crewly 1.20.122 → 1.20.124

package/dist/backend/backend/src/services/harness/harness-api-key.service.js

@@ -0,0 +1,157 @@
+/**
+ * API-key login for harnesses.
+ *
+ * - Claude Code: the Anthropic key is checked against the Anthropic API (a
+ *   401/403 rejects it; a network problem does not block saving a
+ *   well-formed key), stored in the harness credentials store and exported
+ *   to agents as `ANTHROPIC_API_KEY`. Claude's config is updated so the key
+ *   is pre-approved (claude-config.utils).
+ * - Codex: `codex login --with-api-key` with the key on **stdin** (never in
+ *   argv); Codex saves it in its own `auth.json`.
+ *
+ * The key is never logged, echoed back or put in an error message.
+ *
+ * @module services/harness/harness-api-key.service
+ */
+import { HARNESS_CONSTANTS } from '../../constants.js';
+import { prepareClaudeConfigForCrewlyLogin } from './claude-config.utils.js';
+import { getHarnessCredentialsStore } from './harness-credentials.store.js';
+import { buildHarnessPath, resolveExecutable, runCommand } from './harness-exec.utils.js';
+import { getHarnessDefinition, getLoginMethod } from './harness-registry.js';
+import { SILENT_HARNESS_LOGGER } from './harness.types.js';
+import { redactSecrets } from './login-rules.js';
+/** API-key login error. The message never contains the key. */
+export class HarnessApiKeyError extends Error {
+    code;
+    /**
+     * @param code - Machine-readable code
+     * @param message - Human-readable message
+     */
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'HarnessApiKeyError';
+    }
+}
+/**
+ * Basic shape check shared by every provider.
+ *
+ * @param key - Candidate key (already trimmed)
+ * @returns True when the length is plausible and it has no whitespace
+ */
+export function isPlausibleApiKey(key) {
+    return key.length >= HARNESS_CONSTANTS.API_KEY_MIN_LENGTH && key.length <= HARNESS_CONSTANTS.API_KEY_MAX_LENGTH && !/\s/.test(key);
+}
+/** Validates and stores harness API keys. */
+export class HarnessApiKeyService {
+    run;
+    fetchFn;
+    env;
+    credentials;
+    resolveCommand;
+    prepareClaudeConfig;
+    logger;
+    /**
+     * @param deps - Injectable dependencies (all optional)
+     */
+    constructor(deps = {}) {
+        this.run = deps.run ?? runCommand;
+        this.fetchFn = deps.fetchFn ?? ((url, init) => fetch(url, init));
+        this.env = deps.env ?? process.env;
+        this.credentials = deps.credentials ?? getHarnessCredentialsStore();
+        this.resolveCommand = deps.resolveCommand ?? ((command) => resolveExecutable(command, buildHarnessPath(this.env.PATH)));
+        this.prepareClaudeConfig = deps.prepareClaudeConfig ?? ((apiKey) => void prepareClaudeConfigForCrewlyLogin({ apiKey }));
+        this.logger = deps.logger ?? SILENT_HARNESS_LOGGER;
+    }
+    /**
+     * Validate and store an API key for a harness.
+     *
+     * @param harnessId - Harness id
+     * @param rawKey - The key as pasted
+     * @throws HarnessApiKeyError unknown_harness | unsupported | invalid_key | not_installed | login_failed
+     */
+    async submit(harnessId, rawKey) {
+        const def = getHarnessDefinition(harnessId);
+        if (!def)
+            throw new HarnessApiKeyError('unknown_harness', `Unknown harness: ${harnessId}`);
+        if (!getLoginMethod(def.id, 'api_key')) {
+            throw new HarnessApiKeyError('unsupported', `${def.displayName} does not take an API key in Crewly`);
+        }
+        const key = typeof rawKey === 'string' ? rawKey.trim() : '';
+        if (!isPlausibleApiKey(key)) {
+            throw new HarnessApiKeyError('invalid_key', 'That does not look like an API key');
+        }
+        if (def.id === HARNESS_CONSTANTS.IDS.CLAUDE_CODE) {
+            await this.submitAnthropicKey(key);
+            return;
+        }
+        await this.submitCodexKey(key);
+    }
+    /**
+     * Check an Anthropic key against the API.
