crewly 1.20.195 → 1.20.196

package/dist/backend/backend/src/services/core/peer-process.service.d.ts

@@ -0,0 +1,168 @@
+/**
+ * Which local process is on the other end of a TCP connection, and does it
+ * belong to an agent? (#999, specs/2026-10-03-owner-auth.md §4)
+ *
+ * Agents run as the owner's OS user, so they can read `~/.crewly/api-token`
+ * and could ask for a dashboard session over loopback. File permissions
+ * cannot stop that. What does distinguish an agent is how it was started:
+ * every agent process descends from this backend (PTY shells, crewly-agent
+ * children, Codex daemons started from a PTY), runs on an agent PTY's
+ * terminal, or carries an agent's environment. The owner's browser, terminal,
+ * Vite dev server and Electron app have none of these.
+ *
+ * For a connection from this host, this service finds the client process
+ * (`lsof`, or `ss` on Linux) and checks those signals against one `ps`
+ * snapshot (the environment signal is Linux-only: macOS does not expose
+ * another process's environment). A lookup that cannot run (tool missing)
+ * or times out answers `unknown`, and the caller fails open with a warning
+ * (residual risk 3 in the spec). A lookup that ran but found no client
+ * process — it exited first, which an agent can arrange by writing the
+ * request over a raw socket — answers `gone`, and the caller fails CLOSED.
+ *
+ * A determined process can still shed all three signals (double-fork,
+ * `setsid`, `env -i`). That is the same-OS-user limit the spec documents.
+ *
+ * @module services/core/peer-process.service
+ */
+import * as os from 'os';
+/** One row of the process table. */
+export interface PeerProcessEntry {
+    ppid: number;
+    /** Controlling terminal (`??` / `?` when none) */
+    tty: string;
+}
+/** The verdict on a connection's client process. */
+export type PeerVerdict = {
+    kind: 'remote';
+} | {
+    kind: 'self';
+} | {
+    kind: 'agent';
+    pid: number;
+    signal: 'ancestry' | 'tty' | 'env';
+    session: string | null;
+} | {
+    kind: 'not-agent';
+    pid: number;
+}
+/**
+ * The lookup ran but the client process is not there (it exited before it
+ * could be looked up, or no socket matched). Fails CLOSED: an agent can
+ * write a request over a raw socket and exit at once (#1010 review).
+ */
+ | {
+    kind: 'gone';
+    reason: string;
+}
+/** The lookup could not run: the tool is missing or it timed out. Fails open. */
+ | {
+    kind: 'unknown';
+    reason: string;
+};
+/** The parts of a socket the lookup needs. */
+export interface PeerSocketLike {
+    remoteAddress?: string;
+    remotePort?: number;
+    localPort?: number;
+}
+/** Injectable collaborators (tests). */
+export interface PeerProcessDeps {
+    /** Pid of the client end of `clientPort → serverPort`, or null */
+    findPeerPid?: (clientPort: number, serverPort: number) => Promise<number | null>;
+    /** pid → {ppid, tty} for every process */
+    readTable?: () => Promise<Map<number, PeerProcessEntry>>;
+    /** The environment of a process, or null when unreadable */
+    readEnv?: (pid: number) => Promise<Record<string, string> | null>;
+    /** PTY shell pid → session name for the live agent sessions */
+    listSessionPids?: () => Map<number, string>;
+    /** This backend's pid */
+    selfPid?: number;
+    /** Whether an address belongs to this host */
+    isHostAddress?: (address: string) => boolean;
+    /** Lookup budget */
+    timeoutMs?: number;
+}
+/**
+ * Whether an address belongs to this host: loopback, or any of its own
+ * interface addresses (an agent can connect to the machine's LAN IP too).
+ *
+ * @param address - Remote address of a connection
+ * @param interfaces - `os.networkInterfaces()` (tests)
+ * @returns True for a connection from this machine
+ */
+export declare function isHostAddress(address: string, interfaces?: NodeJS.Dict<os.NetworkInterfaceInfo[]>): boolean;
+/**
+ * Parse `lsof -nP -iTCP:<port> -Fpn` output: the pid whose socket's LOCAL
+ * end is `clientPort` and remote end is `serverPort`.
