jishushell 0.4.17 → 0.4.24

package/dist/services/agent-apps/installers/shell-script.js

@@ -0,0 +1,471 @@
+/**
+ * Installer strategy for shell-script-driven agent apps (Ollama and any other
+ * system tool shipped as a `curl | bash` installer).
+ *
+ * Responsibilities:
+ *   - probe installed version + binary size via `probeCommand`
+ *   - probe update availability via GitHub Releases (when `githubRepo` set)
+ *   - install: fetch script → optional sha256 verify → `sudo -n bash`
+ *   - uninstall: stop+disable systemd unit + rm binary + rm extraCleanup
+ *
+ * Heavy ops stream progress through the shared task-registry so the UI
+ * picks them up via `/api/setup/tasks/:id`, identical to adapter installs.
+ */
+import { execFile } from "child_process";
+import { createHash } from "crypto";
+import { mkdtempSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { promisify } from "util";
+import { createTask, emitTask, getRunningTasks, } from "../../task-registry.js";
+const execFileAsync = promisify(execFile);
+const VERSION_DEFAULT_RE = /\b(\d+\.\d+\.\d+)\b/;
+export async function probeShellScriptStatus(source) {
+    const { cmd, args } = source.probeCommand;
+    try {
+        const { stdout } = await execFileAsync(cmd, args, {
+            timeout: 5_000,
+            encoding: "utf-8",
+        });
+        const re = source.versionRegex ? new RegExp(source.versionRegex) : VERSION_DEFAULT_RE;
+        const m = stdout.match(re);
+        return { installed: true, version: m?.[1] };
+    }
+    catch (e) {
+        // ENOENT = binary not found → cleanly "not installed". Any other
+        // failure (exec error, timeout) we report as unknown rather than
+        // definitively "not installed" so a transient shell hang does not
+        // flip the UI from 已安装 to 未安装 mid-session.
+        if (e?.code === "ENOENT")
+            return { installed: false };
+        return null;
+    }
+}
+export async function probeShellScriptSizeMB(source) {
+    if (!source.binaryPath)
+        return null;
+    try {
+        const { stdout } = await execFileAsync("du", ["-sb", source.binaryPath], {
+            timeout: 3_000,
+            encoding: "utf-8",
+        });
+        const bytes = parseInt(stdout.trim().split(/\s+/)[0] || "", 10);
+        if (!Number.isFinite(bytes) || bytes <= 0)
+            return null;
+        return Math.round(bytes / 1_000_000);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Update-availability cache for shell-script apps. Separate from the adapter
+ * SWR cache in `adapter-probes.ts` so the two install kinds stay decoupled.
+ *
+ * Shape:
+ *   - `value`: last known answer (true/false) or null on probe failure.
+ *   - `at`:    ms since epoch of the last refresh.
+ *
+ * The cache is only written by `refreshShellScriptUpdateCache` (called from
+ * `checkAllAgentAppUpdates`). `buildCardView` reads the cache *without* any
+ * network I/O — the hot path can't stall on a slow GitHub call.
+ */
+const shellScriptUpdateCache = new Map();
+/**
+ * Read-only cache lookup used by `buildCardView`. Returns null (UI stays
+ * neutral) until the user clicks "检查更新" at least once, which kicks off
+ * the network probe via `refreshShellScriptUpdateCache`.
+ *
+ * Intentionally NOT falling back to an on-demand probe here — the catalog
+ * endpoint is polled every 5 s and the GitHub Releases API is slow + rate-
+ * limited. See docs/agent-apps-design.md "update checks only on explicit
+ * click".
+ */
+export function readShellScriptUpdateAvailable(appId) {
+    return shellScriptUpdateCache.get(appId)?.value ?? null;
+}
+export function getShellScriptUpdateCacheLastCheckedAt() {
+    let latest = 0;
+    for (const entry of shellScriptUpdateCache.values()) {
+        if (entry.at > latest)
+            latest = entry.at;
+    }
+    return latest > 0 ? latest : null;
+}
+/**
+ * Compare installed version vs GitHub Releases latest tag. Writes the
+ * result to the cache and returns it. Called by `checkAllAgentAppUpdates`;
+ * not called from the catalog hot path.
