dsh-auto-review 0.4.0

package/lib/types/runtime.js

@@ -0,0 +1,486 @@
+/**
+ * Runtime of `dsh-auto-review`: the `approval/request` answerer (claim when
+ * the session and tool policy say `ai`, otherwise strictly `next()`), the
+ * reviewer verdict handling with fail-closed fallback, the risk-policy
+ * escalation, the rejection circuit breaker, the deny-reason injection into
+ * the denied tool result, and the `/auto-review` session command. Every
+ * registration is an effect (ctx.on / commands.register).
+ * @module dsh-auto-review/runtime
+ */
+import { createUserMessage } from '@deepseek-ai/dsh-llm';
+import { resolveConfig, riskExceeds } from "./config.js";
+import { messages } from "./messages.js";
+import { makeAutoReviewProjection } from "./projection.js";
+import { activeOverride, autoReviewFailuresInOpenTurn, autoReviewsInOpenTurn, circuitInOpenTurn, circuitResultText, consecutiveDeniesInOpenTurn, correlateApprovalId, deniesInRecentVerdicts, denyResultText, effectiveAutoReviewState, fallbackResultText, lastDeniedVerdicts, neverResultText, reviewStats, } from "./events.js";
+import { isReviewFailure, newCircuitId, newRejectionId, newVerdictId, runReview, sanitizedArgumentsText, truncate } from "./review.js";
+export const name = 'auto-review';
+export const inject = ['approval', 'subagents', 'commands', 'tools'];
+/** How long an injected feedback text stays available for its tool result (bounded cleanup). */
+const FEEDBACK_TTL_MS = 5 * 60_000;
+/** Closed-union backstop for the fallback-policy switch. */
+function assertNever(value, label) {
+    throw new TypeError(`unknown ${label}: ${String(value)}`);
+}
+/**
+ * Answerer policy resolution for one request: the first matching risk rule
+ * (security invariants win over tool defaults), then the exact tool override,
+ * then the table default. Each rule matches its configured field: the
+ * request reason, the tool name, or the redacted presented call arguments.
+ * @param config - the resolved config.
+ * @param request - the pending approval request.
+ * @param argumentsText - the sanitized call-arguments JSON, when the log has it.
+ * @returns the policy this request resolves to, with its provenance.
+ */
+function policyFor(config, request, argumentsText) {
+    for (const rule of config.riskRules) {
+        const subject = rule.field === 'reason'
+            ? request.reason ?? ''
+            : rule.field === 'toolName'
+                ? request.toolName
+                : argumentsText ?? '';
+        if (rule.regex.test(subject))
+            return { policy: rule.policy, source: `risk rule /${rule.pattern}/ (${rule.field})` };
+    }
+    const override = config.toolsPolicy.overrides[request.toolName];
+    if (override !== undefined)
+        return { policy: override, source: `toolsPolicy.overrides.${request.toolName}` };
+    return { policy: config.toolsPolicy.default, source: 'toolsPolicy.default' };
+}
+/**
+ * Answerer state and behavior. One instance per plugin mount; disposals are
+ * owned by the ctx.on / commands.register effects in {@link apply}.
+ */
+export class AutoReviewRuntime {
+    ctx;
+    config;
+    /** Live reviewer child sessions — their approval asks never re-enter AI review. */
+    reviewerSessions = new Set();
+    /** Feedback texts keyed by call id, consumed (and deleted) by the post-execute listener. */
+    feedback = new Map();
+    constructor(ctx, config) {
+        this.ctx = ctx;
+        this.config = config;
+    }
+    /**
+     * The `approval/request` answerer. Claims a request ONLY when auto-review
+     * is enabled for the session AND the policy for this tool/reason is `ai`
+     * AND both per-turn budgets remain AND the rejection circuit breaker is
+     * not tripped; everything else delegates via `next()` (or deterministically
+     * rejects for `never`). The reviewer's own asks are always delegated
+     * (anti-recursion).
+     * @param request - the pending decision.
+     * @param next - the downstream answerer chain.
+     * @returns the closed approval outcome.
+     */
+    answer(request, next) {
+        // Anti-recursion: a reviewer child's own approval asks go to the human chain.
