lastlight 0.16.0 → 0.16.1

package/dist/sandbox/sandbox.js

@@ -1,453 +0,0 @@
-import { join, relative } from "path";
-import { mkdtempSync, mkdirSync, rmSync } from "fs";
-import { tmpdir } from "os";
-import { spawnSync } from "child_process";
-import { createTaskSandbox, setupTaskWorktree, prePopulateWorkspace } from "./index.js";
-import { SmolSandbox as SmolDriver, smolAvailable, SMOL_WORKSPACE_DIR } from "./smol.js";
-import { ALLOW_ALL_SENTINEL } from "./egress-allowlist.js";
-import { getDockerSandboxOtelEnv, getOtelEnvForSandbox } from "../telemetry/index.js";
-import { DOCKER_WORKSPACE_DIR, SKILL_BUNDLE_ROOT, stageSkillBundle, excludeFromGit, applyEnv, } from "../engine/executors/shared.js";
-/**
- * Inner-run git identity, shared by every adapter's agent path. Takes the
- * resolved bot login (e.g. `last-light[bot]` / `nearform-lastlight[bot]`) so
- * agent commits are attributed to the actual App — including a `BOT_LOGIN`
- * override, which the caller resolves before passing it here.
- */
-export function agentGitIdentityEnv(botLogin) {
-    const login = botLogin;
-    return {
-        GIT_AUTHOR_NAME: login,
-        GIT_AUTHOR_EMAIL: `${login}@users.noreply.github.com`,
-        GIT_COMMITTER_NAME: login,
-        GIT_COMMITTER_EMAIL: `${login}@users.noreply.github.com`,
-        // /workspace is a host-UID bind mount into a different-UID guest; git refuses
-        // to operate without an explicit safe-directory. GIT_CONFIG_* avoids needing
-        // a writeable ~/.gitconfig.
-        GIT_CONFIG_COUNT: "1",
-        GIT_CONFIG_KEY_0: "safe.directory",
-        GIT_CONFIG_VALUE_0: "*",
-    };
-}
-/**
- * The single factory replacing the `if (backend === …)` ladder. Given a
- * backend and construction opts, returns the matching adapter. Docker's
- * old null-fallback is now a thrown error from `provision` (the orchestrator's
- * bracket surfaces it), so this never returns null.
- */
-export function sandboxFor(backend, opts) {
-    switch (backend) {
-        case "docker":
-            return new DockerSandbox(opts);
-        case "smol":
-            return new SmolSandbox(opts);
-        case "gondolin":
-            return new InProcessSandbox("gondolin", opts);
-        case "none":
-            return new InProcessSandbox("none", opts);
-    }
-}
-// ── Docker adapter ──────────────────────────────────────────────────
-/**
- * Wraps the docker container driver ({@link DockerDriver}) + the
- * `createTaskSandbox` provisioning helper. Egress is the strict/open coredns
- * pair selected by `--dns`; the host constants live here.
- */
-class DockerSandbox {
-    opts;
-    backend = "docker";
-    sbx;
-    agentCwd = DOCKER_WORKSPACE_DIR;
-    constructor(opts) {
-        this.opts = opts;
-    }
-    async provision(pre) {
-        // Strict allowlist by default; an `unrestricted_egress` phase points at the
-        // open coredns sidecar instead. IPs match docker-compose.yml's static
-        // assignments (see src/sandbox/egress-firewall-config.ts).
-        const dnsIp = this.opts.egress.unrestricted
-            ? process.env.LASTLIGHT_DNS_OPEN || "172.30.0.11"
-            : process.env.LASTLIGHT_DNS_STRICT || "172.30.0.10";
-        const sbx = await createTaskSandbox({
-            taskId: this.opts.taskId,
-            stateDir: this.opts.stateDir,
-            sandboxDir: this.opts.sandboxDir,
-            env: this.opts.env,
-            prePopulate: pre,
-            dnsIp,
-            imageName: this.opts.imageName,
-        });
-        if (!sbx) {
-            throw new Error("LASTLIGHT_SANDBOX=docker but no docker sandbox was available. " +
-                "Install Docker and build the sandbox image, or set LASTLIGHT_SANDBOX=gondolin / none.");
-        }
-        this.sbx = sbx;
-        this.agentCwd = pre ? `${DOCKER_WORKSPACE_DIR}/${pre.repo}` : DOCKER_WORKSPACE_DIR;
-        return { hostWorkspaceDir: sbx.workDir, agentCwd: this.agentCwd };
-    }
-    stageSkills(phaseKey, skillPaths) {
-        if (!this.sbx)
-            throw new Error("DockerSandbox.stageSkills before provision");
-        // Copy (not symlink): the agent's tools run inside the container and host
-        // symlink targets wouldn't resolve there. Map host dests → in-container paths.
