instar 1.3.646 → 1.3.648

package/dist/core/hostSpawnSemaphore.js

@@ -0,0 +1,471 @@
+/**
+ * hostSpawnSemaphore — P1 of the SIMPLE fork-bomb prevention design.
+ *
+ * Spec: docs/specs/forkbomb-prevention-simple.md (§P1, §P3, §D-CAP).
+ * Source postmortem: the-portal/docs/postmortems/2026-06-20-echo-instar-forkbomb-oom.md.
+ *
+ * THE PRIMARY CONTROL. A single host-local COUNTING SEMAPHORE that bounds how
+ * many LLM subprocesses ("claude -p" / "codex exec" / …) run AT ONCE across
+ * EVERY compliant Instar agent + server instance on this host. The 2026-06-20
+ * incident fork-bombed a 128GB macOS host into OOM twice (~230-289 concurrent
+ * `claude -p` ≈ 90-115GB) because `evaluate()` spawned one subprocess per call
+ * with ZERO concurrency control and CoherenceGate fans ~10 reviewers in
+ * parallel per message. This bounds that.
+ *
+ * MECHANISM — a holder-SET model (NOT decrement/increment counter math):
+ *   A host-local file (`~/.instar/host-spawn-holders.json`, NOT a synced
+ *   volume), guarded by an exclusive O_CREAT|O_EXCL lock (the in-tree
+ *   ProjectRoundLock pattern). The cap is enforced by COUNTING LIVE holder
+ *   records — never by mutating a shared integer:
+ *     - acquire(id): under the lock, prune dead holders, and if
+ *       liveHolders < cap append `{id, pid, hostname, heartbeat}` (atomic
+ *       temp+rename) → true; else false.
+ *     - release(id): under the lock, remove THIS id.
+ *   Crash-safe by construction: a double-release is a no-op (id already gone),
+ *   a pid-reuse can't steal a slot (unique id, not pid), a partial write is
+ *   discarded (temp+rename), a crashed holder is reclaimed by prune-dead
+ *   (pid not alive AND heartbeat stale, on THIS host only).
+ *
+ * HOST-LOCAL-LOCK CONTRACT (mirrors ResumeQueue.ts, the 2026-06-15 lesson):
+ *   - A FOREIGN-hostname holder is NEVER pruned/reclaimed (refuse-loud — a
+ *     pid check is meaningless cross-host on a shared volume).
+ *   - A `df -P` host-local-disk confirmation gates reclaim (fail-closed: if we
+ *     cannot positively confirm the holders file is on a local disk, we NEVER
+ *     prune a holder — we only ever decline to reclaim, never decline to bound).
+ *
+ * BOUNDED INGRESS (P3) lives in the wrapper (SpawnCapIntelligenceProvider) via
+ * poll-retry against `acquire()` — this module is the pure counting primitive.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { SafeFsExecutor } from './SafeFsExecutor.js';
+import { isAlive } from './ProjectRoundLock.js';
+/** Heartbeat staleness window — a holder is reclaim-eligible (pid dead OR, on a
+ * provably host-local disk, heartbeat older than this) only past it. Kept long
+ * (a slow `claude -p` cold-start + run can legitimately exceed a minute), and
+ * pid-liveness is the PRIMARY signal — heartbeat staleness is secondary and
+ * only consulted when the pid is also gone. */
+export const HOLDER_STALE_MS = 5 * 60_000;
+/**
+ * FD1 (from ResumeQueue) — is `p` on a HOST-LOCAL filesystem? FAIL-CLOSED:
+ * anything we cannot positively confirm as local returns false, so a holder on
+ * a genuine shared/network volume is NEVER reclaimed (the two-hosts-one-volume
+ * corruption the host-lock invariant protects against). `df -P` device-column
+ * classification — re-implemented here (not imported from monitoring/) so
+ * core/ never depends on monitoring/.
+ */
+export function isPathHostLocalDefault(p) {
+    let out;
+    try {
+        // lint-allow-sync-spawn: a bounded (3s) one-shot host-FS classification, run
+        // ONCE per process and then MEMOIZED (HostSpawnSemaphore._fsLocalCache) — it
+        // never runs on the hot acquire() fan-out path. Mirrors ResumeQueue's
+        // isStateDirHostLocalDefault host-lock contract; a path's FS type can't
+        // change at runtime, so there is nothing to re-probe.
+        out = execFileSync('df', ['-P', p], { timeout: 3000, encoding: 'utf-8' });
+    }
+    catch {
+        // @silent-fallback-ok: df unavailable/failed ⇒ cannot confirm local ⇒
+        // fail-closed to NOT-local (the safe direction: never reclaim on doubt).
+        return false;
+    }
+    const lines = out.trim().split('\n');
+    if (lines.length < 2)
+        return false; // unparseable → fail-closed
+    const source = lines[1]?.trim().split(/\s+/)[0] ?? '';
+    return classifyDfSourceLocal(source);
+}
+/** Pure FD1 classifier over the `df -P` device-source column. FAIL-CLOSED. */
+export function classifyDfSourceLocal(source) {
+    if (!source)
+        return false;
+    if (source.startsWith('//'))
+        return false; // SMB/CIFS //host/share → network
+    if (/^[^/][^:]*:/.test(source))
+        return false; // NFS host:/path → network
+    if (source.startsWith('/dev/'))
+        return true; // a real block device → local
+    return false; // map/tmpfs/anything unrecognized → fail-closed
+}
+/**
+ * Resolve the concurrent-spawn cap. Precedence (D-CAP):
+ *   INSTAR_HOST_SPAWN_MAX env  >  config intelligence.spawnCap.maxConcurrent  >  8.