+ *
+ * @param output - lsof field output (`p<pid>` / `n<a>:<p>-><b>:<q>` lines)
+ * @param clientPort - The client's ephemeral port
+ * @param serverPort - This backend's port
+ * @returns The client pid, or null
+ */
+export declare function parseLsofPeer(output: string, clientPort: number, serverPort: number): number | null;
+/**
+ * Parse `ss -Htnp '( sport = :<clientPort> )'` output: the first pid listed
+ * for a connection to `serverPort`.
+ *
+ * @param output - ss output
+ * @param serverPort - This backend's port
+ * @returns The client pid, or null
+ */
+export declare function parseSsPeer(output: string, serverPort: number): number | null;
+/**
+ * Parse `ps -Ao pid=,ppid=,tty=` output.
+ *
+ * @param output - ps output
+ * @returns pid → entry
+ */
+export declare function parsePsTable(output: string): Map<number, PeerProcessEntry>;
+/**
+ * Decide whether a process is an agent's, from a process-table snapshot.
+ *
+ * @param pid - The client process
+ * @param table - pid → {ppid, tty}
+ * @param selfPid - This backend's pid
+ * @param sessionPids - PTY shell pid → session name
+ * @returns `agent` with the signal that matched, or null
+ */
+export declare function agentSignalFromTable(pid: number, table: ReadonlyMap<number, PeerProcessEntry>, selfPid: number, sessionPids: ReadonlyMap<number, string>): {
+    signal: 'ancestry' | 'tty';
+    session: string | null;
+} | null;
+/**
+ * Whether a lookup error means "could not look" (fail open) rather than
+ * "looked and it is not there" (fail closed): the tool is missing, or it
+ * was killed for running past its budget.
+ *
+ * @param error - The error
+ * @returns True for a missing tool or a timeout
+ */
+export declare function isLookupUnavailable(error: unknown): boolean;
+/**
+ * Classifies the client process of local connections, once per socket.
+ */
+export declare class PeerProcessService {
+    private readonly cache;
+    private readonly deps;
+    /**
+     * @param deps - Injectable collaborators
+     */
+    constructor(deps?: PeerProcessDeps);
+    /**
+     * Classify the client of a connection. Cached per socket object (a
+     * keep-alive dashboard or CLI pays for one lookup).
+     *
+     * @param socket - The request's socket
+     * @returns The verdict
+     */
+    classify(socket: PeerSocketLike | null | undefined): Promise<PeerVerdict>;
+    /**
+     * Uncached classification.
+     *
+     * @param socket - The request's socket
+     * @returns The verdict
+     */
+    private lookup;
+}
+//# sourceMappingURL=peer-process.service.d.ts.map

package/dist/backend/backend/src/services/core/peer-process.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"peer-process.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/peer-process.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAGzB,oCAAoC;AACpC,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,oDAAoD;AACpD,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,KAAK,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1F;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACpC;;;;GAIG;GACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAClC,iFAAiF;GAC/E;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACjF,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACzD,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAClE,+DAA+D;IAC/D,eAAe,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,yBAAyB;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,oBAAoB;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAYD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAA0B,GAAG,OAAO,CAUnI;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYnG;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS7E;AAyBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAO1E;AA8BD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5C,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACvC;IAAE,MAAM,EAAE,UAAU,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAqB/D;AA4BD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI3D;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+C;IACrE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IAEjD;;OAEG;gBACS,IAAI,GAAE,eAAoB;IAatC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IASzE;;;;;OAKG;YACW,MAAM;CAmCrB"}

package/dist/backend/backend/src/services/core/peer-process.service.js

@@ -0,0 +1,352 @@
+/**
+ * Which local process is on the other end of a TCP connection, and does it
+ * belong to an agent? (#999, specs/2026-10-03-owner-auth.md §4)
+ *
+ * Agents run as the owner's OS user, so they can read `~/.crewly/api-token`
+ * and could ask for a dashboard session over loopback. File permissions
+ * cannot stop that. What does distinguish an agent is how it was started:
+ * every agent process descends from this backend (PTY shells, crewly-agent
+ * children, Codex daemons started from a PTY), runs on an agent PTY's
+ * terminal, or carries an agent's environment. The owner's browser, terminal,
+ * Vite dev server and Electron app have none of these.