-        const staged = stageSkillBundle(this.sbx.workDir, phaseKey, skillPaths, "copy");
-        if (!staged)
-            return undefined;
-        return staged.map((d) => `${DOCKER_WORKSPACE_DIR}/${relative(this.sbx.workDir, d)}`);
-    }
-    sandboxPathFor(relPath) {
-        return `${DOCKER_WORKSPACE_DIR}/${relPath}`;
-    }
-    async runAgent(taskId, prompt, opts, onEvent) {
-        if (!this.sbx)
-            throw new Error("DockerSandbox.runAgent before provision");
-        await this.sbx.sandbox.runAgent(taskId, prompt, {
-            model: opts.model,
-            thinking: opts.thinking,
-            profile: opts.profile,
-            sandboxEnv: this.innerAgentEnv(opts.sandboxEnv),
-            agentCwd: opts.agentCwd,
-            skillDirs: opts.skillDirs,
-            webSearch: opts.webSearch,
-            webSearchProvider: opts.webSearchProvider,
-            onLine: parseLine(onEvent),
-        });
-        return undefined;
-    }
-    async runCommand(taskId, command, opts) {
-        if (!this.sbx)
-            throw new Error("DockerSandbox.runCommand before provision");
-        return this.sbx.sandbox.runCommand(taskId, command, {
-            cwd: opts.cwd,
-            sandboxEnv: opts.sandboxEnv,
-            timeoutSeconds: opts.timeoutSeconds,
-            onLine: () => { },
-        });
-    }
-    async dispose() {
-        if (this.sbx)
-            await this.sbx.cleanup();
-    }
-    /** Git identity + (inside-container) OTEL collector env. */
-    innerAgentEnv(base) {
-        const otel = this.opts.otel?.enabled && this.opts.otel.forwardToSandbox ? getDockerSandboxOtelEnv() : {};
-        return { ...otel, ...base };
-    }
-}
-// ── smol adapter ────────────────────────────────────────────────────
-/**
- * Wraps the smolvm micro-VM driver ({@link SmolDriver}). Egress is native
- * per-machine `--allow-host`; unrestricted → null (open). Provisioning boots
- * the VM first, then probes the share-backed host dir before cloning into it.
- */
-class SmolSandbox {
-    opts;
-    backend = "smol";
-    driver;
-    agentCwd = SMOL_WORKSPACE_DIR;
-    hostWorkspaceDir = "";
-    constructor(opts) {
-        this.opts = opts;
-    }
-    async provision(pre) {
-        if (!smolAvailable()) {
-            throw new Error("LASTLIGHT_SANDBOX=smol but the smolvm CLI is not available. " +
-                "Install smolvm (https://smolmachines.com) and start `smolvm serve`, " +
-                "or set LASTLIGHT_SANDBOX=docker / gondolin / none.");
-        }
-        // Boot FIRST (workspace dir mounted), then provision the probed share. No
-        // pre-clone here — see SmolSandbox.resolveHostWorkspace for why the mount
-        // source isn't always the share root.