+ * A safety FLOOR — read with a plain `??` default, NEVER resolveDevAgentGate
+ * (it is ON by default, ships never-dark). A non-positive / non-finite value
+ * is ignored (falls through to the next source) so a typo can't disable the cap.
+ */
+export function resolveSpawnCap(configCap, env = process.env) {
+    const fromEnv = env['INSTAR_HOST_SPAWN_MAX'];
+    if (fromEnv !== undefined) {
+        const n = Number(fromEnv);
+        if (Number.isFinite(n) && n > 0)
+            return Math.floor(n);
+    }
+    if (typeof configCap === 'number' && Number.isFinite(configCap) && configCap > 0) {
+        return Math.floor(configCap);
+    }
+    return 8;
+}
+/**
+ * Resolve the bounded-acquire poll budget in ms (P3). Precedence (D-CAP):
+ *   INSTAR_SPAWN_ACQUIRE_MS env  >  config intelligence.spawnCap.acquireMs  >  5000.
+ * Read with a plain `??` default (safety floor, never resolveDevAgentGate).
+ */
+export function resolveSpawnAcquireMs(configMs, env = process.env) {
+    const fromEnv = env['INSTAR_SPAWN_ACQUIRE_MS'];
+    if (fromEnv !== undefined) {
+        const n = Number(fromEnv);
+        if (Number.isFinite(n) && n >= 0)
+            return Math.floor(n);
+    }
+    if (typeof configMs === 'number' && Number.isFinite(configMs) && configMs >= 0) {
+        return Math.floor(configMs);
+    }
+    return 5000;
+}
+/**
+ * Resolve the concurrent-pollers ceiling (P3). Precedence (D-CAP):
+ *   INSTAR_SPAWN_WAITERS_MAX env  >  config intelligence.spawnCap.waitersMax  >  64.
+ */
+export function resolveSpawnWaitersMax(configMax, env = process.env) {
+    const fromEnv = env['INSTAR_SPAWN_WAITERS_MAX'];
+    if (fromEnv !== undefined) {
+        const n = Number(fromEnv);
+        if (Number.isFinite(n) && n > 0)
+            return Math.floor(n);
+    }
+    if (typeof configMax === 'number' && Number.isFinite(configMax) && configMax > 0) {
+        return Math.floor(configMax);
+    }
+    return 64;
+}
+/**
+ * Host-wide counting semaphore over LLM-subprocess spawns. One instance per
+ * process is fine — the cross-process coordination is the file + flock, not
+ * the object. Stateless beyond the file.
+ */
+export class HostSpawnSemaphore {
+    holdersPath;
+    cap;
+    now;
+    host;
+    pidAlive;
+    isPathHostLocal;
+    genId;
+    /** Memoized host-local determination (a fixed path's FS type can't change at
+     * runtime; the `df -P` probe is expensive + synchronous, so it runs ONCE per
+     * instance — never per acquire() on the hot fan-out path). */
+    _fsLocalCache;
+    constructor(deps = {}) {
+        this.holdersPath = deps.holdersPath ?? defaultHoldersPath();
+        this.cap = deps.cap ?? resolveSpawnCap();
+        this.now = deps.now ?? (() => Date.now());
+        this.host = (deps.hostname ?? (() => os.hostname()))();
+        this.pidAlive = deps.pidAlive ?? isAlive;
+        this.isPathHostLocal = deps.isPathHostLocal ?? isPathHostLocalDefault;
+        this.genId =
+            deps.genId ??
+                (() => `${this.host}:${process.pid}:${this.now().toString(36)}:${Math.random().toString(36).slice(2, 10)}`);
+    }
+    getCap() {
+        return this.cap;
+    }
+    /**
+     * Try to take a slot under id `id`. Returns true if a slot was appended
+     * (liveHolders < cap after pruning), false if the host is at the cap.
+     * Holds the exclusive flock for the whole read-prune-decide-write window.
+     */
+    acquire(id) {
+        return this.withLock(() => {
+            const file = this.readHolders();
+            const live = this.pruneDead(file.holders);
+            if (live.length >= this.cap) {
+                // At the cap — write back the pruned set (cheap GC) but take no slot.
+                this.writeHolders({ version: 1, holders: live });
+                return false;
+            }
+            // Crash-safe: an id already present (a retry that already landed) is a
+            // no-op-append, not a duplicate slot.
+            if (!live.some((h) => h.id === id)) {
+                live.push({ id, pid: process.pid, hostname: this.host, heartbeat: this.now() });
+            }
+            this.writeHolders({ version: 1, holders: live });
+            return true;
+        }, /* fallbackOnLockFail */ false);
+    }
+    /** Release the slot held under `id`. A double-release / unknown id is a no-op. */
+    release(id) {
+        this.withLock(() => {
+            const file = this.readHolders();
+            const remaining = file.holders.filter((h) => h.id !== id);
+            // Opportunistically GC dead holders on release too (cheap, keeps the file small).