+     *
+     * @param key - The key
+     * @returns valid | invalid | unverified (network error, unexpected status)
+     */
+    async checkAnthropicKey(key) {
+        try {
+            const response = await this.fetchFn(HARNESS_CONSTANTS.CLAUDE.API_KEY_CHECK_URL, {
+                method: 'GET',
+                headers: { 'x-api-key': key, 'anthropic-version': HARNESS_CONSTANTS.CLAUDE.API_VERSION },
+                signal: AbortSignal.timeout(HARNESS_CONSTANTS.CLAUDE.API_KEY_CHECK_TIMEOUT_MS),
+            });
+            if (response.status >= 200 && response.status < 300)
+                return 'valid';
+            if (response.status === 401 || response.status === 403)
+                return 'invalid';
+            return 'unverified';
+        }
+        catch {
+            return 'unverified';
+        }
+    }
+    /**
+     * Validate and store an Anthropic key.
+     *
+     * @param key - The key
+     * @throws HarnessApiKeyError invalid_key
+     */
+    async submitAnthropicKey(key) {
+        if (!key.startsWith(HARNESS_CONSTANTS.CLAUDE.API_KEY_PREFIX)) {
+            throw new HarnessApiKeyError('invalid_key', `Anthropic API keys start with ${HARNESS_CONSTANTS.CLAUDE.API_KEY_PREFIX}`);
+        }
+        const check = await this.checkAnthropicKey(key);
+        if (check === 'invalid')
+            throw new HarnessApiKeyError('invalid_key', 'Anthropic rejected this API key');
+        this.credentials.setAnthropicApiKey(key);
+        try {
+            this.prepareClaudeConfig(key);
+        }
+        catch (error) {
+            this.logger.warn('Could not update Claude config after API key login', { error: error instanceof Error ? error.message : String(error) });
+        }
+        this.logger.info('Anthropic API key stored', { verified: check === 'valid' });
+    }
+    /**
+     * Log Codex in with an OpenAI key (key on stdin).
+     *
+     * @param key - The key
+     * @throws HarnessApiKeyError not_installed | login_failed
+     */
+    async submitCodexKey(key) {
+        const binary = this.resolveCommand('codex');
+        if (!binary)
+            throw new HarnessApiKeyError('not_installed', 'Codex is not installed');
+        const result = await this.run(binary, ['login', '--with-api-key'], {
+            env: { ...this.env, PATH: buildHarnessPath(this.env.PATH) },
+            stdin: `${key}\n`,
+            timeoutMs: HARNESS_CONSTANTS.LOGIN.VERIFY_TIMEOUT_MS,
+        });
+        if (result.code !== 0) {
+            const detail = redactSecrets(`${result.stdout}\n${result.stderr}\n${result.error ?? ''}`, [key]).trim();
+            throw new HarnessApiKeyError('login_failed', detail ? `Codex did not accept the key: ${detail}` : 'Codex did not accept the key');
+        }
+        this.logger.info('Codex logged in with an API key');
+    }
+}
+//# sourceMappingURL=harness-api-key.service.js.map

package/dist/backend/backend/src/services/harness/harness-api-key.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-api-key.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-api-key.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAA2B,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAuC,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAKjD,+DAA+D;AAC/D,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAM3B;IALjB;;;OAGG;IACH,YACiB,IAA4B,EAC5C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAwB;QAI5C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IAClC,CAAC;CACD;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpI,CAAC;AAED,6CAA6C;AAC7C,MAAM,OAAO,oBAAoB;IACf,GAAG,CAAa;IAChB,OAAO,CAAY;IACnB,GAAG,CAAoB;IACvB,WAAW,CAA0B;IACrC,cAAc,CAAqC;IACnD,mBAAmB,CAA2B;IAC9C,MAAM,CAAgB;IAEvC;;OAEG;IACH,YAAY,OAA0B,EAAE;QACvC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,0BAA0B,EAAE,CAAC;QACpE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxH,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,iCAAiC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACxH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,MAAe;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,oBAAoB,SAAS,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,GAAG,GAAG,CAAC,WAAW,qCAAqC,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACnC,OAAO;QACR,CAAC;QACD,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAAW;QAClC,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,iBAAiB,EAAE;gBAC/E,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,MAAM,CAAC,WAAW,EAAE;gBACxF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,wBAAwB,CAAC;aAC9E,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,OAAO,CAAC;YACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAC;YACzE,OAAO,YAAY,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,YAAY,CAAC;QACrB,CAAC;IACF,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAW;QAC3C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,iCAAiC,iBAAiB,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;QACzH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,iCAAiC,CAAC,CAAC;QACxG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC;YACJ,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3I,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAC,GAAW;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE;YAClE,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YAC3D,KAAK,EAAE,GAAG,GAAG,IAAI;YACjB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,iBAAiB;SACpD,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxG,MAAM,IAAI,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;QACnI,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;CACD"}

package/dist/backend/backend/src/services/harness/harness-credentials.store.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Harness credentials store — the harness logins Crewly itself holds.
