mindweave 0.0.1 → 2.1.2

package/dist/tools/guard.js

@@ -0,0 +1,220 @@
+/**
+ * guard.ts — the mechanical safety floor for the mutating tools.
+ *
+ * Two deterministic checks, no model judgment and no prompt rules (keeping the
+ * "how to behave safely" decision out of the prompt is deliberate — the wall is
+ * physical, the model is simply told why and adapts):
+ *
+ *  1. `protectedPathReason` — some files must never be read or written by the
+ *     agent regardless of what it's asked: secrets (`.env`), keys (`.ssh`,
+ *     `*.pem`, `id_rsa`), and the git internals (`.git/`) whose corruption would
+ *     wreck the repo. This mirrors the deny-lists every serious coding agent
+ *     ships; user-configurable rules can layer on later.
+ *
+ *  2. `catastrophicCommandReason` — a tiny, high-confidence blocklist of shell
+ *     commands that are essentially never a legitimate coding action and are
+ *     irreversible (wipe the disk, fork-bomb, reformat). This is NOT a sandbox
+ *     or an injection parser — a single-user local tool doesn't need a heavyweight
+ *     shell analyzer. It's a seatbelt against the few commands that turn a model
+ *     mistake into a destroyed machine.
+ *
+ * Both return a human reason string when they fire, or `null` to allow. Fail
+ * open by design: anything not explicitly matched is allowed.
+ */
+// Path segments / names that are off-limits. Matched against the POSIX-style
+// path so it works the same on Windows and Unix.
+const PROTECTED_PATTERNS = [
+    // Three spellings, because two of them were getting through. `.env` and `.env.local`
+    // were covered; `prod.env`, `staging.env` and `production.env` were NOT, and a
+    // per-environment file is one of the commonest places a real secret actually lives.
+    // `.envrc` (direnv) was not covered either, and it routinely holds exported keys.
+    //
+    // The suffix form is anchored to the end of the BASENAME rather than matched loosely,
+    // which is what keeps ordinary code out of the net: `src/environment.ts` and
+    // `src/env.ts` must stay readable, and a floor that blocked those would be worked
+    // around rather than obeyed.
+    { test: /(^|\/)\.env(\.|$|\/)/i, what: "an environment/secrets file" },
+    { test: /(^|\/)[^/]*\.env$/i, what: "an environment/secrets file" },
+    { test: /(^|\/)\.envrc$/i, what: "an environment/secrets file" },
+    { test: /(^|\/)\.git(\/|$)/i, what: "the git internals directory" },
+    { test: /(^|\/)\.ssh(\/|$)/i, what: "an SSH key directory" },
+    { test: /(^|\/)id_(rsa|ed25519|ecdsa|dsa)(\.|$)/i, what: "a private SSH key" },
+    { test: /\.pem$/i, what: "a private key file" },
+    { test: /(^|\/)(secrets?|credentials)(\/|\.|$)/i, what: "a secrets/credentials file" },
+];
+/**
+ * If `absPath` is a file the agent must never touch, return a short reason;
+ * otherwise null. `absPath` may use either slash style.
+ */
+export function protectedPathReason(absPath) {
+    const posix = absPath.split("\\").join("/");
+    for (const { test, what } of PROTECTED_PATTERNS) {
+        if (test.test(posix))
+            return what;
+    }
+    return null;
+}
+// Another coding agent's private working data: its saved sessions, its memory of
+// past conversations, its rules and skills. A project that has been worked on by
+// more than one tool carries several of these side by side.
+//
+// This is NOT the same thing as a secret, and it is deliberately a separate list.
+// A secret must never be read at all. This data is simply not ours: it belongs to
+// a different tool and a different set of conversations, and helping ourselves to
+// it means presenting someone else's history as if it were our own, or inheriting
+// stale decisions the user never made with us. So the rule is "ask first", not
+// "never" — the user can always say yes.
+//
+// Deliberately absent from this list: our own directory. Our sessions and memory
+// live under the user's home directory rather than in the project, but a project
+// may still hold our own notes, and reading our own work is the entire point.
