jishushell 0.4.24 → 0.5.15

package/dist/services/connection-transactor.js

@@ -0,0 +1,351 @@
+/**
+ * connection-transactor — PUT /connections atomic 5-step flow (§10.3).
+ *
+ *   1. Validate     — resolveConnections runtime mode + per-binding checks
+ *   2. Snapshot     — capture instance.json plus the side-effect files that
+ *                     persist hooks may write through: provider.env (LLM
+ *                     proxy-upstream), mcporter.json (MCP),
+ *                     openclaw.json (LLM proxy-upstream + adapter
+ *                     applyConnectionEnv), and Hermes config.yaml / .env.
+ *                     Snapshot now covers OpenClaw (V2 + legacy),
+ *                     Hermes (V2 + legacy), and generic app-dir consumers.
+ *   3. Apply hooks  — invoke PERSIST_HOOKS for each resolved binding in
+ *                     deterministic order (default-env → search → browser
+ *                     → llm → mcp). On any failure, jump to step 5.
+ *   4. Persist      — read-modify-write instance.json: replace `connections`
+ *                     map only, keep other fields (notably the
+ *                     `connections-env` written by step 3 hooks for generic
+ *                     apps without an adapter).
+ *   5. Rollback     — reverse-order recovery from snapshots: restore each
+ *                     side-effect file (or unlink if it didn't exist
+ *                     pre-apply) before restoring instance.json.
+ *
+ * Returns either { ok: true, resolved, pending } or a structured error.
+ */
+import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { INSTANCES_DIR, APPS_DIR } from "../config.js";
+import { resolveConnections, ConnectionError } from "./connection-resolver.js";
+import { PERSIST_HOOKS, UNPERSIST_HOOKS } from "./connection-apply.js";
+import { categoryFromProviderCapability } from "./connection-resolver.js";
+import * as capabilityRegistry from "./capability-registry.js";
+import { withInstanceLock } from "../utils/instance-lock.js";
+const APPLY_ORDER = ["default", "search", "browser", "llm", "mcp"];
+export async function applyConnections(input) {
+    // Serialize against startApp/stopApp/restartApp on the same consumer
+    // instance. Without this, a concurrent stop can flip a bound provider
+    // to status:stopped between Validate (step 1) and Apply (step 3),
+    // leaving instance.json + side-effect files inconsistent.
+    return withInstanceLock(input.instance.id, () => applyConnectionsImpl(input));
+}
+async function applyConnectionsImpl(input) {
+    const { instance, spec, newConnections, saveInstanceJson, readInstanceJson, adapter } = input;
+    // ── Step 1: Validate ──────────────────────────────────────────────────
+    // Resolve the *new* connections in runtime mode so missing-required /
+    // ambiguous / invalid-binding all surface as ConnectionError before we
+    // touch any state.
+    const candidate = {
+        ...instance,
+        connections: newConnections,
+    };
+    const { resolved } = resolveConnections(spec, candidate, "runtime");
+    // ── Step 1d: validateCapabilityEndpoint per binding (§12) ─────────────
+    // Catches registry tampering / drift before any persist hook fires:
+    //   - Fresh re-resolve must match the registry entry (host/port/path)
+    //   - Provider host must be on loopback or LAN
+    //   - Protocol must be in the category whitelist
+    // Only applies to entries whose provider spec we can resolve; legacy
+    // instances without a synthesized spec degrade gracefully (skip).
+    await validateResolvedEndpoints(resolved);
+    // ── Step 2: Snapshot ──────────────────────────────────────────────────
+    // 覆盖 OpenClaw (V2+legacy)、Hermes (V2+legacy)、generic app-dir 三类
+    // consumer 的具体写入路径；详见 snapshotSideEffectFiles。
+    const snapshot = {
+        instanceJson: await readInstanceJson(instance.id),
+        files: snapshotSideEffectFiles(instance.id),
+    };
+    // ── Step 2b: Compute shrunk slots ─────────────────────────────────────
+    // PERSIST_HOOKS only sees slots that *currently* have a binding. When
+    // the user removes a binding (sets the slot to null or drops it from the
+    // map) we need to undo the durable state the prior persist hook wrote —
+    // otherwise unbinding LLM_ENDPOINT leaves x-jishushell.proxy.upstream
+    // pointing at the gone provider, etc. `shrunkSlots` enumerates exactly
+    // those: present-and-non-null in the on-disk connections, missing or
+    // null in `newConnections`.