-        const workDir = setupTaskWorktree({
-            taskId: this.opts.taskId,
-            stateDir: this.opts.stateDir,
-            sandboxDir: this.opts.sandboxDir,
-        });
-        this.driver = new SmolDriver({
-            env: this.opts.env,
-            allowHosts: this.opts.egress.unrestricted ? null : this.opts.egress.hosts,
-        });
-        const machine = await this.driver.create({ taskId: this.opts.taskId, worktreePath: workDir });
-        const hostWs = machine.hostWorkspace;
-        if (pre)
-            prePopulateWorkspace(hostWs, pre);
-        this.hostWorkspaceDir = hostWs;
-        this.agentCwd = pre ? `${SMOL_WORKSPACE_DIR}/${pre.repo}` : SMOL_WORKSPACE_DIR;
-        return { hostWorkspaceDir: hostWs, agentCwd: this.agentCwd };
-    }
-    stageSkills(phaseKey, skillPaths) {
-        const staged = stageSkillBundle(this.hostWorkspaceDir, phaseKey, skillPaths, "copy");
-        if (!staged)
-            return undefined;
-        return staged.map((d) => `${SMOL_WORKSPACE_DIR}/${relative(this.hostWorkspaceDir, d)}`);
-    }
-    sandboxPathFor(relPath) {
-        return `${SMOL_WORKSPACE_DIR}/${relPath}`;
-    }
-    async runAgent(taskId, prompt, opts, onEvent) {
-        if (!this.driver)
-            throw new Error("SmolSandbox.runAgent before provision");
-        await this.driver.runAgent(taskId, prompt, {
-            model: opts.model,
-            thinking: opts.thinking,
-            profile: opts.profile,
-            sandboxEnv: opts.sandboxEnv,
-            agentCwd: opts.agentCwd,
-            skillDirs: opts.skillDirs,
-            webSearch: opts.webSearch,
-            webSearchProvider: opts.webSearchProvider,
-            onLine: parseLine(onEvent),
-        });
-        return undefined;
-    }
-    async runCommand(taskId, command, opts) {
-        if (!this.driver)
-            throw new Error("SmolSandbox.runCommand before provision");
-        return this.driver.runCommand(taskId, command, {
-            cwd: opts.cwd,
-            sandboxEnv: opts.sandboxEnv,
-            timeoutSeconds: opts.timeoutSeconds,
-            onLine: () => { },
-        });
-    }
-    async dispose() {
-        if (this.driver)
-            await this.driver.destroy(this.opts.taskId);
-    }
-}
-// ── In-process adapter (gondolin / none) ────────────────────────────
-/**
- * **One** adapter for the two in-process backends, parameterized by
- * `mode: 'gondolin' | 'none'`. The two differ only in agentic-pi's `sandbox`
- * arg and a `HOME` override. Owns the `applyEnv`/restore `process.env` splice
- * and the lazy `import("agentic-pi")`.
- *
- * The `mode` flag is a **tombstone** for gondolin's planned removal — when
- * gondolin is retired it collapses to single-mode `none`.
- */
-class InProcessSandbox {
-    mode;
-    opts;
-    backend;
-    hostWorkspaceDir = "";
-    agentCwd = "";
-    constructor(mode, opts) {
-        this.mode = mode;
-        this.opts = opts;
-        this.backend = mode;
-    }
-    async provision(pre) {
-        const workDir = setupTaskWorktree({
-            taskId: this.opts.taskId,
-            stateDir: this.opts.stateDir,
-            sandboxDir: this.opts.sandboxDir,
-            prePopulate: pre,
-        });
-        this.hostWorkspaceDir = workDir;
-        // When pre-cloned, cwd is the checkout so the agent runs inside the repo
-        // with no `cd` preamble; otherwise the workspace root. `repoSubdir` lets a
-        // caller that pre-seeded a `<workspace>/<repo>/` checkout nest the cwd the
-        // same way without a clone (the evals harness) — workDir (the root) stays
-        // hostWorkspaceDir so AGENTS.md/skills remain siblings outside the repo.
-        if (pre) {
-            this.agentCwd = join(workDir, pre.repo);
-        }
-        else if (this.opts.repoSubdir) {
-            this.agentCwd = join(workDir, this.opts.repoSubdir);
-            mkdirSync(this.agentCwd, { recursive: true });
-        }
-        else {
-            this.agentCwd = workDir;
-        }
-        return { hostWorkspaceDir: workDir, agentCwd: this.agentCwd };
-    }
-    stageSkills(phaseKey, skillPaths) {
-        // none: stage at the workspace ROOT (host FS fully visible), by symlink —
-        // the host resolves it and it's the cheap/CI path. gondolin mounts ONLY cwd
-        // into the guest, so its bundle is staged under the repo (inside the mount)
-        // AND must be COPIED, not symlinked: a symlink's target is the skill source
-        // in the install tree (outside cwd), which isn't mounted, so it would dangle
-        // in the guest and the agent couldn't read SKILL.md. Copying (dereferenced)
-        // lands the real files inside the mount, exactly as docker does. The bundle
-        // is added to the checkout's local `.git/info/exclude` so it's never committed.