+            const live = this.pruneDead(remaining);
+            this.writeHolders({ version: 1, holders: live });
+            return undefined;
+        }, /* fallbackOnLockFail */ undefined);
+    }
+    /** Refresh a long-held slot's heartbeat so a slow legit spawn is never reclaimed. */
+    heartbeat(id) {
+        this.withLock(() => {
+            const file = this.readHolders();
+            let changed = false;
+            for (const h of file.holders) {
+                if (h.id === id) {
+                    h.heartbeat = this.now();
+                    changed = true;
+                }
+            }
+            if (changed)
+                this.writeHolders(file);
+            return undefined;
+        }, /* fallbackOnLockFail */ undefined);
+    }
+    /** Read-only status (count of live holders after a prune). Best-effort: never throws. */
+    status() {
+        let live = [];
+        try {
+            live = this.withLock(() => {
+                const file = this.readHolders();
+                const pruned = this.pruneDead(file.holders);
+                this.writeHolders({ version: 1, holders: pruned });
+                return pruned;
+            }, /* fallbackOnLockFail */ this.readHolders().holders);
+        }
+        catch {
+            // @silent-fallback-ok: status is observability — a read error reports
+            // zero holders rather than throwing into the /spawn-limiter route.
+            live = [];
+        }
+        const localHolders = live.filter((h) => h.hostname === this.host).length;
+        return {
+            cap: this.cap,
+            liveHolders: live.length,
+            localHolders,
+            foreignHolders: live.length - localHolders,
+            holdersPath: this.holdersPath,
+        };
+    }
+    // ── Internals ─────────────────────────────────────────────────────
+    /**
+     * Prune dead holders. A holder is reclaimable ONLY if:
+     *   - it is on THIS host (a foreign-hostname holder is NEVER reclaimed —
+     *     refuse-loud — the cross-host shared-volume hazard), AND
+     *   - its pid is no longer alive (PRIMARY signal), AND
+     *   - its heartbeat is stale past HOLDER_STALE_MS (SECONDARY signal — a slow
+     *     spawn whose pid is alive is NEVER reclaimed regardless of heartbeat).
+     * AND a `df -P` host-local confirmation gates ALL reclaim (fail-closed: if we
+     * cannot confirm the holders file is on a local disk, we keep ALL holders —
+     * over-counting is the safe direction for a cap; it never under-bounds).
+     */
+    pruneDead(holders) {
+        if (this._fsLocalCache === undefined) {
+            this._fsLocalCache = this.isPathHostLocal(path.dirname(this.holdersPath));
+        }
+        const fsLocal = this._fsLocalCache;
+        if (!fsLocal) {
+            // Cannot confirm host-local → reclaim NOTHING (fail-closed). Still return
+            // the well-formed set so the file stays clean.
+            return holders.filter((h) => isWellFormedHolder(h));
+        }
+        const nowMs = this.now();
+        return holders.filter((h) => {
+            if (!isWellFormedHolder(h))
+                return false; // drop garbage rows
+            if (h.hostname !== this.host)
+                return true; // foreign — NEVER reclaimed (keep)
+            const pidDead = !this.pidAlive(h.pid);
+            const heartbeatStale = nowMs - h.heartbeat >= HOLDER_STALE_MS;
+            // Reclaim only when BOTH dead AND stale (pid primary, heartbeat secondary).
+            const reclaim = pidDead && heartbeatStale;
+            return !reclaim;
+        });
+    }
+    readHolders() {
+        try {
+            const raw = fs.readFileSync(this.holdersPath, 'utf-8');
+            const obj = JSON.parse(raw);
+            if (!obj || typeof obj !== 'object' || !Array.isArray(obj.holders)) {
+                return { version: 1, holders: [] };
+            }
+            return { version: 1, holders: obj.holders.filter(isWellFormedHolder) };
+        }
+        catch {
+            // @silent-fallback-ok: a missing/corrupt holders file is an EMPTY set —
+            // the safe direction is to bound from zero, never to crash the spawn path.
+            return { version: 1, holders: [] };
+        }
+    }
+    writeHolders(file) {
+        this.ensureDir();
+        const body = JSON.stringify(file);
+        const tmp = `${this.holdersPath}.tmp.${process.pid}.${Math.random().toString(36).slice(2, 8)}`;
+        try {
+            const fd = fs.openSync(tmp, 'wx', 0o600);
+            fs.writeSync(fd, body);
+            fs.closeSync(fd);
+            fs.renameSync(tmp, this.holdersPath); // atomic on the same filesystem
+        }
+        catch (err) {
+            try {
+                SafeFsExecutor.safeUnlinkSync(tmp, { operation: 'HostSpawnSemaphore.writeHolders:cleanup-tmp' });
+            }
+            catch {
+                /* ignore */
+            }
+            throw err;
+        }
+    }
+    /**
+     * Run `fn` while holding the exclusive O_CREAT|O_EXCL lock on `<holdersPath>.lock`.
+     * On a lock-contention failure (another process holds it), returns
+     * `fallbackOnLockFail` — for `acquire`, fallback=false is the SAFE direction
+     * (refuse the slot under contention rather than over-grant past the cap).
