looply-cli 0.0.0-stage → 0.2.0

package/dist/model-transport.js

@@ -0,0 +1,625 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUILT_IN_PROVIDER_ENV = exports.MAX_TRANSPORT_OUTPUT_CHARS = void 0;
+exports.providerSessionDir = providerSessionDir;
+exports.mcpConfigJson = mcpConfigJson;
+exports.mcpMainPath = mcpMainPath;
+exports.isBuiltInProvider = isBuiltInProvider;
+exports.claudeMediatedArgv = claudeMediatedArgv;
+exports.allowedToolArgs = allowedToolArgs;
+exports.makeMediatedAgentRunner = makeMediatedAgentRunner;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const agent_exec_1 = require("./agent-exec");
+const agent_runtime_1 = require("./agent-runtime");
+const agent_contained_1 = require("./agent-contained");
+const exec_domains_1 = require("./exec-domains");
+const untrusted_exec_1 = require("./untrusted-exec");
+/** Which shell a configured provider's line is handed to. See the launch below. */
+const WIN_HOST = process.platform === 'win32';
+const provider_state_1 = require("./provider-state");
+const tool_bridge_1 = require("./tool-bridge");
+const agent_envelope_1 = require("./agent-envelope");
+const spend_ledger_1 = require("./spend-ledger");
+const model_routing_1 = require("./model-routing");
+/**
+ * THE MODEL RUNS HERE; THE MODEL'S TOOLS DO NOT.
+ *
+ * Two phases of work established that the packaged provider cannot run inside
+ * an AppContainer — it spawns a child with piped stdio during startup, libuv
+ * implements that as a named pipe, and a container cannot create one — and that
+ * a restricted token cannot withhold the user's own files. So the provider
+ * process runs as the daemon user, and the boundary moves off the process and
+ * onto the CAPABILITY:
+ *
+ *   the model gets no host tools at all. Every capability it can call is a
+ *   Looply MCP tool, and each of those executes inside the container.
+ *
+ * WHAT THIS DOES AND DOES NOT CLAIM. It does not claim the provider binary is
+ * sandboxed — it is not, and a hostile provider executable could read what the
+ * user can read. That is supply-chain containment and belongs to a later phase.
+ * What is true here is narrower and is the Phase-7 property: model-callable
+ * authority is mediated, and Looply hands the transport no governed credential
+ * through its environment, arguments, configuration, working directory, or tool
+ * surface.
+ *
+ * THE FIVE CHANNELS. Those are the five ways authority could leak from Looply
+ * into the transport, and each is closed deliberately here: the environment is
+ * built up rather than inherited, the arguments carry no secret, the MCP config
+ * names only our own bridge, the working directory is sterile, and the provider
+ * state is a credential copy and nothing else.
+ */
+/**
+ * How much of the transport's own output the daemon will hold.
+ *
+ * 🔴 THE PROVIDER IS THE UNCONTAINED PROCESS, AND THIS WAS UNBOUNDED. Every
+ * chunk of its stdout and stderr was appended to one string with no ceiling, so
+ * the process this phase is ABOUT could exhaust the daemon's memory by talking.
+ * The container bounds what a contained child hands back; nothing bounded this,
+ * and this is the one that is not contained.
+ *
+ * ⚠️ THE TAIL IS WHAT MATTERS HERE, WHICH IS THE OPPOSITE OF THE CONTAINED CASE.
+ * A provider's answer is its LAST line — the JSON envelope readers parse with
+ * `.filter(startsWith('{')).pop()` — so dropping the front preserves the answer
+ * and dropping the back would destroy it. A gate step is the other way round,
+ * and `untrusted-exec.ts` keeps both ends for that reason.
+ */
+exports.MAX_TRANSPORT_OUTPUT_CHARS = 4 * 1024 * 1024;
+/**
+ * The provider's working directory: somewhere with nothing in it.
+ *
+ * NOT THE PROJECT, and this is load-bearing rather than tidy. Even with every
+ * built-in tool disabled, a coding CLI discovers things about the directory it
+ * starts in — configuration, ignore files, repository state. The transport is
+ * meant to learn about the project through the prompt and through tool results,
+ * and through nothing else, so it is started somewhere that has no project in
+ * it to discover.
+ *
+ * Per project and per role, so two sessions never share provider state.
+ */
+function providerSessionDir(projectDir, role, home = (0, node_os_1.homedir)()) {
+    const digest = (0, node_crypto_1.createHash)('sha256').update(`${projectDir}|${role}`, 'utf8').digest('hex').slice(0, 16);
+    const dir = (0, node_path_1.join)(home, '.looply', 'provider-sessions', `${role}-${digest}`);
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    return dir;
+}
+/** The MCP configuration the provider is given: exactly one server, ours. */
+function mcpConfigJson(launch) {
+    return JSON.stringify({
+        mcpServers: {
+            [launch.name]: { command: launch.command, args: launch.args },
+        },
+    });
+}
+/**
+ * Where the bridge entry point lives.
+ *
+ * Beside this file once compiled. Under the test runner this module is loaded
+ * from `src`, where there is no compiled entry — and it must be the compiled
+ * one either way, since that is what the provider will actually spawn. Falling
+ * back to the sibling `dist` keeps the tests driving production's artefact.
