frely-cli 0.23.9 → 0.23.10

package/dist/agent/local/command.js

@@ -0,0 +1,292 @@
+import { spawn } from "node:child_process";
+import { closeSync, openSync } from "node:fs";
+import { mkdir, readFile, rm, stat } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { inspectAuth, normalizeRelayUrl, requireLogin } from "../../auth.js";
+import { cliLaunchArguments } from "../../cli-launch.js";
+import { credentialStore } from "../../credential-store.js";
+import { ControllerError, EXIT } from "../../controller/session.js";
+import { restrictSandboxNetwork, sandboxUnavailableReason, shutdownSandbox } from "../../runtime/sandbox.js";
+import { approveSites } from "./approvals.js";
+import { API_KEY_SERVICE, agentEnv, gatewayOrigin, readApiKey, spawnConfined } from "./confine.js";
+import { parseManifest } from "./manifest.js";
+import { download, githubUrl, parseSource, resolveRegisteredRepo } from "./source.js";
+import { SLUG, agentsRoot, approvedHosts, assertSlug, insideAgentsRoot, isRunning, listRecords, logPath, readRecord, removeRecordFiles, stateDir, workspaceOf, writeRecord, } from "./store.js";
+import { superviseAgent } from "./supervisor.js";
+export const LOCAL_USAGE = `Usage:
+  frely agent local add <username/name | https://github.com/owner/repo> [--name <folder-name>]
+  frely agent local start <name> [--foreground]
+  frely agent local stop <name>
+  frely agent local logs <name> [--lines <n>] [--follow]
+  frely agent local list [--json]
+  frely agent local remove <name>
+  frely agent local key --api-key-stdin | --clear
+`;
+const fail = (message, code = EXIT.cli) => { throw new ControllerError(message, code); };
+const flag = (args, name) => args.includes(name);
+function value(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return undefined;
+    const next = args[index + 1];
+    if (!next || next.startsWith("--"))
+        return fail(`${name} needs a value.`);
+    return next;
+}
+const positional = (args) => args.filter((arg, index) => !arg.startsWith("--") && !(index > 0 && ["--name", "--lines"].includes(args[index - 1])));
+/** Runs `frely agent local ...`; returns the exit code. */
+export async function runAgentLocal(args, io, deps = {}) {
+    try {
+        const [action, ...rest] = args;
+        switch (action) {
+            case "add": return await add(rest, io, deps);
+            case "start": return await start(rest, io, deps);
+            case "stop": return await stop(rest, io);
+            case "logs": return await logs(rest, io);
+            case "list": return await list(rest, io);
+            case "remove": return await remove(rest, io);
+            case "key": return await key(rest, io);
+            case "supervise": return await superviseAgent(rest[0] ?? "");
+            default:
+                io.out(LOCAL_USAGE);
+                return action === undefined ? EXIT.ok : EXIT.cli;
+        }
+    }
+    catch (error) {
+        if (error instanceof ControllerError) {
+            io.err(error.message + "\n");
+            return error.exitCode;
+        }
+        io.err((error instanceof Error ? error.message : String(error)) + "\n");
+        return EXIT.cli;
+    }
+}
+function slugFor(source, requested, manifestName) {
+    const raw = requested ?? (source.kind === "frely" ? source.name : source.repo);
+    const slug = raw.toLowerCase().replace(/[^a-z0-9-]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, 63);
+    if (!SLUG.test(slug))
+        return fail(`Could not make a folder name from ${JSON.stringify(manifestName ?? raw)}. Pass --name <letters-digits-dashes>.`);
+    return slug;
+}
+async function add(args, io, deps) {
+    const [target] = positional(args);
+    if (!target)
+        return fail(LOCAL_USAGE);
+    const source = parseSource(target);
+    const requested = value(args, "--name");
+    if (requested !== undefined)
+        assertSlug(requested);
+    const relayUrl = normalizeRelayUrl((await inspectAuth().catch(() => null))?.relayUrl);
+    const unavailable = sandboxUnavailableReason();
+    if (unavailable)
+        return fail(`Agents run on this computer only inside the Frely sandbox, and it cannot run here (${unavailable}). On Linux install bubblewrap, socat and ripgrep; Windows is not supported.`, EXIT.tool);
+    // Resume an Agent whose setup was interrupted (for example by an approval link) instead of downloading it again.
+    const existing = (await listRecords()).find((item) => !item.setupDone && item.source === target && (requested === undefined || item.slug === requested));
+    let record;
+    if (existing) {
+        record = existing;
+    }
+    else {
+        const registered = source.kind === "frely" ? await resolveRegisteredRepo(source.user, source.name, relayUrl) : undefined;
+        const repoUrl = registered?.repoUrl ?? githubUrl(source);
+        const slug = slugFor(source, requested, registered?.name);
+        if (await readRecord(slug))
+            return fail(`${slug} is already on this computer. Remove it first with frely agent local remove ${slug}, or pick another --name.`);
+        const workspace = workspaceOf(slug);
+        if (await stat(workspace).then(() => true, () => false))
