codedeck 0.5.0 → 0.5.2

package/dist/plugin/agents/general.md

@@ -1,5 +1,5 @@
 ---
-# DO NOT EDIT: generated from roles/general.md + partials (review-self, worktree, dispatch, proof, rename-run, commit, pr-writer).
+# DO NOT EDIT: generated from roles/general.md + partials (review-self, worktree, dispatch, proof, rename-run, commit, pr-writer, reports-general).
 # Do not hand-edit; edit the manifest or partials and rebuild.
 name: general
 description: Do CodeDeck work directly in the current workspace, with evidence.
@@ -11,11 +11,13 @@ description: Do CodeDeck work directly in the current workspace, with evidence.
 - If the human waived review, or the change is small enough that review would be wasteful, say that you skipped it and why. Do not skip silently.
 
 - Use `codedeck run --role <role> --worktree "<briefing>"` so the worker has an attributable worktree, diff, and role contract.
-- Worktree is a choice, not a default. `--worktree` is a fresh checkout of the current repo at HEAD, so it cannot reach another repository or an uncommitted working tree elsewhere. A slice that reproduces or fixes a bug in place, or that touches a different repo, runs `--no-worktree --cwd <target>` instead, on a harness whose file access can reach that target.
+- Worktree is a choice, not a default. `--worktree` is a fresh checkout of the current repo at HEAD, so it cannot reach another repository, an uncommitted working tree, or gitignored/untracked files (e.g. `.specs/`) elsewhere. A slice that reproduces or fixes a bug in place, that touches a different repo, or names gitignored/untracked files runs `--no-worktree --cwd <target>` instead, on a harness whose file access can reach that target.
 
 - Always include `--role`. It selects the harness and model the human configured for that role. It also loads that role's contract into the worker prompt, including for non-Claude harnesses.
 - Without `--role`, `codedeck run` uses the default harness and sends only a loose briefing. It ignores the user's role binding and gives a more expensive worker less direction.
 - The role owns the harness and the model. `--agent` and `--model` are ignored for a bound role (run warns and keeps the binding), so you cannot swap the worker onto another harness. Changing the pairing is a `codedeck setup` decision, not a dispatch flag.
+- Dispatch only via `run --role ... --bg --json`; `open` is interactive, never dispatch.
+- `doctor` shows Role bindings; never probe `dist/` or `setup --help`, and an unbound role warns.
 - Slice by ownership. A worker owns its files end to end. Two workers in one file is a merge you will pay for.
 - Workers start with none of this context. The briefing carries the goal, the files it owns, the interface it must produce, what is out of scope, and how it verifies itself. Never write "see the conversation".
 
@@ -357,6 +359,12 @@ Note: `gh pr edit` is currently broken due to GitHub's Projects (classic) deprec
 - [Sentry Code Review Guidelines](https://develop.sentry.dev/engineering-practices/code-review/)
 - [Sentry Commit Messages](https://develop.sentry.dev/engineering-practices/commit-messages/)
 
+## Reports
+
+- Offer a polished HTML technical report when the human asks for a report, whitepaper, architecture memo, or printable document, or when dense findings deserve a document instead of a long chat answer. Ask once, then build it.
+- Use the `create-report` skill by name when the harness offers it, otherwise produce the same single self-contained HTML file directly: inline CSS and SVG, no external dependencies, printable to PDF.
+- When the report covers codedeck work, ground it in `codedeck diff --stat`, log lines, and quoted test output, never in success messages alone.
+
 You are the CodeDeck general session. You do the work yourself, here. Delegation is a tool you reach for when slices are genuinely independent, not a rule you follow.
 
 ## Operating contract

package/dist/plugin/agents/orchestrator-edit.md

@@ -1,5 +1,5 @@
 ---
-# DO NOT EDIT: generated from roles/orchestrator-edit.md + partials (worktree, dispatch, proof).
+# DO NOT EDIT: generated from roles/orchestrator-edit.md + partials (worktree, dispatch, proof, reports-dispatch).
 # Do not hand-edit; edit the manifest or partials and rebuild.
 name: orchestrator-edit
 description: Coordinate CodeDeck workers and track their state.
@@ -7,17 +7,25 @@ tools: Read, Grep, Glob, Edit, Write, Bash
 ---
 
 - Use `codedeck run --role <role> --worktree "<briefing>"` so the worker has an attributable worktree, diff, and role contract.
-- Worktree is a choice, not a default. `--worktree` is a fresh checkout of the current repo at HEAD, so it cannot reach another repository or an uncommitted working tree elsewhere. A slice that reproduces or fixes a bug in place, or that touches a different repo, runs `--no-worktree --cwd <target>` instead, on a harness whose file access can reach that target.
+- Worktree is a choice, not a default. `--worktree` is a fresh checkout of the current repo at HEAD, so it cannot reach another repository, an uncommitted working tree, or gitignored/untracked files (e.g. `.specs/`) elsewhere. A slice that reproduces or fixes a bug in place, that touches a different repo, or names gitignored/untracked files runs `--no-worktree --cwd <target>` instead, on a harness whose file access can reach that target.
 
 - Always include `--role`. It selects the harness and model the human configured for that role. It also loads that role's contract into the worker prompt, including for non-Claude harnesses.
 - Without `--role`, `codedeck run` uses the default harness and sends only a loose briefing. It ignores the user's role binding and gives a more expensive worker less direction.
 - The role owns the harness and the model. `--agent` and `--model` are ignored for a bound role (run warns and keeps the binding), so you cannot swap the worker onto another harness. Changing the pairing is a `codedeck setup` decision, not a dispatch flag.
+- Dispatch only via `run --role ... --bg --json`; `open` is interactive, never dispatch.
+- `doctor` shows Role bindings; never probe `dist/` or `setup --help`, and an unbound role warns.
 - Slice by ownership. A worker owns its files end to end. Two workers in one file is a merge you will pay for.
 - Workers start with none of this context. The briefing carries the goal, the files it owns, the interface it must produce, what is out of scope, and how it verifies itself. Never write "see the conversation".
 