+ */
+function mcpMainPath(deps = {}) {
+    if (deps.mcpMain !== undefined)
+        return deps.mcpMain;
+    const beside = (0, node_path_1.join)(__dirname, 'mcp-main.js');
+    return (0, node_fs_1.existsSync)(beside) ? beside : (0, node_path_1.join)(__dirname, '..', 'dist', 'mcp-main.js');
+}
+/**
+ * The command line for one mediated turn.
+ *
+ * `--tools ""` is the mechanism that matters, and it was read off the installed
+ * CLI rather than assumed: it takes the list of available tools FROM THE
+ * BUILT-IN SET, and an empty value disables all of them. Without it the model
+ * would keep its own Read, Write, Edit, Glob, Grep and Bash, every one of which
+ * runs as the daemon, and the entire bridge would be decoration beside them.
+ *
+ * `--strict-mcp-config` then makes the supplied configuration the only one, so
+ * no server from the user's profile or a plugin becomes a capability by
+ * accident.
+ */
+/**
+ * Whether `spec` names the built-in provider — the one whose `--output-format
+ * json` envelope is written by the CLI around the model's text, rather than a
+ * configured command whose whole stdout is the model's to write. Only the
+ * former's envelope is read for cost, and only the former's is unwrapped by the
+ * round; a configured provider is driven exactly as it always was.
+ */
+function isBuiltInProvider(spec) {
+    return spec.command === agent_exec_1.DEFAULT_AGENT.command;
+}
+function claudeMediatedArgv(launch, format) {
+    return [
+        '-p',
+        '--output-format',
+        format,
+        // Every built-in host tool, off.
+        '--tools',
+        '',
+        // Only the servers named below; nothing ambient.
+        '--strict-mcp-config',
+        '--mcp-config',
+        mcpConfigJson(launch),
+    ];
+}
+/**
+ * Names the model is allowed to call, spelled the way the provider spells them.
+ *
+ * Belt and braces beside `--tools ""`: if a future version changed what an
+ * empty built-in set means, this still names the only acceptable surface.
+ */
+function allowedToolArgs(role, launch) {
+    const names = tool_bridge_1.TOOL_POLICIES[role].tools.map((t) => `mcp__${launch.name}__${t}`);
+    return ['--allowedTools', names.join(',')];
+}
+/** The environment variables a configured provider is handed, by name. */
+function forwarded(spec, reserved) {
+    const out = {};
+    for (const name of spec.env ?? []) {
+        if (reserved(name))
+            continue;
+        const v = process.env[name];
+        if (typeof v === 'string' && v.length > 0)
+            out[name] = v;
+    }
+    return out;
+}
+/** `LOOPLY_` is Looply's own; the transport never receives one. */
+function isReserved(name) {
+    return /^LOOPLY_/i.test(name.trim());
+}
+/**
+ * What the BUILT-IN provider is told about how it may load its tools.
+ *
+ * 🔴 WITHOUT THIS THE MODEL HAD NO TOOLS, AND SAID SO WITH FABRICATIONS.
+ * Claude Code can DEFER MCP tool schemas behind its own built-in `ToolSearch`
+ * tool, loading them only when the model asks. Looply passes `--tools ""`,
+ * which removes every built-in — `ToolSearch` with them — so a deferred
+ * `mcp__looply__read` was listed and could never be called. The switch is
+ * remote: the provider's cached flag `tengu_deferred_stub_tool` flipped on
+ * under an UNCHANGED 2.1.208 binary and an unchanged argv.
+ *
+ * MEASURED, LIVE, 2026-09-24: across 95 provider sessions on this profile,
+ * every tool-using session was from 2026-09-15; today three verifier turns in
+ * a row called nothing. Two narrated a tool call as text ("⚡ Tool use:
+ * Bash", then a fabricated `<system-reminder>`) and returned no verdict; the
+ * third, run straight into the binary with the seam out of the path, answered
+ * `stale` citing `src/split.ts:1` — a file that does not exist anywhere in
+ * the tree. A verifier that invents its evidence is worse than one that fails.
+ *
+ * `ENABLE_TOOL_SEARCH=false` is the binary's own switch back to "standard":
+ * MCP tools loaded up front, as they were. It adds NO host tool — the
+ * alternative, letting `ToolSearch` through `--tools`, would be the first
+ * built-in the mediated provider was ever allowed.
+ *
+ * ⚠️ BUILT-IN ONLY. A configured provider is somebody else's binary; it
+ * declares how its own tools are turned off (`no_host_tools`) and is told
+ * nothing it did not ask for.
+ */
+exports.BUILT_IN_PROVIDER_ENV = Object.freeze({
+    ENABLE_TOOL_SEARCH: 'false',
+});
+/**
+ * An {@link AgentInvoke} that runs the model outside the container and its
+ * tools inside one.
+ *
+ * Fails closed in every direction it can: no provider runtime, no run; no
+ * bridge, no run; a configured provider that cannot speak the tool protocol,
+ * no run. None of them ever falls back to letting the model touch the host
+ * directly, which is the outcome this whole arc exists to prevent.
+ */
+function makeMediatedAgentRunner(projectDir, role, spec = agent_exec_1.DEFAULT_AGENT, deps = {}, 
+/**
+ * The registry that stops this outliving the run that started it.