+            return fail(`${workspace} already exists. Pick another --name or move that folder away.`);
+        io.err(`Downloading ${repoUrl}${registered?.commit ? ` at ${registered.commit.slice(0, 8)}` : ""}…\n`);
+        const commit = await download(repoUrl, workspace, registered?.commit).catch(async (error) => { await rm(workspace, { recursive: true, force: true }); throw error; });
+        let manifest;
+        try {
+            manifest = parseManifest(await readFile(`${workspace}/frely.yaml`, "utf8").catch(() => fail("The repository has no frely.yaml, so it cannot run through Frely.")));
+        }
+        catch (error) {
+            await rm(workspace, { recursive: true, force: true });
+            throw error;
+        }
+        record = { version: 1, slug, source: target, repoUrl, commit, name: manifest.name ?? registered?.name ?? slug, workspace, setup: manifest.setup, run: manifest.run, network: [...manifest.network],
+            addedAt: new Date().toISOString(), setupDone: false, approvals: {}, pid: undefined, startedAt: undefined };
+        await writeRecord(record);
+    }
+    io.out(`${record.name} (${record.repoUrl} at ${record.commit.slice(0, 8)})\n  runs: ${record.run}\n${record.setup ? `  setup: ${record.setup}\n` : ""}  folder: ${record.workspace}\n`);
+    io.out(`  can reach: Frely's API${record.network.length ? `, and after your approval ${record.network.join(", ")}` : " only"}\n`);
+    record = await withApprovals(record, io, deps);
+    if (record.setup && !record.setupDone) {
+        io.err(`Running setup inside the sandbox: ${record.setup}\n`);
+        const code = await runSetup(record, relayUrl, io);
+        if (code !== 0)
+            return fail(`Setup failed (exit ${code}). Fix it or remove the Agent with frely agent local remove ${record.slug}, then run add again.`, EXIT.tool);
+    }
+    await writeRecord({ ...record, setupDone: true });
+    io.out(`Added. Start it with: frely agent local start ${record.slug}\n`);
+    return EXIT.ok;
+}
+async function withApprovals(record, io, deps) {
+    // When the owner has not answered yet this throws and keeps the download, so the same command carries on from here.
+    const gained = await approveSites(record, io, deps);
+    if (Object.keys(gained).length === 0)
+        return record;
+    const next = { ...record, approvals: { ...record.approvals, ...gained } };
+    await writeRecord(next);
+    return next;
+}
+async function runSetup(record, relayUrl, io) {
+    restrictSandboxNetwork({ allowedDomains: [new URL(gatewayOrigin(relayUrl)).hostname, ...approvedHosts(record)] });
+    await mkdir(`${record.workspace}/.cache`, { recursive: true });
+    try {
+        const { child, violations } = await spawnConfined(record.setup, record.workspace, agentEnv(record.workspace, { model: false }));
+        child.stdout?.on("data", (data) => io.err(data.toString("utf8")));
+        child.stderr?.on("data", (data) => io.err(data.toString("utf8")));
+        const code = await new Promise((done) => { child.once("error", () => done(1)); child.once("close", (exit) => done(exit ?? 1)); });
+        const blocked = violations();
+        if (code !== 0 && blocked.length > 0)
+            io.err(`The sandbox blocked:\n${[...new Set(blocked)].slice(0, 10).join("\n")}\nIf a site is missing, the Agent's author needs to list it under local.network in frely.yaml.\n`);
+        return code;
+    }
+    finally {
+        await shutdownSandbox();
+    }
+}
+async function start(args, io, deps) {
+    const [slug] = positional(args);
+    if (!slug)
+        return fail("Usage: frely agent local start <name> [--foreground]");
+    assertSlug(slug);
+    let record = await readRecord(slug) ?? fail(`No local Agent named ${slug}. See frely agent local list.`);
+    if (!record.setupDone)
+        return fail(`${slug} was not set up yet. Run frely agent local add again to finish.`);
+    if (isRunning(record))
+        return fail(`${slug} is already running (process ${record.pid}). Stop it first to apply new approvals.`);
+    record = await withApprovals(record, io, deps);
+    await preflight(record);
+    if (flag(args, "--foreground"))
+        return superviseAgent(slug);
+    await mkdir(stateDir(), { recursive: true, mode: 0o700 });
+    let supervisor;
+    const log = openSync(logPath(slug), "a", 0o600);
+    try {
+        const launch = cliLaunchArguments(fileURLToPath(new URL("../../index.js", import.meta.url)), ["agent", "local", "supervise", slug]);
+        const child = spawn(launch[0], launch.slice(1), { detached: true, stdio: ["ignore", log, log], env: process.env, windowsHide: true });
+        child.unref();
+        supervisor = child.pid;
+    }
+    finally {
+        closeSync(log);
+    }
+    // The supervisor records its own process id once the Agent is up; wait briefly so a failed start is reported here.
+    for (let waited = 0; waited < 15_000; waited += 250) {
+        await new Promise((done) => setTimeout(done, 250));
+        const current = await readRecord(slug);
+        if (current && isRunning(current)) {
+            io.out(`${slug} is running. Logs: frely agent local logs ${slug}\n`);
+            return EXIT.ok;
+        }
