crewly 1.20.123 → 1.20.124

package/dist/cli/backend/src/services/harness/harness-credentials.store.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Harness credentials store — the harness logins Crewly itself holds.
+ *
+ * Claude Code's `setup-token` prints a long-lived OAuth token instead of
+ * saving it, and an Anthropic API key has to reach agents somehow; both live
+ * here, in `<crewlyHome>/harness-credentials.json` with mode 0600. Codex
+ * writes its own credentials (`$CODEX_HOME/auth.json`), so nothing is stored
+ * for it unless a future flow needs the key.
+ *
+ * {@link harnessEnvForAgents} turns the stored credentials into the env vars
+ * injected into every agent PTY (and adds the user npm prefix to PATH).
+ *
+ * Secrets are never logged, never returned by the REST API and never put in
+ * an error message.
+ *
+ * @module services/harness/harness-credentials.store
+ */
+/** Stored credentials. Every field is optional. */
+export interface HarnessCredentials {
+    claude?: {
+        /** Long-lived token from `claude setup-token` (exported as CLAUDE_CODE_OAUTH_TOKEN) */
+        oauthToken?: string;
+        /** Anthropic API key (exported as ANTHROPIC_API_KEY) */
+        anthropicApiKey?: string;
+        updatedAt?: string;
+    };
+    codex?: {
+        /** OpenAI API key — only kept if a flow needs it (Codex stores its own login) */
+        openaiApiKey?: string;
+        updatedAt?: string;
+    };
+}
+/** Which stored Claude credential is active. */
+export type StoredClaudeCredential = 'oauth_token' | 'api_key' | null;
+/**
+ * Reads and writes `harness-credentials.json`.
+ *
+ * Reads the file on every call (no cache), so the CLI and a running backend
+ * always see each other's writes.
+ */
+export declare class HarnessCredentialsStore {
+    private readonly filePath?;
+    /**
+     * @param filePath - Credentials file; defaults to `<crewlyHome>/harness-credentials.json`
+     *   (resolved per call so `CREWLY_HOME` changes in tests are honoured)
+     */
+    constructor(filePath?: string | undefined);
+    /**
+     * Absolute path of the credentials file.
+     *
+     * @returns The path
+     */
+    getFilePath(): string;
+    /**
+     * Read the stored credentials.
+     *
+     * @returns The credentials; an empty object when the file is missing or unreadable
+     */
+    read(): HarnessCredentials;
+    /**
+     * Write credentials atomically with mode 0600.
+     *
+     * The temp file is created with 0600 before any secret is written to it,
+     * then renamed over the target, and the target is chmod-ed again in case
+     * it pre-existed with a wider mode.
+     *
+     * @param credentials - Full credentials object
+     */
+    write(credentials: HarnessCredentials): void;
+    /**
+     * Store Claude's long-lived OAuth token. Replaces a stored API key, so
+     * agents use exactly the login the owner chose last.
+     *
+     * @param token - Token printed by `claude setup-token`
+     * @throws Error when the token is empty
+     */
+    setClaudeOauthToken(token: string): void;
+    /**
+     * Store an Anthropic API key. Replaces a stored OAuth token.
+     *
+     * @param key - Anthropic API key
+     * @throws Error when the key is empty
+     */
+    setAnthropicApiKey(key: string): void;
+    /**
+     * Store an OpenAI API key (only when a flow needs Crewly to hold it).
+     *
+     * @param key - OpenAI API key
+     * @throws Error when the key is empty
+     */
+    setOpenaiApiKey(key: string): void;
+    /**
+     * Forget the stored Claude credential.
+     */
+    clearClaude(): void;
+    /**
+     * Which Claude credential Crewly holds (never the value).
+     *
+     * @returns `oauth_token`, `api_key` or null
+     */
+    getClaudeCredentialKind(): StoredClaudeCredential;
+    /**
+     * Env vars to inject into agent sessions.
+     *
+     * Always sets PATH (user npm prefix bin first, see harness-exec.utils).
