hex-audit 0.6.3 → 0.8.0

package/dist/commands/fix-review.js

@@ -0,0 +1,367 @@
+import { Command } from 'commander';
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { logger } from '../core/logger.js';
+import { loadProjectContext } from '../core/config.js';
+import { reportError } from '../core/errors.js';
+import { resolveCommit, withWorktree } from '../core/git.js';
+import { FixReviewSchema } from '../core/schema.js';
+import { functionsForFinding } from '../core/dedup.js';
+import { classifyCard, commitsForCard, findUnmappedChange, rewriteIssueBody, } from '../core/fix-review.js';
+import { loadFacts } from '../facts/query.js';
+import { computeProjectDiff } from './diff.js';
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+function gitLog(projectDir, from, to) {
+    const out = execFileSync('git', ['-C', projectDir, 'log', '--format=%H%x1f%s%x1f%b%x1e', `${from}..${to}`], {
+        encoding: 'utf-8',
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    return out
+        .split('\x1e')
+        .map((r) => r.trim())
+        .filter(Boolean)
+        .map((r) => {
+        const [sha, subject, body] = r.split('\x1f');
+        return { sha, subject, body };
+    });
+}
+/** Run one PoC test file with forge in `dir`; map the outcome to a PoC result. */
+function runPoc(dir, file) {
+    if (!fs.existsSync(path.join(dir, file)))
+        return 'missing';
+    const r = spawnSync('forge', ['test', '--match-path', file, '-vv'], {
+        cwd: dir,
+        encoding: 'utf-8',
+        timeout: 15 * 60_000,
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    const text = `${r.stdout ?? ''}${r.stderr ?? ''}`;
+    if (/Compiler run failed|Error \(\d+\)|compilation failed/i.test(text))
+        return 'error';
+    if (r.status === 0 && /\[PASS\]/.test(text))
+        return 'passing';
+    if (/\[FAIL/.test(text))
+        return 'failing';
+    return 'error';
+}
+export function computeFixReview(config, outputDir, from, to, opts) {
+    const projectDir = config.project.project_dir;
+    const { diff } = computeProjectDiff(config, {
+        base: from,
+        head: to,
+        outputDir,
+        noCompile: !opts.compile,
+    });
+    const facts = loadFacts(outputDir);
+    const findings = readJson(path.join(outputDir, 'findings.json'))?.findings ?? [];
+    const tracking = readJson(path.join(outputDir, 'tracking.json'))?.findings ?? [];
+    const reportable = new Set(tracking.filter((t) => t.status === 'verified' || t.status === 'synced').map((t) => t.id));
+    const cards = findings.filter((f) => reportable.has(f.id));
+    const codeChanges = diff.changes.filter((c) => c.change !== 'comments_only' &&
+        (c.kind === 'function' || c.kind === 'modifier' || c.kind === 'state_variable'));
+    const changedIds = new Set(codeChanges.map((c) => `${c.contract}.${c.entity}`));
+    const removedIds = new Set(codeChanges.filter((c) => c.change === 'removed').map((c) => `${c.contract}.${c.entity}`));
+    const log = gitLog(projectDir, from, to);
+    // PoC results at the fix commit, in one throwaway worktree. PoC files live in
+    // the auditor's checkout (test/hex-pocs), so they are copied in first.
+    const after = new Map();
+    if (opts.runPocs) {
+        const withPoc = cards.filter((c) => c.poc?.file);
+        if (withPoc.length) {
+            withWorktree(projectDir, to, path.join(outputDir, '.cache'), (wt) => {
+                for (const c of withPoc) {
+                    const file = c.poc.file;
+                    const src = path.join(projectDir, file);
+                    if (!fs.existsSync(src)) {
+                        after.set(c.id, 'missing');
+                        continue;
+                    }
+                    fs.mkdirSync(path.dirname(path.join(wt, file)), { recursive: true });
+                    fs.copyFileSync(src, path.join(wt, file));
+                    logger.dim(`  PoC ${c.id}: forge test --match-path ${file}`);
+                    after.set(c.id, runPoc(wt, file));
+                }
+            });
+        }
+    }
+    const mapped = new Set();
+    const out = cards.map((c) => {
+        const fns = facts ? functionsForFinding(facts, c, projectDir) : [];
+        const changed = fns.filter((f) => changedIds.has(f));
+        for (const f of changed)
+            mapped.add(f);
+        const commits = commitsForCard(log, { id: c.id, github_issue: c.github?.issue_number });
+        const before = c.poc?.status === 'passing'
+            ? 'passing'
+            : c.poc?.status === 'failing'
+                ? 'failing'
+                : c.poc?.file
+                    ? undefined
+                    : 'missing';
+        const pocAfter = after.get(c.id);
+        const { status, evidence } = classifyCard({
+            pocBefore: before,
+            pocAfter,
+            cardFunctions: fns,
+            changedFunctions: changed,
+            removedFunctions: fns.filter((f) => removedIds.has(f)),
+            commits,
+        });
+        const proposed = status === 'fixed'
+            ? { resolution: 'Fixed' }
+            : status === 'not_fixed' || status === 'unaddressed'
+                ? { resolution: 'Unresolved' }
+                : {};
+        return {
+            id: c.id,
+            title: c.title,
+            severity: c.severity,
+            ...(c.github?.issue_number ? { github_issue: c.github.issue_number } : {}),
