codex-channel-bgos 0.2.0

package/dist/load-config.d.ts

@@ -0,0 +1,30 @@
+import type { CatalogAgent } from "./catalog-sync.js";
+import type { PluginConfig } from "./types.js";
+export interface LoadedConfig extends PluginConfig {
+    agents?: CatalogAgent[];
+}
+/**
+ * Synchronous, never-throwing read of the pairing secrets written by
+ * `codex-pair-bgos` (`~/.codex-bgos/secrets/bgos.json`). Returns `null` when the
+ * file is missing, unreadable, malformed, or the token is too short.
+ *
+ * Intended for constructors that cannot `await` (e.g. `BgosProactiveClient`),
+ * so the SEPARATE proactive check-in/briefing processes - which do not inherit
+ * the adapter's `CODEX_BGOS_PAIRING_TOKEN` env - can still authenticate off the same
+ * secrets file the long-running adapter uses. Safe to call unconditionally; a
+ * missing file simply yields `null`.
+ */
+export declare function readSecretsSafe(): {
+    pairingToken?: string;
+    baseUrl?: string;
+} | null;
+/**
+ * Load BGOS plugin config from (in order of precedence):
+ *   1. `~/.codex-bgos/secrets/bgos.json` (written by `codex-pair-bgos`)
+ *   2. `BGOS_PAIRING_TOKEN` env var
+ * Plus optional agent catalog from `CODEX_BGOS_AGENTS=route:Name,route:Name,...`.
+ *
+ * Throws if neither secrets file nor env var supplies a valid pairing token.
+ */
+export declare function loadConfig(): LoadedConfig;
+//# sourceMappingURL=load-config.d.ts.map

package/dist/load-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-config.d.ts","sourceRoot":"","sources":["../src/load-config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;CACzB;AAgCD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,IAAI;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,CAMP;AAgBD;;;;;;;GAOG;AACH,wBAAgB,UAAU,IAAI,YAAY,CAazC"}

package/dist/load-config.js

@@ -0,0 +1,86 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { loadConfigFromEnv, loadConfigFromPluginCfg } from "./config.js";
+function resolveCodexBgosHome() {
+    const fromEnv = process.env.CODEX_BGOS_HOME?.trim();
+    if (fromEnv) {
+        if (fromEnv.startsWith("~")) {
+            return join(homedir(), fromEnv.slice(1));
+        }
+        return fromEnv;
+    }
+    return join(homedir(), ".codex-bgos");
+}
+function readSecrets() {
+    const path = join(resolveCodexBgosHome(), "secrets", "bgos.json");
+    try {
+        const raw = readFileSync(path, "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed?.pairingToken && parsed.pairingToken.length >= 20) {
+            return parsed;
+        }
+    }
+    catch {
+        // file missing / unreadable - fall through to env
+    }
+    return null;
+}
+/**
+ * Synchronous, never-throwing read of the pairing secrets written by
+ * `codex-pair-bgos` (`~/.codex-bgos/secrets/bgos.json`). Returns `null` when the
+ * file is missing, unreadable, malformed, or the token is too short.
+ *
+ * Intended for constructors that cannot `await` (e.g. `BgosProactiveClient`),
+ * so the SEPARATE proactive check-in/briefing processes - which do not inherit
+ * the adapter's `CODEX_BGOS_PAIRING_TOKEN` env - can still authenticate off the same
+ * secrets file the long-running adapter uses. Safe to call unconditionally; a
+ * missing file simply yields `null`.
+ */
+export function readSecretsSafe() {
+    try {
+        return readSecrets();
+    }
+    catch {
+        return null;
+    }
+}
+function parseAgents(raw) {
+    if (!raw)
+        return [];
+    return raw
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)
+        .map((entry) => {
+        const [route, name] = entry.split(":").map((p) => p.trim());
+        if (!route)
+            return null;
+        return { route, name: name || route };
+    })
+        .filter((a) => a !== null);
+}
+/**
+ * Load BGOS plugin config from (in order of precedence):
+ *   1. `~/.codex-bgos/secrets/bgos.json` (written by `codex-pair-bgos`)
+ *   2. `BGOS_PAIRING_TOKEN` env var
+ * Plus optional agent catalog from `CODEX_BGOS_AGENTS=route:Name,route:Name,...`.
+ *
+ * Throws if neither secrets file nor env var supplies a valid pairing token.
+ */
+export function loadConfig() {
+    const secrets = readSecrets();
+    let base;
+    if (secrets?.pairingToken) {
+        base = loadConfigFromPluginCfg({
+            pairingToken: secrets.pairingToken,
+            baseUrl: secrets.baseUrl,
+        });
+    }
+    else {
+        base = loadConfigFromEnv();
+    }
+    const agents = parseAgents(process.env.CODEX_BGOS_AGENTS);
+    return { ...base, agents };
+}
+//# sourceMappingURL=load-config.js.map