+     * The lock is short-held (a file read + JSON parse + write) so contention is
+     * brief; a crashed lock-holder's stale lock is reclaimed by pid-death.
+     */
+    withLock(fn, fallbackOnLockFail) {
+        this.ensureDir();
+        const lockPath = `${this.holdersPath}.lock`;
+        const deadline = this.now() + 2000; // bounded spin — never block the event loop forever
+        // Spin-acquire the lock with a tiny busy-wait; the critical section is sub-ms.
+        for (;;) {
+            let fd = null;
+            try {
+                fd = fs.openSync(lockPath, 'wx', 0o600); // O_CREAT|O_EXCL
+                fs.writeSync(fd, JSON.stringify({ pid: process.pid, at: this.now() }));
+            }
+            catch (err) {
+                const e = err;
+                if (e.code === 'EEXIST') {
+                    // Lock held. Reclaim it if its holder's pid is dead (crash-safe).
+                    if (this.reclaimStaleLock(lockPath))
+                        continue;
+                    if (this.now() >= deadline)
+                        return fallbackOnLockFail; // give up safely
+                    busyWaitTiny();
+                    continue;
+                }
+                // Any other open error — fail to the safe fallback rather than throw.
+                if (fd !== null) {
+                    try {
+                        fs.closeSync(fd);
+                    }
+                    catch { /* ignore */ }
+                }
+                return fallbackOnLockFail;
+            }
+            try {
+                return fn();
+            }
+            finally {
+                try {
+                    fs.closeSync(fd);
+                }
+                catch { /* @silent-fallback-ok: closing an already-closed/invalid fd on lock-release is benign */ }
+                try {
+                    SafeFsExecutor.safeUnlinkSync(lockPath, { operation: 'HostSpawnSemaphore.withLock:release' });
+                }
+                catch {
+                    /* @silent-fallback-ok: a missing lock on release is fine — release is idempotent */
+                }
+            }
+        }
+    }
+    /** Remove the lock file if its recorded holder pid is dead (crash recovery). */
+    reclaimStaleLock(lockPath) {
+        try {
+            const raw = fs.readFileSync(lockPath, 'utf-8');
+            const obj = JSON.parse(raw);
+            const pid = typeof obj?.pid === 'number' ? obj.pid : null;
+            if (pid !== null && this.pidAlive(pid))
+                return false; // live holder — wait
+            // Dead (or unparseable) lock holder — reclaim.
+            SafeFsExecutor.safeUnlinkSync(lockPath, { operation: 'HostSpawnSemaphore.reclaimStaleLock' });
+            return true;
+        }
+        catch {
+            // @silent-fallback-ok: a read/parse failure on the lock means we couldn't
+            // confirm a live holder; treat as reclaimable so a corrupt lock can't wedge
+            // the cap permanently. The O_EXCL re-create still races safely.
+            try {
+                SafeFsExecutor.safeUnlinkSync(lockPath, { operation: 'HostSpawnSemaphore.reclaimStaleLock:corrupt' });
+                return true;
+            }
+            catch {
+                // @silent-fallback-ok: couldn't remove the corrupt lock (a race with
+                // another reclaimer) — report not-reclaimed; the caller waits + retries.
+                return false;
+            }
+        }
+    }
+    ensureDir() {
+        const dir = path.dirname(this.holdersPath);
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true });
+    }
+}
+/** Default holders file path: `~/.instar/host-spawn-holders.json` (host-local). */
+export function defaultHoldersPath() {
+    return path.join(os.homedir(), '.instar', 'host-spawn-holders.json');
+}
+function isWellFormedHolder(h) {
+    if (!h || typeof h !== 'object')
+        return false;
+    const r = h;
+    return (typeof r.id === 'string' &&
+        typeof r.pid === 'number' &&
+        typeof r.hostname === 'string' &&
+        typeof r.heartbeat === 'number');
+}
+/** A sub-millisecond busy-wait so the spin-lock doesn't peg a core. */
+function busyWaitTiny() {
+    const end = Date.now() + 1;
+    while (Date.now() < end) {
+        /* spin ~1ms */
+    }
+}
+// ── Process-wide singleton ────────────────────────────────────────────
+//
+// The cross-process coordination is the FILE; this singleton just avoids
+// re-resolving deps per call within one process. Config-cap is injected once
+// at boot via `configureHostSpawnSemaphore`; absent that, the env/8 default holds.
+let _singleton = null;
+let _configuredCap;
+let _configuredAcquireMs;
+let _configuredWaitersMax;
+/**
+ * Inject the config-resolved spawn-cap knobs once at server boot (server.ts).
+ * Idempotent: re-resolves the singleton so a later getter sees the configured
+ * cap. The env vars still win inside the `resolve*` helpers.