+     * Adds `CLAUDE_CODE_OAUTH_TOKEN` or `ANTHROPIC_API_KEY` when Crewly holds
+     * a Claude credential. Nothing is added for Codex: it reads its own
+     * `auth.json`.
+     *
+     * @param baseEnv - Environment whose PATH is extended (defaults to process.env)
+     * @returns Env map to merge into the agent's spawn env
+     */
+    harnessEnvForAgents(baseEnv?: NodeJS.ProcessEnv): Record<string, string>;
+}
+/**
+ * The default credentials store.
+ *
+ * @returns Store backed by `<crewlyHome>/harness-credentials.json`
+ */
+export declare function getHarnessCredentialsStore(): HarnessCredentialsStore;
+/**
+ * Env vars to inject into agent sessions, from the default store.
+ *
+ * Never throws: a broken credentials file yields just the PATH.
+ *
+ * @param baseEnv - Environment whose PATH is extended (defaults to process.env)
+ * @returns Env map (PATH plus any Claude credential env var)
+ *
+ * @example
+ * ```ts
+ * const env = { ...identityEnv, ...harnessEnvForAgents() };
+ * ```
+ */
+export declare function harnessEnvForAgents(baseEnv?: NodeJS.ProcessEnv): Record<string, string>;
+//# sourceMappingURL=harness-credentials.store.d.ts.map

package/dist/cli/backend/src/services/harness/harness-credentials.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-credentials.store.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-credentials.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE;QACR,uFAAuF;QACvF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,wDAAwD;QACxD,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE;QACP,iFAAiF;QACjF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACF;AAED,gDAAgD;AAChD,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,SAAS,GAAG,IAAI,CAAC;AAYtE;;;;;GAKG;AACH,qBAAa,uBAAuB;IAKvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAJtC;;;OAGG;gBAC0B,QAAQ,CAAC,EAAE,MAAM,YAAA;IAE9C;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;OAIG;IACH,IAAI,IAAI,kBAAkB;IAS1B;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAe5C;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAMxC;;;;;OAKG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMrC;;;;;OAKG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMlC;;OAEG;IACH,WAAW,IAAI,IAAI;IAQnB;;;;OAIG;IACH,uBAAuB,IAAI,sBAAsB;IAOjD;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,OAAO,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAUrF;AAKD;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,uBAAuB,CAEpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMpG"}

package/dist/cli/backend/src/services/harness/harness-credentials.store.js

@@ -0,0 +1,208 @@
+/**
+ * Harness credentials store — the harness logins Crewly itself holds.
+ *
+ * Claude Code's `setup-token` prints a long-lived OAuth token instead of
+ * saving it, and an Anthropic API key has to reach agents somehow; both live
+ * here, in `<crewlyHome>/harness-credentials.json` with mode 0600. Codex
+ * writes its own credentials (`$CODEX_HOME/auth.json`), so nothing is stored
+ * for it unless a future flow needs the key.
+ *
+ * {@link harnessEnvForAgents} turns the stored credentials into the env vars
+ * injected into every agent PTY (and adds the user npm prefix to PATH).
+ *
+ * Secrets are never logged, never returned by the REST API and never put in
+ * an error message.
+ *
+ * @module services/harness/harness-credentials.store
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { HARNESS_CONSTANTS } from '../../constants.js';
+import { getCrewlyHomePath } from '../core/crewly-home.utils.js';
+import { buildHarnessPath } from './harness-exec.utils.js';
+/**
+ * Whether a value is a non-empty string.
+ *
+ * @param value - Candidate
+ * @returns True for a string with non-whitespace content
+ */
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+/**
+ * Reads and writes `harness-credentials.json`.
+ *
+ * Reads the file on every call (no cache), so the CLI and a running backend
+ * always see each other's writes.