+        if (this.reviewerSessions.has(request.agent.id))
+            return next();
+        const session = request.agent.session;
+        const enabled = effectiveAutoReviewState(session.events) ?? this.config.enableByDefault;
+        if (!enabled)
+            return next();
+        const needsArguments = this.config.riskRules.some(rule => rule.field === 'arguments');
+        const argumentsText = needsArguments && request.callId !== undefined
+            ? sanitizedArgumentsText(session.events, request.callId)
+            : undefined;
+        const { policy, source } = policyFor(this.config, request, argumentsText);
+        if (policy === 'never')
+            return this.neverReject(request, source);
+        if (policy !== 'ai')
+            return next();
+        // Separate budgets: real AI verdicts vs reviewer failures. A broken
+        // reviewer burns the failure budget (then delegates) without eating the
+        // AI-decision budget, and vice versa.
+        if (autoReviewsInOpenTurn(session.events) >= this.config.maxReviewsPerTurn)
+            return next();
+        if (autoReviewFailuresInOpenTurn(session.events) >= this.config.maxFailuresPerTurn)
+            return next();
+        const circuit = circuitInOpenTurn(session.events);
+        if (circuit !== undefined)
+            return this.circuitSettle(request, circuit, next);
+        const approvalId = correlateApprovalId(session.events, request.toolName, request.callId);
+        if (approvalId === undefined) {
+            // The audit chain cannot be completed (verdict → approval/asked); treat
+            // as an internal unavailability, never as a grant.
+            return this.finish(request, undefined, {
+                fallback: 'unavailable',
+                error: 'cannot correlate the pending approval/asked audit event',
+            }, next);
+        }
+        const overrideId = activeOverride(session.events, request.toolName, this.config.overrideTtlMs, Date.now());
+        const override = overrideId === undefined
+            ? undefined
+            : { reviewId: overrideId, toolName: request.toolName };
+        return this.review(request, approvalId, next, override);
+    }
+    /**
+     * Settle a `never`-policy request deterministically: record the log-only
+     * `autoReview/rejection` audit event, and feed a model-visible
+     * `[auto-review-never]` marker text (plus the deny guidance) into the
+     * denied call's tool result — without it the model only sees the generic
+     * rejection and keeps retrying a hard-disabled action. No reviewer runs
+     * and no budget is consumed.
+     * @param request - the hard-disabled decision.
+     * @param source - the matched risk rule or policy table entry.
+     * @returns the closed rejection.
+     */
+    neverReject(request, source) {
+        const rejectionId = newRejectionId();
+        const reason = truncate(source, this.config.reasonMaxChars);
+        const approvalId = correlateApprovalId(request.agent.session.events, request.toolName, request.callId);
+        request.agent.session.append('autoReview/rejection', {
+            rejectionId,
+            ...approvalId !== undefined ? { approvalId } : {},
+            toolName: request.toolName,
+            ...request.callId !== undefined ? { callId: request.callId } : {},
+            reason,
+            outcome: 'rejected',
+        }, { ignorable: true });
+        this.recordFeedback(request.callId, `${neverResultText(rejectionId, request.toolName, reason)}\n${this.config.denyGuidance}`);
+        return Promise.resolve('rejected');
+    }
+    /**
+     * Run the reviewer for one claimed request, register the child for
+     * anti-recursion, apply the risk policy, record the verdict, trip the
+     * circuit breaker on denials, and settle the answerer chain.
+     * @param request - the pending decision.
+     * @param approvalId - the correlated `approval/asked` id.
+     * @param next - the downstream chain (used by risk-policy delegation).
+     * @param override - a pending human one-shot override, when one applies.
+     * @returns the closed approval outcome.