package/dist/load-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-config.js","sourceRoot":"","sources":["../src/load-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAazE,SAAS,oBAAoB;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,IAAI,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;QAC9C,IAAI,MAAM,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC7D,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe;IAI7B,IAAI,CAAC;QACH,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAuB;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,KAAK,EAAkB,CAAC;IACxD,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,IAAkB,CAAC;IACvB,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;QAC1B,IAAI,GAAG,uBAAuB,CAAC;YAC7B,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,iBAAiB,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC1D,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC"}

package/dist/media-classify.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Outbound attachment classification + intrinsic-dimension sniffing.
+ *
+ * Why this exists: the BGOS backend stores `isImage`/`isVideo`/`isAudio`/
+ * `isDocument` on a message_file VERBATIM - it does NOT derive them from the
+ * MIME type (`row.isImage = dto.isImage ?? null`). The frontend renders a
+ * file as an inline image/video ONLY when the matching flag is `true`;
+ * otherwise it falls back to a generic document card. So an outbound image
+ * sent WITHOUT `isImage: true` silently renders as a non-image download card
+ * (the live "agent images don't show in BGOS" bug, 2026-05-31). Every
+ * outbound attachment must therefore carry these flags.
+ */
+export interface MediaKindFlags {
+    isImage: boolean;
+    isVideo: boolean;
+    isAudio: boolean;
+    isDocument: boolean;
+}
+/** Map a MIME type to BGOS's four mutually-exclusive attachment-kind flags. */
+export declare function classifyMedia(mime: string): MediaKindFlags;
+/** Wrap raw base64 as a data URI. The client feeds inline `fileData` straight
+ *  into `<Image source={{ uri }}>`, which needs a real URI - bare base64
+ *  won't load. (The `/send-message` path also accepts/coerces this; the
+ *  `/messages` path stores it verbatim and renders it directly.) */
+export declare function toInlineDataUri(mime: string, base64: string): string;
+/**
+ * Best-effort intrinsic (width, height) for the common image formats,
+ * dependency-free (no image library). Returns `{}` for anything it can't
+ * parse - width/height are optional (the frontend measures the image when
+ * they're absent), so a miss only costs a brief initial-layout aspect
+ * imprecision. Fully guarded: a malformed header yields `{}`, never throws.
+ */
+export declare function sniffImageDimensions(data: Uint8Array): {
+    width?: number;
+    height?: number;
+};
+//# sourceMappingURL=media-classify.d.ts.map

package/dist/media-classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-classify.d.ts","sourceRoot":"","sources":["../src/media-classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAa1D;AAED;;;oEAGoE;AACpE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,UAAU,GACf;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAqErC"}