+            status,
+            evidence,
+            poc: {
+                ...(c.poc?.file ? { file: c.poc.file } : {}),
+                ...(before ? { before: before } : {}),
+                ...(pocAfter ? { after: pocAfter } : {}),
+            },
+            changed_functions: changed,
+            commits,
+            proposed,
+        };
+    });
+    const unmapped = codeChanges
+        .filter((c) => !mapped.has(`${c.contract}.${c.entity}`))
+        .map((c) => ({
+        contract: c.contract,
+        entity: c.entity,
+        kind: c.kind,
+        change: c.change,
+        file: c.file,
+        // Head-side impact from the diff (the change may not exist in the audit-time facts).
+        impacted_entry_points: [
+            ...new Set(diff.impacted
+                .filter((i) => i.is_entry_point &&
+                (`${i.contract}.${i.function}` === `${c.contract}.${c.entity}` ||
+                    i.reasons.some((r) => r.via === `${c.contract}.${c.entity}` || r.via.startsWith(`${c.entity} `))))
+                .map((i) => `${i.contract}.${i.function}`)),
+        ].sort(),
+        reviewed: false,
+    }));
+    const count = (s) => out.filter((c) => c.status === s).length;
+    return FixReviewSchema.parse({
+        generated_at: new Date().toISOString(),
+        from_commit: diff.base_commit,
+        to_commit: diff.head_commit,
+        cards: out,
+        unmapped_changes: unmapped,
+        summary: {
+            fixed: count('fixed'),
+            partially_fixed: count('partially_fixed'),
+            not_fixed: count('not_fixed'),
+            unaddressed: count('unaddressed'),
+            unknown: count('unknown'),
+            unmapped: unmapped.length,
+        },
+    });
+}
+const fixReviewPath = (outputDir, sha) => path.join(outputDir, 'fix-review', `${sha.slice(0, 12)}.json`);
+/**
+ * The saved review of a fix commit named the way people (and the skill) name it: a short or
+ * full SHA, a branch or any other ref. Files are keyed by the first 12 characters of the full SHA.
+ */
+function savedFixReview(config, outputDir, ref) {
+    let sha = ref;
+    try {
+        sha = resolveCommit(config.project.project_dir, ref);
+    }
+    catch {
+        /* not resolvable here (e.g. a shallow clone): match the file name instead */
+    }
+    const exact = fixReviewPath(outputDir, sha);
+    if (fs.existsSync(exact))
+        return exact;
+    const dir = path.dirname(exact);
+    const hits = fs.existsSync(dir)
+        ? fs.readdirSync(dir).filter((f) => f.endsWith('.json') && f.startsWith(ref.slice(0, 12)))
+        : [];
+    if (hits.length === 1)
+        return path.join(dir, hits[0]);
+    throw new Error(`No fix review for ${ref} in ${dir}; run \`hex fix-review --to ${ref}\` first.`);
+}
+const runCmd = new Command('run')
+    .description('Map fix commits to cards, re-run PoCs at the fix commit, and flag unmapped changes (default)')
+    .option('--from <commit>', 'Audited commit (default: settings.report.initial_commit, else project.commit)')
+    .option('--to <commit>', 'Fix commit (default: HEAD)')
+    .option('--no-poc', 'Do not re-run PoCs')
+    .option('--no-compile', 'Do not compile either commit (parser-based diff)')
+    .option('--project <dir>', 'Project directory')
+    .action((opts) => {
+    try {
+        const { config, outputDir } = loadProjectContext(opts.project ?? process.cwd());
+        const projectDir = config.project.project_dir;
+        const report = config.settings.report;
+        const from = resolveCommit(projectDir, opts.from ?? report?.initial_commit ?? config.project.commit);
+        const to = resolveCommit(projectDir, opts.to ?? 'HEAD');
+        const fr = computeFixReview(config, outputDir, from, to, {
+            runPocs: opts.poc !== false,
+            compile: opts.compile !== false,
+        });
+        const file = fixReviewPath(outputDir, to);
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(fr, null, 2) + '\n', 'utf-8');
+        const s = fr.summary;
+        logger.success(`${from.slice(0, 8)} → ${to.slice(0, 8)}: ${s.fixed} fixed · ${s.not_fixed} not fixed · ${s.unknown} need judgement · ${s.unaddressed} unaddressed · ${s.unmapped} unmapped change(s)`);
+        logger.dim(`  ${file}`);
+    }
+    catch (err) {
+        reportError(err);
+        process.exit(1);
+    }
+});
+/**
+ * Apply the proposals (Status + Update from the client) to the GitHub issues.
+ * Outward-facing: the /fix-review skill shows the batch and gets one explicit
+ * confirmation before calling this. Only the two fields change.
+ */
+const applyCmd = new Command('apply')
+    .description('Write proposed Status / Update-from-the-client to the GitHub issues (after confirmation)')
+    .argument('<sha>', 'Fix commit (as in .hex/fix-review/<sha>.json)')
+    .option('--only <ids...>', 'Only these cards')
+    .option('--dry-run', 'Print the new bodies instead of editing')
+    .option('--project <dir>', 'Project directory')
+    .action((sha, opts) => {
+    try {
+        const { config, outputDir } = loadProjectContext(opts.project ?? process.cwd());
+        const repo = config.settings.github?.repo;
+        if (!repo)
+            throw new Error('settings.github.repo is not set; fix review edits GitHub issues.');
+        const file = savedFixReview(config, outputDir, sha);