+const AGENT_PATTERNS = [
+    { test: /(^|\/)\.claude(\/|$)/i, what: "Claude Code" },
+    { test: /(^|\/)CLAUDE\.md$/i, what: "Claude Code" },
+    { test: /(^|\/)\.cursor(\/|$)/i, what: "Cursor" },
+    { test: /(^|\/)\.cursorrules$/i, what: "Cursor" },
+    { test: /(^|\/)\.aider[^/]*$/i, what: "Aider" },
+    { test: /(^|\/)\.aider(\/|$)/i, what: "Aider" },
+    { test: /(^|\/)\.continue(\/|$)/i, what: "Continue" },
+    { test: /(^|\/)\.windsurf(\/|$)/i, what: "Windsurf" },
+    { test: /(^|\/)\.codeium(\/|$)/i, what: "Codeium" },
+    { test: /(^|\/)AGENTS\.md$/i, what: "another coding agent" },
+];
+/**
+ * If `absPath` belongs to a DIFFERENT coding agent, return that tool's name;
+ * otherwise null. Callers use this to ask the user before touching it, never to
+ * refuse outright — see `requestAgentDataAccess`.
+ */
+export function foreignAgentReason(absPath) {
+    const posix = absPath.split("\\").join("/");
+    for (const { test, what } of AGENT_PATTERNS) {
+        if (test.test(posix))
+            return what;
+    }
+    return null;
+}
+/** Directory names belonging to other coding agents, for skipping during a walk
+ *  or search. Files that are not directories (CLAUDE.md, .cursorrules) are matched
+ *  by `foreignAgentReason` instead. */
+export const AGENT_DIRS = [
+    ".claude",
+    ".cursor",
+    ".aider",
+    ".continue",
+    ".windsurf",
+    ".codeium",
+];
+/**
+ * Glob patterns a CONTENT SEARCH must never look inside.
+ *
+ * Search is the quiet way past a per-file gate: `read_file` refuses to open
+ * `.env`, but an unfiltered `grep -r "KEY" .` prints the matching lines anyway,
+ * and the same trick would surface another agent's saved conversations without
+ * ever opening a file. Secrets are excluded outright; another agent's data is
+ * excluded because a search is a poor place to ask a question — the model can
+ * still read those files deliberately, which is where the user gets asked.
+ */
+export const SEARCH_EXCLUDE_GLOBS = [
+    ".env",
+    ".env.*",
+    ".ssh",
+    "*.pem",
+    "id_rsa",
+    "id_ed25519",
+    "id_ecdsa",
+    "id_dsa",
+    "secrets",
+    "secret",
+    "credentials",
+    ...AGENT_DIRS,
+    "CLAUDE.md",
+    "AGENTS.md",
+    ".cursorrules",
+    ".aider*",
+];
+/** True if a search result from `absPath` must be withheld — a secret, or another
+ *  coding agent's data. The counterpart to SEARCH_EXCLUDE_GLOBS for the built-in
+ *  walker, which filters after walking rather than excluding at the source. */
+export function excludedFromSearch(absPath) {
+    return protectedPathReason(absPath) !== null || foreignAgentReason(absPath) !== null;
+}
+// Paths a shell command must not PRINT the contents of.
+const COMMAND_SENSITIVE = [
+    { needle: /(^|[\s"'`/\\=<])\.env\b/i, what: "an environment/secrets file" },
+    { needle: /(^|[\s"'`/\\=<])\.ssh\b/i, what: "an SSH key directory" },
+    { needle: /\bid_(rsa|ed25519|ecdsa|dsa)\b/i, what: "a private SSH key" },
+    { needle: /\.pem\b/i, what: "a private key file" },
+    { needle: /(^|[\s"'`/\\=<])\.claude\b/i, what: "Claude Code's data" },
+    { needle: /(^|[\s"'`/\\=<])\.cursor(rules)?\b/i, what: "Cursor's data" },
+    { needle: /(^|[\s"'`/\\=<])\.aider/i, what: "Aider's data" },
+    { needle: /(^|[\s"'`/\\=<])\.continue\b/i, what: "Continue's data" },
+    { needle: /(^|[\s"'`/\\=<])\.windsurf\b/i, what: "Windsurf's data" },
+    { needle: /(^|[\s"'`/\\=<])\.codeium\b/i, what: "Codeium's data" },
+];
+// Commands whose OUTPUT is the contents of a file. This is the thing that matters:
+// the harm is a secret being printed into the model's context (and from there into
+// a saved transcript, and into the next request to a provider). Copying, moving,
+// listing, or testing for a file does none of that, so none of them belong here.
+//
+// Matched in COMMAND POSITION only — start of the command, or after a pipe,
+// semicolon, `&&`, or a subshell opener. Without that anchor, ordinary words like
+// `type` in `npm run typecheck` or a `--head` flag would trip it.