+ */
+export class HarnessCredentialsStore {
+    filePath;
+    /**
+     * @param filePath - Credentials file; defaults to `<crewlyHome>/harness-credentials.json`
+     *   (resolved per call so `CREWLY_HOME` changes in tests are honoured)
+     */
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    /**
+     * Absolute path of the credentials file.
+     *
+     * @returns The path
+     */
+    getFilePath() {
+        return this.filePath ?? path.join(getCrewlyHomePath(), HARNESS_CONSTANTS.CREDENTIALS_FILE);
+    }
+    /**
+     * Read the stored credentials.
+     *
+     * @returns The credentials; an empty object when the file is missing or unreadable
+     */
+    read() {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(this.getFilePath(), 'utf-8'));
+            return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+        }
+        catch {
+            return {};
+        }
+    }
+    /**
+     * Write credentials atomically with mode 0600.
+     *
+     * The temp file is created with 0600 before any secret is written to it,
+     * then renamed over the target, and the target is chmod-ed again in case
+     * it pre-existed with a wider mode.
+     *
+     * @param credentials - Full credentials object
+     */
+    write(credentials) {
+        const file = this.getFilePath();
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+        const fd = fs.openSync(tmp, 'w', HARNESS_CONSTANTS.CREDENTIALS_FILE_MODE);
+        try {
+            fs.writeSync(fd, `${JSON.stringify(credentials, null, 2)}\n`);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        fs.chmodSync(tmp, HARNESS_CONSTANTS.CREDENTIALS_FILE_MODE);
+        fs.renameSync(tmp, file);
+        fs.chmodSync(file, HARNESS_CONSTANTS.CREDENTIALS_FILE_MODE);
+    }
+    /**
+     * Store Claude's long-lived OAuth token. Replaces a stored API key, so
+     * agents use exactly the login the owner chose last.
+     *
+     * @param token - Token printed by `claude setup-token`
+     * @throws Error when the token is empty
+     */
+    setClaudeOauthToken(token) {
+        if (!isNonEmptyString(token))
+            throw new Error('Claude OAuth token is empty');
+        const current = this.read();
+        this.write({ ...current, claude: { oauthToken: token.trim(), updatedAt: new Date().toISOString() } });
+    }
+    /**
+     * Store an Anthropic API key. Replaces a stored OAuth token.
+     *
+     * @param key - Anthropic API key
+     * @throws Error when the key is empty
+     */
+    setAnthropicApiKey(key) {
+        if (!isNonEmptyString(key))
+            throw new Error('Anthropic API key is empty');
+        const current = this.read();
+        this.write({ ...current, claude: { anthropicApiKey: key.trim(), updatedAt: new Date().toISOString() } });
+    }
+    /**
+     * Store an OpenAI API key (only when a flow needs Crewly to hold it).
+     *
+     * @param key - OpenAI API key
+     * @throws Error when the key is empty
+     */
+    setOpenaiApiKey(key) {
+        if (!isNonEmptyString(key))
+            throw new Error('OpenAI API key is empty');
+        const current = this.read();
+        this.write({ ...current, codex: { openaiApiKey: key.trim(), updatedAt: new Date().toISOString() } });
+    }
+    /**
+     * Forget the stored Claude credential.
+     */
+    clearClaude() {
+        const current = this.read();
+        if (!current.claude)
+            return;
+        const next = { ...current };
+        delete next.claude;
+        this.write(next);
+    }
+    /**
+     * Which Claude credential Crewly holds (never the value).
+     *
+     * @returns `oauth_token`, `api_key` or null
+     */
+    getClaudeCredentialKind() {
+        const claude = this.read().claude;
+        if (isNonEmptyString(claude?.oauthToken))
+            return 'oauth_token';
+        if (isNonEmptyString(claude?.anthropicApiKey))
+            return 'api_key';
+        return null;
+    }
+    /**
+     * Env vars to inject into agent sessions.
+     *
+     * Always sets PATH (user npm prefix bin first, see harness-exec.utils).