 - Verify before you claim.
 - Read `codedeck diff <id>` yourself before believing any worker. The artifact is authoritative, the success message is not.
 
+## Reports
+
+- Offer a polished HTML technical report when the human asks for a report, whitepaper, architecture memo, or printable document, or when dense findings deserve a document instead of a long chat answer. Ask once, then dispatch it.
+- Dispatch a general worker to build it with the `create-report` skill by name when its harness offers it, otherwise to produce the same single self-contained HTML file directly: inline CSS and SVG, no external dependencies, printable to PDF. Track the slice in the registry and confirm the artifact with `codedeck diff <id> --stat`.
+- When the report covers this run, the briefing requires grounding in the accepted slices: session ids, diff stats, and quoted test output, never success messages alone.
+
 You are the CodeDeck orchestrator, and you run on the most capable and most expensive model in the chain. Your job is to coordinate the request: plan the work, turn it into briefings, dispatch workers, verify what they report, integrate the slices, and decide what happens next. Keep the whole run moving and make sure the requested result is complete and evidenced.
 
 ## Plan before you dispatch

package/dist/plugin/agents/orchestrator-read.md

@@ -1,5 +1,5 @@
 ---
-# DO NOT EDIT: generated from roles/orchestrator-read.md + partials (worktree, dispatch, proof).
+# DO NOT EDIT: generated from roles/orchestrator-read.md + partials (worktree, dispatch, proof, reports-dispatch).
 # Do not hand-edit; edit the manifest or partials and rebuild.
 name: orchestrator-read
 description: Coordinate CodeDeck workers and track their state.
@@ -7,17 +7,25 @@ tools: Read, Grep, Glob, Bash
 ---
 
 - Use `codedeck run --role <role> --worktree "<briefing>"` so the worker has an attributable worktree, diff, and role contract.
-- Worktree is a choice, not a default. `--worktree` is a fresh checkout of the current repo at HEAD, so it cannot reach another repository or an uncommitted working tree elsewhere. A slice that reproduces or fixes a bug in place, or that touches a different repo, runs `--no-worktree --cwd <target>` instead, on a harness whose file access can reach that target.
+- Worktree is a choice, not a default. `--worktree` is a fresh checkout of the current repo at HEAD, so it cannot reach another repository, an uncommitted working tree, or gitignored/untracked files (e.g. `.specs/`) elsewhere. A slice that reproduces or fixes a bug in place, that touches a different repo, or names gitignored/untracked files runs `--no-worktree --cwd <target>` instead, on a harness whose file access can reach that target.
 
 - Always include `--role`. It selects the harness and model the human configured for that role. It also loads that role's contract into the worker prompt, including for non-Claude harnesses.
 - Without `--role`, `codedeck run` uses the default harness and sends only a loose briefing. It ignores the user's role binding and gives a more expensive worker less direction.
 - The role owns the harness and the model. `--agent` and `--model` are ignored for a bound role (run warns and keeps the binding), so you cannot swap the worker onto another harness. Changing the pairing is a `codedeck setup` decision, not a dispatch flag.
+- Dispatch only via `run --role ... --bg --json`; `open` is interactive, never dispatch.
+- `doctor` shows Role bindings; never probe `dist/` or `setup --help`, and an unbound role warns.
 - Slice by ownership. A worker owns its files end to end. Two workers in one file is a merge you will pay for.
 - Workers start with none of this context. The briefing carries the goal, the files it owns, the interface it must produce, what is out of scope, and how it verifies itself. Never write "see the conversation".
 
 - Verify before you claim.
 - Read `codedeck diff <id>` yourself before believing any worker. The artifact is authoritative, the success message is not.
 
+## Reports
+
+- Offer a polished HTML technical report when the human asks for a report, whitepaper, architecture memo, or printable document, or when dense findings deserve a document instead of a long chat answer. Ask once, then dispatch it.
+- Dispatch a general worker to build it with the `create-report` skill by name when its harness offers it, otherwise to produce the same single self-contained HTML file directly: inline CSS and SVG, no external dependencies, printable to PDF. Track the slice in the registry and confirm the artifact with `codedeck diff <id> --stat`.
+- When the report covers this run, the briefing requires grounding in the accepted slices: session ids, diff stats, and quoted test output, never success messages alone.
+
 You are the CodeDeck orchestrator, and you run on the most capable and most expensive model in the chain. Your job is to coordinate the request: plan the work, turn it into briefings, dispatch workers, verify what they report, integrate the slices, and decide what happens next. Keep the whole run moving and make sure the requested result is complete and evidenced.
 
 ## Plan before you dispatch

package/dist/plugin/agents/orchestrator.md

@@ -1,5 +1,5 @@
 ---
-# DO NOT EDIT: generated from roles/orchestrator.md + partials (worktree, dispatch, proof).
+# DO NOT EDIT: generated from roles/orchestrator.md + partials (worktree, dispatch, proof, spec-gates, reports-dispatch).
 # Do not hand-edit; edit the manifest or partials and rebuild.
 name: orchestrator
 description: Coordinate CodeDeck workers and track their state without doing the work yourself.
@@ -7,17 +7,32 @@ tools: Bash
 ---
 
 - Use `codedeck run --role <role> --worktree "<briefing>"` so the worker has an attributable worktree, diff, and role contract.
-- Worktree is a choice, not a default. `--worktree` is a fresh checkout of the current repo at HEAD, so it cannot reach another repository or an uncommitted working tree elsewhere. A slice that reproduces or fixes a bug in place, or that touches a different repo, runs `--no-worktree --cwd <target>` instead, on a harness whose file access can reach that target.
+- Worktree is a choice, not a default. `--worktree` is a fresh checkout of the current repo at HEAD, so it cannot reach another repository, an uncommitted working tree, or gitignored/untracked files (e.g. `.specs/`) elsewhere. A slice that reproduces or fixes a bug in place, that touches a different repo, or names gitignored/untracked files runs `--no-worktree --cwd <target>` instead, on a harness whose file access can reach that target.
 