+     */
+    async review(request, approvalId, next, override) {
+        const started = Date.now();
+        const resolution = await runReview(this.ctx, this.config, request, this.reviewerSessions, override);
+        const durationMs = Date.now() - started;
+        if (isReviewFailure(resolution)) {
+            return this.finish(request, approvalId, resolution, next, durationMs);
+        }
+        const reviewId = newVerdictId();
+        const overridden = resolution.decision === 'allow'
+            && resolution.riskLevel !== undefined
+            && riskExceeds(resolution.riskLevel, this.config.riskPolicy.maxAutoAllow);
+        const outcome = overridden
+            ? this.config.riskPolicy.onHighRisk === 'deny' ? 'rejected' : undefined
+            : resolution.decision === 'allow' ? 'allowed-once' : 'rejected';
+        request.agent.session.append('autoReview/verdict', {
+            reviewId,
+            approvalId,
+            toolName: request.toolName,
+            ...request.callId !== undefined ? { callId: request.callId } : {},
+            provider: this.config.reviewerProvider,
+            ...resolution.model !== undefined ? { model: resolution.model } : {},
+            ...resolution.reviewerSessionId !== undefined ? { reviewerSessionId: resolution.reviewerSessionId } : {},
+            durationMs,
+            decision: resolution.decision,
+            reason: resolution.reason,
+            ...resolution.riskLevel !== undefined ? { riskLevel: resolution.riskLevel } : {},
+            ...overridden ? { escalation: 'risk-policy' } : {},
+            ...outcome !== undefined ? { outcome } : {},
+        }, { ignorable: true });
+        if (outcome === undefined)
+            return next();
+        if (resolution.decision === 'deny') {
+            this.recordDenyReason(request.callId, request.toolName, reviewId, resolution.reason);
+            this.checkCircuit(request);
+            return 'rejected';
+        }
+        if (overridden) {
+            // The reviewer allowed, but the risk policy denied: feed the override
+            // back to the model and count it toward the rejection circuit breaker.
+            this.recordDenyReason(request.callId, request.toolName, reviewId, `${resolution.reason} (risk ${resolution.riskLevel} exceeds the configured maxAutoAllow ${this.config.riskPolicy.maxAutoAllow}; the allow verdict was overridden)`);
+            this.checkCircuit(request);
+            return 'rejected';
+        }
+        return 'allowed-once';
+    }
+    /**
+     * Append the fallback verdict event and apply the configured fallback
+     * policy. A user cancellation settles `cancelled` regardless of policy;
+     * otherwise `rejected` (fail closed), `allow-once`, or `delegate`
+     * (continue the chain) per config.
+     */
+    finish(request, approvalId, failure, next, durationMs = 0) {
+        const outcome = this.fallbackOutcome(failure);
+        if (approvalId !== undefined) {
+            const reviewId = newVerdictId();
+            request.agent.session.append('autoReview/verdict', {
+                reviewId,
+                approvalId,
+                toolName: request.toolName,
+                ...request.callId !== undefined ? { callId: request.callId } : {},
+                provider: this.config.reviewerProvider,
+                ...failure.model !== undefined ? { model: failure.model } : {},
+                ...failure.reviewerSessionId !== undefined ? { reviewerSessionId: failure.reviewerSessionId } : {},
+                durationMs,
+                fallback: failure.fallback,
+                error: failure.error,
+                ...outcome !== undefined ? { outcome } : {},
+            }, { ignorable: true });
+            this.ctx.logger.warn(`auto-review fallback (${failure.fallback}) for ${request.toolName}: ${failure.error}`);
+            // A fail-closed rejection is as model-visible as a reviewer deny: the
+            // agent learns WHY it was rejected (and that the reviewer failed)
+            // instead of retrying the same escalation blindly.
+            if (outcome === 'rejected') {
+                this.recordFallbackFeedback(request.callId, reviewId, failure.fallback, failure.error);
+            }
+        }
+        if (outcome === undefined)
+            return next();
+        return Promise.resolve(outcome);
+    }
+    /**
+     * Map one reviewer failure to the approval outcome the answerer settles
+     * with: `cancelled` when the user aborted the request; otherwise the
+     * configured fallback policy.
+     * @param failure - the review failure.
+     * @returns the outcome, or undefined when the chain must continue.
+     */
+    fallbackOutcome(failure) {
+        if (failure.fallback === 'cancelled')
+            return 'cancelled';
+        switch (this.config.fallbackPolicy) {
+            case 'rejected': return 'rejected';
+            case 'allow-once': return 'allowed-once';
+            case 'delegate': return undefined;
+            default: return assertNever(this.config.fallbackPolicy, 'fallback policy');
+        }
+    }
+    /**
+     * Settle one request while the rejection circuit breaker is tripped:
+     * `delegate` continues the chain; `reject` (and `abort-turn`, whose abort
+     * already happened at trip time) rejects with an auditable marker.
+     * @param request - the pending decision.
+     * @param circuit - the turn's recorded circuit trip.
+     * @param next - the downstream chain.