+ */
+export function configureHostSpawnSemaphore(cfg) {
+    _configuredCap = cfg?.maxConcurrent;
+    _configuredAcquireMs = cfg?.acquireMs;
+    _configuredWaitersMax = cfg?.waitersMax;
+    _singleton = new HostSpawnSemaphore({ cap: resolveSpawnCap(_configuredCap) });
+}
+/** The process-wide semaphore. Lazily constructed with env/config/8 cap. */
+export function getHostSpawnSemaphore() {
+    if (!_singleton) {
+        _singleton = new HostSpawnSemaphore({ cap: resolveSpawnCap(_configuredCap) });
+    }
+    return _singleton;
+}
+/** Config-aware acquire-budget resolver (env > injected config > 5000). */
+export function configuredSpawnAcquireMs() {
+    return resolveSpawnAcquireMs(_configuredAcquireMs);
+}
+/** Config-aware waiters-ceiling resolver (env > injected config > 64). */
+export function configuredSpawnWaitersMax() {
+    return resolveSpawnWaitersMax(_configuredWaitersMax);
+}
+/** Test seam — reset the singleton + injected config. */
+export function _resetHostSpawnSemaphoreForTest() {
+    _singleton = null;
+    _configuredCap = undefined;
+    _configuredAcquireMs = undefined;
+    _configuredWaitersMax = undefined;
+}
+//# sourceMappingURL=hostSpawnSemaphore.js.map

package/dist/core/hostSpawnSemaphore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostSpawnSemaphore.js","sourceRoot":"","sources":["../../src/core/hostSpawnSemaphore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAiBhD;;;;+CAI+C;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAS;IAC9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,6EAA6E;QAC7E,6EAA6E;QAC7E,sEAAsE;QACtE,wEAAwE;QACxE,sDAAsD;QACtD,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,yEAAyE;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,4BAA4B;IAChE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,kCAAkC;IAC7E,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,2BAA2B;IACzE,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,8BAA8B;IAC3E,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAiBD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,SAAkB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACtF,MAAM,OAAO,GAAG,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC3F,MAAM,OAAO,GAAG,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAkB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC7F,MAAM,OAAO,GAAG,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAaD;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACZ,WAAW,CAAS;IACpB,GAAG,CAAS;IACZ,GAAG,CAAe;IAClB,IAAI,CAAS;IACb,QAAQ,CAA2B;IACnC,eAAe,CAAyB;IACxC,KAAK,CAAe;IACrC;;kEAE8D;IACtD,aAAa,CAAsB;IAE3C,YAAY,OAA+B,EAAE;QAC3C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,sBAAsB,CAAC;QACtE,IAAI,CAAC,KAAK;YACR,IAAI,CAAC,KAAK;gBACV,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,sEAAsE;gBACtE,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,uEAAuE;YACvE,sCAAsC;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC,EAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,kFAAkF;IAClF,OAAO,CAAC,EAAU;QAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;YACjB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,kFAAkF;YAClF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,SAAS,CAAC;QACnB,CAAC,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,qFAAqF;IACrF,SAAS,CAAC,EAAU;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;YACjB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAChC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;oBAChB,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBACzB,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,IAAI,OAAO;gBAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,yFAAyF;IACzF,MAAM;QACJ,IAAI,IAAI,GAAkB,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;gBACxB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAChC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5C,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBACnD,OAAO,MAAM,CAAC;YAChB,CAAC,EAAE,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,mEAAmE;YACnE,IAAI,GAAG,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACzE,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,YAAY;YACZ,cAAc,EAAE,IAAI,CAAC,MAAM,GAAG,YAAY;YAC1C,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;IACJ,CAAC;IAED,qEAAqE;IAErE;;;;;;;;;;OAUG;IACK,SAAS,CAAC,OAAsB;QACtC,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,0EAA0E;YAC1E,+CAA+C;YAC/C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1B,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,oBAAoB;YAC9D,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC,CAAC,mCAAmC;YAC9E,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,cAAc,GAAG,KAAK,GAAG,CAAC,CAAC,SAAS,IAAI,eAAe,CAAC;YAC9D,4EAA4E;YAC5E,MAAM,OAAO,GAAG,OAAO,IAAI,cAAc,CAAC;YAC1C,OAAO,CAAC,OAAO,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACrC,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,2EAA2E;YAC3E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,IAAiB;QACpC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/F,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACvB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACjB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,gCAAgC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,cAAc,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,6CAA6C,EAAE,CAAC,CAAC;YACnG,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,QAAQ,CAAI,EAAW,EAAE,kBAAqB;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,WAAW,OAAO,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oDAAoD;QACxF,+EAA+E;QAC/E,SAAS,CAAC;YACR,IAAI,EAAE,GAAkB,IAAI,CAAC;YAC7B,IAAI,CAAC;gBACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,iBAAiB;gBAC1D,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,GAA4B,CAAC;gBACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACxB,kEAAkE;oBAClE,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;wBAAE,SAAS;oBAC9C,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;wBAAE,OAAO,kBAAkB,CAAC,CAAC,iBAAiB;oBACxE,