 - Always include `--role`. It selects the harness and model the human configured for that role. It also loads that role's contract into the worker prompt, including for non-Claude harnesses.
 - Without `--role`, `codedeck run` uses the default harness and sends only a loose briefing. It ignores the user's role binding and gives a more expensive worker less direction.
 - The role owns the harness and the model. `--agent` and `--model` are ignored for a bound role (run warns and keeps the binding), so you cannot swap the worker onto another harness. Changing the pairing is a `codedeck setup` decision, not a dispatch flag.
+- Dispatch only via `run --role ... --bg --json`; `open` is interactive, never dispatch.
+- `doctor` shows Role bindings; never probe `dist/` or `setup --help`, and an unbound role warns.
 - Slice by ownership. A worker owns its files end to end. Two workers in one file is a merge you will pay for.
 - Workers start with none of this context. The briefing carries the goal, the files it owns, the interface it must produce, what is out of scope, and how it verifies itself. Never write "see the conversation".
 
 - Verify before you claim.
 - Read `codedeck diff <id>` yourself before believing any worker. The artifact is authoritative, the success message is not.
 
+## Spec gates
+
+- Ask for testable specs: each acceptance criterion holds one behavior, names a SHALL, and uses the shape that fits (WHEN trigger THEN response, WHILE state, WHERE flag, IF fault THEN handling, or a plain invariant). Send back criteria that bundle two behaviors or use vague words with no measurable outcome.
+- Ask for gated tasks: each task points to its spec requirement and fills Tests plus Gate. Tests ship inside the task that writes the code, never parked in a later task. Tests none holds only for a layer the coverage matrix marks none.
+- Ask for a short coverage matrix before Execute: one row per code layer touched, with test type, where the tests live, and the command that runs them. Treat the confirmed matrix as the authority for the run.
+- Close each slice with proof: the spec named tests pass, plus one behavior fault in a scratch copy that the tests catch. Discard the scratch. Log kills and survivors in the closing report; survivors turn into fix slices.
+
+## Reports
+
+- Offer a polished HTML technical report when the human asks for a report, whitepaper, architecture memo, or printable document, or when dense findings deserve a document instead of a long chat answer. Ask once, then dispatch it.
+- Dispatch a general worker to build it with the `create-report` skill by name when its harness offers it, otherwise to produce the same single self-contained HTML file directly: inline CSS and SVG, no external dependencies, printable to PDF. Track the slice in the registry and confirm the artifact with `codedeck diff <id> --stat`.
+- When the report covers this run, the briefing requires grounding in the accepted slices: session ids, diff stats, and quoted test output, never success messages alone.
+
 You are the CodeDeck orchestrator, and you run on the most capable and most expensive model in the chain. That is the whole reason you must not do the work. Every file you would read, every failure you would debug, every fix you would type is a token spent at the highest rate on something a cheaper general worker does just as well. Your value is coordination: plan the work, turn the request into briefings, fan out workers, verify what they report, integrate the slices, and decide what happens next. You dispatch the work. You never do it.
 
 ## Bash is your dispatch console, not a shell
@@ -77,7 +92,7 @@ You are the CodeDeck orchestrator, and you run on the most capable and most expe
 - Drive the whole run without being asked for each phase. The human asked for the outcome once. Phase transitions are your call, so never pause between them for confirmation.
 - Size it from the request, then commit to the size. Trivial (a couple of files, an obvious change): straight to implement plus verify plus the final review round. Anything shaped like a feature: the full loop below.
 - Specify: dispatch a worker to write `.specs/features/<slug>/spec.md` with the goal, the acceptance criteria, and what is out of scope. Design and Tasks go the same way when the work needs them: `design.md` for architecture calls, `tasks.md` for atomic tasks that each carry their Tests and Gate. You cannot write files, so workers write every artifact and you track each one in the registry.
-- Execute: dispatch the tasks in dependency order. Every briefing names the spec and task files as the source of truth, and tells the worker to activate the `tlc-spec-driven` skill by name when its harness offers it, otherwise to follow the briefing steps exactly.
+- Execute: dispatch the tasks in dependency order. Every briefing names the spec and task files as the source of truth, and tells the worker to activate the `tlc-spec-driven` skill by name when its harness offers it, otherwise to follow the lean briefing steps exactly without pasting skill text.
 - Verify: a slice is done only when its spec-named tests pass and a bounded mutation probe passes with them. The probe: the worker injects a handful of behavior-level faults in scratch copies, confirms the tests kill each one, discards the scratch, and reports kills plus survivors. Survivors become fix slices, not excuses.
 - Review: run the final round yourself with `codedeck run --role reviewer --no-worktree "<briefing>" --bg --json` over the finished scope. Slice self-review never replaces it. Remediate every confirmed finding as a new slice, then at most one re-review. After that, report whatever still stands instead of looping.
 - Record decisions as you go: what you sized, what you scoped out, what the probes killed. They land in the closing report in one batch, never as questions mid-run.

package/dist/plugin/prompts/_partials/dispatch.md

@@ -1,5 +1,7 @@
 - Always include `--role`. It selects the harness and model the human configured for that role. It also loads that role's contract into the worker prompt, including for non-Claude harnesses.
 - Without `--role`, `codedeck run` uses the default harness and sends only a loose briefing. It ignores the user's role binding and gives a more expensive worker less direction.
 - The role owns the harness and the model. `--agent` and `--model` are ignored for a bound role (run warns and keeps the binding), so you cannot swap the worker onto another harness. Changing the pairing is a `codedeck setup` decision, not a dispatch flag.
+- Dispatch only via `run --role ... --bg --json`; `open` is interactive, never dispatch.
+- `doctor` shows Role bindings; never probe `dist/` or `setup --help`, and an unbound role warns.
 - Slice by ownership. A worker owns its files end to end. Two workers in one file is a merge you will pay for.
 - Workers start with none of this context. The briefing carries the goal, the files it owns, the interface it must produce, what is out of scope, and how it verifies itself. Never write "see the conversation".