+ *
+ * 🔴 THE LIVE PROVIDER WAS NOT OWNED. The timeout below reaps it, and that
+ * covers a transport that hangs — but not a run that ENDS while one is in
+ * flight. `OwnedChildren` exists for exactly that, its docblock claims "a
+ * Ctrl-C, a `looply stop`" among what it covers, and the one process it most
+ * needed to hold was never adopted into it.
+ *
+ * The hazard is already recorded a few lines below, in `killTree`'s own
+ * docblock: stopping a round mid-turn "left a live stub and a live bridge
+ * behind, still holding a project, for as long as the machine stayed up".
+ * That was observed. This is the half that was missing.
+ *
+ * Optional, so every existing caller and fixture keeps working — but the
+ * production one passes it.
+ */
+owned) {
+    const now = deps.now ?? (() => Date.now());
+    const spawnFn = deps.spawnFn ?? node_child_process_1.spawn;
+    const requested = deps.format ?? 'text';
+    // Whether the stream this transport reads carries an envelope the MODEL did
+    // not write. Decided once, from the spec, and read where the cost is parsed.
+    const builtIn = isBuiltInProvider(spec);
+    /**
+     * 🔴 EVERY MODEL INVOCATION IN THIS SYSTEM COMES THROUGH HERE, WHICH IS WHY
+     * THE SPEND RECORD IS WRITTEN HERE AND NOWHERE ELSE.
+     *
+     * `envelope.ts` opens by saying a budget over numbers nobody counts is
+     * theatre. It was describing its own tree: the parser read `total_cost_usd`,
+     * `unwrapEnvelope` dropped it, and no file anywhere appended a spend record —
+     * so `withinEnvelope`'s dollar ceiling had nothing on the other side of the
+     * comparison.
+     *
+     * ⚠️ AND THE ROUND IS RECORDED TOO, WITH NO DOLLARS. The round asks for
+     * `--output-format text` and gets no envelope, so the most expensive path in
+     * the system can report no cost at all. Recording the invocation with `usd`
+     * ABSENT makes the window's total unmeasurable rather than cheap, and
+     * `withinEnvelope` refuses on unmeasurable. Skipping those invocations
+     * instead would have produced a tidy $0.00 for a night of work.
+     */
+    const record = (0, spend_ledger_1.recordingSpend)(role, now, deps.home, deps.runId);
+    const invoke = async (prompt, timeoutMs) => {
+        const started = now();
+        const fail = (why) => ({
+            ok: false,
+            timedOut: false,
+            ms: now() - started,
+            output: why,
+        });
+        const sessionDir = providerSessionDir(projectDir, role, deps.home);
+        const mcpMain = mcpMainPath(deps);
+        if (!(0, node_fs_1.existsSync)(mcpMain)) {
+            return fail(`the agent did not run: no tool bridge at ${mcpMain}`);
+        }
+        const launch = {
+            name: 'looply',
+            command: deps.bridgeNode ?? process.execPath,
+            // THE DAEMON'S HOME, TOLD RATHER THAN INHERITED. The bridge is trusted
+            // code, but the provider launches it and it inherits the provider's
+            // environment — in which HOME points at the sterile session directory. A
+            // bridge that believed that would build itself a fresh 80 MB toolchain
+            // mirror inside the session on every single round.
+            // AND THE RUN, FOR THE SAME REASON THE HOME IS TOLD. `LOOPLY_` is
+            // stripped from the provider's environment and this is spawned by the
+            // provider, so argv is the only channel. The run id is what turns the
+            // bridge's record of what it served on: absent for a scan or a verify,
+            // which are charged as themselves and have no run to attach a record to.
+            args: [mcpMain, projectDir, role, deps.home ?? (0, node_os_1.homedir)(), deps.runId ?? ''],
+        };
+        let executable;
+        let argv;
+        /** Set only on the mediated path; the provider's own profile. */
+        let claudeConfigDir = null;
+        // Where a CONFIGURED transport's runtime lives, so its command can be
+        // resolved. This is what `agent.runtime` means now: provider runtime
+        // requirements, declared by a person, NOT project filesystem authority. It
+        // keeps every check it had — forbidden roots, physical resolution, and the
+        // refusal of anything inside the worktree.
+        let runtimePath = [];
+        // `cmd /c` does not parse the escaping Node applies to arguments, so a
+        // configured line containing a quoted path arrives mangled. The line is one
+        // argument by contract, so it is passed through verbatim and quoted here.
+        let verbatim = false;
+        if (spec.command === agent_exec_1.DEFAULT_AGENT.command) {
+            /**
+             * An explicitly configured executable stands in for the package lookup,
+             * and ONLY for the lookup — every mediating flag below is unchanged.
+             * `claudePackageDir` finds a Claude Code installed as an npm package
+             * beside node; an installation that lives elsewhere is still the same
+             * provider and still takes the same mediation.
+             */
+            const pkg = spec.executable !== undefined
+                ? ''
+                : deps.packageDir === undefined
+                    ? (0, agent_contained_1.claudePackageDir)()
+                    : deps.packageDir;
+            if (pkg === null)
+                return fail('the agent did not run: no provider runtime was found');
+            /**
+             * 🔴 AN EXPLICIT EXECUTABLE IS CHECKED BEFORE IT IS BELIEVED.
