humanish 0.15.0 → 0.15.2

package/dist/core/git-workspace.js

@@ -0,0 +1,447 @@
+import { constants } from "node:fs";
+import { lstat, open, readdir, realpath } from "node:fs/promises";
+import path from "node:path";
+export const GIT_METADATA_INSPECTION_FAILED_NOTE = "Git metadata could not be inspected safely.";
+export const GIT_METADATA_CONTAINMENT_FAILED_NOTE = "Git metadata failed containment validation.";
+/**
+ * Resolve one physical Git worktree without trusting ambient Git discovery.
+ *
+ * A regular `.git` file is accepted only for Git's exact linked-worktree
+ * topology: `<common>/.git/worktrees/<name>` plus single-link `commondir` and
+ * `gitdir` backpointer files. Arbitrary `gitdir:` redirects (including valid
+ * separate-git-dir repositories) are deliberately unavailable because they
+ * delegate metadata authority outside the selected project without a
+ * verifiable backlink.
+ */
+export async function inspectVerifiedGitWorkspace(cwdInput) {
+    let current;
+    try {
+        current = await realpath(path.resolve(cwdInput));
+        const cwdStats = await lstat(current);
+        if (cwdStats.isSymbolicLink() || !cwdStats.isDirectory()) {
+            return unsafeInspection(current, GIT_METADATA_INSPECTION_FAILED_NOTE);
+        }
+    }
+    catch {
+        return unsafeInspection(path.resolve(cwdInput), GIT_METADATA_INSPECTION_FAILED_NOTE);
+    }
+    while (true) {
+        const dotGitPath = path.join(current, ".git");
+        let dotGitStats;
+        try {
+            dotGitStats = await lstat(dotGitPath, { bigint: true });
+        }
+        catch (error) {
+            if (!isNodeError(error) || error.code !== "ENOENT") {
+                return unsafeInspection(current, GIT_METADATA_INSPECTION_FAILED_NOTE);
+            }
+            const parent = path.dirname(current);
+            if (parent === current) {
+                return { status: "missing" };
+            }
+            current = parent;
+            continue;
+        }
+        if (dotGitStats.isSymbolicLink()) {
+            return unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+        }
+        if (dotGitStats.isDirectory()) {
+            try {
+                if (await realpath(dotGitPath) !== dotGitPath) {
+                    return unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+                }
+                // A normal worktree does not need commondir. Accepting one here would
+                // let a contained `.git/` silently redirect config, refs, and objects.
+                if (await pathExists(path.join(dotGitPath, "commondir"))) {
+                    return unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+                }
+                const configOverrides = [];
+                const workspace = {
+                    commonDir: dotGitPath,
+                    configOverrides,
+                    gitDir: dotGitPath,
+                    kind: "directory",
+                    trustRoot: current,
+                    worktreeRoot: current
+                };
+                return await validateCriticalGitMetadata(workspace)
+                    ? { status: "verified", workspace: freezeVerifiedWorkspace(workspace, configOverrides) }
+                    : unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+            }
+            catch {
+                return unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+            }
+        }
+        if (!dotGitStats.isFile() || dotGitStats.nlink !== 1n) {
+            return unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+        }
+        try {
+            const dotGit = await readSingleLinkRegularFile(dotGitPath);
+            const declaredGitDir = dotGit ? parseGitdirFile(dotGit.text) : null;
+            if (!dotGit || !declaredGitDir) {
+                return unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+            }
+            const gitDir = await realpath(path.isAbsolute(declaredGitDir)
+                ? declaredGitDir
+                : path.resolve(current, declaredGitDir));
+            if (!await isPhysicalDirectory(gitDir)) {
+                return unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+            }
+            const commondir = await readSingleLinkRegularFile(path.join(gitDir, "commondir"));
+            const backpointer = await readSingleLinkRegularFile(path.join(gitDir, "gitdir"));
+            const declaredCommonDir = commondir ? parseSinglePathLine(commondir.text) : null;
+            const declaredBackpointer = backpointer ? parseSinglePathLine(backpointer.text) : null;
+            if (!commondir || !backpointer || !declaredCommonDir || !declaredBackpointer) {
+                return unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+            }
+            const commonDir = await realpath(path.resolve(gitDir, declaredCommonDir));
+            if (!await isPhysicalDirectory(commonDir)