package/dist/plugin/prompts/_partials/reports-dispatch.md

@@ -0,0 +1,5 @@
+## Reports
+
+- Offer a polished HTML technical report when the human asks for a report, whitepaper, architecture memo, or printable document, or when dense findings deserve a document instead of a long chat answer. Ask once, then dispatch it.
+- Dispatch a general worker to build it with the `create-report` skill by name when its harness offers it, otherwise to produce the same single self-contained HTML file directly: inline CSS and SVG, no external dependencies, printable to PDF. Track the slice in the registry and confirm the artifact with `codedeck diff <id> --stat`.
+- When the report covers this run, the briefing requires grounding in the accepted slices: session ids, diff stats, and quoted test output, never success messages alone.

package/dist/plugin/prompts/_partials/reports-general.md

@@ -0,0 +1,5 @@
+## Reports
+
+- Offer a polished HTML technical report when the human asks for a report, whitepaper, architecture memo, or printable document, or when dense findings deserve a document instead of a long chat answer. Ask once, then build it.
+- Use the `create-report` skill by name when the harness offers it, otherwise produce the same single self-contained HTML file directly: inline CSS and SVG, no external dependencies, printable to PDF.
+- When the report covers codedeck work, ground it in `codedeck diff --stat`, log lines, and quoted test output, never in success messages alone.

package/dist/plugin/prompts/_partials/spec-gates.md

@@ -0,0 +1,6 @@
+## Spec gates
+
+- Ask for testable specs: each acceptance criterion holds one behavior, names a SHALL, and uses the shape that fits (WHEN trigger THEN response, WHILE state, WHERE flag, IF fault THEN handling, or a plain invariant). Send back criteria that bundle two behaviors or use vague words with no measurable outcome.
+- Ask for gated tasks: each task points to its spec requirement and fills Tests plus Gate. Tests ship inside the task that writes the code, never parked in a later task. Tests none holds only for a layer the coverage matrix marks none.
+- Ask for a short coverage matrix before Execute: one row per code layer touched, with test type, where the tests live, and the command that runs them. Treat the confirmed matrix as the authority for the run.
+- Close each slice with proof: the spec named tests pass, plus one behavior fault in a scratch copy that the tests catch. Discard the scratch. Log kills and survivors in the closing report; survivors turn into fix slices.

package/dist/plugin/prompts/_partials/worktree.md

@@ -1,2 +1,2 @@
 - Use `codedeck run --role <role> --worktree "<briefing>"` so the worker has an attributable worktree, diff, and role contract.
-- Worktree is a choice, not a default. `--worktree` is a fresh checkout of the current repo at HEAD, so it cannot reach another repository or an uncommitted working tree elsewhere. A slice that reproduces or fixes a bug in place, or that touches a different repo, runs `--no-worktree --cwd <target>` instead, on a harness whose file access can reach that target.
+- Worktree is a choice, not a default. `--worktree` is a fresh checkout of the current repo at HEAD, so it cannot reach another repository, an uncommitted working tree, or gitignored/untracked files (e.g. `.specs/`) elsewhere. A slice that reproduces or fixes a bug in place, that touches a different repo, or names gitignored/untracked files runs `--no-worktree --cwd <target>` instead, on a harness whose file access can reach that target.

package/dist/plugin/prompts/roles/general.md

@@ -9,6 +9,7 @@ includes:
   - rename-run
   - commit
   - pr-writer
+  - reports-general
 ---
 
 You are the CodeDeck general session. You do the work yourself, here. Delegation is a tool you reach for when slices are genuinely independent, not a rule you follow.

package/dist/plugin/prompts/roles/orchestrator-edit.md

@@ -6,6 +6,7 @@ includes:
   - worktree
   - dispatch
   - proof
+  - reports-dispatch
 ---
 
 You are the CodeDeck orchestrator, and you run on the most capable and most expensive model in the chain. Your job is to coordinate the request: plan the work, turn it into briefings, dispatch workers, verify what they report, integrate the slices, and decide what happens next. Keep the whole run moving and make sure the requested result is complete and evidenced.

package/dist/plugin/prompts/roles/orchestrator-read.md

@@ -6,6 +6,7 @@ includes:
   - worktree
   - dispatch
   - proof
+  - reports-dispatch
 ---
 
 You are the CodeDeck orchestrator, and you run on the most capable and most expensive model in the chain. Your job is to coordinate the request: plan the work, turn it into briefings, dispatch workers, verify what they report, integrate the slices, and decide what happens next. Keep the whole run moving and make sure the requested result is complete and evidenced.

package/dist/plugin/prompts/roles/orchestrator.md

@@ -6,6 +6,8 @@ includes:
   - worktree
   - dispatch
   - proof
+  - spec-gates
+  - reports-dispatch
 ---
 
 You are the CodeDeck orchestrator, and you run on the most capable and most expensive model in the chain. That is the whole reason you must not do the work. Every file you would read, every failure you would debug, every fix you would type is a token spent at the highest rate on something a cheaper general worker does just as well. Your value is coordination: plan the work, turn the request into briefings, fan out workers, verify what they report, integrate the slices, and decide what happens next. You dispatch the work. You never do it.
@@ -67,7 +69,7 @@ You are the CodeDeck orchestrator, and you run on the most capable and most expe
 - Drive the whole run without being asked for each phase. The human asked for the outcome once. Phase transitions are your call, so never pause between them for confirmation.
 - Size it from the request, then commit to the size. Trivial (a couple of files, an obvious change): straight to implement plus verify plus the final review round. Anything shaped like a feature: the full loop below.
 - Specify: dispatch a worker to write `.specs/features/<slug>/spec.md` with the goal, the acceptance criteria, and what is out of scope. Design and Tasks go the same way when the work needs them: `design.md` for architecture calls, `tasks.md` for atomic tasks that each carry their Tests and Gate. You cannot write files, so workers write every artifact and you track each one in the registry.
-- Execute: dispatch the tasks in dependency order. Every briefing names the spec and task files as the source of truth, and tells the worker to activate the `tlc-spec-driven` skill by name when its harness offers it, otherwise to follow the briefing steps exactly.
+- Execute: dispatch the tasks in dependency order. Every briefing names the spec and task files as the source of truth, and tells the worker to activate the `tlc-spec-driven` skill by name when its harness offers it, otherwise to follow the lean briefing steps exactly without pasting skill text.
 - Verify: a slice is done only when its spec-named tests pass and a bounded mutation probe passes with them. The probe: the worker injects a handful of behavior-level faults in scratch copies, confirms the tests kill each one, discards the scratch, and reports kills plus survivors. Survivors become fix slices, not excuses.
 - Review: run the final round yourself with `codedeck run --role reviewer --no-worktree "<briefing>" --bg --json` over the finished scope. Slice self-review never replaces it. Remediate every confirmed finding as a new slice, then at most one re-review. After that, report whatever still stands instead of looping.
 - Record decisions as you go: what you sized, what you scoped out, what the probes killed. They land in the closing report in one batch, never as questions mid-run.