+             *
+             * It must be ABSOLUTE — a relative path resolves against whatever cwd the
+             * daemon happens to hold — it must EXIST, so a typo fails here with the
+             * path in the message rather than as an opaque spawn error, and it must
+             * NOT live inside the worktree. That last one is the point: the model can
+             * write to the project, so an executable inside it would be an executable
+             * the model can replace, and Looply would be launching its own provider
+             * from model-authored bytes.
+             */
+            if (spec.executable !== undefined) {
+                const exe = spec.executable;
+                if (!(0, node_path_1.isAbsolute)(exe)) {
+                    return fail(`the agent did not run: agent.executable must be an absolute path (${exe})`);
+                }
+                if (!(0, node_fs_1.existsSync)(exe)) {
+                    return fail(`the agent did not run: no provider executable at ${exe}`);
+                }
+                const inside = (0, agent_runtime_1.checkRuntimeGrants)([(0, node_path_1.dirname)(exe)], undefined, projectDir);
+                if (!inside.ok)
+                    return fail(`the agent did not run: ${inside.because}`);
+            }
+            // The SAME composition `doctor` asks about. Two copies of this path would let
+            // a readiness check answer honestly about a binary nobody is going to run.
+            executable = spec.executable ?? (0, provider_state_1.providerExecutableFor)(pkg);
+            /**
+             * 🔴 THE PROVIDER AUTHENTICATES ITSELF NOW. Looply used to copy the
+             * operator's credential into this session directory on every launch; it
+             * points at a persistent profile instead and holds nothing.
+             *
+             * The profile comes from the DAEMON'S HOME, never from project config —
+             * `.looply/config.yaml` lives inside the worktree the model may edit, and
+             * a worker that could name this directory could point it at one it wrote.
+             */
+            claudeConfigDir = (0, provider_state_1.providerProfileDir)({ home: deps.home });
+            /**
+             * ⚠️ CHECKED IN THE SAME PROFILE AND ENVIRONMENT THE RUN WILL USE, or it
+             * answers a different question — the mistake `doctor --provider` was
+             * repaired for once already. It costs no model turn: `auth status` is
+             * local and prints the profile's own state.
+             */
+            const ready = (deps.checkAuth ?? provider_state_1.checkProviderAuth)(executable, { ...(0, exec_domains_1.buildProviderEnv)(sessionDir), CLAUDE_CONFIG_DIR: claudeConfigDir }, { home: deps.home });
+            if (!ready.ok) {
+                // The reason is carried through rather than flattened: only one of the
+                // five means "log in", and telling somebody to re-authenticate when the
+                // executable is missing wastes their afternoon.
+                return fail(`the agent did not run: provider_${ready.reason} — ${ready.because}`);
+            }
+            // The role's model and effort sit between the mediation flags and the
+            // tool allowlist: nothing configured means nothing added, so a project
+            // that says nothing about models gets the invocation it always did.
+            argv = [
+                ...claudeMediatedArgv(launch, requested),
+                // The prover is a TOOL role, not a model role: it runs the model the
+                // implementer's routing names, exactly as it did while it borrowed the
+                // implementer's transport. Only its tools narrowed.
+                ...(0, model_routing_1.modelArgs)(role === 'prover' ? 'implementer' : role, spec),
+                ...allowedToolArgs(role, launch),
+            ];
+        }
+        else {
+            // A CONFIGURED PROVIDER must be able to take its tools from us. There is
+            // no fallback to host tools: a transport that cannot be mediated is a
+            // transport Looply will not drive.
+            const declared = (0, agent_runtime_1.checkRuntimeGrants)(spec.runtime ?? [], undefined, projectDir);
+            if (!declared.ok)
+                return fail(`the agent did not run: ${declared.because}`);
+            // `agent.command` is a shell line by contract, as it has been since the
+            // gate's steps. It runs through the shell so that contract still holds,
+            // but the shell itself is named explicitly rather than left to `spawn`.
+            /**
+             * ⚠️ THE FALLBACK OMITTED `Windows` — it read `?? 'C:'`, so with no
+             * SystemRoot this looked for `C:\\System32\\cmd.exe`. Absolute, and wrong:
+             * the shell would simply not be found, and a configured provider would
+             * fail to launch for a reason naming no cause. Three spellings of this
+             * fallback exist in the package; this was the only one missing a segment.
+             */
+            /**
+             * 🔴 REFUSED UNLESS ITS TOOLS ARE DECLARED OFF.
+             *
+             * The comment three lines above has always said "there is no fallback to
+             * host tools: a transport that cannot be mediated is a transport Looply
+             * will not drive". Until now that was a statement of intent with nothing
+             * enforcing it: the default branch appended `allowedToolArgs` and this
+             * one appended nothing, so a configured provider ran through `cmd.exe`
+             * with its own file, shell and network tools fully enabled.
+             *
+             * ⚠️ LOOPLY CANNOT INVENT THE FLAG. It does not know what turns an
+             * unknown binary's tools off, and a guessed flag that silently does
+             * nothing reads exactly like one that works. So the person declares it
+             * and this refuses without it — which is the "or the launch is refused"
+             * half of the rule, and the only honest half available.