+     * Adds `CLAUDE_CODE_OAUTH_TOKEN` or `ANTHROPIC_API_KEY` when Crewly holds
+     * a Claude credential. Nothing is added for Codex: it reads its own
+     * `auth.json`.
+     *
+     * @param baseEnv - Environment whose PATH is extended (defaults to process.env)
+     * @returns Env map to merge into the agent's spawn env
+     */
+    harnessEnvForAgents(baseEnv = process.env) {
+        const env = { PATH: buildHarnessPath(baseEnv.PATH) };
+        const claude = this.read().claude;
+        if (isNonEmptyString(claude?.oauthToken)) {
+            env[HARNESS_CONSTANTS.CLAUDE.OAUTH_TOKEN_ENV] = claude.oauthToken;
+        }
+        else if (isNonEmptyString(claude?.anthropicApiKey)) {
+            env[HARNESS_CONSTANTS.CLAUDE.API_KEY_ENV] = claude.anthropicApiKey;
+        }
+        return env;
+    }
+}
+/** Process-wide default store (path resolved per call from CREWLY_HOME). */
+const defaultStore = new HarnessCredentialsStore();
+/**
+ * The default credentials store.
+ *
+ * @returns Store backed by `<crewlyHome>/harness-credentials.json`
+ */
+export function getHarnessCredentialsStore() {
+    return defaultStore;
+}
+/**
+ * Env vars to inject into agent sessions, from the default store.
+ *
+ * Never throws: a broken credentials file yields just the PATH.
+ *
+ * @param baseEnv - Environment whose PATH is extended (defaults to process.env)
+ * @returns Env map (PATH plus any Claude credential env var)
+ *
+ * @example
+ * ```ts
+ * const env = { ...identityEnv, ...harnessEnvForAgents() };
+ * ```
+ */
+export function harnessEnvForAgents(baseEnv = process.env) {
+    try {
+        return defaultStore.harnessEnvForAgents(baseEnv);
+    }
+    catch {
+        return { PATH: buildHarnessPath(baseEnv.PATH) };
+    }
+}
+//# sourceMappingURL=harness-credentials.store.js.map

package/dist/cli/backend/src/services/harness/harness-credentials.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-credentials.store.js","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-credentials.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAqB3D;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IAKN;IAJ7B;;;OAGG;IACH,YAA6B,QAAiB;QAAjB,aAAQ,GAAR,QAAQ,CAAS;IAAG,CAAC;IAElD;;;;OAIG;IACH,WAAW;QACV,OAAO,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IAED;;;;OAIG;IACH,IAAI;QACH,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;QACtH,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAA+B;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QACvD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACJ,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACV,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAa;QAChC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACvG,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,GAAW;QAC7B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,GAAW;QAC1B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACtG,CAAC;IAED;;OAEG;IACH,WAAW;QACV,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO;QAC5B,MAAM,IAAI,GAAuB,EAAE,GAAG,OAAO,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,uBAAuB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;QAClC,IAAI,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC;YAAE,OAAO,aAAa,CAAC;QAC/D,IAAI,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC;YAAE,OAAO,SAAS,CAAC;QAChE,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,UAA6B,OAAO,CAAC,GAAG;QAC3D,MAAM,GAAG,GAA2B,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;QAClC,IAAI,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QACnE,CAAC;aAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QACpE,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;CACD;AAED,4EAA4E;AAC5E,MAAM,YAAY,GAAG,IAAI,uBAAuB,EAAE,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B;IACzC,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA6B,OAAO,CAAC,GAAG;IAC3E,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACjD,CAAC;AACF,CAAC"}

package/dist/cli/backend/src/services/harness/harness-exec.utils.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Process helpers for harness onboarding: the PATH every harness process gets
+ * and a shell-free command runner.