+                || path.basename(commonDir) !== ".git"
+                || path.dirname(gitDir) !== path.join(commonDir, "worktrees")
+                || path.basename(gitDir).length === 0) {
+                return unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+            }
+            const physicalBackpointer = await realpath(path.isAbsolute(declaredBackpointer)
+                ? declaredBackpointer
+                : path.resolve(gitDir, declaredBackpointer));
+            if (physicalBackpointer !== dotGitPath) {
+                return unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+            }
+            const trustRoot = path.dirname(commonDir);
+            if (!await isPhysicalDirectory(trustRoot)
+                || await realpath(path.join(trustRoot, ".git")) !== commonDir
+                || !await stillSameSingleLinkFile(dotGitPath, dotGit.identity)
+                || !await stillSameSingleLinkFile(path.join(gitDir, "commondir"), commondir.identity)
+                || !await stillSameSingleLinkFile(path.join(gitDir, "gitdir"), backpointer.identity)) {
+                return unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+            }
+            const configOverrides = [];
+            const workspace = {
+                commonDir,
+                configOverrides,
+                gitDir,
+                kind: "linked-worktree",
+                trustRoot,
+                worktreeRoot: current
+            };
+            return await validateCriticalGitMetadata(workspace)
+                ? { status: "verified", workspace: freezeVerifiedWorkspace(workspace, configOverrides) }
+                : unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+        }
+        catch {
+            return unsafeInspection(current, GIT_METADATA_CONTAINMENT_FAILED_NOTE);
+        }
+    }
+}
+async function validateCriticalGitMetadata(workspace) {
+    if (!await isPhysicalDirectory(workspace.gitDir)
+        || !await isPhysicalDirectory(workspace.commonDir)
+        || !await isPhysicalDirectory(workspace.worktreeRoot)) {
+        return false;
+    }
+    const criticalFiles = new Set([
+        path.join(workspace.gitDir, "HEAD"),
+        path.join(workspace.gitDir, "index"),
+        path.join(workspace.gitDir, "config.worktree"),
+        path.join(workspace.commonDir, "config"),
+        path.join(workspace.commonDir, "config.worktree"),
+        path.join(workspace.commonDir, "info", "attributes"),
+        path.join(workspace.commonDir, "info", "exclude"),
+        path.join(workspace.commonDir, "packed-refs")
+    ]);
+    for (const filePath of criticalFiles) {
+        if (!await isSingleLinkRegularFileOrMissing(filePath)) {
+            return false;
+        }
+    }
+    // Split indexes are selected by the contained index but read as sibling
+    // metadata. Do not let one redirect Git through a symlink or hardlink.
+    const gitDirEntries = await readdir(workspace.gitDir).catch(() => []);
+    for (const entry of gitDirEntries) {
+        if (/^sharedindex\.[0-9a-f]+$/i.test(entry)) {
+            if (!await isSingleLinkRegularFileOrMissing(path.join(workspace.gitDir, entry))) {
+                return false;
+            }
+        }
+    }
+    for (const directory of [
+        path.join(workspace.commonDir, "objects"),
+        path.join(workspace.commonDir, "refs")
+    ]) {
+        if (!await isPhysicalDirectoryOrMissing(directory)) {
+            return false;
+        }
+    }
+    const head = await readSingleLinkRegularFile(path.join(workspace.gitDir, "HEAD"), true);
+    if (head && !await validateHeadReference(workspace, head.text)) {
+        return false;
+    }
+    const alternatesPath = path.join(workspace.commonDir, "objects", "info", "alternates");
+    if (!await isSingleLinkRegularFileOrMissing(alternatesPath)) {
+        return false;
+    }
+    const alternates = await readSingleLinkRegularFile(alternatesPath, true);
+    if (alternates && !await alternatesStayInsideCommonDir(workspace.commonDir, alternates.text)) {
+        return false;
+    }
+    const overrides = await collectExecutableConfigOverrides(workspace);
+    if (!overrides) {
+        return false;
+    }
+    workspace.configOverrides.push(...overrides);
+    return true;
+}
+async function collectExecutableConfigOverrides(workspace) {
+    const filters = new Set();
+    const diffs = new Set();
+    for (const configPath of new Set([
+        path.join(workspace.commonDir, "config"),
+        path.join(workspace.gitDir, "config.worktree")
+    ])) {
+        const config = await readSingleLinkRegularFile(configPath, true);
+        if (!config)
+            continue;
+        for (const line of config.text.split(/\r?\n/)) {
+            if (/^\s*\[\s*include(?:\s*\]|if\b)/i.test(line)) {
+                // Includes can introduce executable config from an unbound path after
+                // this file was inspected. Provenance capture does not need them.