+    const previousConnections = (snapshot.instanceJson?.connections ?? {});
+    const shrunkSlots = [];
+    for (const [slot, prior] of Object.entries(previousConnections)) {
+        if (prior == null)
+            continue; // already empty — nothing to undo
+        const next = newConnections?.[slot];
+        if (next != null)
+            continue; // still bound (or rebound) — persist hook handles it
+        const req = spec.requires?.find((r) => r.inject_as === slot);
+        const cap = req?.capability ?? "";
+        const fromToken = cap && (UNPERSIST_HOOKS[cap] ? cap : null);
+        const fromProvide = !fromToken ? categoryFromProviderCapability(cap) : null;
+        shrunkSlots.push({ slot, category: fromToken ?? fromProvide ?? "default" });
+    }
+    // ── Step 3: Apply hooks ───────────────────────────────────────────────
+    const ctx = makeApplyContext({ adapter, saveInstanceJson });
+    const appliedHooks = [];
+    try {
+        // 3a: unpersist removed slots BEFORE persisting new ones — if the user
+        //     swapped one LLM provider for another, persist's overwrite already
+        //     handles it; this loop only fires for slots that genuinely went
+        //     away, so it's safe to run first. Failures here are logged and
+        //     swallowed so a stale env var or stale upstream config doesn't
+        //     block legitimate new bindings; the rollback step still recovers
+        //     the full snapshot if a later persist throws.
+        for (const { slot, category } of shrunkSlots) {
+            const hook = UNPERSIST_HOOKS[category];
+            if (!hook)
+                continue;
+            try {
+                await hook(candidate, slot, ctx);
+            }
+            catch (e) {
+                console.warn(`[connection-transactor] unpersist ${category}/${slot} for ${instance.id} failed: ${e?.message ?? e}`);
+            }
+        }
+        for (const category of APPLY_ORDER) {
+            const hook = PERSIST_HOOKS[category];
+            if (!hook)
+                continue;
+            for (const binding of resolved) {
+                if (binding.category !== category)
+                    continue;
+                await hook(candidate, binding, ctx);
+                appliedHooks.push(binding);
+            }
+        }
+    }
+    catch (e) {
+        await rollback(input, snapshot);
+        if (e instanceof ConnectionError)
+            throw e;
+        throw new ConnectionError("CONNECTION_APPLY_FAILED", 500, `Connection apply failed: ${e?.message ?? e}`, { applied: appliedHooks.map((b) => b.slot) });
+    }
+    // ── Step 4: Persist connections ───────────────────────────────────────
+    // Read-modify-write so we don't clobber `connections-env` that step 3
+    // hooks may have written for generic apps without an adapter.
+    try {
+        await saveInstanceJson(instance.id, (cur) => ({
+            ...cur,
+            connections: newConnections,
+        }));
+    }
+    catch (e) {
+        await rollback(input, snapshot);
+        throw new ConnectionError("CONNECTION_PERSIST_FAILED", 500, `Failed to persist connections: ${e?.message ?? e}`);
+    }
+    return { resolved };
+}
+function makeApplyContext(opts) {
+    return {
+        registry: capabilityRegistry,
+        adapter: opts.adapter,
+        async writeConnectionEnv(instance, env) {
+            if (Object.keys(env).length === 0)
+                return;
+            if (opts.adapter && typeof opts.adapter.applyConnectionEnv === "function") {
+                await opts.adapter.applyConnectionEnv(instance.id, env);
+                return;
+            }
+            // Generic container app — persist into instance.json["connections-env"].
+            await opts.saveInstanceJson(instance.id, (cur) => ({
+                ...cur,
+                "connections-env": {
+                    ...(cur["connections-env"] ?? {}),
+                    ...env,
+                },
+            }));
+        },
+    };
+}
+/**
+ * Test-only export so unit tests can exercise the snapshot/restore path
+ * without spinning up the full transactor. Production code should not
+ * import these names directly.
