github-router 0.3.275 → 0.3.276

package/dist/claude-Cl4gYoOZ.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"claude-Cl4gYoOZ.js","names":["nodePath"],"sources":["../src/lib/injected-skills/artifact-review-skill.ts","../src/claude.ts"],"sourcesContent":["export const ARTIFACT_REVIEW_SKILL = {\n  name: \"gh-artifact-review\",\n  md: `---\nname: gh-artifact-review\ndescription: Reviews plans and artifacts in the ai-or-die panel. Defaults to authoring a self-contained HTML artifact (rich, annotatable, optionally interactive) and opening THAT for the human, then drains feedback with artifact_await, revises, and ends the loop. Use when running inside an ai-or-die tab and there is a plan, comparison, diagram, table, diff, or report the user should see before proceeding.\nuser-invocable: true\n---\n\n# gh-artifact-review: human review in the ai-or-die panel\n\nUse this when you finish a plan or produce something a user should review and you are inside an ai-or-die tab (the \\`mcp__peers__artifact_*\\` tools drive a live panel). The human can click any block or select text to attach a comment, and can click declarative action controls you emit — both come back to you as typed events.\n\n## Default: present HTML, not raw markdown\n\nHTML is the canonical review artifact — it renders richly and is annotatable element-by-element. When the content is anything visual or structured (a comparison, table, diagram, diff, dashboard, or a plan you want to look polished), **author a self-contained \\`.html\\` file** (inline CSS, no external deps, readable typography) and open THAT.\n\n- Plan-mode plans: the panel auto-opens them already rendered to HTML — you do not need to convert them by hand.\n- Do not paste raw markdown into an \\`.html\\`; write real HTML (headings, lists, tables, \\`<pre>\\` for code). Opening a raw \\`.md\\` still renders, but a purpose-built HTML artifact reads better and annotates cleanly.\n\n## When to reach for an artifact\n\nDefault to one for anything easier to grasp visually than as terminal prose: plans, design proposals, comparisons / trade-offs, decisions that need the user's input, diagrams / architecture, tables, code diffs, reports. Skip it only for trivial one-line answers.\n\n## Playbooks (what a good artifact of each type contains)\n\n- **plan**: goal, current state, the proposed approach (high-level decisions, not every line), then risks and open questions at the end.\n- **comparison**: options as columns, trade-offs as rows, current-vs-target where relevant, and an explicit recommendation. Do not make the reader infer the winner.\n- **table**: scannable rows, a sticky header, aligned numeric columns; group/section dense records rather than one flat wall.\n- **diagram**: boxes + arrows. Mermaid when automatic layout matters; positioned SVG/CSS when each node needs prose, code, or controls.\n- **code / diff**: \\`<pre>\\` with before/after or unified-diff styling; keep line context tight; call out the changed lines.\n- **report / dashboard**: lead with the headline number / verdict, then supporting detail; keep one idea per section.\n\n## Design system\n\nArtifacts stay portable (they must render identically opened standalone), so do not depend on a server-injected theme. Pick the look in priority order: (1) a look the user named; (2) the **subject project's** own design system, its Tailwind / theme config, CSS variables / tokens, component library, or existing styled pages, especially when the artifact previews that app's UI; (3) only when both come up empty, clean readable defaults (system font stack, generous spacing, a single accent).\n\n## Loop\n\n1. Open: \\`mcp__peers__artifact_open\\` with the absolute path of the \\`.html\\` (or the file). Pass \\`mode:\"interactive\"\\` when the HTML carries \\`data-aod-*\\` action controls (below). Relay the returned \\`viewUrl\\` and tell the user to review in the panel.\n2. Drain: \\`mcp__peers__artifact_await\\`. It long-holds for the human's next events and returns \\`{events, status, cursor}\\`. **Pass the returned \\`cursor\\` on your next call** so you only receive newer events; if \\`events\\` is empty, call again with that cursor.\n3. Act on each event by \\`kind\\`:\n   - \\`comment\\` — a free-text note anchored to the artifact (\\`selector\\`, quoted \\`text\\`, \\`sourceLine\\`); apply the requested change at that exact spot.\n   - \\`action\\` — the human clicked a control you emitted (\\`action\\` verb, \\`elementId\\`, optional \\`value\\`; a multi-select submit arrives as one action carrying the selected set). Do what the verb means (approve a step, choose an option, apply a toggle set).\n4. Reply: \\`mcp__peers__artifact_reply\\` with a concise summary of what you changed. Optionally \\`mcp__peers__artifact_update({file})\\` or \\`({html})\\` to replace the artifact content in place, or \\`mcp__peers__artifact_refresh\\` to reload it from disk.\n5. Repeat 2-4 until the user is satisfied; then \\`mcp__peers__artifact_end\\`. Use \\`mcp__peers__artifact_dismiss\\` to hide the panel while keeping the review alive (queued feedback preserved) if the user wants it out of the way without ending.\n\n### Push arrival (you do not have to be polling)\n\nWhen you are idle at the prompt, panel feedback can arrive on its own as a new turn (the tab injects it). Structured actions that answer a pending decision are routed to you directly. Either way, the durable record is the \\`artifact_await\\` drain, so when in doubt call \\`artifact_await\\` (with your last cursor) to reconcile — it replays anything you missed.\n\n### \\`artifact_poll\\` (frozen legacy)\n\n\\`mcp__peers__artifact_poll\\` still resolves for back-compat but returns the OLD payload (human comments only, no structured actions). Prefer \\`artifact_await\\`.\n\n## Interactive controls (data-aod-* authoring)\n\nTo let the human act on the artifact (not just comment), emit declarative controls; the panel wires them and delivers a typed \\`action\\` event. No JS in the artifact.\n\n- **choose-one (fires immediately):** each option is a button that posts the moment it is clicked.\n  \\`<button data-aod-action=\"choose\" data-aod-group=\"decision-1\" data-aod-id=\"opt-jwt\" data-aod-value=\"jwt\">JWT</button>\\`\n- **multi-select (toggle then submit):** checkboxes sharing a \\`data-aod-group\\`, plus one submit button with the same group. The submit delivers ONE action carrying \\`{group, selected:[{elementId, value?}]}\\`.\n  \\`<input type=\"checkbox\" data-aod-action=\"check\" data-aod-group=\"opts\" data-aod-id=\"a\" data-aod-value=\"a\">\\` … \\`<button data-aod-action=\"submit\" data-aod-group=\"opts\" data-aod-id=\"opts-submit\">Apply</button>\\`\n- **plan steps:** \\`<li class=\"aod-step\" data-aod-id=\"plan-step-3\" data-source-line=\"14\">\\` with per-step \\`data-aod-action=\"approve\"/\"skip\"\\` buttons.\n- **Required attrs:** \\`data-aod-action\\` (verb), \\`data-aod-id\\` (stable, echoed back as \\`elementId\\`; a control missing it is ignored), optional \\`data-aod-value\\`. Keep \\`data-source-line\\` for comment mapping.\n\n## Honest limits\n\n- If a tool errors (e.g. \\`NOT_IN_AIORDIE_TAB\\`, \\`UNREACHABLE\\`, \\`INVALID_REQUEST\\`), report the code/message verbatim; do not claim the panel opened.\n- The panel is a review surface, not an approver: outward/irreversible actions still need explicit user confirmation.\n`,\n} as const\n","import process from \"node:process\"\n\nimport { defineCommand, type ArgsDef } from \"citty\"\nimport consola from \"consola\"\n\nimport {\n  checkClaudeVersion,\n  updateClaude,\n} from \"./lib/claude-version-check\"\nimport { runSelfUpdate } from \"./lib/self-update\"\nimport {\n  injectPeerMcpIntoMirror,\n  resolveCodexCliBackend,\n  resolveGroupKeysFromMirror,\n  workersKeyOf,\n  writePeerMcpRuntimeFiles,\n} from \"./lib/codex-mcp-config\"\nimport { enableFileLogging } from \"./lib/file-log-reporter\"\nimport { getCodexVersion, launchChild } from \"./lib/launch\"\nimport { injectAllowRules, planModeAllowRules } from \"./lib/mcp-permissions-settings\"\nimport { listModelsForEndpoint } from \"./lib/model-validation\"\nimport { ensureClaudeConfigMirror, PATHS, removeOwnClaudeConfigMirror, writeArtifactCredsToMirror } from \"./lib/paths\"\nimport {\n  buildArtifactOpenHookCommand,\n  buildSessionBindHookCommand,\n  buildStopHookCommand,\n  captureLaunchBaseline,\n  injectStopHookIntoSettingsFile,\n  stopGateId,\n  stopGateDisabled,\n} from \"./lib/orchestration/stop-gate-hook\"\nimport { buildPlanReviewHookCommand, planReviewEnabled } from \"./lib/orchestration/plan-review-hook\"\nimport {\n  fileBaselineStore,\n  repoFingerprint,\n  repoRoot,\n  stopGateEnabledForRepo,\n  trustRepo,\n} from \"./lib/orchestration/stop-gate-policy\"\nimport {\n  checksForDescriptor,\n  descriptorHash,\n  parseGateDescriptor,\n  type GateDescriptor,\n} from \"./lib/orchestration/harness-parse\"\nimport {\n  discoverGateCommands,\n  readDiscoveredGate,\n  sourcesHash,\n  writeDiscoveredGate,\n} from \"./lib/orchestration/gate-discovery\"\nimport { liveExec } from \"./lib/orchestration/live-exec\"\nimport { hookMcpRuntimeFromEnv } from \"./lib/orchestration/hook-mcp-client\"\nimport { buildPromptSubmitHookCommand } from \"./lib/orchestration/prompt-submit-hook\"\nimport {\n  FIRST_MATE_GUARD_MATCHER,\n  buildFirstMateGuardHookCommand,\n} from \"./internal-first-mate-guard\"\nimport { assertShapingInstalled } from \"./lib/first-mate/operator-shaping\"\nimport {\n  activeDispatchModes,\n  buildWorkerGuardHookCommand,\n  guardToolMatcher,\n} from \"./lib/worker-dispatch\"\nimport { ARTIFACT_REVIEW_SKILL, INJECTED_SKILLS, writeInjectedSkill } from \"./lib/injected-skills\"\nimport { shouldUseInsecureTls } from \"./lib/artifact/tools\"\nimport { parseBoolEnv } from \"./lib/exec\"\nimport nodePath from \"node:path\"\nimport { tmpdir } from \"node:os\"\nimport { randomBytes } from \"node:crypto\"\nimport { buildPeerAwarenessSnippet, buildPeerAwarenessSummary, type McpGroup } from \"./lib/peer-mcp-personas\"\nimport { injectAttributionSuppressionIntoSettingsFile } from \"./lib/attribution-settings\"\nimport { appendPeerAwarenessToMirroredClaudeMd, appendToolbeltAwarenessToMirroredClaudeMd, OPERATING_DEFAULTS_DIGEST, prependArtifactPanelDirectiveToMirroredClaudeMd, prependOperatingDefaultsToMirroredClaudeMd, prependStyleDirectiveToMirroredClaudeMd } from \"./lib/claude-md-injection\"\nimport { availableToolCommands, buildToolbeltAwareness, toolbeltEnabled } from \"./lib/toolbelt\"\nimport { provisionToolbelt } from \"./lib/toolbelt/provision\"\nimport { colbertDegradedWarning, provisionAndIndexColbert } from \"./lib/colbert\"\nimport { startKeepAwake, stopKeepAwake } from \"./lib/keep-awake\"\nimport { warmTreeSitterPool } from \"./lib/tree-sitter-pool/pool\"\nimport { provisionBrowserAssets } from \"./lib/browser-mcp/provision\"\nimport {\n  DEFAULT_CLAUDE_MODEL_FALLBACKS,\n  pickClaudeDefault,\n} from \"./lib/port\"\nimport {\n  agentToolsEnabled,\n  artifactToolsEnabled,\n  browseAgentEnabled,\n  browserCompoundToolsEnabled,\n  browserToolsEnabled,\n  fleetToolsEnabled,\n  geminiAvailable,\n  nativeSubagentModel,\n  brainstormModel,\n  reviewerModel,\n  scoutModel,\n  scribeModel,\n  standInToolEnabled,\n  workerToolsEnabled,\n} from \"./lib/mcp-capabilities\"\nimport {\n  getClaudeCodeEnvVars,\n  parseSharedArgs,\n  setupAndServe,\n  sharedServerArgs,\n} from \"./lib/server-setup\"\nimport { state } from \"./lib/state\"\nimport { resolveModel } from \"./lib/utils\"\n\nfunction isFirstMateSkillName(name: string): boolean {\n  return (\n    name === \"gh-first-mate\" ||\n    name === \"gh-first-mate-scaffold\" ||\n    name === \"gh-first-mate-operate\" ||\n    name === \"gh-first-mate-conduct\"\n  )\n}\n\nexport const claudeArgs = {\n  ...sharedServerArgs,\n  model: {\n    alias: \"m\",\n    type: \"string\",\n    description:\n      \"Override the default model for Claude Code. Accepts a full slug (e.g. claude-opus-4-7) or an Opus family shorthand (e.g. 4.7, 4.8, 4.6) which expands to the best variant for that family — adding the [1m] suffix when a 1M-context backend is in the catalog.\",\n  },\n  \"codex-mcp\": {\n    type: \"boolean\" as const,\n    default: true,\n    description:\n      \"Wire peer-model MCP personas (codex-critic, codex-reviewer, gemini-critic) into the spawned Claude Code session\",\n  },\n  \"codex-cli\": {\n    type: \"boolean\" as const,\n    default: false,\n    description:\n      \"Add a `codex mcp-server` stdio backend so codex-implementer can mutate files. Requires codex CLI 0.129+; gracefully falls back to HTTP-only if absent.\",\n  },\n  \"codex-mcp-only\": {\n    type: \"boolean\" as const,\n    default: false,\n    description:\n      \"Pass --strict-mcp-config to claude code so only github-router's MCP servers are loaded (hides user's existing MCP servers)\",\n  },\n  stealth: {\n    type: \"boolean\" as const,\n    default: false,\n    description:\n      \"Opt back into VS Code-only beta header filtering. Loses leverage features (task budgets, token-efficient tools, prompt caching, etc.) but minimizes the wire-fingerprint difference from VS Code Copilot Chat. By default the `claude` subcommand enables extended/leverage betas because the spawned Claude Code already identifies itself via UA and other headers — partial stealth doesn't buy much.\",\n  },\n  \"trust-gate\": {\n    type: \"boolean\" as const,\n    default: false,\n    description:\n      \"Explicitly record consent for the structural Stop-gate in THIS repo (pinned to the repo's root-commit). The gate is ON BY DEFAULT when a harness is detected (consent-by-launching), so this is now mostly redundant; it stays for explicit/scripted use. Disable the gate entirely with GH_ROUTER_DISABLE_STOP_GATE=1.\",\n  },\n  \"no-stop-gate\": {\n    type: \"boolean\" as const,\n    default: false,\n    description:\n      \"Disable the structural Stop-gate for THIS session (same effect as GH_ROUTER_DISABLE_STOP_GATE=1). Intended for driven/automated sessions where a blocking Stop hook would hang the turn-end while a fleet driver waits.\",\n  },\n  \"auto-update\": {\n    type: \"boolean\" as const,\n    default: true,\n    description:\n      \"Check for and install the latest Claude Code on launch via `claude update` (throttled to once per hour via ~/.local/share/github-router/last-update-check). `claude update` respects the real install method (native installer or npm), so it never creates a conflicting second install; builds too old to support it fall back to `npm install -g @anthropic-ai/claude-code@latest`. Set to false (--no-auto-update) to check and warn only. Falls back gracefully if claude/npm/network unavailable.\",\n  },\n  \"update-check\": {\n    type: \"boolean\" as const,\n    default: true,\n    description:\n      \"Check the npm registry for a newer Claude Code version on launch and warn if stale (non-blocking ~500ms cost). Set to false (--no-update-check) to skip the check entirely (useful for offline/CI). Independent from --auto-update: --no-update-check implies no auto-install (nothing to install since we never check).\",\n  },\n} satisfies ArgsDef\n\n/**\n * Build the argv to forward to the spawned `claude` child from citty's\n * rawArgs (every token after the `claude` subcommand). citty is non-strict,\n * so an unknown flag such as `--print`/`-p`… `--output-format` is absorbed\n * into the parsed `args` object AND its value swallowed, instead of landing\n * in `args._`; forwarding only `args._` therefore drops headless flags unless\n * the user wrapped them in `--`. Here we walk rawArgs and forward every token\n * that is NOT one of github-router's OWN declared flags (or that flag's\n * consumed value). Everything after a literal `--` is forwarded verbatim,\n * preserving the prior explicit-passthrough behavior.\n *\n * A child flag whose NAME collides with a github-router flag (`-p`/`--port`,\n * `-v`/`--verbose`, `-m`/`--model`, `-a`/`--account-type`, `-r`/`--rate-limit`,\n * `-g`/`--github-token`) is owned by github-router; forward it to the child\n * explicitly after `--` (e.g. `github-router claude -- -p`). Every other Claude\n * flag (`--print`, `--output-format`, `--resume`, `--continue`, …) flows\n * through automatically.\n */\nexport function collectChildPassthroughArgs(\n  rawArgs: ReadonlyArray<string>,\n  argsDef: ArgsDef,\n): string[] {\n  const known = new Set<string>()\n  const stringTyped = new Set<string>()\n  for (const [name, def] of Object.entries(argsDef)) {\n    const rawAlias = \"alias\" in def ? def.alias : undefined\n    const aliases =\n      rawAlias === undefined\n        ? []\n        : Array.isArray(rawAlias)\n          ? rawAlias\n          : [rawAlias]\n    for (const n of [name, ...aliases]) {\n      known.add(n)\n      if (def.type === \"string\") stringTyped.add(n)\n    }\n  }\n\n  const forwarded: string[] = []\n  for (let i = 0; i < rawArgs.length; i++) {\n    const tok = rawArgs[i]\n    // Explicit passthrough separator: forward everything after `--` verbatim\n    // (matches the prior `args._`-only behavior, where citty routed post-`--`\n    // tokens into `_`).\n    if (tok === \"--\") {\n      forwarded.push(...rawArgs.slice(i + 1))\n      break\n    }\n    // A bare `-` or a non-dash token is a positional / value → forward.\n    if (tok === \"-\" || !tok.startsWith(\"-\")) {\n      forwarded.push(tok)\n      continue\n    }\n    const doubleDash = tok.startsWith(\"--\")\n    const afterDashes = tok.slice(doubleDash ? 2 : 1)\n    const eq = afterDashes.indexOf(\"=\")\n    const rawName = eq >= 0 ? afterDashes.slice(0, eq) : afterDashes\n    const hasInlineValue = eq >= 0\n    const negated = doubleDash && rawName.startsWith(\"no-\")\n    const baseName = negated ? rawName.slice(3) : rawName\n\n    const isKnown = known.has(rawName) || (negated && known.has(baseName))\n    if (!isKnown) {\n      // Unknown to github-router → belongs to the child claude (e.g. --print).\n      forwarded.push(tok)\n      continue\n    }\n    // Own flag: drop it. Also drop a separately-tokenized value for a\n    // string-typed flag written as `--flag value` / `-a value` (no inline\n    // `=`, next token present and not itself a flag). Booleans and `--no-…`\n    // negations never consume a following token under citty/mri.\n    const consumesValue =\n      !negated\n      && !hasInlineValue\n      && stringTyped.has(rawName)\n      && i + 1 < rawArgs.length\n      && rawArgs[i + 1] !== \"--\"\n      && !rawArgs[i + 1].startsWith(\"-\")\n    if (consumesValue) i++\n  }\n  return forwarded\n}\n\nexport const claude = defineCommand({\n  meta: {\n    name: \"claude\",\n    description: \"Start the proxy server and launch Claude Code\",\n  },\n  args: claudeArgs,\n  async run({ args, rawArgs }) {\n    if (!process.stdout.isTTY) {\n      consola.error(\"The claude subcommand requires a TTY (interactive terminal).\")\n      process.exit(1)\n    }\n\n    const parsed = parseSharedArgs(args as unknown as Record<string, unknown>)\n\n    // Phase E P2.2: stealth-vs-leverage policy.\n    // The `claude` subcommand defaults to LEVERAGE mode (extended-betas\n    // ON) because the spawned Claude Code already identifies itself via\n    // UA / editor-version / x-app headers — partial stealth doesn't\n    // meaningfully reduce the wire fingerprint, and the cost of stealth\n    // is losing features the user explicitly chose to install Claude\n    // Code for (--max-budget-usd, token-efficient tools, prompt caching,\n    // structured outputs, MCP, etc.).\n    //\n    // The `--stealth` flag opts back into the VS Code-only filter for\n    // users who specifically want minimal wire diff over leverage.\n    // The shared `--extended-betas` flag still works (treated as alias).\n    //\n    // Note: `advisor-tool-` is stripped in BOTH modes regardless of this\n    // setting (Phase A: Copilot 400s on it). ADVISOR will be served via\n    // Phase I's proxy-side translate path independently.\n    if (args.stealth) {\n      // Stealth wins if explicitly requested.\n      parsed.extendedBetas = false\n      consola.info(\n        \"Stealth mode: VS Code-only beta filtering. Leverage features disabled.\",\n      )\n    } else if (!args[\"extended-betas\"]) {\n      // No explicit --extended-betas AND no --stealth → default ON.\n      parsed.extendedBetas = true\n    }\n    // If user passed --extended-betas explicitly, parsed already reflects it.\n\n    // Phase H P2: Claude Code version check + opt-in auto-update.\n    // Default: check + auto-install if newer version available\n    // (throttled to once per hour). The user explicitly chose to install\n    // a Claude Code wrapper — they want the latest features and bug\n    // fixes. Opt-out via --no-auto-update (check only, warn) or\n    // --no-update-check (silence entirely). Best-effort: skips silently\n    // if npm is offline or claude is not on PATH. The check happens\n    // BEFORE setupAndServe so a stale version doesn't get spawned.\n    if (args[\"update-check\"] !== false) {\n      try {\n        const versionCheck = await checkClaudeVersion({\n          noCheck: false,\n        })\n        if (versionCheck.skipped && versionCheck.skipReason === \"no-claude\") {\n          // Claude isn't on PATH — let launchChild surface the more\n          // contextual \"claude not found\" error in the spawn step.\n          consola.debug(\n            \"claude --version probe failed; skipping auto-update.\",\n          )\n        } else if (versionCheck.skipped && versionCheck.skipReason === \"no-npm\") {\n          // npm view failed — likely offline. Don't block launch.\n          consola.debug(\n            \"npm view @anthropic-ai/claude-code failed; skipping auto-update check (likely offline).\",\n          )\n        } else if (\n          versionCheck.needsUpdate\n          && versionCheck.installedVersion\n          && versionCheck.latestVersion\n        ) {\n          if (args[\"auto-update\"] !== false) {\n            try {\n              await updateClaude(versionCheck.latestVersion)\n            } catch (err) {\n              const msg = err instanceof Error ? err.message : String(err)\n              consola.warn(\n                `Auto-update of Claude Code from ${versionCheck.installedVersion} to ${versionCheck.latestVersion} failed (${msg}); continuing with installed version. Run \\`claude update\\` (or \\`npm install -g @anthropic-ai/claude-code@latest\\`) manually to retry.`,\n              )\n            }\n          } else {\n            consola.warn(\n              `Claude Code v${versionCheck.installedVersion} is installed; v${versionCheck.latestVersion} is available. Run with --auto-update (the default) to install on launch, or \\`claude update\\` manually.`,\n            )\n          }\n        }\n      } catch (err) {\n        // Whole version-check should never block launch.\n        consola.debug(\"Claude version check failed:\", err)\n      }\n    }\n\n    let server: Awaited<ReturnType<typeof setupAndServe>>[\"server\"]\n    let serverUrl: string\n    try {\n      const result = await setupAndServe({\n        ...parsed,\n        port: parsed.port, // undefined = random port\n        silent: true,\n      })\n      server = result.server\n      serverUrl = result.serverUrl\n    } catch (error) {\n      consola.error(\"Failed to start server:\", error instanceof Error ? error.message : error)\n      process.exit(1)\n    }\n\n    // Queue a best-effort self-update of github-router itself (detached,\n    // applies next launch). Fire-and-forget so the bounded npm probe\n    // never delays spawning Claude Code.\n    void runSelfUpdate({ selfUpdate: args[\"self-update\"] !== false })\n\n    // Provision the router-owned CLAUDE_CONFIG_DIR with our synthetic\n    // .credentials.json + a snapshot copy of the user's ~/.claude/.\n    // The spawned Claude Code (and any teammates it spawns via the\n    // agent-teams primitive) reads this dir instead of ~/.claude/,\n    // finds our synthetic credential, and authenticates — closing the\n    // teammate-spawn allowlist gap that drops ANTHROPIC_AUTH_TOKEN.\n    // See ensureClaudeConfigMirror in src/lib/paths.ts.\n    //\n    // Run BEFORE enableFileLogging so a fatal credentials-write failure\n    // surfaces on the user's terminal (we only throw on the credentials\n    // write — copy failures of individual user files are debug-logged\n    // and skipped).\n    try {\n      await ensureClaudeConfigMirror()\n    } catch (err) {\n      consola.error(\n        `Failed to provision CLAUDE_CONFIG_DIR mirror: ${\n          err instanceof Error ? err.message : String(err)\n        }. Spawned Claude Code would not be able to authenticate.`,\n      )\n      process.exit(1)\n    }\n\n    enableFileLogging() // redirect errors/warnings to file; suppress terminal output\n\n    // Two slugs flow through this code:\n    //   * `chosenSlug` — the value we set for `ANTHROPIC_MODEL`. Must be an\n    //     Anthropic-published slug (e.g. `claude-opus-4-8`) so Claude Code's\n    //     hardcoded `/model` registry matches it and the UI shows the right\n    //     menu entry. The proxy's resolver translates this back to a Copilot\n    //     slug at request time, so the actual upstream call still works.\n    //   * `resolvedSlug` — the Copilot-side slug after `resolveModel`. Used\n    //     only for cache-presence validation (fallback chain) and the\n    //     launch banner.\n    //\n    // For the implicit-default path only, we walk\n    // DEFAULT_CLAUDE_MODEL_FALLBACKS when neither the default nor any\n    // earlier fallback resolves to a model present in the Copilot cache.\n    // Explicit `--model` is respected as-is — including Copilot slugs\n    // (which Claude Code's UI won't recognize, but power users may want\n    // for explicit pinning).\n    // `-m 4.7` / `-m 4.8` shorthand: treat a bare \"N.M\" value as an\n    // Opus-family preference and let pickClaudeDefault pick the best\n    // variant for that family (adding [1m] when an opus-N.M-1m backend\n    // exists in the catalog). Full slugs and any non-matching string\n    // continue to pass through unchanged. `usingDefault` stays false\n    // for shorthand so the DEFAULT_CLAUDE_MODEL_FALLBACKS walk doesn't\n    // override an explicit family request with the next-older Opus.\n    const usingDefault = !args.model\n    const opusFamilyShorthand = args.model?.match(/^(\\d+\\.\\d+)$/)?.