+     * @returns the closed approval outcome.
+     */
+    circuitSettle(request, circuit, next) {
+        if (circuit.action === 'delegate')
+            return next();
+        const explanation = `rejection circuit breaker tripped (${circuit.trip.kind}: ${circuit.trip.count} denials)`;
+        this.recordFeedback(request.callId, circuitResultText(circuit.circuitId, request.toolName, explanation));
+        return Promise.resolve('rejected');
+    }
+    /**
+     * Trip the rejection circuit breaker after a denial, at most once per
+     * turn. `abort-turn` also injects a model-visible warning and cancels the
+     * agent (deferred a macrotask so the service's `approval/decided` append
+     * commits first — the pair must stay turn-enclosed).
+     * @param request - the request whose denial may trip the breaker.
+     */
+    checkCircuit(request) {
+        const session = request.agent.session;
+        if (circuitInOpenTurn(session.events) !== undefined)
+            return;
+        const { consecutiveDenies, windowDenies, windowSize, action } = this.config.circuitBreaker;
+        const consecutive = consecutiveDeniesInOpenTurn(session.events);
+        const trip = consecutive >= consecutiveDenies
+            ? { kind: 'consecutive', count: consecutive }
+            : (() => {
+                const window = deniesInRecentVerdicts(session.events, windowSize);
+                return window >= windowDenies ? { kind: 'window', count: window } : undefined;
+            })();
+        if (trip === undefined)
+            return;
+        const circuitId = newCircuitId();
+        session.append('autoReview/circuit', {
+            circuitId,
+            action,
+            trip,
+            toolName: request.toolName,
+        }, { ignorable: true });
+        this.ctx.logger.warn(`auto-review circuit breaker tripped (${trip.kind}: ${trip.count}) by ${request.toolName}; action=${action}`);
+        if (action === 'abort-turn') {
+            request.agent.inject(createUserMessage({
+                content: [{ type: 'text', text: messages(this.config.language).circuitNotice(trip.kind, trip.count) }],
+                source: { kind: 'plugin', plugin: 'auto-review' },
+            }));
+            setTimeout(() => {
+                request.agent.cancel({ kind: 'hook', reason: `auto-review circuit breaker: ${trip.kind} ${trip.count}` });
+            }, 0);
+        }
+    }
+    /**
+     * Store one model-visible feedback text for a denied/failed call's tool
+     * result, keyed by call id. Consumed once by the post-execute listener;
+     * entries expire after a bounded TTL so a result path that never reaches
+     * post-execute cannot grow the map. Same call id twice is last-wins (a
+     * retried approval replaces its own pending feedback).
+     */
+    recordFeedback(callId, text) {
+        if (callId === undefined)
+            return;
+        const now = Date.now();
+        for (const [key, entry] of this.feedback) {
+            if (now - entry.at > FEEDBACK_TTL_MS)
+                this.feedback.delete(key);
+        }
+        this.feedback.set(callId, { text, at: now });
+    }
+    /**
+     * Record a deny reason (plus the anti-circumvention guidance) for the
+     * denied call's tool result.
+     * @param callId - the denied call.
+     * @param toolName - the denied tool.
+     * @param reviewId - the verdict event's id (embedded in the injected text).
+     * @param reason - the reviewer's reason.
+     */
+    recordDenyReason(callId, toolName, reviewId, reason) {
+        this.recordFeedback(callId, `${denyResultText(reviewId, toolName, reason)}\n${this.config.denyGuidance}`);
+    }
+    /**
+     * Record a fallback-rejection text for the failed call's tool result.
+     * @param callId - the failed call.
+     * @param reviewId - the fallback verdict event's id (embedded in the text).
+     * @param fallback - the failure category.
+     * @param error - the failure detail.
+     */
+    recordFallbackFeedback(callId, reviewId, fallback, error) {
+        this.recordFeedback(callId, fallbackResultText(reviewId, fallback, truncate(error, this.config.reasonMaxChars)));
+    }
+    /**
+     * The `tools/post-execute` listener: replace the generic rejection text of
+     * a call THIS answerer denied with the recorded feedback (the model-visible
+     * content, reconstructable via the embedded marker). Any other call
+     * delegates untouched.