+        if (supervisor === undefined || !isRunning({ pid: supervisor })) {
+            const tail = (await readFile(logPath(slug), "utf8").catch(() => "")).trim().split("\n").slice(-6).join("\n");
+            return fail(`${slug} did not start:\n${tail}`, EXIT.tool);
+        }
+    }
+    return fail(`${slug} did not report that it started. See frely agent local logs ${slug}.`, EXIT.tool);
+}
+/** The two things a start needs besides the download: a login and a key for the model calls. Said now, not in a log file. */
+async function preflight(record) {
+    const login = await requireLogin().catch(() => fail("Frely login is required. Run `frely login`."));
+    if (!await readApiKey(gatewayOrigin(login.config.relayUrl))) {
+        fail(`${record.slug} needs a Frely API key for its model calls. Create one at ${login.config.relayUrl}/user/keys, then run: frely agent local key --api-key-stdin`);
+    }
+}
+async function stop(args, io) {
+    const [slug] = positional(args);
+    if (!slug)
+        return fail("Usage: frely agent local stop <name>");
+    assertSlug(slug);
+    const record = await readRecord(slug) ?? fail(`No local Agent named ${slug}.`);
+    if (!isRunning(record)) {
+        io.out(`${slug} is not running.\n`);
+        return EXIT.ok;
+    }
+    process.kill(record.pid, "SIGTERM");
+    for (let waited = 0; waited < 8000 && isRunning(record); waited += 200)
+        await new Promise((done) => setTimeout(done, 200));
+    if (isRunning(record)) {
+        try {
+            process.kill(record.pid, "SIGKILL");
+        }
+        catch { /* already gone */ }
+    }
+    await writeRecord({ ...record, pid: undefined, startedAt: undefined });
+    io.out(`${slug} stopped.\n`);
+    return EXIT.ok;
+}
+async function logs(args, io) {
+    const [slug] = positional(args);
+    if (!slug)
+        return fail("Usage: frely agent local logs <name> [--lines <n>] [--follow]");
+    assertSlug(slug);
+    if (!await readRecord(slug))
+        return fail(`No local Agent named ${slug}.`);
+    const lines = Number(value(args, "--lines") ?? 100);
+    if (!Number.isInteger(lines) || lines < 1 || lines > 10_000)
+        return fail("--lines must be 1 to 10000.");
+    const text = await readFile(logPath(slug), "utf8").catch(() => "");
+    const all = text.split("\n");
+    io.out(all.slice(-lines - 1).join("\n"));
+    if (!flag(args, "--follow"))
+        return EXIT.ok;
+    let offset = Buffer.byteLength(text);
+    for (;;) {
+        await new Promise((done) => setTimeout(done, 1000));
+        const size = (await stat(logPath(slug)).catch(() => undefined))?.size ?? 0;
+        if (size > offset) {
+            const handle = await readFile(logPath(slug));
+            io.out(handle.subarray(offset).toString("utf8"));
+            offset = size;
+        }
+    }
+}
+async function list(args, io) {
+    const records = await listRecords();
+    if (flag(args, "--json")) {
+        io.out(JSON.stringify(records.map((r) => ({ name: r.slug, title: r.name, source: r.source, commit: r.commit, workspace: r.workspace, running: isRunning(r), setupDone: r.setupDone, sites: r.network, approved: approvedHosts(r) })), null, 2) + "\n");
+        return EXIT.ok;
+    }
+    if (records.length === 0) {
+        io.out(`No local Agents. Add one with frely agent local add <username/name>. They live under ${agentsRoot()}.\n`);
+        return EXIT.ok;
+    }
+    io.out(records.map((r) => `${r.slug}\t${isRunning(r) ? "running" : r.setupDone ? "stopped" : "not set up"}\t${r.source}\t${r.commit.slice(0, 8)}`).join("\n") + "\n");
+    return EXIT.ok;
+}
+async function remove(args, io) {
+    const [slug] = positional(args);
+    if (!slug)
+        return fail("Usage: frely agent local remove <name>");
+    assertSlug(slug);
+    const record = await readRecord(slug) ?? fail(`No local Agent named ${slug}.`);
+    if (isRunning(record))
+        await stop([slug], io);
+    if (!insideAgentsRoot(record.workspace))
+        return fail(`Refusing to delete ${record.workspace}: it is not inside ${agentsRoot()}.`);
+    await rm(record.workspace, { recursive: true, force: true });
+    await removeRecordFiles(slug);
+    io.out(`${slug} removed, with its folder ${record.workspace}.\n`);
+    return EXIT.ok;
+}
+async function key(args, io) {
+    const origin = gatewayOrigin((await requireLogin().catch(() => fail("Frely login is required. Run `frely login`."))).config.relayUrl);
+    if (flag(args, "--clear")) {
+        await credentialStore.deletePassword(API_KEY_SERVICE, origin);
+        io.out("The saved API key was removed.\n");
+        return EXIT.ok;
+    }
+    if (!flag(args, "--api-key-stdin"))
+        return fail("Usage: frely agent local key --api-key-stdin | --clear");
+    const secret = await io.readSecret();
+    if (Buffer.byteLength(secret, "utf8") < 8 || Buffer.byteLength(secret, "utf8") > 8192 || /[\x00-\x20\x7f]/u.test(secret))
+        return fail("The API key is invalid.");
+    await credentialStore.setPassword(API_KEY_SERVICE, origin, secret);
+    io.out("The API key was saved in this computer's secure storage. Local Agents use it for their model calls.\n");
+    return EXIT.ok;
+}
+//# sourceMappingURL=command.js.map