-        const gondolin = this.mode === "gondolin";
-        const skillRoot = gondolin ? this.agentCwd : this.hostWorkspaceDir;
-        const staged = stageSkillBundle(skillRoot, phaseKey, skillPaths, gondolin ? "copy" : "symlink");
-        if (staged && gondolin)
-            excludeFromGit(this.agentCwd, SKILL_BUNDLE_ROOT);
-        return staged; // paths inside cwd → agentic-pi maps them into the guest's /workspace
-    }
-    sandboxPathFor(relPath) {
-        return join(this.hostWorkspaceDir, relPath);
-    }
-    async runAgent(_taskId, prompt, opts, onEvent) {
-        // agentic-pi reads its own env (provider keys, App PEM, …) from
-        // process.env. Splice in our scoped values for the call, then restore.
-        const restore = applyEnv(this.opts.env);
-        const allowedHttpHosts = this.opts.egress.unrestricted ? [ALLOW_ALL_SENTINEL] : this.opts.egress.hosts;
-        try {
-            // Loaded lazily: agentic-pi transitively poisons the global undici
-            // dispatcher on import, which would break the harness's own fetch. The
-            // dynamic import keeps the harness clean unless an in-process run happens.
-            const { run: agenticRun } = await import("agentic-pi");
-            return await agenticRun({
-                model: opts.model,
-                prompt,
-                thinking: opts.thinking,
-                profile: opts.profile,
-                authFile: opts.authFile,
-                githubApiBaseUrl: opts.githubApiBaseUrl,
-                sandbox: this.mode === "gondolin" ? "gondolin" : "none",
-                sandboxEnv: this.innerAgentEnv(opts.sandboxEnv),
-                cwd: opts.agentCwd,
-                noSession: true,
-                skillPaths: opts.skillDirs,
-                allowedHttpHosts,
-                webSearch: opts.webSearch === true,
-                webSearchProvider: opts.webSearchProvider,
-                onEvent,
-                onWarn: (msg) => console.warn(`[agentic] ${msg}`),
-            });
-        }
-        finally {
-            restore();
-        }
-    }
-    async runCommand(_taskId, command, opts) {
-        // gondolin / none run the command on the host worktree via spawnSync — the
-        // same degraded model those backends already used.
-        const proc = spawnSync("sh", ["-c", command], {
-            cwd: opts.cwd,
-            env: { ...process.env, ...this.opts.env, ...(opts.sandboxEnv ?? {}) },
-            encoding: "utf-8",
-            timeout: opts.timeoutSeconds * 1000,
-            maxBuffer: 256 * 1024 * 1024,
-        });
-        const exitCode = proc.status ?? (proc.signal ? 124 : 1);
-        return {
-            exitCode,
-            stdout: proc.stdout ?? "",
-            stderr: proc.stderr ?? "",
-            timedOut: proc.signal === "SIGTERM",
-        };
-    }
-    dispose() {
-        // No isolation primitive to tear down — the env splice is restored inside
-        // runAgent, and the worktree is reaped elsewhere.
-    }
-    /** Git identity + OTEL env + (gondolin only) a HOME override into the VM. */
-    innerAgentEnv(base) {
-        const otel = this.opts.otel?.enabled && this.opts.otel.forwardToSandbox ? getOtelEnvForSandbox() : {};
-        // gondolin: the VM user inherits HOME from the agentic-pi process (the
-        // host's HOME leaks in). Force HOME=/root so `git config --global` /
-        // `gh auth status` write to a real path inside the VM. none runs on the
-        // host — never override HOME.
-        const homeOverride = this.mode === "gondolin" ? { HOME: "/root", USER: "root", LOGNAME: "root" } : {};
-        return { ...otel, ...base, ...homeOverride };
-    }
-}
-/**
- * In-memory `Sandbox` adapter for unit-testing the orchestrator without
- * Docker/VMs. `provision()` returns a **real** `mkdtemp` workspace (so skill
- * staging + artifact harvest run for real), `runAgent` replays a canned array
- * of pi event records through `onEvent`, and it **records** the opts it
- * received for assertions. Covers Last Light's orchestration, not agentic-pi's
- * semantics.
- *
- * Inject it via the optional `sandboxFactory` on `executeAgent`/`executeCommand`
- * — see {@link FakeSandbox.asFactory}.
- */
-export class FakeSandbox {
-    behavior;
-    backend = "none";
-    // Recorded for assertions.
-    egress;
-    env;
-    hostWorkspaceDir = "";
-    agentCwd = "";
-    stagedSkillDirs;
-    receivedAgentOpts;
-    receivedCommandOpts;
-    receivedCommand;
-    provisionCalls = 0;
-    disposed = false;
-    constructor(behavior = {}) {
-        this.behavior = behavior;
-    }
-    /**
-     * Build a {@link SandboxFactory} that always returns THIS instance, capturing
-     * the construction opts (egress, env, backend) for later inspection.