+ */
+export async function refreshShellScriptUpdateCache(appId, source) {
+    const value = await probeShellScriptUpdateNow(source);
+    shellScriptUpdateCache.set(appId, { value, at: Date.now() });
+    return value;
+}
+async function probeShellScriptUpdateNow(source) {
+    if (!source.githubRepo)
+        return null;
+    const probe = await probeShellScriptStatus(source);
+    if (!probe?.installed || !probe.version)
+        return null;
+    const apiUrl = `https://api.github.com/repos/${source.githubRepo}/releases/latest`;
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 15_000);
+        let body;
+        try {
+            const resp = await fetch(apiUrl, {
+                headers: {
+                    Accept: "application/vnd.github+json",
+                    "User-Agent": "jishushell-agent-apps",
+                },
+                signal: controller.signal,
+            });
+            if (!resp.ok)
+                return null;
+            body = (await resp.json());
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const latest = (body.tag_name || "").replace(/^v/, "").trim();
+        if (!latest)
+            return null;
+        return latest !== probe.version;
+    }
+    catch {
+        return null;
+    }
+}
+export function findRunningShellScriptTask(appId) {
+    const install = getRunningTasks(appId)[0];
+    if (install)
+        return { id: install.id, kind: "install" };
+    const uninstall = getRunningTasks(`uninstall-${appId}`)[0];
+    if (uninstall)
+        return { id: uninstall.id, kind: "uninstall" };
+    return undefined;
+}
+export async function startShellScriptInstall(appId, source) {
+    // Block install when uninstall is running — destructive of each other.
+    if (getRunningTasks(`uninstall-${appId}`).length > 0) {
+        return {
+            ok: false,
+            error: `${appId} 正在卸载，请等待卸载完成后再安装`,
+        };
+    }
+    const existing = getRunningTasks(appId);
+    if (existing.length > 0) {
+        return {
+            ok: true,
+            taskId: existing[0].id,
+            reused: true,
+            message: `${appId} 安装已在进行中`,
+        };
+    }
+    // Preflight: if the daemon cannot gain privileges (e.g. systemd's
+    // NoNewPrivileges hardening is on), hand back a manual command for the
+    // user to run in a terminal instead of starting a task that is doomed.
+    const priv = await probePrivilegeEscalation();
+    if (!priv.ok) {
+        return {
+            ok: false,
+            error: `面板无法自动提权安装 (${priv.reason})`,
+            manualReason: describeManualPrivilegeReason(priv.reason),
+            manualCommand: buildManualInstallCommand(source, priv.reason),
+        };
+    }
+    const task = createTask(appId);
+    runShellScriptInstall(task, source).catch((e) => {
+        emitTask(task, { type: "error", message: `安装失败: ${e?.message || e}` });
+        task.status = "error";
+    });
+    return { ok: true, taskId: task.id };
+}
+/**
+ * Probe whether the daemon can actually execute something as root. Checks
+ * three failure modes:
+ *   1. sudo not in PATH
+ *   2. systemd NoNewPrivileges=true (sudo refuses, distinct error text)
+ *   3. sudoers blocks this user (password required / not allowed)
+ */
+async function probePrivilegeEscalation() {
+    try {
+        await execFileAsync("sudo", ["-n", "true"], { timeout: 3_000 });
+        return { ok: true };
+    }
+    catch (e) {
+        const stderr = String(e?.stderr || "").toLowerCase();
+        if (e?.code === "ENOENT")
+            return { ok: false, reason: "sudo 不在 PATH" };
+        if (stderr.includes("no new privileges")) {
+            return { ok: false, reason: "systemd NoNewPrivileges=true" };
+        }
+        if (stderr.includes("password is required") || stderr.includes("a password is required")) {
+            return { ok: false, reason: "sudoers 需要密码" };
+        }
+        return {
+            ok: false,
+            reason: e?.message ? String(e.message).slice(0, 120) : "sudo 不可用",
+        };
+    }
+}
+function buildManualInstallCommand(source, reason) {
+    if (reason === "sudo 不在 PATH") {
+        return `curl -fsSL ${source.scriptUrl} | sh`;
+    }
+    return `curl -fsSL ${source.scriptUrl} | sudo sh`;
+}
+function describeManualPrivilegeReason(reason) {
+    if (reason === "sudo 不在 PATH") {
+        return "当前环境没有 sudo，请切换到 root 终端后手动执行下面的命令";
+    }
+    if (reason === "systemd NoNewPrivileges=true") {
+        return "面板服务被 systemd 安全策略限制，不能在后台自动 sudo；请在你自己的终端执行下面的命令";
+    }
+    if (reason === "sudoers 需要密码") {
+        return "当前系统的 sudo 需要密码，后台任务不能代输；请在终端执行下面的命令，终端会提示你输入密码";
+    }
+    return `后台无法自动提权：${reason}`;
+}
+async function runShellScriptInstall(task, source) {
+    emitTask(task, { type: "progress", message: "检查 sudo 权限...", progress: 5 });
+    // Panel runs as a non-root user. The install script needs sudo. We use
+    // `sudo -n` (non-interactive); if it prompts for a password we bail with
+    // a clear message instead of hanging.