package/dist/agent/local/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../src/agent/local/command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC7G,OAAO,EAAE,YAAY,EAAqB,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,qBAAqB,EAAoB,MAAM,aAAa,CAAC;AACxG,OAAO,EACL,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,GAElK,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AASjD,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;CAQ1B,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,OAAe,IAAI,CAAC,GAAG,EAAS,EAAE,GAAG,MAAM,IAAI,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAChH,MAAM,IAAI,GAAG,CAAC,IAAuB,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrF,SAAS,KAAK,CAAC,IAAuB,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,UAAU,GAAG,CAAC,IAAuB,EAAY,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;AAEjL,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuB,EAAE,EAAW,EAAE,OAAqB,EAAE;IAC/F,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QAC/B,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,KAAK,CAAC,CAAC,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;YAC7C,KAAK,OAAO,CAAC,CAAC,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;YACjD,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACzC,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACzC,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACzC,KAAK,QAAQ,CAAC,CAAC,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7C,KAAK,KAAK,CAAC,CAAC,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvC,KAAK,WAAW,CAAC,CAAC,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7D;gBAAS,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAAC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACjF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC,QAAQ,CAAC;QAAC,CAAC;QAC9F,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAmB,EAAE,SAA6B,EAAE,YAAgC;IACnG,MAAM,GAAG,GAAG,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,GAAG,CAAC,wCAAwC,CAAC,CAAC;IACpJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,EAAW,EAAE,IAAkB;IAChE,MAAM,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,SAAS;QAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,wBAAwB,EAAE,CAAC;IAC/C,IAAI,WAAW;QAAE,OAAO,IAAI,CAAC,sFAAsF,WAAW,8EAA8E,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzN,iHAAiH;IACjH,MAAM,QAAQ,GAAG,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC;IACzJ,IAAI,MAAwB,CAAC;IAC7B,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzH,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,SAAS,CAAC,MAAyC,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAC1D,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,IAAI,+EAA+E,IAAI,2BAA2B,CAAC,CAAC;QAC/J,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,SAAS,gEAAgE,CAAC,CAAC;QACnJ,EAAE,CAAC,GAAG,CAAC,eAAe,OAAO,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/K,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,QAAQ,CAAC,GAAG,SAAS,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAC3K,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;QACrF,MAAM,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,UAAU,EAAE,IAAI,IAAI,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;YAChM,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAC7G,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;IACxL,EAAE,CAAC,GAAG,CAAC,2BAA2B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,6BAA6B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;IAClI,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAE/C,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtC,EAAE,CAAC,GAAG,CAAC,qCAAqC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,sBAAsB,IAAI,+DAA+D,MAAM,CAAC,IAAI,uBAAuB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtK,CAAC;IACD,MAAM,WAAW,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,EAAE,CAAC,GAAG,CAAC,iDAAiD,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAwB,EAAE,EAAW,EAAE,IAAkB;IACpF,oHAAoH;IACpH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACpD,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;IAC1E,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAwB,EAAE,QAAgB,EAAE,EAAW;IAC7E,sBAAsB,CAAC,EAAE,cAAc,EAAE,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAClH,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,KAAM,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACjI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1E,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzJ,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,EAAE,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QACvN,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,eAAe,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAc,EAAE,EAAW,EAAE,IAAkB;IAClE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC/E,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,wBAAwB,IAAI,+BAA+B,CAAC,CAAC;IACzG,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,GAAG,IAAI,iEAAiE,CAAC,CAAC;IAC7G,IAAI,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,IAAI,gCAAgC,MAAM,CAAC,GAAG,0CAA0C,CAAC,CAAC;IAChI,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAE5D,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,IAAI,UAA8B,CAAC;IACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;QACpI,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACvI,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC;IACzB,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAC7B,mHAAmH;IACnH,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAAC,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,6CAA6C,IAAI,IAAI,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC,EAAE,CAAC;QAAC,CAAC;QAC5H,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7G,OAAO,IAAI,CAAC,GAAG,IAAI,oBAAoB,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,IAAI,+DAA+D,IAAI,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AACxG,CAAC;AAED,6HAA6H;AAC7H,KAAK,UAAU,SAAS,CAAC,MAAwB;IAC/C,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC,CAAC;IACpG,IAAI,CAAC,MAAM,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,6DAA6D,KAAK,CAAC,MAAM,CAAC,QAAQ,6DAA6D,CAAC,CAAC;IACtK,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,EAAW;IAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAC/D,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC;IAC/E,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC,EAAE,CAAC;IAAC,CAAC;IAChF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;IACrC,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3H,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAAC,CAAC;IACrG,MAAM,WAAW,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IACvE,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,EAAW;IAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACxF,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACxG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,CAAC;IAC5C,IAAI,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACrC,SAAS,CAAC;QACR,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;QAC3E,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,EAAW;IAC7C,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACvP,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAAC,EAAE,CAAC,GAAG,CAAC,wFAAwF,UAAU,EAAE,KAAK,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC,EAAE,CAAC;IAAC,CAAC;IAChK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACtK,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAc,EAAE,EAAW;IAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACjE,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC;IAC/E,IAAI,SAAS,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,sBAAsB,MAAM,CAAC,SAAS,sBAAsB,UAAU,EAAE,GAAG,CAAC,CAAC;IAClI,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9B,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,6BAA6B,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,EAAW;IAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtI,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QAAC,MAAM,eAAe,CAAC,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAAC,EAAE,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC,EAAE,CAAC;IAAC,CAAC;IACzJ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACjK,MAAM,eAAe,CAAC,WAAW,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACnE,EAAE,CAAC,GAAG,CAAC,uGAAuG,CAAC,CAAC;IAChH,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC"}