+                return null;
+            }
+            const sectionStart = /^\s*\[\s*(filter|diff)\b/i.exec(line);
+            if (!sectionStart)
+                continue;
+            const section = /^\s*\[\s*(filter|diff)\s+(?:"((?:\\.|[^"\\])*)"|\.\s*([^\]\s]+))\s*\]\s*(?:[#;].*)?$/i.exec(line);
+            if (!section)
+                return null;
+            const rawDriver = section[2] === undefined ? section[3] : unescapeGitConfigSubsection(section[2]);
+            if (!rawDriver || !/^[A-Za-z0-9_.-]+$/.test(rawDriver))
+                return null;
+            if (section[1]?.toLowerCase() === "filter")
+                filters.add(rawDriver);
+            else
+                diffs.add(rawDriver);
+        }
+    }
+    const overrides = [];
+    for (const driver of [...filters].sort()) {
+        overrides.push(`filter.${driver}.clean=`, `filter.${driver}.smudge=`, `filter.${driver}.process=`, `filter.${driver}.required=false`);
+    }
+    for (const driver of [...diffs].sort()) {
+        overrides.push(`diff.${driver}.command=`, `diff.${driver}.textconv=`);
+    }
+    return overrides;
+}
+function unescapeGitConfigSubsection(value) {
+    let result = "";
+    for (let index = 0; index < value.length; index += 1) {
+        const char = value[index];
+        if (char !== "\\") {
+            result += char;
+            continue;
+        }
+        const escaped = value[index + 1];
+        if (escaped !== "\\" && escaped !== "\"")
+            return null;
+        result += escaped;
+        index += 1;
+    }
+    return result;
+}
+function freezeVerifiedWorkspace(workspace, configOverrides) {
+    Object.freeze(configOverrides);
+    return Object.freeze(workspace);
+}
+async function validateHeadReference(workspace, headText) {
+    const value = headText.trim();
+    if (/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/i.test(value)) {
+        return true;
+    }
+    if (!value.startsWith("ref: ")) {
+        return false;
+    }
+    const ref = value.slice("ref: ".length);
+    if (!isSafeGitRef(ref)) {
+        return false;
+    }
+    // Normal branch refs live under the common directory. Per-worktree refs may
+    // live under the admin directory. Validate either existing path without
+    // requiring an unborn branch to have a loose ref.
+    const candidates = [path.join(workspace.commonDir, ...ref.split("/"))];
+    if (workspace.gitDir !== workspace.commonDir) {
+        candidates.push(path.join(workspace.gitDir, ...ref.split("/")));
+    }
+    for (const candidate of candidates) {
+        if (!await validateOptionalContainedFileChain(candidate.startsWith(`${workspace.gitDir}${path.sep}`) ? workspace.gitDir : workspace.commonDir, candidate)) {
+            return false;
+        }
+    }
+    return true;
+}
+async function validateOptionalContainedFileChain(root, filePath) {
+    const relative = path.relative(root, filePath);
+    if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        return false;
+    }
+    let current = root;
+    const segments = relative.split(path.sep);
+    for (const [index, segment] of segments.entries()) {
+        current = path.join(current, segment);
+        let stats;
+        try {
+            stats = await lstat(current, { bigint: true });
+        }
+        catch (error) {
+            return isNodeError(error) && error.code === "ENOENT";
+        }
+        if (stats.isSymbolicLink())
+            return false;
+        if (index < segments.length - 1) {
+            if (!stats.isDirectory())
+                return false;
+        }
+        else if (!stats.isFile() || stats.nlink !== 1n) {
+            return false;
+        }
+    }
+    return true;
+}
+async function alternatesStayInsideCommonDir(commonDir, text) {
+    const objectDir = path.join(commonDir, "objects");
+    for (const line of text.split(/\r?\n/).map((value) => value.trim()).filter(Boolean)) {
+        const candidate = path.isAbsolute(line) ? line : path.resolve(objectDir, line);
+        let physical;
+        try {
+            physical = await realpath(candidate);
+        }
+        catch {
+            return false;
+        }
+        const relative = path.relative(commonDir, physical);
+        if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+            return false;
+        }
+    }
+    return true;
+}
+function parseGitdirFile(text) {
+    const match = /^gitdir:\s*([^\r\n]+)\r?\n?$/.exec(text);
+    return match?.[1]?.trim() || null;
+}
+function parseSinglePathLine(text) {