+    try {
+        await execFileAsync("sudo", ["-n", "true"], { timeout: 3_000 });
+    }
+    catch (e) {
+        const detail = [
+            e?.code ? `code=${e.code}` : "",
+            e?.signal ? `signal=${e.signal}` : "",
+            e?.stderr ? `stderr=${String(e.stderr).trim().slice(0, 200)}` : "",
+            e?.message ? `msg=${String(e.message).slice(0, 200)}` : "",
+        ].filter(Boolean).join(" | ");
+        console.error(`[agent-apps] sudo -n true failed: ${detail}`);
+        emitTask(task, {
+            type: "error",
+            message: `需要免密 sudo。[${detail || "no details"}] 请在终端执行 sudo visudo 允许当前用户免密，或手动运行安装命令。`,
+        });
+        task.status = "error";
+        return;
+    }
+    emitTask(task, {
+        type: "progress",
+        message: `下载安装脚本: ${source.scriptUrl}`,
+        progress: 15,
+    });
+    const controller = new AbortController();
+    const dlTimer = setTimeout(() => controller.abort(), 60_000);
+    let scriptText;
+    try {
+        const resp = await fetch(source.scriptUrl, { signal: controller.signal });
+        if (!resp.ok) {
+            emitTask(task, {
+                type: "error",
+                message: `下载失败: HTTP ${resp.status}`,
+            });
+            task.status = "error";
+            return;
+        }
+        scriptText = await resp.text();
+    }
+    catch (e) {
+        emitTask(task, { type: "error", message: `下载失败: ${e?.message || e}` });
+        task.status = "error";
+        return;
+    }
+    finally {
+        clearTimeout(dlTimer);
+    }
+    if (source.scriptSha256) {
+        const actual = createHash("sha256").update(scriptText).digest("hex");
+        if (actual !== source.scriptSha256) {
+            emitTask(task, {
+                type: "error",
+                message: `sha256 校验失败: 期望 ${source.scriptSha256}, 实际 ${actual}`,
+            });
+            task.status = "error";
+            return;
+        }
+        emitTask(task, { type: "log", message: `sha256 校验通过` });
+    }
+    else {
+        emitTask(task, {
+            type: "log",
+            message: "(未配置 sha256 校验；生产环境建议 pin 到固定版本)",
+        });
+    }
+    // Write to a temp dir with restrictive mode so the script file cannot be
+    // substituted between check and exec.
+    const scriptDir = mkdtempSync(join(tmpdir(), "agent-app-install-"));
+    const scriptPath = join(scriptDir, "install.sh");
+    writeFileSync(scriptPath, scriptText, { mode: 0o700 });
+    emitTask(task, {
+        type: "progress",
+        message: "执行安装脚本（sudo bash）...",
+        progress: 40,
+    });
+    const ok = await runWithStream(task, "sudo", ["-n", "bash", scriptPath], 30 * 60_000);
+    try {
+        rmSync(scriptDir, { recursive: true, force: true });
+    }
+    catch { /* best effort */ }
+    if (!ok) {
+        emitTask(task, { type: "error", message: "安装脚本返回非零退出码" });
+        task.status = "error";
+        return;
+    }
+    emitTask(task, { type: "progress", message: "验证安装...", progress: 95 });
+    const status = await probeShellScriptStatus(source);
+    if (!status?.installed) {
+        emitTask(task, {
+            type: "error",
+            message: "安装脚本执行后仍检测不到可执行命令，请查看日志排查",
+        });
+        task.status = "error";
+        return;
+    }
+    emitTask(task, {
+        type: "done",
+        message: status.version ? `安装完成: v${status.version}` : "安装完成",
+        progress: 100,
+    });
+    task.status = "done";
+}
+export async function startShellScriptUninstall(appId, source) {
+    // Block uninstall while install is in flight.