+             */
+            const suppression = spec.noHostTools ?? [];
+            if (suppression.length === 0) {
+                return fail('the agent did not run: this provider is configured but does not say how its own tools are ' +
+                    'turned off. Looply gives a model no host tools, and it cannot guess the flag for a binary ' +
+                    'it does not know — set `agent.no_host_tools` to the arguments that disable them.');
+            }
+            /**
+             * 🔴 THE PLATFORM'S OWN SHELL, WHICH IS WHAT THE DEP COMMENT HAS ALWAYS
+             * CLAIMED THIS READS — and it read Windows' shell on every platform.
+             *
+             * Off Windows the spawn failed with `ENOENT` on
+             * `C:\Windows/System32/cmd.exe`, so no configured provider could be
+             * launched at all: a turn died before the prompt reached it, and every
+             * suite that drives a real `looply run` — round, coordinator, lifecycle,
+             * closure, admission — failed with a message naming a path that does not
+             * exist on the host.
+             *
+             * ⚠️ IT CHANGES NOTHING ABOUT TRUST. This transport is deliberately NOT
+             * contained on any platform — the comment above says why: a packaged
+             * provider spawns children with piped stdio, which an AppContainer cannot
+             * create — so the boundary that matters is the GATE's, and the gate still
+             * refuses rather than falling back where there is no container to make. The
+             * declared suppression arguments are appended here whatever the shell is,
+             * and a provider that declares none is still refused above.
+             *
+             * `/bin/sh` rather than `$SHELL`: the environment handed to this child is
+             * built rather than inherited, and a person's interactive shell is not a
+             * contract. `sh -c <line>` takes the line as ONE argument, which is the
+             * same contract `cmd /d /s /c "<line>"` satisfies.
+             */
+            const shell = deps.shell ?? (WIN_HOST ? (0, node_path_1.join)((0, untrusted_exec_1.systemRoot)(), 'System32', 'cmd.exe') : '/bin/sh');
+            executable = shell;
+            /**
+             * ⚠️ THE DECLARED ARGUMENTS ARE APPENDED, so a configured provider is
+             * mediated by the same shape the default one is: a command line plus the
+             * arguments that leave the model with nothing but Looply's tools.
+             */
+            const line = [spec.command, ...suppression].join(' ');
+            argv = WIN_HOST ? ['/d', '/s', '/c', '"' + line + '"'] : ['-c', line];
+            // `windowsVerbatimArguments` is a Windows spawn option and the quoting it
+            // preserves is cmd's; `sh -c` needs neither.
+            verbatim = WIN_HOST;
+            runtimePath = declared.paths;
+        }
+        const base = (0, exec_domains_1.buildProviderEnv)(sessionDir, forwarded(spec, isReserved));
+        const env = {
+            ...base,
+            ...(runtimePath.length === 0
+                ? {}
+                : { PATH: [...runtimePath, base['PATH'] ?? ''].filter((p) => p.length > 0).join(';') }),
+            // How a configured transport is told where its tools are. Claude reads
+            // the same thing off its command line; this is the provider-neutral
+            // spelling of it, and it names only Looply's own bridge.
+            LOOPLY_MCP_CONFIG: mcpConfigJson(launch),
+            LOOPLY_MCP_TOOLS: tool_bridge_1.TOOL_POLICIES[role].tools.map((t) => `mcp__${launch.name}__${t}`).join(','),
+            // The provider's persistent profile. Added to a scrubbed environment that
+            // is BUILT UP rather than inherited, so this is one named variable, not a
+            // loosening of what else crosses.
+            ...(claudeConfigDir === null ? {} : { CLAUDE_CONFIG_DIR: claudeConfigDir, ...exports.BUILT_IN_PROVIDER_ENV }),
+        };
+        return await new Promise((resolve) => {
+            let out = '';
+            let droppedChars = 0;
+            /**
+             * Keeps the TAIL: see `MAX_TRANSPORT_OUTPUT_CHARS`. Trimmed on the way in
+             * rather than at the end, because holding it all and slicing afterwards
+             * would be the very allocation this prevents.
+             */
+            const absorb = (chunk) => {
+                out += chunk;
+                if (out.length > exports.MAX_TRANSPORT_OUTPUT_CHARS) {
+                    const over = out.length - exports.MAX_TRANSPORT_OUTPUT_CHARS;
+                    out = out.slice(over);
+                    droppedChars += over;
+                }
+            };
+            const collected = () => droppedChars === 0
+                ? out
+                : `… ${droppedChars} characters of transport output dropped, over the ${exports.MAX_TRANSPORT_OUTPUT_CHARS}-character bound …\n${out}`;
+            let done = false;
+            let timer;
+            const child = spawnFn(executable, argv, {
+                cwd: sessionDir,
+                // Cast, not spread. `ProcessEnv` is declared with a REQUIRED NODE_ENV
+                // by a type package elsewhere in this tree, and the tempting fix —
+                // starting from `process.env` — is exactly the inheritance this file
+                // exists to prevent.
+                env: env,
+                stdio: ['pipe', 'pipe', 'pipe'],
+                // NEVER `shell: true`. The executable and its arguments are named
+                // explicitly; the one place a shell is involved is a configured
+                // provider's own line, where cmd is named outright above.