+    const match = /^([^\r\n]+)\r?\n?$/.exec(text);
+    return match?.[1]?.trim() || null;
+}
+function isSafeGitRef(value) {
+    return value.startsWith("refs/")
+        && !value.includes("\\")
+        && !value.includes("\0")
+        && !value.includes("//")
+        && value.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}
+async function readSingleLinkRegularFile(filePath, allowMissing = false) {
+    let before;
+    try {
+        before = await lstat(filePath, { bigint: true });
+    }
+    catch (error) {
+        if (allowMissing && isNodeError(error) && error.code === "ENOENT") {
+            return null;
+        }
+        throw error;
+    }
+    if (before.isSymbolicLink() || !before.isFile() || before.nlink !== 1n) {
+        return null;
+    }
+    const handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const opened = await handle.stat({ bigint: true });
+        if (!opened.isFile()
+            || opened.nlink !== 1n
+            || opened.dev !== before.dev
+            || opened.ino !== before.ino) {
+            return null;
+        }
+        const text = await handle.readFile("utf8");
+        return Object.freeze({
+            identity: Object.freeze({ dev: opened.dev, ino: opened.ino }),
+            text
+        });
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function isSingleLinkRegularFileOrMissing(filePath) {
+    let before;
+    try {
+        before = await lstat(filePath, { bigint: true });
+    }
+    catch (error) {
+        return isNodeError(error) && error.code === "ENOENT";
+    }
+    if (before.isSymbolicLink() || !before.isFile() || before.nlink !== 1n) {
+        return false;
+    }
+    const handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW).catch(() => null);
+    if (!handle)
+        return false;
+    try {
+        const opened = await handle.stat({ bigint: true });
+        return opened.isFile()
+            && opened.nlink === 1n
+            && opened.dev === before.dev
+            && opened.ino === before.ino;
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function stillSameSingleLinkFile(filePath, identity) {
+    try {
+        const stats = await lstat(filePath, { bigint: true });
+        return !stats.isSymbolicLink()
+            && stats.isFile()
+            && stats.nlink === 1n
+            && stats.dev === identity.dev
+            && stats.ino === identity.ino;
+    }
+    catch {
+        return false;
+    }
+}
+async function isPhysicalDirectory(directory) {
+    try {
+        const stats = await lstat(directory);
+        return !stats.isSymbolicLink() && stats.isDirectory() && await realpath(directory) === directory;
+    }
+    catch {
+        return false;
+    }
+}
+async function isPhysicalDirectoryOrMissing(directory) {
+    try {
+        const stats = await lstat(directory);
+        return !stats.isSymbolicLink() && stats.isDirectory() && await realpath(directory) === directory;
+    }
+    catch (error) {
+        return isNodeError(error) && error.code === "ENOENT";
+    }
+}
+async function pathExists(filePath) {
+    try {
+        await lstat(filePath);
+        return true;
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+function unsafeInspection(worktreeRoot, note) {
+    return { note, status: "unsafe", worktreeRoot };
+}
+function isNodeError(error) {
+    return error instanceof Error && "code" in error;
+}
+//# sourceMappingURL=git-workspace.js.map

package/dist/core/git-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-workspace.js","sourceRoot":"","sources":["../../src/core/git-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,mCAAmC,GAAG,6CAA6C,CAAC;AACjG,MAAM,CAAC,MAAM,oCAAoC,GAAG,6CAA6C,CAAC;AAyBlG;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,QAAgB;IAChE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACzD,OAAO,gBAAgB,CAAC,OAAO,EAAE,mCAAmC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,mCAAmC,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,gBAAgB,CAAC,OAAO,EAAE,mCAAmC,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;YACjB,SAAS;QACX,CAAC;QAED,IAAI,WAAW,CAAC,cAAc,EAAE,EAAE,CAAC;YACjC,OAAO,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;oBAC9C,OAAO,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;gBACzE,CAAC;gBACD,sEAAsE;gBACtE,uEAAuE;gBACvE,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;oBACzD,OAAO,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;gBACzE,CAAC;gBACD,MAAM,eAAe,GAAa,EAAE,CAAC;gBACrC,MAAM,SAAS,GAAyB;oBACtC,SAAS,EAAE,UAAU;oBACrB,eAAe;oBACf,MAAM,EAAE,UAAU;oBAClB,IAAI,EAAE,WAAW;oBACjB,SAAS