-     */
-    asFactory() {
-        return (backend, opts) => {
-            this.backend = backend;
-            this.egress = opts.egress;
-            this.env = opts.env;
-            return this;
-        };
-    }
-    async provision(pre) {
-        this.provisionCalls += 1;
-        const dir = mkdtempSync(join(tmpdir(), "fake-sbx-"));
-        this.hostWorkspaceDir = dir;
-        this.agentCwd = pre ? join(dir, pre.repo) : dir;
-        if (pre)
-            mkdirSync(this.agentCwd, { recursive: true });
-        return { hostWorkspaceDir: dir, agentCwd: this.agentCwd };
-    }
-    stageSkills(phaseKey, skillPaths) {
-        this.stagedSkillDirs = stageSkillBundle(this.hostWorkspaceDir, phaseKey, skillPaths, "symlink");
-        return this.stagedSkillDirs;
-    }
-    sandboxPathFor(relPath) {
-        return join(this.hostWorkspaceDir, relPath);
-    }
-    async runAgent(_taskId, _prompt, opts, onEvent) {
-        this.receivedAgentOpts = opts;
-        if (this.behavior.throwOnRunAgent)
-            throw asError(this.behavior.throwOnRunAgent);
-        for (const record of this.behavior.events ?? [])
-            onEvent(record);
-        return this.behavior.returnRunResult;
-    }
-    async runCommand(_taskId, command, opts) {
-        this.receivedCommand = command;
-        this.receivedCommandOpts = opts;
-        if (this.behavior.throwOnRunCommand)
-            throw asError(this.behavior.throwOnRunCommand);
-        return this.behavior.commandResult ?? { exitCode: 0, stdout: "", stderr: "", timedOut: false };
-    }
-    dispose() {
-        this.disposed = true;
-        try {
-            if (this.hostWorkspaceDir)
-                rmSync(this.hostWorkspaceDir, { recursive: true, force: true });
-        }
-        catch {
-            /* best effort */
-        }
-    }
-}
-// ── helpers ─────────────────────────────────────────────────────────
-function asError(e) {
-    return e instanceof Error ? e : new Error(e);
-}
-/**
- * Wrap an `onEvent(record)` consumer as an `onLine(line)` handler for the
- * subprocess (docker/smol) drivers: apply the cheap `{`-prefix guard, parse
- * JSON, and forward the parsed record. Non-JSON / malformed lines are dropped.
- */
-function parseLine(onEvent) {
-    return (line) => {
-        if (!line.startsWith("{"))
-            return;
-        let record;
-        try {
-            record = JSON.parse(line);
-        }
-        catch {
-            return;
-        }
-        onEvent(record);
-    };
-}
-//# sourceMappingURL=sandbox.js.map

package/dist/sandbox/sandbox.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/sandbox/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG1C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAExF,OAAO,EAAE,WAAW,IAAI,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,QAAQ,GACT,MAAM,+BAA+B,CAAC;AAsKvC;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,KAAK,GAAG,QAAQ,CAAC;IACvB,OAAO;QACL,eAAe,EAAE,KAAK;QACtB,gBAAgB,EAAE,GAAG,KAAK,2BAA2B;QACrD,kBAAkB,EAAE,KAAK;QACzB,mBAAmB,EAAE,GAAG,KAAK,2BAA2B;QACxD,8EAA8E;QAC9E,6EAA6E;QAC7E,4BAA4B;QAC5B,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,gBAAgB;QAClC,kBAAkB,EAAE,GAAG;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAAuB,EAAE,IAAwB;IAC1E,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM;YACT,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,IAAI,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAChD,KAAK,MAAM;YACT,OAAO,IAAI,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,aAAa;IAKY;IAJpB,OAAO,GAAmB,QAAQ,CAAC;IACpC,GAAG,CAA4E;IAC/E,QAAQ,GAAG,oBAAoB,CAAC;IAExC,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;IAAG,CAAC;IAEzD,KAAK,CAAC,SAAS,CAAC,GAAqB;QACnC,4EAA4E;QAC5E,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY;YACzC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,aAAa;YACjD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,aAAa,CAAC;QAEtD,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC;YAClC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YAClB,WAAW,EAAE,GAAG;YAChB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAC9D,uFAAuF,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,oBAAoB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACnF,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACpE,CAAC;IAED,WAAW,CAAC,QAAgB,EAAE,UAAgC;QAC5D,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC7E,0EAA0E;QAC1E,+EAA+E;QAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,oBAAoB,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,OAAO,GAAG,oBAAoB,IAAI,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,MAAc,EACd,IAAkB,EAClB,OAAuC;QAEvC,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE;YAC9C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,IAAoB;QACpE,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE;YAClD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,4DAA4D;IACpD,aAAa,CAAC,IAA4B;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IAC9B,CAAC;CACF;AAED,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,WAAW;IAMc;IALpB,OAAO,GAAmB,MAAM,CAAC;IAClC,MAAM,CAAc;IACpB,QAAQ,GAAG,kBAAkB,CAAC;IAC9B,gBAAgB,GAAG,EAAE,CAAC;IAE9B,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;IAAG,CAAC;IAEzD,KAAK,CAAC,SAAS,CAAC,GAAqB;QACnC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,8DAA8D;gBAC5D,sEAAsE;gBACtE,oDAAoD,CACvD,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,sCAAsC;QACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC;YAC3B,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YAClB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;SAC1E,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,GAAG;YAAE,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,kBAAkB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC/D,CAAC;IAED,WAAW,CAAC,QAAgB,EAAE,UAAgC;QAC5D,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,IAAI,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,OAAO,GAAG,kBAAkB,IAAI,OAAO,EAAE,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,MAAc,EACd,IAAkB,EAClB,OAAuC;QAEvC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3E,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE;YACzC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,IAAoB;QACpE,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE;YAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,uEAAuE;AAEvE;;;;;;;;GAQG;AACH,MAAM,gBAAgB;IAMD;IACA;IANV,OAAO,CAAiB;IACzB,gBAAgB,GAAG,EAAE,CAAC;IACtB,QAAQ,GAAG,EAAE,CAAC;IAEtB,YACmB,IAAyB,EACzB,IAAwB;QADxB,SAAI,GAAJ,IAAI,CAAqB;QACzB,SAAI,GAAJ,IAAI,CAAoB;QAEzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAqB;QACnC,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,WAAW,EAAE,GAAG;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAChC,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpD,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,WAAW,CAAC,QAAgB,EAAE,UAAgC;QAC5D,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,gFAAgF;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC;QAC1C,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACnE,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChG,IAAI,MAAM,IAAI,QAAQ;YAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC,CAAC,sEAAsE;IACvF,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,OAAe,EACf,MAAc,EACd,IAAkB,EAClB,OAAuC;QAEvC,gEAAgE;QAChE,uEAAuE;QACvE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QACvG,IAAI,CAAC;YACH,mEAAmE;YACnE,uEAAuE;YACvE,2EAA2E;YAC3E,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAmC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YACvF,OAAO,MAAM,UAAU,CAAC;gBACtB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;gBACvD,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC/C,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI,CAAC,SAAS;gBAC1B,gBAAgB;gBAChB,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI;gBAClC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,OAAO;gBACP,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,OAAe,EAAE,IAAoB;QACrE,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;YAC5C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE;YACrE,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI;YACnC,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;SAC7B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS;SACpC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,kDAAkD;IACpD,CAAC;IAED,6EAA6E;IACrE,aAAa,CAAC,IAA4B;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,8BAA8B;QAC9B,MAAM,YAAY,GAChB,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,YAAY,EAAE,CAAC;IAC/C,CAAC;CACF;AAiBD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,WAAW;IAcO;IAb7B,OAAO,GAAmB,MAAM,CAAC;IACjC,2BAA2B;IAC3B,MAAM,CAAgB;IACtB,GAAG,CAA0B;IAC7B,gBAAgB,GAAG,EAAE,CAAC;IACtB,QAAQ,GAAG,EAAE,CAAC;IACd,eAAe,CAAY;IAC3B,iBAAiB,CAAgB;IACjC,mBAAmB,CAAkB;IACrC,eAAe,CAAU;IACzB,cAAc,GAAG,CAAC,CAAC;IACnB,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAA6B,WAAyB,EAAE;QAA3B,aAAQ,GAAR,QAAQ,CAAmB;IAAG,CAAC;IAE5D;;;OAGG;IACH,SAAS;QACP,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;YACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAqB;QACnC,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAChD,IAAI,GAAG;YAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAED,WAAW,CAAC,QAAgB,EAAE,UAAgC;QAC5D,IAAI,CAAC,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,OAAe,EACf,OAAe,EACf,IAAkB,EAClB,OAAuC;QAEvC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe;YAAE,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAChF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,OAAe,EAAE,IAAoB;QACrE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;QAC/B,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB;YAAE,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjG,CAAC;IAED,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,gBAAgB;gBAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;CACF;AAED,uEAAuE;AAEvE,SAAS,OAAO,CAAC,CAAiB;IAChC,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAuC;IACxD,OAAO,CAAC,IAAY,EAAE,EAAE;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAClC,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/sandbox/smol.d.ts

@@ -1,162 +0,0 @@
-/**
- * smolvm sandbox manager — runs agent tasks inside local micro-VMs.