+ *
+ * Claude Code's `setup-token` prints a long-lived OAuth token instead of
+ * saving it, and an Anthropic API key has to reach agents somehow; both live
+ * here, in `<crewlyHome>/harness-credentials.json` with mode 0600. Codex
+ * writes its own credentials (`$CODEX_HOME/auth.json`), so nothing is stored
+ * for it unless a future flow needs the key.
+ *
+ * {@link harnessEnvForAgents} turns the stored credentials into the env vars
+ * injected into every agent PTY (and adds the user npm prefix to PATH).
+ *
+ * Secrets are never logged, never returned by the REST API and never put in
+ * an error message.
+ *
+ * @module services/harness/harness-credentials.store
+ */
+/** Stored credentials. Every field is optional. */
+export interface HarnessCredentials {
+    claude?: {
+        /** Long-lived token from `claude setup-token` (exported as CLAUDE_CODE_OAUTH_TOKEN) */
+        oauthToken?: string;
+        /** Anthropic API key (exported as ANTHROPIC_API_KEY) */
+        anthropicApiKey?: string;
+        updatedAt?: string;
+    };
+    codex?: {
+        /** OpenAI API key — only kept if a flow needs it (Codex stores its own login) */
+        openaiApiKey?: string;
+        updatedAt?: string;
+    };
+}
+/** Which stored Claude credential is active. */
+export type StoredClaudeCredential = 'oauth_token' | 'api_key' | null;
+/**
+ * Reads and writes `harness-credentials.json`.
+ *
+ * Reads the file on every call (no cache), so the CLI and a running backend
+ * always see each other's writes.
+ */
+export declare class HarnessCredentialsStore {
+    private readonly filePath?;
+    /**
+     * @param filePath - Credentials file; defaults to `<crewlyHome>/harness-credentials.json`
+     *   (resolved per call so `CREWLY_HOME` changes in tests are honoured)
+     */
+    constructor(filePath?: string | undefined);
+    /**
+     * Absolute path of the credentials file.
+     *
+     * @returns The path
+     */
+    getFilePath(): string;
+    /**
+     * Read the stored credentials.
+     *
+     * @returns The credentials; an empty object when the file is missing or unreadable
+     */
+    read(): HarnessCredentials;
+    /**
+     * Write credentials atomically with mode 0600.
+     *
+     * The temp file is created with 0600 before any secret is written to it,
+     * then renamed over the target, and the target is chmod-ed again in case
+     * it pre-existed with a wider mode.
+     *
+     * @param credentials - Full credentials object
+     */
+    write(credentials: HarnessCredentials): void;
+    /**
+     * Store Claude's long-lived OAuth token. Replaces a stored API key, so
+     * agents use exactly the login the owner chose last.
+     *
+     * @param token - Token printed by `claude setup-token`
+     * @throws Error when the token is empty
+     */
+    setClaudeOauthToken(token: string): void;
+    /**
+     * Store an Anthropic API key. Replaces a stored OAuth token.