+     */
+    injectDenyReason(exec, result, next) {
+        const entry = this.feedback.get(exec.callId);
+        if (entry === undefined)
+            return next();
+        this.feedback.delete(exec.callId);
+        // Only the denial result exists for this call (the tool never executed);
+        // a non-error result means the chain evolved past us — leave it alone.
+        if (!result.isError)
+            return next();
+        return Promise.resolve({
+            kind: 'block',
+            feedback: [{ type: 'text', text: entry.text }],
+        });
+    }
+    /**
+     * Execute the `/auto-review` command: `on` / `off` write the durable
+     * `autoReview/state` override (surviving restore) and inject a switch
+     * notice; `status` reports the effective state, both per-turn budgets,
+     * and the session's cumulative statistics; `approve [n]` records a
+     * one-shot human override for a recent denial.
+     * @param invocation - the received command invocation.
+     * @returns the command result shown to the user.
+     */
+    command(invocation) {
+        const agent = invocation.agent;
+        const session = agent.session;
+        const t = messages(this.config.language);
+        const input = invocation.rawInput.trim().toLowerCase();
+        if (input.startsWith('approve'))
+            return this.approveCommand(invocation);
+        const current = effectiveAutoReviewState(session.events) ?? this.config.enableByDefault;
+        if (input === 'status' || input === '') {
+            const stats = reviewStats(session.events);
+            const circuit = circuitInOpenTurn(session.events);
+            const recent = stats.recent.length === 0
+                ? []
+                : [t.recentLine(stats.recent.map(verdict => {
+                        const label = verdict.decision !== undefined
+                            ? verdict.decision
+                            : `fallback(${verdict.fallback ?? '?'})`;
+                        return `${verdict.toolName}: ${label}`;
+                    }).join(', '))];
+            return {
+                kind: 'success',
+                text: [
+                    t.statusLine(current),
+                    t.verdictsLine(autoReviewsInOpenTurn(session.events), this.config.maxReviewsPerTurn),
+                    t.failuresLine(autoReviewFailuresInOpenTurn(session.events), this.config.maxFailuresPerTurn),
+                    ...circuit === undefined ? [] : [t.circuitLine(circuit.trip.kind, circuit.trip.count, circuit.action)],
+                    t.allTimeLine(stats.allows, stats.denies, stats.fallbacks, stats.rejections, stats.avgDurationMs),
+                    ...recent,
+                    t.usage,
+                ].join('\n'),
+            };
+        }
+        if (input !== 'on' && input !== 'off') {
+            return {
+                kind: 'error',
+                text: t.unknownArg(invocation.rawInput.trim()),
+            };
+        }
+        const enabled = input === 'on';
+        if (current === enabled) {
+            return { kind: 'success', text: t.already(input.toUpperCase()) };
+        }
+        ;
+        session.append('autoReview/state', { enabled }, { ignorable: true });
+        agent.inject(createUserMessage({
+            content: [{
+                    type: 'text',
+                    text: t.switchedNotice(enabled),
+                }],
+            source: { kind: 'plugin', plugin: 'auto-review' },
+        }));
+        return { kind: 'success', text: t.switchedResult(input.toUpperCase()) };
+    }
+    /**
+     * Execute `/auto-review approve [n]`: record a single-use human override
+     * for the n-th most recent denial (1 = most recent). The override is
+     * consumed by the NEXT same-tool review within `overrideTtlMs`, which
+     * carries the authorization as reviewer context — the reviewer still
+     * decides.
+     * @param invocation - the received command invocation.
+     * @returns the command result shown to the user.
+     */
+    approveCommand(invocation) {
+        const agent = invocation.agent;
+        const session = agent.session;
+        const t = messages(this.config.language);
+        const arg = invocation.rawInput.trim().split(/\s+/u)[1];
+        const index = arg === undefined ? 1 : Number.parseInt(arg, 10);
+        if (!Number.isSafeInteger(index) || index < 1) {
+            return {
+                kind: 'error',
+                text: t.approveInvalid(arg ?? ''),
+            };
+        }
+        const denies = lastDeniedVerdicts(session.events, index);
+        const target = denies[index - 1];
+        if (target === undefined) {
+            return { kind: 'error', text: t.approveNone(index, denies.length) };
+        }
+        ;
+        session.append('autoReview/override', {
+            reviewId: target.reviewId,
+            toolName: target.toolName,
+        }, { ignorable: true });
+        return {
+            kind: 'success',
+            text: t.approveResult(target.toolName, String(target.reviewId), Math.round(this.config.overrideTtlMs / 60_000)),
+        };
+    }
+}
+/**
+ * Mount the plugin: resolve config, register the answerer and the
+ * post-execute listener as effects, register the slash command, and register
+ * the `autoReview` session projection (when the host provides the
+ * session-projection capability — the web profile does; bare test mounts and
+ * minimal compositions may not, and the answerer must not depend on it).