+ *
+ * For a connection from this host, this service finds the client process
+ * (`lsof`, or `ss` on Linux) and checks those signals against one `ps`
+ * snapshot (the environment signal is Linux-only: macOS does not expose
+ * another process's environment). A lookup that cannot run (tool missing)
+ * or times out answers `unknown`, and the caller fails open with a warning
+ * (residual risk 3 in the spec). A lookup that ran but found no client
+ * process — it exited first, which an agent can arrange by writing the
+ * request over a raw socket — answers `gone`, and the caller fails CLOSED.
+ *
+ * A determined process can still shed all three signals (double-fork,
+ * `setsid`, `env -i`). That is the same-OS-user limit the spec documents.
+ *
+ * @module services/core/peer-process.service
+ */
+import { execFile } from 'child_process';
+import { promises as fsp } from 'fs';
+import * as os from 'os';
+import { OWNER_AUTH_CONSTANTS, API_SECURITY_CONSTANTS } from '../../constants.js';
+/**
+ * Normalise an address for comparison (`::ffff:1.2.3.4` → `1.2.3.4`).
+ *
+ * @param address - Address string
+ * @returns Normalised address
+ */
+function normaliseAddress(address) {
+    return address.startsWith('::ffff:') ? address.slice('::ffff:'.length) : address;
+}
+/**
+ * Whether an address belongs to this host: loopback, or any of its own
+ * interface addresses (an agent can connect to the machine's LAN IP too).
+ *
+ * @param address - Remote address of a connection
+ * @param interfaces - `os.networkInterfaces()` (tests)
+ * @returns True for a connection from this machine
+ */
+export function isHostAddress(address, interfaces = os.networkInterfaces()) {
+    if (!address)
+        return false;
+    if (API_SECURITY_CONSTANTS.LOOPBACK_ADDRESSES.includes(address))
+        return true;
+    const target = normaliseAddress(address);
+    for (const entries of Object.values(interfaces)) {
+        for (const entry of entries ?? []) {
+            if (normaliseAddress(entry.address) === target)
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Run a command, resolving stdout ('' on a non-zero exit with no output).
+ *
+ * @param cmd - Executable
+ * @param args - Arguments
+ * @param timeoutMs - Budget
+ * @returns stdout
+ */
+function run(cmd, args, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        execFile(cmd, args, { timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024 }, (error, stdout) => {
+            // lsof exits 1 when nothing matched: that is an answer, not a failure.
+            if (error && !(stdout && stdout.length > 0) && error.code !== 1) {
+                reject(error);
+                return;
+            }
+            resolve(stdout ?? '');
+        });
+    });
+}
+/**
+ * Parse `lsof -nP -iTCP:<port> -Fpn` output: the pid whose socket's LOCAL
+ * end is `clientPort` and remote end is `serverPort`.
+ *
+ * @param output - lsof field output (`p<pid>` / `n<a>:<p>-><b>:<q>` lines)
+ * @param clientPort - The client's ephemeral port
+ * @param serverPort - This backend's port
+ * @returns The client pid, or null
+ */
+export function parseLsofPeer(output, clientPort, serverPort) {
+    let pid = null;
+    const re = new RegExp(`:${clientPort}->.*:${serverPort}$`);
+    for (const line of output.split('\n')) {
+        if (line.startsWith('p')) {
+            const n = Number(line.slice(1));
+            pid = Number.isInteger(n) && n > 0 ? n : null;
+        }
+        else if (line.startsWith('n') && pid !== null && re.test(line.slice(1).trim())) {
+            return pid;
+        }
+    }
+    return null;
+}
+/**
+ * Parse `ss -Htnp '( sport = :<clientPort> )'` output: the first pid listed
+ * for a connection to `serverPort`.