package/dist/agent/local/confine.d.ts

@@ -0,0 +1,20 @@
+import { type ChildProcess } from "node:child_process";
+import { type CredentialStore } from "../../credential-store.js";
+export declare const API_KEY_SERVICE = "frely-cli-local-agent-key-v1";
+/** Where the Agent's model calls go: the public gateway for frely.cloud, the relay itself elsewhere (development). */
+export declare function gatewayOrigin(relayUrl: string, env?: NodeJS.ProcessEnv): string;
+/** The key for the Agent's model calls: FRELY_API_KEY when set, else the one saved with `frely agent local key`. */
+export declare function readApiKey(origin: string, env?: NodeJS.ProcessEnv, store?: CredentialStore): Promise<string | undefined>;
+/**
+ * The environment of the Agent's program. Not the caller's environment: a key or token exported in the shell must not reach code
+ * from a repository. Package managers get caches inside the Agent's folder, the only place besides the temp folder they may write.
+ */
+export declare function agentEnv(workspace: string, hosts: {
+    model: boolean;
+}, base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export interface Confined {
+    child: ChildProcess;
+    violations(): string[];
+}
+/** Starts `command` inside the sandbox, in the Agent's own folder. Refused, never run bare, when this computer cannot sandbox it. */
+export declare function spawnConfined(command: string, workspace: string, env: NodeJS.ProcessEnv): Promise<Confined>;

package/dist/agent/local/confine.js

@@ -0,0 +1,52 @@
+import { spawn } from "node:child_process";
+import { join } from "node:path";
+import { credentialStore as secureCredentialStore } from "../../credential-store.js";
+import { sandboxCommandDetailed, sandboxViolationLines } from "../../runtime/sandbox.js";
+import { MODEL_HOST } from "./model-proxy.js";
+export const API_KEY_SERVICE = "frely-cli-local-agent-key-v1";
+/** Where the Agent's model calls go: the public gateway for frely.cloud, the relay itself elsewhere (development). */
+export function gatewayOrigin(relayUrl, env = process.env) {
+    const override = env.FRELY_GATEWAY_URL?.trim();
+    const url = new URL(override || relayUrl);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && ["127.0.0.1", "localhost", "::1"].includes(url.hostname)))
+        throw new Error("The Frely gateway must use HTTPS outside loopback development.");
+    if (!override && url.hostname === "frely.cloud")
+        return "https://api.frely.cloud";
+    return url.origin;
+}
+/** The key for the Agent's model calls: FRELY_API_KEY when set, else the one saved with `frely agent local key`. */
+export async function readApiKey(origin, env = process.env, store = secureCredentialStore) {
+    const fromEnv = env.FRELY_API_KEY?.trim();
+    if (fromEnv)
+        return fromEnv;
+    return (await store.getPassword(API_KEY_SERVICE, origin).catch(() => null)) ?? undefined;
+}
+const PASS_THROUGH = ["PATH", "HOME", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "TERM", "TZ", "TMPDIR", "SystemRoot"];
+/**
+ * The environment of the Agent's program. Not the caller's environment: a key or token exported in the shell must not reach code
+ * from a repository. Package managers get caches inside the Agent's folder, the only place besides the temp folder they may write.
+ */
+export function agentEnv(workspace, hosts, base = process.env) {
+    const env = {};
+    for (const name of PASS_THROUGH)
+        if (base[name] !== undefined)
+            env[name] = base[name];
+    const cache = join(workspace, ".cache");
+    Object.assign(env, { XDG_CACHE_HOME: cache, UV_CACHE_DIR: join(cache, "uv"), PIP_CACHE_DIR: join(cache, "pip"), npm_config_cache: join(cache, "npm"), BUN_INSTALL_CACHE_DIR: join(cache, "bun") });
+    if (hosts.model) {
+        const base = `http://${MODEL_HOST}`;
+        Object.assign(env, {
+            FRELY_MODEL_BASE_URL: `${base}/v1`,
+            OPENAI_BASE_URL: `${base}/v1`, OPENAI_API_BASE: `${base}/v1`, OPENAI_API_KEY: "frely-local-placeholder",
+            ANTHROPIC_BASE_URL: base, ANTHROPIC_API_KEY: "frely-local-placeholder",
+        });
+    }
+    return env;
+}
+/** Starts `command` inside the sandbox, in the Agent's own folder. Refused, never run bare, when this computer cannot sandbox it. */
+export async function spawnConfined(command, workspace, env) {
+    const wrapped = await sandboxCommandDetailed(command, workspace);
+    const child = spawn(wrapped.command, { cwd: workspace, env, shell: true, stdio: ["ignore", "pipe", "pipe"], detached: process.platform !== "win32", windowsHide: true });
+    return { child, violations: () => sandboxViolationLines(wrapped.commandId) };
+}
+//# sourceMappingURL=confine.js.map