+        const fr = FixReviewSchema.parse(JSON.parse(fs.readFileSync(file, 'utf-8')));
+        let edited = 0;
+        for (const card of fr.cards) {
+            if (opts.only && !opts.only.includes(card.id))
+                continue;
+            if (!card.github_issue || (!card.proposed.resolution && !card.proposed.update_from_client))
+                continue;
+            const body = execFileSync('gh', [
+                'issue',
+                'view',
+                String(card.github_issue),
+                '--repo',
+                repo,
+                '--json',
+                'body',
+                '--jq',
+                '.body',
+            ], {
+                encoding: 'utf-8',
+            }).replace(/\n$/, '');
+            const next = rewriteIssueBody(body, {
+                status: card.proposed.resolution,
+                update: card.proposed.update_from_client,
+            });
+            if (next === body)
+                continue;
+            if (opts.dryRun) {
+                console.log(`── #${card.github_issue} (${card.id})\n${next}\n`);
+                continue;
+            }
+            const tmp = path.join(outputDir, '.cache', `issue-${card.github_issue}.md`);
+            fs.mkdirSync(path.dirname(tmp), { recursive: true });
+            fs.writeFileSync(tmp, next, 'utf-8');
+            execFileSync('gh', ['issue', 'edit', String(card.github_issue), '--repo', repo, '--body-file', tmp], { stdio: 'inherit' });
+            fs.rmSync(tmp, { force: true });
+            card.applied_at = new Date().toISOString();
+            edited++;
+        }
+        if (!opts.dryRun) {
+            fs.writeFileSync(file, JSON.stringify(fr, null, 2) + '\n', 'utf-8');
+            logger.success(`Edited ${edited} GitHub issue(s). Run /sync-issues to pull them back.`);
+        }
+    }
+    catch (err) {
+        reportError(err);
+        process.exit(1);
+    }
+});
+const proposeCmd = new Command('propose')
+    .description('Set the proposed resolution / client update for a card (used by /fix-review)')
+    .argument('<sha>', 'Fix commit')
+    .argument('<id>', 'Card id')
+    .option('--status <s>', 'fixed | partially_fixed | not_fixed | unaddressed | unknown')
+    .option('--resolution <r>', 'Fixed | Mitigated | Acknowledged | Not Fixed | Unresolved')
+    .option('--update-file <path>', 'Text for "Update from the client"')
+    .option('--evidence <text>', 'Why (one or two sentences)')
+    .option('--project <dir>', 'Project directory')
+    .action((sha, id, opts) => {
+    try {
+        const { config, outputDir } = loadProjectContext(opts.project ?? process.cwd());
+        const file = savedFixReview(config, outputDir, sha);
+        const fr = FixReviewSchema.parse(JSON.parse(fs.readFileSync(file, 'utf-8')));
+        const card = fr.cards.find((c) => c.id === id);
+        if (!card)
+            throw new Error(`${id} is not in ${file}`);
+        if (opts.status)
+            card.status = opts.status;
+        if (opts.evidence)
+            card.evidence = opts.evidence;
+        if (opts.resolution)
+            card.proposed.resolution = opts.resolution;
+        if (opts.updateFile)
+            card.proposed.update_from_client = fs
+                .readFileSync(path.resolve(opts.updateFile), 'utf-8')
+                .trim();
+        const count = (s) => fr.cards.filter((c) => c.status === s).length;
+        fr.summary = {
+            ...fr.summary,
+            fixed: count('fixed'),
+            partially_fixed: count('partially_fixed'),
+            not_fixed: count('not_fixed'),
+            unaddressed: count('unaddressed'),
+            unknown: count('unknown'),
+        };
+        fs.writeFileSync(file, JSON.stringify(FixReviewSchema.parse(fr), null, 2) + '\n', 'utf-8');
+        logger.success(`${id}: ${card.status}${card.proposed.resolution ? ` → ${card.proposed.resolution}` : ''}`);
+    }
+    catch (err) {
+        reportError(err);
+        process.exit(1);
+    }
+});
+const reviewedCmd = new Command('reviewed')
+    .description('Record the review of an unmapped change (used by /fix-review)')
+    .argument('<sha>', 'Fix commit')
+    .argument('<ref>', 'Contract.function, with or without the signature')
+    .requiredOption('--note <text>', 'The verdict in one or two sentences, with any card filed')
+    .option('--project <dir>', 'Project directory')
+    .action((sha, ref, opts) => {
+    try {
+        const { config, outputDir } = loadProjectContext(opts.project ?? process.cwd());
+        const file = savedFixReview(config, outputDir, sha);
+        const fr = FixReviewSchema.parse(JSON.parse(fs.readFileSync(file, 'utf-8')));
+        const u = fr.unmapped_changes[findUnmappedChange(fr.unmapped_changes, ref)];
+        u.reviewed = true;
+        u.note = opts.note.trim();
+        fs.writeFileSync(file, JSON.stringify(FixReviewSchema.parse(fr), null, 2) + '\n', 'utf-8');
+        logger.success(`${u.contract}.${u.entity}: reviewed`);
+    }
+    catch (err) {
+        reportError(err);
+        process.exit(1);
+    }
+});
+export const fixReviewCommand = new Command('fix-review')
+    .description('Fix review: which issues the client fixed, with PoCs re-run at the fix commit')
+    .addCommand(runCmd, { isDefault: true })
+    .addCommand(proposeCmd)
+    .addCommand(reviewedCmd)
+    .addCommand(applyCmd);
+//# sourceMappingURL=fix-review.js.map