+ *
+ * PATH: when `npm install -g` hits EACCES, Crewly installs the harness under a
+ * user-owned prefix (`<crewlyHome>/npm-global`). Its `bin` dir is prepended to
+ * PATH for everything Crewly spawns — status probes, the login broker and agent
+ * sessions — so a harness installed there is found without touching the
+ * user's shell profile. Claude Code's native installer dir (`~/.local/bin`) is
+ * appended when missing, because a backend started by launchd/systemd often
+ * lacks it.
+ *
+ * @module services/harness/harness-exec.utils
+ */
+import type { RunCommand } from './harness.types.js';
+/**
+ * The user-owned npm prefix used when a global install is not permitted.
+ *
+ * @returns Absolute path, e.g. `~/.crewly/npm-global`
+ */
+export declare function getUserNpmPrefix(): string;
+/**
+ * The bin directory of the user-owned npm prefix.
+ *
+ * @returns Absolute path, e.g. `~/.crewly/npm-global/bin`
+ */
+export declare function getUserNpmBinDir(): string;
+/**
+ * Build the PATH value harness processes run with.
+ *
+ * Prepends the user npm prefix bin dir and appends `~/.local/bin`, each only
+ * when not already present. Order of the existing entries is preserved.
+ *
+ * @param currentPath - Existing PATH (may be undefined)
+ * @param homeDir - Home directory (injectable for tests)
+ * @returns The PATH string
+ *
+ * @example
+ * ```ts
+ * buildHarnessPath('/usr/bin', '/home/me');
+ * // '/home/me/.crewly/npm-global/bin:/usr/bin:/home/me/.local/bin'
+ * ```
+ */
+export declare function buildHarnessPath(currentPath: string | undefined, homeDir?: string): string;
+/**
+ * PATH for running `npm`: the harness PATH plus the directory of the running
+ * Node binary, where npm lives in nvm / installer layouts. A backend started
+ * by launchd or systemd often has neither on its PATH.
+ *
+ * @param currentPath - Existing PATH
+ * @param homeDir - Home directory (injectable for tests)
+ * @param nodeBinDir - Directory of the Node binary (injectable for tests)
+ * @returns The PATH string
+ */
+export declare function buildNpmPath(currentPath: string | undefined, homeDir?: string, nodeBinDir?: string): string;
+/**
+ * Copy an environment with PATH set to {@link buildHarnessPath}.
+ *
+ * @param env - Source environment (defaults to process.env)
+ * @returns A new environment object
+ */
+export declare function withHarnessPath(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Find an executable on a PATH, like `which`.
+ *
+ * @param command - Bare command name (or an absolute path, returned when executable)
+ * @param envPath - PATH to search
+ * @param isExecutable - Executable check (injectable for tests)
+ * @returns Absolute path, or null when not found
+ */
+export declare function resolveExecutable(command: string, envPath: string | undefined, isExecutable?: (file: string) => boolean): string | null;
+/**
+ * Run a command without a shell and collect its output.
+ *
+ * Never rejects: a spawn failure (ENOENT) or timeout comes back as
+ * `{ code: null, error }`. Secrets must go through `options.stdin`, never
+ * through `args`, so they cannot appear in `ps` output.
+ *
+ * @param command - Executable
+ * @param args - Arguments
+ * @param options - env, timeout, stdin, streaming output callback
+ * @returns Exit code and output
+ */
+export declare const runCommand: RunCommand;
+//# sourceMappingURL=harness-exec.utils.d.ts.map

package/dist/cli/backend/src/services/harness/harness-exec.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-exec.utils.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-exec.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,OAAO,KAAK,EAAiB,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AAEvF;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,GAAE,MAAqB,GAAG,MAAM,CAOxG;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,GAAE,MAAqB,EAC9B,UAAU,GAAE,MAAuC,GACjD,MAAM,CAGR;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAEvF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,YAAY,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAA6B,GAC3D,MAAM,GAAG,IAAI,CAUf;AAiBD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,EAAE,UAsDtB,CAAC"}

package/dist/cli/backend/src/services/harness/harness-exec.utils.js

@@ -0,0 +1,183 @@
+/**
+ * Process helpers for harness onboarding: the PATH every harness process gets
+ * and a shell-free command runner.