+ *
+ * @param output - ss output
+ * @param serverPort - This backend's port
+ * @returns The client pid, or null
+ */
+export function parseSsPeer(output, serverPort) {
+    for (const line of output.split('\n')) {
+        const cols = line.trim().split(/\s+/);
+        if (cols.length < 5)
+            continue;
+        if (!cols.some((c, i) => i >= 3 && new RegExp(`:${serverPort}$`).test(c)))
+            continue;
+        const m = /pid=(\d+)/.exec(line);
+        if (m)
+            return Number(m[1]);
+    }
+    return null;
+}
+/**
+ * Find the client pid of a connection with the platform's tools.
+ *
+ * @param clientPort - Client's ephemeral port (the connection's remotePort)
+ * @param serverPort - This backend's port (the connection's localPort)
+ * @param timeoutMs - Budget
+ * @returns pid or null
+ */
+async function defaultFindPeerPid(clientPort, serverPort, timeoutMs) {
+    if (process.platform === 'linux') {
+        let output = null;
+        try {
+            output = await run('ss', ['-Htnp', `( sport = :${clientPort} )`], timeoutMs);
+        }
+        catch {
+            output = null; // ss unusable: fall through to lsof
+        }
+        // ss ran: its answer stands, including "nothing" (falling through to a
+        // missing lsof would turn "not found" into "could not look").
+        if (output !== null)
+            return parseSsPeer(output, serverPort);
+    }
+    return parseLsofPeer(await run('lsof', ['-nP', `-iTCP:${clientPort}`, '-Fpn'], timeoutMs), clientPort, serverPort);
+}
+/**
+ * Parse `ps -Ao pid=,ppid=,tty=` output.
+ *
+ * @param output - ps output
+ * @returns pid → entry
+ */
+export function parsePsTable(output) {
+    const table = new Map();
+    for (const line of output.split('\n')) {
+        const m = /^\s*(\d+)\s+(\d+)\s+(\S+)/.exec(line);
+        if (m)
+            table.set(Number(m[1]), { ppid: Number(m[2]), tty: m[3] ?? '?' });
+    }
+    return table;
+}
+/**
+ * Read another process's environment (same user) — Linux only, from
+ * `/proc/<pid>/environ`. macOS does not expose another process's
+ * environment (`ps -E` prints none, checked on macOS 15), so there the
+ * ancestry and terminal signals carry the check.
+ *
+ * @param pid - Process
+ * @returns The variables this check cares about, or null when unreadable
+ */
+async function defaultReadEnv(pid) {
+    if (process.platform !== 'linux')
+        return null;
+    const wanted = ['CREWLY_SESSION_NAME', OWNER_AUTH_CONSTANTS.AGENT_BADGE_ENV];
+    const out = {};
+    try {
+        const raw = await fsp.readFile(`/proc/${pid}/environ`, 'utf8');
+        for (const pair of raw.split('\0')) {
+            const eq = pair.indexOf('=');
+            if (eq > 0 && wanted.includes(pair.slice(0, eq)))
+                out[pair.slice(0, eq)] = pair.slice(eq + 1);
+        }
+        return out;
+    }
+    catch {
+        return null;
+    }
+}
+/** Terminal names that mean "no controlling terminal". */
+const NO_TTY = new Set(['?', '??', '-', '']);
+/**
+ * Decide whether a process is an agent's, from a process-table snapshot.
+ *
+ * @param pid - The client process
+ * @param table - pid → {ppid, tty}
+ * @param selfPid - This backend's pid
+ * @param sessionPids - PTY shell pid → session name
+ * @returns `agent` with the signal that matched, or null
+ */
+export function agentSignalFromTable(pid, table, selfPid, sessionPids) {
+    // 1. Ancestry: anything the backend spawned (directly or not) is an agent's.