+     *
+     * @param key - Anthropic API key
+     * @throws Error when the key is empty
+     */
+    setAnthropicApiKey(key: string): void;
+    /**
+     * Store an OpenAI API key (only when a flow needs Crewly to hold it).
+     *
+     * @param key - OpenAI API key
+     * @throws Error when the key is empty
+     */
+    setOpenaiApiKey(key: string): void;
+    /**
+     * Forget the stored Claude credential.
+     */
+    clearClaude(): void;
+    /**
+     * Which Claude credential Crewly holds (never the value).
+     *
+     * @returns `oauth_token`, `api_key` or null
+     */
+    getClaudeCredentialKind(): StoredClaudeCredential;
+    /**
+     * Env vars to inject into agent sessions.
+     *
+     * Always sets PATH (user npm prefix bin first, see harness-exec.utils).
+     * Adds `CLAUDE_CODE_OAUTH_TOKEN` or `ANTHROPIC_API_KEY` when Crewly holds
+     * a Claude credential. Nothing is added for Codex: it reads its own
+     * `auth.json`.
+     *
+     * @param baseEnv - Environment whose PATH is extended (defaults to process.env)
+     * @returns Env map to merge into the agent's spawn env
+     */
+    harnessEnvForAgents(baseEnv?: NodeJS.ProcessEnv): Record<string, string>;
+}
+/**
+ * The default credentials store.
+ *
+ * @returns Store backed by `<crewlyHome>/harness-credentials.json`
+ */
+export declare function getHarnessCredentialsStore(): HarnessCredentialsStore;
+/**
+ * Env vars to inject into agent sessions, from the default store.
+ *
+ * Never throws: a broken credentials file yields just the PATH.
+ *
+ * @param baseEnv - Environment whose PATH is extended (defaults to process.env)
+ * @returns Env map (PATH plus any Claude credential env var)
+ *
+ * @example
+ * ```ts
+ * const env = { ...identityEnv, ...harnessEnvForAgents() };
+ * ```
+ */
+export declare function harnessEnvForAgents(baseEnv?: NodeJS.ProcessEnv): Record<string, string>;
+//# sourceMappingURL=harness-credentials.store.d.ts.map

package/dist/backend/backend/src/services/harness/harness-credentials.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-credentials.store.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-credentials.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE;QACR,uFAAuF;QACvF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,wDAAwD;QACxD,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE;QACP,iFAAiF;QACjF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACF;AAED,gDAAgD;AAChD,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,SAAS,GAAG,IAAI,CAAC;AAYtE;;;;;GAKG;AACH,qBAAa,uBAAuB;IAKvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAJtC;;;OAGG;gBAC0B,QAAQ,CAAC,EAAE,MAAM,YAAA;IAE9C;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;OAIG;IACH,IAAI,IAAI,kBAAkB;IAS1B;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAe5C;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAMxC;;;;;OAKG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMrC;;;;;OAKG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMlC;;OAEG;IACH,WAAW,IAAI,IAAI;IAQnB;;;;OAIG;IACH,uBAAuB,IAAI,sBAAsB;IAOjD;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,OAAO,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAUrF;AAKD;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,uBAAuB,CAEpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMpG"}

package/dist/backend/backend/src/services/harness/harness-credentials.store.js

@@ -0,0 +1,208 @@
+/**
+ * Harness credentials store — the harness logins Crewly itself holds.
+ *
+ * Claude Code's `setup-token` prints a long-lived OAuth token instead of
+ * saving it, and an Anthropic API key has to reach agents somehow; both live
+ * here, in `<crewlyHome>/harness-credentials.json` with mode 0600. Codex
+ * writes its own credentials (`$CODEX_HOME/auth.json`), so nothing is stored
+ * for it unless a future flow needs the key.
+ *
+ * {@link harnessEnvForAgents} turns the stored credentials into the env vars
+ * injected into every agent PTY (and adds the user npm prefix to PATH).
+ *
+ * Secrets are never logged, never returned by the REST API and never put in
+ * an error message.