,EAAE,OAAO;oBAClB,YAAY,EAAE,OAAO;iBACtB,CAAC;gBACF,OAAO,MAAM,2BAA2B,CAAC,SAAS,CAAC;oBACjD,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,uBAAuB,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE;oBACxF,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,WAAW,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YACtD,OAAO,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,UAAU,CAAC,CAAC;YAC3D,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpE,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC/B,OAAO,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;gBAC7B,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAC1C,CAAC;YACF,IAAI,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,OAAO,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAClF,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjF,MAAM,iBAAiB,GAAG,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACjF,MAAM,mBAAmB,GAAG,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvF,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC7E,OAAO,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAC1E,IACE,CAAC,MAAM,mBAAmB,CAAC,SAAS,CAAC;mBAClC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,MAAM;mBACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;mBAC1D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EACrC,CAAC;gBACD,OAAO,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,mBAAmB,GAAG,MAAM,QAAQ,CACxC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBAClC,CAAC,CAAC,mBAAmB;gBACrB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAC9C,CAAC;YACF,IAAI,mBAAmB,KAAK,UAAU,EAAE,CAAC;gBACvC,OAAO,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,IACE,CAAC,MAAM,mBAAmB,CAAC,SAAS,CAAC;mBAClC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,SAAS;mBAC1D,CAAC,MAAM,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;mBAC3D,CAAC,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC;mBAClF,CAAC,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,EACpF,CAAC;gBACD,OAAO,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,eAAe,GAAa,EAAE,CAAC;YACrC,MAAM,SAAS,GAAyB;gBACtC,SAAS;gBACT,eAAe;gBACf,MAAM;gBACN,IAAI,EAAE,iBAAiB;gBACvB,SAAS;gBACT,YAAY,EAAE,OAAO;aACtB,CAAC;YACF,OAAO,MAAM,2BAA2B,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,uBAAuB,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE;gBACxF,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,SAA+B;IACxE,IACE,CAAC,MAAM,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC;WACzC,CAAC,MAAM,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC;WAC/C,CAAC,MAAM,mBAAmB,CAAC,SAAS,CAAC,YAAY,CAAC,EACrD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;KAC9C,CAAC,CAAC;IACH,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,gCAAgC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACtE,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI;QACtB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;KACvC,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACxF,IAAI,IAAI,IAAI,CAAC,MAAM,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IACvF,IAAI,CAAC,MAAM,gCAAgC,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACzE,IAAI,UAAU,IAAI,CAAC,MAAM,6BAA6B,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7F,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IACA,SAAS,CAAC,eAA4B,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,SAA+B;IAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC;KAC/C,CAAC,EAAE,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,IAAI,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,sEAAsE;gBACtE,kEAAkE;gBAClE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,YAAY,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,CAAC,YAAY;gBAAE,SAAS;YAC5B,MAAM,OAAO,GAAG,uFAAuF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnH,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,SAAS,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpE,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;;gBAC9D,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,SAAS,CAAC,IAAI,CACZ,UAAU,MAAM,SAAS,EACzB,UAAU,MAAM,UAAU,EAC1B,UAAU,MAAM,WAAW,EAC3B,UAAU,MAAM,iBAAiB,CAClC,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,QAAQ,MAAM,WAAW,EAAE,QAAQ,MAAM,YAAY,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAa;IAChD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,IAAI,OAAO,CAAC;QAClB,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAC9B,SAA+B,EAC/B,eAAyB;IAEzB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,SAA+B,EAAE,QAAgB;IACpF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,kCAAkC,CAC3