+    let current = pid;
+    let session = null;
+    const seen = new Set();
+    for (let depth = 0; depth < OWNER_AUTH_CONSTANTS.PEER_MAX_ANCESTRY_DEPTH && current > 1 && !seen.has(current); depth++) {
+        seen.add(current);
+        session ??= sessionPids.get(current) ?? null;
+        const entry = table.get(current);
+        if (!entry)
+            break;
+        if (entry.ppid === selfPid)
+            return { signal: 'ancestry', session };
+        current = entry.ppid;
+    }
+    // 2. Terminal: a process orphaned out of an agent's shell keeps its PTY.
+    const tty = table.get(pid)?.tty ?? '';
+    if (!NO_TTY.has(tty)) {
+        for (const [shellPid, name] of sessionPids) {
+            if (table.get(shellPid)?.tty === tty)
+                return { signal: 'tty', session: name };
+        }
+    }
+    return null;
+}
+/** Thrown when a lookup takes longer than its budget. */
+class LookupTimeoutError extends Error {
+}
+/**
+ * Reject with {@link LookupTimeoutError} if the work takes longer than `ms`.
+ *
+ * @param promise - Work
+ * @param ms - Budget
+ * @returns The work's result
+ */
+function withTimeout(promise, ms) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new LookupTimeoutError('timed out')), ms);
+        promise.then((v) => {
+            clearTimeout(timer);
+            resolve(v);
+        }, (e) => {
+            clearTimeout(timer);
+            reject(e);
+        });
+    });
+}
+/**
+ * Whether a lookup error means "could not look" (fail open) rather than
+ * "looked and it is not there" (fail closed): the tool is missing, or it
+ * was killed for running past its budget.
+ *
+ * @param error - The error
+ * @returns True for a missing tool or a timeout
+ */
+export function isLookupUnavailable(error) {
+    if (error instanceof LookupTimeoutError)
+        return true;
+    const e = error;
+    return Boolean(e && (e.code === 'ENOENT' || e.killed === true));
+}
+/**
+ * Classifies the client process of local connections, once per socket.
+ */
+export class PeerProcessService {
+    cache = new WeakMap();
+    deps;
+    /**
+     * @param deps - Injectable collaborators
+     */
+    constructor(deps = {}) {
+        const timeoutMs = deps.timeoutMs ?? OWNER_AUTH_CONSTANTS.PEER_LOOKUP_TIMEOUT_MS;
+        this.deps = {
+            findPeerPid: deps.findPeerPid ?? ((c, s) => defaultFindPeerPid(c, s, timeoutMs)),
+            readTable: deps.readTable ?? (async () => parsePsTable(await run('ps', ['-Ao', 'pid=,ppid=,tty='], timeoutMs))),
+            readEnv: deps.readEnv ?? ((pid) => defaultReadEnv(pid)),
+            listSessionPids: deps.listSessionPids ?? (() => new Map()),
+            selfPid: deps.selfPid ?? process.pid,
+            isHostAddress: deps.isHostAddress ?? ((a) => isHostAddress(a)),
+            timeoutMs,
+        };
+    }
+    /**
+     * Classify the client of a connection. Cached per socket object (a
+     * keep-alive dashboard or CLI pays for one lookup).
+     *
+     * @param socket - The request's socket
+     * @returns The verdict
+     */
+    classify(socket) {
+        if (!socket)
+            return Promise.resolve({ kind: 'gone', reason: 'no socket' });
+        const hit = this.cache.get(socket);
+        if (hit)
+            return hit;
+        const verdict = this.lookup(socket);
+        this.cache.set(socket, verdict);
+        return verdict;
+    }
+    /**
+     * Uncached classification.
+     *
+     * @param socket - The request's socket
+     * @returns The verdict
+     */
+    async lookup(socket) {
+        const address = socket.remoteAddress ?? '';
+        // Node clears remoteAddress once the peer has closed the socket: a sender
+        // that already hung up is not "remote", it is gone (#1010 review).
+        if (!address)
+            return { kind: 'gone', reason: 'socket already closed' };
+        if (!this.deps.isHostAddress(address))
+            return { kind: 'remote' };
+        const clientPort = socket.remotePort;
+        const serverPort = socket.localPort;
+        if (!clientPort || !serverPort)
+            return { kind: 'gone', reason: 'no ports' };
+        const work = async () => {
+            const pid = await this.deps.findPeerPid(clientPort, serverPort);
+            if (!pid)
+                return { kind: 'gone', reason: 'client process not found' };
+            if (pid === this.deps.selfPid)
+                return { kind: 'self' };
+            const table = await this.deps.readTable();
+            // Exited between the two lookups: nothing left to vouch for it.