package/dist/agent/local/confine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confine.js","sourceRoot":"","sources":["../../../src/agent/local/confine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,IAAI,qBAAqB,EAAwB,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAE9D,sHAAsH;AACtH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAClF,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC5M,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa;QAAE,OAAO,yBAAyB,CAAC;IAClF,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG,EAAE,QAAyB,qBAAqB;IACnI,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC;AAC3F,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAC;AAEnI;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAiB,EAAE,KAAyB,EAAE,OAA0B,OAAO,CAAC,GAAG;IAC1G,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,YAAY;QAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACnM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,UAAU,UAAU,EAAE,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE;YACjB,oBAAoB,EAAE,GAAG,IAAI,KAAK;YAClC,eAAe,EAAE,GAAG,IAAI,KAAK,EAAE,eAAe,EAAE,GAAG,IAAI,KAAK,EAAE,cAAc,EAAE,yBAAyB;YACvG,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,yBAAyB;SACvE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAID,qIAAqI;AACrI,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,SAAiB,EAAE,GAAsB;IAC5F,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACzK,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;AAC/E,CAAC"}

package/dist/agent/local/manifest.d.ts

@@ -0,0 +1,17 @@
+/** What `frely.yaml` says about running the repository on this computer (the `local:` section). */
+export interface LocalManifest {
+    /** Display name; the repository name when the file has none. */
+    name: string | undefined;
+    /** Runs once after the download, inside the sandbox. */
+    setup: string | undefined;
+    /** Starts the Agent, inside the sandbox. */
+    run: string;
+    /** Extra sites the Agent needs beyond Frely's API. Each one needs the owner's approval. */
+    network: readonly string[];
+}
+export declare class ManifestError extends Error {
+    constructor(message: string);
+}
+export declare function isApprovableHost(value: unknown): value is string;
+/** Reads the `local:` section of a repository's `frely.yaml`. Throws ManifestError with a sentence the person can act on. */
+export declare function parseManifest(text: string): LocalManifest;

package/dist/agent/local/manifest.js

@@ -0,0 +1,55 @@
+import { parse } from "yaml";
+export class ManifestError extends Error {
+    constructor(message) { super(message); this.name = "ManifestError"; }
+}
+const MAX_MANIFEST_BYTES = 64 * 1024;
+const MAX_COMMAND_CHARS = 500;
+const MAX_NETWORK_HOSTS = 20;
+/** A plain lower-case DNS name with at least one dot. No wildcards, ports, IP literals or `localhost`. */
+const HOST = /^(?=.{4,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,61}[a-z0-9]$/u;
+export function isApprovableHost(value) {
+    return typeof value === "string" && HOST.test(value) && !/^\d+(?:\.\d+)+$/u.test(value) && !value.endsWith(".localhost") && !value.endsWith(".local");
+}
+const asObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+function command(value, field, required) {
+    if (value === undefined || value === null) {
+        if (required)
+            throw new ManifestError(`frely.yaml: local.${field} is required.`);
+        return undefined;
+    }
+    if (typeof value !== "string" || value.trim() === "" || value.length > MAX_COMMAND_CHARS || /[\0\r\n]/u.test(value)) {
+        throw new ManifestError(`frely.yaml: local.${field} must be one line of at most ${MAX_COMMAND_CHARS} characters.`);
+    }
+    return value.trim();
+}
+/** Reads the `local:` section of a repository's `frely.yaml`. Throws ManifestError with a sentence the person can act on. */
+export function parseManifest(text) {
+    if (Buffer.byteLength(text, "utf8") > MAX_MANIFEST_BYTES)
+        throw new ManifestError("frely.yaml is larger than 64 KiB.");
+    let document;
+    try {
+        document = parse(text, { maxAliasCount: 0 });
+    }
+    catch (error) {
+        throw new ManifestError(`frely.yaml is not valid YAML: ${error instanceof Error ? error.message.split("\n")[0] : String(error)}`);
+    }
+    const root = asObject(document);
+    if (!root)
+        throw new ManifestError("frely.yaml must be a mapping.");
+    const local = asObject(root.local);
+    if (!local)
+        throw new ManifestError("frely.yaml has no local: section, so this repository cannot run on this computer. It needs local.run (and optionally local.setup).");
+    const name = root.name === undefined ? undefined : typeof root.name === "string" && root.name.trim() !== "" && root.name.length <= 100 && !/[\0\r\n]/u.test(root.name) ? root.name.trim() : (() => { throw new ManifestError("frely.yaml: name must be a short single line."); })();
+    const hosts = local.network ?? [];
+    if (!Array.isArray(hosts) || hosts.length > MAX_NETWORK_HOSTS)
+        throw new ManifestError(`frely.yaml: local.network must be a list of at most ${MAX_NETWORK_HOSTS} site names.`);
+    const network = [];
+    for (const host of hosts) {
+        if (!isApprovableHost(host))
+            throw new ManifestError(`frely.yaml: local.network entry ${JSON.stringify(host)} is not an exact site name such as pypi.org (no wildcards, ports or addresses).`);
+        if (!network.includes(host))
+            network.push(host);
+    }
+    return { name, setup: command(local.setup, "setup", false), run: command(local.run, "run", true), network };
+}
+//# sourceMappingURL=manifest.js.map