package/dist/media-classify.js

@@ -0,0 +1,108 @@
+/**
+ * Outbound attachment classification + intrinsic-dimension sniffing.
+ *
+ * Why this exists: the BGOS backend stores `isImage`/`isVideo`/`isAudio`/
+ * `isDocument` on a message_file VERBATIM - it does NOT derive them from the
+ * MIME type (`row.isImage = dto.isImage ?? null`). The frontend renders a
+ * file as an inline image/video ONLY when the matching flag is `true`;
+ * otherwise it falls back to a generic document card. So an outbound image
+ * sent WITHOUT `isImage: true` silently renders as a non-image download card
+ * (the live "agent images don't show in BGOS" bug, 2026-05-31). Every
+ * outbound attachment must therefore carry these flags.
+ */
+/** Map a MIME type to BGOS's four mutually-exclusive attachment-kind flags. */
+export function classifyMedia(mime) {
+    const m = (mime || "").toLowerCase();
+    const isImage = m.startsWith("image/");
+    const isVideo = m.startsWith("video/");
+    const isAudio = m.startsWith("audio/");
+    return {
+        isImage,
+        isVideo,
+        isAudio,
+        // Anything that isn't recognized media is a document (the download-card
+        // fallback). Mutually exclusive with the three above.
+        isDocument: !(isImage || isVideo || isAudio),
+    };
+}
+/** Wrap raw base64 as a data URI. The client feeds inline `fileData` straight
+ *  into `<Image source={{ uri }}>`, which needs a real URI - bare base64
+ *  won't load. (The `/send-message` path also accepts/coerces this; the
+ *  `/messages` path stores it verbatim and renders it directly.) */
+export function toInlineDataUri(mime, base64) {
+    return `data:${mime};base64,${base64}`;
+}
+/**
+ * Best-effort intrinsic (width, height) for the common image formats,
+ * dependency-free (no image library). Returns `{}` for anything it can't
+ * parse - width/height are optional (the frontend measures the image when
+ * they're absent), so a miss only costs a brief initial-layout aspect
+ * imprecision. Fully guarded: a malformed header yields `{}`, never throws.
+ */
+export function sniffImageDimensions(data) {
+    const b = data;
+    try {
+        const dv = new DataView(b.buffer, b.byteOffset, b.byteLength);
+        // PNG: 8-byte sig, then an IHDR chunk with width/height as big-endian u32.
+        if (b.length >= 24 &&
+            b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47 &&
+            b[12] === 0x49 && b[13] === 0x48 && b[14] === 0x44 && b[15] === 0x52) {
+            return { width: dv.getUint32(16), height: dv.getUint32(20) };
+        }
+        // GIF: 'GIF8' then logical-screen width/height little-endian.
+        if (b.length >= 10 && b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46) {
+            return { width: dv.getUint16(6, true), height: dv.getUint16(8, true) };
+        }
+        // JPEG: scan for a Start-Of-Frame (SOFn) marker carrying dimensions.
+        if (b.length >= 4 && b[0] === 0xff && b[1] === 0xd8) {
+            let i = 2;
+            while (i + 9 < b.length) {
+                if (b[i] !== 0xff) {
+                    i++;
+                    continue;
+                }
+                const marker = b[i + 1];
+                i += 2;
+                // SOF0..SOF15 except DHT(C4)/JPG(C8)/DAC(CC) carry the frame size.
+                if (marker >= 0xc0 && marker <= 0xcf &&
+                    marker !== 0xc4 && marker !== 0xc8 && marker !== 0xcc) {
+                    return { height: dv.getUint16(i + 3), width: dv.getUint16(i + 5) };
+                }
+                if (i + 2 > b.length)
+                    break;
+                i += dv.getUint16(i); // skip this segment
+            }
+            return {};
+        }
+        // WebP (RIFF container): VP8 (lossy) / VP8L (lossless) / VP8X (extended).
+        if (b.length >= 30 &&
+            b[0] === 0x52 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x46 &&
+            b[8] === 0x57 && b[9] === 0x45 && b[10] === 0x42 && b[11] === 0x50) {
+            const fmt = String.fromCharCode(b[12], b[13], b[14], b[15]);
+            if (fmt === "VP8 ") {
+                return {
+                    width: dv.getUint16(26, true) & 0x3fff,
+                    height: dv.getUint16(28, true) & 0x3fff,
+                };
+            }
+            if (fmt === "VP8L") {
+                const b1 = b[21], b2 = b[22], b3 = b[23], b4 = b[24];
+                return {
+                    width: (((b2 & 0x3f) << 8) | b1) + 1,
+                    height: (((b4 & 0x0f) << 10) | (b3 << 2) | ((b2 & 0xc0) >> 6)) + 1,
+                };
+            }
+            if (fmt === "VP8X") {
+                return {
+                    width: (b[24] | (b[25] << 8) | (b[26] << 16)) + 1,
+                    height: (b[27] | (b[28] << 8) | (b[29] << 16)) + 1,
+                };
+            }
+        }
+    }
+    catch {
+        return {};
+    }
+    return {};
+}
+//# sourceMappingURL=media-classify.js.map