- *
- * Structural peer of {@link DockerSandbox}: Last Light owns the isolation
- * boundary, bind-mounts the per-task workspace, runs `agentic-pi run --sandbox
- * none` *inside* the machine, and parses the JSONL event stream exactly as the
- * docker path does. Differences from docker:
- *
- *  - **Isolation** is a real micro-VM (own kernel) via smolvm's host
- *    hypervisor (Apple Silicon Hypervisor.framework / Linux KVM), not a
- *    sibling container. No daemon, no Docker (smolvm drives the hypervisor
- *    directly).
- *  - **Egress** is enforced natively per-machine via `--allow-host` (sourced
- *    from `egress-allowlist.ts`), so this backend needs none of the coredns +
- *    nginx-egress sidecar stack. `--allow-host` implies `--net`; we always
- *    enable networking (the agent must reach the LLM provider).
- *  - **Secrets** (provider keys, GITHUB_TOKEN) are injected via smolvm's
- *    `--secret-env GUEST=HOST` so values never appear on the argv — the host
- *    env of the spawned `smolvm` process carries them; smolvm resolves them
- *    into the guest at start.
- *  - **Image** is whatever `SMOLVM_IMAGE` names. smolvm's `-I` accepts a
- *    registry ref OR a local `docker save` archive (`./img.tar`) / unpacked
- *    rootfs dir — the latter needs NO registry, so it works under the strict
- *    egress allowlist. The lastlight sandbox image (built locally by docker)
- *    is consumed offline via `docker save lastlight-sandbox:latest -o img.tar`
- *    then `SMOLVM_IMAGE=img.tar`. Archives are cached by hash; `start` resolves
- *    from cache, not the network.
- *
- * Driven via the **smolvm CLI** (`execFile`), verified against smolvm 1.2.5.
- *
- * Feasibility-spike scope (documented gaps vs docker):
- *  - We exec `agentic-pi` directly rather than running the sandbox image's
- *    entrypoint, so the entrypoint's git-credential-helper setup is skipped.
- *    Read-only profiles (agentic-pi's built-in github tools + minted
- *    GITHUB_TOKEN) work; repo-write `git push` from the workspace is out of
- *    scope here.
- *  - The workload runs VM-grade (root) by default; workspace writes land as
- *    root on the host bind mount. No shared package-manager cache, no SSRF
- *    metadata floor in unrestricted mode, no in-network OTEL collector.
- *  - The image (`SMOLVM_IMAGE`) must be resolvable by smolvm (a registry ref,
- *    or a local image it can load) — see the spike plan's verification steps.
- */
-/**
- * Where the per-task workspace is bind-mounted inside the guest. smolvm treats
- * `/workspace` specially — a `-v <host>:/workspace` mount "takes priority" and
- * the host share is used directly (instead of the VM's storage-disk workspace),
- * which avoids the `virtiofs` carve-out other mount targets get. The probe in
- * {@link SmolSandbox.resolveHostWorkspace} still confirms the actual host path.
- */
-export declare const SMOL_WORKSPACE_DIR = "/workspace";
-/** True when the smolvm CLI is invocable on this host. */
-export declare function smolAvailable(): boolean;
-export interface SmolSandboxConfig {
-    /** OCI image to boot (default: SMOLVM_IMAGE / lastlight-sandbox:latest). */
-    imageName?: string;
-    /**
-     * Env vars injected into in-guest commands (provider keys, GITHUB_TOKEN,
-     * OTEL…). Forwarded via `--secret-env` so values stay off the argv.
-     */
-    env: Record<string, string>;
-    /** Timeout in seconds for an agent run (default 1800 = 30 min). */
-    timeoutSeconds?: number;
-    /**
-     * Egress allowlist (apex hostnames). Each becomes a repeated `--allow-host`.