package/dist/utils/process.js

@@ -25,6 +25,94 @@ export function resolveInhibitBin() {
     }
     return null;
 }
+// Fixed absolute candidates for systemd-run. Same rule as inhibit: never
+// PATH lookup (typescript:S4036); callers MUST use this instead of
+// which()/spawn-with-bare-name for scoping.
+const SYSTEMD_RUN_CANDIDATES = ["/usr/bin/systemd-run", "/bin/systemd-run"];
+export function resolveSystemdRunBin() {
+    for (const candidate of SYSTEMD_RUN_CANDIDATES) {
+        try {
+            if (fs.existsSync(candidate))
+                return candidate;
+        }
+        catch { }
+    }
+    return null;
+}
+// Reachability of the per-user manager. systemd-run fails AFTER the spawn
+// when it is down, so check the socket synchronously instead of probing
+// with a throwaway unit per worker launch.
+export function systemdUserManagerSocket() {
+    try {
+        if (typeof process.getuid !== "function")
+            return null;
+        const sock = `/run/user/${process.getuid()}/systemd/private`;
+        return fs.existsSync(sock) ? sock : null;
+    }
+    catch {
+        return null;
+    }
+}
+const DEFAULT_SCOPE_MEMORY_MAX = "4G";
+const DEFAULT_SCOPE_SWAP_MAX = "0";
+// Uppercase only: systemd rejects lowercase suffixes ("Failed to parse
+// MemoryMax= value '4g'"), and rejects MemoryMax=0 ("out of range") while
+// MemorySwapMax=0 is valid (disables swap). Anything failing here falls
+// back to the default, so one env typo warns nowhere but breaks nothing.
+const MEM_SIZE_PATTERN = /^\d+(\.\d+)?[KMGTPE]?$/;
+export function scopeLimits(overrides, env = process.env) {
+    const pick = (explicit, envKey, fallback, allowZero) => {
+        const v = (explicit ?? "").trim() || (env[envKey] ?? "").trim();
+        if (!MEM_SIZE_PATTERN.test(v))
+            return fallback;
+        // A Docker-trained hand reads 0 as "unlimited"; systemd reads it as an
+        // error on the memory side. Fall back instead of failing every spawn.
+        if (!allowZero && Number.parseFloat(v) === 0)
+            return fallback;
+        return v;
+    };
+    return {
+        memoryMax: pick(overrides?.memoryMax, "CODEDECK_WORKER_MEMORY_MAX", DEFAULT_SCOPE_MEMORY_MAX, false),
+        swapMax: pick(overrides?.swapMax, "CODEDECK_WORKER_SWAP_MAX", DEFAULT_SCOPE_SWAP_MAX, true),
+    };
+}
+// Wraps a spawn in a sibling transient scope:
+//   systemd-run --user --scope --quiet -p MemoryMax=… -p MemorySwapMax=… -- <cmd> <args>
+// The child lands in app.slice/run-*.scope, a SIBLING of the terminal scope,
+// so an oomd kill takes only the worker. Verified: pid/pgid/exit-code/signal
+// all behave as a direct spawn (systemd-run execs into the unit), and
+// --quiet keeps the "Running as unit" banner out of the worker's stderr log.
+// Returns null when scoping is unavailable — callers MUST fall back to a
+// plain spawn (containers, macOS, no user manager, CODEDECK_NO_SCOPE=1).
+export function buildScopedSpawn(req, deps) {
+    if ((deps?.platform ?? process.platform) !== "linux")
+        return null;
+    const env = deps?.env ?? process.env;
+    if ((env.CODEDECK_NO_SCOPE ?? "") === "1")
+        return null;
+    const bin = deps?.systemdRunBin !== undefined ? deps.systemdRunBin : resolveSystemdRunBin();
+    if (!bin)
+        return null;
+    const reachable = deps?.userManagerReachable !== undefined
+        ? deps.userManagerReachable
+        : systemdUserManagerSocket() !== null;
+    if (!reachable)
+        return null;
+    const limits = scopeLimits({ memoryMax: req.memoryMax, swapMax: req.swapMax }, env);
+    const args = [
+        "--user",
+        "--scope",
+        "--quiet",
+        "-p",
+        `MemoryMax=${limits.memoryMax}`,
+        "-p",
+        `MemorySwapMax=${limits.swapMax}`,
+    ];
+    if (req.description)
+        args.push(`--description=${req.description}`);
+    args.push("--", req.cmd, ...req.args);
+    return { cmd: bin, args };
+}
 export function sleep(ms) {
     const { promise, resolve } = Promise.withResolvers();
     setTimeout(resolve, ms);