+ *
+ * PATH: when `npm install -g` hits EACCES, Crewly installs the harness under a
+ * user-owned prefix (`<crewlyHome>/npm-global`). Its `bin` dir is prepended to
+ * PATH for everything Crewly spawns — status probes, the login broker and agent
+ * sessions — so a harness installed there is found without touching the
+ * user's shell profile. Claude Code's native installer dir (`~/.local/bin`) is
+ * appended when missing, because a backend started by launchd/systemd often
+ * lacks it.
+ *
+ * @module services/harness/harness-exec.utils
+ */
+import { spawn } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { HARNESS_CONSTANTS } from '../../constants.js';
+import { getCrewlyHomePath } from '../core/crewly-home.utils.js';
+/**
+ * The user-owned npm prefix used when a global install is not permitted.
+ *
+ * @returns Absolute path, e.g. `~/.crewly/npm-global`
+ */
+export function getUserNpmPrefix() {
+    return path.join(getCrewlyHomePath(), HARNESS_CONSTANTS.USER_NPM_PREFIX_DIR);
+}
+/**
+ * The bin directory of the user-owned npm prefix.
+ *
+ * @returns Absolute path, e.g. `~/.crewly/npm-global/bin`
+ */
+export function getUserNpmBinDir() {
+    return path.join(getUserNpmPrefix(), 'bin');
+}
+/**
+ * Build the PATH value harness processes run with.
+ *
+ * Prepends the user npm prefix bin dir and appends `~/.local/bin`, each only
+ * when not already present. Order of the existing entries is preserved.
+ *
+ * @param currentPath - Existing PATH (may be undefined)
+ * @param homeDir - Home directory (injectable for tests)
+ * @returns The PATH string
+ *
+ * @example
+ * ```ts
+ * buildHarnessPath('/usr/bin', '/home/me');
+ * // '/home/me/.crewly/npm-global/bin:/usr/bin:/home/me/.local/bin'
+ * ```
+ */
+export function buildHarnessPath(currentPath, homeDir = os.homedir()) {
+    const entries = (currentPath ?? '').split(path.delimiter).filter((entry) => entry.length > 0);
+    const npmBin = getUserNpmBinDir();
+    const nativeBin = path.join(homeDir, HARNESS_CONSTANTS.NATIVE_INSTALLER_BIN_DIR);
+    const result = entries.includes(npmBin) ? [...entries] : [npmBin, ...entries];
+    if (!result.includes(nativeBin))
+        result.push(nativeBin);
+    return result.join(path.delimiter);
+}
+/**
+ * PATH for running `npm`: the harness PATH plus the directory of the running
+ * Node binary, where npm lives in nvm / installer layouts. A backend started
+ * by launchd or systemd often has neither on its PATH.
+ *
+ * @param currentPath - Existing PATH
+ * @param homeDir - Home directory (injectable for tests)
+ * @param nodeBinDir - Directory of the Node binary (injectable for tests)
+ * @returns The PATH string
+ */
+export function buildNpmPath(currentPath, homeDir = os.homedir(), nodeBinDir = path.dirname(process.execPath)) {
+    const harnessPath = buildHarnessPath(currentPath, homeDir);
+    return harnessPath.split(path.delimiter).includes(nodeBinDir) ? harnessPath : `${harnessPath}${path.delimiter}${nodeBinDir}`;
+}
+/**
+ * Copy an environment with PATH set to {@link buildHarnessPath}.
+ *
+ * @param env - Source environment (defaults to process.env)
+ * @returns A new environment object
+ */
+export function withHarnessPath(env = process.env) {
+    return { ...env, PATH: buildHarnessPath(env.PATH) };
+}
+/**
+ * Find an executable on a PATH, like `which`.