C,SAAS,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAC/F,SAAS,CACV,EAAE,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,kCAAkC,CAAC,IAAY,EAAE,QAAgB;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;QACvD,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,OAAO,KAAK,CAAC;QACzC,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,OAAO,KAAK,CAAC;QACzC,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,SAAiB,EAAE,IAAY;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpF,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/E,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;WAC3B,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;WACrB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;WACrB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;WACrB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAgB,EAChB,YAAY,GAAG,KAAK;IAEpB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,YAAY,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IACE,CAAC,MAAM,CAAC,MAAM,EAAE;eACb,MAAM,CAAC,KAAK,KAAK,EAAE;eACnB,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;eACzB,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAC5B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;YAC7D,IAAI;SACL,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,QAAgB;IAC9D,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACjG,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,EAAE;eACjB,MAAM,CAAC,KAAK,KAAK,EAAE;eACnB,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;eACzB,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAgB,EAAE,QAAsB;IAC7E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE;eACzB,KAAK,CAAC,MAAM,EAAE;eACd,KAAK,CAAC,KAAK,KAAK,EAAE;eAClB,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;eAC1B,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IAClD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,SAAiB;IAC3D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;IACnG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;IACvD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,YAAoB,EACpB,IAA8F;IAE9F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;AACnD,CAAC"}

package/dist/cua-actor-lab.d.ts

@@ -8,6 +8,7 @@ import { type DetachedTimers } from "./e2b-detached.js";
 import { type DevicePreset } from "./device-presets.js";
 import { type LabActorLane, type LabConfig, type LabDesktopBrowser, type LabSubjectServe, type LabSubjectState } from "./lab-config.js";
 import { renderObserver, type ObserverResult } from "./observer.js";
+import { type PreparedOutputDirectory } from "./selected-output-paths.js";
 import { type LocalTreeArchive } from "./source-archive.js";
 import type { StopWhen } from "./stop-conditions.js";
 import { type RunBundle, type RunRerunLineage, type RunProviderResource, type RunSubjectProvenance, type RunSubjectStateStepRecord } from "./run.js";
@@ -395,7 +396,7 @@ export interface CuaLaneDeps {
     perLaneSandboxMs: number;
     timeoutMs: number;
     laneCount: number;
-    artifactRoot: string;
+    artifactRoot: PreparedOutputDirectory;
     redactScreenshots: boolean;
     scrubKnownValues: (text: string) => string;
     runSession: (options: CuaActorSessionOptions) => Promise<CuaLoopResult>;
@@ -430,7 +431,7 @@ export interface LaneRunOutcome {
 /** Build a lane's writeScreenshot closure: writes under screenshots/<screenshotDir>/ and records
  *  the relative path the trace references (screenshots/<name> at N=1; screenshots/<laneId>/<name>
  *  at N>1). */
-export declare function makeLaneWriteScreenshot(artifactRoot: string, spec: {
+export declare function makeLaneWriteScreenshot(artifactRoot: PreparedOutputDirectory, spec: {
     screenshotDir: string;
 }, screenshots: string[]): (name: string, bytes: Buffer) => Promise<string>;
 /**

package/dist/cua-actor-lab.js

@@ -21,7 +21,7 @@
 //   conformant humanish.actor-trace.v1 projection, whose `redaction.screenshots` records the
 //   run's actual mode ("raw" | "blurred" | "n/a") — every label downstream derives from it.
 import { randomBytes } from "node:crypto";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { readFile, realpath, rm } from "node:fs/promises";
 import path from "node:path";
 import { runDesktopCommandOrThrow, toErrorMessage } from "./command-failure.js";
 import { pathToFileURL } from "node:url";
@@ -37,6 +37,8 @@ import { assertScreenshotEvidence } from "./image-evidence.js";
 import { buildObserverData } from "./observer-data.js";
 import { attachObserverRuntimeStreamUrls, renderObserver } from "./observer.js";