+ *
+ * @module services/harness/harness-credentials.store
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { HARNESS_CONSTANTS } from '../../constants.js';
+import { getCrewlyHomePath } from '../core/crewly-home.utils.js';
+import { buildHarnessPath } from './harness-exec.utils.js';
+/**
+ * Whether a value is a non-empty string.
+ *
+ * @param value - Candidate
+ * @returns True for a string with non-whitespace content
+ */
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+/**
+ * Reads and writes `harness-credentials.json`.
+ *
+ * Reads the file on every call (no cache), so the CLI and a running backend
+ * always see each other's writes.
+ */
+export class HarnessCredentialsStore {
+    filePath;
+    /**
+     * @param filePath - Credentials file; defaults to `<crewlyHome>/harness-credentials.json`
+     *   (resolved per call so `CREWLY_HOME` changes in tests are honoured)
+     */
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    /**
+     * Absolute path of the credentials file.
+     *
+     * @returns The path
+     */
+    getFilePath() {
+        return this.filePath ?? path.join(getCrewlyHomePath(), HARNESS_CONSTANTS.CREDENTIALS_FILE);
+    }
+    /**
+     * Read the stored credentials.
+     *
+     * @returns The credentials; an empty object when the file is missing or unreadable
+     */
+    read() {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(this.getFilePath(), 'utf-8'));
+            return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+        }
+        catch {
+            return {};
+        }
+    }
+    /**
+     * Write credentials atomically with mode 0600.
+     *
+     * The temp file is created with 0600 before any secret is written to it,
+     * then renamed over the target, and the target is chmod-ed again in case
+     * it pre-existed with a wider mode.
+     *
+     * @param credentials - Full credentials object
+     */
+    write(credentials) {
+        const file = this.getFilePath();
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+        const fd = fs.openSync(tmp, 'w', HARNESS_CONSTANTS.CREDENTIALS_FILE_MODE);
+        try {
+            fs.writeSync(fd, `${JSON.stringify(credentials, null, 2)}\n`);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        fs.chmodSync(tmp, HARNESS_CONSTANTS.CREDENTIALS_FILE_MODE);
+        fs.renameSync(tmp, file);
+        fs.chmodSync(file, HARNESS_CONSTANTS.CREDENTIALS_FILE_MODE);
+    }
+    /**
+     * Store Claude's long-lived OAuth token. Replaces a stored API key, so
+     * agents use exactly the login the owner chose last.
+     *
+     * @param token - Token printed by `claude setup-token`
+     * @throws Error when the token is empty
+     */
+    setClaudeOauthToken(token) {
+        if (!isNonEmptyString(token))
+            throw new Error('Claude OAuth token is empty');
+        const current = this.read();
+        this.write({ ...current, claude: { oauthToken: token.trim(), updatedAt: new Date().toISOString() } });
+    }
+    /**
+     * Store an Anthropic API key. Replaces a stored OAuth token.
+     *
+     * @param key - Anthropic API key
+     * @throws Error when the key is empty
+     */
+    setAnthropicApiKey(key) {
+        if (!isNonEmptyString(key))
+            throw new Error('Anthropic API key is empty');
+        const current = this.read();
+        this.write({ ...current, claude: { anthropicApiKey: key.trim(), updatedAt: new Date().toISOString() } });
+    }
+    /**
+     * Store an OpenAI API key (only when a flow needs Crewly to hold it).
+     *
+     * @param key - OpenAI API key
+     * @throws Error when the key is empty
+     */
+    setOpenaiApiKey(key) {
+        if (!isNonEmptyString(key))
+            throw new Error('OpenAI API key is empty');
+        const current = this.read();
+        this.write({ ...current, codex: { openaiApiKey: key.trim(), updatedAt: new Date().toISOString() } });
+    }
+    /**
+     * Forget the stored Claude credential.
+     */
+    clearClaude() {
+        const current = this.read();
+        if (!current.claude)
+            return;
+        const next = { ...current };
+        delete next.claude;
+        this.write(next);
+    }
+    /**
+     * Which Claude credential Crewly holds (never the value).