+//
+// PowerShell shares this list: `cat`, `type`, and `gc` are all aliases for
+// Get-Content there, so the same names cover both shells.
+const CONTENT_READERS = /(^|[|;&]|&&|\$\(|\bthen\b|\bdo\b)\s*(sudo\s+)?(cat|type|more|less|head|tail|strings|xxd|od|base64|gc|Get-Content|sls|Select-String|findstr|grep|rg|ack|awk|sed|nl|tac|Format-Hex)\b/i;
+// `< file` feeds a file's contents in, which can print it just as directly.
+const INPUT_REDIRECT = /<\s*[^\s|;&]+/;
+/**
+ * If `command` would PRINT the contents of a secret or another agent's data,
+ * return what it is reaching for; otherwise null.
+ *
+ * Two conditions, both required: the command reads file content, AND it names one
+ * of the sensitive paths. That pairing is what keeps this useful rather than
+ * merely irritating: `Test-Path .env` (does it exist?), `ls .claude`, and
+ * `cp .env.example .env` all pass, while `cat .env` and `Get-Content .env` do not.
+ *
+ * This is deliberately not adversarial defense. A model set on evading a string
+ * check can always do so, and no amount of pattern-matching a shell fixes that.
+ * It is here to stop the accidental `cat .env` that would drop live credentials
+ * into the transcript, which is a mistake rather than an attack. The caller points
+ * the model at `read_file`, which asks the user properly.
+ */
+export function sensitiveCommandReason(command) {
+    const reads = CONTENT_READERS.test(command) || INPUT_REDIRECT.test(command);
+    if (!reads)
+        return null;
+    for (const { needle, what } of COMMAND_SENSITIVE) {
+        if (needle.test(command))
+            return what;
+    }
+    return null;
+}
+// Irreversible, essentially-never-legitimate commands. Patterns are intentionally
+// narrow (high precision) so they don't get in the way of real work — the goal is
+// to catch the catastrophic mistake, not to police the shell.
+const CATASTROPHIC_PATTERNS = [
+    { test: /\brm\s+(-[a-z]*\s+)*-[a-z]*[rf][a-z]*\s+(-[a-z]+\s+)*(\/|~|\$HOME)(\s|$)/i, what: "recursively deleting the filesystem root or home directory" },
+    // Real disk-format commands only. `\bformat\b` matched the word anywhere, so every
+    // benign PowerShell display cmdlet — `Format-Table`, `Format-List`, `Format-Hex` — and
+    // even `git log --format=…` was refused as "reformatting a disk", blocking ordinary
+    // work. Now it catches `mkfs`, the CMD `format <drive>:` / `format /switch`, and the
+    // PowerShell cmdlets that actually erase a volume (`Format-Volume`, `Format-Disk`).
+    { test: /\bmkfs\b|\bformat\s+(?:[a-z]:|\/)|\bformat-(?:volume|disk)\b/i, what: "reformatting a disk" },
+    { test: /\bdd\b[^\n]*\bof=\/dev\/(sd|nvme|disk|hd)/i, what: "overwriting a raw disk device" },
+    { test: />\s*\/dev\/(sd|nvme|disk|hd)/i, what: "writing to a raw disk device" },
+    { test: /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/, what: "a fork bomb" },
+    { test: /\bRemove-Item\b[^\n]*\b-Recurse\b[^\n]*(\\|\/|\$env:|~)(\s|$)/i, what: "recursively deleting a drive root or home directory" },
+];
+/**
+ * If `command` is an irreversible, catastrophic action, return a short reason;
+ * otherwise null.