 import { containsSensitive, digestText, redactedTail, redactText } from "./redaction.js";
+import { assertPreparedSelectedOutputDirectory, assertSafeOutputPathSegment, prepareContainedOutputDirectory, prepareSelectedOutputDirectory, writeContainedOutputFile, writePreparedRunLatestPointer } from "./selected-output-paths.js";
+import { prepareRunArtifactPaths, validatePreparedRunArtifactPaths } from "./run-paths.js";
 import { createLocalTreeArchive } from "./source-archive.js";
 import { buildRunSource, loadRunBundle, PUBLIC_TARGET_CWD, REVIEW_SCHEMA, RUN_BUNDLE_SCHEMA } from "./run.js";
 export const CUA_ACTOR_LAB_SCHEMA = "humanish.cua-lab-result.v2";
@@ -386,13 +388,16 @@ function phaseEventIdSuffix(type) {
  *  the relative path the trace references (screenshots/<name> at N=1; screenshots/<laneId>/<name>
  *  at N>1). */
 export function makeLaneWriteScreenshot(artifactRoot, spec, screenshots) {
+    if (spec.screenshotDir) {
+        assertSafeOutputPathSegment(spec.screenshotDir, "Screenshot lane id");
+    }
     const dirParts = spec.screenshotDir ? ["screenshots", spec.screenshotDir] : ["screenshots"];
     const relPrefix = spec.screenshotDir ? path.posix.join("screenshots", spec.screenshotDir) : "screenshots";
     return async (name, bytes) => {
+        assertSafeOutputPathSegment(name, "Screenshot name");
         const rel = path.posix.join(relPrefix, name);
         assertScreenshotEvidence(rel, bytes);
-        await mkdir(path.join(artifactRoot, ...dirParts), { recursive: true });
-        await writeFile(path.join(artifactRoot, ...dirParts, name), bytes);
+        await writeContainedOutputFile(artifactRoot, path.join(...dirParts, name), bytes);
         screenshots.push(rel);
         return rel;
     };
@@ -881,8 +886,7 @@ export async function runCuaLane(spec, deps) {
         }
     }
     if (session) {
-        await mkdir(path.dirname(path.join(deps.artifactRoot, spec.traceArtifactPath)), { recursive: true });
-        await writeFile(path.join(deps.artifactRoot, spec.traceArtifactPath), `${JSON.stringify(session.trace, null, 2)}\n`, "utf8");
+        await writeContainedOutputFile(deps.artifactRoot, spec.traceArtifactPath, `${JSON.stringify(session.trace, null, 2)}\n`, "utf8");
         if (session.trace.redaction.screenshots === "raw") {
             warnings.push("Screenshots are full-fidelity (raw) for local use — the bundle stays in gitignored .humanish and nothing scans these pixels; review them before sharing anywhere. Set policies.redactScreenshots: true to blur a share-as-is bundle.");
         }
@@ -949,8 +953,7 @@ async function runInProcessLane(spec, deps) {
         sessionError = redactText(deps.scrubKnownValues(toErrorMessage(error)));
     }
     if (session) {
-        await mkdir(path.dirname(path.join(deps.artifactRoot, spec.traceArtifactPath)), { recursive: true });
-        await writeFile(path.join(deps.artifactRoot, spec.traceArtifactPath), `${JSON.stringify(session.trace, null, 2)}\n`, "utf8");
+        await writeContainedOutputFile(deps.artifactRoot, spec.traceArtifactPath, `${JSON.stringify(session.trace, null, 2)}\n`, "utf8");
         if (session.trace.redaction.screenshots === "raw") {
             warnings.push("Screenshots are full-fidelity (raw) for local use — the bundle stays in gitignored .humanish and nothing scans these pixels; review them before sharing anywhere. Set policies.redactScreenshots: true to blur a share-as-is bundle.");
         }
@@ -1180,7 +1183,12 @@ function subjectProvenanceArg(subject, publicRepo, subjectEnvNames) {
 }
 export async function runCuaActorLab(options) {
     const { config, dryRun } = options;
-    const cwd = path.resolve(options.cwd);
+    // Capture the physical project before reading or invoking any caller hook. A supported
+    // symlink cwd remains valid, but retargeting that alias from a hook cannot redirect source
+    // reads, local-tree packing, managed run storage, or Observer output into another project.
+    const physicalCwd = await realpath(path.resolve(options.cwd));
+    const projectRoot = await prepareSelectedOutputDirectory(path.dirname(physicalCwd), physicalCwd);
+    const cwd = projectRoot.physicalPath;
     const hooks = options.hooks ?? {};
     let liveObserver;
     const runtimeStreamUrls = [];
@@ -1320,6 +1328,7 @@ export async function runCuaActorLab(options) {
         emitPreflightPlan(plan, config.id);
     }
     hooks.onPreflight?.(plan);
+    await assertPreparedSelectedOutputDirectory(projectRoot);
     // Read keys once into locals (names only; values never logged or persisted).