[1]\n    const requestedSlug = opusFamilyShorthand\n      ? pickClaudeDefault(opusFamilyShorthand)\n      : (args.model ?? pickClaudeDefault())\n    let chosenSlug = requestedSlug\n    let resolvedSlug = resolveModel(chosenSlug)\n\n    if (usingDefault && state.models) {\n      const inCache = (slug: string) =>\n        state.models?.data.some((m) => m.id === resolveModel(slug)) ?? false\n      if (!inCache(chosenSlug)) {\n        for (const fallback of DEFAULT_CLAUDE_MODEL_FALLBACKS) {\n          if (inCache(fallback)) {\n            // Re-derive through pickClaudeDefault so 1M detection runs against\n            // the FALLBACK's own family. The constant holds bare slugs, so\n            // assigning one directly silently drops [1m] accounting on a\n            // family that is 1M-capable — the user lands on a working model\n            // with a 200k context budget it did not need to accept.\n            // `inCache` already proved the family is present, so this cannot\n            // trigger pickClaudeDefault's family-absent warning.\n            const fallbackSlug = pickClaudeDefault(\n              fallback.replace(/^claude-opus-/, \"\"),\n            )\n            consola.info(\n              `Default model \"${chosenSlug}\" not in your Copilot model list; falling back to \"${fallbackSlug}\".`,\n            )\n            chosenSlug = fallbackSlug\n            resolvedSlug = resolveModel(fallbackSlug)\n            break\n          }\n        }\n      }\n    }\n\n    if (resolvedSlug !== chosenSlug) {\n      consola.info(`Model \"${chosenSlug}\" resolved to \"${resolvedSlug}\"`)\n    }\n    const modelEntry = state.models?.data.find((m) => m.id === resolvedSlug)\n    if (!modelEntry) {\n      const available = listModelsForEndpoint(\"/v1/messages\")\n      consola.warn(\n        `Model \"${resolvedSlug}\" not found. Available claude models: ${available.join(\", \")}`,\n      )\n    }\n\n    // Banner shows the round-trip so the user sees both names. Claude Code's\n    // UI will display the chosenSlug; Copilot upstream sees resolvedSlug.\n    const banner =\n      chosenSlug === resolvedSlug\n        ? chosenSlug\n        : `${chosenSlug} → ${resolvedSlug}`\n    // Print to stderr directly — consola's terminal reporter is already gone\n    process.stderr.write(`Server ready on ${serverUrl}, launching Claude Code (${banner})...\\n`)\n\n    const envVars = getClaudeCodeEnvVars(serverUrl, chosenSlug)\n    // Forward unrecognized flags (e.g. --print / --output-format / --resume)\n    // to the spawned Claude Code child. citty is non-strict, so those land in\n    // the parsed `args` object with their values swallowed rather than in\n    // `args._`; walking rawArgs and dropping only github-router's OWN flags\n    // makes `github-router claude -m <model> --print \"…\"` work headless\n    // without requiring the `--` separator. See collectChildPassthroughArgs.\n    const extraArgs = collectChildPassthroughArgs(rawArgs, claudeArgs)\n\n    // LLM toolbelt: materialize curated CLI tools (rg/fd/jq/sd/sg/yq)\n    // into the router bin dir prepended to the agent's PATH (the prepend\n    // itself is done in getClaudeCodeEnvVars). Materialization runs in\n    // the BACKGROUND so it never delays launch; the awareness one-liner\n    // lists EVERY curated tool reachable this launch (system installs +\n    // the toolbelt bin), appended to the mirrored CLAUDE.md so the main\n    // agent AND descendants know which fast tools to prefer. Best-effort.\n    if (toolbeltEnabled()) {\n      void provisionToolbelt().catch((err) =>\n        consola.debug(\"Toolbelt provisioning failed:\", err),\n      )\n      const toolbeltLine = buildToolbeltAwareness(availableToolCommands())\n      if (toolbeltLine) {\n        try {\n          await appendToolbeltAwarenessToMirroredClaudeMd(toolbeltLine)\n        } catch (err) {\n          consola.warn(\n            `Toolbelt CLAUDE.md append failed: ${\n              err instanceof Error ? err.message : String(err)\n            }`,\n          )\n        }\n      }\n    }\n\n    // Best-effort ColBERT semantic-search provision + background index of\n    // the launch cwd (if a git repo). ON by default; never blocks launch,\n    // never throws. Opt out with GH_ROUTER_DISABLE_SEMANTIC_SEARCH=1.\n    void provisionAndIndexColbert()\n\n    // Surface a terminally-failed semantic index to the HUMAN. Without this\n    // the only signals are a `notice` the model reads and a log line, so a\n    // degraded index can (and did) go unnoticed for weeks. Fire-and-forget:\n    // lexical search still works, so this must never delay or fail a launch.\n    void colbertDegradedWarning(undefined, { logsToFile: true })\n      .then((warning) => {\n        if (warning) process.stderr.write(`${warning}\\n`)\n      })\n      .catch(() => {})\n\n    // Best-effort, bounded launch warm-up: ready one tree-sitter worker.\n    // Opt out with GH_ROUTER_DISABLE_TS_POOL_WARMUP=1.\n    void warmTreeSitterPool()\n\n    // Best-effort: keep the machine awake while the proxy/Claude Code\n    // session runs (win32 default-on; opt out GH_ROUTER_DISABLE_KEEP_AWAKE=1).\n    // Released via stopKeepAwake() in the shutdown chain below AND via the\n    // module's own self-registered SIGINT/SIGTERM/exit reaper.\n    startKeepAwake()\n\n    // Best-effort: materialize the browser extension + bridge into the\n    // stable app-dir and stamp the running version, so a one-time \"Load\n    // unpacked\" survives npx/bunx upgrades. Gated on --browse; never\n    // blocks launch, never throws.\n    if (browserToolsEnabled()) {\n      void provisionBrowserAssets().catch((err) =>\n        consola.debug(\"Browser extension provisioning failed:\", err),\n      )\n    }\n\n    // Peer-MCP wiring. Default-on. When enabled:\n    //   1. Decide between HTTP backend (always works, read-only personas)\n    //      and the `--codex-cli` stdio backend (requires codex 0.129+,\n    //      adds the implementer persona).\n    //   2. Probe the live Copilot catalog for gemini-3.1-pro-preview.\n    //   3. Generate a per-launch nonce, write the MCP config tempfile\n    //      under PATHS.CLAUDE_RUNTIME_DIR with mode 0o600, AND write\n    //      one .md subagent file per peer agent into ~/.claude/agents/\n    //      (Phase 2.5 — `--agents` JSON does NOT populate Claude Code's\n    //      Task subagent_type enum on v2.1.138; .md files in the canonical\n    //      agents dir do).\n    //   4. Inject `--mcp-config <path>` into the spawned Claude Code's\n    //      argv. Add `--strict-mcp-config` if the user explicitly opts\n    //      out of their existing MCP servers. The `--agents` JSON path\n    //      is intentionally NOT passed: the .md registration in the\n    //      canonical agents dir is the authoritative surface.\n    //   5. Plumb `cleanup()` into launchChild's onShutdown so tempfiles\n    //      are unlinked on signal exit.\n    //\n    // The per-launch CLAUDE_CONFIG_DIR mirror is ALWAYS cleaned up on\n    // shutdown (regardless of codex-mcp), since `ensureClaudeConfigMirror`\n    // above always provisioned it. We chain the peer-MCP cleanup\n    // (if any) ahead of the mirror removal so files inside the mirror\n    // get unlinked first via known paths; the recursive `fs.rm` is\n    // belt-and-braces for everything else.\n    const baseShutdown = async (): Promise<void> => {\n      await stopKeepAwake()\n      await removeOwnClaudeConfigMirror()\n    }\n    let onShutdown: () => Promise<void> = baseShutdown\n    // Captured inside the codex-mcp block (when built) so the always-on\n    // operating-defaults injection below can ride the peer-awareness snippet\n    // along in the SAME --append-system-prompt arg. Undefined when codex-mcp is\n    // off (then only the operating-defaults directive is injected).\n    let peerAwarenessSnippet: string | undefined\n    let peerAwarenessSummary: string | undefined\n    const codexMcpEnabled = (args as Record<string, unknown>)[\"codex-mcp\"] !== false\n    if (codexMcpEnabled) {\n      try {\n        const requestedCli =\n          ((args as Record<string, unknown>)[\"codex-cli\"] as boolean | undefined) ?? false\n        const backend = resolveCodexCliBackend({\n          requested: requestedCli,\n          codexInfo: requestedCli ? getCodexVersion() : null,\n        })\n        const geminiModelsAvailable = geminiAvailable()\n        if (!geminiModelsAvailable) {\n          consola.info(\n            \"gemini-3.1-pro-preview not found in your Copilot model catalog; gemini-critic persona will not be registered.\",\n          )\n        }\n\n        // Which scoped MCP servers to register. `peers` + `search` are\n        // always on; `workers` / `decide` / `browser` only when their gate\n        // passes at launch (avoids registering a server whose tools would\n        // all be filtered out of tools/list). Resolve each group's\n        // `.claude.json` config key ONCE (bare, or `gh-router-<group>` on\n        // collision) and thread it into every channel — the mcpServers\n        // entries, the persona .md routing strings, and the awareness\n        // snippet — so a user-side `browser`/`search` MCP never silently\n        // hijacks or drops one of ours.\n        const enabledGroups: Array<McpGroup> = [\"peers\", \"search\", \"orchestrate\"]\n        if (workerToolsEnabled()) enabledGroups.push(\"workers\")\n        if (standInToolEnabled()) enabledGroups.push(\"decide\")\n        if (browserToolsEnabled()) enabledGroups.push(\"browser\")\n        if (fleetToolsEnabled()) enabledGroups.push(\"fleet\")\n        if (agentToolsEnabled()) enabledGroups.push(\"first-mate\")\n        const { keys: groupKeys, skipped: skippedGroups } =\n          await resolveGroupKeysFromMirror(enabledGroups)\n\n        const runtime = await writePeerMcpRuntimeFiles(serverUrl, {\n          codexCli: backend === \"cli\",\n          geminiAvailable: geminiModelsAvailable,\n          groupKeys,\n          workerToolsAvailable: workerToolsEnabled(),\n          browseAvailable: browseAgentEnabled(),\n          nativeSubagentModel: nativeSubagentModel(),\n          reviewerModel: reviewerModel(),\n          brainstormModel: brainstormModel(),\n          scoutModel: scoutModel(),\n          scribeModel: scribeModel(),\n        })\n        state.peerMcpNonce = runtime.nonce\n        // Reach-back channel for the advisory-review hooks (hook V2): the\n        // detached Stop reviewer and the UserPromptSubmit hook run as separate\n        // processes with no in-proc state, so they call the proxy over loopback\n        // HTTP using this URL + the per-launch nonce (the same nonce the /mcp\n        // handler validates). Set on the spawned child's env so the hooks — and\n        // the detached reviewer they spawn — inherit it.\n        envVars.GH_ROUTER_HOOK_MCP_URL = serverUrl\n        envVars.GH_ROUTER_HOOK_NONCE = runtime.nonce\n        onShutdown = async (): Promise<void> => {\n          await runtime.cleanup()\n          await baseShutdown()\n        }\n\n        // Subagent MCP visibility: inject `gh-router-peers` (and the\n        // `codex-cli` stdio entry when enabled) into the mirrored\n        // `<CLAUDE_CONFIG_DIR>/.claude.json` so subagents — Agent-tool\n        // subagents, forks, agent-teams subprocesses — discover the peer\n        // MCP from persistent (user-scope) config rather than the parent's\n        // ephemeral --mcp-config CLI flag. Same nonce as runtime files\n        // (the proxy validates Authorization against the launch nonce\n        // regardless of which channel the request came through).\n        //\n        // On collision with a user-side entry of the same name, this\n        // returns ok:false; we then keep --mcp-config as the fallback so\n        // at least the parent session retains the peer tools (subagents\n        // remain blind in that case, by design — explicit branch, not\n        // silent precedence).\n        const injected = await injectPeerMcpIntoMirror(serverUrl, {\n          codexCli: backend === \"cli\",\n          geminiAvailable: geminiModelsAvailable,\n          groupKeys,\n          nonce: runtime.nonce,\n        })\n\n        // Channel selection: prefer the mirror (subagent-visible) when\n        // injection succeeded. Only fall back to --mcp-config when\n        // injection refused due to a user-side collision. Pushing BOTH\n        // would register the same server name twice (mirror + CLI flag),\n        // which is ambiguous across Claude Code versions.\n        if (!injected.ok) {\n          extraArgs.push(\"--mcp-config\", runtime.mcpConfigPath)\n          if ((args as Record<string, unknown>)[\"codex-mcp-only\"] === true) {\n            extraArgs.push(\"--strict-mcp-config\")\n          }\n        } else if ((args as Record<string, unknown>)[\"codex-mcp-only\"] === true) {\n          // User asked for strict-MCP-only but the mirror inject path\n          // can't enforce that (other user-scope MCPs already in the\n          // mirror's snapshot are visible). Warn so the flag's mismatch\n          // with the new behavior is obvious.\n          consola.warn(\n            \"--codex-mcp-only has no effect when peer MCP is wired via the \"\n              + \"mirrored .claude.json (the user's existing user-scope MCPs in \"\n              + \"the snapshot are still visible). Pass --no-codex-mcp to skip \"\n              + \"peer-MCP wiring entirely.\",\n          )\n        }\n\n        const personaNames = runtime.personas.map((p) => p.agentName).join(\", \")\n        const subagentVisibility = injected.ok\n          ? `subagent-visible (mirrored mcpServers: [${injected.serversAdded.join(\", \")}])`\n          : `subagent-INVISIBLE (collision on user-side mcpServers: [${injected.conflictingServers.join(\", \")}]; parent-only via --mcp-config)`\n        const skippedNote =\n          skippedGroups.length > 0\n            ? ` WARNING: groups [${skippedGroups.join(\", \")}] skipped — both the bare and \\`gh-router-<group>\\` keys collide with your own mcpServers; those tools are unavailable this session (rename the user-side server to re-enable).`\n            : \"\"\n        process.stderr.write(\n          `Peer MCP wired (backend=${backend}, personas=[${personaNames}], `\n            + `subagent .md files=${runtime.agentMdPaths.length}, ${subagentVisibility}).${skippedNote}\\n`,\n        )\n\n        // ── Floor-raising agent surface (docs/floor-raising-agent-surface.md) ──\n        // NOTE (intentional coupling, gemini integration review): this block is\n        // nested in `if (codexMcpEnabled)` — the github-router \"enhancement\n        // layer\" master switch — alongside the MCP server injection above. The\n        // skills REQUIRE that injection (they call mcp__workers__* /\n        // mcp__orchestrate__* / mcp__search__* tools), so coupling them here is\n        // correct. The Stop-gate is MCP-independent and could live outside;\n        // keeping it here means `--no-codex-mcp` opts out of the whole layer\n        // (consistent: that flag also hides --trust-gate, so the gate was never\n        // enabled in such a session anyway). Decoupling the Stop-gate + moving\n        // the per-prompt reset out is a clean follow-up.\n        // When the worker/orchestrate backend is available, materialize the\n        // injected skills into the mirror and register the front-end\n        // UserPromptSubmit hook (per-prompt Stop-gate budget reset + advisory\n        // goal steer). gh-first-mate is additionally gated on the first-mate MCP\n        // server so the slash command does not advertise an unavailable tool.\n        // The hooks scope themselves to the top-level session via the payload's\n        // agent_type, so subagents/teammates are untouched.\n        const sessionCwd = process.cwd()\n        if (workerToolsEnabled()) {\n          const skillsToWrite = INJECTED_SKILLS.filter(\n            (s) => !isFirstMateSkillName(s.name) || agentToolsEnabled(),\n          )\n          let skillsWritten = 0\n          for (const s of skillsToWrite) {\n            const r = await writeInjectedSkill(s.name, s.md).catch(() => ({ written: false }))\n            if (r.written) skillsWritten++\n          }\n          try {\n            const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, \"settings.json\")\n            const cmd = buildPromptSubmitHookCommand(process.execPath, process.argv[1])\n            // Raise the host hook timeout to 45s (default 30s): the V2 path may\n            // make one gpt-5.6-sol scope call + a parallel code search. The hook's\n            // own enrichment is bounded well under this (≈22s) and fails open,\n            // so 45s is headroom, not a tax the user routinely pays.\n            await injectStopHookIntoSettingsFile(settingsPath, cmd, \"UserPromptSubmit\", 45)\n          } catch (err) {\n            consola.warn(`Could not register the UserPromptSubmit hook: ${String(err)}`)\n          }\n          // Auto-approve github-router's own injected MCP servers so their tools\n          // run WITHOUT a permission prompt in every mode — including plan mode,\n          // where the research tools (search / peers / workers-explore / stand_in /\n          // orchestrate) are exactly what the model reaches for. MCP tools aren't\n          // subject to plan mode's file-edit/shell-write restriction, so a bare\n          // `mcp__<server>` allow rule (on the RESOLVED keys) auto-runs them there\n          // too. deny/ask and the user's own allow entries are preserved.\n          // Auto-approve github-router's own injected MCP servers PLUS the native\n          // read-only research tools (WebSearch/WebFetch) so they run WITHOUT a\n          // permission prompt in every mode — including plan mode, where that\n          // research surface is exactly what the model reaches for. MCP tools and\n          // read-only natives aren't subject to plan mode's file-edit/shell-write\n          // restriction, so an allow rule auto-runs them there too. deny/ask and\n          // the user's own allow entries are preserved.\n          try {\n            const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, \"settings.json\")\n            // Authoritative list of the servers we actually injected — on the\n            // mirror path that's `injected.serversAdded` (includes the `codex-cli`\n            // stdio server, not just the HTTP groups); on the collision fallback,\n            // reconstruct it from the resolved group keys + codex-cli.\n            const injectedServerKeys = injected.ok\n              ? injected.serversAdded\n              : [\n                  ...Object.values(groupKeys).filter((k): k is string => Boolean(k)),\n                  ...(backend === \"cli\" ? [\"codex-cli\"] : []),\n                ]\n            const res = await injectAllowRules(settingsPath, planModeAllowRules(injectedServerKeys))\n            if (res.added.length) {\n              consola.debug(`Auto-approved for plan mode: ${res.added.join(\", \")}`)\n            }\n          } catch (err) {\n            consola.warn(`Could not auto-approve injected tools: ${String(err)}`)\n          }\n          // Workers non-blocking guard: a PreToolUse hook scoped (matcher) to the\n          // active worker tools that DENIES a raw `mcp__<workersKey>__<mode>` call\n          // from the main agent (redirecting it to the `worker-<mode>` background\n          // dispatcher) and ALLOWS it only from that dispatcher subagent. The\n          // resolved workersKey + active modes are baked into the command\n          // (dedup-distinct) and the matcher. Local + instant, so a short 10s\n          // timeout is ample.\n          //\n          // GATED ON `injected.ok`: the guard only makes sense when subagents can\n          // SEE the workers MCP (mirror injection succeeded). On the collision\n          // fallback (parent-only --mcp-config, subagents blind), a `worker-*`\n          // dispatcher could not reach the worker tool — registering the guard\n          // then would deny the main agent AND leave it no working dispatcher, a\n          // fully-broken state. So when injection failed we skip the guard and\n          // leave raw (blocking) workers usable on the main thread.\n          //\n          // HYBRID opt-out (`GH_ROUTER_DISABLE_WORKER_GUARD=1`): keeps the\n          // non-blocking guarantee ON by default, but lets an operator restore the\n          // raw `mcp__workers__*` escape hatch on demand (e.g. for guaranteed\n          // structured-arg fidelity, or when a blocking call is acceptable) — so\n          // the worker-* agents COMPLEMENT rather than hard-replace the raw tools.\n          if (!injected.ok) {\n            consola.warn(\n              \"Workers non-blocking guard NOT registered: subagent MCP injection \"\n                + \"fell back to parent-only (--mcp-config), so worker-* dispatchers \"\n                + \"cannot reach the workers server. Raw (blocking) worker tools remain \"\n                + \"usable on the main thread this session.\",\n            )\n          } else if (process.env.GH_ROUTER_DISABLE_WORKER_GUARD === \"1\") {\n            consola.info(\n              \"Workers non-blocking guard disabled via GH_ROUTER_DISABLE_WORKER_GUARD=1 \"\n                + \"— raw mcp__workers__* is callable on the main thread (blocking); the \"\n                + \"worker-* background agents remain the steered, non-blocking default.\",\n            )\n          } else {\n            try {\n              const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, \"settings.json\")\n              const workersKey = workersKeyOf(groupKeys)\n              const modes = activeDispatchModes({ browse: browseAgentEnabled() })\n              const cmd = buildWorkerGuardHookCommand(\n                process.execPath,\n                process.argv[1],\n                workersKey,\n                modes,\n              )\n              const matcher = guardToolMatcher(workersKey, modes)\n              await injectStopHookIntoSettingsFile(settingsPath, cmd, \"PreToolUse\", 10, matcher)\n            } catch (err) {\n              consola.warn(`Could not register the workers PreToolUse guard hook: ${String(err)}`)\n            }\n          }\n          if (skillsWritten > 0) {\n            const skillNames = skillsToWrite.map((s) => `/${s.name}`).join(\", \")\n            process.stderr.write(\n              `Injected skills (${skillsWritten}/${skillsToWrite.length}): ${skillNames}.\\n`,\n            )\n          }\n        }\n\n        // In operator/`--agents` mode, keep local worker/orchestrate MCP tools\n        // subagent-only for the MAIN operator. File-authoring tools and Bash stay\n        // available; steering to cloud-agent delegation lives in the banner and\n        // /gh-first-mate skill. Fail-closed only for this reduced PreToolUse guard.\n        if (agentToolsEnabled()) {\n          let shapingInstalled = false\n          try {\n            const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, \"settings.json\")\n            const guardCmd = buildFirstMateGuardHookCommand(process.execPath, process.argv[1])\n            await injectStopHookIntoSettingsFile(\n              settingsPath,\n              guardCmd,\n              \"PreToolUse\",\n              undefined,\n              FIRST_MATE_GUARD_MATCHER,\n            )\n            shapingInstalled = true\n          } catch (err) {\n            consola.error(\n              `Could not register the operator worker/orchestrate guard hook: ${String(err)}`,\n            )\n          }\n          assertShapingInstalled(true, shapingInstalled)\n\n          // Surface the scaffold allowlist AT STARTUP rather than only as a\n          // refusal deep inside a tool call. `scaffold_repo` creates branches,\n          // commits files and opens PRs, so it is deny-by-default — but a user\n          // upgrading into that gate would otherwise discover it as an opaque\n          // mid-mission failure naming an env var they have never seen. One\n          // line at launch turns a surprise into a setting.\n          if (!process.env.GH_ROUTER_FM_SCAFFOLD_REPOS?.trim()) {\n            consola.info(\n              \"first-mate: scaffold_repo is disabled (it writes to real repositories). \"\n              + \"Set GH_ROUTER_FM_SCAFFOLD_REPOS to a comma-separated list of owner/name \"\n              + \"entries, or owner/* for a whole org, to enable it.\",\n            )\n          }\n        }\n\n        // ai-or-die session binding. When launched inside an ai-or-die Terminal\n        // tab, ai-or-die sets AIORDIE_CLAUDE_BIND to a per-tab sidecar path.\n        // Register a SessionStart/SessionEnd hook that records the active claude\n        // session id + transcript path to that sidecar on every startup / resume\n        // / clear / compact, so ai-or-die can bind the tab's sticky-note\n        // summariser to the exact transcript (surviving /resume, /clear and\n        // exit→relaunch). The path is baked into the hook command (not env), and\n        // AIORDIE_CLAUDE_BIND is stripped from the child's env (sanitizeParentEnv),\n        // so a nested `github-router claude` can't hijack the parent tab; the hook\n        // itself also skips subagent/teammate payloads (agent_id/agent_type).\n        const aiordieSidecar = (process.env.AIORDIE_CLAUDE_BIND ?? \"\").trim()\n        // The path is baked into the hook command string (double-quoted, like\n        // buildStopHookCommand). It is app-controlled (ai-or-die's data dir + a\n        // uuid), so it never contains a double-quote; refuse defensively if it\n        // somehow does rather than emit a malformed command (ai-or-die then falls\n        // back to its inference path).\n        if (aiordieSidecar.length > 0 && !aiordieSidecar.includes('\"')) {\n          try {\n            const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, \"settings.json\")\n            const command = buildSessionBindHookCommand(process.execPath, process.argv[1], aiordieSidecar)\n            await injectStopHookIntoSettingsFile(settingsPath, command, \"SessionStart\")\n            await injectStopHookIntoSettingsFile(settingsPath, command, \"SessionEnd\")\n          } catch (err) {\n            consola.warn(`Could not register the ai-or-die session-bind hook: ${String(err)}`)\n          }\n        }\n\n        // Default-on plan review in the artifact panel: when inside an ai-or-die\n        // tab (AIORDIE_SESSION_ID set), the artifact_* tools reach a real review\n        // panel, so materialize the gh-artifact-review skill and steer the agent\n        // to open plans there by default. Skill is written here (not in\n        // INJECTED_SKILLS) so it only appears inside a tab; the CLAUDE.md\n        // directive reaches descendants. Both best-effort.