package/dist/agent/local/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../src/agent/local/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAc7B,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC;CAC9E;AAED,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,0GAA0G;AAC1G,MAAM,IAAI,GAAG,yFAAyF,CAAC;AAEvG,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxJ,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAuC,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE9L,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa,EAAE,QAAiB;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,IAAI,QAAQ;YAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,KAAK,eAAe,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpH,MAAM,IAAI,aAAa,CAAC,qBAAqB,KAAK,gCAAgC,iBAAiB,cAAc,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,kBAAkB;QAAE,MAAM,IAAI,aAAa,CAAC,mCAAmC,CAAC,CAAC;IACvH,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,aAAa,CAAC,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAC1M,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,+BAA+B,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,oIAAoI,CAAC,CAAC;IAC1K,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,aAAa,CAAC,+CAA+C,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpR,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB;QAAE,MAAM,IAAI,aAAa,CAAC,uDAAuD,iBAAiB,cAAc,CAAC,CAAC;IAC/K,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAC/L,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAE,EAAE,OAAO,EAAE,CAAC;AAC/G,CAAC"}

package/dist/agent/local/model-proxy.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The name the Agent's program uses for model access, as plain http:// (`OPENAI_BASE_URL=http://frely-model.local/v1`).
+ * The sandbox's own proxy hands every request for this name to the Unix socket below, so the request reaches this file and nothing else.
+ * The program therefore never holds a Frely credential: it sends a placeholder key, and the real one is added here, outside the sandbox.
+ */
+export declare const MODEL_HOST = "frely-model.local";
+export interface ModelProxyOptions {
+    socketPath: string;
+    /** The gateway origin, for example https://api.frely.cloud. */
+    upstream: string;
+    /** The `Authorization` header value for one upstream call. Read per call so a renewed credential is used. */
+    authorization(): Promise<string>;
+    fetchFn?: typeof fetch;
+}
+export interface ModelProxy {
+    close(): Promise<void>;
+}
+export declare function startModelProxy(options: ModelProxyOptions): Promise<ModelProxy>;