+ */
+export const __testing__ = {
+    snapshotSideEffectFiles: (instanceId) => snapshotSideEffectFiles(instanceId),
+    applyFileSnapshots: (snapshots) => applyFileSnapshots(snapshots),
+    validateResolvedEndpoints: (resolved) => validateResolvedEndpoints(resolved),
+};
+/**
+ * Walk every resolved binding and validate each provider entry's endpoint
+ * via `validateCapabilityEndpoint` (§12). Looks the provider spec up
+ * either through the app-manager (app-installed providers) or through the
+ * legacy synthesizer (instance-backed providers). When neither lookup
+ * yields a spec, the entry is left un-validated rather than rejected —
+ * the design's protection target is registry tampering after legitimate
+ * registration, and there's no spec to compare against in the missing case.
+ */
+async function validateResolvedEndpoints(resolved) {
+    if (resolved.length === 0)
+        return;
+    const { validateCapabilityEndpoint, findProviderProvide } = await import("./capability-endpoint-validator.js");
+    const { getApp } = await import("./app/app-manager.js");
+    const { loadCapabilitySpecForLegacyInstance } = await import("./runtime/migrations.js");
+    const legacyInstanceManager = await import("./instance-manager.js");
+    for (const binding of resolved) {
+        const category = binding.category;
+        for (const entry of binding.entries) {
+            // Look up the provider spec. Two paths:
+            //   1. App-installed provider — `getApp(entry.instanceId).spec`
+            //   2. Legacy instance-backed provider — synthesize from agent template
+            let providerSpec = null;
+            let isLegacySynthetic = false;
+            const appRecord = getApp(entry.instanceId);
+            if (appRecord) {
+                providerSpec = appRecord.spec;
+            }
+            else {
+                const meta = legacyInstanceManager.getInstance(entry.instanceId);
+                providerSpec = loadCapabilitySpecForLegacyInstance(meta);
+                isLegacySynthetic = !!providerSpec;
+            }
+            if (!providerSpec) {
+                // No spec we can validate against AND no live instance to synthesize
+                // one from. The registry entry is orphaned — treat as a hard reject
+                // so a tampered registry can't sneak past the validator simply by
+                // pointing at an instanceId that no longer exists.
+                const { ConnectionError } = await import("./connection-resolver.js");
+                throw new ConnectionError("INVALID_CAPABILITY_ENDPOINT", 400, `Provider '${entry.instanceId}' has no installed app or live instance — registry entry is orphaned`, {
+                    providerInstanceId: entry.instanceId,
+                    capability: entry.capability,
+                    reason: "provider-spec-missing",
+                });
+            }
+            const provide = findProviderProvide(providerSpec, entry.capability);
+            if (!provide) {
+                if (isLegacySynthetic) {
+                    // Legacy synthetic specs are minimal (id/name/requires/provides
+                    // only). If the agent template hasn't declared this capability
+                    // there's nothing to validate against — degrade rather than
+                    // reject so we don't break working bindings on older instances.
+                    continue;
+                }
+                // App-installed provider whose spec doesn't declare this capability.
+                // Either the registry was tampered to forge a capability the spec
+                // doesn't expose, or the spec drifted out of sync. Either way the
+                // safe move is to reject — apply hooks would otherwise consume a
+                // registry-supplied host/port/protocol with no spec confirmation.
+                const { ConnectionError } = await import("./connection-resolver.js");
+                throw new ConnectionError("INVALID_CAPABILITY_ENDPOINT", 400, `Provider '${entry.instanceId}' app spec does not declare capability '${entry.capability}'`, {
+                    providerInstanceId: entry.instanceId,
+                    capability: entry.capability,
+                    reason: "capability-not-in-spec",
+                });
+            }
+            validateCapabilityEndpoint(providerSpec, entry.instanceId, provide, entry, category);
+        }
+    }
+}
+/**
+ * Capture raw bytes of files that PERSIST_HOOKS may write through. Used to
+ * roll back partial mutations when a later hook throws. Files that did not
+ * exist at snapshot time are recorded with `bytes: null` and unlinked on
+ * rollback so we don't leave behind half-written state.