\n        if (artifactToolsEnabled()) {\n          await writeInjectedSkill(ARTIFACT_REVIEW_SKILL.name, ARTIFACT_REVIEW_SKILL.md)\n            .catch(() => ({ written: false }))\n          try {\n            await prependArtifactPanelDirectiveToMirroredClaudeMd(groupKeys.peers)\n          } catch (err) {\n            consola.warn(`Artifact-panel directive prepend failed: ${String(err)}`)\n          }\n          // Hands-off auto-open: write the artifact creds to a mode-600 mirror\n          // file (AIORDIE_TOKEN is stripped from the child env, and argv leaks to\n          // ps), then register a PostToolUse(ExitPlanMode) hook so the finalized\n          // plan opens in the panel without the model calling artifact_open.\n          try {\n            await writeArtifactCredsToMirror(shouldUseInsecureTls(process.env.AIORDIE_BASE_URL ?? \"\"))\n            const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, \"settings.json\")\n            const cmd = buildArtifactOpenHookCommand(process.execPath, process.argv[1])\n            await injectStopHookIntoSettingsFile(settingsPath, cmd, \"PostToolUse\", undefined, \"ExitPlanMode\")\n          } catch (err) {\n            consola.warn(`Could not register the artifact auto-open hook: ${String(err)}`)\n          }\n        }\n\n        // Advisory plan review: a SECOND PostToolUse(ExitPlanMode) hook, separate\n        // from artifact auto-open. It is default-on when the hook MCP runtime is\n        // wired, top-level-only at runtime, and never blocks ExitPlanMode; material\n        // findings are written to the shared findings store for the next prompt.\n        if (hookMcpRuntimeFromEnv(envVars) && planReviewEnabled()) {\n          try {\n            const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, \"settings.json\")\n            const command = buildPlanReviewHookCommand(process.execPath, process.argv[1])\n            await injectStopHookIntoSettingsFile(settingsPath, command, \"PostToolUse\", undefined, \"ExitPlanMode\")\n          } catch (err) {\n            consola.warn(`Could not register the advisory plan-review hook: ${String(err)}`)\n          }\n        }\n\n        // Structural-gate Stop hook — CONSENT-GATED per repo (default OFF; it\n        // never runs an UNTRUSTED repo's scripts). `--trust-gate` records consent\n        // for this repo; GH_ROUTER_ENABLE_STOP_GATE force-enables. The hook also\n        // re-checks trust at runtime and scopes to the top-level session.\n        if ((args as Record<string, unknown>)[\"trust-gate\"] === true) {\n          try {\n            const root = await trustRepo(sessionCwd)\n            process.stderr.write(\n              `Structural gate trusted for this repo (${root}); it will run on launch here from now on.\\n`,\n            )\n          } catch (err) {\n            consola.warn(`Could not record gate trust: ${String(err)}`)\n          }\n        }\n        const gateDisabled = stopGateDisabled(args as Record<string, unknown>)\n        const forceEnabled = parseBoolEnv(process.env.GH_ROUTER_ENABLE_STOP_GATE) === true\n        const includeTests = parseBoolEnv(process.env.GH_ROUTER_STOP_GATE_RUN_TESTS) === true\n        const gateRoot = await repoRoot(sessionCwd).catch(() => sessionCwd)\n        // Resolve the gate source: the deterministic parser first (the bun/TS\n        // sealed fast-path OR a parsed multi-language check set), then the cached\n        // model-discovered record. A cache MISS marks `discovering` (background\n        // discovery arms the gate on the NEXT launch — no launch-time model\n        // latency). Discovery is OPT-IN (GH_ROUTER_ENABLE_GATE_DISCOVERY=1): it\n        // runs a read-only worker that reads repo files, so it stays off by\n        // default; the parser covers the common ecosystems with no model at all.\n        let descriptor: GateDescriptor | null = null\n        let discovering = false\n        if (!gateDisabled) {\n          descriptor = await parseGateDescriptor(gateRoot, { includeTests }).catch(() => null)\n          if (!descriptor) {\n            const cached = await readDiscoveredGate(gateRoot).catch(() => null)\n            if (cached) {\n              descriptor = {\n                kind: \"discovered\",\n                checks: cached.checks,\n                ecosystem: cached.ecosystem,\n                workdir: gateRoot,\n                evidence: cached.evidence,\n              }\n              // Force-enable wants a gate NOW (not a next-launch background discovery);\n              // when nothing parsed/cached, it falls back to the sealed default below.\n            } else if (!forceEnabled && workerToolsEnabled() && parseBoolEnv(process.env.GH_ROUTER_ENABLE_GATE_DISCOVERY) === true) {\n              discovering = true\n            }\n          }\n        }\n        // Enable when forced-on, already trusted, or auto-trust-on-detection (a\n        // resolved descriptor OR a kicked discovery is consent-by-launching). The\n        // gate only ever runs the launched repo's own checks and is\n        // baseline-isolated; opt out entirely with GH_ROUTER_DISABLE_STOP_GATE=1.\n        let gateEnabled = gateDisabled ? false : await stopGateEnabledForRepo(sessionCwd).catch(() => false)\n        let autoTrusted = false\n        if (!gateEnabled && !gateDisabled && (descriptor || discovering)) {\n          try {\n            await trustRepo(sessionCwd)\n            gateEnabled = true\n            autoTrusted = true\n          } catch (err) {\n            consola.warn(`Could not auto-trust this repo for the structural gate: ${String(err)}`)\n          }\n        }\n        // Force-enable (GH_ROUTER_ENABLE_STOP_GATE / --trust-gate) with no parsed\n        // or discovered descriptor falls back to the sealed default gate, matching\n        // the legacy behavior of explicit enablement (takes precedence over a\n        // background discovery, which `forceEnabled` already suppressed above).\n        if (gateEnabled && !descriptor && !discovering) {\n          descriptor = { kind: \"sealed\", gateId: stopGateId(), workdir: gateRoot }\n        }\n        if (gateEnabled && descriptor) {\n          const armed = descriptor\n          try {\n            const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, \"settings.json\")\n            const command = buildStopHookCommand(process.execPath, process.argv[1])\n            // Arm the matching runtime resolver (env reaches the child via envVars).\n            if (armed.kind === \"sealed\") envVars.GH_ROUTER_STOP_GATE_ID = armed.gateId\n            else if (armed.kind === \"parsed\") envVars.GH_ROUTER_STOP_GATE_PARSED = \"1\"\n            else envVars.GH_ROUTER_STOP_GATE_DISCOVERED = \"1\"\n            if (includeTests) envVars.GH_ROUTER_STOP_GATE_RUN_TESTS = \"1\"\n            await injectStopHookIntoSettingsFile(settingsPath, command)\n            // Capture the baseline at LAUNCH (pre-mutation) for the dynamic paths,\n            // so an agent-introduced failure is a regression — not silently adopted\n            // as the baseline at first stop. Sealed keeps its legacy first-stop\n            // baseline (unchanged). Fire-and-forget: never blocks the launch.\n            if (armed.kind !== \"sealed\") {\n              const checks = checksForDescriptor(armed)\n              const descriptorKey = descriptorHash(armed)\n              // Per-launch token isolates concurrent sessions' baselines; the child\n              // reads it back to recompute the same launch-baseline key.\n              const token = randomBytes(8).toString(\"hex\")\n              envVars.GH_ROUTER_STOP_GATE_BASELINE_TOKEN = token\n              void (async () => {\n                await captureLaunchBaseline({\n                  checks,\n                  workdir: armed.workdir,\n                  exec: liveExec,\n                  descriptorKey,\n                  token,\n                  baseline: fileBaselineStore(nodePath.join(tmpdir(), \"gh-router-stopgate-baseline\")),\n                })\n              })().catch(() => {})\n            }\n            const tail =\n              \"A regression or a gate-weakening diff blocks stopping until fixed (per-prompt, max 2). \"\n              + \"Opt out with GH_ROUTER_DISABLE_STOP_GATE=1.\\n\"\n            if (armed.kind === \"sealed\") {\n              process.stderr.write(\n                (autoTrusted\n                  ? `Structural-gate Stop hook enabled by default for this repo (gate=${armed.gateId}; runs typecheck/test/lint at stop). `\n                  : `Structural-gate Stop hook enabled (gate=${armed.gateId}). `) + tail,\n              )\n            } else {\n              const ids = checksForDescriptor(armed).map((c) => c.id).join(\", \")\n              const testNote = includeTests\n                ? \"Full test suite ON. \"\n                : \"Full test suite off by default (enable with GH_ROUTER_STOP_GATE_RUN_TESTS=1). \"\n              process.stderr.write(\n                `Structural-gate Stop hook armed for this ${armed.ecosystem} repo (checks: ${ids}; `\n                  + `from ${armed.evidence.join(\", \")}). ${testNote}${tail}`,\n              )\n            }\n          } catch (err) {\n            // Never fail the launch over the hook; surface and continue.\n            consola.warn(`Could not register the structural-gate Stop hook: ${String(err)}`)\n          }\n        } else if (gateEnabled && discovering) {\n          // Kick a background discovery; the gate arms on the next launch.\n          process.stderr.write(\n            \"Structural Stop-gate: no checks parsed for this repo — discovering check commands in the \"\n              + \"background (arms on the next launch). Disable with GH_ROUTER_ENABLE_GATE_DISCOVERY=0.\\n\",\n          )\n          void (async () => {\n            try {\n              const disc = await discoverGateCommands(gateRoot, {\n                includeTests,\n                signal: AbortSignal.timeout(120_000),\n              })\n              if (disc) {\n                const [fingerprint, sh] = await Promise.all([\n                  repoFingerprint(gateRoot).catch(() => \"\"),\n                  sourcesHash(gateRoot).catch(() => \"\"),\n                ])\n                await writeDiscoveredGate({\n                  root: gateRoot,\n                  fingerprint,\n                  sourcesHash: sh,\n                  discoveredAt: new Date().toISOString(),\n                  model: \"gemini-3.5-flash\",\n                  ecosystem: disc.ecosystem,\n                  checks: disc.checks,\n                  confidence: disc.confidence,\n                  evidence: disc.evidence,\n                })\n              }\n            } catch {\n              /* best-effort: discovery never blocks or fails the launch. */\n            }\n          })().catch(() => {})\n        } else if (!gateDisabled && !descriptor && !discovering) {\n          // The original \"silent skip\" fix: say WHY the gate is off.\n          process.stderr.write(\n            \"Structural Stop-gate not enabled: no checks found in this repo \"\n              + \"(looked at package.json scripts / CI workflows / Makefile / Cargo.toml / go.mod / pyproject). \"\n              + \"Force a sealed gate with GH_ROUTER_ENABLE_STOP_GATE=1\"\n              + (workerToolsEnabled() ? \", or let a model discover them with GH_ROUTER_ENABLE_GATE_DISCOVERY=1\" : \"\")\n              + \".\\n\",\n          )\n        }\n\n        // Awareness snippet: append a short, descriptive system-prompt\n        // section telling Claude *what* peer-review tools exist — Claude\n        // decides *whether* to call them based on each tool's own\n        // `description` (the routing layer). This is the awareness layer.\n        //\n        // Delivery is dual-surface, both unconditional:\n        //   1. --append-system-prompt — system-turn position, strongest\n        //      attention weight; reaches the main agent only.\n        //   2. <CLAUDE_CONFIG_DIR>/CLAUDE.md (appended) — user-turn\n        //      <claudeMd> wrapper; reaches Agent-tool subagents and\n        //      agent-teams teammates that inherit CLAUDE_CONFIG_DIR but\n        //      not --append-system-prompt.\n        //\n        // Capability gates: worker_* and stand_in mentions are gated on\n        // the same predicates the /mcp tools/list uses (workerToolsEnabled\n        // / standInToolEnabled), so the snippet never names a tool that\n        // is missing from the live catalog.\n        //\n        // Previously gated by GH_ROUTER_PEER_AWARENESS (default-on).\n        // The flag was dropped (per plan: it served no purpose now that\n        // the snippet is default-on across both surfaces). Existing\n        // `GH_ROUTER_PEER_AWARENESS=0` shell exports are silent no-ops.\n        const peerSnippet = buildPeerAwarenessSnippet({\n          codexCli: backend === \"cli\",\n          geminiAvailable: geminiModelsAvailable,\n          workerToolsAvailable: workerToolsEnabled(),\n          standInAvailable: standInToolEnabled(),\n          browseAvailable: browserToolsEnabled(),\n          compoundBrowseAvailable: browserCompoundToolsEnabled(),\n          powerBrowseAvailable: state.powerBrowseEnabled,\n          fleetAvailable: fleetToolsEnabled(),\n          agentToolsAvailable: agentToolsEnabled(),\n          scoutAvailable: scoutModel() != null,\n          groupKeys,\n        })\n        // Capture the peer-awareness snippet; the always-on operating-defaults\n        // injection after this block composes the single --append-system-prompt\n        // (operating-defaults first, then this summary).\n        peerAwarenessSnippet = peerSnippet\n        peerAwarenessSummary = buildPeerAwarenessSummary({\n          workerToolsAvailable: workerToolsEnabled(),\n          standInAvailable: standInToolEnabled(),\n          browseAvailable: browserToolsEnabled(),\n          fleetAvailable: fleetToolsEnabled(),\n          agentToolsAvailable: agentToolsEnabled(),\n          groupKeys,\n        })\n        // Ordering invariant: this MUST run AFTER ensureClaudeConfigMirror()\n        // has resolved (above in this same handler), so the snapshot of\n        // the user's ~/.claude/CLAUDE.md is already in place before we\n        // append our marker block. The helper's own mirror-only safety\n        // guard rejects writes outside CLAUDE_CONFIG_DIR as defence in\n        // depth. Failures warn-and-continue: this CLAUDE.md copy is now the\n        // primary full-inventory surface (the system prompt carries only a\n        // summary of it), so on the rare write failure the agent falls back to\n        // the tool descriptions in tools/list, not a launch-blocker.\n        try {\n          await appendPeerAwarenessToMirroredClaudeMd(peerSnippet)\n        } catch (err) {\n          consola.warn(\n            `Peer-awareness CLAUDE.md append failed (agent keeps tool descriptions via tools/list, loses the inventory overview): ${\n              err instanceof Error ? err.message : String(err)\n            }`,\n          )\n        }\n        // Style directive: prepend a short writing/communication style\n        // directive at the TOP of the mirrored CLAUDE.md so every\n        // spawned agent reads it first. Independent marker fence from\n        // the peer-awareness block, so the two coexist (style at top,\n        // user content in the middle, peer-awareness at the bottom).\n        // Best-effort like the append above.\n        try {\n          await prependStyleDirectiveToMirroredClaudeMd()\n        } catch (err) {\n          consola.warn(\n            `Style-directive CLAUDE.md prepend failed: ${\n              err instanceof Error ? err.message : String(err)\n            }`,\n          )\n        }\n      } catch (err) {\n        consola.warn(\n          `Peer MCP wiring failed (claude will launch without it): ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        )\n      }\n    }\n\n    // Operating-defaults directive (orchestrator posture + hybrid excellence\n    // lens): injected by DEFAULT, NOT gated on codex-mcp, so the posture always\n    // reaches the agent even under --no-codex-mcp. Two surfaces:\n    //   1. --append-system-prompt (main agent, highest salience): the single\n    //      such arg for the session carries a condensed digest, with a compact\n    //      summary of the peer-awareness inventory riding along after it.\n    //   2. the mirrored CLAUDE.md TOP (main agent and descendant agents): the\n    //      full directive is prepended after the style directive when that ran.\n    // ensureClaudeConfigMirror() ran unconditionally above, so the mirror exists\n    // regardless of codex-mcp; the prepend is best-effort (warn-and-continue).\n    // Peer-awareness inventory lives ONCE, in the mirrored CLAUDE.md (appended\n    // above), which the main agent and descendants both read. The system prompt\n    // carries only a compact summary, not the full ~1.1k-token snippet, so\n    // the inventory is not duplicated in the context window on every turn. The\n    // full operating-defaults directive lives in CLAUDE.md, while a condensed\n    // digest keeps those defaults at top salience in --append-system-prompt.\n    // If the CLAUDE.md append happened to fail, the agent still has every tool's\n    // own description in tools/list (the real routing signal); it just loses this\n    // higher-level overview.\n    extraArgs.push(\n      \"--append-system-prompt\",\n      peerAwarenessSnippet && peerAwarenessSummary\n        ? `${OPERATING_DEFAULTS_DIGEST}\\n\\n${peerAwarenessSummary}`\n        : OPERATING_DEFAULTS_DIGEST,\n    )\n    try {\n      await prependOperatingDefaultsToMirroredClaudeMd()\n    } catch (err) {\n      consola.warn(\n        `Operating-defaults CLAUDE.md prepend failed: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      )\n    }\n\n    // Deterministic backstop for the injected no-attribution style directive:\n    // write `attribution: {commit:\"\", pr:\"\"}` into the mirrored settings.json so\n    // Claude Code's harness suppresses the commit/PR bylines at the source, not\n    // just via the advisory CLAUDE.md prose. Presence-guarded (an existing\n    // user `attribution`/`includeCoAuthoredBy` wins) and best-effort. Opt out\n    // with GH_ROUTER_DISABLE_NO_ATTRIBUTION=1.\n    if (process.env.GH_ROUTER_DISABLE_NO_ATTRIBUTION !== \"1\") {\n      try {\n        const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, \"settings.json\")\n        await injectAttributionSuppressionIntoSettingsFile(settingsPath)\n      } catch (err) {\n        consola.warn(\n          `No-attribution settings backstop skipped: ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        )\n      }\n    }\n\n    launchChild(\n      { kind: \"claude-code\", envVars, extraArgs, model: chosenSlug },\n      server,\n      { onShutdown },\n    )\n  },\n})\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,MAAa,wBAAwB;CACnC,MAAM;CACN,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoEN;;;ACsCA,SAAS,qBAAqB,MAAuB;CACnD,OACE,SAAS,mBACT,SAAS,4BACT,SAAS,2BACT,SAAS;AAEb;AAEA,MAAa,aAAa;CACxB,GAAG;CACH,OAAO;EACL,OAAO;EACP,MAAM;EACN,aACE;CACJ;CACA,aAAa;EACX,MAAM;EACN,SAAS;EACT,aACE;CACJ;CACA,aAAa;EACX,MAAM;EACN,SAAS;EACT,aACE;CACJ;CACA,kBAAkB;EAChB,MAAM;EACN,SAAS;EACT,aACE;CACJ;CACA,SAAS;EACP,MAAM;EACN,SAAS;EACT,aACE;CACJ;CACA,cAAc;EACZ,MAAM;EACN,SAAS;EACT,aACE;CACJ;CACA,gBAAgB;EACd,MAAM;EACN,SAAS;EACT,aACE;CACJ;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,aACE;CACJ;CACA,gBAAgB;EACd,MAAM;EACN,SAAS;EACT,aACE;CACJ;AACF;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,4BACd,SACA,SACU;CACV,MAAM,wBAAQ,IAAI,IAAY;CAC9B,MAAM,8BAAc,IAAI,IAAY;CACpC,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,OAAO,GAAG;EACjD,MAAM,WAAW,WAAW,MAAM,IAAI,QAAQ,KAAA;EAC9C,MAAM,UACJ,aAAa,KAAA,IACT,CAAC,IACD,MAAM,QAAQ,QAAQ,IACpB,WACA,CAAC,QAAQ;EACjB,KAAK,MAAM,KAAK,CAAC,MAAM,GAAG,OAAO,GAAG;GAClC,MAAM,IAAI,CAAC;GACX,IAAI,IAAI,SAAS,UAAU,YAAY,IAAI,CAAC;EAC9C;CACF;CAEA,MAAM,YAAsB,CAAC;CAC7B,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;EACvC,MAAM,MAAM,QAAQ;EAIpB,IAAI,QAAQ,MAAM;GAChB,UAAU,KAAK,GAAG,QAAQ,MAAM,IAAI,CAAC,CAAC;GACtC;EACF;EAEA,IAAI,QAAQ,OAAO,CAAC,IAAI,WAAW,GAAG,GAAG;GACvC,UAAU,KAAK,GAAG;GAClB;EACF;EACA,MAAM,aAAa,IAAI,WAAW,IAAI;EACtC,MAAM,cAAc,IAAI,MAAM,aAAa,IAAI,CAAC;EAChD,MAAM,KAAK,YAAY,QAAQ,GAAG;EAClC,MAAM,UAAU,MAAM,IAAI,YAAY,MAAM,GAAG,EAAE,IAAI;EACrD,MAAM,iBAAiB,MAAM;EAC7B,MAAM,UAAU,cAAc,QAAQ,WAAW,KAAK;EACtD,MAAM,WAAW,UAAU,QAAQ,MAAM,CAAC,IAAI;EAG9C,IAAI,EADY,MAAM,IAAI,OAAO,KAAM,WAAW,MAAM,IAAI,QAAQ,IACtD;GAEZ,UAAU,KAAK,GAAG;GAClB;EACF;EAYA,IANE,CAAC,WACE,CAAC,kBACD,YAAY,IAAI,OAAO,KACvB,IAAI,IAAI,QAAQ,UAChB,QAAQ,IAAI,OAAO,QACnB,CAAC,QAAQ,IAAI,EAAE,CAAC,WAAW,GAAG,GAChB;CACrB;CACA,OAAO;AACT;AAEA,MAAa,SAAS,cAAc;CAClC,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,MAAM;CACN,MAAM,IAAI,EAAE,MAAM,WAAW;EAC3B,IAAI,CAAC,QAAQ,OAAO,OAAO;GACzB,QAAQ,MAAM,8DAA8D;GAC5E,QAAQ,KAAK,CAAC;EAChB;EAEA,MAAM,SAAS,gBAAgB,IAA0C;EAkBzE,IAAI,KAAK,SAAS;GAEhB,OAAO,gBAAgB;GACvB,QAAQ,KACN,wEACF;EACF,OAAO,IAAI,CAAC,KAAK,mBAEf,OAAO,gBAAgB;EAYzB,IAAI,KAAK,oBAAoB,OAC3B,IAAI;GACF,MAAM,eAAe,MAAM,mBAAmB,EAC5C,SAAS,MACX,CAAC;GACD,IAAI,aAAa,WAAW,aAAa,eAAe,aAGtD,QAAQ,MACN,sDACF;QACK,IAAI,aAAa,WAAW,aAAa,eAAe,UAE7D,QAAQ,MACN,yFACF;QACK,IACL,aAAa,eACV,aAAa,oBACb,aAAa,eAEhB,IAAI,KAAK,mBAAmB,OAC1B,IAAI;IACF,MAAM,aAAa,aAAa,aAAa;GAC/C,SAAS,KAAK;IACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;IAC3D,QAAQ,KACN,mCAAmC,aAAa,iBAAiB,MAAM,aAAa,cAAc,WAAW,IAAI,wIACnH;GACF;QAEA,QAAQ,KACN,gBAAgB,aAAa,iBAAiB,kBAAkB,aAAa,cAAc,yGAC7F;EAGN,SAAS,KAAK;GAEZ,QAAQ,MAAM,gCAAgC,GAAG;EACnD;EAGF,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,MAAM,SAAS,MAAM,cAAc;IACjC,GAAG;IACH,MAAM,OAAO;IACb,QAAQ;GACV,CAAC;GACD,SAAS,OAAO;GAChB,YAAY,OAAO;EACrB,SAAS,OAAO;GACd,QAAQ,MAAM,2BAA2B,iBAAiB,QAAQ,MAAM,UAAU,KAAK;GACvF,QAAQ,KAAK,CAAC;EAChB;EAKA,cAAmB,EAAE,YAAY,KAAK,mBAAmB,MAAM,CAAC;EAchE,IAAI;GACF,MAAM,yBAAyB;EACjC,SAAS,KAAK;GACZ,QAAQ,MACN,iDACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAChD,yDACH;GACA,QAAQ,KAAK,CAAC;EAChB;EAEA,kBAAkB;EAyBlB,MAAM,eAAe,CAAC,KAAK;EAC3B,MAAM,sBAAsB,KAAK,OAAO,MAAM,cAAc,CAAC,GAAG;EAIhE,IAAI,aAHkB,sBAClB,kBAAkB,mBAAmB,IACpC,KAAK,SAAS,kBAAkB;EAErC,IAAI,eAAe,aAAa,UAAU;EAE1C,IAAI,gBAAgB,MAAM,QAAQ;GAChC,MAAM,WAAW,SACf,MAAM,QAAQ,KAAK,MAAM,MAAM,EAAE,OAAO,aAAa,IAAI,CAAC,KAAK;GACjE,IAAI,CAAC,QAAQ,UAAU,GAChB;SAAA,MAAM,YAAY,gCACrB,IAAI,QAAQ,QAAQ,GAAG;KAQrB,MAAM,eAAe,kBACnB,SAAS,QAAQ,iBAAiB,EAAE,CACtC;KACA,QAAQ,KACN,kBAAkB,WAAW,qDAAqD,aAAa,GACjG;KACA,aAAa;KACb,eAAe,aAAa,YAAY;KACxC;IACF;;EAGN;EAEA,IAAI,iBAAiB,YACnB,QAAQ,KAAK,UAAU,WAAW,iBAAiB,aAAa,EAAE;EAGpE,IAAI,CADe,MAAM,QAAQ,KAAK,MAAM,MAAM,EAAE,OAAO,YAAY,GACtD;GACf,MAAM,YAAY,sBAAsB,cAAc;GACtD,QAAQ,KACN,UAAU,aAAa,wCAAwC,UAAU,KAAK,IAAI,GACpF;EACF;EAIA,MAAM,SACJ,eAAe,eACX,aACA,GAAG,WAAW,KAAK;EAEzB,QAAQ,OAAO,MAAM,mBAAmB,UAAU,2BAA2B,OAAO,OAAO;EAE3F,MAAM,UAAU,qBAAqB,WAAW,UAAU;EAO1D,MAAM,YAAY,4BAA4B,SAAS,UAAU;EASjE,IAAI,gBAAgB,GAAG;GACrB,kBAAuB,CAAC,CAAC,OAAO,QAC9B,QAAQ,MAAM,iCAAiC,GAAG,CACpD;GACA,MAAM,eAAe,uBAAuB,sBAAsB,CAAC;GACnE,IAAI,cACF,IAAI;IACF,MAAM,0CAA0C,YAAY;GAC9D,SAAS,KAAK;IACZ,QAAQ,KACN,qCACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;GACF;EAEJ;EAKA,yBAA8B;EAM9B,uBAA4B,KAAA,GAAW,EAAE,YAAY,KAAK,CAAC,CAAC,CACzD,MAAM,YAAY;GACjB,IAAI,SAAS,QAAQ,OAAO,MAAM,GAAG,QAAQ,GAAG;EAClD,CAAC,CAAC,CACD,YAAY,CAAC,CAAC;EAIjB,mBAAwB;EAMxB,eAAe;EAMf,IAAI,oBAAoB,GACtB,uBAA4B,CAAC,CAAC,OAAO,QACnC,QAAQ,MAAM,0CAA0C,GAAG,CAC7D;EA4BF,MAAM,eAAe,YAA2B;GAC9C,MAAM,cAAc;GACpB,MAAM,4BAA4B;EACpC;EACA,IAAI,aAAkC;EAKtC,IAAI;EACJ,IAAI;EAEJ,IADyB,KAAiC,iBAAiB,OAEzE,IAAI;GACF,MAAM,eACF,KAAiC,gBAAwC;GAC7E,MAAM,UAAU,uBAAuB;IACrC,WAAW;IACX,WAAW,eAAe,gBAAgB,IAAI;GAChD,CAAC;GACD,MAAM,wBAAwB,gBAAgB;GAC9C,IAAI,CAAC,uBACH,QAAQ,KACN,+GACF;GAYF,MAAM,gBAAiC;IAAC;IAAS;IAAU;GAAa;GACxE,IAAI,mBAAmB,GAAG,cAAc,KAAK,SAAS;GACtD,IAAI,mBAAmB,GAAG,cAAc,KAAK,QAAQ;GACrD,IAAI,oBAAoB,GAAG,cAAc,KAAK,SAAS;GACvD,IAAI,kBAAkB,GAAG,cAAc,KAAK,OAAO;GACnD,IAAI,kBAAkB,GAAG,cAAc,KAAK,YAAY;GACxD,MAAM,EAAE,MAAM,WAAW,SAAS,kBAChC,MAAM,2BAA2B,aAAa;GAEhD,MAAM,UAAU,MAAM,yBAAyB,WAAW;IACxD,UAAU,YAAY;IACtB,iBAAiB;IACjB;IACA,sBAAsB,mBAAmB;IACzC,iBAAiB,mBAAmB;IACpC,qBAAqB,oBAAoB;IACzC,eAAe,cAAc;IAC7B,iBAAiB,gBAAgB;IACjC,YAAY,WAAW;IACvB,aAAa,YAAY;GAC3B,CAAC;GACD,MAAM,eAAe,QAAQ;GAO7B,QAAQ,yBAAyB;GACjC,QAAQ,uBAAuB,QAAQ;GACvC,aAAa,YAA2B;IACtC,MAAM,QAAQ,QAAQ;IACtB,MAAM,aAAa;GACrB;GAgBA,MAAM,WAAW,MAAM,wBAAwB,WAAW;IACxD,UAAU,YAAY;IACtB,iBAAiB;IACjB;IACA,OAAO,QAAQ;GACjB,CAAC;GAOD,IAAI,CAAC,SAAS,IAAI;IAChB,UAAU,KAAK,gBAAgB,QAAQ,aAAa;IACpD,IAAK,KAAiC,sBAAsB,MAC1D,UAAU,KAAK,qBAAqB;GAExC,OAAO,IAAK,KAAiC,sBAAsB,MAKjE,QAAQ,KACN,oNAIF;GAGF,MAAM,eAAe,QAAQ,SAAS,KAAK,MAAM,EAAE,SAAS,CAAC,CAAC,KAAK,IAAI;GACvE,MAAM,qBAAqB,SAAS,KAChC,2CAA2C,SAAS,aAAa,KAAK,IAAI,EAAE,MAC5E,2DAA2D,SAAS,mBAAmB,KAAK,IAAI,EAAE;GACtG,MAAM,cACJ,cAAc,SAAS,IACnB,qBAAqB,cAAc,KAAK,IAAI,EAAE,mLAC9C;GACN,QAAQ,OAAO,MACb,2BAA2B,QAAQ,cAAc,aAAa,wBACpC,QAAQ,aAAa,OAAO,IAAI,mBAAmB,IAAI,YAAY,GAC/F;GAoBA,MAAM,aAAa,QAAQ,IAAI;GAC/B,IAAI,mBAAmB,GAAG;IACxB,MAAM,gBAAgB,gBAAgB,QACnC,MAAM,CAAC,qBAAqB,EAAE,IAAI,KAAK,kBAAkB,CAC5D;IACA,IAAI,gBAAgB;IACpB,KAAK,MAAM,KAAK,eAEd,KAAI,MADY,mBAAmB,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,EAAA,CAC3E,SAAS;IAEjB,IAAI;KACF,MAAM,eAAeA,KAAS,KAAK,MAAM,mBAAmB,eAAe;KAC3E,MAAM,MAAM,6BAA6B,QAAQ,UAAU,QAAQ,KAAK,EAAE;KAK1E,MAAM,+BAA+B,cAAc,KAAK,oBAAoB,EAAE;IAChF,SAAS,KAAK;KACZ,QAAQ,KAAK,iDAAiD,OAAO,GAAG,GAAG;IAC7E;IAeA,IAAI;KACF,MAAM,eAAeA,KAAS,KAAK,MAAM,mBAAmB,eAAe;KAK3E,MAAM,qBAAqB,SAAS,KAChC,SAAS,eACT,CACE,GAAG,OAAO,OAAO,SAAS,CAAC,CAAC,QAAQ,MAAmB,QAAQ,CAAC,CAAC,GACjE,GAAI,YAAY,QAAQ,CAAC,WAAW,IAAI,CAAC,CAC3C;KACJ,MAAM,MAAM,MAAM,iBAAiB,cAAc,mBAAmB,kBAAkB,CAAC;KACvF,IAAI,IAAI,MAAM,QACZ,QAAQ,MAAM,gCAAgC,IAAI,MAAM,KAAK,IAAI,GAAG;IAExE,SAAS,KAAK;KACZ,QAAQ,KAAK,0CAA0C,OAAO,GAAG,GAAG;IACtE;IAsBA,IAAI,CAAC,SAAS,IACZ,QAAQ,KACN,gPAIF;SACK,IAAI,QAAQ,IAAI,mCAAmC,KACxD,QAAQ,KACN,oNAGF;SAEA,IAAI;KACF,MAAM,eAAeA,KAAS,KAAK,MAAM,mBAAmB,eAAe;KAC3E,MAAM,aAAa,aAAa,SAAS;KACzC,MAAM,QAAQ,oBAAoB,EAAE,QAAQ,mBAAmB,EAAE,CAAC;KAClE,MAAM,MAAM,4BACV,QAAQ,UACR,QAAQ,KAAK,IACb,YACA,KACF;KACA,MAAM,UAAU,iBAAiB,YAAY,KAAK;KAClD,MAAM,+BAA+B,cAAc,KAAK,cAAc,IAAI,OAAO;IACnF,SAAS,KAAK;KACZ,QAAQ,KAAK,yDAAyD,OAAO,GAAG,GAAG;IACrF;IAEF,IAAI,gBAAgB,GAAG;KACrB,MAAM,aAAa,cAAc,KAAK,MAAM,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI;KACnE,QAAQ,OAAO,MACb,oBAAoB,cAAc,GAAG,cAAc,OAAO,KAAK,WAAW,IAC5E;IACF;GACF;GAMA,IAAI,kBAAkB,GAAG;IACvB,IAAI,mBAAmB;IACvB,IAAI;KACF,MAAM,eAAeA,KAAS,KAAK,MAAM,mBAAmB,eAAe;KAC3E,MAAM,WAAW,+BAA+B,QAAQ,UAAU,QAAQ,KAAK,EAAE;KACjF,MAAM,+BACJ,