: "allow",
+        skill: "allow",
+        task: "deny",
+        question: "deny",
+        doom_loop: "deny",
+        external_directory: externalDirectory,
+    };
+    if (capabilities.canEdit) {
+        base.edit = sensitiveFileRules(security);
+    }
+    else {
+        base.edit = "deny";
+    }
+    if (capabilities.canRunBash) {
+        base.bash = gitSafetyBashRules(security);
+    }
+    else {
+        base.bash = "deny";
+    }
+    return base;
+}
+export function profileForAgent(name) {
+    switch (name) {
+        case "deepseek-researcher":
+            return "read";
+        case "deepseek-reviewer":
+            return "review";
+        case "deepseek-coder":
+            return "code";
+        case "deepseek-tester":
+            return "test";
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=policy.js.map

package/dist/security/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/security/policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAU7E,MAAM,CAAC,MAAM,oBAAoB,GAA8C;IAC7E,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;IAC3D,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;IAC7D,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IAC1D,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;CAC3D,CAAC;AAEF,SAAS,kBAAkB,CAAC,QAAwB;IAClD,IAAI,CAAC,QAAQ,CAAC,eAAe;QAAE,OAAO,OAAO,CAAC;IAC9C,MAAM,KAAK,GAAqC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACjE,KAAK,MAAM,OAAO,IAAI,0BAA0B;QAAE,KAAK,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;IAC1E,KAAK,MAAM,OAAO,IAAI,mBAAmB;QAAE,KAAK,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACpE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,sBAAsB,IAAI,EAAE;QAAE,KAAK,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;IACrF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAwB;IAClD,MAAM,KAAK,GAAqC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACjE,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,KAAK,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC;QAC5B,KAAK,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC;QACjC,KAAK,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;QAC9B,KAAK,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC;QACnC,KAAK,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAqB,EACrB,QAAwB;IAExB,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,iBAAiB,GAAqB,QAAQ,CAAC,iBAAiB,IAAI,MAAM,CAAC;IACjF,MAAM,IAAI,GAAqB;QAC7B,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC;QAClC,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,MAAM;QACjB,kBAAkB,EAAE,iBAAiB;KACtC,CAAC;IAEF,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;IACrB,CAAC;IAED,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,qBAAqB;YACxB,OAAO,MAAM,CAAC;QAChB,KAAK,mBAAmB;YACtB,OAAO,QAAQ,CAAC;QAClB,KAAK,gBAAgB;YACnB,OAAO,MAAM,CAAC;QAChB,KAAK,iBAAiB;YACpB,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/types/index.d.ts

@@ -0,0 +1,131 @@
+import type { FileDiff } from "@opencode-ai/sdk";
+/** The resolved, validated workspace a delegated agent operates in. */
+export interface AgentWorkspace {
+    /** Canonical (realpath) absolute directory the agent works in. */
+    cwd: string;
+    /** The path the caller asked for, before canonicalization. */
+    requestedPath: string;
+    /** Optional soft hints supplied with the task. Never a hard restriction. */
+    allowedPaths?: string[];
+    /** Paths that are protected by policy (informational). */
+    deniedPaths?: string[];
+    /** Canonical git repository root, when the workspace is inside one. */
+    gitRoot?: string;
+    /** Whether the selected agent is restricted to read-only operation. */
+    readOnly: boolean;
+    /** OpenCode project identifier for the workspace. */
+    projectID?: string;
+}
+export type SessionStatus = "pending" | "running" | "completed" | "failed" | "aborted" | "timeout";
+/** A delegated task/agent session tracked by the bridge. */
+export interface AgentSession {
+    id: string;
+    cwd: string;
+    agent: string;
+    provider: string | null;
+    model: string | null;
+    title: string | null;
+    status: SessionStatus;
+    createdAt: string;
+    updatedAt: string;
+    /** OpenCode message id of the last assistant response, when known. */
+    lastMessageID?: string;
+    /** Bridge-level result summary of the last completed run. */
+    lastSummary?: string;
+    lastError?: {
+        code: string;
+        message: string;
+    };
+    durationMs?: number;
+    /** Git baseline captured when the session was created (for diff isolation). */
+    baseline?: {
+        head: string | null;
+        stashRef: string | null;
+        untracked: string[];
+        unborn: boolean;
+    };
+}
+export interface Finding {
+    severity?: string;
+    title: string;
+    detail?: string;
+    file?: string;
+    line?: number;
+}
+export interface DelegateResult {
+    status: "completed" | "failed" | "aborted" | "timeout";
+    session_id: string;
+    agent: string;
+    cwd: string;
+    model: string | null;
+    summary: string;
+    findings: Finding[];
+    files_changed: number;
+    duration_ms: number;
+    truncated: boolean;
+    error?: {
+        code: string;
+        message: string;
+        details?: Record<string, unknown>;
+    };
+}
+export interface AgentInfo {
+    name: string;
+    description: string;
+    mode: "primary" | "subagent" | "all";
+    readOnly: boolean;
+    canEdit: boolean;
+    canRunBash: boolean;
+    model: string | null;
+    source: "builtin" | "project" | "opencode";
+}
+export type PermissionAction = "allow" | "ask" | "deny";
+export type PermissionRule = PermissionAction | Record<string, PermissionAction>;
+export type PermissionConfig = Record<string, PermissionRule>;
+export interface AgentDefinition {
+    name: string;
+    description: string;
+    mode: "primary" | "subagent" | "all";
+    prompt: string;
+    permission: PermissionConfig;
+    model: string | null;
+    temperature?: number;
+    /** Permission profile override (only honoured for project/configured agents). */
+    profile?: import("../security/policy.js").AgentProfile;
+    source: "builtin" | "project";
+}
+export interface RunProgress {
+    progress: number;
+    total?: number;
+    message: string;
+}
+export interface RunResult {
+    status: "completed" | "failed" | "timeout";
+    summary: string;
+    findings: Finding[];
+    error?: {
+        code: string;
+        message: string;
+        details?: Record<string, unknown>;
+    };
+    durationMs: number;
+    messageID?: string;
+    truncated: boolean;
+}
+export interface DiffFileSummary {
+    file: string;
+    additions: number;
+    deletions: number;
+    status: "modified" | "added" | "deleted" | "renamed" | "unknown";
+}
+export interface DiffResult {
+    session_id: string;
+    cwd: string;
+    source: "opencode" | "git";
+    files: DiffFileSummary[];
+    diff: string;
+    truncated: boolean;
+    note?: string;
+    /** Raw OpenCode file diffs, when available. */
+    opencodeDiff?: FileDiff[];
+}