+                shell: false,
+                ...(verbatim ? { windowsVerbatimArguments: true } : {}),
+            });
+            // Given back the moment it settles, so a finished transport is not killed
+            // later by a shutdown that still believes it is running.
+            let release;
+            if (owned && child.pid !== undefined) {
+                const pid = child.pid;
+                release = owned.adopt({
+                    pid,
+                    label: `model transport (${role})`,
+                    kill: () => killTree(pid),
+                });
+            }
+            const finish = (r) => {
+                if (done)
+                    return;
+                done = true;
+                release?.();
+                if (timer !== undefined)
+                    clearTimeout(timer);
+                resolve(r);
+            };
+            child.stdout?.on('data', (d) => absorb(d.toString('utf8')));
+            child.stderr?.on('data', (d) => absorb(d.toString('utf8')));
+            child.on('error', (e) => finish(fail(`the agent did not run: ${e.message}`)));
+            child.stdin?.on('error', () => undefined);
+            child.on('exit', (code) => finish({ ok: code === 0, timedOut: false, ms: now() - started, output: collected() }));
+            timer = setTimeout(() => {
+                killTree(child.pid);
+                finish({ ok: false, timedOut: true, ms: now() - started, output: collected() });
+            }, timeoutMs);
+            try {
+                child.stdin?.end(prompt);
+            }
+            catch {
+                /* a transport that exited before reading its prompt is an exit, not a crash */
+            }
+        });
+    };
+    return async (prompt, timeoutMs) => {
+        const r = await invoke(prompt, timeoutMs);
+        /**
+         * 🔴 ONLY THE JSON PATH HAS AN ENVELOPE — AND ON THE TEXT PATH THE MODEL
+         * WOULD HAVE BEEN WRITING ITS OWN SPEND RECORD.
+         *
+         * The round runs with `--output-format text`, so the whole stream is model
+         * prose. The first version of this parsed it anyway, which means a model
+         * that emits `{"type":"result","subtype":"success","total_cost_usd":0.0}`
+         * anywhere in its transcript writes a line into the machine's durable spend
+         * ledger — the file a dollar ceiling is meant to read. An agent's assertion
+         * is never authoritative about what happened; that is the invariant the
+         * whole two-key rule rests on, and this was it being broken about money.
+         *
+         * ⚠️ AND THE TEXT PATH IS STILL RECORDED, WITHOUT DOLLARS. Skipping it
+         * would leave the most expensive path in the system out of the ledger
+         * entirely and total a night of rounds at $0.00. An unmeasured invocation
+         * makes the whole window unmeasurable, which `withinEnvelope` refuses on.
+         *
+         * ⚠️ AND NOT PARSING IT IS ALSO WHAT MAKES THE ROUND CHEAP AGAIN. The
+         * parse is quadratic in the number of unclosed braces (see
+         * `agent-envelope.ts` — 110 seconds on 2 MB before it was bounded), and
+         * this line was running it on every round transcript.
+         */
+        /**
+         * 🔴 AND ONLY FOR THE BUILT-IN PROVIDER, WHOSE ENVELOPE THE CLI WRITES.
+         *
+         * Found by the closure acceptance check the moment the round moved to the
+         * JSON path: a CONFIGURED provider is an arbitrary command, and its stdout
+         * is the model's own stream — `output_format_flag` may be empty, and
+         * nothing between the model and this parser writes an envelope the model
+         * cannot forge. The check's stub printed `{"type":"result",
+         * "total_cost_usd":99999}` in its prose and the parser dutifully made it a
+         * ledger row. With Claude Code on `--output-format json` the model's text
+         * sits INSIDE the envelope's `result` string, escaped, so the last object
+         * on the stream is the CLI's own; that is the only stream this trusts.
+         * A configured provider's invocation is recorded with `usd` absent —
+         * unmeasured, never zero — exactly as the text path always was.
+         */
+        const format = builtIn ? requested : 'text';
+        const env = format === 'json' ? (0, agent_envelope_1.parseAgentEnvelope)(r.output ?? '') : null;
+        record({ ms: r.ms, ...(env?.cost === undefined ? {} : { cost: env.cost }) });
+        return r;
+    };
+}
+/**
+ * Kill the transport AND everything under it.
+ *
+ * `child.kill()` is not enough. A configured provider is launched through the
+ * shell, so the tree is cmd -> provider -> bridge, and killing the top of it
+ * leaves the rest running. This was observed rather than imagined: stopping a
+ * round mid-turn left a live stub and a live bridge behind, still holding a
+ * project, for as long as the machine stayed up — and they went on contending
+ * for container profiles with every run afterwards.
+ *
+ * The contained half was already safe: each contained process is held in a job
+ * object that dies with it. This is about the trusted processes above it.
+ */
+function killTree(pid) {
+    if (pid === undefined)
+        return;
+    try {
+        if (process.platform === 'win32') {
+            /**
+             * ABSOLUTE, and with a cwd looply owns.
+             *
+             * A bare name here inherits `process.cwd()`, which for a run IS the
+             * project directory — and Windows searches the cwd before PATH, so the
+             * contained agent (granted write over that directory) could put a
+             * `taskkill.exe` there and have the daemon run it. Same rule as the git
+             * binary; the name is different and the consequence is identical.