     const openaiApiKey = env.OPENAI_API_KEY?.trim() ?? "";
     const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
@@ -1348,12 +1357,14 @@ export async function runCuaActorLab(options) {
         }
     }
     const runId = options.runId ?? makeCuaRunId();
-    const artifactRoot = path.join(cwd, ".humanish", "runs", runId);
+    const runPaths = await prepareRunArtifactPaths(cwd, runId);
+    const artifactRoot = runPaths.absoluteRunRoot;
+    const physicalArtifactRoot = runPaths.physicalRunRoot;
     const createdAt = new Date().toISOString();
     const timeoutMs = config.execution?.timeoutMs ?? DEFAULT_SESSION_TIMEOUT_MS;
     const requestTimeoutMs = readPositiveInt(env.HUMANISH_E2B_REQUEST_TIMEOUT_MS, 60_000);
     const redactScreenshots = config.policies?.redactScreenshots === true;
-    await mkdir(path.join(artifactRoot, "screenshots"), { recursive: true });
+    await prepareContainedOutputDirectory(runPaths, "screenshots");
     const source = await buildRunSource({
         capturedAt: createdAt,
         cwd,
@@ -1404,7 +1415,7 @@ export async function runCuaActorLab(options) {
         perLaneSandboxMs: resolvePerLaneSandboxMs(config),
         timeoutMs,
         laneCount,
-        artifactRoot,
+        artifactRoot: runPaths,
         redactScreenshots,
         scrubKnownValues,
         runSession,
@@ -1461,7 +1472,7 @@ export async function runCuaActorLab(options) {
                 subjectEnvNames,
                 inProgress: true
             });
-        await writeCuaRunArtifacts(cwd, artifactRoot, inProgressBundle, createdAt);
+        await writeCuaRunArtifacts(inProgressBundle, createdAt, runPaths);
         liveObserver = observerResultForCuaArtifacts(cwd, runId, artifactRoot, [
             "Live CUA Observer is attached before final verification; stream auth URLs are runtime-only and are not persisted."
         ]);
@@ -1570,7 +1581,7 @@ export async function runCuaActorLab(options) {
         bundle,
         context: {
             bundle,
-            runDir: artifactRoot,
+            runDir: physicalArtifactRoot,
             labId: config.id,
             runId,
             actor: descriptor.id,
@@ -1582,7 +1593,7 @@ export async function runCuaActorLab(options) {
         warnings: adapterWarnings,
         hookLabel: "cuaHooks"
     });
-    await writeCuaRunArtifacts(cwd, artifactRoot, bundle, createdAt);
+    await writeCuaRunArtifacts(bundle, createdAt, runPaths);
     const observer = await render(cwd, runId, { open: options.open === true });
     if (observer.ok && runtimeStreamUrls.length > 0) {
         attachObserverRuntimeStreamUrls(observer, runtimeStreamUrls);
@@ -1705,21 +1716,21 @@ function buildLaneSummary(outcomes, laneCount, plan, dryRun) {
         waves: plan.waves
     };
 }
-async function writeCuaRunArtifacts(cwd, artifactRoot, bundle, updatedAt) {
+async function writeCuaRunArtifacts(bundle, updatedAt, preparedRunPaths) {
+    const runPaths = await validatePreparedRunArtifactPaths(preparedRunPaths);
     const publicBundle = {
         ...bundle,
         cwd: PUBLIC_TARGET_CWD
     };
-    await writeFile(path.join(artifactRoot, "run.json"), `${JSON.stringify(publicBundle, null, 2)}\n`, "utf8");
-    await writeFile(path.join(artifactRoot, "review.json"), `${JSON.stringify(publicBundle.review, null, 2)}\n`, "utf8");
-    await writeFile(path.join(artifactRoot, "review.md"), renderCuaReviewMarkdown(publicBundle), "utf8");
-    await writeFile(path.join(artifactRoot, "events.ndjson"), `${publicBundle.events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
-    await mkdir(path.join(artifactRoot, "observer"), { recursive: true });
-    await writeFile(path.join(artifactRoot, "observer", "observer-data.json"), `${JSON.stringify(buildObserverData(publicBundle), null, 2)}\n`, "utf8");
-    await writeFile(path.join(cwd, ".humanish", "runs", "latest.json"), `${JSON.stringify({
+    await writeContainedOutputFile(runPaths, "run.json", `${JSON.stringify(publicBundle, null, 2)}\n`, "utf8");
+    await writeContainedOutputFile(runPaths, "review.json", `${JSON.stringify(publicBundle.review, null, 2)}\n`, "utf8");
+    await writeContainedOutputFile(runPaths, "review.md", renderCuaReviewMarkdown(publicBundle), "utf8");
+    await writeContainedOutputFile(runPaths, "events.ndjson", `${publicBundle.events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
+    await writeContainedOutputFile(runPaths, "observer/observer-data.json", `${JSON.stringify(buildObserverData(publicBundle), null, 2)}\n`, "utf8");
+    await writePreparedRunLatestPointer(runPaths, `${JSON.stringify({
         schema: "humanish.latest-run.v1",
         runId: publicBundle.runId,
-        path: path.join(".humanish", "runs", publicBundle.runId),
+        path: runPaths.relativeRunRoot,
         updatedAt
     }, null, 2)}\n`, "utf8");
 }