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,sEAAsE;gBACtE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;oBAChB,IAAI,CAAC;wBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAClD,CAAC;gBACD,OAAO,kBAAkB,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,EAAE,EAAE,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,yFAAyF,CAAC,CAAC;gBAC7H,IAAI,CAAC;oBACH,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,qCAAqC,EAAE,CAAC,CAAC;gBAChG,CAAC;gBAAC,MAAM,CAAC;oBACP,oFAAoF;gBACtF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IACxE,gBAAgB,CAAC,QAAgB;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,IAAI,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,qBAAqB;YAC3E,+CAA+C;YAC/C,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,qCAAqC,EAAE,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,4EAA4E;YAC5E,gEAAgE;YAChE,IAAI,CAAC;gBACH,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,6CAA6C,EAAE,CAAC,CAAC;gBACtG,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,yEAAyE;gBACzE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAEO,SAAS;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU;IACpC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAChC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;QACxB,eAAe;IACjB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,mFAAmF;AAEnF,IAAI,UAAU,GAA8B,IAAI,CAAC;AACjD,IAAI,cAAkC,CAAC;AACvC,IAAI,oBAAwC,CAAC;AAC7C,IAAI,qBAAyC,CAAC;AAS9C;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAoB;IAC9D,cAAc,GAAG,GAAG,EAAE,aAAa,CAAC;IACpC,oBAAoB,GAAG,GAAG,EAAE,SAAS,CAAC;IACtC,qBAAqB,GAAG,GAAG,EAAE,UAAU,CAAC;IACxC,UAAU,GAAG,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB;IACtC,OAAO,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;AACrD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB;IACvC,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,CAAC;AACvD,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,+BAA+B;IAC7C,UAAU,GAAG,IAAI,CAAC;IAClB,cAAc,GAAG,SAAS,CAAC;IAC3B,oBAAoB,GAAG,SAAS,CAAC;IACjC,qBAAqB,GAAG,SAAS,CAAC;AACpC,CAAC"}

package/dist/core/intelligenceProviderFactory.d.ts

@@ -100,18 +100,6 @@ export interface BuildIntelligenceProviderOptions {
      */
     resolveExecJson?: () => boolean;
 }
-/**
- * Build an IntelligenceProvider for the given framework. Returns null
- * if the required binary can't be located. The caller decides what
- * happens next — fatal error, fall-back to a different framework, or
- * disable LLM-backed paths entirely.
- *
- * @example
- *   const intel = buildIntelligenceProvider({ framework: 'codex-cli' });
- *   if (intel === null) {
- *     console.warn('Codex CLI not found — LLM-backed paths disabled.');
- *   }
- */
 export declare function buildIntelligenceProvider(options?: BuildIntelligenceProviderOptions): IntelligenceProvider | null;
 /**
  * Convenience: read the framework selection from the environment.

package/dist/core/intelligenceProviderFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"intelligenceProviderFactory.d.ts","sourceRoot":"","sources":["../../src/core/intelligenceProviderFactory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAOvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6DAA6D,CAAC;AAE1G;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,CAAC;AAE1F,MAAM,WAAW,gCAAgC;IAC/C;;;;OAIG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QACjB,IAAI,EAAE,oBAAoB,CAAC;QAC3B,4EAA4E;QAC5E,WAAW,EAAE,eAAe,CAAC;QAC7B,gEAAgE;QAChE,aAAa,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;QAC5D,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAC;QAChD,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,IAAI,CAAC;KACrD,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC;CACjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,gCAAqC,GAC7C,oBAAoB,GAAG,IAAI,CA0G7B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,qBAAqB,GAAG,IAAI,CAOnG"}
+{"version":3,"file":"intelligenceProviderFactory.d.ts","sourceRoot":"","sources":["../../src/core/intelligenceProviderFactory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6DAA6D,CAAC;AAE1G;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,CAAC;AAE1F,MAAM,WAAW,gCAAgC;IAC/C;;;;OAIG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QACjB,IAAI,EAAE,oBAAoB,CAAC;QAC3B,4EAA4E;QAC5E,WAAW,EAAE,eAAe,CAAC;QAC7B,gEAAgE;QAChE,aAAa,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;QAC5D,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAC;QAChD,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,IAAI,CAAC;KACrD,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC;CACjC;AA4BD,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,gCAAqC,GAC7C,oBAAoB,GAAG,IAAI,CAiH7B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,qBAAqB,GAAG,IAAI,CAOnG"}

package/dist/core/intelligenceProviderFactory.js

@@ -19,6 +19,7 @@ import { CodexCliIntelligenceProvider } from './CodexCliIntelligenceProvider.js'
 import { GeminiCliIntelligenceProvider } from './GeminiCliIntelligenceProvider.js';
 import { PiCliIntelligenceProvider } from './PiCliIntelligenceProvider.js';
 import { wrapIntelligenceWithCircuitBreaker } from './CircuitBreakingIntelligenceProvider.js';
+import { wrapIntelligenceWithSpawnCap } from './SpawnCapIntelligenceProvider.js';
 import { AnthropicSubscriptionRouter, } from './AnthropicSubscriptionRouter.js';
 import { InteractivePoolIntelligenceProvider } from './InteractivePoolIntelligenceProvider.js';
 /**
@@ -33,12 +34,29 @@ import { InteractivePoolIntelligenceProvider } from './InteractivePoolIntelligen
  *     console.warn('Codex CLI not found — LLM-backed paths disabled.');
  *   }
  */
+/**
+ * Apply the two universal funnel wrappers in the correct order: the spawn cap
+ * INSIDE the circuit breaker (so a breaker-open shed never holds a spawn slot),
+ * then the breaker OUTSIDE. Both are per-`evaluate()` wrappers, so the acquire
+ * is per-call — load-bearing for CoherenceGate's shared-instance fan-out.
+ * No-ops on null (passes a possibly-null factory result through unchanged).