+ * @param ctx - the host context.
+ * @param config - raw plugin config.
+ */
+export function apply(ctx, config) {
+    const resolved = resolveConfig(config);
+    const runtime = new AutoReviewRuntime(ctx, resolved);
+    ctx.on('approval/request', (request, next) => runtime.answer(request, next));
+    ctx.on('tools/post-execute', (exec, result, next) => runtime.injectDenyReason(exec, result, next));
+    ctx.commands.register({
+        name: 'auto-review',
+        description: messages(resolved.language).description,
+        input: { hint: 'on|off|status|approve [n]' },
+        handler: invocation => runtime.command(invocation),
+    });
+    if (ctx.get('sessionProjections') !== undefined) {
+        ctx.inject(['sessionProjections'], scope => scope.sessionProjections.register(makeAutoReviewProjection(resolved.enableByDefault)));
+    }
+}
+//# sourceMappingURL=runtime.js.map

package/lib/types/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAQxD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAExD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAC1D,OAAO,EACL,cAAc,EACd,4BAA4B,EAC5B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,EACnB,sBAAsB,EACtB,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,GAQZ,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAGtI,MAAM,CAAC,MAAM,IAAI,GAAG,aAAa,CAAA;AACjC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AAEpE,gGAAgG;AAChG,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAA;AAQlC,4DAA4D;AAC5D,SAAS,WAAW,CAAC,KAAY,EAAE,KAAa;IAC9C,MAAM,IAAI,SAAS,CAAC,WAAW,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAC3D,CAAC;AASD;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,MAAsB,EAAE,OAAwB,EAAE,aAAiC;IACpG,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,KAAK,QAAQ;YACrC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE;YACtB,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU;gBACzB,CAAC,CAAC,OAAO,CAAC,QAAQ;gBAClB,CAAC,CAAC,aAAa,IAAI,EAAE,CAAA;QACzB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAA;IACrH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAA;IAC5G,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IAQT;IACR;IARX,mFAAmF;IAClE,gBAAgB,GAAG,IAAI,GAAG,EAAa,CAAA;IAExD,4FAA4F;IAC3E,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAA;IAE5D,YACmB,GAAY,EACpB,MAAsB;QADd,QAAG,GAAH,GAAG,CAAS;QACpB,WAAM,GAAN,MAAM,CAAgB;IAC9B,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,MAAM,CAAC,OAAwB,EAAE,IAAoC;QACnE,8EAA8E;QAC9E,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAA;QACrC,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAA;QACvF,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAA;QAC3B,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAA;QACrF,MAAM,aAAa,GAAG,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAClE,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;QACzE,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAA;QAClC,oEAAoE;QACpE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB;YAAE,OAAO,IAAI,EAAE,CAAA;QACzF,IAAI,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAAE,OAAO,IAAI,EAAE,CAAA;QACjG,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QAC5E,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACxF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,wEAAwE;YACxE,mDAAmD;YACnD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE;gBACrC,QAAQ,EAAE,aAAa;gBACvB,KAAK,EAAE,yDAAyD;aACjE,EAAE,IAAI,CAAC,CAAA;QACV,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAC1G,MAAM,QAAQ,GAAgC,UAAU,KAAK,SAAS;YACpE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAA;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IACzD,CAAC;IAED;;;;;;;;;;OAUG;IACK,WAAW,CAAC,OAAwB,EAAE,MAAc;QAC1D,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QAC3D,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CACrG;QAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAqC,CAAC,sBAAsB,EAAE;YACpF,WAAW;YACX,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;YACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;YACjE,MAAM;YACN,OAAO,EAAE,UAAU;SACpB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACvB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;QAC7H,OAAO,OAAO,CAAC,OAAO,CAAkB,UAAU,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,MAAM,CAClB,OAAwB,EACxB,UAA6B,EAC7B,IAAoC,EACpC,QAA0B;QAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC1B,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAA;QACnG,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;QACvC,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;QACvE,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAA;QAC/B,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,KAAK,OAAO;eAC7C,UAAU,CAAC,SAAS,KAAK,SAAS;eAClC,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;QAC3E,MAAM,OAAO,GAAgC,UAAU;YACrD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACvE,CAAC,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAChE;QAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAmC,CAAC,oBAAoB,EAAE;YAChF,QAAQ;YACR,UAAU;YACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;YACjE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;YACtC,GAAG,UAAU,