package/dist/types/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":""}

package/dist/util/fs.d.ts

@@ -0,0 +1,12 @@
+export declare function pathExists(target: string): Promise<boolean>;
+export declare function ensureDir(dir: string): Promise<void>;
+export declare function ensureDirSync(dir: string, mode?: number): void;
+export declare function readJsonFile<T>(file: string): Promise<T | null>;
+export declare function readJsonFileSync<T>(file: string): T | null;
+/** Write a file atomically (write temp file in the same dir, then rename). */
+export declare function writeFileAtomic(file: string, contents: string, options?: {
+    mode?: number;
+}): Promise<void>;
+export declare function writeFileAtomicSync(file: string, contents: string, options?: {
+    mode?: number;
+}): void;

package/dist/util/fs.js

@@ -0,0 +1,73 @@
+import fs from "node:fs";
+import path from "node:path";
+export async function pathExists(target) {
+    try {
+        await fs.promises.access(target);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function ensureDir(dir) {
+    await fs.promises.mkdir(dir, { recursive: true });
+}
+export function ensureDirSync(dir, mode) {
+    fs.mkdirSync(dir, { recursive: true, ...(mode !== undefined ? { mode } : {}) });
+}
+export async function readJsonFile(file) {
+    try {
+        const raw = await fs.promises.readFile(file, "utf8");
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+export function readJsonFileSync(file) {
+    try {
+        const raw = fs.readFileSync(file, "utf8");
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+/** Write a file atomically (write temp file in the same dir, then rename). */
+export async function writeFileAtomic(file, contents, options = {}) {
+    const dir = path.dirname(file);
+    await ensureDir(dir);
+    const temp = path.join(dir, `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);
+    await fs.promises.writeFile(temp, contents, {
+        encoding: "utf8",
+        ...(options.mode !== undefined ? { mode: options.mode } : {}),
+    });
+    await fs.promises.rename(temp, file);
+    if (options.mode !== undefined) {
+        await fs.promises.chmod(file, options.mode).catch(() => undefined);
+    }
+}
+export function writeFileAtomicSync(file, contents, options = {}) {
+    const dir = path.dirname(file);
+    // Session/log state lives in a directory only the owner can access.
+    ensureDirSync(dir, options.mode !== undefined ? 0o700 : undefined);
+    const temp = path.join(dir, `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);
+    fs.writeFileSync(temp, contents, {
+        encoding: "utf8",
+        ...(options.mode !== undefined ? { mode: options.mode } : {}),
+    });
+    fs.renameSync(temp, file);
+    if (options.mode !== undefined) {
+        try {
+            fs.chmodSync(file, options.mode);
+        }
+        catch {
+            // best effort; the file is still written
+        }
+    }
+}
+//# sourceMappingURL=fs.js.map

package/dist/util/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/util/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAa;IACtD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAI,IAAY;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAI,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,QAAgB,EAChB,UAA6B,EAAE;IAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxF,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE;QAC1C,QAAQ,EAAE,MAAM;QAChB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,QAAgB,EAChB,UAA6B,EAAE;IAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,oEAAoE;IACpE,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxF,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE;QAC/B,QAAQ,EAAE,MAAM;QAChB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC,CAAC;IACH,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC"}