+ */
+function wrapForFunnel(provider, breaker) {
+    return wrapIntelligenceWithCircuitBreaker(wrapIntelligenceWithSpawnCap(provider), breaker);
+}
 export function buildIntelligenceProvider(options = {}) {
     const framework = options.framework ?? 'claude-code';
-    // Every provider the factory hands out is wrapped with the account-global
-    // LLM circuit breaker (CircuitBreakingIntelligenceProvider). A closed breaker
-    // is a transparent passthrough, so this is always safe; it only acts when the
-    // provider reports a usage/rate limit. See LlmCircuitBreaker for the why.
+    // Every provider the factory hands out is wrapped with TWO universal funnels
+    // (Structure > Willpower — every consumer inherits both from one place):
+    //   1. the host-wide SPAWN CAP (SpawnCapIntelligenceProvider) — the SIMPLE
+    //      fork-bomb prevention P1 chokepoint. Layered INSIDE the breaker so a
+    //      breaker-open shed never even reaches the spawn-cap acquire (no slot is
+    //      held for a call that won't spawn); the cap binds the ACTUAL spawn.
+    //   2. the account-global LLM circuit breaker (CircuitBreakingIntelligenceProvider).
+    //      A closed breaker is a transparent passthrough; it only acts on a
+    //      usage/rate limit. See LlmCircuitBreaker for the why.
+    // `wrapForFunnel` applies both in the correct order at EVERY return arm so a
+    // new framework case can't accidentally ship un-capped.
     switch (framework) {
         case 'claude-code': {
             const path = options.binaryPath ?? detectClaudePath();
@@ -63,15 +81,15 @@ export function buildIntelligenceProvider(options = {}) {
                     ...(sp.onRoute ? { onRoute: sp.onRoute } : {}),
                     ...(sp.onDegrade ? { onDegrade: sp.onDegrade } : {}),
                 });
-                return wrapIntelligenceWithCircuitBreaker(routed, options.breaker);
+                return wrapForFunnel(routed, options.breaker);
             }
-            return wrapIntelligenceWithCircuitBreaker(headless, options.breaker);
+            return wrapForFunnel(headless, options.breaker);
         }
         case 'codex-cli': {
             const path = options.binaryPath ?? detectCodexPath();
             if (!path)
                 return null;
-            return wrapIntelligenceWithCircuitBreaker(new CodexCliIntelligenceProvider({
+            return wrapForFunnel(new CodexCliIntelligenceProvider({
                 codexPath: path,
                 ...(options.workingDirectory ? { workingDirectory: options.workingDirectory } : {}),
                 ...(options.resolveExecJson ? { resolveExecJson: options.resolveExecJson } : {}),
@@ -81,7 +99,7 @@ export function buildIntelligenceProvider(options = {}) {
             const path = options.binaryPath ?? detectGeminiPath();
             if (!path)
                 return null;
-            return wrapIntelligenceWithCircuitBreaker(new GeminiCliIntelligenceProvider({
+            return wrapForFunnel(new GeminiCliIntelligenceProvider({
                 geminiPath: path,
                 ...(options.workingDirectory ? { workingDirectory: options.workingDirectory } : {}),
                 ...(options.quotaStateFile ? { capacityPolicy: { quotaStateFile: options.quotaStateFile } } : {}),
@@ -104,7 +122,7 @@ export function buildIntelligenceProvider(options = {}) {
                 return null;
             }
             try {
-                return wrapIntelligenceWithCircuitBreaker(new PiCliIntelligenceProvider({
+                return wrapForFunnel(new PiCliIntelligenceProvider({
                     piPath: path,
                     model: options.piModel,
                     ...(options.piAllowAnthropicProviders !== undefined

package/dist/core/intelligenceProviderFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"intelligenceProviderFactory.js","sourceRoot":"","sources":["../../src/core/intelligenceProviderFactory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,2BAA2B,GAI5B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAwF/F;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAA4C,EAAE;IAE9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;IAErD,0EAA0E;IAC1E,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC;YACzD,qEAAqE;YACrE,4DAA4D;YAC5D,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAI,2BAA2B,CAAC;oBAC7C,QAAQ;oBACR,IAAI,EAAE,IAAI,mCAAmC,CAAC,EAAE,CAAC,WAAW,CAAC;oBAC7D,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,aAAa,EAAE,EAAE,CAAC,aAAa;oBAC/B,GAAG,CAAC,EAAE,CAAC,oBAAoB,KAAK,SAAS;wBACvC,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,EAAE;wBACnD,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrD,CAAC,CAAC;gBACH,OAAO,kCAAkC,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,kCAAkC,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,kCAAkC,CACvC,IAAI,4BAA4B,CAAC;gBAC/B,SAAS,EAAE,IAAI;gBACf,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC,EACF,OAAO,CAAC,OAAO,