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;YACpE,GAAG,UAAU,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE;YACxG,UAAU;YACV,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,GAAG,UAAU,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;YAChF,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE;YAClD,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;SAC5C,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACvB,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QACxC,IAAI,UAAU,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;YACpF,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;YAC1B,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,sEAAsE;YACtE,uEAAuE;YACvE,IAAI,CAAC,gBAAgB,CACnB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,EAChB,QAAQ,EACR,GAAG,UAAU,CAAC,MAAM,UAAU,UAAU,CAAC,SAAS,wCAAwC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,qCAAqC,CACnK,CAAA;YACD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;YAC1B,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,OAAO,cAAc,CAAA;IACvB,CAAC;IAED;;;;;OAKG;IACK,MAAM,CACZ,OAAwB,EACxB,UAAyC,EACzC,OAAsB,EACtB,IAAoC,EACpC,UAAU,GAAG,CAAC;QAEd,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,YAAY,EAAE,CAC9B;YAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAmC,CAAC,oBAAoB,EAAE;gBAChF,QAAQ;gBACR,UAAU;gBACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;gBACjE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBACtC,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;gBAC9D,GAAG,OAAO,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE;gBAClG,UAAU;gBACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;aAC5C,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACvB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,QAAQ,SAAS,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;YAC5G,sEAAsE;YACtE,kEAAkE;YAClE,mDAAmD;YACnD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC3B,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YACxF,CAAC;QACH,CAAC;QACD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QACxC,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,OAAsB;QAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW;YAAE,OAAO,WAAW,CAAA;QACxD,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACnC,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAA;YAClC,KAAK,YAAY,CAAC,CAAC,OAAO,cAAc,CAAA;YACxC,KAAK,UAAU,CAAC,CAAC,OAAO,SAAS,CAAA;YACjC,OAAO,CAAC,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,aAAa,CACnB,OAAwB,EACxB,OAA8C,EAC9C,IAAoC;QAEpC,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,IAAI,EAAE,CAAA;QAChD,MAAM,WAAW,GAAG,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,WAAW,CAAA;QAC7G,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;QACxG,OAAO,OAAO,CAAC,OAAO,CAAkB,UAAU,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,OAAwB;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAA;QACrC,IAAI,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS;YAAE,OAAM;QAC3D,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAA;QAC1F,MAAM,WAAW,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC/D,MAAM,IAAI,GAAG,WAAW,IAAI,iBAAiB;YAC3C,CAAC,CAAC,EAAE,IAAI,EAAE,aAAsB,EAAE,KAAK,EAAE,WAAW,EAAE;YACtD,CAAC,CAAC,CAAC,GAAG,EAAE;gBACN,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;gBACjE,OAAO,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YACxF,CAAC,CAAC,EAAE,CAAA;QACN,IAAI,IAAI,KAAK,SAAS;YAAE,OAAM;QAC9B,MAAM,SAAS,GAAG,YAAY,EAAE,CAC/B;QAAC,OAAO,CAAC,MAAmC,CAAC,oBAAoB,EAAE;YAClE,SAAS;YACT,MAAM;YACN,IAAI;YACJ,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,QAAQ,OAAO,CAAC,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAA;QAClI,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACrC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtG,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE;aAClD,CAAC,CAAC,CAAA;YACH,UAAU,CAAC,GAAG,EAAE;gBACd,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,gCAAgC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YAC3G,CAAC,EAAE,CAAC,CAAC,CAAA;QACP,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,MAA0B,EAAE,IAAY;QAC7D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAM;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,eAAe;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CACtB,MAA0B,EAC1B,QAAgB,EAChB,QAA6B,EAC7B,MAAc;QAEd,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;IAC3G,CAAC;IAED;;;;;;OAMG;IACK,sBAAsB,CAC5B,MAA0B,EAC1B,QAA6B,EAC7B,QAA4B,EAC5B,KAAa;QAEb,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;IAClH,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CACd,IAAmB,EACnB,MAAqC,EACrC,IAAqC;QAErC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACjC,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAA;QAClC,OAAO,OAAO,CAAC,OAAO,CAAmB;YACvC,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC/C,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,UAA6B;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;QAC7B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACtD,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QACvE,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAA;QACvF,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACjD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBACtC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;wBACzC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS;4BAC1C,CAAC,CAAC,OAAO,CAAC,QAAQ;4BAClB,CAAC,CAAC,YAAY,OAAO,CAAC,QAAQ,IAAI,GAAG,GAAG,CAAA;wBAC1C,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAA;oBACxC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE;oBACJ,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;oBACrB,CAAC,CAAC,YAAY,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;oBACpF,CAAC,CAAC,YAAY,CAAC,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;oBAC5F,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;oBACtG,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC;oBACjG,GAAG,MAAM;oBACT,CAAC,CAAC,KAAK;iBACR,CAAC,IAAI,CAAC,IAAI,CAAC;aACb,CAAA;QACH,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;aAC/C,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,KAAK,IAAI,CAAA;QAC9B,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAA;QAClE,CAAC;QACD,CAAC;QAAC,OAAO,CAAC,MAAiC,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACjG,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAC7B,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC;iBAChC,CAAC;YACF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE;SAClD,CAAC,CAAC,CAAA;QACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAA;IACzE,CAAC;IAED;;;;;;;;OAQG;IACK,cAAc,CAAC,UAA6B;QAClD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;QAC7B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,MAAM,KAAK,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC9D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,IAAI,EAAE,CAAC;aAClC,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAA;QACrE,CAAC;QACD,CAAC;QAAC,OAAO,CAAC,MAAoC,CAAC,qBAAqB,EAAE;YACpE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACvB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,CAAC;SAChH,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACpD,GAAG,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;IAC5E,GAAG,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IAClG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW;QACpD,KAAK,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE;QAC5C,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;KACnD,CAAC,CAAA;IACF,IAAI,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,SAAS,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACpI,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,132 @@
+{
+  "name": "dsh-auto-review",
+  "version": "0.4.0",
+  "description": "Second-model AI auto-review for DeepSeek Harness approval requests: a read-only reviewer subagent decides allow/deny on the approval answerer chain, with fail-closed fallback and full session-log audit.",
+  "private": false,
+  "author": {
+    "name": "PerryLink"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PerryLink/dsh-auto-review.git"
+  },
+  "bugs": {
+    "url": "https://github.com/PerryLink/dsh-auto-review/issues"
+  },
+  "homepage": "https://github.com/PerryLink/dsh-auto-review#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./client": {
+      "types": "./lib/types/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "src",
+    "cordis.patch.yml",
+    "CHANGELOG.md",
+    "README.md",
+    "README.zh.md",
+    "README.es.md",
+    "README.pt.md",
+    "README.hi.md",
+    "LICENSE"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-ui-conversation"
+      ]
+    }
+  },
+  "keywords": [
+    "deepseek-harness",
+    "dsh",
+    "dsh-plugin",
+    "cordis",
+    "approval",
+    "auto-review",
+    "second-model",
+    "ai-safety",
+    "sandbox",
+    "subagent"
+  ],
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/schemastery": "^3.18.0",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-brand": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-commands": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session-projection": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-subagent": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-user-approval": "0.1.0-rc.6"
+  },
+  "dependencies": {
+    "tsdown": "^0.22.14",
+    "typescript": "^5.9.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/schemastery": "^3.18.0",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-api-remotes": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-brand": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-connection": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-commands": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session-projection": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-subagent": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-user-approval": "0.1.0-rc.6",
+    "@types/node": "^22.19.0",
+    "@types/react": "18.3.31",
+    "jsdom": "^26.1.0",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
+    "vitest": "^3.2.0"
+  },
+  "license": "Apache-2.0",
+  "scripts": {
+    "build": "node scripts/prepare.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "test": "vitest run",
+    "verify:self-contained": "node scripts/verify-self-contained.mjs"
+  }
+}