package/dist/agent/local/model-proxy.js

@@ -0,0 +1,111 @@
+import { createServer } from "node:http";
+import { chmod, mkdir, rm } from "node:fs/promises";
+import { dirname } from "node:path";
+import { Readable } from "node:stream";
+/**
+ * The name the Agent's program uses for model access, as plain http:// (`OPENAI_BASE_URL=http://frely-model.local/v1`).
+ * The sandbox's own proxy hands every request for this name to the Unix socket below, so the request reaches this file and nothing else.
+ * The program therefore never holds a Frely credential: it sends a placeholder key, and the real one is added here, outside the sandbox.
+ */
+export const MODEL_HOST = "frely-model.local";
+const MAX_BODY_BYTES = 16 * 1024 * 1024;
+/** Only the model calls: nothing about the account, keys or billing. */
+const ROUTES = new Map([
+    ["POST /v1/chat/completions", "POST"], ["POST /v1/responses", "POST"], ["POST /v1/embeddings", "POST"],
+    ["POST /v1/messages", "POST"], ["POST /v1/messages/count_tokens", "POST"], ["GET /v1/models", "GET"],
+]);
+/** Request headers passed on. Everything else, above all anything that authenticates, is dropped. */
+const FORWARD_REQUEST = ["content-type", "accept", "anthropic-version", "anthropic-beta", "openai-beta"];
+const FORWARD_RESPONSE = ["content-type", "cache-control", "retry-after", "x-request-id"];
+function reply(response, status, message) {
+    if (response.headersSent) {
+        response.destroy();
+        return;
+    }
+    response.writeHead(status, { "content-type": "application/json" });
+    response.end(JSON.stringify({ error: { message, type: "frely_local_proxy" } }));
+}
+/** The body, or undefined when it is over the limit. An oversize body is still read to its end (not kept) so the sender gets the refusal instead of a broken pipe. */
+async function readBody(request) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        size += chunk.length;
+        if (size > 4 * MAX_BODY_BYTES) {
+            request.destroy();
+            break;
+        }
+        if (size <= MAX_BODY_BYTES)
+            chunks.push(chunk);
+    }
+    return size > MAX_BODY_BYTES ? undefined : Buffer.concat(chunks);
+}
+export async function startModelProxy(options) {
+    const fetchFn = options.fetchFn ?? fetch;
+    const upstream = new URL(options.upstream);
+    const handle = async (request, response) => {
+        // The sandbox proxy sends an absolute URL; anything else did not come through it.
+        let url;
+        try {
+            url = new URL(request.url ?? "");
+        }
+        catch {
+            return reply(response, 404, "Unknown host.");
+        }
+        if (url.protocol !== "http:" || url.hostname !== MODEL_HOST)
+            return reply(response, 404, "Unknown host.");
+        const method = ROUTES.get(`${request.method} ${url.pathname}`);
+        if (!method)
+            return reply(response, 404, "This path is not available to a local Agent. It can call the model endpoints only.");
+        const body = method === "POST" ? await readBody(request) : undefined;
+        if (method === "POST" && body === undefined)
+            return reply(response, 413, "The request is larger than 16 MiB.");
+        const headers = new Headers();
+        for (const name of FORWARD_REQUEST) {
+            const value = request.headers[name];
+            if (typeof value === "string")
+                headers.set(name, value);
+        }
+        try {
+            headers.set("authorization", await options.authorization());
+        }
+        catch (error) {
+            return reply(response, 401, error instanceof Error ? error.message : "No Frely credential.");
+        }
+        const abort = new AbortController();
+        response.once("close", () => abort.abort());
+        let result;
+        try {
+            result = await fetchFn(new URL(url.pathname + url.search, upstream), { method, headers, ...(body ? { body: new Uint8Array(body) } : {}), redirect: "error", signal: abort.signal });
+        }
+        catch {
+            return reply(response, 502, "Frely could not be reached.");
+        }
+        const out = {};
+        for (const name of FORWARD_RESPONSE) {
+            const value = result.headers.get(name);
+            if (value !== null)
+                out[name] = value;
+        }
+        response.writeHead(result.status, out);
+        if (!result.body) {
+            response.end();
+            return;
+        }
+        const stream = Readable.fromWeb(result.body);
+        stream.once("error", () => response.destroy());
+        stream.pipe(response);
+    };
+    const server = createServer((request, response) => { handle(request, response).catch(() => reply(response, 500, "The local model proxy failed.")); });
+    await mkdir(dirname(options.socketPath), { recursive: true, mode: 0o700 });
+    await rm(options.socketPath, { force: true });
+    await new Promise((done, fail) => { server.once("error", fail); server.listen(options.socketPath, done); });
+    await chmod(options.socketPath, 0o600).catch(() => undefined);
+    return {
+        close: async () => {
+            await new Promise((done) => { server.close(() => done()); server.closeAllConnections(); });
+            await rm(options.socketPath, { force: true });
+        },
+    };
+}
+//# sourceMappingURL=model-proxy.js.map

package/dist/agent/local/model-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-proxy.js","sourceRoot":"","sources":["../../../src/agent/local/model-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAE9C,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC,wEAAwE;AACxE,MAAM,MAAM,GAAgC,IAAI,GAAG,CAAC;IAClD,CAAC,2BAA2B,EAAE,MAAM,CAAC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACtG,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,CAAC,gCAAgC,EAAE,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,KAAK,CAAC;CACrG,CAAC,CAAC;AACH,qGAAqG;AACrG,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,QAAQ,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,aAAa,CAAU,CAAC;AAClH,MAAM,gBAAgB,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,CAAU,CAAC;AAanG,SAAS,KAAK,CAAC,QAAwB,EAAE,MAAc,EAAE,OAAe;IACtE,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAAC,OAAO;IAAC,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,sKAAsK;AACtK,KAAK,UAAU,QAAQ,CAAC,OAAwB;IAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAClC,IAAI,IAAK,KAAgB,CAAC,MAAM,CAAC;QACjC,IAAI,IAAI,GAAG,CAAC,GAAG,cAAc,EAAE,CAAC;YAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM;QAAC,CAAC;QAC5D,IAAI,IAAI,IAAI,cAAc;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA0B;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,EAAE,OAAwB,EAAE,QAAwB,EAAiB,EAAE;QACzF,kFAAkF;QAClF,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;QAAC,CAAC;QACjG,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,oFAAoF,CAAC,CAAC;QAC/H,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;QAC/G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YAAC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QACrI,IAAI,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAAC,CAAC;QACpL,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5C,IAAI,MAAgB,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;YAAC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,KAAK,KAAK,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAAC,CAAC;QACvH,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAa,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9J,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClH,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACjG,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}