package/dist/media-classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-classify.js","sourceRoot":"","sources":["../src/media-classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO;QACL,OAAO;QACP,OAAO;QACP,OAAO;QACP,wEAAwE;QACxE,sDAAsD;QACtD,UAAU,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,IAAI,OAAO,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;;oEAGoE;AACpE,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc;IAC1D,OAAO,QAAQ,IAAI,WAAW,MAAM,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAgB;IAEhB,MAAM,CAAC,GAAG,IAAI,CAAC;IACf,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QAC9D,2EAA2E;QAC3E,IACE,CAAC,CAAC,MAAM,IAAI,EAAE;YACd,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;YAChE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,EACpE,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,8DAA8D;QAC9D,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QACzE,CAAC;QACD,qEAAqE;QACrE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAClB,CAAC,EAAE,CAAC;oBACJ,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAC;gBACP,mEAAmE;gBACnE,IACE,MAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI;oBAChC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EACrD,CAAC;oBACD,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACrE,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM;oBAAE,MAAM;gBAC5B,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;YAC5C,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,0EAA0E;QAC1E,IACE,CAAC,CAAC,MAAM,IAAI,EAAE;YACd,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;YAChE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,EAClE,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,OAAO;oBACL,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,MAAM;oBACtC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,MAAM;iBACxC,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrD,OAAO;oBACL,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC;oBACpC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;iBACnE,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,OAAO;oBACL,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC;oBACjD,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC;iBACnD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/media-guard.d.ts

@@ -0,0 +1,13 @@
+/** Thrown when an outbound file path fails the allowlist. */
+export declare class MediaPathError extends Error {
+    constructor(message: string);
+}
+/**
+ * Validate an agent-supplied outbound file path against the allowlist and
+ * return its resolved, symlink-free real path. Throws `MediaPathError` on
+ * any rejection - the caller MUST NOT publish when this throws.
+ *
+ * @param filePath agent-supplied path (absolute or relative to cwd)
+ */
+export declare function resolveAllowedMediaPath(filePath: string): string;
+//# sourceMappingURL=media-guard.d.ts.map

package/dist/media-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-guard.d.ts","sourceRoot":"","sources":["../src/media-guard.ts"],"names":[],"mappings":"AAkCA,6DAA6D;AAC7D,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAuED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAoDhE"}