+    if (getRunningTasks(appId).length > 0) {
+        return {
+            ok: false,
+            error: `${appId} 正在安装/更新，请等待完成后再卸载`,
+        };
+    }
+    if (getRunningTasks(`uninstall-${appId}`).length > 0) {
+        return {
+            ok: false,
+            error: `${appId} 卸载已在进行中`,
+        };
+    }
+    const priv = await probePrivilegeEscalation();
+    if (!priv.ok) {
+        const manual = buildManualUninstallCommand(source);
+        return {
+            ok: false,
+            error: `面板无法以 root 执行 (${priv.reason})`,
+            manualReason: priv.reason,
+            manualCommand: manual,
+        };
+    }
+    const task = createTask(`uninstall-${appId}`);
+    runShellScriptUninstall(task, source).catch((e) => {
+        emitTask(task, { type: "error", message: `卸载失败: ${e?.message || e}` });
+        task.status = "error";
+    });
+    return { ok: true, taskId: task.id };
+}
+function buildManualUninstallCommand(source) {
+    const parts = [];
+    if (source.systemdUnit) {
+        parts.push(`sudo systemctl stop ${source.systemdUnit}`);
+        parts.push(`sudo systemctl disable ${source.systemdUnit}`);
+    }
+    const rmTargets = [];
+    if (source.binaryPath)
+        rmTargets.push(source.binaryPath);
+    if (source.extraCleanup)
+        rmTargets.push(...source.extraCleanup);
+    if (rmTargets.length > 0) {
+        parts.push(`sudo rm -rf ${rmTargets.join(" ")}`);
+    }
+    return parts.join(" && ");
+}
+async function runShellScriptUninstall(task, source) {
+    try {
+        await execFileAsync("sudo", ["-n", "true"], { timeout: 3_000 });
+    }
+    catch {
+        emitTask(task, {
+            type: "error",
+            message: "需要免密 sudo。请手动运行卸载命令。",
+        });
+        task.status = "error";
+        return;
+    }
+    // systemd stop/disable failures are treated as warnings, not hard errors:
+    // the unit may not exist (e.g. the user installed via a different path),
+    // which is not a reason to leave the app in a limbo "half-uninstalled"
+    // state. The binary rm below is what actually defines success.
+    if (source.systemdUnit) {
+        emitTask(task, {
+            type: "progress",
+            message: `停止 systemd 服务: ${source.systemdUnit}`,
+            progress: 20,
+        });
+        const stopped = await runWithStream(task, "sudo", ["-n", "systemctl", "stop", source.systemdUnit], 15_000);
+        if (!stopped) {
+            emitTask(task, { type: "log", message: "systemctl stop 失败（可能服务未启用），继续卸载" });
+        }
+        const disabled = await runWithStream(task, "sudo", ["-n", "systemctl", "disable", source.systemdUnit], 15_000);
+        if (!disabled) {
+            emitTask(task, { type: "log", message: "systemctl disable 失败（可能服务未启用），继续卸载" });
+        }
+    }
+    const removalTargets = [];
+    if (source.binaryPath)
+        removalTargets.push(source.binaryPath);
+    if (source.extraCleanup)
+        removalTargets.push(...source.extraCleanup);
+    // Binary removal is the load-bearing step. If rm fails, post-probe will
+    // still see the binary and the app is effectively still installed —
+    // that has to be surfaced as an error rather than a silent success.
+    if (removalTargets.length > 0) {
+        emitTask(task, {
+            type: "progress",
+            message: `删除文件: ${removalTargets.join(", ")}`,
+            progress: 60,
+        });
+        const removed = await runWithStream(task, "sudo", ["-n", "rm", "-rf", "--", ...removalTargets], 30_000);
+        if (!removed) {
+            emitTask(task, {
+                type: "error",
+                message: `rm 失败（${removalTargets.join(", ")}），卸载未完成。请查看日志或手动清理。`,
+            });
+            task.status = "error";
+            return;
+        }
+    }
+    // Post-verify: the probe command should now fail with ENOENT. If it
+    // still works, the rm command "succeeded" but something else put the
+    // binary back (alternate PATH, alias, etc.) — treat as error so the UI
+    // flags it instead of optimistically showing "已安装 → 未安装".