cACA,UACA,cACA,KAAA,GACA,wBACF;KACA,mBAAmB;IACrB,SAAS,KAAK;KACZ,QAAQ,MACN,kEAAkE,OAAO,GAAG,GAC9E;IACF;IACA,uBAAuB,MAAM,gBAAgB;IAQ7C,IAAI,CAAC,QAAQ,IAAI,6BAA6B,KAAK,GACjD,QAAQ,KACN,oMAGF;GAEJ;GAYA,MAAM,kBAAkB,QAAQ,IAAI,uBAAuB,GAAA,CAAI,KAAK;GAMpE,IAAI,eAAe,SAAS,KAAK,CAAC,eAAe,SAAS,IAAG,GAC3D,IAAI;IACF,MAAM,eAAeA,KAAS,KAAK,MAAM,mBAAmB,eAAe;IAC3E,MAAM,UAAU,4BAA4B,QAAQ,UAAU,QAAQ,KAAK,IAAI,cAAc;IAC7F,MAAM,+BAA+B,cAAc,SAAS,cAAc;IAC1E,MAAM,+BAA+B,cAAc,SAAS,YAAY;GAC1E,SAAS,KAAK;IACZ,QAAQ,KAAK,uDAAuD,OAAO,GAAG,GAAG;GACnF;GASF,IAAI,qBAAqB,GAAG;IAC1B,MAAM,mBAAmB,sBAAsB,MAAM,sBAAsB,EAAE,CAAC,CAC3E,aAAa,EAAE,SAAS,MAAM,EAAE;IACnC,IAAI;KACF,MAAM,gDAAgD,UAAU,KAAK;IACvE,SAAS,KAAK;KACZ,QAAQ,KAAK,4CAA4C,OAAO,GAAG,GAAG;IACxE;IAKA,IAAI;KACF,MAAM,2BAA2B,qBAAqB,QAAQ,IAAI,oBAAoB,EAAE,CAAC;KACzF,MAAM,eAAeA,KAAS,KAAK,MAAM,mBAAmB,eAAe;KAC3E,MAAM,MAAM,6BAA6B,QAAQ,UAAU,QAAQ,KAAK,EAAE;KAC1E,MAAM,+BAA+B,cAAc,KAAK,eAAe,KAAA,GAAW,cAAc;IAClG,SAAS,KAAK;KACZ,QAAQ,KAAK,mDAAmD,OAAO,GAAG,GAAG;IAC/E;GACF;GAMA,IAAI,sBAAsB,OAAO,KAAK,kBAAkB,GACtD,IAAI;IACF,MAAM,eAAeA,KAAS,KAAK,MAAM,mBAAmB,eAAe;IAC3E,MAAM,UAAU,2BAA2B,QAAQ,UAAU,QAAQ,KAAK,EAAE;IAC5E,MAAM,+BAA+B,cAAc,SAAS,eAAe,KAAA,GAAW,cAAc;GACtG,SAAS,KAAK;IACZ,QAAQ,KAAK,qDAAqD,OAAO,GAAG,GAAG;GACjF;GAOF,IAAK,KAAiC,kBAAkB,MACtD,IAAI;IACF,MAAM,OAAO,MAAM,UAAU,UAAU;IACvC,QAAQ,OAAO,MACb,0CAA0C,KAAK,6CACjD;GACF,SAAS,KAAK;IACZ,QAAQ,KAAK,gCAAgC,OAAO,GAAG,GAAG;GAC5D;GAEF,MAAM,eAAe,iBAAiB,IAA+B;GACrE,MAAM,eAAe,aAAa,QAAQ,IAAI,0BAA0B,MAAM;GAC9E,MAAM,eAAe,aAAa,QAAQ,IAAI,6BAA6B,MAAM;GACjF,MAAM,WAAW,MAAM,SAAS,UAAU,CAAC,CAAC,YAAY,UAAU;GAQlE,IAAI,aAAoC;GACxC,IAAI,cAAc;GAClB,IAAI,CAAC,cAAc;IACjB,aAAa,MAAM,oBAAoB,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,YAAY,IAAI;IACnF,IAAI,CAAC,YAAY;KACf,MAAM,SAAS,MAAM,mBAAmB,QAAQ,CAAC,CAAC,YAAY,IAAI;KAClE,IAAI,QACF,aAAa;MACX,MAAM;MACN,QAAQ,OAAO;MACf,WAAW,OAAO;MAClB,SAAS;MACT,UAAU,OAAO;KACnB;UAGK,IAAI,CAAC,gBAAgB,mBAAmB,KAAK,aAAa,QAAQ,IAAI,+BAA+B,MAAM,MAChH,cAAc;IAElB;GACF;GAKA,IAAI,cAAc,eAAe,QAAQ,MAAM,uBAAuB,UAAU,CAAC,CAAC,YAAY,KAAK;GACnG,IAAI,cAAc;GAClB,IAAI,CAAC,eAAe,CAAC,iBAAiB,cAAc,cAClD,IAAI;IACF,MAAM,UAAU,UAAU;IAC1B,cAAc;IACd,cAAc;GAChB,SAAS,KAAK;IACZ,QAAQ,KAAK,2DAA2D,OAAO,GAAG,GAAG;GACvF;GAMF,IAAI,eAAe,CAAC,cAAc,CAAC,aACjC,aAAa;IAAE,MAAM;IAAU,QAAQ,WAAW;IAAG,SAAS;GAAS;GAEzE,IAAI,eAAe,YAAY;IAC7B,MAAM,QAAQ;IACd,IAAI;KACF,MAAM,eAAeA,KAAS,KAAK,MAAM,mBAAmB,eAAe;KAC3E,MAAM,UAAU,qBAAqB,QAAQ,UAAU,QAAQ,KAAK,EAAE;KAEtE,IAAI,MAAM,SAAS,UAAU,QAAQ,yBAAyB,MAAM;UAC/D,IAAI,MAAM,SAAS,UAAU,QAAQ,6BAA6B;UAClE,QAAQ,iCAAiC;KAC9C,IAAI,cAAc,QAAQ,gCAAgC;KAC1D,MAAM,+BAA+B,cAAc,OAAO;KAK1D,IAAI,MAAM,SAAS,UAAU;MAC3B,MAAM,SAAS,oBAAoB,KAAK;MACxC,MAAM,gBAAgB,eAAe,KAAK;MAG1C,MAAM,QAAQ,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK;MAC3C,QAAQ,qCAAqC;MAC7C,CAAM,YAAY;OAChB,MAAM,sBAAsB;QAC1B;QACA,SAAS,MAAM;QACf,MAAM;QACN;QACA;QACA,UAAU,kBAAkBA,KAAS,KAAK,OAAO,GAAG,6BAA6B,CAAC;OACpF,CAAC;MACH,EAAA,CAAG,CAAC,CAAC,YAAY,CAAC,CAAC;KACrB;KACA,MAAM,OACJ;KAEF,IAAI,MAAM,SAAS,UACjB,QAAQ,OAAO,OACZ,cACG,oEAAoE,MAAM,OAAO,yCACjF,2CAA2C,MAAM,OAAO,QAAQ,IACtE;UACK;MACL,MAAM,MAAM,oBAAoB,KAAK,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;MACjE,MAAM,WAAW,eACb,yBACA;MACJ,QAAQ,OAAO,MACb,4CAA4C,MAAM,UAAU,iBAAiB,IAAI,SACrE,MAAM,SAAS,KAAK,IAAI,EAAE,KAAK,WAAW,MACxD;KACF;IACF,SAAS,KAAK;KAEZ,QAAQ,KAAK,qDAAqD,OAAO,GAAG,GAAG;IACjF;GACF,OAAO,IAAI,eAAe,aAAa;IAErC,QAAQ,OAAO,MACb,kLAEF;IACA,CAAM,YAAY;KAChB,IAAI;MACF,MAAM,OAAO,MAAM,qBAAqB,UAAU;OAChD;OACA,QAAQ,YAAY,QAAQ,IAAO;MACrC,CAAC;MACD,IAAI,MAAM;OACR,MAAM,CAAC,aAAa,MAAM,MAAM,QAAQ,IAAI,CAC1C,gBAAgB,QAAQ,CAAC,CAAC,YAAY,EAAE,GACxC,YAAY,QAAQ,CAAC,CAAC,YAAY,EAAE,CACtC,CAAC;OACD,MAAM,oBAAoB;QACxB,MAAM;QACN;QACA,aAAa;QACb,+BAAc,IAAI,KAAK,EAAA,CAAE,YAAY;QACrC,OAAO;QACP,WAAW,KAAK;QAChB,QAAQ,KAAK;QACb,YAAY,KAAK;QACjB,UAAU,KAAK;OACjB,CAAC;MACH;KACF,QAAQ,CAER;IACF,EAAA,CAAG,CAAC,CAAC,YAAY,CAAC,CAAC;GACrB,OAAO,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,aAE1C,QAAQ,OAAO,MACb,wNAGK,mBAAmB,IAAI,0EAA0E,MAClG,KACN;GAyBF,MAAM,cAAc,0BAA0B;IAC5C,UAAU,YAAY;IACtB,iBAAiB;IACjB,sBAAsB,mBAAmB;IACzC,kBAAkB,mBAAmB;IACrC,iBAAiB,oBAAoB;IACrC,yBAAyB,4BAA4B;IACrD,sBAAsB,MAAM;IAC5B,gBAAgB,kBAAkB;IAClC,qBAAqB,kBAAkB;IACvC,gBAAgB,WAAW,KAAK;IAChC;GACF,CAAC;GAID,uBAAuB;GACvB,uBAAuB,0BAA0B;IAC/C,sBAAsB,mBAAmB;IACzC,kBAAkB,mBAAmB;IACrC,iBAAiB,oBAAoB;IACrC,gBAAgB,kBAAkB;IAClC,qBAAqB,kBAAkB;IACvC;GACF,CAAC;GAUD,IAAI;IACF,MAAM,sCAAsC,WAAW;GACzD,SAAS,KAAK;IACZ,QAAQ,KACN,wHACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;GACF;GAOA,IAAI;IACF,MAAM,wCAAwC;GAChD,SAAS,KAAK;IACZ,QAAQ,KACN,6CACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;GACF;EACF,SAAS,KAAK;GACZ,QAAQ,KACN,2DACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;EACF;EAsBF,UAAU,KACR,0BACA,wBAAwB,uBACpB,GAAG,0BAA0B,MAAM,yBACnC,yBACN;EACA,IAAI;GACF,MAAM,2CAA2C;EACnD,SAAS,KAAK;GACZ,QAAQ,KACN,gDACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;EACF;EAQA,IAAI,QAAQ,IAAI,qCAAqC,KACnD,IAAI;GACF,MAAM,eAAeA,KAAS,KAAK,MAAM,mBAAmB,eAAe;GAC3E,MAAM,6CAA6C,YAAY;EACjE,SAAS,KAAK;GACZ,QAAQ,KACN,6CACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;EACF;EAGF,YACE;GAAE,MAAM;GAAe;GAAS;GAAW,OAAO;EAAW,GAC7D,QACA,EAAE,WAAW,CACf;CACF;AACF,CAAC"}

package/dist/engine-Drs3cxLW.js

@@ -1,2 +0,0 @@
-import { b as runWorkerAgent } from "./peer-mcp-personas-TMOZJhfy.js";
-export { runWorkerAgent };

package/dist/lifecycle-2M0IThRr.js

@@ -1,2 +0,0 @@
-import { o as sweepStaleColbertMetaAtBoot } from "./lifecycle-AgNOtFRv.js";
-export { sweepStaleColbertMetaAtBoot };

package/dist/lifecycle-C8kFsAj-.js

@@ -1,2 +0,0 @@
-import { o as sweepStaleWorktreesAtBoot } from "./lifecycle-0XrazT05.js";
-export { sweepStaleWorktreesAtBoot };

package/dist/paths-BbHtQAOs.js

@@ -1,2 +0,0 @@
-import { t as PATHS } from "./paths-Bg1_DWhi.js";
-export { PATHS };

package/dist/serve-DMA82DFJ.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve-DMA82DFJ.js","names":["fs","fsSync","fs"],"sources":["../src/lib/serve/cloudcli.ts","../src/lib/serve/devtunnel.ts","../src/lib/serve/enhancements.ts","../src/lib/serve/provider-facade.ts","../src/lib/serve/reverse-proxy.ts","../src/serve.ts"],"sourcesContent":["import { spawn, type ChildProcess } from \"node:child_process\"\nimport { randomBytes } from \"node:crypto\"\nimport fs from \"node:fs/promises\"\nimport fsSync from \"node:fs\"\nimport http from \"node:http\"\nimport path from \"node:path\"\n\nimport consola from \"consola\"\n\nimport { runCommandCapture, resolveExecutable } from \"../exec\"\nimport { PATHS } from \"../paths\"\nimport { buildEnv } from \"../worker-agent/bash\"\n\nexport const CLOUDCLI_PACKAGE = \"@cloudcli-ai/cloudcli\"\n/** Pinned, tested known-good version. Never `@latest` (see docs/serve-control-plane.md). */\nexport const CLOUDCLI_PINNED_VERSION = \"1.36.1\"\n\n/**\n * Build the env handed to the CloudCLI child. Starts from `buildEnv()` — the\n * vetted secret-stripping ALLOWLIST used for worker bash (drops GITHUB_TOKEN,\n * GH_ROUTER_*, ANTHROPIC_AUTH_TOKEN, OPENAI_API_KEY, COPILOT_TOKEN by omission)\n * — then layers the non-secret Anthropic/Claude vars. The spawned claude still\n * authenticates because that rides the synthetic `.credentials.json` FILE in\n * CLAUDE_CONFIG_DIR, not an env token. Load-bearing: CloudCLI exposes a browser\n * terminal that can read its own env, so no secret may live there.\n */\nexport function composeCloudCliChildEnv(\n  anthropicVars: Record<string, string>,\n): NodeJS.ProcessEnv {\n  return { ...buildEnv(), ...anthropicVars }\n}\n\nconst SERVER_ENTRY_REL = path.join(\n  \"dist-server\",\n  \"server\",\n  \"index.js\",\n)\n\nexport interface ResolvedCloudCli {\n  /** Absolute path to the CloudCLI server entry (dist-server/server/index.js). */\n  serverEntry: string\n  version: string | null\n}\n\n/** Where the package's server entry lives under a given install root. */\nfunction serverEntryUnderRoot(root: string): string {\n  return path.join(root, \"node_modules\", CLOUDCLI_PACKAGE, SERVER_ENTRY_REL)\n}\n\nasync function exists(p: string): Promise<boolean> {\n  try {\n    await fs.access(p)\n    return true\n  } catch {\n    return false\n  }\n}\n\nasync function readVersion(pkgRoot: string): Promise<string | null> {\n  try {\n    const raw = await fs.readFile(\n      path.join(pkgRoot, \"node_modules\", CLOUDCLI_PACKAGE, \"package.json\"),\n      \"utf8\",\n    )\n    return (JSON.parse(raw) as { version?: string }).version ?? null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Resolve the CloudCLI server entry, in order:\n *   1. an explicit `--cloudcli-path` (a package dir OR an install root),\n *   2. an existing pinned install in the router-owned dir,\n *   3. (unless `noInstall`) install the pinned version into the router-owned dir.\n * Never installs globally, never `@latest`.\n */\nexport async function resolveCloudCli(opts: {\n  cliPath?: string\n  noInstall: boolean\n  version?: string\n}): Promise<ResolvedCloudCli> {\n  const version = opts.version ?? CLOUDCLI_PINNED_VERSION\n\n  // 1. explicit path — accept either a package dir or an install root.\n  if (opts.cliPath) {\n    const direct = path.join(opts.cliPath, SERVER_ENTRY_REL)\n    const underRoot = serverEntryUnderRoot(opts.cliPath)\n    if (await exists(direct)) return { serverEntry: direct, version: null }\n    if (await exists(underRoot))\n      return { serverEntry: underRoot, version: await readVersion(opts.cliPath) }\n    throw new Error(\n      `--cloudcli-path \"${opts.cliPath}\" does not contain a CloudCLI install (looked for ${SERVER_ENTRY_REL}).`,\n    )\n  }\n\n  // 2. existing router-owned install.\n  const root = PATHS.CLOUDCLI_HOME\n  const entry = serverEntryUnderRoot(root)\n  if (await exists(entry)) {\n    return { serverEntry: entry, version: await readVersion(root) }\n  }\n\n  // 3. install the pinned version locally into the router-owned dir.\n  if (opts.noInstall) {\n    throw new Error(\n      `CloudCLI is not installed and --no-install was given. Install it with:\\n  npm i --prefix \"${root}\" ${CLOUDCLI_PACKAGE}@${version}`,\n    )\n  }\n  await installCloudCli(root, version)\n  if (!(await exists(entry))) {\n    throw new Error(\n      `CloudCLI install completed but the server entry is missing (${entry}).`,\n    )\n  }\n  return { serverEntry: entry, version: await readVersion(root) }\n}\n\nasync function installCloudCli(root: string, version: string): Promise<void> {\n  const npm = resolveExecutable(\"npm\")\n  if (!npm) {\n    throw new Error(\n      \"npm not found on PATH — cannot install CloudCLI. Install Node.js/npm, or pass --cloudcli-path to an existing install.\",\n    )\n  }\n  await fs.mkdir(root, { recursive: true, mode: 0o700 })\n  // A local package.json so `npm i` installs into <root>/node_modules\n  // instead of walking up to a parent project.\n  const pkgJson = path.join(root, \"package.json\")\n  if (!(await exists(pkgJson))) {\n    await fs.writeFile(\n      pkgJson,\n      JSON.stringify({ name: \"gh-router-cloudcli-host\", private: true }, null, 2),\n    )\n  }\n  consola.info(\n    `Installing ${CLOUDCLI_PACKAGE}@${version} (one-time, ~a minute; builds native deps)…`,\n  )\n  const { code, stderr } = await runCommandCapture(\n    [\n      npm,\n      \"install\",\n      `${CLOUDCLI_PACKAGE}@${version}`,\n      \"--prefix\",\n      root,\n      \"--no-audit\",\n      \"--no-fund\",\n      \"--loglevel=error\",\n    ],\n    { timeoutMs: 10 * 60_000 },\n  )\n  if (code !== 0) {\n    throw new Error(\n      `CloudCLI install failed (npm exit ${code}). This often means no network, a corporate proxy, or missing Windows build tools for native deps.\\nInstall manually then re-run with --cloudcli-path:\\n  npm i --prefix \"${root}\" ${CLOUDCLI_PACKAGE}@${version}\\n${stderr.slice(0, 400)}`,\n    )\n  }\n}\n\nexport interface CloudCliProcess {\n  child: ChildProcess\n  port: number\n  databasePath: string\n}\n\n/** Spawn CloudCLI on a loopback port with the given (already-filtered) env. */\nexport function spawnCloudCli(opts: {\n  serverEntry: string\n  port: number\n  env: NodeJS.ProcessEnv\n}): CloudCliProcess {\n  const databasePath = path.join(PATHS.CLOUDCLI_HOME, \"auth.db\")\n  const node = resolveExecutable(\"node\") ?? process.execPath\n  // Diagnostic opt-in: route CloudCLI's stdout+stderr to a log file so its\n  // internal errors (SDK/DB/session-create) are inspectable. Default stays\n  // \"ignore\" (CloudCLI is noisy and its logs aren't user-facing).\n  const logPath = process.env.GH_ROUTER_CLOUDCLI_LOG\n  let stdio: \"ignore\" | [\"ignore\", number, number] = \"ignore\"\n  if (logPath) {\n    try {\n      const fd = fsSync.openSync(logPath, \"a\")\n      stdio = [\"ignore\", fd, fd]\n    } catch {\n      /* unwritable log path — fall back to ignore */\n    }\n  }\n  const child = spawn(node, [opts.serverEntry], {\n    env: {\n      ...opts.env,\n      SERVER_PORT: String(opts.port),\n      HOST: \"127.0.0.1\", // loopback only — never 0.0.0.0\n      DATABASE_PATH: databasePath, // router-owned, isolated from a user's standalone CloudCLI\n      // Do NOT set VITE_IS_PLATFORM: it disarms server auth and still shows a\n      // login wall in the OSS bundle. Keep JWT auth on; auto-login is done by\n      // the reverse proxy injecting the token.\n      VITE_IS_PLATFORM: \"\",\n    },\n    stdio,\n    windowsHide: true,\n  })\n  return { child, port: opts.port, databasePath }\n}\n\n// ---- health + JWT --------------------------------------------------------\n\nfunction req(\n  port: number,\n  method: \"GET\" | \"POST\",\n  urlPath: string,\n  body?: unknown,\n): Promise<{ status: number; body: string }> {\n  return new Promise((resolve, reject) => {\n    const data = body === undefined ? undefined : JSON.stringify(body)\n    const r = http.request(\n      {\n        host: \"127.0.0.1\",\n        port,\n        path: urlPath,\n        method,\n        headers: data\n          ? { \"content-type\": \"application/json\", \"content-length\": Buffer.byteLength(data) }\n          : {},\n      },\n      (res) => {\n        let b = \"\"\n        res.on(\"data\", (d) => (b += d))\n        res.on(\"end\", () => resolve({ status: res.statusCode ?? 0, body: b }))\n      },\n    )\n    r.on(\"error\", reject)\n    if (data) r.write(data)\n    r.end()\n  })\n}\n\nconst sleep = (ms: number) => new Promise((r) => setTimeout(r, ms))\n\n/** Poll /api/auth/status until the server answers. Returns `needsSetup`. */\nexport async function waitForCloudCliReady(\n  port: number,\n  timeoutMs = 60_000,\n): Promise<{ needsSetup: boolean }> {\n  const deadline = Date.now() + timeoutMs\n  while (Date.now() < deadline) {\n    try {\n      const r = await req(port, \"GET\", \"/api/auth/status\")\n      if (r.status === 200) {\n        const parsed = JSON.parse(r.body) as { needsSetup?: boolean }\n        return { needsSetup: parsed.needsSetup === true }\n      }\n    } catch {\n      // not up yet\n    }\n    await sleep(1000)\n  }\n  throw new Error(`CloudCLI did not become ready within ${timeoutMs}ms`)\n}\n\nconst secretFile = () => path.join(PATHS.CLOUDCLI_HOME, \".serve-secret.json\")\n\nasync function loadPassword(username: string): Promise<string | null> {\n  try {\n    const raw = await fs.readFile(secretFile(), \"utf8\")\n    const parsed = JSON.parse(raw) as { username?: string; password?: string }\n    if (parsed.username === username && parsed.password) return parsed.password\n  } catch {\n    // no file yet\n  }\n  return null\n}\n\nasync function persistPassword(username: string, password: string): Promise<void> {\n  // mode 0o600 + a 0o700 parent dir. On Windows the mode bits are ignored, but\n  // the dir lives under the per-user home, which is user-ACL'd by default; the\n  // password is a low-value local login for a loopback-only, Origin-gated app.\n  await fs.mkdir(PATHS.CLOUDCLI_HOME, { recursive: true, mode: 0o700 })\n  await fs.writeFile(\n    secretFile(),\n    JSON.stringify({ username, password }),\n    { mode: 0o600 },\n  )\n}\n\n/**\n * Ensure a CloudCLI user exists and return a valid JWT. On a fresh (isolated)\n * DB we register (persisting the password only AFTER success); on an existing\n * DB we log in with the persisted password.\n */\nexport async function mintJwt(\n  port: number,\n  username: string,\n  needsSetup: boolean,\n): Promise<string> {\n  const existing = await loadPassword(username)\n  if (needsSetup) {\n    const password = existing ?? randomBytes(24).toString(\"base64url\")\n    const r = await req(port, \"POST\", \"/api/auth/register\", { username, password })\n    if (r.status === 200) {\n      const token = (JSON.parse(r.body) as { token?: string }).token\n      if (token) {\n        await persistPassword(username, password)\n        return token\n      }\n    }\n    // Fall through to login (e.g. a race created the user first).\n  }\n  const password = existing\n  if (!password) {\n    throw new Error(\n      `CloudCLI already has a user but no stored password for \"${username}\". Delete ${path.join(PATHS.CLOUDCLI_HOME, \"auth.db\")} and retry.`,\n    )\n  }\n  const r = await req(port, \"POST\", \"/api/auth/login\", { username, password })\n  if (r.status === 200) {\n    const token = (JSON.parse(r.body) as { token?: string }).token\n    if (token) return token\n  }\n  throw new Error(\n    `Could not obtain a CloudCLI session token (status ${r.status}). If a stale isolated DB exists, delete ${path.join(PATHS.CLOUDCLI_HOME, \"auth.db\")} and retry.`,\n  )\n}\n","import { spawn } from \"node:child_process\"\nimport { createHash } from \"node:crypto\"\nimport os from \"node:os\"\n\nimport { killChildProcessTree, resolveExecutable, runCommandCapture } from \"../exec\"\n\n// Label stamped on every tunnel `serve --tunnel` creates, so our tunnels are\n// identifiable and sweepable (`devtunnel list -l github-router-serve`). Before\n// this, serve minted an anonymous, unlabeled tunnel per launch that was never\n// deleted — they accumulated server-side against the hard\n// `TunnelsPerUserPerCluster` (10) cap until new tunnels were denied.\nexport const SERVE_TUNNEL_LABEL = \"github-router-serve\"\n\n// A per-machine label so reuse/sweep scopes to THIS host and never touches a\n// tunnel another machine (sharing the same dev-tunnels account) owns. Hashed so\n// an arbitrary hostname maps to a label-charset-safe token.\nexport function serveTunnelMachineLabel(hostname: string = os.hostname()): string {\n  return `ghr-machine-${createHash(\"sha256\").update(hostname).digest(\"hex\").slice(0, 12)}`\n}\n\n/**\n * Stable, deterministic tunnel ID for THIS machine, so `serve --tunnel` REUSES\n * one tunnel across launches → a stable, bookmarkable public URL. Derived from a\n * hash of the hostname (valid tunnel-id charset: lowercase alnum + hyphens,\n * bounded length). NOTE: the hosting URL's subdomain is a devtunnels-assigned\n * token, NOT this id — the id only anchors find/reuse; the URL is stable because\n * the same tunnel is re-hosted, not because the id appears in it.\n */\nexport function serveTunnelId(hostname: string = os.hostname()): string {\n  return `ghr-serve-${createHash(\"sha256\").update(hostname).digest(\"hex\").slice(0, 12)}`\n}\n\n/**\n * Reconcile a reused tunnel's ports to exactly `[desired]`: which existing ports\n * to delete and whether the desired port must be created. Pure (unit-tested).\n * This is why reuse works across `--port` changes — `devtunnel host <id>\n * -p <newport>` fails (\"Batch update of ports is not supported\"), but per-port\n * `port delete` + `port create` does not.\n */\nexport function portsToReconcile(\n  currentPorts: number[],\n  desired: number,\n): { toDelete: number[]; toCreate: number | null } {\n  return {\n    toDelete: currentPorts.filter((p) => p !== desired),\n    toCreate: currentPorts.includes(desired) ? null : desired,\n  }\n}\n\nexport interface TunnelInfo {\n  tunnelId: string\n  labels?: string[]\n  hostConnections?: number\n}\n\n/**\n * The IDs of our own idle tunnels for this machine to sweep — EXCLUDING the\n * stable reused tunnel (`exceptId`), which we keep and re-host. Pure\n * (unit-tested). A tunnel with a live host connection (a concurrent serve\n * instance) is never swept. Cleans up pre-migration random-named tunnels + any\n * crash-orphaned duplicates while preserving the one stable tunnel.\n */\nexport function serveTunnelIdsToSweep(\n  tunnels: TunnelInfo[],\n  machineLabel: string,\n  exceptId?: string,\n): string[] {\n  return tunnels\n    .filter((t) => (t.labels ?? []).includes(machineLabel) && !t.hostConnections)\n    .map((t) => t.tunnelId)\n    .filter((id) => !exceptId || id.split(\".\")[0] !== exceptId)\n}\n\n/** List the tunnels serve owns (label-filtered). Best-effort: [] on any error. */\nasync function listServeTunnels(cli: string): Promise<TunnelInfo[]> {\n  try {\n    const { stdout, code } = await runCommandCapture(\n      [cli, \"list\", \"-l\", SERVE_TUNNEL_LABEL, \"-j\"],\n      { timeoutMs: 15_000 },\n    )\n    if (code !== 0) return []\n    const parsed = JSON.parse(stdout) as { tunnels?: TunnelInfo[] }\n    return Array.isArray(parsed?.tunnels) ? parsed.tunnels : []\n  } catch {\n    return []\n  }\n}\n\n/** Best-effort delete of a single tunnel by full id (e.g. `fancy-fog-x.inc1`). */\nasync function deleteTunnel(cli: string, tunnelId: string): Promise<void> {\n  try {\n    await runCommandCapture([cli, \"delete\", tunnelId, \"-f\"], { timeoutMs: 15_000 })\n  } catch {\n    /* best-effort — a stale delete failing must not block hosting */\n  }\n}\n\n/** Current port numbers configured on a tunnel. Best-effort: [] on any error. */\nasync function getTunnelPorts(cli: string, tunnelId: string): Promise<number[]> {\n  try {\n    const { stdout, code } = await runCommandCapture(\n      [cli, \"port\", \"list\", tunnelId, \"-j\"],\n      { timeoutMs: 15_000 },\n    )\n    if (code !== 0) return []\n    const parsed = JSON.parse(stdout) as { ports?: Array<{ portNumber?: number }> }\n    return (parsed?.ports ?? [])\n      .map((p) => p.portNumber)\n      .filter((n): n is number => typeof n === \"number\")\n  } catch {\n    return []\n  }\n}\n\n/**\n * Ensure the stable per-machine tunnel exists (create it labeled if absent).\n * Returns true when the stable tunnel is present + owned by us (safe to reuse),\n * false to fall back to the anonymous-labeled host path. `existing` is the\n * pre-fetched label-scoped list (so we don't re-list).\n */\nasync function ensureStableTunnel(\n  cli: string,\n  stableId: string,\n  machineLabel: string,\n  existing: TunnelInfo[],\n): Promise<boolean> {\n  const present = existing.some((t) => t.tunnelId.split(\".\")[0] === stableId)\n  if (present) return true\n  try {\n    // `create` errors (\"Conflict\") if the id is already taken — but we only get\n    // here when our label-scoped list did NOT contain it, so a conflict means a\n    // DIFFERENT owner holds the id: fall back rather than reuse a foreign tunnel.\n    const { code } = await runCommandCapture(\n      [cli, \"create\", stableId, \"-l\", SERVE_TUNNEL_LABEL, \"-l\", machineLabel,\n        \"-d\", \"github-router-serve-control-plane\"],\n      { timeoutMs: 20_000 },\n    )\n    return code === 0\n  } catch {\n    return false\n  }\n}\n\n/** Reconcile the tunnel's ports to exactly `[port]` (delete stale, create missing). */\nasync function reconcileTunnelPorts(cli: string, tunnelId: string, port: number): Promise<void> {\n  const { toDelete, toCreate } = portsToReconcile(await getTunnelPorts(cli, tunnelId), port)\n  for (const p of toDelete) {\n    await runCommandCapture([cli, \"port\", \"delete\", tunnelId, \"-p\", String(p)], { timeoutMs: 15_000 }).catch(() => {})\n  }\n  if (toCreate != null) {\n    await runCommandCapture([cli, \"port\", \"create\", tunnelId, \"-p\", String(toCreate)], { timeoutMs: 15_000 }).catch(() => {})\n  }\n}\n\n\n// Matches the browser URL devtunnel prints, e.g.\n//   Hosting port 5454 at https://l3rs99qw-5454.usw2.devtunnels.ms/\nconst DEVTUNNEL_URL_RE =\n  /https:\\/\\/[a-z0-9][a-z0-9-]*(?:\\.[a-z0-9-]+)*\\.devtunnels\\.ms\\/?/i\n\nexport type DevtunnelFailureKind =\n  | \"not-installed\"\n  | \"not-logged-in\"\n  | \"timeout\"\n  | \"exited\"\n  | \"spawn\"\n\nexport class DevtunnelError extends Error {\n  readonly kind: DevtunnelFailureKind\n  constructor(kind: DevtunnelFailureKind, message: string) {\n    super(message)\n    this.name = \"DevtunnelError\"\n    this.kind = kind\n  }\n}\n\nexport interface DevtunnelHandle {\n  url: string\n  stop: () => void\n}\n\n/** Absolute path to the `devtunnel` CLI, or null if not on PATH. */\nexport function resolveDevtunnelCli(): string | null {\n  return resolveExecutable(\"devtunnel\")\n}\n\n/** Best-effort login check via `devtunnel user show`. */\nexport async function isDevtunnelLoggedIn(cli: string): Promise<boolean> {\n  try {\n    const { stdout, stderr, code } = await runCommandCapture(\n      [cli, \"user\", \"show\"],\n      { timeoutMs: 15_000 },\n    )\n    const out = `${stdout}\\n${stderr}`\n    if (/not logged in/i.test(out)) return false\n    if (/logged in as/i.test(out)) return true\n    return code === 0\n  } catch {\n    return false\n  }\n}\n\n/** Extract the dev-tunnel browser URL from CLI output. Exported for tests. */\nexport function parseDevtunnelUrl(text: string): string | null {\n  const m = text.match(DEVTUNNEL_URL_RE)\n  return m ? m[0].replace(/\\/+$/, \"\") : null\n}\n\n/**\n * Spawn `devtunnel <args>` and resolve once it prints its public URL. Shared by\n * the stable-reuse and anonymous-labeled host paths. Rejects (DevtunnelError) on\n * timeout, early exit, an auth error in the output, or a spawn failure.\n */\nfunction hostTunnelProcess(cli: string, args: string[], timeoutMs: number): Promise<DevtunnelHandle> {\n  const child = spawn(cli, args, { stdio: [\"ignore\", \"pipe\", \"pipe\"], windowsHide: true })\n  return new Promise<DevtunnelHandle>((resolve, reject) => {\n    let settled = false\n    const stop = () => {\n      // Tree-kill: the devtunnel process spawns a helper and a plain\n      // child.kill() leaves the tunnel up (verified). taskkill /T /F on\n      // Windows, process-group SIGTERM on POSIX.\n      try {\n        killChildProcessTree(child, { detachedGroup: process.platform !