package/dist/utils/process.js.map

@@ -1 +1 @@
-{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/utils/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAO1C,MAAM,UAAU,KAAK,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,GAAG,cAAc,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/E,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,qEAAqE;AACrE,MAAM,sBAAsB,GAAG,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAC;AAEpF,MAAM,UAAU,iBAAiB;IAC/B,KAAK,MAAM,SAAS,IAAI,sBAAsB,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,EAAU;IAC9B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;IAC3D,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,8DAA8D;QAC9D,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,OAAO,GAAG,IAAI,EAAE,iBAA0B;IACpF,MAAM,qBAAqB,GAAG,GAAY,EAAE;QAC1C,IAAI,iBAAiB,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,iBAAiB,CAAC;IAChE,CAAC,CAAC;IACF,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,MAAM,cAAc,GAAG,GAAY,EAAE,CACnC,qBAAqB,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,CAAC,GAAmB,EAAE,yBAAyB,GAAG,KAAK,EAAW,EAAE;QACjF,IAAI,CAAC,yBAAyB,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxB,IAAI,GAAG,KAAK,SAAS;gBAAE,aAAa,GAAG,IAAI,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,yBAAyB;gBAAE,OAAO,KAAK,CAAC;YAC5C,sEAAsE;YACtE,gEAAgE;YAChE,IAAI,CAAC,qBAAqB,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC3C,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO;IAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU;YAAE,MAAM;QACvC,IAAI,WAAW,IAAI,CAAC,qBAAqB,EAAE;YAAE,MAAM;QACnD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,iBAAiB,KAAK,SAAS,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;SAAM,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,qBAAqB,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,SAAS,CAAC,CAAC;IACpB,CAAC;IACD,uEAAuE;IACvE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvC,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3E,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/utils/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAO1C,MAAM,UAAU,KAAK,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,GAAG,cAAc,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/E,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,qEAAqE;AACrE,MAAM,sBAAsB,GAAG,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAC;AAEpF,MAAM,UAAU,iBAAiB;IAC/B,KAAK,MAAM,SAAS,IAAI,sBAAsB,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,mEAAmE;AACnE,4CAA4C;AAC5C,MAAM,sBAAsB,GAAG,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;AAE5E,MAAM,UAAU,oBAAoB;IAClC,KAAK,MAAM,SAAS,IAAI,sBAAsB,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,wEAAwE;AACxE,2CAA2C;AAC3C,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC;QACH,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,IAAI,GAAG,aAAa,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC;QAC7D,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD,MAAM,UAAU,WAAW,CACzB,SAAoD,EACpD,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,CACX,QAA4B,EAC5B,MAAc,EACd,QAAgB,EAChB,SAAkB,EACV,EAAE;QACV,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC/C,uEAAuE;QACvE,sEAAsE;QACtE,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,KAAK,CAAC;QACpG,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,IAAI,CAAC;KAC5F,CAAC;AACJ,CAAC;AAiBD,8CAA8C;AAC9C,yFAAyF;AACzF,6EAA6E;AAC7E,6EAA6E;AAC7E,sEAAsE;AACtE,6EAA6E;AAC7E,yEAAyE;AACzE,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAC9B,GAAuB,EACvB,IAAsB;IAEtB,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;IAC5F,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,SAAS,GACb,IAAI,EAAE,oBAAoB,KAAK,SAAS;QACtC,CAAC,CAAC,IAAI,CAAC,oBAAoB;QAC3B,CAAC,CAAC,wBAAwB,EAAE,KAAK,IAAI,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG;QACX,QAAQ;QACR,SAAS;QACT,SAAS;QACT,IAAI;QACJ,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,IAAI;QACJ,iBAAiB,MAAM,CAAC,OAAO,EAAE;KAClC,CAAC;IACF,IAAI,GAAG,CAAC,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,EAAU;IAC9B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;IAC3D,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,8DAA8D;QAC9D,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,OAAO,GAAG,IAAI,EAAE,iBAA0B;IACpF,MAAM,qBAAqB,GAAG,GAAY,EAAE;QAC1C,IAAI,iBAAiB,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,iBAAiB,CAAC;IAChE,CAAC,CAAC;IACF,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,MAAM,cAAc,GAAG,GAAY,EAAE,CACnC,qBAAqB,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,CAAC,GAAmB,EAAE,yBAAyB,GAAG,KAAK,EAAW,EAAE;QACjF,IAAI,CAAC,yBAAyB,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxB,IAAI,GAAG,KAAK,SAAS;gBAAE,aAAa,GAAG,IAAI,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,yBAAyB;gBAAE,OAAO,KAAK,CAAC;YAC5C,sEAAsE;YACtE,gEAAgE;YAChE,IAAI,CAAC,qBAAqB,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC3C,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO;IAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU;YAAE,MAAM;QACvC,IAAI,WAAW,IAAI,CAAC,qBAAqB,EAAE;YAAE,MAAM;QACnD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,iBAAiB,KAAK,SAAS,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;SAAM,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,qBAAqB,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,SAAS,CAAC,CAAC;IACpB,CAAC;IACD,uEAAuE;IACvE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvC,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3E,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC"}