+    const post = await probeShellScriptStatus(source);
+    if (post?.installed) {
+        emitTask(task, {
+            type: "error",
+            message: "rm 返回 0 但 probeCommand 仍可用，可能存在其它路径的安装残留，请手动排查。",
+        });
+        task.status = "error";
+        return;
+    }
+    emitTask(task, { type: "done", message: "卸载完成", progress: 100 });
+    task.status = "done";
+}
+function runWithStream(task, cmd, args, timeoutMs) {
+    return new Promise((resolve) => {
+        const child = execFile(cmd, args, { timeout: timeoutMs, encoding: "utf-8", maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+            const output = `${stdout || ""}${stderr || ""}`;
+            for (const raw of output.split(/\r?\n/)) {
+                const line = raw.trim();
+                if (line)
+                    emitTask(task, { type: "log", message: line });
+            }
+            resolve(!err);
+        });
+        child.on("error", (e) => {
+            emitTask(task, { type: "log", message: `[exec-error] ${e.message}` });
+        });
+    });
+}
+//# sourceMappingURL=shell-script.js.map

package/dist/services/agent-apps/installers/shell-script.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-script.js","sourceRoot":"","sources":["../../../../src/services/agent-apps/installers/shell-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,eAAe,GAEhB,MAAM,wBAAwB,CAAC;AAGhC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAI1C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAyB;IAEzB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE;YAChD,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACtF,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,2CAA2C;QAC3C,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAyB;IAEzB,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE;YACvE,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAiD,CAAC;AAExF;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAa;IAC1D,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,sCAAsC;IACpD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,sBAAsB,CAAC,MAAM,EAAE,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,EAAE,GAAG,MAAM;YAAE,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAa,EACb,MAAyB;IAEzB,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACtD,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,MAAyB;IAEzB,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,MAAM,GAAG,gCAAgC,MAAM,CAAC,UAAU,kBAAkB,CAAC;IACnF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,IAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;gBAC/B,OAAO,EAAE;oBACP,MAAM,EAAE,6BAA6B;oBACrC,YAAY,EAAE,uBAAuB;iBACtC;gBACD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;QACtD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAa;IAEb,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,MAAyB;IAEzB,uEAAuE;IACvE,IAAI,eAAe,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,KAAK,mBAAmB;SACnC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,GAAG,KAAK,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,IAAI,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,eAAe,IAAI,CAAC,MAAM,GAAG;YACpC,YAAY,EAAE,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;YACxD,aAAa,EAAE,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9C,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,wBAAwB;IACrC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACvE,IAAI,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU;SAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAyB,EAAE,MAAc;IAC1E,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,cAAc,MAAM,CAAC,SAAS,OAAO,CAAC;IAC/C,CAAC;IACD,OAAO,cAAc,MAAM,CAAC,SAAS,YAAY,CAAC;AACpD,CAAC;AAED,SAAS,6BAA6B,CAAC,MAAc;IACnD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,KAAK,8BAA8B,EAAE,CAAC;QAC9C,OAAO,mDAAmD,CAAC;IAC7D,CAAC;IACD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,iDAAiD,CAAC;IAC3D,CAAC;IACD,OAAO,YAAY,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAU,EACV,MAAyB;IAEzB,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,sCAAsC;IACtC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG;YACb,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;YAC/B,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;YACrC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YAClE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;SAC3D,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;QAC7D,QAAQ,CAAC,IAAI,EAAE;YACb,IAAI,EAAE,OAAO;YACb,OAAO,EACL,cAAc,MAAM,IAAI,YAAY,0CAA0C;SACjF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,OAAO;IACT,CAAC;IAED,QAAQ,CAAC,IAAI,EAAE;QACb,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,WAAW,MAAM,CAAC,SAAS,EAAE;QACtC,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,EAAE;gBACb,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,cAAc,IAAI,CAAC,MAAM,EAAE;aACrC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;YACtB,OAAO;QACT,CAAC;QACD,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,OAAO;IACT,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,EAAE;gBACb,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,mBAAmB,MAAM,CAAC,YAAY,QAAQ,MAAM,EAAE;aAChE,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;YACtB,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,EAAE;YACb,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,kCAAkC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,sCAAsC;IACtC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACjD,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvD,QAAQ,CAAC,IAAI,EAAE;QACb,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IACtF,IAAI,CAAC;QAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAExF,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,OAAO;IACT,CAAC;IAED,