+ *
+ * 覆盖三类 consumer 的所有已知写入路径：
+ *   - OpenClaw：provider.env / openclaw.json / mcporter.json（V2 + legacy）
+ *   - Hermes：agent-home/config.yaml + agent-home/.env（V2 + legacy）
+ *   - Generic app-dir：apps/<id>/instance.json
+ *
+ * 路径前缀来自 INSTANCES_DIR / APPS_DIR（均读 JISHUSHELL_HOME 环境变量），
+ * 不存在的路径记为 bytes:null，回滚时做 unlink 而非写入。
+ */
+function snapshotSideEffectFiles(instanceId) {
+    const legacyHome = join(INSTANCES_DIR, instanceId);
+    const v2Home = join(APPS_DIR, instanceId);
+    const candidates = [
+        // ── Per-instance secret bag (LLM proxy-upstream) ──
+        join(legacyHome, "provider.env"),
+        // ── OpenClaw-native config (V2 + legacy layouts) ──
+        join(legacyHome, "openclaw-home", ".openclaw", "openclaw.json"),
+        join(v2Home, "openclaw-home", ".openclaw", "openclaw.json"),
+        // ── MCP server registry consumed by the OpenClaw runtime ──
+        join(legacyHome, "openclaw-home", ".openclaw", "workspace", "config", "mcporter.json"),
+        join(v2Home, "openclaw-home", ".openclaw", "workspace", "config", "mcporter.json"),
+        // ── Hermes adapter writes (V2 layout): config.yaml + .env via
+        //    applyConnectionEnv. Without these in the snapshot, a partial MCP
+        //    apply for the search slot leaves a half-written config.yaml when
+        //    a later LLM hook fails. Path matches `resolveHermesPaths`.
+        join(v2Home, "agent-home", "config.yaml"),
+        join(v2Home, "agent-home", ".env"),
+        // ── Hermes legacy layout (pre-V2 instances) ──
+        join(legacyHome, "agent-home", "config.yaml"),
+        join(legacyHome, "agent-home", ".env"),
+        // ── Generic app-dir consumer (e.g. OpenWebUI) — instance.json
+        //    holds the persisted `connections-env` map written by the
+        //    openai-env hook for non-adapter apps. Already covered by
+        //    `snapshot.instanceJson`, but listed here as an extra safety net
+        //    so a partial direct write at apps/<id>/instance.json (outside
+        //    the saveInstanceJson code path) still rolls back. ──
+        join(v2Home, "instance.json"),
+    ];
+    const out = [];
+    for (const path of candidates) {
+        try {
+            out.push({ path, bytes: existsSync(path) ? readFileSync(path) : null });
+        }
+        catch (e) {
+            if (e.code === "ENOENT") {
+                // File disappeared between existsSync and readFileSync (TOCTOU) — treat as absent.
+                out.push({ path, bytes: null });
+            }
+            else {
+                console.warn(`[connection-transactor] snapshot read failed for ${path}: ${e?.message ?? e}`);
+                out.push({ path, bytes: null, readError: true });
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Restore each file to its snapshotted bytes. Files whose snapshot recorded
+ * `bytes: null` (didn't exist pre-apply) are unlinked. Errors are logged
+ * per-file so a single failed restore doesn't block the rest.
+ */
+function applyFileSnapshots(snapshots) {
+    for (const file of snapshots) {
+        if (file.readError) {
+            console.warn(`[connection-transactor] skipping rollback for ${file.path} (snapshot read had failed)`);
+            continue;
+        }
+        try {
+            if (file.bytes === null) {
+                if (existsSync(file.path))
+                    unlinkSync(file.path);
+            }
+            else {
+                try {
+                    mkdirSync(dirname(file.path), { recursive: true });
+                }
+                catch { /* dir likely exists */ }
+                writeFileSync(file.path, file.bytes);
+            }
+        }
+        catch (e) {
+            console.error(`[connection-transactor] rollback file restore failed for ${file.path}: ${e?.message ?? e}`);
+        }
+    }
+}
+async function rollback(input, snapshot) {
+    // Restore side-effect files first so their state is consistent before the
+    // instance.json `connections` map is rewound. Failures are logged but not
+    // propagated — at this point the caller has already seen a CONNECTION_*
+    // error and we want to give every later restore step a chance to run.
+    applyFileSnapshots(snapshot.files);
+    try {
+        // Single read-modify-write that overlays the snapshot on the current
+        // instance.json — atomic rollback for the single-file state.