+     *
+     * @returns `oauth_token`, `api_key` or null
+     */
+    getClaudeCredentialKind() {
+        const claude = this.read().claude;
+        if (isNonEmptyString(claude?.oauthToken))
+            return 'oauth_token';
+        if (isNonEmptyString(claude?.anthropicApiKey))
+            return 'api_key';
+        return null;
+    }
+    /**
+     * Env vars to inject into agent sessions.
+     *
+     * Always sets PATH (user npm prefix bin first, see harness-exec.utils).
+     * Adds `CLAUDE_CODE_OAUTH_TOKEN` or `ANTHROPIC_API_KEY` when Crewly holds
+     * a Claude credential. Nothing is added for Codex: it reads its own
+     * `auth.json`.
+     *
+     * @param baseEnv - Environment whose PATH is extended (defaults to process.env)
+     * @returns Env map to merge into the agent's spawn env
+     */
+    harnessEnvForAgents(baseEnv = process.env) {
+        const env = { PATH: buildHarnessPath(baseEnv.PATH) };
+        const claude = this.read().claude;
+        if (isNonEmptyString(claude?.oauthToken)) {
+            env[HARNESS_CONSTANTS.CLAUDE.OAUTH_TOKEN_ENV] = claude.oauthToken;
+        }
+        else if (isNonEmptyString(claude?.anthropicApiKey)) {
+            env[HARNESS_CONSTANTS.CLAUDE.API_KEY_ENV] = claude.anthropicApiKey;
+        }
+        return env;
+    }
+}
+/** Process-wide default store (path resolved per call from CREWLY_HOME). */
+const defaultStore = new HarnessCredentialsStore();
+/**
+ * The default credentials store.
+ *
+ * @returns Store backed by `<crewlyHome>/harness-credentials.json`
+ */
+export function getHarnessCredentialsStore() {
+    return defaultStore;
+}
+/**
+ * Env vars to inject into agent sessions, from the default store.
+ *
+ * Never throws: a broken credentials file yields just the PATH.
+ *
+ * @param baseEnv - Environment whose PATH is extended (defaults to process.env)
+ * @returns Env map (PATH plus any Claude credential env var)
+ *
+ * @example
+ * ```ts
+ * const env = { ...identityEnv, ...harnessEnvForAgents() };
+ * ```
+ */
+export function harnessEnvForAgents(baseEnv = process.env) {
+    try {
+        return defaultStore.harnessEnvForAgents(baseEnv);
+    }
+    catch {
+        return { PATH: buildHarnessPath(baseEnv.PATH) };
+    }
+}
+//# sourceMappingURL=harness-credentials.store.js.map

package/dist/backend/backend/src/services/harness/harness-credentials.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-credentials.store.js","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-credentials.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAqB3D;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IAKN;IAJ7B;;;OAGG;IACH,YAA6B,QAAiB;QAAjB,aAAQ,GAAR,QAAQ,CAAS;IAAG,CAAC;IAElD;;;;OAIG;IACH,WAAW;QACV,OAAO,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IAED;;;;OAIG;IACH,IAAI;QACH,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;QACtH,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAA+B;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QACvD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACJ,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACV,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAa;QAChC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACvG,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,GAAW;QAC7B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,GAAW;QAC1B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACtG,CAAC;IAED;;OAEG;IACH,WAAW;QACV,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO;QAC5B,MAAM,IAAI,GAAuB,EAAE,GAAG,OAAO,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,uBAAuB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;QAClC,IAAI,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC;YAAE,OAAO,aAAa,CAAC;QAC/D,IAAI,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC;YAAE,OAAO,SAAS,CAAC;QAChE,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,UAA6B,OAAO,CAAC,GAAG;QAC3D,MAAM,GAAG,GAA2B,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;QAClC,IAAI,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QACnE,CAAC;aAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QACpE,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;CACD;AAED,4EAA4E;AAC5E,MAAM,YAAY,GAAG,IAAI,uBAAuB,EAAE,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B;IACzC,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA6B,OAAO,CAAC,GAAG;IAC3E,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACjD,CAAC;AACF,CAAC"}

package/dist/backend/backend/src/services/harness/harness-exec.utils.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Process helpers for harness onboarding: the PATH every harness process gets
+ * and a shell-free command runner.