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE;YACb,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,OAAO;IACT,CAAC;IAED,QAAQ,CAAC,IAAI,EAAE;QACb,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM;QAC7D,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAa,EACb,MAAyB;IAEzB,8CAA8C;IAC9C,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,KAAK,oBAAoB;SACpC,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,KAAK,UAAU;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kBAAkB,IAAI,CAAC,MAAM,GAAG;YACvC,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,aAAa,EAAE,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC;IAC9C,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QAChD,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,2BAA2B,CAAC,MAAyB;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,UAAU;QAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,YAAY;QAAE,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,eAAe,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAAU,EACV,MAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,EAAE;YACb,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,sBAAsB;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,+DAA+D;IAC/D,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE;YACb,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,kBAAkB,MAAM,CAAC,WAAW,EAAE;YAC/C,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CACtE,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAClC,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CACzE,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,UAAU;QAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,YAAY;QAAE,cAAc,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IAErE,wEAAwE;IACxE,oEAAoE;IACpE,oEAAoE;IACpE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,EAAE;YACb,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,SAAS,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC7C,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,IAAI,EACJ,MAAM,EACN,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,EAC5C,MAAM,CACP,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,EAAE;gBACb,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,SAAS,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB;aACjE,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;YACtB,OAAO;QACT,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,EAAE;YACb,IAAI,EAAE,OAAO;YACb,OAAO,EACL,iDAAiD;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,OAAO;IACT,CAAC;IAED,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CACpB,IAAU,EACV,GAAW,EACX,IAAc,EACd,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,QAAQ,CACpB,GAAG,EACH,IAAI,EACJ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EACtE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,CAAC;YAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,IAAI;oBAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtB,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/agent-apps/types.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Types for the agent-apps module.
+ *
+ * "Agent apps" are installable Tier-1 agent runtimes (hermes, openclaw).
+ * They are surfaced to the user through the "运行时安装" page and share one
+ * install/update/uninstall pipeline driven by the RuntimeAdapter contract.
+ *
+ * Non-agent AppSpec bundles (ollama, searxng, openwebui, ...) live under
+ * `/apps/*.yaml` and install via `POST /api/apps/install` into the generic
+ * `custom` AppTypeManager — they are NOT part of this catalog.
+ *
+ * The `AgentAppCategory` and `AgentAppSource` kinds also cover historical
+ * CLI-tool / system-service installers (`shell-script`, `npm-global`) that
+ * may gain new entries in future phases.
+ */
+export type AgentAppCategory = "agent-runtime" | "system-service" | "cli-tool";
+/**
+ * How an app is installed on disk. Each kind maps to an installer strategy in
+ * `installers/`. Today only `adapter` (hermes + openclaw) has catalog entries;
+ * `shell-script` / `npm-global` remain in the type union for future use.
+ */
+export type AgentAppSource = {
+    kind: "adapter";
+    /** Matches an entry in `runtime/index.ts` adapter registry. */
+    agentType: string;
+} | {
+    kind: "shell-script";
+    /**
+     * URL of the install script. Fetched over HTTPS; sha256 is verified
+     * when `scriptSha256` is set. Leaving sha256 out is supported but
+     * surfaces a warning in the install log.
+     */
+    scriptUrl: string;
+    scriptSha256?: string;
+    /** Command used to detect install status + read version. */
+    probeCommand: {
+        cmd: string;
+        args: string[];
+    };
+    /** Regex with a `(version)` capture group applied to `probeCommand`
+     *  stdout. Default: `/\b(\d+\.\d+\.\d+)\b/`. */
+    versionRegex?: string;
+    /**
+     * GitHub slug (`owner/name`) used to look up the latest release via
+     * the REST API during update checks. Leave unset to disable update
+     * detection for this app.
+     */
+    githubRepo?: string;
+    /** systemd unit name (without `.service`) stopped + disabled on
+     *  uninstall. Leave unset if the app is not a daemon. */
+    systemdUnit?: string;
+    /** Absolute path of the primary binary removed on uninstall. Also
+     *  used for the disk-size probe (`du -sb`). */
+    binaryPath?: string;
+    /** Additional absolute paths removed on uninstall (state dirs,
+     *  systemd unit file, etc.). */
+    extraCleanup?: string[];
+} | {
+    kind: "npm-global";
+    packageName: string;
+};
+export interface AgentAppStatus {
+    installed: boolean;
+    imageReady?: boolean;
+    version?: string;
+    digest?: string;
+    /**
+     * Whether the registry has a newer image than the one stored locally.