+        await input.saveInstanceJson(input.instance.id, () => snapshot.instanceJson);
+    }
+    catch (e) {
+        console.error(`[connection-transactor] rollback failed: ${e?.message ?? e}`);
+    }
+}
+//# sourceMappingURL=connection-transactor.js.map

package/dist/services/connection-transactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-transactor.js","sourceRoot":"","sources":["../../src/services/connection-transactor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,KAAK,kBAAkB,MAAM,0BAA0B,CAAC;AAG/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAI7D,MAAM,WAAW,GAAe,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAiC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAsB;IAC3D,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,0DAA0D;IAC1D,OAAO,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAsB;IACxD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAE9F,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB;IACnB,MAAM,SAAS,GAAgB;QAC7B,GAAG,QAAQ;QACX,WAAW,EAAE,cAAc;KAC5B,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEpE,yEAAyE;IACzE,oEAAoE;IACpE,sEAAsE;IACtE,+CAA+C;IAC/C,iDAAiD;IACjD,qEAAqE;IACrE,kEAAkE;IAClE,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAE1C,yEAAyE;IACzE,gEAAgE;IAChE,+CAA+C;IAC/C,MAAM,QAAQ,GAAuB;QACnC,YAAY,EAAE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,KAAK,EAAE,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;KAC5C,CAAC;IAEF,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,4BAA4B;IAC5B,MAAM,mBAAmB,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,IAAI,EAAE,CAA4B,CAAC;IAClG,MAAM,WAAW,GAA8C,EAAE,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAChE,IAAI,KAAK,IAAI,IAAI;YAAE,SAAS,CAAC,kCAAkC;QAC/D,MAAM,IAAI,GAAI,cAA0C,EAAE,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,IAAI,IAAI,IAAI;YAAE,SAAS,CAAC,qDAAqD;QACjF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,yEAAyE;IACzE,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAyB,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,mDAAmD;QACnD,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CACV,qCAAqC,QAAQ,IAAI,IAAI,QAAQ,QAAQ,CAAC,EAAE,YAAY,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CACtG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;oBAAE,SAAS;gBAC5C,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBACpC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY,eAAe;YAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,eAAe,CACvB,yBAAyB,EACzB,GAAG,EACH,4BAA4B,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,EAC7C,EAAE,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,8DAA8D;IAC9D,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,GAAG;YACN,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChC,MAAM,IAAI,eAAe,CACvB,2BAA2B,EAC3B,GAAG,EACH,kCAAkC,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAGzB;IACC,OAAO;QACL,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,CAAC,kBAAkB,CAAC,QAAQ,EAAE,GAAG;YACpC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAC1C,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;gBAC1E,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,yEAAyE;YACzE,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACjD,GAAG,GAAG;gBACN,iBAAiB,EAAE;oBACjB,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;oBACjC,GAAG,GAAG;iBACP;aACF,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,uBAAuB,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,uBAAuB,CAAC,UAAU,CAAC;IACpF,kBAAkB,EAAE,CAAC,SAAyB,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC;IAChF,yBAAyB,EAAE,CAAC,QAA8B,EAAE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,CAAC;CACnG,CAAC;AAEF;;;;;;;;GAQG;AACH,KAAK,UAAU,yBAAyB,CAAC,QAA8B;IACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CACtE,oCAAoC,CACrC,CAAC;IACF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACxD,MAAM,EAAE,mCAAmC,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACxF,MAAM,qBAAqB,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAEpE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAI,OAAO,CAAC,QAA6D,CAAC;QACxF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,wCAAwC;YACxC,gEAAgE;YAChE,wEAAwE;YACxE,IAAI,YAAY,GAAQ,IAAI,CAAC;YAC7B,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,SAAS,EAAE,CAAC;gBACd,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,qBAAqB,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACjE,YAAY,GAAG,mCAAmC,CAAC,IAAI,CAAC,CAAC;gBACzD,iBAAiB,GAAG,CAAC,CAAC,YAAY,CAAC;YACrC,CAAC;YAED,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,qEAAqE;gBACrE,oEAAoE;gBACpE,kEAAkE;gBAClE,mDAAmD;gBACnD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;gBACrE,MAAM,IAAI,eAAe,CACvB,6BAA6B,EAC7B,GAAG,EACH,aAAa,KAAK,CAAC,UAAU,sEAAsE,EACnG;oBACE,kBAAkB,EAAE,KAAK,CAAC,UAAU;oBACpC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,uBAAuB;iBAChC,CACF,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YACpE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,iBAAiB,EAAE,CAAC;oBACtB,gEAAgE;oBAChE,+DAA+D;oBAC/D,4DAA4D;oBAC5D,gEAAgE;oBAChE,SAAS;gBACX,CAAC;gBACD,qEAAqE;gBACrE,kEAAkE;gBAClE,kEAAkE;gBAClE,iEAAiE;gBACjE,kEAAkE;gBAClE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;gBACrE,MAAM,IAAI,eAAe,CACvB,6BAA6B,EAC7B,GAAG,EACH,aAAa,KAAK,CAAC,UAAU,2CAA2C,KAAK,CAAC,UAAU,GAAG,EAC3F;oBACE,kBAAkB,EAAE,KAAK,CAAC,UAAU;oBACpC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,wBAAwB;iBACjC,CACF,CAAC;YACJ,CAAC;YACD,0BAA0B,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,uBAAuB,CAAC,UAAkB;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG;QACjB,qDAAqD;QACrD,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC;QAChC,qDAAqD;QACrD,IAAI,CAAC,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,CAAC;QAC/D,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,CAAC;QAC3D,6DAA6D;QAC7D,IAAI,CAAC,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,CAAC;QACtF,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,CAAC;QAClF,+DAA+D;QAC/D,sEAAsE;QACtE,sEAAsE;QACtE,gEAAgE;QAChE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC;QAClC,gDAAgD;QAChD,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC;QACtC,+DAA+D;QAC/D,8DAA8D;QAC9D,8DAA8D;QAC9D,qEAAqE;QACrE,mEAAmE;QACnE,0DAA0D;QAC1D,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC;KAC9B,CAAC;IACF,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnD,mFAAmF;gBACnF,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,oDAAoD,IAAI,KAAK,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC7F,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,SAAyB;IACnD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,iDAAiD,IAAI,CAAC,IAAI,6BAA6B,CAAC,CAAC;YACtG,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBACxB,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;gBACnC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,4DAA4D,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAsB,EAAE,QAA4B;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,sEAAsE;IACtE,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEnC,IAAI,CAAC;QACH,qEAAqE;QACrE,6DAA6D;QAC7D,MAAM,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC"}

package/dist/services/external-mounts.d.ts

@@ -0,0 +1,40 @@
+export interface ExternalMount {
+    alias: string;
+    host_path: string;
+    mode: "ro" | "rw";
+    description?: string;
+}
+export interface MountValidationError {
+    field: string;
+    message: string;
+}
+export interface MountValidationResult {
+    ok: boolean;
+    errors: MountValidationError[];
+    warnings: string[];
+}
+/**
+ * Validate a single mount candidate. Returns {ok, errors, warnings};
+ * warnings flag sensitive paths (e.g. ~/.ssh) but do NOT block the
+ * caller — that call is the user's policy decision.
+ */
+export declare function validateMount(m: Partial<ExternalMount>, existing?: ExternalMount[]): MountValidationResult;
+/**
+ * Resolve a files/-relative path that MIGHT start with an external
+ * mount alias to its true host filesystem path. Returns null when the
+ * path doesn't begin with a registered alias — caller falls back to
+ * `FILES_ROOT/<rel>`.
+ *
+ * Symlink defense and path-safety MUST run on the returned absolute
+ * path against `mount.host_path` (not FILES_ROOT) — caller's job.
+ */
+export declare function resolveAcrossMounts(rel: string, mounts: ExternalMount[]): {
+    abs: string;
+    mount: ExternalMount;
+    remainder: string;
+} | null;
+/**
+ * Returns true if the given files/-relative path lands inside a
+ * read-only mount (any operation that mutates must reject early).
+ */
+export declare function isReadOnlyTarget(rel: string, mounts: ExternalMount[]): boolean;

package/dist/services/external-mounts.js

@@ -0,0 +1,187 @@
+/**
+ * External mounts — let any host directory appear as a virtual subtree
+ * inside ~/.jishushell/files/ (M3 W4 PR-4).
+ *
+ * Design choice: virtualize at the FilesManager layer rather than
+ * planting a symlink under FILES_ROOT.
+ *
+ *   1. The W1 symlink-defense rejects ALL symlinks anywhere in the
+ *      path chain. We don't want to whitelist symlinks generally;
+ *      the alias check must be code-explicit.
+ *   2. Symlinks behave inconsistently across docker bind mounts,
+ *      WebDAV clients, and macOS APFS firmlinks. A virtual layer
+ *      sidesteps the entire mess.
+ *   3. Listing the FILES_ROOT directory cannot include a symlink
+ *      that points outside (the listing helper hides them); a
+ *      virtual entry is just a synthesized DirEntry.