+ *
+ * PATH: when `npm install -g` hits EACCES, Crewly installs the harness under a
+ * user-owned prefix (`<crewlyHome>/npm-global`). Its `bin` dir is prepended to
+ * PATH for everything Crewly spawns — status probes, the login broker and agent
+ * sessions — so a harness installed there is found without touching the
+ * user's shell profile. Claude Code's native installer dir (`~/.local/bin`) is
+ * appended when missing, because a backend started by launchd/systemd often
+ * lacks it.
+ *
+ * @module services/harness/harness-exec.utils
+ */
+import type { RunCommand } from './harness.types.js';
+/**
+ * The user-owned npm prefix used when a global install is not permitted.
+ *
+ * @returns Absolute path, e.g. `~/.crewly/npm-global`
+ */
+export declare function getUserNpmPrefix(): string;
+/**
+ * The bin directory of the user-owned npm prefix.
+ *
+ * @returns Absolute path, e.g. `~/.crewly/npm-global/bin`
+ */
+export declare function getUserNpmBinDir(): string;
+/**
+ * Build the PATH value harness processes run with.
+ *
+ * Prepends the user npm prefix bin dir and appends `~/.local/bin`, each only
+ * when not already present. Order of the existing entries is preserved.
+ *
+ * @param currentPath - Existing PATH (may be undefined)
+ * @param homeDir - Home directory (injectable for tests)
+ * @returns The PATH string
+ *
+ * @example
+ * ```ts
+ * buildHarnessPath('/usr/bin', '/home/me');
+ * // '/home/me/.crewly/npm-global/bin:/usr/bin:/home/me/.local/bin'
+ * ```
+ */
+export declare function buildHarnessPath(currentPath: string | undefined, homeDir?: string): string;
+/**
+ * PATH for running `npm`: the harness PATH plus the directory of the running
+ * Node binary, where npm lives in nvm / installer layouts. A backend started
+ * by launchd or systemd often has neither on its PATH.
+ *
+ * @param currentPath - Existing PATH
+ * @param homeDir - Home directory (injectable for tests)
+ * @param nodeBinDir - Directory of the Node binary (injectable for tests)
+ * @returns The PATH string
+ */
+export declare function buildNpmPath(currentPath: string | undefined, homeDir?: string, nodeBinDir?: string): string;
+/**
+ * Copy an environment with PATH set to {@link buildHarnessPath}.
+ *
+ * @param env - Source environment (defaults to process.env)
+ * @returns A new environment object
+ */
+export declare function withHarnessPath(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Find an executable on a PATH, like `which`.
+ *
+ * @param command - Bare command name (or an absolute path, returned when executable)
+ * @param envPath - PATH to search
+ * @param isExecutable - Executable check (injectable for tests)
+ * @returns Absolute path, or null when not found
+ */
+export declare function resolveExecutable(command: string, envPath: string | undefined, isExecutable?: (file: string) => boolean): string | null;
+/**
+ * Run a command without a shell and collect its output.
+ *
+ * Never rejects: a spawn failure (ENOENT) or timeout comes back as
+ * `{ code: null, error }`. Secrets must go through `options.stdin`, never
+ * through `args`, so they cannot appear in `ps` output.
+ *
+ * @param command - Executable
+ * @param args - Arguments
+ * @param options - env, timeout, stdin, streaming output callback
+ * @returns Exit code and output
+ */
+export declare const runCommand: RunCommand;
+//# sourceMappingURL=harness-exec.utils.d.ts.map

package/dist/backend/backend/src/services/harness/harness-exec.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-exec.utils.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-exec.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,OAAO,KAAK,EAAiB,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AAEvF;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,GAAE,MAAqB,GAAG,MAAM,CAOxG;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,GAAE,MAAqB,EAC9B,UAAU,GAAE,MAAuC,GACjD,MAAM,CAGR;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAEvF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,YAAY,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAA6B,GAC3D,MAAM,GAAG,IAAI,CAUf;AAiBD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,EAAE,UAsDtB,CAAC"}