+     * `true`  = upstream digest differs from local
+     * `false` = local is up-to-date
+     * `null`  = probe failed / docker too old / offline (UI stays neutral)
+     */
+    updateAvailable?: boolean | null;
+    /** Task id currently installing/updating this app, if any. */
+    currentTaskId?: string;
+    /**
+     * Shape of `currentTaskId`: install/update tasks vs. uninstall tasks use
+     * disjoint task names so they cannot collide. The frontend relies on this
+     * kind to render the right verb ("安装中" vs "卸载中") and to avoid
+     * toasting "install complete" when an uninstall finishes.
+     */
+    currentTaskKind?: "install" | "uninstall";
+}
+export interface AgentAppCardView {
+    id: string;
+    name: string;
+    category: AgentAppCategory;
+    description: string;
+    /** Optional lucide-style icon key the frontend can map to an SVG. */
+    icon?: string;
+    /** Approximate install size surfaced in the UI (may be `null` when unknown). */
+    diskSpaceMB?: number | null;
+    source: AgentAppSource;
+    status: AgentAppStatus;
+    /** Whether each lifecycle action is supported by this app's installer. */
+    actions: {
+        install: boolean;
+        update: boolean;
+        uninstall: boolean;
+    };
+    /**
+     * True when this app is required for basic panel function (currently
+     * openclaw). The UI uses this to hide the uninstall button.
+     */
+    required: boolean;
+}
+export interface InstallStartResult {
+    ok: boolean;
+    taskId?: string;
+    reused?: boolean;
+    error?: string;
+    message?: string;
+    /**
+     * Populated when the install/uninstall requires privilege escalation that
+     * the panel daemon cannot perform itself (e.g. the service runs with
+     * `NoNewPrivileges=true`, which blocks sudo's setuid path).
+     *
+     * The UI should show this to the user as a one-line shell command to run
+     * in their own terminal. After the user executes it, the regular status
+     * probe cycle picks up the new install state automatically.
+     */
+    manualCommand?: string;
+    /** Human-readable reason the daemon can't self-execute (UI subtitle). */
+    manualReason?: string;
+}

package/dist/services/agent-apps/types.js

@@ -0,0 +1,17 @@
+/**
+ * Types for the agent-apps module.
+ *
+ * "Agent apps" are installable Tier-1 agent runtimes (hermes, openclaw).
+ * They are surfaced to the user through the "运行时安装" page and share one
+ * install/update/uninstall pipeline driven by the RuntimeAdapter contract.
+ *
+ * Non-agent AppSpec bundles (ollama, searxng, openwebui, ...) live under
+ * `/apps/*.yaml` and install via `POST /api/apps/install` into the generic
+ * `custom` AppTypeManager — they are NOT part of this catalog.
+ *
+ * The `AgentAppCategory` and `AgentAppSource` kinds also cover historical
+ * CLI-tool / system-service installers (`shell-script`, `npm-global`) that
+ * may gain new entries in future phases.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/services/agent-apps/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/agent-apps/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/services/{app-compiler.d.ts → app/app-compiler.d.ts}

@@ -1,12 +1,12 @@
-import type { AppSpec, AppTask, AppTaskPort, AppTaskHealth } from "../types.js";
+import type { AppSpec, AppTask, AppTaskPort, AppTaskHealth } from "../../types.js";
 export declare function parseCpuToMHz(cpu?: string): number;
 export declare function parseMemoryToMB(memory?: string): number;
 /** Compile AppTask ports → Nomad network port mappings */
 export declare function compilePorts(ports?: AppTaskPort[]): Record<string, any>[];
 /** Compile AppTask health → Nomad service check */
-export declare function compileHealthCheck(health?: AppTaskHealth, taskName?: string): Record<string, any> | null;
+export declare function compileHealthCheck(health?: AppTaskHealth, taskName?: string, ports?: AppTaskPort[]): Record<string, any> | null;
 /** Map AppTask role → Nomad lifecycle hook */
-export declare function compileLifecycle(role: string): Record<string, any> | null;
+export declare function compileLifecycle(role?: string): Record<string, any> | null;
 export declare function compileTaskRuntime(task: AppTask, instanceId: string): Record<string, any>;
 /**
  * Compile a full AppSpec into a Nomad-compatible task group structure.