+ *
+ * The user-visible model:
+ *   files/                     ← real POSIX root
+ *   ├── notes/                 ← real subdirectory
+ *   ├── photos/                ← real subdirectory
+ *   └── Documents/             ← VIRTUAL — host_path = /Users/me/Documents
+ *
+ * From every layer's perspective (panel UI, /api/files/*, WebDAV,
+ * Agent drive shim), Documents/ behaves like any other directory.
+ * Mode "ro" is enforced uniformly.
+ *
+ * Sensitive paths flagged by sanity-check (caller can override):
+ *   /etc, /proc, /sys, /dev, /var/log, ~/.ssh, ~/.aws, ~/.gnupg,
+ *   anywhere inside JISHUSHELL_HOME (would create recursion)
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { homedir } from "node:os";
+import { JISHUSHELL_HOME, FILES_ROOT } from "../config.js";
+const ALIAS_RE = /^[a-zA-Z0-9_][a-zA-Z0-9_.-]{0,63}$/;
+const DENY_PREFIXES = [
+    "/etc",
+    "/proc",
+    "/sys",
+    "/dev",
+    "/run",
+    "/boot",
+    "/var/log",
+    "/var/lib",
+];
+const SUSPICIOUS_HIDDEN = [".ssh", ".aws", ".gnupg", ".config/gh"];
+/**
+ * Reserved aliases that cannot be used because they collide with
+ * panel-internal directories or W1.5 / W2 conventions.
+ */
+const RESERVED_ALIASES = new Set([
+    ".trash",
+    "agent-data",
+    "legacy",
+    "skills",
+    "memory",
+    ".knowledge",
+]);
+/**
+ * Validate a single mount candidate. Returns {ok, errors, warnings};
+ * warnings flag sensitive paths (e.g. ~/.ssh) but do NOT block the
+ * caller — that call is the user's policy decision.
+ */
+export function validateMount(m, existing = []) {
+    const errors = [];
+    const warnings = [];
+    // alias
+    if (!m.alias || typeof m.alias !== "string") {
+        errors.push({ field: "alias", message: "required string" });
+    }
+    else if (!ALIAS_RE.test(m.alias)) {
+        errors.push({
+            field: "alias",
+            message: "must match [a-zA-Z0-9_.-]+ (no slashes), <= 64 chars",
+        });
+    }
+    else if (RESERVED_ALIASES.has(m.alias)) {
+        errors.push({ field: "alias", message: `"${m.alias}" is a reserved alias` });
+    }
+    else if (existing.some((e) => e.alias === m.alias)) {
+        errors.push({ field: "alias", message: `"${m.alias}" already in use` });
+    }
+    // mode
+    if (m.mode !== "ro" && m.mode !== "rw") {
+        errors.push({ field: "mode", message: 'must be "ro" or "rw"' });
+    }
+    // host_path
+    if (!m.host_path || typeof m.host_path !== "string") {
+        errors.push({ field: "host_path", message: "required absolute path" });
+    }
+    else if (!path.isAbsolute(m.host_path)) {
+        errors.push({ field: "host_path", message: "must be absolute" });
+    }
+    else {
+        // Resolve any ~ expansion the caller forgot
+        const resolved = m.host_path.startsWith("~")
+            ? path.join(homedir(), m.host_path.slice(1))
+            : path.resolve(m.host_path);
+        if (!fs.existsSync(resolved)) {
+            errors.push({
+                field: "host_path",
+                message: `path does not exist: ${resolved}`,
+            });
+        }
+        else {
+            try {
+                const stat = fs.lstatSync(resolved);
+                if (stat.isSymbolicLink()) {
+                    errors.push({
+                        field: "host_path",
+                        message: "must be a real directory, not a symlink",
+                    });
+                }
+                else if (!stat.isDirectory()) {
+                    errors.push({
+                        field: "host_path",
+                        message: "must be a directory",
+                    });
+                }
+            }
+            catch (e) {
+                errors.push({
+                    field: "host_path",
+                    message: `cannot stat: ${e.message}`,
+                });
+            }
+            // Recursion guard: must not be inside FILES_ROOT or JISHUSHELL_HOME
+            if (resolved === FILES_ROOT ||
+                resolved.startsWith(FILES_ROOT + path.sep) ||
+                resolved === JISHUSHELL_HOME ||
+                resolved.startsWith(JISHUSHELL_HOME + path.sep)) {
+                errors.push({
+                    field: "host_path",
+                    message: "cannot mount a path inside ~/.jishushell — would cause recursion",
+                });
+            }
+            // Sensitive prefix warnings (do not block)
+            for (const prefix of DENY_PREFIXES) {
+                if (resolved === prefix || resolved.startsWith(prefix + "/")) {
+                    warnings.push(`host_path is under ${prefix} — system directory, mode=ro is strongly recommended`);
+                    break;
+                }
+            }
+            for (const hidden of SUSPICIOUS_HIDDEN) {
+                if (resolved.includes(`/${hidden}`) || resolved.includes(`\\${hidden}`)) {
+                    warnings.push(`host_path contains "${hidden}" — likely holds credentials, mode=ro recommended`);
+                    break;
+                }
+            }
+        }
+    }
+    return { ok: errors.length === 0, errors, warnings };
+}
+/**
+ * Resolve a files/-relative path that MIGHT start with an external
+ * mount alias to its true host filesystem path. Returns null when the
+ * path doesn't begin with a registered alias — caller falls back to
+ * `FILES_ROOT/<rel>`.