+ */
+export function catastrophicCommandReason(command) {
+    for (const { test, what } of CATASTROPHIC_PATTERNS) {
+        if (test.test(command))
+            return what;
+    }
+    return null;
+}
+//# sourceMappingURL=guard.js.map

package/dist/tools/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/tools/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,6EAA6E;AAC7E,iDAAiD;AACjD,MAAM,kBAAkB,GAAqC;IAC3D,qFAAqF;IACrF,+EAA+E;IAC/E,oFAAoF;IACpF,kFAAkF;IAClF,EAAE;IACF,sFAAsF;IACtF,6EAA6E;IAC7E,kFAAkF;IAClF,6BAA6B;IAC7B,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACtE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACnE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,6BAA6B,EAAE;IAChE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACnE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAC5D,EAAE,IAAI,EAAE,yCAAyC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC9E,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC/C,EAAE,IAAI,EAAE,wCAAwC,EAAE,IAAI,EAAE,4BAA4B,EAAE;CACvF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,kBAAkB,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,iFAAiF;AACjF,4DAA4D;AAC5D,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,kFAAkF;AAClF,kFAAkF;AAClF,+EAA+E;AAC/E,yCAAyC;AACzC,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,8EAA8E;AAC9E,MAAM,cAAc,GAAqC;IACvD,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,aAAa,EAAE;IACtD,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,aAAa,EAAE;IACnD,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjD,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjD,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAC/C,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAC/C,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,UAAU,EAAE;IACrD,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,UAAU,EAAE;IACrD,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,SAAS,EAAE;IACnD,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,sBAAsB,EAAE;CAC7D,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,cAAc,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;uCAEuC;AACvC,MAAM,CAAC,MAAM,UAAU,GAAsB;IAC3C,SAAS;IACT,SAAS;IACT,QAAQ;IACR,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,aAAa;IACb,GAAG,UAAU;IACb,WAAW;IACX,WAAW;IACX,cAAc;IACd,SAAS;CACV,CAAC;AAEF;;+EAE+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,mBAAmB,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,kBAAkB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AACvF,CAAC;AAED,wDAAwD;AACxD,MAAM,iBAAiB,GAAuC;IAC5D,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,6BAA6B,EAAE;IAC3E,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,EAAE;IACpE,EAAE,MAAM,EAAE,iCAAiC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACxE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAClD,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,oBAAoB,EAAE;IACrE,EAAE,MAAM,EAAE,qCAAqC,EAAE,IAAI,EAAE,eAAe,EAAE;IACxE,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE;IAC5D,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACpE,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACpE,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,gBAAgB,EAAE;CACnE,CAAC;AAEF,mFAAmF;AACnF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,kFAAkF;AAClF,kEAAkE;AAClE,EAAE;AACF,2EAA2E;AAC3E,0DAA0D;AAC1D,MAAM,eAAe,GACnB,sLAAsL,CAAC;AAEzL,4EAA4E;AAC5E,MAAM,cAAc,GAAG,eAAe,CAAC;AAEvC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,8DAA8D;AAC9D,MAAM,qBAAqB,GAAqC;IAC9D,EAAE,IAAI,EAAE,2EAA2E,EAAE,IAAI,EAAE,4DAA4D,EAAE;IACzJ,mFAAmF;IACnF,uFAAuF;IACvF,oFAAoF;IACpF,qFAAqF;IACrF,oFAAoF;IACpF,EAAE,IAAI,EAAE,+DAA+D,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACtG,EAAE,IAAI,EAAE,4CAA4C,EAAE,IAAI,EAAE,+BAA+B,EAAE;IAC7F,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,8BAA8B,EAAE;IAC/E,EAAE,IAAI,EAAE,0CAA0C,EAAE,IAAI,EAAE,aAAa,EAAE;IACzE,EAAE,IAAI,EAAE,gEAAgE,EAAE,IAAI,EAAE,qDAAqD,EAAE;CACxI,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tools/killTree.js

@@ -0,0 +1,215 @@
+/**
+ * killTree.ts — spawning a child we can later kill completely, and killing it.
+ *
+ * Spawn and kill live in ONE module because they share one invariant. Killing a
+ * shell alone leaves grandchildren (node → jest, npx → the real server, a dev
+ * server) holding the output pipe open, so the job looks hung forever. Killing the
+ * whole tree needs `taskkill /T` on Windows and the negative-pid process group on
+ * POSIX — and the process group only exists if the child was spawned `detached`.
+ *
+ * That invariant used to be a sentence in a comment, and two of the three callers
+ * did not honour it: the MCP stdio transport and the language-server host both
+ * spawned attached and then skipped the tree kill entirely off Windows, so on macOS
+ * and Linux only the direct child was ever signalled and its children were orphaned.
+ * `spawnManaged` exists so that cannot happen again: every child that will later be
+ * tree-killed is created through it, and it sets the group up correctly by
+ * construction rather than by remembering.
+ *
+ * TWO KILL VARIANTS, and the difference is not cosmetic. `killTree` is asynchronous
+ * and escalates politely. It does NOT work from a `process.on("exit")` handler: Node
+ * runs no async work during exit, so neither a spawn nor a timer ever reaches the
+ * OS and the process survives — measured, not assumed. Anything disposing from an
+ * exit handler must call `killTreeSync`, which blocks and goes straight to the
+ * forceful signal because there is no time left to be polite.