== \"win32\" })\n      } catch {\n        try {\n          child.kill()\n        } catch {\n          /* already gone */\n        }\n      }\n    }\n    const finish = (fn: () => void) => {\n      if (settled) return\n      settled = true\n      clearTimeout(timer)\n      fn()\n    }\n    const timer = setTimeout(\n      () =>\n        finish(() => {\n          stop()\n          reject(new DevtunnelError(\"timeout\", \"dev tunnel did not report a URL in time\"))\n        }),\n      timeoutMs,\n    )\n    const onData = (buf: Buffer) => {\n      const text = String(buf)\n      const url = parseDevtunnelUrl(text)\n      if (url) {\n        finish(() => resolve({ url, stop }))\n        return\n      }\n      if (/not logged in|login (required|expired)|unauthorized/i.test(text)) {\n        finish(() => {\n          stop()\n          reject(new DevtunnelError(\"not-logged-in\", \"dev tunnel authentication failed; run `devtunnel user login`\"))\n        })\n      }\n    }\n    child.stdout?.on(\"data\", onData)\n    child.stderr?.on(\"data\", onData)\n    child.once(\"error\", (err) => finish(() => reject(new DevtunnelError(\"spawn\", err.message))))\n    child.once(\"exit\", (code) =>\n      finish(() =>\n        reject(new DevtunnelError(\"exited\", `devtunnel exited (code ${code}) before printing a URL`)),\n      ),\n    )\n  })\n}\n\n/**\n * Host an AUTHENTICATED (never anonymous) dev tunnel forwarding `port`, resolving\n * once its public URL is printed. NEVER `--allow-anonymous` (owner-only access).\n *\n * REUSES a stable per-machine tunnel (`serveTunnelId`) across launches → a\n * STABLE, bookmarkable public URL. Each launch: ensure the stable tunnel exists\n * (create it labeled if absent), reconcile its ports to exactly `[port]` via\n * per-port delete/create (`host <id> -p <newport>` can't change ports — it 400s\n * \"Batch update of ports is not supported\"), sweep our OTHER idle labeled tunnels\n * (pre-migration random-named ones / crash orphans), then `host <id>`. The URL's\n * subdomain is a devtunnels-assigned token (not the id), but it's stable because\n * the SAME tunnel is re-hosted every launch.\n *\n * If any stable-path step fails (id already taken by another owner, CLI hiccup),\n * falls back to hosting a fresh anonymous-labeled tunnel (the prior behavior) so\n * `--tunnel` always works — just without a stable URL that launch.\n */\nexport async function startDevtunnel(\n  port: number,\n  opts: { timeoutMs?: number } = {},\n): Promise<DevtunnelHandle> {\n  const cli = resolveDevtunnelCli()\n  if (!cli) {\n    throw new DevtunnelError(\n      \"not-installed\",\n      \"The `devtunnel` CLI is not installed. Install it (winget install Microsoft.devtunnel  /  brew install --cask devtunnel) then run `devtunnel user login`.\",\n    )\n  }\n  if (!(await isDevtunnelLoggedIn(cli))) {\n    throw new DevtunnelError(\n      \"not-logged-in\",\n      \"Not signed in to dev tunnels. Run `devtunnel user login` (or `devtunnel user login -g` for GitHub) first.\",\n    )\n  }\n\n  const timeoutMs = opts.timeoutMs ?? 40_000\n  const machineLabel = serveTunnelMachineLabel()\n  const stableId = serveTunnelId()\n\n  // Stable-reuse path (best-effort; any failure falls through to anonymous host).\n  try {\n    const owned = await listServeTunnels(cli)\n    if (await ensureStableTunnel(cli, stableId, machineLabel, owned)) {\n      await reconcileTunnelPorts(cli, stableId, port)\n      // Sweep our OTHER idle labeled tunnels but KEEP the stable one.\n      for (const id of serveTunnelIdsToSweep(owned, machineLabel, stableId)) {\n        await deleteTunnel(cli, id)\n      }\n      return await hostTunnelProcess(cli, [\"host\", stableId], timeoutMs)\n    }\n  } catch {\n    /* fall through to the anonymous-labeled host path */\n  }\n\n  // Fallback: sweep our idle labeled tunnels, then host a fresh anonymous one.\n  // Labels are SEPARATE `-l` flags — the service rejects a label containing a\n  // space (`must match '[\\w-=]{1,50}'`), so they can't be joined into one arg.\n  try {\n    for (const id of serveTunnelIdsToSweep(await listServeTunnels(cli), machineLabel)) {\n      await deleteTunnel(cli, id)\n    }\n  } catch {\n    /* best-effort sweep — never blocks hosting */\n  }\n  return await hostTunnelProcess(\n    cli,\n    [\"host\", \"-p\", String(port), \"-l\", SERVE_TUNNEL_LABEL, \"-l\", machineLabel, \"-d\", \"github-router-serve-control-plane\"],\n    timeoutMs,\n  )\n}\n","import path from \"node:path\"\n\nimport consola from \"consola\"\n\nimport { injectAttributionSuppressionIntoSettingsFile } from \"../attribution-settings\"\nimport {\n  BUILTIN_SUBAGENT_DEFINITIONS,\n  injectPeerMcpIntoMirror,\n  resolveGroupKeysFromMirror,\n  workersKeyOf,\n  writePeerMcpRuntimeFiles,\n} from \"../codex-mcp-config\"\nimport {\n  appendPeerAwarenessToMirroredClaudeMd,\n  appendToolbeltAwarenessToMirroredClaudeMd,\n  OPERATING_DEFAULTS_DIRECTIVE,\n  prependOperatingDefaultsToMirroredClaudeMd,\n  prependStyleDirectiveToMirroredClaudeMd,\n} from \"../claude-md-injection\"\nimport { INJECTED_SKILLS, writeInjectedSkill } from \"../injected-skills\"\nimport {\n  configureServeDefaultPermissionMode,\n  injectAllowRules,\n  planModeAllowRules,\n  sanitizeServeSettingsEnv,\n} from \"../mcp-permissions-settings\"\nimport {\n  agentToolsEnabled,\n  browseAgentEnabled,\n  browserCompoundToolsEnabled,\n  browserToolsEnabled,\n  fleetToolsEnabled,\n  geminiAvailable,\n  nativeSubagentModel,\n  brainstormModel,\n  reviewerModel,\n  scoutModel,\n  scribeModel,\n  standInToolEnabled,\n  workerToolsEnabled,\n} from \"../mcp-capabilities\"\nimport { buildPlanReviewHookCommand, planReviewEnabled } from \"../orchestration/plan-review-hook\"\nimport { buildPromptSubmitHookCommand } from \"../orchestration/prompt-submit-hook\"\nimport { injectStopHookIntoSettingsFile } from \"../orchestration/stop-gate-hook\"\nimport { PATHS } from \"../paths\"\nimport { buildPeerAwarenessSnippet, enumerateInjectedMcpToolNames, type McpGroup } from \"../peer-mcp-personas\"\nimport { state } from \"../state\"\nimport { availableToolCommands, buildToolbeltAwareness, toolbeltEnabled } from \"../toolbelt\"\nimport {\n  activeDispatchModes,\n  buildWorkerGuardHookCommand,\n  guardToolMatcher,\n} from \"../worker-dispatch\"\n\nexport interface ServeEnhancementsHandle {\n  cleanup: () => Promise<void>\n  nonce?: string\n  /** Exact `mcp__<key>__<tool>` names of every injected MCP tool — seeded into\n   *  the reverse-proxy's `localStorage['claude-settings'].allowedTools` so\n   *  CloudCLI's `canUseTool` auto-approves them in PLAN mode. */\n  mcpToolNames?: string[]\n}\n\nexport interface ServeEnhancementOpts {\n  /** Route Codex personas through a local `codex mcp-server` (stdio) when the backend resolved to \"cli\". */\n  codexCli?: boolean\n  /** True when the control plane is reachable beyond loopback (a --tunnel or --public-url is active). Gates the highest-blast-radius capabilities OFF by default: the server-side browser MCP (a session-hijack / SSRF / cloud-metadata primitive when reachable remotely) and first-mate (mints a repo+workflow GitHub write token). */\n  tunnelExposed?: boolean\n  /** Operator opt-in to expose the browser MCP over the tunnel despite the risk. */\n  browseOverTunnel?: boolean\n  /** Operator opt-in to expose first-mate over the tunnel despite the risk. */\n  agentsOverTunnel?: boolean\n  /** Operator opt-in to expose the fleet MCP over the tunnel despite the risk\n   *  (fleet drives remote coding sessions with the operator's stored fleet\n   *  credentials — an equal-or-higher blast radius than the browser MCP). */\n  fleetOverTunnel?: boolean\n}\n\nconst NOOP: ServeEnhancementsHandle = { cleanup: async () => {} }\n\n/**\n * Wire the github-router enhancement layer into the router-owned\n * CLAUDE_CONFIG_DIR mirror so a CloudCLI-spawned Claude session gets the same\n * tools `github-router claude` provides:\n *   - the scoped MCP servers (peers / search / orchestrate, plus workers /\n *     decide / browser / fleet / first-mate when their gate passes) — the\n *     SDK-spawned claude reads them from the mirror's `.claude.json`,\n *   - the peer-critic / worker / implementer subagents (`.md` files written into\n *     the mirror's `agents/`),\n *   - the gh-* skills (research / orchestrate / floor-keeper / worker).\n *\n * Best-effort: on any failure Claude still works, just without the extras.\n * Must run AFTER `ensureClaudeConfigMirror()` and BEFORE CloudCLI is spawned.\n * Tab-specific bits (ai-or-die hooks, artifact review) are intentionally left\n * out — they don't apply to the serve control plane.\n */\nexport async function provisionServeEnhancements(\n  serverUrl: string,\n  opts: ServeEnhancementOpts = {},\n): Promise<ServeEnhancementsHandle> {\n  try {\n    const tunnelExposed = opts.tunnelExposed === true\n    const browseAllowed = browserToolsEnabled() && (!tunnelExposed || opts.browseOverTunnel === true)\n    const firstMateAllowed = agentToolsEnabled() && (!tunnelExposed || opts.agentsOverTunnel === true)\n    const fleetAllowed = fleetToolsEnabled() && (!tunnelExposed || opts.fleetOverTunnel === true)\n\n    const enabledGroups: McpGroup[] = [\"peers\", \"search\", \"orchestrate\"]\n    if (workerToolsEnabled()) enabledGroups.push(\"workers\")\n    if (standInToolEnabled()) enabledGroups.push(\"decide\")\n    if (browseAllowed) enabledGroups.push(\"browser\")\n    if (fleetAllowed) enabledGroups.push(\"fleet\")\n    if (firstMateAllowed) enabledGroups.push(\"first-mate\")\n\n    const gem = geminiAvailable()\n    const { keys: groupKeys } = await resolveGroupKeysFromMirror(enabledGroups)\n\n    const runtime = await writePeerMcpRuntimeFiles(serverUrl, {\n      codexCli: opts.codexCli === true,\n      geminiAvailable: gem,\n      groupKeys,\n      workerToolsAvailable: workerToolsEnabled(),\n      browseAvailable: browseAllowed && browseAgentEnabled(),\n      nativeSubagentModel: nativeSubagentModel(),\n      reviewerModel: reviewerModel(),\n      brainstormModel: brainstormModel(),\n      scoutModel: scoutModel(),\n      scribeModel: scribeModel(),\n      // Serve-only: register Claude Code's built-in Explore/Plan/general-purpose\n      // subagents (the Agent SDK doesn't) so the model's habitual Agent() calls\n      // resolve. Never passed by `github-router claude` (would shadow the CLI's\n      // native built-ins).\n      builtinSubagents: BUILTIN_SUBAGENT_DEFINITIONS,\n    })\n    // The proxy's /mcp handler authorizes tool calls against this per-launch\n    // nonce (the same value baked into the mirrored mcpServers Authorization).\n    state.peerMcpNonce = runtime.nonce\n\n    const injected = await injectPeerMcpIntoMirror(serverUrl, {\n      codexCli: opts.codexCli === true,\n      geminiAvailable: gem,\n      groupKeys,\n      nonce: runtime.nonce,\n    })\n\n    const peerSnippet = buildPeerAwarenessSnippet({\n      codexCli: opts.codexCli === true,\n      geminiAvailable: gem,\n      workerToolsAvailable: workerToolsEnabled(),\n      standInAvailable: standInToolEnabled(),\n      browseAvailable: browseAllowed,\n      compoundBrowseAvailable: browseAllowed && browserCompoundToolsEnabled(),\n      powerBrowseAvailable: browseAllowed && state.powerBrowseEnabled,\n      agentToolsAvailable: firstMateAllowed,\n      scoutAvailable: scoutModel() != null,\n      groupKeys,\n    })\n\n    await appendPeerAwarenessToMirroredClaudeMd(peerSnippet).catch((err) =>\n      consola.warn(`Peer-awareness CLAUDE.md append failed: ${String(err)}`),\n    )\n    await prependStyleDirectiveToMirroredClaudeMd().catch((err) =>\n      consola.warn(`Style-directive CLAUDE.md prepend failed: ${String(err)}`),\n    )\n    await prependOperatingDefaultsToMirroredClaudeMd(OPERATING_DEFAULTS_DIRECTIVE).catch((err) =>\n      consola.warn(`Operating-defaults CLAUDE.md prepend failed: ${String(err)}`),\n    )\n    if (toolbeltEnabled()) {\n      const toolbeltLine = buildToolbeltAwareness(availableToolCommands())\n      if (toolbeltLine) {\n        await appendToolbeltAwarenessToMirroredClaudeMd(toolbeltLine).catch((err) =>\n          consola.warn(`Toolbelt CLAUDE.md append failed: ${String(err)}`),\n        )\n      }\n    }\n\n    // gh-* skills, minus the operator/tab-specific ones (first-mate, artifact).\n    let skillsWritten = 0\n    for (const s of INJECTED_SKILLS) {\n      if (s.name.startsWith(\"gh-first-mate\") || s.name === \"gh-artifact-review\") {\n        continue\n      }\n      const r = await writeInjectedSkill(s.name, s.md).catch(() => ({\n        written: false,\n      }))\n      if (r.written) skillsWritten++\n    }\n\n    const settingsPath = path.join(PATHS.CLAUDE_CONFIG_DIR, \"settings.json\")\n\n    // Suppress AI attribution in the mirror's settings.json (no-op if the user\n    // already configured it).\n    await injectAttributionSuppressionIntoSettingsFile(settingsPath).catch(() => {})\n\n    // Strip serve-inappropriate CLAUDE_CODE_* env keys the user may have set in\n    // their real settings.json — notably CLAUDE_CODE_COORDINATOR_MODE, which\n    // CloudCLI applies via settingSources and which strips the single serve chat\n    // agent down to delegation-only tools (a direct Glob/Read/Bash then fails\n    // \"not enabled in this context\"). UNCONDITIONAL: a working toolset is needed\n    // even when GH_ROUTER_SERVE_NO_AUTO_APPROVE=1 keeps permission prompts on.\n    const strip = await sanitizeServeSettingsEnv(settingsPath).catch((err) => {\n      consola.warn(`Could not sanitize serve settings env: ${String(err)}`)\n      return { removed: [] as string[] }\n    })\n    if (strip.removed.length) {\n      consola.info(`Serve: removed ${strip.removed.join(\", \")} from the mirror settings (single-agent surface).`)\n    }\n\n    // Serve's permission model: \"seamless routine + decisions to the user\".\n    // Set the mirror's default permission mode to \"default\" (NON-bypass) so\n    // CloudCLI's canUseTool callback stays live — routine tools pre-approved via\n    // the seeded allow-list run with no prompt, while AskUserQuestion/ExitPlanMode\n    // (never allow-listed) reach the human as real widgets. Bypass would skip\n    // canUseTool and auto-answer those two. Opt out with GH_ROUTER_SERVE_NO_AUTO_APPROVE=1\n    // (then CloudCLI prompts on every not-yet-approved tool).\n    if (process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== \"1\") {\n      await configureServeDefaultPermissionMode(settingsPath).catch((err) =>\n        consola.warn(`Could not set serve permission defaults: ${String(err)}`),\n      )\n    }\n\n    // Auto-approve github-router's injected MCP servers PLUS the native read-only\n    // research tools (WebSearch/WebFetch) via allow rules (MCP on the resolved\n    // keys). Redundant under the bypass default above, but load-bearing the moment\n    // a serve user switches the composer to PLAN mode: plan mode re-gates tools,\n    // and this is exactly the research surface wanted while planning. Runs AFTER\n    // the bypass config so the entries survive its allow-list clear. Uses the\n    // authoritative injected-server list (`injected.serversAdded` — includes the\n    // `codex-cli` stdio server), falling back to the resolved keys + codex-cli on\n    // collision.\n    const injectedServerKeys = injected.ok\n      ? injected.serversAdded\n      : [\n          ...Object.values(groupKeys).filter((k): k is string => Boolean(k)),\n          ...(opts.codexCli === true ? [\"codex-cli\"] : []),\n        ]\n    await injectAllowRules(settingsPath, planModeAllowRules(injectedServerKeys)).catch((err) =>\n      consola.warn(`Could not auto-approve injected tools: ${String(err)}`),\n    )\n\n    if (workerToolsEnabled()) {\n      const promptCmd = buildPromptSubmitHookCommand(process.execPath, process.argv[1])\n      await injectStopHookIntoSettingsFile(settingsPath, promptCmd, \"UserPromptSubmit\", 45).catch(\n        (err) => consola.warn(`Could not register the UserPromptSubmit hook: ${String(err)}`),\n      )\n\n      if (!injected.ok) {\n        consola.warn(\n          \"Workers non-blocking guard NOT registered: subagent MCP injection fell back to parent-only, so worker-* dispatchers cannot reach the workers server. Raw worker tools remain usable on the main thread.\",\n        )\n      } else if (process.env.GH_ROUTER_DISABLE_WORKER_GUARD !== \"1\") {\n        const workersKey = workersKeyOf(groupKeys)\n        const modes = activeDispatchModes({ browse: browseAllowed && browseAgentEnabled() })\n        const cmd = buildWorkerGuardHookCommand(\n          process.execPath,\n          process.argv[1],\n          workersKey,\n          modes,\n        )\n        const matcher = guardToolMatcher(workersKey, modes)\n        await injectStopHookIntoSettingsFile(settingsPath, cmd, \"PreToolUse\", 10, matcher).catch(\n          (err) => consola.warn(`Could not register the workers PreToolUse guard hook: ${String(err)}`),\n        )\n      } else {\n        consola.info(\n          \"Workers non-blocking guard disabled via GH_ROUTER_DISABLE_WORKER_GUARD=1; raw worker tools remain callable on the main thread.\",\n        )\n      }\n    }\n\n    if (planReviewEnabled()) {\n      try {\n        const command = buildPlanReviewHookCommand(process.execPath, process.argv[1])\n        // Advisory PostToolUse(ExitPlanMode) hook: non-blocking; findings surface on the next prompt.\n        // Verified (scripts/verify-plan-mode-cloudcli.mjs): ExitPlanMode runs as a real tool under\n        // CloudCLI's SDK path, and settingSources=['project','user','local'] loads this mirror\n        // settings.json hook, so PostToolUse(ExitPlanMode) fires on approval+execution.\n        await injectStopHookIntoSettingsFile(settingsPath, command, \"PostToolUse\", undefined, \"ExitPlanMode\")\n      } catch (err) {\n        consola.warn(`Could not register the advisory plan-review hook: ${String(err)}`)\n      }\n    }\n\n    const servers = injected.ok\n      ? injected.serversAdded.join(\", \")\n      : \"parent-only (user mcpServers collision)\"\n    consola.info(\n      `github-router tools wired into Claude sessions: MCP [${servers}], ${runtime.personas.length} subagents, ${skillsWritten} skills.`,\n    )\n    return {\n      cleanup: runtime.cleanup,\n      nonce: runtime.nonce,\n      mcpToolNames: enumerateInjectedMcpToolNames(groupKeys, { codexCli: opts.codexCli === true }),\n    }\n  } catch (err) {\n    consola.warn(\n      `Could not wire the github-router MCP/skills layer: ${\n        err instanceof Error ? err.message : String(err)\n      }. Claude still works, without the extra tools.`,\n    )\n    return NOOP\n  }\n}\n","import fs from \"node:fs/promises\"\nimport path from \"node:path\"\n\nimport type { Model, ModelsResponse } from \"~/services/copilot/get-models\"\n\nexport interface ProviderFacadeContext {\n  getModels: () => ModelsResponse | undefined\n  defaultModel: string\n  claudeConfigDir: string\n}\n\nexport type ProviderFacadeKind = \"models\" | \"mcp\" | \"skills\" | \"commands\" | \"auth\"\n\ntype JsonObject = Record<string, unknown>\n\nfunction isObject(value: unknown): value is JsonObject {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value)\n}\n\nfunction envelopedData(value: unknown): JsonObject | null {\n  if (!isObject(value) || !isObject(value.data)) return null\n  return value.data\n}\n\nfunction cloneObject<T extends JsonObject>(value: T): JsonObject {\n  return { ...value }\n}\n\n/**\n * Requests serve answers DIRECTLY (never forwarded to CloudCLI) with a canned\n * JSON body. `POST /api/system/update` is CloudCLI's \"update available\" button,\n * which runs a GLOBAL `npm install -g @cloudcli-ai/cloudcli@latest` in the user's\n * home dir (`server/index.js`) — mutating their global npm and never applying to\n * serve's pinned, router-owned install. Blocking it prevents that surprise\n * mutation and tells the user how updates actually work. HTTP 200 + `success:\n * false` so the UI neither runs the update nor throws an error toast. Returns\n * null for anything not blocked.\n */\nexport function facadeBlockedRequest(\n  method: string,\n  pathname: string,\n): { status: number; json: JsonObject } | null {\n  if (method.toUpperCase() === \"POST\" && pathname === \"/api/system/update\") {\n    return {\n      status: 200,\n      json: {\n        success: false,\n        managed: true,\n        message:\n          \"CloudCLI is managed by github-router (a pinned, router-owned install). \"\n          + \"To update, run `npm i -g github-router@latest`, then restart `github-router serve`.\",\n      },\n    }\n  }\n  return null\n}\n\nexport function facadeInterceptKind(\n  method: string,\n  pathname: string,\n): ProviderFacadeKind | null {\n  const normalizedMethod = method.toUpperCase()\n  if (normalizedMethod === \"POST\" && pathname === \"/api/commands/list\") {\n    return \"commands\"\n  }\n  if (normalizedMethod !== \"GET\") return null\n\n  switch (pathname) {\n    case \"/api/providers/claude/models\":\n      return \"models\"\n    case \"/api/providers/claude/mcp/servers\":\n      return \"mcp\"\n    case \"/api/providers/claude/skills\":\n      return \"skills\"\n    case \"/api/providers/claude/auth/status\":\n      return \"auth\"\n    default:\n      return null\n  }\n}\n\nexport async function rewriteProviderResponse(\n  kind: ProviderFacadeKind,\n  upstreamJson: unknown,\n  ctx: ProviderFacadeContext,\n  query: URLSearchParams,\n): Promise<unknown | null> {\n  try {\n    switch (kind) {\n      case \"models\":\n        return rewriteModels(upstreamJson, ctx)\n      case \"mcp\":\n        return rewriteMcp(upstreamJson, ctx, query)\n      case \"skills\":\n        return rewriteSkills(upstreamJson, ctx)\n      case \"commands\":\n        return rewriteCommands(upstreamJson, ctx)\n      case \"auth\":\n        return rewriteAuth(upstreamJson)\n    }\n  } catch {\n    return null\n  }\n}\n\nfunction rewriteModels(upstreamJson: unknown, ctx: ProviderFacadeContext): unknown | null {\n  if (!isObject(upstreamJson)) return null\n  const data = envelopedData(upstreamJson)\n  if (!data || !isObject(data.models) || data.cache === undefined) return null\n\n  const catalog = ctx.getModels()\n  const models = catalog?.data\n  if (!Array.isArray(models) || models.length === 0) return null\n\n  const options = models\n    .filter(isPickerModel)\n    .map((m) => {\n      const option: { value: string; label: string; description: string; effort?: JsonObject } = {\n        value: m.id,\n        label: m.name || m.id,\n        description: `${m.vendor} · ${m.capabilities.family}`,\n      }\n      // Emit the effort selector the CloudCLI UI + `resolveClaudeEffort` need:\n      // `effort.values` is `[{value}]` and the server maps it back with\n      // `.map(v => v.value)` to validate a client-picked effort before passing\n      // it to the binary. Derived from the Copilot catalog's per-model\n      // `reasoning_effort` allowlist; omitted for non-reasoning models (no\n      // selector shown). Default to `high` when supported (matches the shim's\n      // default), else the model's top tier.\n      const efforts = m.capabilities.supports?.reasoning_effort\n      if (Array.isArray(efforts) && efforts.length > 0) {\n        option.effort = {\n          default: efforts.includes(\"high\") ? \"high\" : efforts[efforts.length - 1],\n          values: efforts.map((e) => ({ value: e })),\n        }\n      }\n      return option\n    })\n  if (options.length === 0) return null\n\n  const values = new Set(options.map((o) => o.value))\n  const upstreamDefault = typeof data.models.DEFAULT === \"string\" ? data.models.DEFAULT : undefined\n  const DEFAULT = values.has(ctx.defaultModel)\n    ? ctx.defaultModel\n    : (options[0]?.value ?? upstreamDefault)\n\n  const nextData = cloneObject(data)\n  nextData.models = { OPTIONS: options, DEFAULT }\n  return { ...upstreamJson, data: nextData }\n}\n\nfunction isPickerModel(model: unknown): model is Model {\n  return isObject(model)\n    && typeof model.id === \"string\"\n    && model.model_picker_enabled !== false\n    && typeof model.vendor === \"string\"\n    && (model.name === undefined || typeof model.name === \"string\")\n    && isObject(model.capabilities)\n    && typeof model.capabilities.family === \"string\"\n}\n\nasync function rewriteMcp(\n  upstreamJson: unknown,\n  ctx: ProviderFacadeContext,\n  query: URLSearchParams,\n): Promise<unknown | null> {\n  if (!isObject(upstreamJson) || query.get(\"scope\") !== \"user\") return null\n  const data = envelopedData(upstreamJson)\n  if (!data || !Array.isArray(data.servers)) return null\n\n  const mirror = await readJson(path.join(ctx.claudeConfigDir, \".claude.json\"))\n  if (!isObject(mirror) || !isObject(mirror.mcpServers)) return null\n\n  const existing = new Set(\n    data.servers\n      .filter(isObject)\n      .map((s) => s.name)\n      .filter((name): name is string => typeof name === \"string\"),\n  )\n  const additions: JsonObject[] = []\n  for (const [name, entry] of Object.entries(mirror.mcpServers)) {\n    if (existing.has(name) || !isObject(entry)) continue\n    const transport = entry.type === \"http\" ? \"http\" : \"stdio\"\n    const server: JsonObject = {\n      provider: \"claude\",\n      name,\n      scope: \"user\",\n      transport,\n    }\n    if (typeof entry.url === \"string\") server.url = entry.url\n    additions.push(server)\n    existing.add(name)\n  }\n  if (additions.length === 0) return null\n\n  const nextData = cloneObject(data)\n  nextData.servers = [...data.servers, ...additions]\n  return { ...upstreamJson, data: nextData }\n}\n\nasync function rewriteSkills(\n  upstreamJson: unknown,\n  ctx: ProviderFacadeContext,\n): Promise<unknown | null> {\n  if (!isObject(upstreamJson)) return null\n  const data = envelopedData(upstreamJson)\n  if (!data || !Array.isArray(data.skills)) return null\n\n  const skills = await readSkillDirs(path.join(ctx.claudeConfigDir, \"skills\"))\n  if (skills.length === 0) return null\n\n  const existing = new Set(\n    data.skills\n      .filter(isObject)\n      .map((s) => s.command)\n      .filter((command): command is string => typeof command === \"string\"),\n  )\n  const additions = skills\n    .filter((skill) => !existing.has(skill.name))\n    .map((skill) => ({\n      provider: \"claude\",\n      name: skill.name,\n      description: skill.description,\n      command: skill.name,\n      scope: \"user\",\n      // sourcePath intentionally omitted — the UI dispatches on `command`/`name`,\n      // and an absolute mirror path would leak the home dir / username to the browser.