+            if (!table.has(pid))
+                return { kind: 'gone', reason: 'client process exited' };
+            const sessionPids = this.deps.listSessionPids();
+            const fromTable = agentSignalFromTable(pid, table, this.deps.selfPid, sessionPids);
+            if (fromTable)
+                return { kind: 'agent', pid, ...fromTable };
+            // 3. Environment: an agent shell's variables survive an orphaning fork.
+            const env = await this.deps.readEnv(pid);
+            if (env && (env['CREWLY_SESSION_NAME'] || env[OWNER_AUTH_CONSTANTS.AGENT_BADGE_ENV])) {
+                return { kind: 'agent', pid, signal: 'env', session: env['CREWLY_SESSION_NAME'] || null };
+            }
+            return { kind: 'not-agent', pid };
+        };
+        try {
+            return await withTimeout(work(), this.deps.timeoutMs);
+        }
+        catch (error) {
+            if (isLookupUnavailable(error)) {
+                return { kind: 'unknown', reason: error instanceof LookupTimeoutError ? 'lookup timed out' : 'lookup tool unavailable' };
+            }
+            return { kind: 'gone', reason: `lookup failed: ${error instanceof Error ? error.message : String(error)}` };
+        }
+    }
+}
+//# sourceMappingURL=peer-process.service.js.map

package/dist/backend/backend/src/services/core/peer-process.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"peer-process.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/peer-process.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,IAAI,CAAC;AACrC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAiDlF;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,aAAqD,EAAE,CAAC,iBAAiB,EAAE;IACxH,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAK,sBAAsB,CAAC,kBAAwC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACpG,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAClC,IAAI,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,SAAiB;IACzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACzF,uEAAuE;YACvE,IAAI,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAK,KAA4B,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACxF,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,UAAkB,EAAE,UAAkB;IAClF,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,QAAQ,UAAU,GAAG,CAAC,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjF,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,UAAkB;IAC5D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACpF,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAAC,UAAkB,EAAE,UAAkB,EAAE,SAAiB;IACzF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,cAAc,UAAU,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC,CAAC,oCAAoC;QACrD,CAAC;QACD,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AACrH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAC7E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/D,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,KAA4C,EAC5C,OAAe,EACf,WAAwC;IAExC,6EAA6E;IAC7E,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,oBAAoB,CAAC,uBAAuB,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvH,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,OAAO,KAAK,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,MAAM;QAClB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACnE,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,yEAAyE;IACzE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yDAAyD;AACzD,MAAM,kBAAmB,SAAQ,KAAK;CAAG;AAEzC;;;;;;GAMG;AACH,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,EAAE;YACJ,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,EACD,CAAC,CAAU,EAAE,EAAE;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,KAAK,YAAY,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,KAAoD,CAAC;IAC/D,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,kBAAkB;IACZ,KAAK,GAAG,IAAI,OAAO,EAAgC,CAAC;IACpD,IAAI,CAA4B;IAEjD;;OAEG;IACH,YAAY,OAAwB,EAAE;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAC,sBAAsB,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG;YACV,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAChF,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YAC/G,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACvD,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;YAC1D,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG;YACpC,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAC9D,SAAS;SACV,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,MAAyC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,MAAM,CAAC,MAAsB;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;QAC3C,0EAA0E;QAC1E,mEAAmE;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACjE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,KAAK,IAA0B,EAAE;YAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAChE,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;YACtE,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1C,gEAAgE;YAChE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACnF,IAAI,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;YAC3D,wEAAwE;YACxE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,GAAG,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;gBACrF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,qBAAqB,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5F,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;QACpC,CAAC,CAAC;QACF,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,YAAY,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC;YAC3H,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QAC9G,CAAC;IACH,CAAC;CACF"}