package/dist/media-guard.js

@@ -0,0 +1,159 @@
+/**
+ * Outbound media-path guard.
+ *
+ * SECURITY (defense-in-depth): every outbound file send - `sendFile`,
+ * `sendImage`, `sendVideo`, and the structured `uploadFile` - ultimately
+ * hands an agent-supplied `filePath` to `publishMediaPath`, which reads it
+ * off disk and ships its bytes to BGOS. Without a guard, a compromised /
+ * misbehaving agent could exfiltrate ANY file the host process can read
+ * (`/etc/passwd`, `~/.ssh/id_rsa`, app secrets, etc.).
+ *
+ * The BGOS backend is now the sole authority for chat/session resolution,
+ * but it can't see the host filesystem, so the path allowlist has to live
+ * here, at the boundary, before a single byte is read.
+ *
+ * Policy
+ * ------
+ *   - Resolve the requested path to an absolute, symlink-free real path.
+ *   - Reject anything that isn't inside the allowed media root.
+ *   - The allowed root is `CODEX_BGOS_MEDIA_ROOT` (resolved + symlink-free);
+ *     when unset it defaults to `<cwd>/media`, falling back to `<cwd>`
+ *     if `<cwd>/media` doesn't exist - so an out-of-the-box install can
+ *     still send files the agent wrote under the working dir, while a
+ *     hardened deployment can pin a narrow root.
+ *   - Reject obviously-sensitive locations outright even on the off chance
+ *     the root is mis-configured to a parent of them (belt + suspenders).
+ *   - Reject symlinks whose real target escapes the root (handled by
+ *     realpath-ing both sides before the containment check).
+ *
+ * On rejection we throw a clear `MediaPathError`; callers must NOT publish.
+ */
+import { realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, resolve, sep } from "node:path";
+/** Thrown when an outbound file path fails the allowlist. */
+export class MediaPathError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "MediaPathError";
+    }
+}
+/**
+ * Absolute prefixes that are never sendable regardless of the configured
+ * root - a second line of defense in case `CODEX_BGOS_MEDIA_ROOT` is pointed
+ * (mis-configured) at `/` or a home dir. Compared against the resolved
+ * real path, case-sensitively (matches POSIX; the dominant deploy target).
+ */
+const SENSITIVE_PREFIXES = [
+    "/etc",
+    "/proc",
+    "/sys",
+    "/dev",
+    "/root",
+    "/var/run",
+    "/run/secrets",
+    // Common secret-bearing dot-dirs under the host user's home.
+    resolve(homedir(), ".ssh"),
+    resolve(homedir(), ".aws"),
+    resolve(homedir(), ".gnupg"),
+    resolve(homedir(), ".config", "gcloud"),
+    resolve(homedir(), ".kube"),
+    // The plugin's own pairing-token store.
+    resolve(homedir(), ".codex-bgos", "secrets"),
+];
+/**
+ * Resolve the allowed media root.
+ *
+ * `CODEX_BGOS_MEDIA_ROOT` wins when set. Otherwise we prefer `<cwd>/media`
+ * (the conventional drop dir) and fall back to `<cwd>` when that folder
+ * doesn't exist. The returned path is realpath-resolved so symlinked
+ * roots are compared by their true location.
+ */
+function resolveMediaRoot() {
+    const raw = process.env.CODEX_BGOS_MEDIA_ROOT?.trim();
+    if (raw) {
+        return realpathOrResolve(raw);
+    }
+    const cwd = process.cwd();
+    const mediaDir = resolve(cwd, "media");
+    try {
+        // If `<cwd>/media` exists, pin to it (narrower = safer).
+        return realpathSync(mediaDir);
+    }
+    catch {
+        // No media dir - fall back to the working directory itself.
+        return realpathOrResolve(cwd);
+    }
+}
+/** realpath a path if it exists; otherwise return its absolute resolution.
+ *  Used for the ROOT (which may legitimately not exist yet) - the target
+ *  file is realpath'd separately and must exist. */
+function realpathOrResolve(p) {
+    const abs = isAbsolute(p) ? p : resolve(process.cwd(), p);
+    try {
+        return realpathSync(abs);
+    }
+    catch {
+        return abs;
+    }
+}
+/** True when `child` is the same as, or nested under, `parent`. Both must
+ *  already be absolute + normalized. Uses a separator-terminated compare
+ *  so `/a/media` does not match `/a/media-evil`. */
+function isContained(parent, child) {
+    if (child === parent)
+        return true;
+    const withSep = parent.endsWith(sep) ? parent : parent + sep;
+    return child.startsWith(withSep);
+}
+/**
+ * Validate an agent-supplied outbound file path against the allowlist and
+ * return its resolved, symlink-free real path. Throws `MediaPathError` on
+ * any rejection - the caller MUST NOT publish when this throws.
+ *
+ * @param filePath agent-supplied path (absolute or relative to cwd)
+ */
+export function resolveAllowedMediaPath(filePath) {
+    if (typeof filePath !== "string" || filePath.trim() === "") {
+        throw new MediaPathError("outbound file path is empty");
+    }
+    // Cheap pre-check: reject NUL bytes (path-truncation tricks) and any
+    // explicit parent-traversal segment before we touch the filesystem.
+    if (filePath.includes("\0")) {
+        throw new MediaPathError("outbound file path contains a NUL byte");
+    }
+    const requested = isAbsolute(filePath)
+        ? filePath
+        : resolve(process.cwd(), filePath);
+    // realpath the target - this both proves the file exists AND collapses
+    // any `..` segments and symlink hops to the true on-disk location, so a
+    // symlink under the root that points outside it is caught by the
+    // containment check below.
+    let real;
+    try {
+        real = realpathSync(requested);
+    }
+    catch {
+        throw new MediaPathError(`outbound file not found or unreadable: ${filePath}`);
+    }
+    // Hard-deny sensitive locations regardless of root configuration. We
+    // check BOTH the pre-resolution absolute path AND the realpath, because:
+    //   - the realpath catches a symlink that points INTO a sensitive dir;
+    //   - the requested path catches the literal request on platforms where
+    //     the sensitive dir is itself a symlink (e.g. macOS `/etc` ->
+    //     `/private/etc`), which realpath would otherwise rewrite past our
+    //     prefix list.
+    for (const prefix of SENSITIVE_PREFIXES) {
+        if (isContained(prefix, real) || isContained(prefix, requested)) {
+            throw new MediaPathError(`refusing to send file from a sensitive location: ${real}`);
+        }
+    }
+    // Must live under the allowed media root.
+    const root = resolveMediaRoot();
+    if (!isContained(root, real)) {
+        throw new MediaPathError(`outbound file path ${real} is outside the allowed media root ${root} ` +
+            `(set CODEX_BGOS_MEDIA_ROOT to widen it)`);
+    }
+    return real;
+}
+//# sourceMappingURL=media-guard.js.map