+             */
+            const system32 = (0, node_path_1.join)((0, untrusted_exec_1.systemRoot)(), 'System32');
+            (0, node_child_process_1.spawn)((0, node_path_1.join)(system32, 'taskkill.exe'), ['/PID', String(pid), '/T', '/F'], {
+                stdio: 'ignore',
+                cwd: system32,
+            });
+            return;
+        }
+        process.kill(pid);
+    }
+    catch {
+        /* already gone */
+    }
+}
+//# sourceMappingURL=model-transport.js.map

package/dist/model-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-transport.js","sourceRoot":"","sources":["../src/model-transport.ts"],"names":[],"mappings":";;;AAsFA,gDAKC;AAGD,sCAMC;AAUD,kCAIC;AA6CD,8CAEC;AAED,gDAaC;AAQD,0CAGC;AA2DD,0DAmYC;AAznBD,2DAA2C;AAC3C,6CAAyC;AACzC,qCAAgD;AAChD,qCAAkC;AAClC,yCAAsD;AACtD,6CAA+E;AAC/E,mDAAqD;AACrD,uDAAqD;AACrD,iDAAkD;AAClD,qDAA8C;AAE9C,mFAAmF;AACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAE9C,qDAAgG;AAChG,+CAA6D;AAE7D,qDAAsD;AACtD,iDAAgD;AAChD,mDAA4C;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;;GAcG;AACU,QAAA,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAU1D;;;;;;;;;;;GAWG;AACH,SAAgB,kBAAkB,CAAC,UAAkB,EAAE,IAAc,EAAE,OAAe,IAAA,iBAAO,GAAE;IAC7F,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvG,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC;IAC5E,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,SAAgB,aAAa,CAAC,MAAiB;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE;YACV,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;SAC9D;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,OAA2B,EAAE;IACvD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACpD,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC9C,OAAO,IAAA,oBAAU,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;AACpF,CAAC;AAyBD;;;;;;;;;;;;GAYG;AACH;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,IAAe;IAC/C,OAAO,IAAI,CAAC,OAAO,KAAK,0BAAa,CAAC,OAAO,CAAC;AAChD,CAAC;AAED,SAAgB,kBAAkB,CAAC,MAAiB,EAAE,MAAuB;IAC3E,OAAO;QACL,IAAI;QACJ,iBAAiB;QACjB,MAAM;QACN,iCAAiC;QACjC,SAAS;QACT,EAAE;QACF,iDAAiD;QACjD,qBAAqB;QACrB,cAAc;QACd,aAAa,CAAC,MAAM,CAAC;KACtB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,IAAc,EAAE,MAAiB;IAC/D,MAAM,KAAK,GAAG,2BAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;IAChF,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,IAAe,EAAE,QAAmC;IACrE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACU,QAAA,qBAAqB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACnF,kBAAkB,EAAE,OAAO;CAC5B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,SAAgB,uBAAuB,CACrC,UAAkB,EAClB,IAAc,EACd,OAAkB,0BAAa,EAC/B,OAA2B,EAAE;AAC7B;;;;;;;;;;;;;;;;GAgBG;AACH,KAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,0BAAK,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAExC;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,MAAM,GAAG,IAAA,6BAAc,EAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAEhE,MAAM,MAAM,GAAG,KAAK,EAAE,MAAc,EAAE,SAAiB,EAA0B,EAAE;QACjF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAiB,EAAE,CAAC,CAAC;YAC5C,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,KAAK;YACf,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO;YACnB,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,IAAA,oBAAU,EAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,4CAA4C,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAc;YACxB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ;YAC5C,uEAAuE;YACvE,oEAAoE;YACpE,yEAAyE;YACzE,uEAAuE;YACvE,mDAAmD;YACnD,kEAAkE;YAClE,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,yEAAyE;YACzE,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAA,iBAAO,GAAE,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;SAC5E,CAAC;QAEF,IAAI,UAAkB,CAAC;QACvB,IAAI,IAAc,CAAC;QACnB,iEAAiE;QACjE,IAAI,eAAe,GAAkB,IAAI,CAAC;QAC1C,sEAAsE;QACtE,qEAAqE;QACrE,2EAA2E;QAC3E,2EAA2E;QAC3E,2CAA2C;QAC3C,IAAI,WAAW,GAAsB,EAAE,CAAC;QACxC,uEAAuE;QACvE,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,IAAI,IAAI,CAAC,OAAO,KAAK,0BAAa,CAAC,OAAO,EAAE,CAAC;YAC3C;;;;;;eAMG;YACH,MAAM,GAAG,GACP,IAAI,CAAC,UAAU,KAAK,SAAS;gBAC3B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS;oBAC7B,CAAC,CAAC,IAAA,kCAAgB,GAAE;oBACpB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;YACxB,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,sDAAsD,CAAC,CAAC;YACtF;;;;;;;;;;eAUG;YACH,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;gBAC5B,IAAI,CAAC,IAAA,sBAAU,EAAC,GAAG,CAAC,EAAE,CAAC;oBACrB,OAAO,IAAI,CAAC,qEAAqE,GAAG,GAAG,CAAC,CAAC;gBAC3F,CAAC;gBACD,IAAI,CAAC,IAAA,oBAAU,EAAC,GAAG,CAAC,EAAE,CAAC;oBACrB,OAAO,IAAI,CAAC,oDAAoD,GAAG,EAAE,CAAC,CAAC;gBACzE,CAAC;gBACD,MAAM,MAAM,GAAG,IAAA,kCAAkB,EAAC,CAAC,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;gBACzE,IAAI,CAAC,MAAM,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAC,0BAA0B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,8EAA8E;YAC9E,2EAA2E;YAC3E,UAAU,GAAG,IAAI,CAAC,UAAU,IAAK,IAAA,sCAAqB,EAAC,GAAG,CAAY,CAAC;YACvE;;;;;;;;eAQG;YACH,eAAe,GAAG,IAAA,mCAAkB,EAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D;;;;;eAKG;YACH,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kCAAiB,CAAC,CACjD,UAAU,EACV,EAAE,GAAG,IAAA,+BAAgB,EAAC,UAAU,CAAC,EAAE,iBAAiB,EAAE,eAAe,EAAE,EACvE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACpB,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,uEAAuE;gBACvE,wEAAwE;gBACxE,gDAAgD;gBAChD,OAAO,IAAI,CAAC,mCAAmC,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,sEAAsE;YACtE,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,GAAG;gBACL,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC;gBACxC,qEAAqE;gBACrE,uEAAuE;gBACvE,oDAAoD;gBACpD,GAAG,IAAA,yBAAS,EAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC;gBAC5D,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC;aACjC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,sEAAsE;YACtE,mCAAmC;YACnC,MAAM,QAAQ,GAAG,IAAA,kCAAkB,EAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,0BAA0B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE;;;;;;eAMG;YACH;;;;;;;;;;;;;;;eAeG;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YAC3C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CACT,4FAA4F;oBAC1F,4FAA4F;oBAC5F,kFAAkF,CACrF,CAAC;YACJ,CAAC;YACD;;;;;;;;;;;;;;;;;;;;;;;eAuBG;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAA,2BAAU,GAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC/F,UAAU,GAAG,KAAK,CAAC;YACnB;;;;eAIG;YACH,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtE,0EAA0E;YAC1E,6CAA6C;YAC7C,QAAQ,GAAG,QAAQ,CAAC;YACpB,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC/B,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,+BAAgB,EAAC,UAAU,EAAE,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QACvE,MAAM,GAAG,GAA2B;YAClC,GAAG,IAAI;YACP,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;gBAC1B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzF,uEAAuE;YACvE,oEAAoE;YACpE,yDAAyD;YACzD,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC;YACxC,gBAAgB,EAAE,2BAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7F,0EAA0E;YAC1E,0EAA0E;YAC1E,kCAAkC;YAClC,GAAG,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,eAAe,EAAE,GAAG,6BAAqB,EAAE,CAAC;SACtG,CAAC;QAEF,OAAO,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;YAClD,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB;;;;eAIG;YACH,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;gBACrC,GAAG,IAAI,KAAK,CAAC;gBACb,IAAI,GAAG,CAAC,MAAM,GAAG,kCAA0B,EAAE,CAAC;oBAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,kCAA0B,CAAC;oBACrD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACtB,YAAY,IAAI,IAAI,CAAC;gBACvB,CAAC;YACH,CAAC,CAAC;YACF,MAAM,SAAS,GAAG,GAAW,EAAE,CAC7B,YAAY,KAAK,CAAC;gBAChB,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,KAAK,YAAY,qDAAqD,kCAA0B,uBAAuB,GAAG,EAAE,CAAC;YACnI,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,IAAI,KAAiC,CAAC;YACtC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE;gBACtC,GAAG,EAAE,UAAU;gBACf,sEAAsE;gBACtE,mEAAmE;gBACnE,qEAAqE;gBACrE,qBAAqB;gBACrB,GAAG,EAAE,GAAwB;gBAC7B,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,kEAAkE;gBAClE,gEAAgE;gBAChE,0DAA0D;gBAC1D,KAAK,EAAE,KAAK;gBACZ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;YACH,0EAA0E;YAC1E,yDAAyD;YACzD,IAAI,OAAiC,CAAC;YACtC,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;gBACtB,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;oBACpB,GAAG;oBACH,KAAK,EAAE,oBAAoB,IAAI,GAAG;oBAClC,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;iBAC1B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAgB,EAAQ,EAAE;gBACxC,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,IAAI,CAAC;gBACZ,OAAO,EAAE,EAAE,CAAC;gBACZ,IAAI,KAAK,KAAK,SAAS;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC7C,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC,CAAC;YACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACrF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACxB,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CACtF,CAAC;YACF,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAClF,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,IAAI,CAAC;gBACH,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,+EAA+E;YACjF,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,MAAc,EAAE,SAAiB,EAA0B,EAAE;QACzE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1C;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH;;;;;;;;;;;;;;WAcG;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAA,mCAAkB,EAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,QAAQ,CAAC,GAAuB;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC;;;;;;;;eAQG;YACH,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,IAAA,2BAAU,GAAE,EAAE,UAAU,CAAC,CAAC;YAChD,IAAA,0BAAK,EAAC,IAAA,gBAAI,EAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;gBACvE,KAAK,EAAE,QAAQ;gBACf,GAAG,EAAE,QAAQ;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;AACH,CAAC"}