package/dist/commands/fix-review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix-review.js","sourceRoot":"","sources":["../../src/commands/fix-review.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAe,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAkB/C,SAAS,QAAQ,CAAI,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAM,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,UAAkB,EAAE,IAAY,EAAE,EAAU;IAC1D,MAAM,GAAG,GAAG,YAAY,CACtB,KAAK,EACL,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,6BAA6B,EAAE,GAAG,IAAI,KAAK,EAAE,EAAE,CAAC,EAC1E;QACE,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CACF,CAAC;IACF,OAAO,GAAG;SACP,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,kFAAkF;AAClF,SAAS,MAAM,CAAC,GAAW,EAAE,IAAY;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE;QAClE,GAAG,EAAE,GAAG;QACR,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,EAAE,GAAG,MAAM;QACpB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IAClD,IAAI,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IACvF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,SAAiB,EACjB,IAAY,EACZ,EAAU,EACV,IAA4C;IAE5C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9C,MAAM,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC1C,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,EAAE;QACR,SAAS;QACT,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,QAAQ,GACZ,QAAQ,CAA6B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC9F,MAAM,QAAQ,GACZ,QAAQ,CAA8B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC/F,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1F,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,eAAe;QAC5B,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAClF,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAC1F,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAEzC,8EAA8E;IAC9E,uEAAuE;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,YAAY,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE;gBAClE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAI,CAAC,IAAK,CAAC;oBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;oBACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;wBACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;wBAC3B,SAAS;oBACX,CAAC;oBACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBACrE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;oBAC1C,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,6BAA6B,IAAI,EAAE,CAAC,CAAC;oBAC7D,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,GAAG,GAAoB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GACV,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS;gBAC3B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI;oBACX,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,SAAS,CAAC;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;YACxC,SAAS,EAAE,MAA+B;YAC1C,QAAQ;YACR,aAAa,EAAE,GAAG;YAClB,gBAAgB,EAAE,OAAO;YACzB,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtD,OAAO;SACR,CAAC,CAAC;QACH,MAAM,QAAQ,GACZ,MAAM,KAAK,OAAO;YAChB,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE;YACzB,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,aAAa;gBAClD,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE;gBAC9B,CAAC,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM;YACN,QAAQ;YACR,GAAG,EAAE;gBACH,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC;YACD,iBAAiB,EAAE,OAAO;YAC1B,OAAO;YACP,QAAQ;SACT,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,WAAW;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,qFAAqF;QACrF,qBAAqB,EAAE;YACrB,GAAG,IAAI,GAAG,CACR,IAAI,CAAC,QAAQ;iBACV,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,cAAc;gBAChB,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE;oBAC5D,CAAC,CAAC,OAAO,CAAC,IAAI,CACZ,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAC5E,CAAC,CACP;iBACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAC7C;SACF,CAAC,IAAI,EAAE;QACR,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC,CAAC;IAEN,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACvF,OAAO,eAAe,CAAC,KAAK,CAAC;QAC3B,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,WAAW;QAC3B,KAAK,EAAE,GAAG;QACV,gBAAgB,EAAE,QAAQ;QAC1B,OAAO,EAAE;YACP,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,eAAe,EAAE,KAAK,CAAC,iBAAiB,CAAC;YACzC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC;YAC7B,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC;YACjC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;YACzB,QAAQ,EAAE,QAAQ,CAAC,MAAM;SAC1B;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAE,GAAW,EAAE,EAAE,CACvD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;AAEjE;;;GAGG;AACH,SAAS,cAAc,CAAC,MAAc,EAAE,SAAiB,EAAE,GAAW;IACpE,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAC7B,