package/dist/media-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-guard.js","sourceRoot":"","sources":["../src/media-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErD,6DAA6D;AAC7D,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAsB;IAC5C,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,cAAc;IACd,6DAA6D;IAC7D,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC;IAC5B,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC;IACvC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC;IAC3B,wCAAwC;IACxC,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC;CAC7C,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,gBAAgB;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,yDAAyD;QACzD,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;oDAEoD;AACpD,SAAS,iBAAiB,CAAC,CAAS;IAClC,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;oDAEoD;AACpD,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa;IAChD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;IAC7D,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,cAAc,CAAC,6BAA6B,CAAC,CAAC;IAC1D,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,cAAc,CAAC,wCAAwC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAErC,uEAAuE;IACvE,wEAAwE;IACxE,iEAAiE;IACjE,2BAA2B;IAC3B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CACtB,0CAA0C,QAAQ,EAAE,CACrD,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,kEAAkE;IAClE,uEAAuE;IACvE,mBAAmB;IACnB,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,IAAI,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,cAAc,CACtB,oDAAoD,IAAI,EAAE,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CACtB,sBAAsB,IAAI,sCAAsC,IAAI,GAAG;YACrE,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/outbound-retry.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Classify an outbound send failure (contract C3 outbound).
+ *
+ * Retry (backoff 1s/5s/25s) ONLY for the provably-undelivered network-error
+ * class, because the backend message insert is NOT idempotent:
+ *   - connection-level errors that fail BEFORE the request reaches the server
+ *     (ECONNREFUSED, ENOTFOUND, EAI_AGAIN, EHOSTUNREACH, ENETUNREACH,
+ *     socket-hang-up-before-response)
+ *   - HTTP 429 (honor Retry-After)
+ *
+ * Everything else is AMBIGUOUS (the request may have been applied server-side):
+ * request timeouts (ECONNABORTED) and 5xx get NO retry, and every other 4xx is
+ * a caller error. Ambiguous failures reject to the caller and set a heartbeat
+ * lastError, but are never retried or spooled.
+ */
+export interface OutboundErrorClass {
+    retriable: boolean;
+    /** When set (429 Retry-After), wait exactly this long instead of backoff. */
+    retryAfterMs?: number;
+}
+export declare function classifyOutboundError(err: unknown): OutboundErrorClass;
+/** Backoff schedule for the safe class (contract C3). */
+export declare const OUTBOUND_BACKOFFS_MS: readonly [1000, 5000, 25000];
+//# sourceMappingURL=outbound-retry.d.ts.map