+ *
+ * Symlink defense and path-safety MUST run on the returned absolute
+ * path against `mount.host_path` (not FILES_ROOT) — caller's job.
+ */
+export function resolveAcrossMounts(rel, mounts) {
+    if (!rel)
+        return null;
+    const slash = rel.indexOf("/");
+    const first = slash < 0 ? rel : rel.slice(0, slash);
+    const remainder = slash < 0 ? "" : rel.slice(slash + 1);
+    const m = mounts.find((x) => x.alias === first);
+    if (!m)
+        return null;
+    const expanded = m.host_path.startsWith("~")
+        ? path.join(homedir(), m.host_path.slice(1))
+        : path.resolve(m.host_path);
+    const abs = remainder ? path.join(expanded, remainder) : expanded;
+    return { abs, mount: m, remainder };
+}
+/**
+ * Returns true if the given files/-relative path lands inside a
+ * read-only mount (any operation that mutates must reject early).
+ */
+export function isReadOnlyTarget(rel, mounts) {
+    const m = resolveAcrossMounts(rel, mounts);
+    return !!(m && m.mount.mode === "ro");
+}
+//# sourceMappingURL=external-mounts.js.map

package/dist/services/external-mounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-mounts.js","sourceRoot":"","sources":["../../src/services/external-mounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAoB3D,MAAM,QAAQ,GAAG,oCAAoC,CAAC;AAEtD,MAAM,aAAa,GAAG;IACpB,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,UAAU;CACX,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,YAAY;CACb,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,CAAyB,EACzB,WAA4B,EAAE;IAE9B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,QAAQ;IACR,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,sDAAsD;SAChE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,uBAAuB,EAAE,CAAC,CAAC;IAC/E,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;IACP,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,YAAY;IACZ,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACzE,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAE9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,wBAAwB,QAAQ,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC;wBACV,KAAK,EAAE,WAAW;wBAClB,OAAO,EAAE,yCAAyC;qBACnD,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC;wBACV,KAAK,EAAE,WAAW;wBAClB,OAAO,EAAE,qBAAqB;qBAC/B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,gBAAgB,CAAC,CAAC,OAAO,EAAE;iBACrC,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,IACE,QAAQ,KAAK,UAAU;gBACvB,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC;gBAC1C,QAAQ,KAAK,eAAe;gBAC5B,QAAQ,CAAC,UAAU,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,EAC/C,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,kEAAkE;iBAC5E,CAAC,CAAC;YACL,CAAC;YAED,2CAA2C;YAC3C,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;gBACnC,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;oBAC7D,QAAQ,CAAC,IAAI,CACX,sBAAsB,MAAM,sDAAsD,CACnF,CAAC;oBACF,MAAM;gBACR,CAAC;YACH,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;gBACvC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,EAAE,CAAC,EAAE,CAAC;oBACxE,QAAQ,CAAC,IAAI,CACX,uBAAuB,MAAM,mDAAmD,CACjF,CAAC;oBACF,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,MAAuB;IAEvB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAC1C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,MAAuB;IAEvB,MAAM,CAAC,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACxC,CAAC"}