-     * `null` → no allowlist (open egress, still `--net`); used for
-     * `unrestricted_egress` phases.
-     */
-    allowHosts: string[] | null;
-}
-export interface SmolMachineInfo {
-    machineName: string;
-    /** Host dir passed to `-v` (the mount source). */
-    worktreePath: string;
-    /**
-     * Host dir that actually backs the guest workspace. smolvm's `-v` does not
-     * always share the source root directly — depending on version it carves a
-     * `<source>/virtiofs/<tag>` subdir and shares THAT. We probe for it after
-     * boot (see {@link SmolSandbox.resolveHostWorkspace}) so host-side staging
-     * (clone / AGENTS.md / skills) lands where the guest can see it, regardless
-     * of which mount semantics the installed smolvm uses.
-     */
-    hostWorkspace: string;
-}
-export declare class SmolSandbox {
-    private config;
-    private machines;
-    constructor(config: SmolSandboxConfig);
-    /** Create + start a micro-VM with the workspace bind-mounted and egress locked. */
-    create(opts: {
-        taskId: string;
-        worktreePath: string;
-    }): Promise<SmolMachineInfo>;
-    /**
-     * Discover the host directory that backs the guest workspace mount. Writes a
-     * sentinel file from inside the guest at {@link SMOL_WORKSPACE_DIR}, then
-     * locates it under the mount source on the host — its parent dir is the
-     * host-side workspace root. Falls back to the source root if not found
-     * (e.g. a future smolvm that shares the source directly and the scan misses).
-     */
-    private resolveHostWorkspace;
-    /** Wait until the machine can run a trivial command (boot completion). */
-    private waitForReady;
-    /**
-     * Run `agentic-pi run --sandbox none …` inside the machine. Mirrors
-     * {@link DockerSandbox.runAgent}: streams stdout line-by-line for the live
-     * shim and writes the prompt to the child's stdin (`-i`). The agentic-pi
-     * argv is passed directly after `--` (no `sh -c`), so no shell quoting.
-     */
-    runAgent(taskId: string, prompt: string, opts?: {
-        model?: string;
-        thinking?: string;
-        profile?: string;
-        /** Forwarded to the inner agentic-pi run via its own `--sandbox-env`. */
-        sandboxEnv?: Record<string, string>;
-        agentCwd?: string;
-        webSearch?: boolean;
-        webSearchProvider?: "tavily" | "brave" | "exa";
-        skillDirs?: string[];
-        onLine?: (line: string) => void;
-    }): Promise<void>;
-    /**
-     * Run a deterministic shell command in the machine and resolve with its exit
-     * code + bounded output. Non-agent sibling of {@link runAgent}; powers
-     * `type: bash` / `type: script` phases. The command is a shell string, so it
-     * runs under `sh -c`.
-     */
-    runCommand(taskId: string, command: string, opts?: {
-        cwd?: string;
-        /** Non-secret env forwarded via `-e KEY=VALUE` (e.g. LL_OUT_*, git identity). */
-        sandboxEnv?: Record<string, string>;
-        timeoutSeconds?: number;
-        onLine?: (line: string) => void;
-    }): Promise<{
-        exitCode: number;
-        stdout: string;
-        stderr: string;
-        timedOut: boolean;
-    }>;
-    /** Stop + delete the machine. */
-    destroy(taskId: string): Promise<void>;
-    /**
-     * The allowlist hosts that smolvm can actually use, in original order.
-     *
-     * smolvm resolves every `--allow-host` to its IP(s) AT VM START and aborts
-     * `create` if ANY entry fails to resolve. Our `egress-allowlist.ts` follows an
-     * apex+subdomain convention (e.g. `githubusercontent.com`), and some of those
-     * bare apexes have no A record — they'd abort the whole VM. So we pre-resolve
-     * here and drop the unresolvable ones.
-     *
-     * CAVEAT: unlike docker (SNI) / gondolin (hostname), smolvm's filter is
-     * IP-pinned at start — `--allow-host github.com` allows github.com's IPs only,
-     * NOT api.github.com or rotating CDN IPs. A faithful apex+subdomain policy
-     * would need each concrete subdomain enumerated; that's a spike gap.
-     */
-    private resolvableAllowHosts;
-    /**
-     * Build `--secret-env GUEST=GUEST` flags for every machine-env var plus the
-     * child-process env that carries their values, so secrets (tokens, provider
-     * keys) reach the guest via smolvm's secret channel rather than the argv.
-     */
-    private secretEnv;
-}