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1F,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,OAAO,GAAG,+BAA+B,GAAG,WAAW,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;KAC9B,WAAW,CACV,8FAA8F,CAC/F;KACA,MAAM,CACL,iBAAiB,EACjB,+EAA+E,CAChF;KACA,MAAM,CAAC,eAAe,EAAE,4BAA4B,CAAC;KACrD,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC;KACxC,MAAM,CAAC,cAAc,EAAE,kDAAkD,CAAC;KAC1E,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC9C,MAAM,CACL,CAAC,IAAwF,EAAE,EAAE;IAC3F,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QAC9C,MAAM,MAAM,GAAI,MAAM,CAAC,QAAqD,CAAC,MAAM,CAAC;QACpF,MAAM,IAAI,GAAG,aAAa,CACxB,UAAU,EACV,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,cAAc,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAC7D,CAAC;QACF,MAAM,EAAE,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;YACvD,OAAO,EAAE,IAAI,CAAC,GAAG,KAAK,KAAK;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,KAAK;SAChC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,CAAC,OAAO,CACZ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,SAAS,gBAAgB,CAAC,CAAC,OAAO,qBAAqB,CAAC,CAAC,WAAW,kBAAkB,CAAC,CAAC,QAAQ,qBAAqB,CACvL,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ;;;;GAIG;AACH,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAClC,WAAW,CACV,0FAA0F,CAC3F;KACA,QAAQ,CAAC,OAAO,EAAE,+CAA+C,CAAC;KAClE,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;KAC7C,MAAM,CAAC,WAAW,EAAE,yCAAyC,CAAC;KAC9D,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC9C,MAAM,CAAC,CAAC,GAAW,EAAE,IAA6D,EAAE,EAAE;IACrF,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;QAC1C,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,SAAS;YACxD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBACxF,SAAS;YACX,MAAM,IAAI,GAAG,YAAY,CACvB,IAAI,EACJ;gBACE,OAAO;gBACP,MAAM;gBACN,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;gBACzB,QAAQ;gBACR,IAAI;gBACJ,QAAQ;gBACR,MAAM;gBACN,MAAM;gBACN,OAAO;aACR,EACD;gBACE,QAAQ,EAAE,OAAO;aAClB,CACF,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACrB,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE;gBAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;gBAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB;aACzC,CAAC,CAAC;YACH,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;gBAChE,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,CAAC,YAAY,KAAK,CAAC,CAAC;YAC5E,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACrC,YAAY,CACV,IAAI,EACJ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,EAChF,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;YACF,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,EAAE,CAAC;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YACpE,MAAM,CAAC,OAAO,CAAC,UAAU,MAAM,uDAAuD,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC;KACtC,WAAW,CAAC,8EAA8E,CAAC;KAC3F,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;KAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;KAC3B,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;KACrF,MAAM,CAAC,kBAAkB,EAAE,2DAA2D,CAAC;KACvF,MAAM,CAAC,sBAAsB,EAAE,mCAAmC,CAAC;KACnE,MAAM,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;KACzD,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC9C,MAAM,CACL,CACE,GAAW,EACX,EAAU,EACV,IAMC,EACD,EAAE;IACF,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAiC,CAAC;QACtE,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjD,IAAI,IAAI,CAAC,UAAU;YACjB,IAAI,CAAC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,UAAqD,CAAC;QACxF,IAAI,IAAI,CAAC,UAAU;YACjB,IAAI,CAAC,QAAQ,CAAC,kBAAkB,GAAG,EAAE;iBAClC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;iBACpD,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5F,EAAE,CAAC,OAAO,GAAG;YACX,GAAG,EAAE,CAAC,OAAO;YACb,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,eAAe,EAAE,KAAK,CAAC,iBAAiB,CAAC;YACzC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC;YAC7B,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC;YACjC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;SAC1B,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3F,MAAM,CAAC,OAAO,CACZ,GAAG,EAAE,KAAK,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3F,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC;KACxC,WAAW,CAAC,+DAA+D,CAAC;KAC5E,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;KAC/B,QAAQ,CAAC,OAAO,EAAE,kDAAkD,CAAC;KACrE,cAAc,CAAC,eAAe,EAAE,0DAA0D,CAAC;KAC3F,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC9C,MAAM,CAAC,CAAC,GAAW,EAAE,GAAW,EAAE,IAAwC,EAAE,EAAE;IAC7E,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3F,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC;KACtD,WAAW,CAAC,+EAA+E,CAAC;KAC5F,UAAU,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACvC,UAAU,CAAC,UAAU,CAAC;KACtB,UAAU,CAAC,WAAW,CAAC;KACvB,UAAU,CAAC,QAAQ,CAAC,CAAC"}