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,kCAAkC,CACvC,IAAI,6BAA6B,CAAC;gBAChC,UAAU,EAAE,IAAI;gBAChB,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClG,CAAC,EACF,OAAO,CAAC,OAAO,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,sEAAsE;YACtE,qDAAqD;YACrD,6CAA6C;YAC7C,oDAAoD;YACpD,kEAAkE;YAClE,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CACV,8FAA8F;oBAC9F,qGAAqG,CACtG,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,kCAAkC,CACvC,IAAI,yBAAyB,CAAC;oBAC5B,MAAM,EAAE,IAAI;oBACZ,KAAK,EAAE,OAAO,CAAC,OAAO;oBACtB,GAAG,CAAC,OAAO,CAAC,yBAAyB,KAAK,SAAS;wBACjD,CAAC,CAAC,EAAE,uBAAuB,EAAE,OAAO,CAAC,yBAAyB,EAAE;wBAChE,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF,CAAC,EACF,OAAO,CAAC,OAAO,CAChB,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,iEAAiE;gBACjE,kEAAkE;gBAClE,sEAAsE;gBACtE,mEAAmE;gBACnE,oEAAoE;gBACpE,OAAO,CAAC,IAAI,CAAC,0DAA0D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,iEAAiE;YACjE,sCAAsC;YACtC,MAAM,WAAW,GAAU,SAAS,CAAC;YACrC,KAAK,WAAW,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC;IACpE,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IAC/D,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"intelligenceProviderFactory.js","sourceRoot":"","sources":["../../src/core/intelligenceProviderFactory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEjF,OAAO,EACL,2BAA2B,GAI5B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAwF/F;;;;;;;;;;;GAWG;AACH;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,QAAqC,EACrC,OAAsC;IAEtC,OAAO,kCAAkC,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAA4C,EAAE;IAE9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;IAErD,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,qFAAqF;IACrF,wEAAwE;IACxE,4DAA4D;IAC5D,6EAA6E;IAC7E,wDAAwD;IACxD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC;YACzD,qEAAqE;YACrE,4DAA4D;YAC5D,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAI,2BAA2B,CAAC;oBAC7C,QAAQ;oBACR,IAAI,EAAE,IAAI,mCAAmC,CAAC,EAAE,CAAC,WAAW,CAAC;oBAC7D,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,aAAa,EAAE,EAAE,CAAC,aAAa;oBAC/B,GAAG,CAAC,EAAE,CAAC,oBAAoB,KAAK,SAAS;wBACvC,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,EAAE;wBACnD,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrD,CAAC,CAAC;gBACH,OAAO,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,aAAa,CAClB,IAAI,4BAA4B,CAAC;gBAC/B,SAAS,EAAE,IAAI;gBACf,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC,EACF,OAAO,CAAC,OAAO,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,aAAa,CAClB,IAAI,6BAA6B,CAAC;gBAChC,UAAU,EAAE,IAAI;gBAChB,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClG,CAAC,EACF,OAAO,CAAC,OAAO,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,sEAAsE;YACtE,qDAAqD;YACrD,6CAA6C;YAC7C,oDAAoD;YACpD,kEAAkE;YAClE,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CACV,8FAA8F;oBAC9F,qGAAqG,CACtG,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,aAAa,CAClB,IAAI,yBAAyB,CAAC;oBAC5B,MAAM,EAAE,IAAI;oBACZ,KAAK,EAAE,OAAO,CAAC,OAAO;oBACtB,GAAG,CAAC,OAAO,CAAC,yBAAyB,KAAK,SAAS;wBACjD,CAAC,CAAC,EAAE,uBAAuB,EAAE,OAAO,CAAC,yBAAyB,EAAE;wBAChE,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF,CAAC,EACF,OAAO,CAAC,OAAO,CAChB,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,iEAAiE;gBACjE,kEAAkE;gBAClE,sEAAsE;gBACtE,mEAAmE;gBACnE,oEAAoE;gBACpE,OAAO,CAAC,IAAI,CAAC,0DAA0D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,iEAAiE;YACjE,sCAAsC;YACtC,MAAM,WAAW,GAAU,SAAS,CAAC;YACrC,KAAK,WAAW,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC;IACpE,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IAC/D,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/types.d.ts

@@ -3016,6 +3016,24 @@ export interface InstarConfig {
              * injected sentinel and the REPL would otherwise never be reaped. */
             maxReroutedLifetimeMinutes?: number;
         };
+        /**
+         * Fork-bomb prevention — host-wide concurrent-LLM-subprocess cap (the SIMPLE
+         * design, docs/specs/forkbomb-prevention-simple.md §D-CAP). A SAFETY FLOOR:
+         * read with a plain `?? default` (env > this config > the hardcoded default),
+         * NEVER `resolveDevAgentGate` — it ships ON for every agent, never dark. The
+         * cap bounds how many `claude -p`/`codex exec` subprocesses run AT ONCE
+         * across every compliant Instar process on the host (the primary control for
+         * the 2026-06-20 OOM fork-bomb). Env overrides: INSTAR_HOST_SPAWN_MAX,
+         * INSTAR_SPAWN_ACQUIRE_MS, INSTAR_SPAWN_WAITERS_MAX.
+         */
+        spawnCap?: {
+            /** Concurrent-spawn cap across the whole host. Default 8. */
+            maxConcurrent?: number;
+            /** Bounded-acquire poll budget (ms) before a saturated call sheds. Default 5000. */
+            acquireMs?: number;
+            /** Concurrent-poller ceiling (bounds the waiters, no queue-node heap). Default 64. */
+            waitersMax?: number;
+        };
     };
     /**
      * Agent-level set of frameworks this install actively uses. Drives