\n    }))\n  if (additions.length === 0) return null\n\n  const nextData = cloneObject(data)\n  nextData.skills = [...data.skills, ...additions]\n  return { ...upstreamJson, data: nextData }\n}\n\nasync function rewriteCommands(\n  upstreamJson: unknown,\n  ctx: ProviderFacadeContext,\n): Promise<unknown | null> {\n  if (!isObject(upstreamJson) || !Array.isArray(upstreamJson.custom)) return null\n\n  const dirs = [\n    path.join(ctx.claudeConfigDir, \"commands\"),\n    path.join(ctx.claudeConfigDir, \".claude\", \"commands\"),\n  ]\n  const commandFiles = (await Promise.all(dirs.map(readCommandFiles))).flat()\n  if (commandFiles.length === 0) return null\n\n  const existing = new Set(\n    upstreamJson.custom\n      .filter(isObject)\n      .map((c) => c.name)\n      .filter((name): name is string => typeof name === \"string\"),\n  )\n  const additions = commandFiles\n    .filter((command) => !existing.has(command.name))\n    .map((command) => ({\n      name: command.name,\n      // Relative path only — an absolute mirror path would leak the home dir /\n      // username to the browser. The UI dispatches on `name`.\n      path: command.relativePath,\n      relativePath: command.relativePath,\n      description: command.description,\n      namespace: \"user\",\n      metadata: { type: \"custom\" },\n    }))\n  if (additions.length === 0) return null\n\n  const custom = [...upstreamJson.custom, ...additions]\n  return {\n    ...upstreamJson,\n    custom,\n    count: countCommands(upstreamJson.builtIn) + custom.length,\n  }\n}\n\nfunction rewriteAuth(upstreamJson: unknown): unknown | null {\n  if (!isObject(upstreamJson)) return null\n  const data = envelopedData(upstreamJson)\n  if (!data) return null\n\n  return {\n    ...upstreamJson,\n    data: {\n      ...data,\n      authenticated: true,\n      installed: true,\n    },\n  }\n}\n\nasync function readJson(filePath: string): Promise<unknown | null> {\n  try {\n    return JSON.parse(await fs.readFile(filePath, \"utf8\"))\n  } catch {\n    return null\n  }\n}\n\nasync function readSkillDirs(skillsDir: string): Promise<Array<{ name: string; description: string; sourcePath: string }>> {\n  try {\n    const entries = await fs.readdir(skillsDir, { withFileTypes: true })\n    const skills = await Promise.all(\n      entries\n        .filter((entry) => entry.isDirectory() && entry.name.startsWith(\"gh-\"))\n        .map(async (entry) => {\n          const sourcePath = path.join(skillsDir, entry.name, \"SKILL.md\")\n          let description = \"\"\n          try {\n            const md = await fs.readFile(sourcePath, \"utf8\")\n            description = parseFrontmatterField(md, \"description\") ?? \"\"\n          } catch {\n            // Keep the skill visible even if only the directory is readable.\n          }\n          const name = entry.name\n          return { name, description, sourcePath }\n        }),\n    )\n    return skills\n  } catch {\n    return []\n  }\n}\n\nasync function readCommandFiles(commandsDir: string): Promise<Array<{ name: string; relativePath: string; filePath: string; description: string }>> {\n  try {\n    const stat = await fs.stat(commandsDir)\n    if (!stat.isDirectory()) return []\n  } catch {\n    return []\n  }\n  return readCommandFilesRecursive(commandsDir, commandsDir)\n}\n\nasync function readCommandFilesRecursive(\n  root: string,\n  dir: string,\n): Promise<Array<{ name: string; relativePath: string; filePath: string; description: string }>> {\n  let entries\n  try {\n    entries = await fs.readdir(dir, { withFileTypes: true })\n  } catch {\n    return []\n  }\n\n  const out: Array<{ name: string; relativePath: string; filePath: string; description: string }> = []\n  for (const entry of entries) {\n    const filePath = path.join(dir, entry.name)\n    if (entry.isDirectory()) {\n      out.push(...await readCommandFilesRecursive(root, filePath))\n      continue\n    }\n    if (!entry.isFile() || !entry.name.endsWith(\".md\")) continue\n    const relativePath = normalizeRelative(path.relative(root, filePath))\n    const name = relativePath.replace(/\\.md$/i, \"\")\n    let description = \"\"\n    try {\n      const md = await fs.readFile(filePath, \"utf8\")\n      description = parseFrontmatterField(md, \"description\") ?? firstMarkdownLine(md)\n    } catch {\n      // A listed file that disappears mid-read should not break the UI.\n    }\n    out.push({ name, relativePath, filePath, description })\n  }\n  return out\n}\n\nfunction parseFrontmatterField(markdown: string, field: string): string | null {\n  if (!markdown.startsWith(\"---\")) return null\n  const end = markdown.indexOf(\"\\n---\", 3)\n  if (end < 0) return null\n  const frontmatter = markdown.slice(3, end).split(/\\r?\\n/)\n  for (const line of frontmatter) {\n    const match = line.match(/^([A-Za-z0-9_-]+):\\s*(.*)$/)\n    if (!match || match[1] !== field) continue\n    return match[2].replace(/^['\"]|['\"]$/g, \"\").trim()\n  }\n  return null\n}\n\nfunction firstMarkdownLine(markdown: string): string {\n  const body = markdown.startsWith(\"---\")\n    ? markdown.slice(markdown.indexOf(\"\\n---\", 3) + 4)\n    : markdown\n  for (const line of body.split(/\\r?\\n/)) {\n    const trimmed = line.trim()\n    if (trimmed) return trimmed.replace(/^#+\\s*/, \"\")\n  }\n  return \"\"\n}\n\nfunction normalizeRelative(value: string): string {\n  return value.split(path.sep).join(\"/\")\n}\n\nfunction countCommands(builtIn: unknown): number {\n  return Array.isArray(builtIn) ? builtIn.length : 0\n}\n","import http from \"node:http\"\nimport type { AddressInfo, Socket } from \"node:net\"\n\nimport { getPackageVersion } from \"../version\"\n\n/**\n * Loopback-only identity endpoint served directly by the reverse proxy (never\n * forwarded to CloudCLI). A second `github-router serve` probes this on the\n * intended port to detect an already-running instance (single-instance guard),\n * so it can attach/refuse instead of starting a duplicate CloudCLI. Carries no\n * secret — just a service marker + version + origin.\n */\nexport const SERVE_IDENTITY_PATH = \"/__github-router-serve__\"\nexport const SERVE_IDENTITY_SERVICE = \"github-router-serve\"\n\n/**\n * Standalone HTTP + WebSocket reverse proxy that fronts a locally-running\n * CloudCLI instance under github-router's own origin. It is deliberately NOT\n * routed through the srvx/Hono app — a separate lightweight proxy avoids\n * entangling CloudCLI's raw WebSocket upgrades (`/ws` chat, `/shell` node-pty\n * terminal) with the model-API server.\n *\n * Security responsibilities CloudCLI's OSS server does not handle itself:\n *  1. Injects `localStorage['auth-token']` into the served `index.html` so the\n *     SPA boots already-authenticated (true zero-login).\n *  2. Rejects foreign `Host` (DNS-rebinding defense — an `Origin`-only check\n *     still lets a rebound `attacker.com → 127.0.0.1` navigation fetch the\n *     token-injected HTML) AND foreign `Origin` on requests + WS upgrades\n *     (CloudCLI performs NO Origin check on `/ws` or `/shell`).\n */\nexport interface ReverseProxyOptions {\n  targetHost: string\n  targetPort: number\n  bindHost: string\n  bindPort: number\n  /** JWT injected into the SPA so it boots authenticated. */\n  authToken: string\n  /**\n   * Seed CloudCLI's `claude-settings` localStorage with `skipPermissions:false`\n   * and an `allowedTools` allow-list (routine built-ins + injected `mcp__*`) so\n   * routine tools auto-run with no prompt while `AskUserQuestion`/`ExitPlanMode`\n   * still reach the user (serve default; disabled by GH_ROUTER_SERVE_NO_AUTO_APPROVE=1).\n   */\n  seedToolSettings?: boolean\n  /** Exact tool names to seed into the `claude-settings` `allowedTools`\n   *  auto-approve list (only used when `seedToolSettings`) — the routine\n   *  built-ins plus every exact `mcp__<key>__<tool>` name. MUST NOT include\n   *  `AskUserQuestion`/`ExitPlanMode`, or they would auto-resolve instead of\n   *  reaching the user. */\n  seedAllowedTools?: string[]\n  providerFacade?: {\n    kindFor: (method: string, pathname: string) => string | null\n    rewrite: (\n      kind: string,\n      upstreamJson: unknown,\n      query: URLSearchParams,\n    ) => Promise<unknown | null>\n    /**\n     * Requests answered DIRECTLY with a canned JSON body, never forwarded to\n     * CloudCLI (e.g. `POST /api/system/update`, which would run a global npm\n     * install). Returns null to forward normally.\n     */\n    blockedRequest?: (\n      method: string,\n      pathname: string,\n    ) => { status: number; json: unknown } | null\n  }\n  /**\n   * Extra exact `host:port` values to accept beyond loopback (e.g. a specific\n   * dev-tunnel host `abc-5454.usw2.devtunnels.ms`). Used for remote access.\n   */\n  extraAllowedHosts?: string[]\n  /** Extra exact origins to accept (e.g. `https://abc-5454.usw2.devtunnels.ms`). */\n  extraAllowedOrigins?: string[]\n  /**\n   * Accept ANY `*.devtunnels.ms` host + `https://*.devtunnels.ms` origin. A\n   * convenience for Microsoft dev tunnels when the exact URL isn't pinned. Only\n   * the user's own authenticated tunnel actually forwards to this loopback port,\n   * so this does not weaken the same-user loopback trust boundary.\n   */\n  allowDevtunnelHosts?: boolean\n}\n\nexport interface ReverseProxyHandle {\n  url: string\n  port: number\n  close: () => Promise<void>\n}\n\nconst HEAD_CLOSE = \"</head>\"\n\n/** CloudCLI's localStorage key for per-tool chat permission settings. */\nconst CLAUDE_SETTINGS_KEY = \"claude-settings\"\n\n/**\n * The two interaction tools CloudCLI routes to the human (its\n * `TOOLS_REQUIRING_INTERACTION`). They must NEVER appear in the seeded\n * `allowedTools` — an exact-name match there would auto-approve them and defeat\n * the question widget / plan card. Stripped defensively at the seed chokepoint\n * so no upstream list (mcp names, a future caller) can reintroduce them.\n */\nconst NEVER_AUTO_APPROVE = new Set([\"AskUserQuestion\", \"ExitPlanMode\"])\n\n/**\n * Embed the token as a JS string literal. JSON.stringify escapes quotes and\n * backslashes; we additionally neutralize `<` so the value can never break out\n * of the surrounding <script> element regardless of contents.\n *\n * When `seedToolSettings` is set, also seed CloudCLI's `claude-settings`\n * localStorage with `{allowedTools:<routine+mcp>, disallowedTools:[], skipPermissions:false}`.\n * This is serve's \"seamless routine + decisions to the user\" model: `canUseTool`\n * stays LIVE (skipPermissions:false, NOT bypass), routine tools in `allowedTools`\n * auto-run with no prompt, and `AskUserQuestion`/`ExitPlanMode` — deliberately\n * NOT in the list and hard-cased by CloudCLI into `TOOLS_REQUIRING_INTERACTION` —\n * always reach the human as a real question widget / plan Approve-Reject card.\n * `skipPermissions:true` (bypass) would skip `canUseTool` entirely and silently\n * auto-answer those two, which is exactly what we are fixing.\n */\nfunction buildInjection(\n  token: string,\n  seedToolSettings = false,\n  seedAllowedTools: string[] = [],\n): string {\n  const safe = JSON.stringify(token).replace(/</g, \"\\\\u003c\")\n  let body = `localStorage.setItem('auth-token',${safe});`\n  if (seedToolSettings) {\n    const settings = JSON.stringify({\n      // CloudCLI's per-tool AUTO-APPROVE list — feeds the Agent-SDK `canUseTool`\n      // fast-path (EXACT-name match, no `mcp__<server>` wildcard) AND\n      // `sdkOptions.allowedTools`. We seed the routine built-ins + every exact\n      // `mcp__<key>__<tool>` name so ordinary work never prompts. The two\n      // interaction tools are filtered out unconditionally (NEVER_AUTO_APPROVE)\n      // so they always reach the user, no matter what the caller passed.\n      allowedTools: seedAllowedTools.filter((t) => !NEVER_AUTO_APPROVE.has(t)),\n      disallowedTools: [],\n      // NON-bypass: keep canUseTool live so AskUserQuestion/ExitPlanMode reach\n      // the user. Bypass would auto-resolve them on a generated answer.\n      skipPermissions: false,\n    })\n    const safeSettings = JSON.stringify(settings).replace(/</g, \"\\\\u003c\")\n    body += `localStorage.setItem('${CLAUDE_SETTINGS_KEY}',${safeSettings});`\n  }\n  return `<script>try{${body}}catch(e){}</script>`\n}\n\nfunction headerLines(headers: http.IncomingHttpHeaders): string {\n  return Object.entries(headers)\n    .map(([k, v]) => `${k}: ${Array.isArray(v) ? v.join(\", \") : v}`)\n    .join(\"\\r\\n\")\n}\n\nexport async function startReverseProxy(\n  opts: ReverseProxyOptions,\n): Promise<ReverseProxyHandle> {\n  const { targetHost, targetPort, bindHost, bindPort, authToken } = opts\n  const ownOrigin = `http://${bindHost}:${bindPort}`\n  const injection = buildInjection(authToken, opts.seedToolSettings === true, opts.seedAllowedTools ?? [])\n\n  const allowedHosts = new Set([\n    `127.0.0.1:${bindPort}`,\n    `localhost:${bindPort}`,\n    `[::1]:${bindPort}`,\n    ...(opts.extraAllowedHosts ?? []).map((h) => h.toLowerCase()),\n  ])\n  // Loopback-only subset — the single-instance identity probe always comes from\n  // 127.0.0.1, so the identity endpoint is answered only for a loopback Host\n  // (never a dev-tunnel host), keeping the version off the remote surface.\n  const loopbackHosts = new Set([\n    `127.0.0.1:${bindPort}`,\n    `localhost:${bindPort}`,\n    `[::1]:${bindPort}`,\n  ])\n  const allowedOrigins = new Set([\n    `http://127.0.0.1:${bindPort}`,\n    `http://localhost:${bindPort}`,\n    `http://[::1]:${bindPort}`,\n    ...(opts.extraAllowedOrigins ?? []).map((o) => o.toLowerCase()),\n  ])\n  // `(^|\\.)devtunnels.ms$` matches `x.devtunnels.ms` but not `evildevtunnels.ms`\n  // / `evil-devtunnels.ms` (the char before must be start-of-string or a dot).\n  const DEVTUNNEL_RE = /(^|\\.)devtunnels\\.ms$/i\n  const isDevtunnelHost = (host: string): boolean =>\n    !!opts.allowDevtunnelHosts && DEVTUNNEL_RE.test(host.replace(/:\\d+$/, \"\"))\n  const isDevtunnelOrigin = (origin: string): boolean => {\n    if (!opts.allowDevtunnelHosts) return false\n    try {\n      const u = new URL(origin)\n      return u.protocol === \"https:\" && DEVTUNNEL_RE.test(u.hostname)\n    } catch {\n      return false\n    }\n  }\n  // Host defends against DNS-rebinding; Origin defends against cross-origin\n  // browser access. A missing Origin (plain navigation / non-browser) is only\n  // allowed once the Host has already been confirmed allowed.\n  const hostAllowed = (host?: string): boolean =>\n    !!host\n    && (allowedHosts.has(host.toLowerCase()) || isDevtunnelHost(host.toLowerCase()))\n  const originAllowed = (origin?: string): boolean =>\n    !origin\n    || allowedOrigins.has(origin.toLowerCase())\n    || isDevtunnelOrigin(origin)\n\n  // Track hijacked upgrade sockets so close() can destroy them — http.Server\n  // .close() otherwise waits for them forever (shutdown hang).\n  const liveSockets = new Set<Socket>()\n\n  const server = http.createServer((clientReq, clientRes) => {\n    clientReq.on(\"error\", () => clientRes.destroy())\n    clientRes.on(\"error\", () => clientReq.destroy())\n\n    if (!hostAllowed(clientReq.headers.host) || !originAllowed(clientReq.headers.origin)) {\n      clientRes.writeHead(403, { \"content-type\": \"text/plain\" })\n      clientRes.end(\"Forbidden\")\n      return\n    }\n\n    // Single-instance identity probe — answered directly, never proxied to\n    // CloudCLI. Loopback Host only (the probe is always local); carries no\n    // secret and no attacker-usable URL.\n    if ((clientReq.url ?? \"\").split(\"?\")[0] === SERVE_IDENTITY_PATH) {\n      if (!loopbackHosts.has(String(clientReq.headers.host ?? \"\").toLowerCase())) {\n        clientRes.writeHead(404, { \"content-type\": \"text/plain\" })\n        clientRes.end(\"Not found\")\n        return\n      }\n      clientRes.writeHead(200, { \"content-type\": \"application/json\" })\n      clientRes.end(\n        JSON.stringify({\n          service: SERVE_IDENTITY_SERVICE,\n          version: getPackageVersion(),\n        }),\n      )\n      return\n    }\n\n    const requestUrl = new URL(clientReq.url ?? \"/\", ownOrigin)\n\n    // Requests serve answers directly (never forwarded) — e.g. CloudCLI's\n    // system-update button, which would run a global `npm i -g` mutation.\n    const blocked = opts.providerFacade?.blockedRequest?.(\n      clientReq.method ?? \"GET\",\n      requestUrl.pathname,\n    )\n    if (blocked) {\n      clientReq.resume() // drain the request body so the socket can be reused\n      clientRes.writeHead(blocked.status, { \"content-type\": \"application/json\" })\n      clientRes.end(JSON.stringify(blocked.json))\n      return\n    }\n\n    const facadeKind = opts.providerFacade?.kindFor(\n      clientReq.method ?? \"GET\",\n      requestUrl.pathname,\n    ) ?? null\n\n    // Drop accept-encoding so HTML comes back uncompressed and stays\n    // injectable; façade JSON rewrites also need original bytes, not gzip/br.\n    const headers = { ...clientReq.headers }\n    delete headers[\"accept-encoding\"]\n\n    const proxyReq = http.request(\n      {\n        host: targetHost,\n        port: targetPort,\n        path: clientReq.url,\n        method: clientReq.method,\n        headers,\n      },\n      (proxyRes) => {\n        proxyRes.on(\"error\", () => clientRes.destroy())\n        const contentType = String(proxyRes.headers[\"content-type\"] ?? \"\")\n        if (facadeKind) {\n          const chunks: Buffer[] = []\n          proxyRes.on(\"data\", (d) => chunks.push(Buffer.from(d)))\n          proxyRes.on(\"end\", () => {\n            const original = Buffer.concat(chunks)\n            const sendOriginal = () => {\n              // We buffered the whole body, so send it as a fixed buffer and let\n              // Node re-frame — any upstream chunked/encoded framing is now wrong.\n              const outHeaders = { ...proxyRes.headers }\n              delete outHeaders[\"content-length\"]\n              delete outHeaders[\"content-encoding\"]\n              delete outHeaders[\"transfer-encoding\"]\n              clientRes.writeHead(proxyRes.statusCode ?? 502, outHeaders)\n              clientRes.end(original)\n            }\n            if (proxyRes.statusCode !== 200) {\n              sendOriginal()\n              return\n            }\n            void (async () => {\n              try {\n                const parsed = JSON.parse(original.toString(\"utf8\"))\n                const rewritten = await opts.providerFacade?.rewrite(\n                  facadeKind,\n                  parsed,\n                  requestUrl.searchParams,\n                )\n                if (rewritten == null) {\n                  sendOriginal()\n                  return\n                }\n                const outHeaders = { ...proxyRes.headers }\n                // We send a fresh JSON body, so any upstream length/encoding\n                // framing is now wrong — drop it and let Node re-frame.\n                delete outHeaders[\"content-length\"]\n                delete outHeaders[\"content-encoding\"]\n                delete outHeaders[\"transfer-encoding\"]\n                outHeaders[\"content-type\"] = \"application/json\"\n                clientRes.writeHead(200, outHeaders)\n                clientRes.end(JSON.stringify(rewritten))\n              } catch {\n                sendOriginal()\n              }\n            })()\n          })\n        } else if (contentType.includes(\"text/html\")) {\n          const chunks: Buffer[] = []\n          proxyRes.on(\"data\", (d) => chunks.push(Buffer.from(d)))\n          proxyRes.on(\"end\", () => {\n            let html = Buffer.concat(chunks).toString(\"utf8\")\n            html = html.includes(HEAD_CLOSE)\n              ? html.replace(HEAD_CLOSE, injection + HEAD_CLOSE)\n              : injection + html\n            const outHeaders = { ...proxyRes.headers }\n            // We send a fresh fixed buffer, so any length/encoding framing the\n            // upstream set is now wrong — drop it and let Node re-frame.\n            delete outHeaders[\"content-length\"]\n            delete outHeaders[\"content-encoding\"]\n            delete outHeaders[\"transfer-encoding\"]\n            clientRes.writeHead(proxyRes.statusCode ?? 502, outHeaders)\n            clientRes.end(html)\n          })\n        } else {\n          clientRes.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers)\n          proxyRes.pipe(clientRes)\n        }\n      },\n    )\n    proxyReq.on(\"error\", (err) => {\n      if (!clientRes.headersSent)\n        clientRes.writeHead(502, { \"content-type\": \"text/plain\" })\n      clientRes.end(`Bad gateway: ${err.message}`)\n    })\n    clientReq.pipe(proxyReq)\n  })\n\n  server.on(\"upgrade\", (clientReq, clientSock: Socket, clientHead) => {\n    // Attach error handling + track the socket IMMEDIATELY, before any async\n    // window (a client reset during the upstream handshake must not crash us).\n    clientSock.on(\"error\", () => clientSock.destroy())\n    liveSockets.add(clientSock)\n    clientSock.once(\"close\", () => liveSockets.delete(clientSock))\n\n    if (!hostAllowed(clientReq.headers.host) || !originAllowed(clientReq.headers.origin)) {\n      clientSock.destroy()\n      return\n    }\n\n    const proxyReq = http.request({\n      host: targetHost,\n      port: targetPort,\n      path: clientReq.url,\n      method: clientReq.method,\n      headers: clientReq.headers,\n    })\n    proxyReq.on(\"upgrade\", (proxyRes, proxySock, proxyHead) => {\n      clientSock.write(\n        `HTTP/1.1 ${proxyRes.statusCode} ${proxyRes.statusMessage}\\r\\n${headerLines(\n          proxyRes.headers,\n        )}\\r\\n\\r\\n`,\n      )\n      if (clientHead && clientHead.length) proxySock.write(clientHead)\n      if (proxyHead && proxyHead.length) proxySock.unshift(proxyHead)\n      proxySock.pipe(clientSock)\n      clientSock.pipe(proxySock)\n      const cleanup = () => {\n        proxySock.destroy()\n        clientSock.destroy()\n      }\n      // Tear down on BOTH error and normal close, on either side (else the\n      // paired socket leaks on every page refresh / terminal close).\n      clientSock.on(\"error\", cleanup)\n      proxySock.on(\"error\", cleanup)\n      clientSock.on(\"close\", cleanup)\n      proxySock.on(\"close\", cleanup)\n    })\n    // CloudCLI answered the upgrade with an ordinary response (e.g. 401/404 for\n    // a missing/invalid JWT). Relay it and close so the browser WS doesn't hang.\n    proxyReq.on(\"response\", (proxyRes) => {\n      try {\n        clientSock.write(\n          `HTTP/1.1 ${proxyRes.statusCode} ${proxyRes.statusMessage}\\r\\n${headerLines(\n            proxyRes.headers,\n          )}\\r\\n\\r\\n`,\n        )\n      } catch {\n        /* socket already gone */\n      }\n      proxyRes.on(\"data\", (d) => {\n        clientSock.write(d as Buffer)\n      })\n      proxyRes.on(\"end\", () => clientSock.end())\n      proxyRes.on(\"error\", () => clientSock.destroy())\n    })\n    proxyReq.on(\"error\", () => clientSock.destroy())\n    proxyReq.end()\n  })\n\n  await new Promise<void>((resolve, reject) => {\n    const onError = (err: Error) => reject(err)\n    server.once(\"error\", onError)\n    server.listen(bindPort, bindHost, () => {\n      server.removeListener(\"error\", onError)\n      resolve()\n    })\n  })\n\n  // Defense-in-depth: refuse to run if we somehow bound a non-loopback address.\n  const addr = server.address() as AddressInfo | null\n  if (addr && addr.address !== \"127.0.0.1\" && addr.address !== \"::1\") {\n    await new Promise<void>((r) => server.close(() => r()))\n    throw new Error(\n      `reverse proxy refused non-loopback bind (got ${addr.address})`,\n    )\n  }\n\n  return {\n    url: ownOrigin,\n    port: bindPort,\n    close: () =>\n      new Promise<void>((resolve) => {\n        for (const s of liveSockets) s.destroy()\n        liveSockets.clear()\n        const t = setTimeout(resolve, 1500) // never let shutdown hang\n        server.close(() => {\n          clearTimeout(t)\n          resolve()\n        })\n      }),\n  }\n}\n\n/** Exported for unit tests. */\nexport const __test = { buildInjection, HEAD_CLOSE }\n","import { spawn } from \"node:child_process\"\nimport http from \"node:http\"\nimport type { AddressInfo } from \"node:net\"\n\nimport { defineCommand } from \"citty\"\nimport consola from \"consola\"\n\nimport { provisionBrowserAssets } from \"./lib/browser-mcp/provision\"\nimport { provisionAndIndexColbert } from \"./lib/colbert\"\nimport { resolveCodexCliBackend } from \"./lib/codex-mcp-config\"\nimport { killChildProcessTree } from \"./lib/exec\"\nimport { startKeepAwake, stopKeepAwake } from \"./lib/keep-awake\"\nimport { getCodexVersion } from \"./lib/launch\"\nimport { browserToolsEnabled } from \"./lib/mcp-capabilities\"\nimport { SEAMLESS_BUILTIN_TOOLS } from \"./lib/mcp-permissions-settings\"\nimport { ensureClaudeConfigMirror, PATHS, removeOwnClaudeConfigMirror } from \"./lib/paths\"\nimport { DEFAULT_CLAUDE_MODEL_FALLBACKS, pickClaudeDefault } from \"./lib/port\"\nimport {\n  getClaudeCodeEnvVars,\n  parseSharedArgs,\n  setupAndServe,\n  sharedServerArgs,\n} from \"./lib/server-setup\"\nimport {\n  composeCloudCliChildEnv,\n  mintJwt,\n  resolveCloudCli,\n  spawnCloudCli,\n  waitForCloudCliReady,\n} from \"./lib/serve/cloudcli\"\nimport { DevtunnelError, startDevtunnel } from \"./lib/serve/devtunnel\"\nimport { provisionServeEnhancements } from \"./lib/serve/enhancements\"\nimport { facadeBlockedRequest, facadeInterceptKind, rewriteProviderResponse } from \"./lib/serve/provider-facade\"\nimport {\n  SERVE_IDENTITY_PATH,\n  SERVE_IDENTITY_SERVICE,\n  startReverseProxy,\n} from \"./lib/serve/reverse-proxy\"\nimport { runSelfUpdate } from \"./lib/self-update\"\nimport { state } from \"./lib/state\"\nimport { provisionToolbelt } from \"./lib/toolbelt/provision\"\nimport { resolveModel } from \"./lib/utils\"\nimport { getGitHubUser } from \"./services/github/get-user\"\n\nasync function getFreePort(): Promise<number> {\n  return new Promise((resolve, reject) => {\n    const s = http.createServer()\n    s.once(\"error\", reject)\n    s.listen(0, \"127.0.0.1\", () => {\n      const port = (s.address() as AddressInfo).port\n      s.close(() => resolve(port))\n    })\n  })\n}\n\n/** Default user-facing control-plane port when `--port` is not given. */\nconst DEFAULT_SERVE_PORT = 5454\n\nfunction isPortFree(port: number): Promise<boolean> {\n  return new Promise((resolve) => {\n    const s = http.createServer()\n    s.once(\"error\", () => resolve(false))\n    s.listen(port, \"127.0.0.1\", () => s.close(() => resolve(true)))\n  })\n}\n\n/**\n * Probe a loopback port for an already-running `github-router serve` (its\n * identity endpoint). Returns true when the port hosts OUR serve, else false\n * (free, or a foreign process). `serve` is designed to run ONCE per machine\n * (a single machine-wide control plane for all repos), so a second launch\n * attaches to the running one instead of spawning a duplicate CloudCLI +\n * contending on the shared auth DB. We intentionally do NOT trust any URL the\n * probed service reports — a local squatter could forge the identity marker, so\n * the caller only ever opens a locally-constructed loopback origin.