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAapC,eAAO,MAAM,WAAW,SAkWpB,CAAC"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,eAAO,MAAM,WAAW,SAyapB,CAAC"}

package/dist/commands/init.js

@@ -8,8 +8,10 @@ import { normalizePath, getOutputDir } from '../core/paths.js';
 import { runForge, detectTools } from '../core/external-tools.js';
 import { parseSolidity, extractSolidityVersion } from '../parsers/solidity-parser.js';
 import { copySkillsToClaudeFormat, getClaudeSkillsDir } from '../core/skills.js';
+import { ensureMcpConfig } from '../core/mcp-config.js';
 import { ProgressTracker } from '../core/progress.js';
 import { HexError, reportError } from '../core/errors.js';
+import { headCommit, isGitRepo, resolveCommit } from '../core/git.js';
 export const initCommand = new Command('init')
     .description('Initialize a new audit project')
     .option('--project <dir>', 'Project directory (default: cwd)')
@@ -21,6 +23,9 @@ export const initCommand = new Command('init')
     .option('--output-dir <dir>', 'Output directory', '.hex')
     .option('--exclude <globs>', 'Comma-separated exclude globs')
     .option('--github-repo <owner/repo>', 'GitHub repo for issue syncing (sets settings.github.repo)')
+    .option('--mode <mode>', 'Audit mode: full | diff (differential audit against --base)', 'full')
+    .option('--base <commit>', 'Differential mode: the previously audited commit')
+    .option('--previous-audit <path>', "Differential mode: the previous engagement's .hex/ folder or its report (PDF/MD)")
     .option('--no-verify', 'Skip build verification')
     .action(async (opts) => {
     const STEPS = [
@@ -61,13 +66,16 @@ export const initCommand = new Command('init')
         const allMissing = tools.every((t) => !t.available);
         tracker.update('check tools', allMissing ? 'failed' : 'ok', toolDetails.join(', '));
         if (!tools.find((t) => t.name === 'forge')?.available) {
-            logger.warn('forge not found — compilation verification and test coverage will be unavailable');
+            logger.warn('forge not found — exact compiler facts and test coverage will be unavailable (parser fallback)');
         }
-        if (!tools.find((t) => t.name === 'slither')?.available) {
-            logger.warn('slither not found — access control, state variable, and external call analysis will be limited');
+        // Audit mode
+        const mode = opts.mode === 'diff' ? 'diff' : 'full';
+        if (opts.mode !== 'full' && opts.mode !== 'diff') {
+            throw new Error(`Invalid --mode: ${opts.mode}. Use full or diff.`);
         }
-        if (!tools.find((t) => t.name === 'solc')?.available) {
-            logger.warn('solc not found — storage layout extraction will be unavailable');
+        if (mode === 'diff' && !opts.base) {
+            tracker.update('resolve scope', 'failed', '--base missing');
+            throw new HexError('diff.base-required');
         }
         // Resolve scope globs
         if (!opts.scope) {
@@ -139,6 +147,32 @@ export const initCommand = new Command('init')
                 logger.warn('Could not detect git commit hash. Use --commit to specify.');
             }
         }
+        // Differential mode: pin the base commit and record the previous audit.
+        let baseCommit;
+        let previousAudit;
+        if (mode === 'diff') {
+            if (!isGitRepo(projectDir))
+                throw new HexError('diff.not-git', `path: ${projectDir}`);
+            baseCommit = resolveCommit(projectDir, opts.base);
+            if (commit && commit !== 'unknown') {
+                const resolvedHead = resolveCommit(projectDir, commit);
+                const wt = headCommit(projectDir);
+                if (wt && wt !== resolvedHead) {
+                    logger.warn(`Working tree is at ${wt.slice(0, 8)} but --commit is ${resolvedHead.slice(0, 8)}. ` +
+                        'Analyses read the working tree: check out the head commit before `hex analyze`.');
+                }
+            }
+            if (opts.previousAudit) {
+                const prev = path.resolve(opts.previousAudit);
+                if (!fs.existsSync(prev)) {
+                    throw new Error(`--previous-audit path not found: ${prev}`);
+                }
+                const isHexDir = fs.statSync(prev).isDirectory() &&
+                    (fs.existsSync(path.join(prev, 'config.json')) ||
+                        fs.existsSync(path.join(prev, '.hex', 'config.json')));
+                previousAudit = { kind: isHexDir ? 'hex' : 'report', path: prev };
+            }
+        }
         // Determine project name
         const name = opts.name ?? path.basename(projectDir);
         // Create config
@@ -154,6 +188,10 @@ export const initCommand = new Command('init')
             exclude: excludeGlobs,
             outputDir: opts.outputDir,
             githubRepo: opts.githubRepo,
+            scopeGlobs: scopeGlobs,
+            mode,
+            baseCommit,
+            previousAudit,
         });
         const outputDir = getOutputDir(projectDir, config.settings.output_dir);
         tracker.update('create config', 'ok', normalizePath(outputDir));
@@ -161,6 +199,7 @@ export const initCommand = new Command('init')
         tracker.update('copy skills', 'running');
         const claudeSkillsDir = getClaudeSkillsDir(projectDir);
         const skillsResult = copySkillsToClaudeFormat({ targetDir: claudeSkillsDir });
+        ensureMcpConfig(projectDir);
         tracker.update('copy skills', 'ok', `${skillsResult.updated + skillsResult.added} skill(s)`);
         // Create subdirectories
         for (const subdir of ['validations', 'ai-results']) {
@@ -177,7 +216,15 @@ export const initCommand = new Command('init')
         // Optionally verify compilation
         if (opts.verify !== false && isFoundry) {
             tracker.update('verify build', 'running');
-            const result = await runForge(projectDir, ['build']);
+            // Build into Hex's cache, never the client's out/ and cache/.
+            const cache = path.join(outputDir, '.cache');
+            const result = await runForge(projectDir, [
+                'build',
+                '--out',
+                path.join(cache, 'forge-out'),
+                '--cache-path',
+                path.join(cache, 'forge-cache'),
+            ]);
             if (result.exitCode === 0) {
                 tracker.update('verify build', 'ok');
             }
@@ -199,7 +246,20 @@ This project is being audited with Hex.
 - **Chain:** ${config.project.chain}
 - **Solidity:** ${config.project.solidity_version}
 - **Commit:** \`${config.project.commit}\`${config.project.docs_url ? `\n- **Docs:** ${config.project.docs_url}` : ''}
-- **Config:** \`${config.settings.output_dir}/config.json\` — source of truth for all project metadata
+- **Config:** \`${config.settings.output_dir}/config.json\` — source of truth for all project metadata${mode === 'diff' && baseCommit
+                ? `
+
+## Differential audit
+
+This is a **differential audit** of \`${baseCommit.slice(0, 8)}\` → \`${String(config.project.commit).slice(0, 8)}\`. Review effort goes to the changed code and the flows it reaches, not the whole scope.
+
+- \`${config.settings.output_dir}/diff.json\` — changed files and entities, storage-layout changes, and every impacted function with the reason chain (from \`hex diff\`)
+- \`${config.settings.output_dir}/diff/changes.patch\` — the in-scope unified diff
+- \`${config.settings.output_dir}/diff-overview.md\` — what changed and why (written by /init-audit)${previousAudit
+                    ? `
+- \`${config.settings.output_dir}/previous-audit/\` — prior findings (\`findings.json\`) and their regression check (\`review.json\`)`
+                    : ''}`
+                : ''}
 