+ *
+ * @param command - Bare command name (or an absolute path, returned when executable)
+ * @param envPath - PATH to search
+ * @param isExecutable - Executable check (injectable for tests)
+ * @returns Absolute path, or null when not found
+ */
+export function resolveExecutable(command, envPath, isExecutable = defaultIsExecutable) {
+    if (command.includes(path.sep)) {
+        return isExecutable(command) ? command : null;
+    }
+    for (const dir of (envPath ?? '').split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = path.join(dir, command);
+        if (isExecutable(candidate))
+            return candidate;
+    }
+    return null;
+}
+/**
+ * Whether a file exists and is executable by this user.
+ *
+ * @param file - Absolute path
+ * @returns True when executable
+ */
+function defaultIsExecutable(file) {
+    try {
+        fs.accessSync(file, fs.constants.X_OK);
+        return fs.statSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Run a command without a shell and collect its output.
+ *
+ * Never rejects: a spawn failure (ENOENT) or timeout comes back as
+ * `{ code: null, error }`. Secrets must go through `options.stdin`, never
+ * through `args`, so they cannot appear in `ps` output.
+ *
+ * @param command - Executable
+ * @param args - Arguments
+ * @param options - env, timeout, stdin, streaming output callback
+ * @returns Exit code and output
+ */
+export const runCommand = (command, args, options = {}) => new Promise((resolve) => {
+    let stdout = '';
+    let stderr = '';
+    let settled = false;
+    let timer = null;
+    const finish = (result) => {
+        if (settled)
+            return;
+        settled = true;
+        if (timer)
+            clearTimeout(timer);
+        resolve(result);
+    };
+    let child;
+    try {
+        child = spawn(command, [...args], {
+            env: options.env ?? process.env,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+    }
+    catch (error) {
+        resolve({ code: null, stdout: '', stderr: '', error: error instanceof Error ? error.message : String(error) });
+        return;
+    }
+    if (options.timeoutMs) {
+        timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            finish({ code: null, stdout, stderr, error: `timed out after ${options.timeoutMs} ms` });
+        }, options.timeoutMs);
+    }
+    child.stdout?.on('data', (chunk) => {
+        const text = chunk.toString();
+        stdout += text;
+        options.onOutput?.(text);
+    });
+    child.stderr?.on('data', (chunk) => {
+        const text = chunk.toString();
+        stderr += text;
+        options.onOutput?.(text);
+    });
+    child.on('error', (error) => finish({ code: null, stdout, stderr, error: error.message }));
+    child.on('close', (code) => finish({ code, stdout, stderr }));
+    child.stdin?.on('error', () => undefined);
+    if (options.stdin !== undefined) {
+        child.stdin?.end(options.stdin);
+    }
+    else {
+        child.stdin?.end();
+    }
+});
+//# sourceMappingURL=harness-exec.utils.js.map

package/dist/cli/backend/src/services/harness/harness-exec.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-exec.utils.js","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-exec.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAGjE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA+B,EAAE,UAAkB,EAAE,CAAC,OAAO,EAAE;IAC/F,MAAM,OAAO,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC3B,WAA+B,EAC/B,UAAkB,EAAE,CAAC,OAAO,EAAE,EAC9B,aAAqB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEnD,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,IAAI,CAAC,SAAS,GAAG,UAAU,EAAE,CAAC;AAC9H,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,OAAO,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAChC,OAAe,EACf,OAA2B,EAC3B,eAA0C,mBAAmB;IAE7D,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,YAAY,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACxC,IAAI,CAAC;QACJ,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,UAAU,GAAe,CACrC,OAAe,EACf,IAAuB,EACvB,UAA6B,EAAE,EACN,EAAE,CAC3B,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACvB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAA0B,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAQ,EAAE;QAC9C,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC,CAAC;IAEF,IAAI,KAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YAC/B,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAC/B,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/G,OAAO;IACR,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACvB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;QAC1F,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,IAAI,CAAC;QACf,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,IAAI,CAAC;QACf,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3F,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAE9D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACP,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACpB,CAAC;AACF,CAAC,CAAC,CAAC"}