\n */\nfunction probeExistingServe(port: number): Promise<boolean> {\n  return new Promise((resolve) => {\n    const req = http.get(\n      {\n        host: \"127.0.0.1\",\n        port,\n        path: SERVE_IDENTITY_PATH,\n        headers: { host: `127.0.0.1:${port}` },\n        timeout: 1500,\n      },\n      (res) => {\n        if (res.statusCode !== 200) {\n          res.resume()\n          resolve(false)\n          return\n        }\n        const chunks: Buffer[] = []\n        res.on(\"data\", (d) => chunks.push(Buffer.from(d)))\n        res.on(\"end\", () => {\n          try {\n            const body = JSON.parse(Buffer.concat(chunks).toString(\"utf8\")) as {\n              service?: string\n            }\n            resolve(body.service === SERVE_IDENTITY_SERVICE)\n          } catch {\n            resolve(false)\n          }\n        })\n        res.on(\"error\", () => resolve(false))\n      },\n    )\n    req.on(\"timeout\", () => req.destroy())\n    req.on(\"error\", () => resolve(false))\n  })\n}\n\n/**\n * Resolve the user-facing port: honor an explicit `--port`; otherwise use 5454\n * when free, else fall back to a random free port. (Single-instance detection —\n * an already-running github-router serve on the intended port — is handled by\n * the earlier `probeExistingServe` attach/refuse in `run`.)\n */\nasync function resolveServePort(requested?: number): Promise<number> {\n  if (requested != null) return requested\n  if (await isPortFree(DEFAULT_SERVE_PORT)) return DEFAULT_SERVE_PORT\n  const fallback = await getFreePort()\n  consola.info(`Port ${DEFAULT_SERVE_PORT} is in use; using ${fallback} instead.`)\n  return fallback\n}\n\nfunction openBrowser(url: string): void {\n  try {\n    if (process.platform === \"win32\") {\n      spawn(\"cmd\", [\"/c\", \"start\", \"\", url], {\n        detached: true,\n        stdio: \"ignore\",\n        windowsHide: true,\n      }).unref()\n    } else if (process.platform === \"darwin\") {\n      spawn(\"open\", [url], { detached: true, stdio: \"ignore\" }).unref()\n    } else {\n      spawn(\"xdg-open\", [url], { detached: true, stdio: \"ignore\" }).unref()\n    }\n  } catch {\n    // best-effort; the URL is printed too\n  }\n}\n\nexport const serve = defineCommand({\n  meta: {\n    name: \"serve\",\n    description:\n      \"Serve a browser control plane (CloudCLI) with Claude routed through the proxy\",\n  },\n  args: {\n    ...sharedServerArgs,\n    model: {\n      alias: \"m\",\n      type: \"string\",\n      description: \"Override the default Claude model\",\n    },\n    \"cloudcli-path\": {\n      type: \"string\",\n      description: \"Use an existing CloudCLI install instead of the managed one\",\n    },\n    \"cloudcli-version\": {\n      type: \"string\",\n      description: \"Override the pinned CloudCLI version to install\",\n    },\n    \"codex-cli\": {\n      type: \"boolean\",\n      default: false,\n      description: \"Route Codex personas through a local `codex mcp-server` (requires codex 0.129+; falls back to HTTP if missing)\",\n    },\n    \"browse-over-tunnel\": {\n      type: \"boolean\",\n      default: false,\n      description: \"Expose the server-side browser MCP even when tunnel-exposed (session-hijack / SSRF risk — only with fully-trusted tunnel access)\",\n    },\n    \"agents-over-tunnel\": {\n      type: \"boolean\",\n      default: false,\n      description: \"Expose first-mate (mints a repo+workflow GitHub write token) even when tunnel-exposed (only with fully-trusted tunnel access)\",\n    },\n    \"fleet-over-tunnel\": {\n      type: \"boolean\",\n      default: false,\n      description: \"Expose the fleet MCP (drives remote coding sessions with your fleet credentials) even when tunnel-exposed (only with fully-trusted tunnel access)\",\n    },\n    \"no-install\": {\n      type: \"boolean\",\n      default: false,\n      description: \"Do not auto-install CloudCLI; require an existing install\",\n    },\n    \"no-open\": {\n      type: \"boolean\",\n      default: false,\n      description: \"Do not open the browser automatically\",\n    },\n    \"public-url\": {\n      type: \"string\",\n      description:\n        \"Public URL(s) this is reachable at (e.g. a dev-tunnel https URL), comma-separated — allowlists their host+origin for remote access\",\n    },\n    tunnel: {\n      type: \"boolean\",\n      default: false,\n      description:\n        \"Auto-create + host an AUTHENTICATED (never anonymous) Microsoft dev tunnel for the serve port and print its public URL, so you can reach the control plane from anywhere. Requires the `devtunnel` CLI + `devtunnel user login`.\",\n    },\n  },\n  async run({ args }) {\n    state.serveMode = true\n\n    if (process.versions.bun) {\n      consola.warn(\n        \"`serve` should run under Node.js. Bun's node:http upgrade sockets cannot relay the CloudCLI terminal/chat WebSockets; run the installed `github-router` binary (Node).\",\n      )\n    }\n\n    const parsed = parseSharedArgs(args as unknown as Record<string, unknown>)\n\n    // Single-instance guard: `serve` is a machine-wide control plane meant to run\n    // ONCE per machine (work on any repo through its file explorer / sessions). If\n    // one is already running on the intended port, attach to it (open + exit)\n    // instead of spawning a second CloudCLI that would contend on the shared auth\n    // DB. Only triggers for OUR serve; a foreign process on the port falls through\n    // to the random-port fallback in resolveServePort.\n    const intendedPort = parsed.port ?? DEFAULT_SERVE_PORT\n    if (await probeExistingServe(intendedPort)) {\n      // Construct the URL locally — never trust a URL the probed service reports\n      // (a local squatter could forge the identity marker into an open-browser).\n      const existingUrl = `http://127.0.0.1:${intendedPort}`\n      consola.box(\n        `github-router control plane already running\\n\\n${existingUrl}\\n\\nOpening it — stop that instance first if you want a fresh one.`,\n      )\n      if (args[\"no-open\"] !== true) openBrowser(existingUrl)\n      return\n    }\n\n    // 1. github-router proxy — internal (random port). The USER-facing port is\n    //    the reverse proxy below, so force this one random regardless of --port.\n    const { server, serverUrl } = await setupAndServe({\n      ...parsed,\n      port: undefined,\n      silent: true,\n    })\n\n    // 2. provision the router-owned CLAUDE_CONFIG_DIR (synthetic creds +\n    //    onboarding-skip) so CloudCLI's SDK-spawned claude authenticates\n    //    through the proxy. Hard-fail on error (mirrors src/claude.ts).\n    try {\n      await ensureClaudeConfigMirror()\n    } catch (err) {\n      consola.error(\n        `Failed to provision CLAUDE_CONFIG_DIR mirror: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      )\n      process.exit(1)\n    }\n\n    // Best-effort self-update (detached, applies next launch). Runs after the\n    // server is listening so the bounded probe can't delay it.\n    void runSelfUpdate({ selfUpdate: args[\"self-update\"] !== false })\n\n    // Best-effort ColBERT semantic-search provision. ON by default; never blocks\n    // launch. `skipCwdIndex`: serve is machine-wide, so the launch cwd is usually\n    // NOT a repo the user works on — per-workspace on-demand indexing (kicked by\n    // the first search for a given repo) covers real queries instead.\n    void provisionAndIndexColbert({ skipCwdIndex: true })\n\n    // Best-effort LLM toolbelt materialization. The mirror awareness line is\n    // written by provisionServeEnhancements below, matching `github-router claude`.\n    void provisionToolbelt().catch((err) =>\n      consola.debug(\"Toolbelt provisioning failed:\", err),\n    )\n\n    // Best-effort: keep the machine awake while the proxy/CloudCLI session runs.\n    // Released via stopKeepAwake() in the shutdown chain below and by the module's\n    // own self-registered signal/exit reaper.\n    startKeepAwake()\n\n    // Best-effort: materialize the browser extension + bridge into the stable\n    // app-dir when browser tools are enabled.\n    if (browserToolsEnabled()) {\n      void provisionBrowserAssets().catch((err) =>\n        consola.debug(\"Browser extension provisioning failed:\", err),\n      )\n    }\n\n    const opusFamilyShorthand = (args.model as string | undefined)?.match(/^(\\d+\\.\\d+)$/)?.[1]\n    let chosenSlug = opusFamilyShorthand\n      ? pickClaudeDefault(opusFamilyShorthand)\n      : ((args.model as string | undefined) ?? pickClaudeDefault())\n    if (!args.model && state.models) {\n      const inCache = (slug: string): boolean =>\n        state.models?.data.some((m) => m.id === resolveModel(slug)) ?? false\n      if (!inCache(chosenSlug)) {\n        for (const fb of DEFAULT_CLAUDE_MODEL_FALLBACKS) {\n          if (inCache(fb)) {\n            consola.info(\n              `Default model \"${chosenSlug}\" not in your Copilot model list; falling back to \"${fb}\".`,\n            )\n            chosenSlug = fb\n            break\n          }\n        }\n      }\n    }\n\n    const requestedCli = args[\"codex-cli\"] === true\n    const backend = resolveCodexCliBackend({\n      requested: requestedCli,\n      codexInfo: requestedCli ? getCodexVersion() : null,\n    })\n    const tunnelExposed =\n      args.tunnel === true\n      || String(args[\"public-url\"] ?? \"\")\n        .split(\",\")\n        .map((s) => s.trim())\n        .filter(Boolean).length > 0\n    if (tunnelExposed && browserToolsEnabled() && args[\"browse-over-tunnel\"] !== true) {\n      consola.info(\n        \"Browser MCP is disabled over the tunnel (session-hijack/SSRF risk). Pass --browse-over-tunnel to enable it for fully-trusted access.\",\n      )\n    }\n    if (tunnelExposed && state.agentsEnabled && args[\"agents-over-tunnel\"] !== true) {\n      consola.info(\n        \"first-mate is disabled over the tunnel (it mints a GitHub write token). Pass --agents-over-tunnel to enable it for fully-trusted access.\",\n      )\n    }\n    if (tunnelExposed && state.fleetEnabled && args[\"fleet-over-tunnel\"] !== true) {\n      consola.info(\n        \"Fleet MCP is disabled over the tunnel (it drives remote coding sessions with your fleet credentials). Pass --fleet-over-tunnel to enable it for fully-trusted access.\",\n      )\n    }\n\n    // 2b. wire the github-router enhancement layer (MCP servers + peer/worker\n    //     subagents + gh-* skills) into the mirror so CloudCLI-spawned Claude\n    //     sessions get the same tools `github-router claude` provides. Must run\n    //     after the mirror exists and before CloudCLI spawns claude.\n    const enhancements = await provisionServeEnhancements(serverUrl, {\n      codexCli: backend === \"cli\",\n      tunnelExposed,\n      browseOverTunnel: args[\"browse-over-tunnel\"] === true,\n      agentsOverTunnel: args[\"agents-over-tunnel\"] === true,\n      fleetOverTunnel: args[\"fleet-over-tunnel\"] === true,\n    })\n\n    // 3. filtered child env: the vetted secret-stripping allowlist (buildEnv,\n    //    drops GITHUB_TOKEN/GH_ROUTER_*/ANTHROPIC_AUTH_TOKEN/OPENAI_API_KEY/\n    //    COPILOT_TOKEN) plus the non-secret ANTHROPIC_BASE_URL/CLAUDE_CONFIG_DIR\n    //    /model vars. Auth rides the synthetic .credentials.json FILE, not env.\n    const anthropicVars = getClaudeCodeEnvVars(serverUrl, chosenSlug)\n    // CLAUDE_CODE_FORK_SUBAGENT silently no-ops under CloudCLI's headless\n    // `claude --print` path (the binary's Z8() precondition disables forking\n    // without an interactive session), so setting it here is dead weight that\n    // would mislead the model into assuming forked subagents inherit full\n    // context. Drop it for serve. (getClaudeCodeEnvVars sets it for the\n    // interactive `claude` path, where forking works.)\n    delete anthropicVars.CLAUDE_CODE_FORK_SUBAGENT\n    if (enhancements.nonce) {\n      anthropicVars.GH_ROUTER_HOOK_MCP_URL = serverUrl\n      anthropicVars.GH_ROUTER_HOOK_NONCE = enhancements.nonce\n    }\n    const childEnv: NodeJS.ProcessEnv = composeCloudCliChildEnv(anthropicVars)\n    // Placeholder only: CloudCLI's Claude provider checks this env var to mark\n    // Claude as connected. Claude still authenticates through the proxy mirror.\n    childEnv.ANTHROPIC_API_KEY = \"sk-ant-github-router-proxy-placeholder\"\n    // CloudCLI's cloned server defines CLAUDE_FALLBACK_MODELS as an in-code object,\n    // and the searched server tree has no process.env.CLAUDE_FALLBACK_MODELS reader.\n    // Do not set an env var here unless CloudCLI adds a documented string format.\n\n    // 4. resolve/install + spawn CloudCLI on a loopback port.\n    let cloudcli\n    try {\n      cloudcli = await resolveCloudCli({\n        cliPath: args[\"cloudcli-path\"] as string | undefined,\n        noInstall: args[\"no-install\"] === true,\n        version: args[\"cloudcli-version\"] as string | undefined,\n      })\n    } catch (err) {\n      consola.error(err instanceof Error ? err.message : String(err))\n      process.exit(1)\n    }\n\n    const ccPort = await getFreePort()\n    const cc = spawnCloudCli({\n      serverEntry: cloudcli.serverEntry,\n      port: ccPort,\n      env: childEnv,\n    })\n\n    // 5. shutdown wiring (we don't use launchChild — its kind union is closed).\n    let shuttingDown = false\n    let reverseClose: (() => Promise<void>) | null = null\n    let tunnelStop: (() => void) | null = null\n    const shutdown = async (): Promise<void> => {\n      if (shuttingDown) return\n      shuttingDown = true\n      if (tunnelStop) {\n        try {\n          tunnelStop()\n        } catch {\n          /* best-effort */\n        }\n      }\n      try {\n        killChildProcessTree(cc.child, {\n          detachedGroup: process.platform !== \"win32\",\n        })\n      } catch {\n        /* best-effort */\n      }\n      if (reverseClose) await reverseClose().catch(() => {})\n      try {\n        ;(server as unknown as { close?: () => void }).close?.()\n      } catch {\n        /* best-effort */\n      }\n      await stopKeepAwake().catch(() => {})\n      await enhancements.cleanup().catch(() => {})\n      await removeOwnClaudeConfigMirror().catch(() => {})\n    }\n    // `shutdown()` must never strand the process. `.then(exit)` alone skips the\n    // exit on a REJECTION, so a teardown failure leaves a process that was\n    // explicitly trying to die running forever — the worst possible outcome on\n    // a shutdown path. `.finally` guarantees the exit either way, and the code\n    // is preserved because an operator's script reads it.\n    const exitAfterShutdown = (code: number) => {\n      void shutdown()\n        .catch((err: unknown) => {\n          consola.error(\"Shutdown failed; exiting anyway:\", err)\n        })\n        .finally(() => process.exit(code))\n    }\n    process.once(\"SIGINT\", () => exitAfterShutdown(0))\n    process.once(\"SIGTERM\", () => exitAfterShutdown(0))\n    cc.child.once(\"exit\", (code) => {\n      if (!shuttingDown) {\n        consola.error(`CloudCLI exited unexpectedly (code ${code}).`)\n        exitAfterShutdown(1)\n      }\n    })\n    cc.child.once(\"error\", (err) => {\n      // spawn failure (ENOENT/EACCES) emits 'error', not 'exit' — an unhandled\n      // 'error' crashes the process and bypasses shutdown, orphaning the mirror.\n      if (!shuttingDown) {\n        consola.error(`CloudCLI failed to start: ${err.message}`)\n        exitAfterShutdown(1)\n      }\n    })\n\n    // 6. wait for CloudCLI, seed the user from the GitHub identity, mint a JWT.\n    let ready\n    try {\n      ready = await waitForCloudCliReady(ccPort)\n    } catch (err) {\n      consola.error(err instanceof Error ? err.message : String(err))\n      await shutdown()\n      process.exit(1)\n    }\n\n    let username = \"github-router\"\n    try {\n      username = (await getGitHubUser()).login\n    } catch {\n      // fall back to a generic control-plane user; not fatal\n    }\n\n    let token: string\n    try {\n      token = await mintJwt(ccPort, username, ready.needsSetup)\n    } catch (err) {\n      consola.error(err instanceof Error ? err.message : String(err))\n      await shutdown()\n      process.exit(1)\n    }\n\n    // 7. resolve remote-access allowlist (dev tunnels) + the user-facing port.\n    const publicUrls = String(args[\"public-url\"] ?? \"\")\n      .split(\",\")\n      .map((s) => s.trim())\n      .filter(Boolean)\n    const extraAllowedHosts: string[] = []\n    const extraAllowedOrigins: string[] = []\n    for (const u of publicUrls) {\n      try {\n        const url = new URL(u)\n        extraAllowedHosts.push(url.host)\n        extraAllowedOrigins.push(url.origin)\n      } catch {\n        consola.warn(`Ignoring invalid --public-url \"${u}\"`)\n      }\n    }\n    const tunnelMode = args.tunnel === true\n    if (extraAllowedHosts.length || tunnelMode) {\n      consola.warn(\n        \"Remote access enabled: anyone who reaches this through the tunnel AND passes its authentication gets FULL control-plane access — including a shell on this machine. The tunnel is authenticated (never anonymous); only grant access to people you fully trust.\",\n      )\n    }\n\n    const servePort = await resolveServePort(parsed.port)\n    const providerFacade = {\n      kindFor: facadeInterceptKind,\n      blockedRequest: facadeBlockedRequest,\n      rewrite: (kind: string, json: unknown, query: URLSearchParams) =>\n        rewriteProviderResponse(\n          kind as Parameters<typeof rewriteProviderResponse>[0],\n          json,\n          {\n            getModels: () => state.models,\n            // Resolve to the Copilot catalog slug so it matches the picker\n            // OPTIONS values (chosenSlug may be a dashed/`[1m]`-bracketed Anthropic\n            // slug; the OPTIONS values are catalog ids). Otherwise DEFAULT misses\n            // and falls back to the first option.\n            defaultModel: resolveModel(chosenSlug),\n            claudeConfigDir: PATHS.CLAUDE_CONFIG_DIR,\n          },\n          query,\n        ),\n    }\n    let reverse\n    try {\n      reverse = await startReverseProxy({\n        targetHost: \"127.0.0.1\",\n        targetPort: ccPort,\n        bindHost: \"127.0.0.1\",\n        bindPort: servePort,\n        authToken: token,\n        seedToolSettings: process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== \"1\",\n        // Routine built-ins + every injected mcp tool name → auto-approve; the\n        // two interaction tools (AskUserQuestion/ExitPlanMode) are excluded so\n        // they reach the user (SEAMLESS_BUILTIN_TOOLS never lists them).\n        seedAllowedTools: [...SEAMLESS_BUILTIN_TOOLS, ...(enhancements.mcpToolNames ?? [])],\n        extraAllowedHosts,\n        extraAllowedOrigins,\n        allowDevtunnelHosts: tunnelMode,\n        providerFacade,\n      })\n    } catch (err) {\n      consola.error(\n        `Failed to bind the control-plane port ${servePort}: ${\n          err instanceof Error ? err.message : String(err)\n        }. Is it already in use? Pass --port <n>.`,\n      )\n      await shutdown()\n      process.exit(1)\n    }\n    reverseClose = reverse.close\n\n    // 8. optionally auto-create + host an AUTHENTICATED dev tunnel for remote\n    //    access. Non-fatal: on any failure keep serving locally (and the\n    //    *.devtunnels.ms allowlist stays, so a manual `devtunnel host` works).\n    let tunnelUrl: string | null = null\n    if (tunnelMode) {\n      consola.info(\"Creating an authenticated dev tunnel…\")\n      try {\n        const tunnel = await startDevtunnel(servePort)\n        tunnelUrl = tunnel.url\n        tunnelStop = tunnel.stop\n      } catch (err) {\n        const msg = err instanceof DevtunnelError ? err.message : String(err)\n        consola.warn(\n          `Could not auto-host a dev tunnel: ${msg}\\nServing locally only. To host manually once fixed: devtunnel host -p ${servePort}`,\n        )\n      }\n    }\n\n    // 9. ready.\n    const publicLines = [\n      ...publicUrls.map((u) => `remote: ${u}`),\n      ...(tunnelUrl ? [`remote (tunnel): ${tunnelUrl}  (stable — bookmark it; same URL every launch)`] : []),\n    ]\n    const publicBlock = publicLines.length ? `\\n${publicLines.join(\"\\n\")}` : \"\"\n    consola.box(\n      `🖥️  github-router control plane\\n\\nlocal:  ${reverse.url}${publicBlock}\\n\\nsigned in as ${username} · model ${chosenSlug}\\nCtrl+C to stop`,\n    )\n    if (args[\"no-open\"] !== true) openBrowser(reverse.url)\n  },\n})\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAaA,MAAa,mBAAmB;;;;;;;;;;AAahC,SAAgB,wBACd,eACmB;CACnB,OAAO;EAAE,GAAG,SAAS;EAAG,GAAG;CAAc;AAC3C;AAEA,MAAM,mBAAmB,KAAK,KAC5B,eACA,UACA,UACF;;AASA,SAAS,qBAAqB,MAAsB;CAClD,OAAO,KAAK,KAAK,MAAM,gBAAgB,kBAAkB,gBAAgB;AAC3E;AAEA,eAAe,OAAO,GAA6B;CACjD,IAAI;EACF,MAAMA,KAAG,OAAO,CAAC;EACjB,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAe,YAAY,SAAyC;CAClE,IAAI;EACF,MAAM,MAAM,MAAMA,KAAG,SACnB,KAAK,KAAK,SAAS,gBAAgB,kBAAkB,cAAc,GACnE,MACF;EACA,OAAQ,KAAK,MAAM,GAAG,CAAC,CAA0B,WAAW;CAC9D,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;AASA,eAAsB,gBAAgB,MAIR;CAC5B,MAAM,UAAU,KAAK,WAAA;CAGrB,IAAI,KAAK,SAAS;EAChB,MAAM,SAAS,KAAK,KAAK,KAAK,SAAS,gBAAgB;EACvD,MAAM,YAAY,qBAAqB,KAAK,OAAO;EACnD,IAAI,MAAM,OAAO,MAAM,GAAG,OAAO;GAAE,aAAa;GAAQ,SAAS;EAAK;EACtE,IAAI,MAAM,OAAO,SAAS,GACxB,OAAO;GAAE,aAAa;GAAW,SAAS,MAAM,YAAY,KAAK,OAAO;EAAE;EAC5E,MAAM,IAAI,MACR,oBAAoB,KAAK,QAAQ,oDAAoD,iBAAiB,GACxG;CACF;CAGA,MAAM,OAAO,MAAM;CACnB,MAAM,QAAQ,qBAAqB,IAAI;CACvC,IAAI,MAAM,OAAO,KAAK,GACpB,OAAO;EAAE,aAAa;EAAO,SAAS,MAAM,YAAY,IAAI;CAAE;CAIhE,IAAI,KAAK,WACP,MAAM,IAAI,MACR,6FAA6F,KAAK,IAAI,iBAAiB,GAAG,SAC5H;CAEF,MAAM,gBAAgB,MAAM,OAAO;CACnC,IAAI,CAAE,MAAM,OAAO,KAAK,GACtB,MAAM,IAAI,MACR,+DAA+D,MAAM,GACvE;CAEF,OAAO;EAAE,aAAa;EAAO,SAAS,MAAM,YAAY,IAAI;CAAE;AAChE;AAEA,eAAe,gBAAgB,MAAc,SAAgC;CAC3E,MAAM,MAAM,kBAAkB,KAAK;CACnC,IAAI,CAAC,KACH,MAAM,IAAI,MACR,uHACF;CAEF,MAAMA,KAAG,MAAM,MAAM;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CAGrD,MAAM,UAAU,KAAK,KAAK,MAAM,cAAc;CAC9C,IAAI,CAAE,MAAM,OAAO,OAAO,GACxB,MAAMA,KAAG,UACP,SACA,KAAK,UAAU;EAAE,MAAM;EAA2B,SAAS;CAAK,GAAG,MAAM,CAAC,CAC5E;CAEF,QAAQ,KACN,cAAc,iBAAiB,GAAG,QAAQ,4CAC5C;CACA,MAAM,EAAE,MAAM,WAAW,MAAM,kBAC7B;EACE;EACA;EACA,GAAG,iBAAiB,GAAG;EACvB;EACA;EACA;EACA;EACA;CACF,GACA,EAAE,WAAW,IAAY,CAC3B;CACA,IAAI,SAAS,GACX,MAAM,IAAI,MACR,qCAAqC,KAAK,4KAA4K,KAAK,IAAI,iBAAiB,GAAG,QAAQ,IAAI,OAAO,MAAM,GAAG,GAAG,GACpR;AAEJ;;AASA,SAAgB,cAAc,MAIV;CAClB,MAAM,eAAe,KAAK,KAAK,MAAM,eAAe,SAAS;CAC7D,MAAM,OAAO,kBAAkB,MAAM,KAAK,QAAQ;CAIlD,MAAM,UAAU,QAAQ,IAAI;CAC5B,IAAI,QAA+C;CACnD,IAAI,SACF,IAAI;EACF,MAAM,KAAKC,GAAO,SAAS,SAAS,GAAG;EACvC,QAAQ;GAAC;GAAU;GAAI;EAAE;CAC3B,QAAQ,CAER;CAgBF,OAAO;EAAE,OAdK,MAAM,MAAM,CAAC,KAAK,WAAW,GAAG;GAC5C,KAAK;IACH,GAAG,KAAK;IACR,aAAa,OAAO,KAAK,IAAI;IAC7B,MAAM;IACN,eAAe;IAIf,kBAAkB;GACpB;GACA;GACA,aAAa;EACf,CACa;EAAG,MAAM,KAAK;EAAM;CAAa;AAChD;AAIA,SAAS,IACP,MACA,QACA,SACA,MAC2C;CAC3C,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,OAAO,SAAS,KAAA,IAAY,KAAA,IAAY,KAAK,UAAU,IAAI;EACjE,MAAM,IAAI,KAAK,QACb;GACE,MAAM;GACN;GACA,MAAM;GACN;GACA,SAAS,OACL;IAAE,gBAAgB;IAAoB,kBAAkB,OAAO,WAAW,IAAI;GAAE,IAChF,CAAC;EACP,IACC,QAAQ;GACP,IAAI,IAAI;GACR,IAAI,GAAG,SAAS,MAAO,KAAK,CAAE;GAC9B,IAAI,GAAG,aAAa,QAAQ;IAAE,QAAQ,IAAI,cAAc;IAAG,MAAM;GAAE,CAAC,CAAC;EACvE,CACF;EACA,EAAE,GAAG,SAAS,MAAM;EACpB,IAAI,MAAM,EAAE,MAAM,IAAI;EACtB,EAAE,IAAI;CACR,CAAC;AACH;AAEA,MAAM,SAAS,OAAe,IAAI,SAAS,MAAM,WAAW,GAAG,EAAE,CAAC;;AAGlE,eAAsB,qBACpB,MACA,YAAY,KACsB;CAClC,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;EAC5B,IAAI;GACF,MAAM,IAAI,MAAM,IAAI,MAAM,OAAO,kBAAkB;GACnD,IAAI,EAAE,WAAW,KAEf,OAAO,EAAE,YADM,KAAK,MAAM,EAAE,IACF,CAAC,CAAC,eAAe,KAAK;EAEpD,QAAQ,CAER;EACA,MAAM,MAAM,GAAI;CAClB;CACA,MAAM,IAAI,MAAM,wCAAwC,UAAU,GAAG;AACvE;AAEA,MAAM,mBAAmB,KAAK,KAAK,MAAM,eAAe,oBAAoB;AAE5E,eAAe,aAAa,UAA0C;CACpE,IAAI;EACF,MAAM,MAAM,MAAMD,KAAG,SAAS,WAAW,GAAG,MAAM;EAClD,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,IAAI,OAAO,aAAa,YAAY,OAAO,UAAU,OAAO,OAAO;CACrE,QAAQ,CAER;CACA,OAAO;AACT;AAEA,eAAe,gBAAgB,UAAkB,UAAiC;CAIhF,MAAMA,KAAG,MAAM,MAAM,eAAe;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACpE,MAAMA,KAAG,UACP,WAAW,GACX,KAAK,UAAU;EAAE;EAAU;CAAS,CAAC,GACrC,EAAE,MAAM,IAAM,CAChB;AACF;;;;;;AAOA,eAAsB,QACpB,MACA,UACA,YACiB;CACjB,MAAM,WAAW,MAAM,aAAa,QAAQ;CAC5C,IAAI,YAAY;EACd,MAAM,WAAW,YAAY,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;EACjE,MAAM,IAAI,MAAM,IAAI,MAAM,QAAQ,sBAAsB;GAAE;GAAU;EAAS,CAAC;EAC9E,IAAI,EAAE,WAAW,KAAK;GACpB,MAAM,QAAS,KAAK,MAAM,EAAE,IAAI,CAAC,CAAwB;GACzD,IAAI,OAAO;IACT,MAAM,gBAAgB,UAAU,QAAQ;IACxC,OAAO;GACT;EACF;CAEF;CACA,MAAM,WAAW;CACjB,IAAI,CAAC,UACH,MAAM,IAAI,MACR,2DAA2D,SAAS,YAAY,KAAK,KAAK,MAAM,eAAe,SAAS,EAAE,YAC5H;CAEF,MAAM,IAAI,MAAM,IAAI,MAAM,QAAQ,mBAAmB;EAAE;EAAU;CAAS,CAAC;CAC3E,IAAI,EAAE,WAAW,KAAK;EACpB,MAAM,QAAS,KAAK,MAAM,EAAE,IAAI,CAAC,CAAwB;EACzD,IAAI,OAAO,OAAO;CACpB;CACA,MAAM,IAAI,MACR,qDAAqD,EAAE,OAAO,2CAA2C,KAAK,KAAK,MAAM,eAAe,SAAS,EAAE,YACrJ;AACF;;;ACpTA,MAAa,qBAAqB;AAKlC,SAAgB,wBAAwB,WAAmB,GAAG,SAAS,GAAW;CAChF,OAAO,eAAe,WAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;AACvF;;;;;;;;;AAUA,SAAgB,cAAc,WAAmB,GAAG,SAAS,GAAW;CACtE,OAAO,aAAa,WAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;AACrF;;;;;;;;AASA,SAAgB,iBACd,cACA,SACiD;CACjD,OAAO;EACL,UAAU,aAAa,QAAQ,MAAM,MAAM,OAAO;EAClD,UAAU,aAAa,SAAS,OAAO,IAAI,OAAO;CACpD;AACF;;;;;;;;AAeA,SAAgB,sBACd,SACA,cACA,UACU;CACV,OAAO,QACJ,QAAQ,OAAO,EAAE,UAAU,CAAC,EAAA,CAAG,SAAS,YAAY,KAAK,CAAC,EAAE,eAAe,CAAC,CAC5E,KAAK,MAAM,EAAE,QAAQ,CAAC,CACtB,QAAQ,OAAO,CAAC,YAAY,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,QAAQ;AAC9D;;AAGA,eAAe,iBAAiB,KAAoC;CAClE,IAAI;EACF,MAAM,EAAE,QAAQ,SAAS,MAAM,kBAC7B;GAAC;GAAK;GAAQ;GAAM;GAAoB;EAAI,GAC5C,EAAE,WAAW,KAAO,CACtB;EACA,IAAI,SAAS,GAAG,OAAO,CAAC;EACxB,MAAM,SAAS,KAAK,MAAM,MAAM;EAChC,OAAO,MAAM,QAAQ,QAAQ,OAAO,IAAI,OAAO,UAAU,CAAC;CAC5D,QAAQ;EACN,OAAO,CAAC;CACV;AACF;;AAGA,eAAe,aAAa,KAAa,UAAiC;CACxE,IAAI;EACF,MAAM,kBAAkB;GAAC;GAAK;GAAU;GAAU;EAAI,GAAG,EAAE,WAAW,KAAO,CAAC;CAChF,QAAQ,CAER;AACF;;AAGA,eAAe,eAAe,KAAa,UAAqC;CAC9E,IAAI;EACF,MAAM,EAAE,QAAQ,SAAS,MAAM,kBAC7B;GAAC;GAAK;GAAQ;GAAQ;GAAU;EAAI,GACpC,EAAE,WAAW,KAAO,CACtB;EACA,IAAI,SAAS,GAAG,OAAO,CAAC;EAExB,QADe,KAAK,MAAM,MACb,CAAC,EAAE,SAAS,CAAC,EAAA,CACvB,KAAK,MAAM,EAAE,UAAU,CAAC,CACxB,QAAQ,MAAmB,OAAO,MAAM,QAAQ;CACrD,QAAQ;EACN,OAAO,CAAC;CACV;AACF;;;;;;;AAQA,eAAe,mBACb,KACA,UACA,cACA,UACkB;CAElB,IADgB,SAAS,MAAM,MAAM,EAAE,SAAS,MAAM,GAAG,CAAC,CAAC,OAAO,QACxD,GAAG,OAAO;CACpB,IAAI;EAIF,MAAM,EAAE,SAAS,MAAM,kBACrB;GAAC;GAAK;GAAU;GAAU;GAAM;GAAoB;GAAM;GACxD;GAAM;EAAmC,GAC3C,EAAE,WAAW,IAAO,CACtB;EACA,OAAO,SAAS;CAClB,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAe,qBAAqB,KAAa,UAAkB,MAA6B;CAC9F,MAAM,EAAE,UAAU,aAAa,iBAAiB,MAAM,eAAe,KAAK,QAAQ,GAAG,IAAI;CACzF,KAAK,MAAM,KAAK,UACd,MAAM,kBAAkB;EAAC;EAAK;EAAQ;EAAU;EAAU;EAAM,OAAO,CAAC;CAAC,GAAG,EAAE,WAAW,KAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;CAEnH,IAAI,YAAY,MACd,MAAM,kBAAkB;EAAC;EAAK;EAAQ;EAAU;EAAU;EAAM,OAAO,QAAQ;CAAC,GAAG,EAAE,WAAW,KAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AAE5H;AAKA,MAAM,mBACJ;AASF,IAAa,iBAAb,cAAoC,MAAM;CACxC;CACA,YAAY,MAA4B,SAAiB;EACvD,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;;AAQA,SAAgB,sBAAqC;CACnD,OAAO,kBAAkB,WAAW;AACtC;;AAGA,eAAsB,oBAAoB,KAA+B;CACvE,IAAI;EACF,MAAM,EAAE,QAAQ,QAAQ,SAAS,MAAM,kBACrC;GAAC;GAAK;GAAQ;EAAM,GACpB,EAAE,WAAW,KAAO,CACtB;EACA,MAAM,MAAM,GAAG,OAAO,IAAI;EAC1B,IAAI,iBAAiB,KAAK,GAAG,GAAG,OAAO;EACvC,IAAI,gBAAgB,KAAK,GAAG,GAAG,OAAO;EACtC,OAAO,SAAS;CAClB,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,kBAAkB,MAA6B;CAC7D,MAAM,IAAI,KAAK,MAAM,gBAAgB;CACrC,OAAO,IAAI,EAAE,EAAE,CAAC,QAAQ,QAAQ,EAAE,IAAI;AACxC;;;;;;AAOA,SAAS,kBAAkB,KAAa,MAAgB,WAA6C;CACnG,MAAM,QAAQ,MAAM,KAAK,MAAM;EAAE,OAAO;GAAC;GAAU;GAAQ;EAAM;EAAG,aAAa;CAAK,CAAC;CACvF,OAAO,IAAI,SAA0B,SAAS,WAAW;EACvD,IAAI,UAAU;EACd,MAAM,aAAa;GAIjB,IAAI;IACF,qBAAqB,OAAO,EAAE,eAAe,QAAQ,aAAa,QAAQ,CAAC;GAC7E,QAAQ;IACN,IAAI;KACF,MAAM,KAAK;IACb,QAAQ,CAER;GACF;EACF;EACA,MAAM,UAAU,OAAmB;GACjC,IAAI,SAAS;GACb,UAAU;GACV,aAAa,KAAK;GAClB,GAAG;EACL;EACA,MAAM,QAAQ,iBAEV,aAAa;GACX,KAAK;GACL,OAAO,IAAI,eAAe,WAAW,yCAAyC,CAAC;EACjF,CAAC,GACH,SACF;EACA,MAAM,UAAU,QAAgB;GAC9B,MAAM,OAAO,OAAO,GAAG;GACvB,MAAM,MAAM,kBAAkB,IAAI;GAClC,IAAI,KAAK;IACP,aAAa,QAAQ;KAAE;KAAK;IAAK,CAAC,CAAC;IACnC;GACF;GACA,IAAI,uDAAuD,KAAK,IAAI,GAClE,aAAa;IACX,KAAK;IACL,OAAO,IAAI,eAAe,iBAAiB,8DAA8D,CAAC;GAC5G,CAAC;EAEL;EACA,MAAM,QAAQ,GAAG,QAAQ,MAAM;EAC/B,MAAM,QAAQ,GAAG,QAAQ,MAAM;EAC/B,MAAM,KAAK,UAAU,QAAQ,aAAa,OAAO,IAAI,eAAe,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC;EAC3F,MAAM,KAAK,SAAS,SAClB,aACE,OAAO,IAAI,eAAe,UAAU,0BAA0B,KAAK,wBAAwB,CAAC,CAC9F,CACF;CACF,CAAC;AACH;;;;;;;;;;;;;;;;;;AAmBA,eAAsB,eACpB,MACA,OAA+B,CAAC,GACN;CAC1B,MAAM,MAAM,oBAAoB;CAChC,IAAI,CAAC,KACH,MAAM,IAAI,eACR,iBACA,0JACF;CAEF,IAAI,CAAE,MAAM,oBAAoB,GAAG,GACjC,MAAM,IAAI,eACR,iBACA,2GACF;CAGF,MAAM,YAAY,KAAK,aAAa;CACpC,MAAM,eAAe,wBAAwB;CAC7C,MAAM,WAAW,cAAc;CAG/B,IAAI;EACF,MAAM,QAAQ,MAAM,iBAAiB,GAAG;EACxC,IAAI,MAAM,mBAAmB,KAAK,UAAU,cAAc,KAAK,GAAG;GAChE,MAAM,qBAAqB,KAAK,UAAU,IAAI;GAE9C,KAAK,MAAM,MAAM,sBAAsB,OAAO,cAAc,QAAQ,GAClE,MAAM,aAAa,KAAK,EAAE;GAE5B,OAAO,MAAM,kBAAkB,KAAK,CAAC,QAAQ,QAAQ,GAAG,SAAS;EACnE;CACF,QAAQ,CAER;CAKA,IAAI;EACF,KAAK,MAAM,MAAM,sBAAsB,MAAM,iBAAiB,GAAG,GAAG,YAAY,GAC9E,MAAM,aAAa,KAAK,EAAE;CAE9B,QAAQ,CAER;CACA,OAAO,MAAM,kBACX,KACA;EAAC;EAAQ;EAAM,OAAO,IAAI;EAAG;EAAM;EAAoB;EAAM;EAAc;EAAM;CAAmC,GACpH,SACF;AACF;;;ACrQA,MAAM,OAAgC,EAAE,SAAS,YAAY,CAAC,EAAE;;;;;;;;;;;;;;;;;AAkBhE,eAAsB,2BACpB,WACA,OAA6B,CAAC,GACI;CAClC,IAAI;EACF,MAAM,gBAAgB,KAAK,kBAAkB;EAC7C,MAAM,gBAAgB,oBAAoB,MAAM,CAAC,iBAAiB,KAAK,qBAAqB;EAC5F,MAAM,mBAAmB,kBAAkB,MAAM,CAAC,iBAAiB,KAAK,qBAAqB;EAC7F,MAAM,eAAe,kBAAkB,MAAM,CAAC,iBAAiB,KAAK,oBAAoB;EAExF,MAAM,gBAA4B;GAAC;GAAS;GAAU;EAAa;EACnE,IAAI,mBAAmB,GAAG,cAAc,KAAK,SAAS;EACtD,IAAI,mBAAmB,GAAG,cAAc,KAAK,QAAQ;EACrD,IAAI,eAAe,cAAc,KAAK,SAAS;EAC/C,IAAI,cAAc,cAAc,KAAK,OAAO;EAC5C,IAAI,kBAAkB,cAAc,KAAK,YAAY;EAErD,MAAM,MAAM,gBAAgB;EAC5B,MAAM,EAAE,MAAM,cAAc,MAAM,2BAA2B,aAAa;EAE1E,MAAM,UAAU,MAAM,yBAAyB,WAAW;GACxD,UAAU,KAAK,aAAa;GAC5B,iBAAiB;GACjB;GACA,sBAAsB,mBAAmB;GACzC,iBAAiB,iBAAiB,mBAAmB;GACrD,qBAAqB,oBAAoB;GACzC,eAAe,cAAc;GAC7B,iBAAiB,gBAAgB;GACjC,YAAY,WAAW;GACvB,aAAa,YAAY;GAKzB,kBAAkB;EACpB,CAAC;EAGD,MAAM,eAAe,QAAQ;EAE7B,MAAM,WAAW,MAAM,wBAAwB,WAAW;GACxD,UAAU,KAAK,aAAa;GAC5B,iBAAiB;GACjB;GACA,OAAO,QAAQ;EACjB,CAAC;EAED,MAAM,cAAc,0BAA0B;GAC5C,UAAU,KAAK,aAAa;GAC5B,iBAAiB;GACjB,sBAAsB,mBAAmB;GACzC,kBAAkB,mBAAmB;GACrC,iBAAiB;GACjB,yBAAyB,iBAAiB,4BAA4B;GACtE,sBAAsB,iBAAiB,MAAM;GAC7C,qBAAqB;GACrB,gBAAgB,WAAW,KAAK;GAChC;EACF,CAAC;EAED,MAAM,sCAAsC,WAAW,CAAC,CAAC,OAAO,QAC9D,QAAQ,KAAK,2CAA2C,OAAO,GAAG,GAAG,CACvE;EACA,MAAM,wCAAwC,CAAC,CAAC,OAAO,QACrD,QAAQ,KAAK,6CAA6C,OAAO,GAAG,GAAG,CACzE;EACA,MAAM,2CAA2C,4BAA4B,CAAC,CAAC,OAAO,QACpF,QAAQ,KAAK,gDAAgD,OAAO,GAAG,GAAG,CAC5E;EACA,IAAI,gBAAgB,GAAG;GACrB,MAAM,eAAe,uBAAuB,sBAAsB,CAAC;GACnE,IAAI,cACF,MAAM,0CAA0C,YAAY,CAAC,CAAC,OAAO,QACnE,QAAQ,KAAK,qCAAqC,OAAO,GAAG,GAAG,CACjE;EAEJ;EAGA,IAAI,gBAAgB;EACpB,KAAK,MAAM,KAAK,iBAAiB;GAC/B,IAAI,EAAE,KAAK,WAAW,eAAe,KAAK,EAAE,SAAS,sBACnD;GAKF,KAAI,MAHY,mBAAmB,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,EAC5D,SAAS,MACX,EAAE,EAAA,CACI,SAAS;EACjB;EAEA,MAAM,eAAe,KAAK,KAAK,MAAM,mBAAmB,eAAe;EAIvE,MAAM,6CAA6C,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC;EAQ/E,MAAM,QAAQ,MAAM,yBAAyB,YAAY,CAAC,CAAC,OAAO,QAAQ;GACxE,QAAQ,KAAK,0CAA0C,OAAO,GAAG,GAAG;GACpE,OAAO,EAAE,SAAS,CAAC,EAAc;EACnC,CAAC;EACD,IAAI,MAAM,QAAQ,QAChB,QAAQ,KAAK,kBAAkB,MAAM,QAAQ,KAAK,IAAI,EAAE,kDAAkD;EAU5G,IAAI,QAAQ,IAAI,oCAAoC,KAClD,MAAM,oCAAoC,YAAY,CAAC,CAAC,OAAO,QAC7D,QAAQ,KAAK,4CAA4C,OAAO,GAAG,GAAG,CACxE;EAYF,MAAM,qBAAqB,SAAS,KAChC,SAAS,eACT,CACE,GAAG,OAAO,OAAO,SAAS,CAAC,CAAC,QAAQ,MAAmB,QAAQ,CAAC,CAAC,GACjE,GAAI,KAAK,aAAa,OAAO,CAAC,WAAW,IAAI,CAAC,CAChD;EACJ,MAAM,iBAAiB,cAAc,mBAAmB,kBAAkB,CAAC,CAAC,CAAC,OAAO,QAClF,QAAQ,KAAK,0CAA0C,OAAO,GAAG,GAAG,CACtE;EAEA,IAAI,mBAAmB,GAAG;GACxB,MAAM,YAAY,6BAA6B,QAAQ,UAAU,QAAQ,KAAK,EAAE;GAChF,MAAM,+BAA+B,cAAc,WAAW,oBAAoB,EAAE,CAAC,CAAC,OACnF,QAAQ,QAAQ,KAAK,iDAAiD,OAAO,GAAG,GAAG,CACtF;GAEA,IAAI,CAAC,SAAS,IACZ,QAAQ,KACN,yMACF;QACK,IAAI,QAAQ,IAAI,mCAAmC,KAAK;IAC7D,MAAM,aAAa,aAAa,SAAS;IACzC,MAAM,QAAQ,oBAAoB,EAAE,QAAQ,iBAAiB,mBAAmB,EAAE,CAAC;IACnF,MAAM,MAAM,4BACV,QAAQ,UACR,QAAQ,KAAK,IACb,YACA,KACF;IACA,MAAM,UAAU,iBAAiB,YAAY,KAAK;IAClD,MAAM,+BAA+B,cAAc,KAAK,cAAc,IAAI,OAAO,CAAC,CAAC,OAChF,QAAQ,QAAQ,KAAK,yDAAyD,OAAO,GAAG,GAAG,CAC9F;GACF,OACE,QAAQ,KACN,gIACF;EAEJ;EAEA,IAAI,kBAAkB,GACpB,IAAI;GACF,MAAM,UAAU,2BAA2B,QAAQ,UAAU,QAAQ,KAAK,EAAE;GAK5E,MAAM,+BAA+B,cAAc,SAAS,eAAe,KAAA,GAAW,cAAc;EACtG,SAAS,KAAK;GACZ,QAAQ,KAAK,qDAAqD,OAAO,GAAG,GAAG;EACjF;EAGF,MAAM,UAAU,SAAS,KACrB,SAAS,aAAa,KAAK,IAAI,IAC/B;EACJ,QAAQ,KACN,wDAAwD,QAAQ,KAAK,QAAQ,SAAS,OAAO,cAAc,cAAc,SAC3H;EACA,OAAO;GACL,SAAS,QAAQ;GACjB,OAAO,QAAQ;GACf,cAAc,8BAA8B,WAAW,EAAE,UAAU,KAAK,aAAa,KAAK,CAAC;EAC7F;CACF,SAAS,KAAK;EACZ,QAAQ,KACN,sDACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAChD,+CACH;EACA,OAAO;CACT;AACF;;;AC9RA,SAAS,SAAS,OAAqC;CACrD,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,cAAc,OAAmC;CACxD,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,MAAM,IAAI,GAAG,OAAO;CACtD,OAAO,MAAM;AACf;AAEA,SAAS,YAAkC,OAAsB;CAC/D,OAAO,EAAE,GAAG,MAAM;AACpB;;;;;;;;;;;AAYA,SAAgB,qBACd,QACA,UAC6C;CAC7C,IAAI,OAAO,YAAY,MAAM,UAAU,aAAa,sBAClD,OAAO;EACL,QAAQ;EACR,MAAM;GACJ,SAAS;GACT,SAAS;GACT,SACE;EAEJ;CACF;CAEF,OAAO;AACT;AAEA,SAAgB,oBACd,QACA,UAC2B;CAC3B,MAAM,mBAAmB,OAAO,YAAY;CAC5C,IAAI,qBAAqB,UAAU,aAAa,sBAC9C,OAAO;CAET,IAAI,qBAAqB,OAAO,OAAO;CAEvC,QAAQ,UAAR;EACE,KAAK,gCACH,OAAO;EACT,KAAK,qCACH,OAAO;EACT,KAAK,gCACH,OAAO;EACT,KAAK,qCACH,OAAO;EACT,SACE,OAAO;CACX;AACF;AAEA,eAAsB,wBACpB,MACA,cACA,KACA,OACyB;CACzB,IAAI;EACF,QAAQ,MAAR;GACE,KAAK,UACH,OAAO,cAAc,cAAc,GAAG;GACxC,KAAK,OACH,OAAO,WAAW,cAAc,KAAK,KAAK;GAC5C,KAAK,UACH,OAAO,cAAc,cAAc,GAAG;GACxC,KAAK,YACH,OAAO,gBAAgB,cAAc,GAAG;GAC1C,KAAK,QACH,OAAO,YAAY,YAAY;EACnC;CACF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,cAAc,cAAuB,KAA4C;CACxF,IAAI,CAAC,SAAS,YAAY,GAAG,OAAO;CACpC,MAAM,OAAO,cAAc,YAAY;CACvC,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,KAAK,KAAK,UAAU,KAAA,GAAW,OAAO;CAGxE,MAAM,SADU,IAAI,UACC,CAAC,EAAE;CACxB,IAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG,OAAO;CAE1D,MAAM,UAAU,OACb,OAAO,aAAa,CAAC,CACrB,KAAK,MAAM;EACV,MAAM,SAAqF;GACzF,OAAO,EAAE;GACT,OAAO,EAAE,QAAQ,EAAE;GACnB,aAAa,GAAG,EAAE,OAAO,KAAK,EAAE,aAAa;EAC/C;EAQA,MAAM,UAAU,EAAE,aAAa,UAAU;EACzC,IAAI,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,GAC7C,OAAO,SAAS;GACd,SAAS,QAAQ,SAAS,MAAM,IAAI,SAAS,QAAQ,QAAQ,SAAS;GACtE,QAAQ,QAAQ,KAAK,OAAO,EAAE,OAAO,EAAE,EAAE;EAC3C;EAEF,OAAO;CACT,CAAC;CACH,IAAI,QAAQ,WAAW,GAAG,OAAO;CAEjC,MAAM,SAAS,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,KAAK,CAAC;CAClD,MAAM,kBAAkB,OAAO,KAAK,OAAO,YAAY,WAAW,KAAK,OAAO,UAAU,KAAA;CACxF,MAAM,UAAU,OAAO,IAAI,IAAI,YAAY,IACvC,IAAI,eACH,QAAQ,EAAE,EAAE,SAAS;CAE1B,MAAM,WAAW,YAAY,IAAI;CACjC,SAAS,SAAS;EAAE,SAAS;EAAS;CAAQ;CAC9C,OAAO;EAAE,GAAG;EAAc,MAAM;CAAS;AAC3C;AAEA,SAAS,cAAc,OAAgC;CACrD,OAAO,SAAS,KAAK,KAChB,OAAO,MAAM,OAAO,YACpB,MAAM,yBAAyB,SAC/B,OAAO,MAAM,WAAW,aACvB,MAAM,SAAS,KAAA,KAAa,OAAO,MAAM,SAAS,aACnD,SAAS,MAAM,YAAY,KAC3B,OAAO,MAAM,aAAa,WAAW;AAC5C;AAEA,eAAe,WACb,cACA,KACA,OACyB;CACzB,IAAI,CAAC,SAAS,YAAY,KAAK,MAAM,IAAI,OAAO,MAAM,QAAQ,OAAO;CACrE,MAAM,OAAO,cAAc,YAAY;CACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG,OAAO;CAElD,MAAM,SAAS,MAAM,SAAS,KAAK,KAAK,IAAI,iBAAiB,cAAc,CAAC;CAC5E,IAAI,CAAC,SAAS,MAAM,KAAK,CAAC,SAAS,OAAO,UAAU,GAAG,OAAO;CAE9D,MAAM,WAAW,IAAI,IACnB,KAAK,QACF,OAAO,QAAQ,CAAC,CAChB,KAAK,MAAM,EAAE,IAAI,CAAC,CAClB,QAAQ,SAAyB,OAAO,SAAS,QAAQ,CAC9D;CACA,MAAM,YAA0B,CAAC;CACjC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,UAAU,GAAG;EAC7D,IAAI,SAAS,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,GAAG;EAE5C,MAAM,SAAqB;GACzB,UAAU;GACV;GACA,OAAO;GACP,WALgB,MAAM,SAAS,SAAS,SAAS;EAMnD;EACA,IAAI,OAAO,MAAM,QAAQ,UAAU,OAAO,MAAM,MAAM;EACtD,UAAU,KAAK,MAAM;EACrB,SAAS,IAAI,IAAI;CACnB;CACA,IAAI,UAAU,WAAW,GAAG,OAAO;CAEnC,MAAM,WAAW,YAAY,IAAI;CACjC,SAAS,UAAU,CAAC,GAAG,KAAK,SAAS,GAAG,SAAS;CACjD,OAAO;EAAE,GAAG;EAAc,MAAM;CAAS;AAC3C;AAEA,eAAe,cACb,cACA,KACyB;CACzB,IAAI,CAAC,SAAS,YAAY,GAAG,OAAO;CACpC,MAAM,OAAO,cAAc,YAAY;CACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,QAAQ,KAAK,MAAM,GAAG,OAAO;CAEjD,MAAM,SAAS,MAAM,cAAc,KAAK,KAAK,IAAI,iBAAiB,QAAQ,CAAC;CAC3E,IAAI,OAAO,WAAW,GAAG,OAAO;CAEhC,MAAM,WAAW,IAAI,IACnB,KAAK,OACF,OAAO,QAAQ,CAAC,CAChB,KAAK,MAAM,EAAE,OAAO,CAAC,CACrB,QAAQ,YAA+B,OAAO,YAAY,QAAQ,CACvE;CACA,MAAM,YAAY,OACf,QAAQ,UAAU,CAAC,SAAS,IAAI,MAAM,IAAI,CAAC,CAAC,CAC5C,KAAK,WAAW;EACf,UAAU;EACV,MAAM,MAAM;EACZ,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,OAAO;CAGT,EAAE;CACJ,IAAI,UAAU,WAAW,GAAG,OAAO;CAEnC,MAAM,WAAW,YAAY,IAAI;CACjC,SAAS,SAAS,CAAC,GAAG,KAAK,QAAQ,GAAG,SAAS;CAC/C,OAAO;EAAE,GAAG;EAAc,MAAM;CAAS;AAC3C;AAEA,eAAe,gBACb,cACA,KACyB;CACzB,IAAI,CAAC,SAAS,YAAY,KAAK,CAAC,MAAM,QAAQ,aAAa,MAAM,GAAG,OAAO;CAE3E,MAAM,OAAO,CACX,KAAK,KAAK,IAAI,iBAAiB,UAAU,GACzC,KAAK,KAAK,IAAI,iBAAiB,WAAW,UAAU,CACtD;CACA,MAAM,gBAAgB,MAAM,QAAQ,IAAI,KAAK,IAAI,gBAAgB,CAAC,EAAA,CAAG,KAAK;CAC1E,IAAI,aAAa,WAAW,GAAG,OAAO;CAEtC,MAAM,WAAW,IAAI,IACnB,aAAa,OACV,OAAO,QAAQ,CAAC,CAChB,KAAK,MAAM,EAAE,IAAI,CAAC,CAClB,QAAQ,SAAyB,OAAO,SAAS,QAAQ,CAC9D;CACA,MAAM,YAAY,aACf,QAAQ,YAAY,CAAC,SAAS,IAAI,QAAQ,IAAI,CAAC,CAAC,CAChD,KAAK,aAAa;EACjB,MAAM,QAAQ;EAGd,MAAM,QAAQ;EACd,cAAc,QAAQ;EACtB,aAAa,QAAQ;EACrB,WAAW;EACX,UAAU,EAAE,MAAM,SAAS;CAC7B,EAAE;CACJ,IAAI,UAAU,WAAW,GAAG,OAAO;CAEnC,MAAM,SAAS,CAAC,GAAG,aAAa,QAAQ,GAAG,SAAS;CACpD,OAAO;EACL,GAAG;EACH;EACA,OAAO,cAAc,aAAa,OAAO,IAAI,OAAO;CACtD;AACF;AAEA,SAAS,YAAY,cAAuC;CAC1D,IAAI,CAAC,SAAS,YAAY,GAAG,OAAO;CACpC,MAAM,OAAO,cAAc,YAAY;CACvC,IAAI,CAAC,MAAM,OAAO;CAElB,OAAO;EACL,GAAG;EACH,MAAM;GACJ,GAAG;GACH,eAAe;GACf,WAAW;EACb;CACF;AACF;AAEA,eAAe,SAAS,UAA2C;CACjE,IAAI;EACF,OAAO,KAAK,MAAM,MAAME,KAAG,SAAS,UAAU,MAAM,CAAC;CACvD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAe,cAAc,WAA8F;CACzH,IAAI;EACF,MAAM,UAAU,MAAMA,KAAG,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC;EAiBnE,OAAO,MAhBc,QAAQ,IAC3B,QACG,QAAQ,UAAU,MAAM,YAAY,KAAK,MAAM,KAAK,WAAW,KAAK,CAAC,CAAC,CACtE,IAAI,OAAO,UAAU;GACpB,MAAM,aAAa,KAAK,KAAK,WAAW,MAAM,MAAM,UAAU;GAC9D,IAAI,cAAc;GAClB,IAAI;IAEF,cAAc,sBAAsB,MADnBA,KAAG,SAAS,YAAY,MAAM,GACP,aAAa,KAAK;GAC5D,QAAQ,CAER;GAEA,OAAO;IAAE,MADI,MAAM;IACJ;IAAa;GAAW;EACzC,CAAC,CACL;CAEF,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,eAAe,iBAAiB,aAAoH;CAClJ,IAAI;EAEF,IAAI,EAAC,MADcA,KAAG,KAAK,WAAW,EAAA,CAC5B,YAAY,GAAG,OAAO,CAAC;CACnC,QAAQ;EACN,OAAO,CAAC;CACV;CACA,OAAO,0BAA0B,aAAa,WAAW;AAC3D;AAEA,eAAe,0BACb,MACA,KAC+F;CAC/F,IAAI;CACJ,IAAI;EACF,UAAU,MAAMA,KAAG,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;CACzD,QAAQ;EACN,OAAO,CAAC;CACV;CAEA,MAAM,MAA4F,CAAC;CACnG,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,WAAW,KAAK,KAAK,KAAK,MAAM,IAAI;EAC1C,IAAI,MAAM,YAAY,GAAG;GACvB,IAAI,KAAK,GAAG,MAAM,0BAA0B,MAAM,QAAQ,CAAC;GAC3D;EACF;EACA,IAAI,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,KAAK,GAAG;EACpD,MAAM,eAAe,kBAAkB,KAAK,SAAS,MAAM,QAAQ,CAAC;EACpE,MAAM,OAAO,aAAa,QAAQ,UAAU,EAAE;EAC9C,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,KAAK,MAAMA,KAAG,SAAS,UAAU,MAAM;GAC7C,cAAc,sBAAsB,IAAI,aAAa,KAAK,kBAAkB,EAAE;EAChF,QAAQ,CAER;EACA,IAAI,KAAK;GAAE;GAAM;GAAc;GAAU;EAAY,CAAC;CACxD;CACA,OAAO;AACT;AAEA,SAAS,sBAAsB,UAAkB,OAA8B;CAC7E,IAAI,CAAC,SAAS,WAAW,KAAK,GAAG,OAAO;CACxC,MAAM,MAAM,SAAS,QAAQ,SAAS,CAAC;CACvC,IAAI,MAAM,GAAG,OAAO;CACpB,MAAM,cAAc,SAAS,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,OAAO;CACxD,KAAK,MAAM,QAAQ,aAAa;EAC9B,MAAM,QAAQ,KAAK,MAAM,4BAA4B;EACrD,IAAI,CAAC,SAAS,MAAM,OAAO,OAAO;EAClC,OAAO,MAAM,EAAE,CAAC,QAAQ,gBAAgB,EAAE,CAAC,CAAC,KAAK;CACnD;CACA,OAAO;AACT;AAEA,SAAS,kBAAkB,UAA0B;CACnD,MAAM,OAAO,SAAS,WAAW,KAAK,IAClC,SAAS,MAAM,SAAS,QAAQ,SAAS,CAAC,IAAI,CAAC,IAC/C;CACJ,KAAK,MAAM,QAAQ,KAAK,MAAM,OAAO,GAAG;EACtC,MAAM,UAAU,KAAK,KAAK;EAC1B,IAAI,SAAS,OAAO,QAAQ,QAAQ,UAAU,EAAE;CAClD;CACA,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAuB;CAChD,OAAO,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;AACvC;AAEA,SAAS,cAAc,SAA0B;CAC/C,OAAO,MAAM,QAAQ,OAAO,IAAI,QAAQ,SAAS;AACnD;;;;;;;;;;ACjYA,MAAa,sBAAsB;AACnC,MAAa,yBAAyB;AA4EtC,MAAM,aAAa;;AAGnB,MAAM,sBAAsB;;;;;;;;AAS5B,MAAM,qCAAqB,IAAI,IAAI,CAAC,mBAAmB,cAAc,CAAC;;;;;;;;;;;;;;;;AAiBtE,SAAS,eACP,OACA,mBAAmB,OACnB,mBAA6B,CAAC,GACtB;CAER,IAAI,OAAO,qCADE,KAAK,UAAU,KAAK,CAAC,CAAC,QAAQ,MAAM,SACE,EAAE;CACrD,IAAI,kBAAkB;EACpB,MAAM,WAAW,KAAK,UAAU;GAO9B,cAAc,iBAAiB,QAAQ,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC;GACvE,iBAAiB,CAAC;GAGlB,iBAAiB;EACnB,CAAC;EACD,MAAM,eAAe,KAAK,UAAU,QAAQ,CAAC,CAAC,QAAQ,MAAM,SAAS;EACrE,QAAQ,yBAAyB,oBAAoB,IAAI,aAAa;CACxE;CACA,OAAO,eAAe,KAAK;AAC7B;AAEA,SAAS,YAAY,SAA2C;CAC9D,OAAO,OAAO,QAAQ,OAAO,CAAC,CAC3B,KAAK,CAAC,GAAG,OAAO,GAAG,EAAE,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,GAAG,CAAC,CAC/D,KAAK,MAAM;AAChB;AAEA,eAAsB,kBACpB,MAC6B;CAC7B,MAAM,EAAE,YAAY,YAAY,UAAU,UAAU,cAAc;CAClE,MAAM,YAAY,UAAU,SAAS,GAAG;CACxC,MAAM,YAAY,eAAe,WAAW,KAAK,qBAAqB,MAAM,KAAK,oBAAoB,CAAC,CAAC;CAEvG,MAAM,+BAAe,IAAI,IAAI;EAC3B,aAAa;EACb,aAAa;EACb,SAAS;EACT,IAAI,KAAK,qBAAqB,CAAC,EAAA,CAAG,KAAK,MAAM,EAAE,YAAY,CAAC;CAC9D,CAAC;CAID,MAAM,gCAAgB,IAAI,IAAI;EAC5B,aAAa;EACb,aAAa;EACb,SAAS;CACX,CAAC;CACD,MAAM,iCAAiB,IAAI,IAAI;EAC7B,oBAAoB;EACpB,oBAAoB;EACpB,gBAAgB;EAChB,IAAI,KAAK,uBAAuB,CAAC,EAAA,CAAG,KAAK,MAAM,EAAE,YAAY,CAAC;CAChE,CAAC;CAGD,MAAM,eAAe;CACrB,MAAM,mBAAmB,SACvB,CAAC,CAAC,KAAK,uBAAuB,aAAa,KAAK,KAAK,QAAQ,SAAS,EAAE,CAAC;CAC3E,MAAM,qBAAqB,WAA4B;EACrD,IAAI,CAAC,KAAK,qBAAqB,OAAO;EACtC,IAAI;GACF,MAAM,IAAI,IAAI,IAAI,MAAM;GACxB,OAAO,EAAE,aAAa,YAAY,aAAa,KAAK,EAAE,QAAQ;EAChE,QAAQ;GACN,OAAO;EACT;CACF;CAIA,MAAM,eAAe,SACnB,CAAC,CAAC,SACE,aAAa,IAAI,KAAK,YAAY,CAAC,KAAK,gBAAgB,KAAK,YAAY,CAAC;CAChF,MAAM,iBAAiB,WACrB,CAAC,UACE,eAAe,IAAI,OAAO,YAAY,CAAC,KACvC,kBAAkB,MAAM;CAI7B,MAAM,8BAAc,IAAI,IAAY;CAEpC,MAAM,SAAS,KAAK,cAAc,WAAW,cAAc;EACzD,UAAU,GAAG,eAAe,UAAU,QAAQ,CAAC;EAC/C,UAAU,GAAG,eAAe,UAAU,QAAQ,CAAC;EAE/C,IAAI,CAAC,YAAY,UAAU,QAAQ,IAAI,KAAK,CAAC,cAAc,UAAU,QAAQ,MAAM,GAAG;GACpF,UAAU,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;GACzD,UAAU,IAAI,WAAW;GACzB;EACF;EAKA,KAAK,UAAU,OAAO,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,OAAA,4BAA4B;GAC/D,IAAI,CAAC,cAAc,IAAI,OAAO,UAAU,QAAQ,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG;IAC1E,UAAU,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;IACzD,UAAU,IAAI,WAAW;IACzB;GACF;GACA,UAAU,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;GAC/D,UAAU,IACR,KAAK,UAAU;IACb,SAAS;IACT,SAAS,kBAAkB;GAC7B,CAAC,CACH;GACA;EACF;EAEA,MAAM,aAAa,IAAI,IAAI,UAAU,OAAO,KAAK,SAAS;EAI1D,MAAM,UAAU,KAAK,gBAAgB,iBACnC,UAAU,UAAU,OACpB,WAAW,QACb;EACA,IAAI,SAAS;GACX,UAAU,OAAO;GACjB,UAAU,UAAU,QAAQ,QAAQ,EAAE,gBAAgB,mBAAmB,CAAC;GAC1E,UAAU,IAAI,KAAK,UAAU,QAAQ,IAAI,CAAC;GAC1C;EACF;EAEA,MAAM,aAAa,KAAK,gBAAgB,QACtC,UAAU,UAAU,OACpB,WAAW,QACb,KAAK;EAIL,MAAM,UAAU,EAAE,GAAG,UAAU,QAAQ;EACvC,OAAO,QAAQ;EAEf,MAAM,WAAW,KAAK,QACpB;GACE,MAAM;GACN,MAAM;GACN,MAAM,UAAU;GAChB,QAAQ,UAAU;GAClB;EACF,IACC,aAAa;GACZ,SAAS,GAAG,eAAe,UAAU,QAAQ,CAAC;GAC9C,MAAM,cAAc,OAAO,SAAS,QAAQ,mBAAmB,EAAE;GACjE,IAAI,YAAY;IACd,MAAM,SAAmB,CAAC;IAC1B,SAAS,GAAG,SAAS,MAAM,OAAO,KAAK,OAAO,KAAK,CAAC,CAAC,CAAC;IACtD,SAAS,GAAG,aAAa;KACvB,MAAM,WAAW,OAAO,OAAO,MAAM;KACrC,MAAM,qBAAqB;MAGzB,MAAM,aAAa,EAAE,GAAG,SAAS,QAAQ;MACzC,OAAO,WAAW;MAClB,OAAO,WAAW;MAClB,OAAO,WAAW;MAClB,UAAU,UAAU,SAAS,cAAc,KAAK,UAAU;MAC1D,UAAU,IAAI,QAAQ;KACxB;KACA,IAAI,SAAS,eAAe,KAAK;MAC/B,aAAa;MACb;KACF;KACA,CAAM,YAAY;MAChB,IAAI;OACF,MAAM,SAAS,KAAK,MAAM,SAAS,SAAS,MAAM,CAAC;OACnD,MAAM,YAAY,MAAM,KAAK,gBAAgB,QAC3C,YACA,QACA,WAAW,YACb;OACA,IAAI,aAAa,MAAM;QACrB,aAAa;QACb;OACF;OACA,MAAM,aAAa,EAAE,GAAG,SAAS,QAAQ;OAGzC,OAAO,WAAW;OAClB,OAAO,WAAW;OAClB,OAAO,WAAW;OAClB,WAAW,kBAAkB;OAC7B,UAAU,UAAU,KAAK,UAAU;OACnC,UAAU,IAAI,KAAK,UAAU,SAAS,CAAC;MACzC,QAAQ;OACN,aAAa;MACf;KACF,EAAA,CAAG;IACL,CAAC;GACH,OAAO,IAAI,YAAY,SAAS,WAAW,GAAG;IAC5C,MAAM,SAAmB,CAAC;IAC1B,SAAS,GAAG,SAAS,MAAM,OAAO,KAAK,OAAO,KAAK,CAAC,CAAC,CAAC;IACtD,SAAS,GAAG,aAAa;KACvB,IAAI,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM;KAChD,OAAO,KAAK,SAAS,UAAU,IAC3B,KAAK,QAAQ,YAAY,YAAY,UAAU,IAC/C,YAAY;KAChB,MAAM,aAAa,EAAE,GAAG,SAAS,QAAQ;KAGzC,OAAO,WAAW;KAClB,OAAO,WAAW;KAClB,OAAO,WAAW;KAClB,UAAU,UAAU,SAAS,cAAc,KAAK,UAAU;KAC1D,UAAU,IAAI,IAAI;IACpB,CAAC;GACH,OAAO;IACL,UAAU,UAAU,SAAS,cAAc,KAAK,SAAS,OAAO;IAChE,SAAS,KAAK,SAAS;GACzB;EACF,CACF;EACA,SAAS,GAAG,UAAU,QAAQ;GAC5B,IAAI,CAAC,UAAU,aACb,UAAU,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;GAC3D,UAAU,IAAI,gBAAgB,IAAI,SAAS;EAC7C,CAAC;EACD,UAAU,KAAK,QAAQ;CACzB,CAAC;CAED,OAAO,GAAG,YAAY,WAAW,YAAoB,eAAe;EAGlE,WAAW,GAAG,eAAe,WAAW,QAAQ,CAAC;EACjD,YAAY,IAAI,UAAU;EAC1B,WAAW,KAAK,eAAe,YAAY,OAAO,UAAU,CAAC;EAE7D,IAAI,CAAC,YAAY,UAAU,QAAQ,IAAI,KAAK,CAAC,cAAc,UAAU,QAAQ,MAAM,GAAG;GACpF,WAAW,QAAQ;GACnB;EACF;EAEA,MAAM,WAAW,KAAK,QAAQ;GAC5B,MAAM;GACN,MAAM;GACN,MAAM,UAAU;GAChB,QAAQ,UAAU;GAClB,SAAS,UAAU;EACrB,CAAC;EACD,SAAS,GAAG,YAAY,UAAU,WAAW,cAAc;GACzD,WAAW,MACT,YAAY,SAAS,WAAW,GAAG,SAAS,cAAc,MAAM,YAC9D,SAAS,OACX,EAAE,SACJ;GACA,IAAI,cAAc,WAAW,QAAQ,UAAU,MAAM,UAAU;GAC/D,IAAI,aAAa,UAAU,QAAQ,UAAU,QAAQ,SAAS;GAC9D,UAAU,KAAK,UAAU;GACzB,WAAW,KAAK,SAAS;GACzB,MAAM,gBAAgB;IACpB,UAAU,QAAQ;IAClB,WAAW,QAAQ;GACrB;GAGA,WAAW,GAAG,SAAS,OAAO;GAC9B,UAAU,GAAG,SAAS,OAAO;GAC7B,WAAW,GAAG,SAAS,OAAO;GAC9B,UAAU,GAAG,SAAS,OAAO;EAC/B,CAAC;EAGD,SAAS,GAAG,aAAa,aAAa;GACpC,IAAI;IACF,WAAW,MACT,YAAY,SAAS,WAAW,GAAG,SAAS,cAAc,MAAM,YAC9D,SAAS,OACX,EAAE,SACJ;GACF,QAAQ,CAER;GACA,SAAS,GAAG,SAAS,MAAM;IACzB,WAAW,MAAM,CAAW;GAC9B,CAAC;GACD,SAAS,GAAG,aAAa,WAAW,IAAI,CAAC;GACzC,SAAS,GAAG,eAAe,WAAW,QAAQ,CAAC;EACjD,CAAC;EACD,SAAS,GAAG,eAAe,WAAW,QAAQ,CAAC;EAC/C,SAAS,IAAI;CACf,CAAC;CAED,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,MAAM,WAAW,QAAe,OAAO,GAAG;EAC1C,OAAO,KAAK,SAAS,OAAO;EAC5B,OAAO,OAAO,UAAU,gBAAgB;GACtC,OAAO,eAAe,SAAS,OAAO;GACtC,QAAQ;EACV,CAAC;CACH,CAAC;CAGD,MAAM,OAAO,OAAO,QAAQ;CAC5B,IAAI,QAAQ,KAAK,YAAY,eAAe,KAAK,YAAY,OAAO;EAClE,MAAM,IAAI,SAAe,MAAM,OAAO,YAAY,EAAE,CAAC,CAAC;EACtD,MAAM,IAAI,MACR,gDAAgD,KAAK,QAAQ,EAC/D;CACF;CAEA,OAAO;EACL,KAAK;EACL,MAAM;EACN,aACE,IAAI,SAAe,YAAY;GAC7B,KAAK,MAAM,KAAK,aAAa,EAAE,QAAQ;GACvC,YAAY,MAAM;GAClB,MAAM,IAAI,WAAW,SAAS,IAAI;GAClC,OAAO,YAAY;IACjB,aAAa,CAAC;IACd,QAAQ;GACV,CAAC;EACH,CAAC;CACL;AACF;;;AC9YA,eAAe,cAA+B;CAC5C,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,IAAI,KAAK,aAAa;EAC5B,EAAE,KAAK,SAAS,MAAM;EACtB,EAAE,OAAO,GAAG,mBAAmB;GAC7B,MAAM,OAAQ,EAAE,QAAQ,CAAC,CAAiB;GAC1C,EAAE,YAAY,QAAQ,IAAI,CAAC;EAC7B,CAAC;CACH,CAAC;AACH;;AAGA,MAAM,qBAAqB;AAE3B,SAAS,WAAW,MAAgC;CAClD,OAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,IAAI,KAAK,aAAa;EAC5B,EAAE,KAAK,eAAe,QAAQ,KAAK,CAAC;EACpC,EAAE,OAAO,MAAM,mBAAmB,EAAE,YAAY,QAAQ,IAAI,CAAC,CAAC;CAChE,CAAC;AACH;;;;;;;;;;;AAYA,SAAS,mBAAmB,MAAgC;CAC1D,OAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,MAAM,KAAK,IACf;GACE,MAAM;GACN;GACA,MAAM;GACN,SAAS,EAAE,MAAM,aAAa,OAAO;GACrC,SAAS;EACX,IACC,QAAQ;GACP,IAAI,IAAI,eAAe,KAAK;IAC1B,IAAI,OAAO;IACX,QAAQ,KAAK;IACb;GACF;GACA,MAAM,SAAmB,CAAC;GAC1B,IAAI,GAAG,SAAS,MAAM,OAAO,KAAK,OAAO,KAAK,CAAC,CAAC,CAAC;GACjD,IAAI,GAAG,aAAa;IAClB,IAAI;KAIF,QAHa,KAAK,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM,CAGlD,CAAC,CAAC,YAAY,sBAAsB;IACjD,QAAQ;KACN,QAAQ,KAAK;IACf;GACF,CAAC;GACD,IAAI,GAAG,eAAe,QAAQ,KAAK,CAAC;EACtC,CACF;EACA,IAAI,GAAG,iBAAiB,IAAI,QAAQ,CAAC;EACrC,IAAI,GAAG,eAAe,QAAQ,KAAK,CAAC;CACtC,CAAC;AACH;;;;;;;AAQA,eAAe,iBAAiB,WAAqC;CACnE,IAAI,aAAa,MAAM,OAAO;CAC9B,IAAI,MAAM,WAAW,kBAAkB,GAAG,OAAO;CACjD,MAAM,WAAW,MAAM,YAAY;CACnC,QAAQ,KAAK,QAAQ,mBAAmB,oBAAoB,SAAS,UAAU;CAC/E,OAAO;AACT;AAEA,SAAS,YAAY,KAAmB;CACtC,IAAI;EACF,IAAI,QAAQ,aAAa,SACvB,MAAM,OAAO;GAAC;GAAM;GAAS;GAAI;EAAG,GAAG;GACrC,UAAU;GACV,OAAO;GACP,aAAa;EACf,CAAC,CAAC,CAAC,MAAM;OACJ,IAAI,QAAQ,aAAa,UAC9B,MAAM,QAAQ,CAAC,GAAG,GAAG;GAAE,UAAU;GAAM,OAAO;EAAS,CAAC,CAAC,CAAC,MAAM;OAEhE,MAAM,YAAY,CAAC,GAAG,GAAG;GAAE,UAAU;GAAM,OAAO;EAAS,CAAC,CAAC,CAAC,MAAM;CAExE,QAAQ,CAER;AACF;AAEA,MAAa,QAAQ,cAAc;CACjC,MAAM;EACJ,MAAM;EACN,aACE;CACJ;CACA,MAAM;EACJ,GAAG;EACH,OAAO;GACL,OAAO;GACP,MAAM;GACN,aAAa;EACf;EACA,iBAAiB;GACf,MAAM;GACN,aAAa;EACf;EACA,oBAAoB;GAClB,MAAM;GACN,aAAa;EACf;EACA,aAAa;GACX,MAAM;GACN,SAAS;GACT,aAAa;EACf;EACA,sBAAsB;GACpB,MAAM;GACN,SAAS;GACT,aAAa;EACf;EACA,sBAAsB;GACpB,MAAM;GACN,SAAS;GACT,aAAa;EACf;EACA,qBAAqB;GACnB,MAAM;GACN,SAAS;GACT,aAAa;EACf;EACA,cAAc;GACZ,MAAM;GACN,SAAS;GACT,aAAa;EACf;EACA,WAAW;GACT,MAAM;GACN,SAAS;GACT,aAAa;EACf;EACA,cAAc;GACZ,MAAM;GACN,aACE;EACJ;EACA,QAAQ;GACN,MAAM;GACN,SAAS;GACT,aACE;EACJ;CACF;CACA,MAAM,IAAI,EAAE,QAAQ;EAClB,MAAM,YAAY;EAElB,IAAI,QAAQ,SAAS,KACnB,QAAQ,KACN,wKACF;EAGF,MAAM,SAAS,gBAAgB,IAA0C;EAQzE,MAAM,eAAe,OAAO,QAAQ;EACpC,IAAI,MAAM,mBAAmB,YAAY,GAAG;GAG1C,MAAM,cAAc,oBAAoB;GACxC,QAAQ,IACN,kDAAkD,YAAY,mEAChE;GACA,IAAI,KAAK,eAAe,MAAM,YAAY,WAAW;GACrD;EACF;EAIA,MAAM,EAAE,QAAQ,cAAc,MAAM,cAAc;GAChD,GAAG;GACH,MAAM,KAAA;GACN,QAAQ;EACV,CAAC;EAKD,IAAI;GACF,MAAM,yBAAyB;EACjC,SAAS,KAAK;GACZ,QAAQ,MACN,iDACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;GACA,QAAQ,KAAK,CAAC;EAChB;EAIA,cAAmB,EAAE,YAAY,KAAK,mBAAmB,MAAM,CAAC;EAMhE,yBAA8B,EAAE,cAAc,KAAK,CAAC;EAIpD,kBAAuB,CAAC,CAAC,OAAO,QAC9B,QAAQ,MAAM,iCAAiC,GAAG,CACpD;EAKA,eAAe;EAIf,IAAI,oBAAoB,GACtB,uBAA4B,CAAC,CAAC,OAAO,QACnC,QAAQ,MAAM,0CAA0C,GAAG,CAC7D;EAGF,MAAM,sBAAuB,KAAK,OAA8B,MAAM,cAAc,CAAC,GAAG;EACxF,IAAI,aAAa,sBACb,kBAAkB,mBAAmB,IACnC,KAAK,SAAgC,kBAAkB;EAC7D,IAAI,CAAC,KAAK,SAAS,MAAM,QAAQ;GAC/B,MAAM,WAAW,SACf,MAAM,QAAQ,KAAK,MAAM,MAAM,EAAE,OAAO,aAAa,IAAI,CAAC,KAAK;GACjE,IAAI,CAAC,QAAQ,UAAU,GAChB;SAAA,MAAM,MAAM,gCACf,IAAI,QAAQ,EAAE,GAAG;KACf,QAAQ,KACN,kBAAkB,WAAW,qDAAqD,GAAG,GACvF;KACA,aAAa;KACb;IACF;;EAGN;EAEA,MAAM,eAAe,KAAK,iBAAiB;EAC3C,MAAM,UAAU,uBAAuB;GACrC,WAAW;GACX,WAAW,eAAe,gBAAgB,IAAI;EAChD,CAAC;EACD,MAAM,gBACJ,KAAK,WAAW,QACb,OAAO,KAAK,iBAAiB,EAAE,CAAC,CAChC,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CACpB,OAAO,OAAO,CAAC,CAAC,SAAS;EAC9B,IAAI,iBAAiB,oBAAoB,KAAK,KAAK,0BAA0B,MAC3E,QAAQ,KACN,sIACF;EAEF,IAAI,iBAAiB,MAAM,iBAAiB,KAAK,0BAA0B,MACzE,QAAQ,KACN,0IACF;EAEF,IAAI,iBAAiB,MAAM,gBAAgB,KAAK,yBAAyB,MACvE,QAAQ,KACN,uKACF;EAOF,MAAM,eAAe,MAAM,2BAA2B,WAAW;GAC/D,UAAU,YAAY;GACtB;GACA,kBAAkB,KAAK,0BAA0B;GACjD,kBAAkB,KAAK,0BAA0B;GACjD,iBAAiB,KAAK,yBAAyB;EACjD,CAAC;EAMD,MAAM,gBAAgB,qBAAqB,WAAW,UAAU;EAOhE,OAAO,cAAc;EACrB,IAAI,aAAa,OAAO;GACtB,cAAc,yBAAyB;GACvC,cAAc,uBAAuB,aAAa;EACpD;EACA,MAAM,WAA8B,wBAAwB,aAAa;EAGzE,SAAS,oBAAoB;EAM7B,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,gBAAgB;IAC/B,SAAS,KAAK;IACd,WAAW,KAAK,kBAAkB;IAClC,SAAS,KAAK;GAChB,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC9D,QAAQ,KAAK,CAAC;EAChB;EAEA,MAAM,SAAS,MAAM,YAAY;EACjC,MAAM,KAAK,cAAc;GACvB,aAAa,SAAS;GACtB,MAAM;GACN,KAAK;EACP,CAAC;EAGD,IAAI,eAAe;EACnB,IAAI,eAA6C;EACjD,IAAI,aAAkC;EACtC,MAAM,WAAW,YAA2B;GAC1C,IAAI,cAAc;GAClB,eAAe;GACf,IAAI,YACF,IAAI;IACF,WAAW;GACb,QAAQ,CAER;GAEF,IAAI;IACF,qBAAqB,GAAG,OAAO,EAC7B,eAAe,QAAQ,aAAa,QACtC,CAAC;GACH,QAAQ,CAER;GACA,IAAI,cAAc,MAAM,aAAa,CAAC,CAAC,YAAY,CAAC,CAAC;GACrD,IAAI;IACD,OAA8C,QAAQ;GACzD,QAAQ,CAER;GACA,MAAM,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC;GACpC,MAAM,aAAa,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC;GAC3C,MAAM,4BAA4B,CAAC,CAAC,YAAY,CAAC,CAAC;EACpD;EAMA,MAAM,qBAAqB,SAAiB;GAC1C,SAAc,CAAC,CACZ,OAAO,QAAiB;IACvB,QAAQ,MAAM,oCAAoC,GAAG;GACvD,CAAC,CAAC,CACD,cAAc,QAAQ,KAAK,IAAI,CAAC;EACrC;EACA,QAAQ,KAAK,gBAAgB,kBAAkB,CAAC,CAAC;EACjD,QAAQ,KAAK,iBAAiB,kBAAkB,CAAC,CAAC;EAClD,GAAG,MAAM,KAAK,SAAS,SAAS;GAC9B,IAAI,CAAC,cAAc;IACjB,QAAQ,MAAM,sCAAsC,KAAK,GAAG;IAC5D,kBAAkB,CAAC;GACrB;EACF,CAAC;EACD,GAAG,MAAM,KAAK,UAAU,QAAQ;GAG9B,IAAI,CAAC,cAAc;IACjB,QAAQ,MAAM,6BAA6B,IAAI,SAAS;IACxD,kBAAkB,CAAC;GACrB;EACF,CAAC;EAGD,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,qBAAqB,MAAM;EAC3C,SAAS,KAAK;GACZ,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC9D,MAAM,SAAS;GACf,QAAQ,KAAK,CAAC;EAChB;EAEA,IAAI,WAAW;EACf,IAAI;GACF,YAAY,MAAM,cAAc,EAAA,CAAG;EACrC,QAAQ,CAER;EAEA,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,QAAQ,QAAQ,UAAU,MAAM,UAAU;EAC1D,SAAS,KAAK;GACZ,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC9D,MAAM,SAAS;GACf,QAAQ,KAAK,CAAC;EAChB;EAGA,MAAM,aAAa,OAAO,KAAK,iBAAiB,EAAE,CAAC,CAChD,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CACpB,OAAO,OAAO;EACjB,MAAM,oBAA8B,CAAC;EACrC,MAAM,sBAAgC,CAAC;EACvC,KAAK,MAAM,KAAK,YACd,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,CAAC;GACrB,kBAAkB,KAAK,IAAI,IAAI;GAC/B,oBAAoB,KAAK,IAAI,MAAM;EACrC,QAAQ;GACN,QAAQ,KAAK,kCAAkC,EAAE,EAAE;EACrD;EAEF,MAAM,aAAa,KAAK,WAAW;EACnC,IAAI,kBAAkB,UAAU,YAC9B,QAAQ,KACN,iQACF;EAGF,MAAM,YAAY,MAAM,iBAAiB,OAAO,IAAI;EACpD,MAAM,iBAAiB;GACrB,SAAS;GACT,gBAAgB;GAChB,UAAU,MAAc,MAAe,UACrC,wBACE,MACA,MACA;IACE,iBAAiB,MAAM;IAKvB,cAAc,aAAa,UAAU;IACrC,iBAAiB,MAAM;GACzB,GACA,KACF;EACJ;EACA,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,kBAAkB;IAChC,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,UAAU;IACV,WAAW;IACX,kBAAkB,QAAQ,IAAI,oCAAoC;IAIlE,kBAAkB,CAAC,GAAG,wBAAwB,GAAI,aAAa,gBAAgB,CAAC,CAAE;IAClF;IACA;IACA,qBAAqB;IACrB;GACF,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,MACN,yCAAyC,UAAU,IACjD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAChD,yCACH;GACA,MAAM,SAAS;GACf,QAAQ,KAAK,CAAC;EAChB;EACA,eAAe,QAAQ;EAKvB,IAAI,YAA2B;EAC/B,IAAI,YAAY;GACd,QAAQ,KAAK,uCAAuC;GACpD,IAAI;IACF,MAAM,SAAS,MAAM,eAAe,SAAS;IAC7C,YAAY,OAAO;IACnB,aAAa,OAAO;GACtB,SAAS,KAAK;IACZ,MAAM,MAAM,eAAe,iBAAiB,IAAI,UAAU,OAAO,GAAG;IACpE,QAAQ,KACN,qCAAqC,IAAI,yEAAyE,WACpH;GACF;EACF;EAGA,MAAM,cAAc,CAClB,GAAG,WAAW,KAAK,MAAM,WAAW,GAAG,GACvC,GAAI,YAAY,CAAC,oBAAoB,UAAU,gDAAgD,IAAI,CAAC,CACtG;EACA,MAAM,cAAc,YAAY,SAAS,KAAK,YAAY,KAAK,IAAI,MAAM;EACzE,QAAQ,IACN,+CAA+C,QAAQ,MAAM,YAAY,mBAAmB,SAAS,WAAW,WAAW,iBAC7H;EACA,IAAI,KAAK,eAAe,MAAM,YAAY,QAAQ,GAAG;CACvD;AACF,CAAC"}