package/dist/web/canvas-page.js

@@ -42,12 +42,17 @@ export const CANVAS_PAGE = `<!doctype html>
   .dot.resting { background: #636366; }
   .dot.done { background: #3a3a3c; }
   .dot.failed { background: #ff453a; box-shadow: 0 0 8px rgba(255,69,58,.8); }
-  #feed { left: 16px; top: 112px; width: 300px; }
+  #feed { left: 16px; top: 112px; width: 330px; }
   #feed h2 { font-size: 11px; letter-spacing: .06em; color: #98989f; margin: 0 0 8px; }
-  #feed ul { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 7px; }
-  #feed li { font-size: 12.5px; color: #98989f; display: flex; gap: 8px; animation: feedIn .3s ease-out; }
-  #feed li b { color: #f5f5f7; white-space: nowrap; }
+  #feed ul { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 6px; }
+  #feed li { font-size: 12px; color: #98989f; display: flex; align-items: baseline; gap: 7px; animation: feedIn .3s ease-out; line-height: 1.35; }
+  #feed li b { color: #f5f5f7; white-space: nowrap; font-weight: 600; font-size: 12px; }
   #feed li.fresh { color: #f5f5f7; }
+  #feed li.warn { color: #ff9f0a; }
+  #feed li.bad { color: #ff453a; }
+  #feed .feed-text { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace; font-size: 11.5px; }
+  #feed .feed-count { font-size: 11px; color: #636366; font-weight: 600; margin-left: 2px; white-space: nowrap; flex-shrink: 0; font-family: system-ui, sans-serif; }
+  #feed li.fresh .feed-count { color: #8e8e93; }
   @keyframes feedIn { from { opacity: 0; transform: translateY(-5px); } to { opacity: 1; } }
   #hint { left: 50%; transform: translateX(-50%); bottom: 16px; font-size: 12px; color: #98989f; white-space: nowrap; }
   #detail { position: fixed; top: 0; right: 0; bottom: 0; width: min(400px, 94vw); z-index: 20;
@@ -97,14 +102,15 @@ export const CANVAS_PAGE = `<!doctype html>
   .node:active { cursor: grabbing; }
   .node { transform-origin: 0 0; }
   .node.orch { width: 228px; border-color: rgba(255,255,255,.18); }
-  .node .row { display: flex; align-items: center; gap: 8px; }
+  .node .row { display: flex; align-items: center; gap: 8px; min-width: 0; }
+  .node .row .dot { flex-shrink: 0; }
   .node .logo { width: 22px; height: 22px; display: inline-flex; flex-shrink: 0; }
   .node .logo svg { width: 22px; height: 22px; fill: #f5f5f7; }
   .node.orch .logo { width: 26px; height: 26px; }
   .node.orch .logo svg { width: 26px; height: 26px; }
-  .node .name { font-size: 13.5px; font-weight: 650; }
-  .node .sub { font-size: 12px; color: #98989f; margin-top: 3px; }
-  .node .act { font-size: 12px; color: #98989f; margin-top: 5px; min-height: 15px; }
+  .node .name { font-size: 13.5px; font-weight: 650; flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  .node .sub { font-size: 12px; color: #98989f; margin-top: 3px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  .node .act { font-size: 12px; color: #98989f; margin-top: 5px; min-height: 15px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
   .node .act b { color: #f5f5f7; }
   .node.alert { border-color: rgba(255,159,10,.65); animation: alertPulse 1.6s ease-in-out infinite; }
   @keyframes alertPulse { 0%,100% { border-color: rgba(255,159,10,.65); } 50% { border-color: rgba(255,159,10,1); } }
@@ -176,28 +182,41 @@ function toolHuman(name) {
   if (name === "bash" || name === "Bash") return "terminal";
   return name;
 }
+function shortPath(s) {
+  if (!s || typeof s !== "string") return "";
+  var clean = s.replace(/\\\\/g, "/").replace(/\\/\\/+$/, "");
+  var parts = clean.split("/").filter(Boolean);
+  if (parts.length > 2) return parts.slice(-2).join("/");
+  return parts.join("/") || s;
+}
 /* Pedaco do input real da ferramenta: primeira string interessante, cortada.
    "terminal" sozinho nao diz nada; "podman ps" diz. */
 function inputSnippet(input) {
   if (!input) return "";
   if (typeof input === "string") return clip(input);
   if (typeof input !== "object") return "";
-  var keys = ["command", "cmd", "file", "path", "query", "pattern", "message", "text", "url"];
-  for (var i = 0; i < keys.length; i++) {
-    var v = input[keys[i]];
-    if (typeof v === "string" && v.trim() !== "") return clip(v);
+  if (Array.isArray(input.todos)) return "(" + input.todos.length + " tarefas)";
+  var pathKeys = ["filePath", "file_path", "filename", "file", "path", "target", "dest", "directory", "dir"];
+  for (var p = 0; p < pathKeys.length; p++) {
+    var pv = input[pathKeys[p]];
+    if (typeof pv === "string" && pv.trim() !== "") return clip(shortPath(pv.trim()));
+  }
+  var textKeys = ["command", "cmd", "script", "query", "pattern", "regex", "title", "message", "text", "prompt", "url"];
+  for (var t = 0; t < textKeys.length; t++) {
+    var tv = input[textKeys[t]];
+    if (typeof tv === "string" && tv.trim() !== "") return clip(tv.trim());
   }
   return "";
 }
 function clip(s) {
-  var one = String(s).replace(/\s+/g, " ").trim();
-  return one.length > 42 ? one.slice(0, 42) + "…" : one;
+  var one = String(s).replace(/\\s+/g, " ").trim();
+  return one.length > 40 ? one.slice(0, 40) + "…" : one;
 }
 function toolLabel(tool) {
   var name = (tool && tool.name) || "";
-  var snip = inputSnippet(tool && tool.input);
-  if (!name) return snip || "uma tarefa";
-  if (name === "bash" || name === "Bash") return snip ? '"' + snip + '"' : "terminal";
+  var snip = (tool && tool.title && typeof tool.title === "string") ? clip(tool.title) : inputSnippet(tool && tool.input);
+  if (!name) return snip || "tarefa";
+  if (name === "bash" || name === "Bash") return snip ? "$ " + snip : "terminal";
   return snip ? name + " " + snip : name;
 }
 function timeAgo(iso) {
@@ -317,17 +336,42 @@ function paintNode(n) {
   b.textContent = STATUS_HUMAN[n.status] || "Encerrada";
   n.actEl.appendChild(b);
   n.actEl.appendChild(document.createTextNode(" · " + n.activity));
+  n.actEl.title = (STATUS_HUMAN[n.status] || "") + (n.activity ? " · " + n.activity : "");
   n.el.classList.toggle("orch", !!n.isOrch);
   n.el.classList.toggle("alert", n.status === "needs_input");
   n.el.title = "sessão " + n.id + (n.label ? " · " + n.label : "");
 }
-function feed(agent, text) {
+function feed(agent, text, kind) {
+  if (!text) return;