package/dist/outbound-retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-retry.d.ts","sourceRoot":"","sources":["../src/outbound-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAUH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA2BD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAsCtE;AAED,yDAAyD;AACzD,eAAO,MAAM,oBAAoB,8BAA+B,CAAC"}

package/dist/outbound-retry.js

@@ -0,0 +1,75 @@
+/**
+ * Classify an outbound send failure (contract C3 outbound).
+ *
+ * Retry (backoff 1s/5s/25s) ONLY for the provably-undelivered network-error
+ * class, because the backend message insert is NOT idempotent:
+ *   - connection-level errors that fail BEFORE the request reaches the server
+ *     (ECONNREFUSED, ENOTFOUND, EAI_AGAIN, EHOSTUNREACH, ENETUNREACH,
+ *     socket-hang-up-before-response)
+ *   - HTTP 429 (honor Retry-After)
+ *
+ * Everything else is AMBIGUOUS (the request may have been applied server-side):
+ * request timeouts (ECONNABORTED) and 5xx get NO retry, and every other 4xx is
+ * a caller error. Ambiguous failures reject to the caller and set a heartbeat
+ * lastError, but are never retried or spooled.
+ */
+const SAFE_CONNECTION_CODES = new Set([
+    "ECONNREFUSED",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "EHOSTUNREACH",
+    "ENETUNREACH",
+]);
+function parseRetryAfterMs(headers) {
+    if (!headers)
+        return undefined;
+    const raw = headers["retry-after"] ?? headers["Retry-After"];
+    if (raw === undefined || raw === null)
+        return undefined;
+    const s = String(raw).trim();
+    // Numeric seconds form.
+    if (/^\d+$/.test(s)) {
+        return Number(s) * 1000;
+    }
+    // HTTP-date form.
+    const when = Date.parse(s);
+    if (!Number.isNaN(when)) {
+        return Math.max(0, when - Date.now());
+    }
+    return undefined;
+}
+export function classifyOutboundError(err) {
+    const e = (err ?? {});
+    const status = e.response?.status;
+    // HTTP 429, rate limited, safe to retry, honor Retry-After.
+    if (status === 429) {
+        return {
+            retriable: true,
+            retryAfterMs: parseRetryAfterMs(e.response?.headers),
+        };
+    }
+    // Any other HTTP response means the request DID reach the server:
+    // 5xx and other 4xx are ambiguous (do not retry).
+    if (typeof status === "number") {
+        return { retriable: false };
+    }
+    // No HTTP response, connection-level failure.
+    const code = e.code;
+    if (code && SAFE_CONNECTION_CODES.has(code)) {
+        return { retriable: true };
+    }
+    // socket hang up before any response bytes: retriable. A hang-up that
+    // arrives WITH a response is impossible (no status here), so this only
+    // fires pre-response.
+    const message = e.message ?? "";
+    if (code === "ECONNRESET" &&
+        /socket hang up/i.test(message)) {
+        return { retriable: true };
+    }
+    // Request timeout (ECONNABORTED) is AMBIGUOUS: the server may have applied
+    // the write. No retry.
+    return { retriable: false };
+}
+/** Backoff schedule for the safe class (contract C3). */
+export const OUTBOUND_BACKOFFS_MS = [1000, 5000, 25000];
+//# sourceMappingURL=outbound-retry.js.map

package/dist/outbound-retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-retry.js","sourceRoot":"","sources":["../src/outbound-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc;IACd,WAAW;IACX,WAAW;IACX,cAAc;IACd,aAAa;CACd,CAAC,CAAC;AAcH,SAAS,iBAAiB,CAAC,OAA4C;IAGrE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,wBAAwB;IACxB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC1B,CAAC;IACD,kBAAkB;IAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAmB,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC;IAElC,4DAA4D;IAC5D,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO;YACL,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC;SACrD,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,kDAAkD;IAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,8CAA8C;IAC9C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,IAAI,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,sBAAsB;IACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;IAChC,IACE,IAAI,KAAK,YAAY;QACrB,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAC/B,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,2EAA2E;IAC3E,uBAAuB;IACvB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAU,CAAC"}