 ## Scope
 
@@ -208,24 +268,25 @@ ${uniqueScope.map((f) => `- \`${f}\``).join('\n')}
 
 ## Output Directory (\`${config.settings.output_dir}/\`)
 
-All analysis outputs live here. Key files and what they answer:
+All Hex data lives here. Key files and what they answer:
 
 | File | Contains | Use when asked about... |
 |------|----------|------------------------|
-| \`config.json\` | Project config (scope, chain, docs URL, commit) | project setup, documentation, scope |
-| \`stats.json\` | nSLOC, contracts, functions, test coverage, dependencies | codebase size, complexity, coverage |
-| \`deps.json\` | Inheritance, imports, calls, clusters | contract relationships, dependency graph |
-| \`access-control.json\` | Roles, modifiers, function access | who can call what, privileged functions |
-| \`state-vars.json\` | State variables, types, visibility, read/write | storage, mutability, state layout |
-| \`external-calls.json\` | External calls, reentrancy guards, trust levels | external interactions, reentrancy risk |
-| \`overview.md\` | AI-generated protocol overview | what the protocol does, architecture |
-| \`spec-conformance.json\` | Spec vs code deviations | spec compliance, ERC conformance |
-| \`findings.json\` | Audit findings (canonical), wrapped as \`{ "findings": [...] }\` | reported issues, vulnerabilities |
-| \`tracking.json\` | Board state per issue (status, source, duplicate_of), wrapped as \`{ "findings": [...] }\` | finding triage, board columns |
-| \`comparison.json\` | Dedup match_signals (auditagent / github) | duplicate detection |
-| \`progress.json\` | Audit progress tracking | what has been reviewed |
-| \`diagrams/\` | Mermaid architecture and flow diagrams | system diagrams, flows |
-| \`report/\` | LaTeX report sections (executive summary, audited files, summary of issues, system overview, issues, documentation eval, test suite) as \`.txt\` + \`.tex\` | final report export |
+| \`config.json\` | Project config (scope, mode, chain, docs URL, commit) | project setup, documentation, scope |
+| \`facts.json\` | **Exact compiler facts**: call graph, reads/writes, modifiers, inheritance, entry points, storage layout | who calls what, who writes a variable, storage slots |
+| \`stats.json\` | nSLOC, ERCs, test coverage, dependencies | codebase size, complexity, coverage |
+| \`model/protocol.json\` | Verified protocol model: actors, assets, privileges, trust, dependencies, state machines, accounting, risky flows (each claim verified or contested) | how the protocol works, who can do what |
+| \`model/invariants.json\` | Invariants (proposed / accepted / rejected) and their test results | what must always hold |
+| \`model/diagrams/\` | Diagram specs and Excalidraw scenes | system pictures |
+| \`overview.md\` | Protocol overview | what the protocol does, architecture |
+| \`spec-conformance.json\` | Docs / NatSpec / ERC promises vs code | spec compliance |
+| \`findings.json\` / \`tracking.json\` | Board cards (content / status, source, validation) | reported issues, triage |
+| \`progress.json\` | Per-function review state (unread / read / questioned / cleared) | review progress, blind spots |
+| \`triage-rules.json\` | The auditor's standing decisions (trusted roles, out of scope, by design, known issues) | what not to report |
+| \`notes/\` | Contract notes, questions and leads (Diane) | auditor's notes |
+| \`ai-audit/\`, \`ai-results/\` | /ai-audit runs and the records behind AI cards | AI audit results |
+| \`fix-review/\` | Fix review results per fix commit | which issues the client fixed |
+| \`report/\` | LaTeX report sections and figures | final report |
 
 Not all files exist initially — they are created as you run skills and CLI commands.
 