+  var top = feedList.firstElementChild;
+  if (top && top._agent === agent && top._text === text) {
+    var count = (top._count || 1) + 1;
+    top._count = count;
+    var badge = top.querySelector(".feed-count");
+    if (!badge) {
+      badge = document.createElement("span");
+      badge.className = "feed-count";
+      top.appendChild(badge);
+    }
+    badge.textContent = "×" + count;
+    top.classList.remove("fresh");
+    void top.offsetWidth;
+    top.classList.add("fresh");
+    return;
+  }
   var li = document.createElement("li");
-  li.className = "fresh";
+  li.className = "fresh" + (kind ? " " + kind : "");
+  li._agent = agent;
+  li._text = text;
+  li._count = 1;
+  li.title = agent + ": " + text;
   var b = document.createElement("b");
   b.textContent = agent;
   li.appendChild(b);
-  li.appendChild(document.createTextNode(text));
+  var span = document.createElement("span");
+  span.className = "feed-text";
+  span.textContent = text;
+  li.appendChild(span);
   feedList.insertBefore(li, feedList.firstChild);
   while (feedList.children.length > 6) feedList.removeChild(feedList.lastChild);
   var items = feedList.children;
@@ -563,15 +607,16 @@ function onEvent(n, ev) {
     spawnRing(n, "#0a84ff");
     spawnFlow(n, "#0a84ff", 1);
     touch(n, toolLabel(ev.tool));
-    feed(agentName(n.agent), "começou: " + toolLabel(ev.tool));
+    feed(agentName(n.agent), toolLabel(ev.tool));
   } else if (ev.type === "tool.completed") {
     var bad = ev.tool && ev.tool.success === false;
     touch(n, toolLabel(ev.tool) + (bad ? " (com erro)" : " ✓"));
-    if (bad) feed(agentName(n.agent), "ferramenta falhou");
+    if (bad) feed(agentName(n.agent), "falhou: " + toolLabel(ev.tool), "bad");
   } else if (ev.type === "message") {
     if (ev.role === "assistant") {
       touch(n, "respondendo");
-      feed(agentName(n.agent), String(ev.content || "").slice(0, 90));
+      var textSnippet = clip(ev.content || "");
+      if (textSnippet) feed(agentName(n.agent), textSnippet);
     }
   } else if (ev.type === "message.queued") {
     touch(n, "mensagem na fila");
@@ -580,20 +625,20 @@ function onEvent(n, ev) {
   } else if (ev.type === "turn.started") {
     if (n.id && n.id === detailId && detailPending) { detailPending = null; paintSendState(); }
   } else if (ev.type === "turn.completed") {
-    feed(agentName(n.agent), "etapa concluída");
+    // turn completion is recorded on node activity
   } else if (ev.type === "file.changed") {
-    feed(agentName(n.agent), "mudou " + (ev.path || "um arquivo"));
+    feed(agentName(n.agent), "salvou " + (shortPath(ev.path === "unknown" ? "" : ev.path) || "arquivo"));
   } else if (ev.type === "permission.requested") {
     n.status = "needs_input";
     touch(n, "quer sua aprovação para continuar");
     paintSummary();
     spawnRing(n, "#ff9f0a");
-    feed(agentName(n.agent), "pedindo sua aprovação");
+    feed(agentName(n.agent), "precisa de aprovação", "warn");
   } else if (ev.type === "session.completed" || ev.type === "session.failed") {
     n.status = ev.type === "session.failed" ? "failed" : "completed";
     touch(n, ev.type === "session.failed" ? ("falhou: " + (ev.error || "")) : "concluída");
     paintSummary();
-    feed(agentName(n.agent), ev.type === "session.failed" ? "falhou" : "concluída");
+    feed(agentName(n.agent), ev.type === "session.failed" ? "falhou" : "concluída", ev.type === "session.failed" ? "bad" : "");
     // Stop/release cancels the queue server-side: drop a stale "na fila"
     // hint on the open detail, mirroring the turn.started branch.
     if (n.id && n.id === detailId && detailPending) { detailPending = null; paintSendState(); }
@@ -671,6 +716,7 @@ function frame() {
       if (nodes[i].runId === n.runId && nodes[i].isOrch) { o = nodes[i]; break; }
     }
     if (!o) return;
+    if (hideDone && isDone(o.status)) return;
     var e = edgeCurve(n, o);
     var pa = w2s(e.ax, e.ay), pb = w2s(e.bx, e.by), pc = w2s(e.cx, e.cy);
     ctx.beginPath();
@@ -940,8 +986,8 @@ function selectSession(id) {
     var repo = s.repository ? String(s.repository).split("/").pop() : "";
     var items = [
       ["Modelo", s.model || "—"],
-      // effort so existe quando a sessao nasceu com --effort; ausente = padrao.
-      ["Esforço", s.effort || "padrão"],
+      // effort chega sempre para claude/codex/omp/antigravity; ausente = opencode (ignora) ou sessão legada.
+      ["Esforço", s.effort || "n/a"],
       ["Repo", repo || "—"],
       ["Atividade", s.lastEvent ? (lastEventHuman(s.lastEvent) || s.lastEvent) : "—"],
     ];
@@ -973,14 +1019,14 @@ function selectSession(id) {
       } else if (ev.type === "message" && ev.role === "assistant" && ev.content) {
         chat.appendChild(chatMsg(agentName(s.agent), String(ev.content), "assistant"));
       } else if (ev.type === "tool.started") {
-        chat.appendChild(chatEvt("começou: " + toolLabel(ev.tool)));
+        chat.appendChild(chatEvt(toolLabel(ev.tool)));
       } else if (ev.type === "tool.completed") {
         var bad = ev.tool && ev.tool.success === false;
-        chat.appendChild(chatEvt("terminou: " + toolLabel(ev.tool) + (bad ? " (com erro)" : "")));
+        if (bad) chat.appendChild(chatEvt("falhou: " + toolLabel(ev.tool)));
       } else if (ev.type === "permission.requested") {
-        chat.appendChild(chatEvt("pediu aprovação: " + (ev.tool || "uma ação")));
+        chat.appendChild(chatEvt("precisa de aprovação: " + (ev.tool || "uma ação")));
       } else if (ev.type === "file.changed") {
-        chat.appendChild(chatEvt("mudou " + (ev.path || "um arquivo")));
+        chat.appendChild(chatEvt("salvou " + (shortPath(ev.path === "unknown" ? "" : ev.path) || "arquivo")));
       }
     }
     if (!chat.children.length) {

package/dist/web/canvas-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"canvas-page.js","sourceRoot":"","sources":["../../src/web/canvas-page.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAuiC3B,CAAC"}
+{"version":3,"file":"canvas-page.js","sourceRoot":"","sources":["../../src/web/canvas-page.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAqlC3B,CAAC"}