@@ -233,27 +294,31 @@ Not all files exist initially — they are created as you run skills and CLI com
 
 Skills are in \`.claude/skills/\` and auto-discovered by Claude Code. Type \`/\` to list them.
 
-**Recommended workflow order:**
+1. \`/init-audit\` — Safety gate, exact facts, then agents build and verify the protocol model, invariants, conformance and diagrams
+2. \`/ai-audit\` — 12 parallel attacker agents; findings land on the board (pre-validated), leads in notes
+3. \`/write-finding\` — Record a manual issue as a Potential card
+4. \`/validate-finding\` / \`/validate-all-findings\` — Validate cards; PoC by default
+5. \`/prevalidate\` — Parallel agent validation of new machine-generated cards; conclusive cases move automatically
+6. \`/fuzz\` — Fuzz the accepted invariants (Echidna / Medusa / Foundry); violations become cards
+7. \`/diane\` — Turn recorded narration into notes and review ticks
+8. \`/ingest-aa-report\` — Ingest a Nethermind AuditAgent scan
+9. \`/sync-issues\` — Two-way GitHub Issues sync (GitHub canonical)
+10. \`/fix-review\` — Check the client's fixes (PoCs re-run at the fix commit) and update GitHub
+11. \`/generate-report\` — Emit the LaTeX report sections
 
-1. \`/init-audit\` — Initialize, dependency safety, full analysis pipeline, overview, diagrams, flows, spec conformance, board materialization (all in one)
-2. \`/write-finding\` — Record a manual issue as a Potential card on the board
-3. \`/validate-finding\` — Validate any Potential card (manual / auditagent / conformance / github); per-issue PoC or memo-only
-4. \`/generate-poc\` — Generate and run a proof-of-concept test (invoked by /validate-finding)
-5. \`/ingest-aa-report\` — Ingest a completed Nethermind AuditAgent scan by ID, with inline dedup
-6. \`/sync-issues\` — Two-way GitHub Issues sync (GitHub canonical)
-7. \`/generate-report\` — Emit the LaTeX report sections into \`${config.settings.output_dir}/report/\`
+## Hex MCP tools
 
-Each skill builds on previous outputs.
+The project's \`.mcp.json\` registers the Hex MCP server. **When the auditor says "this", "here" or "the selected …", call \`hex_focus\` first**: it returns what they have selected in the dashboard. Use \`hex_facts_query\` for exact code relationships instead of grepping.
 
-## CLI Commands
+## CLI Commands (always \`npx --no-install hex …\`; an unrelated npm package is named \`hex\`)
 
-- \`npx hex analyze\` — Run all deterministic analysis (stats, deps, access, state, calls, patterns, constraints, surface)
-- \`npx hex context\` — Assemble full codebase context for AI prompts
-- \`npx hex context --target <Contract>\` — Focused context for a single contract
-- \`npx hex dashboard\` — Open browser dashboard at http://localhost:3000
-- \`npx hex issue move <id> --to <column>\` — Move an issue between board columns
-- \`npx hex issue patch <id> [--severity ...] [--resolution ...]\` — Edit issue fields
-- \`npx hex update\` — Update hex-audit to the latest version
+- \`analyze\` — stats + compiler facts (+ diff in differential mode)
+- \`facts query <callers|callees|readers|writers|layout|linearization|entry-points|reach|function> [ref]\` — exact relationships
+- \`model show|validate\`, \`invariant list|accept|reject|set-test|export\`
+- \`review mark <ref> --state <read|questioned|cleared>\`, \`review status\`, \`review blind-spots\`
+- \`issue new|move|patch|show|validation|dedup|mark-duplicate|exclude\`
+- \`rules list|add|remove|export\`
+- \`diagram build|list\`, \`diff\`, \`fix-review\`, \`dashboard\`, \`update\`
 
 ## Writing Style (applies to every skill that produces text)
 
@@ -330,9 +395,8 @@ Apply these to every skill output without being reminded.
         logger.info(`Output: ${normalizePath(outputDir)}`);
         logger.info('');
         logger.info('Next steps:');
-        logger.dim('  hex stats    # Generate codebase statistics');
-        logger.dim('  hex deps     # Build dependency graph');
-        logger.dim('  hex access   # Map access control');
+        logger.dim('  hex analyze     # Stats + exact compiler facts (+ diff in differential mode)');
+        logger.dim('  hex dashboard   # Open the review workspace');
     }
     catch (err) {
         tracker.finish();