+ *
+ * Why not make everything synchronous and delete the footgun? Measured on this
+ * machine, `spawnSync("taskkill /F /T")` blocks for a median of 122ms (max 140ms)
+ * per tree. Session teardown kills several at once, so an always-sync version would
+ * freeze the UI for a noticeable fraction of a second on every swap.
+ */
+import { spawn, spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+const IS_WINDOWS = process.platform === "win32";
+/**
+ * How long a process gets to shut down cleanly before it is killed outright.
+ *
+ * POSIX only, and it matters: a dev server, a language server, or an MCP server
+ * asked to stop will flush state, release a port, and close a socket if it is given
+ * a chance. Going straight to SIGKILL — which is what this module used to do — denies
+ * that, and the cost shows up later as a held port or a half-written file.
+ */
+const TERM_GRACE_MS = 2_000;
+/** taskkill arguments for a whole process tree. */
+function killArgs(pid) {
+    return ["/F", "/T", "/PID", String(pid)];
+}
+/**
+ * Spawn a child that can later be tree-killed.
+ *
+ * Use this for any process with a lifetime — a shell command, an MCP server, a
+ * language server. On POSIX it becomes its own process-group leader, which is the
+ * precondition `killTree` depends on; on Windows the group is handled by `taskkill
+ * /T` and nothing extra is needed. Callers keep full control of stdio, cwd and env;
+ * only the group setting is decided here, because that is the part that has to be
+ * consistent for the kill path to work.
+ */
+export function spawnManaged(command, args, options = {}) {
+    return spawn(command, args, {
+        ...options,
+        windowsHide: options.windowsHide ?? true,
+        // POSIX: lead our own process group so the whole tree can be signalled at once.
+        // Windows has no process groups in this sense; taskkill /T walks the tree instead.
+        detached: IS_WINDOWS ? false : (options.detached ?? true),
+    });
+}
+/**
+ * Kill `pid` and everything beneath it. Non-blocking.
+ *
+ * POSIX escalates: SIGTERM to the group, then SIGKILL to whatever is still there
+ * after the grace period. Windows uses `taskkill /F /T`, which is already a forced
+ * whole-tree kill. Use only where an event loop is still running; see `killTreeSync`.
+ */
+/**
+ * Signal the process GROUP led by `pid`, falling back to the process itself.
+ *
+ * The group is the point: it reaches grandchildren. But a group only exists if the
+ * child was spawned `detached`, which is what `spawnManaged` guarantees. A pid from
+ * a plain `spawn` leads no group, so `kill(-pid)` raises ESRCH and the whole kill
+ * used to be swallowed by a `catch` and do NOTHING, with no error and no signal.
+ *
+ * That silent no-op is what hangs a POSIX process: the child survives, its handle
+ * keeps the event loop alive, and the parent never exits. MEASURED on Linux, a
+ * plainly-spawned child was still in state `S` after killTreeSync returned.
+ *
+ * Falling back to the bare pid means the caller always gets the kill they asked
+ * for. Grandchildren of a non-detached child are still missed, which is exactly why
+ * `spawnManaged` exists, but one dead process beats zero.
+ */
+function signalGroupThenSelf(pid, signal) {
+    try {
+        process.kill(-pid, signal);
+    }
+    catch {
+        try {
+            process.kill(pid, signal);
+        }
+        catch {
+            // Already gone, or no permission — nothing more we can do.
+        }
+    }
+}
+export function killTree(pid) {
+    if (pid === undefined)
+        return;
+    try {
+        if (IS_WINDOWS) {
+            spawn("taskkill", killArgs(pid), { windowsHide: true, stdio: "ignore" });
+            return;
+        }
+        signalGroupThenSelf(pid, "SIGTERM");
+        const escalate = setTimeout(() => {
+            signalGroupThenSelf(pid, "SIGKILL");
+        }, TERM_GRACE_MS);
+        // Never hold the process open just to deliver a follow-up kill.
+        escalate.unref?.();
+    }
+    catch {
+        // Already gone, or no permission — nothing more we can do.
+    }
+}
+/**
+ * How long to wait for the OS to actually finish killing before giving up.
+ *
+ * SIGKILL cannot be caught, blocked or ignored, so this deadline is not there for
+ * a process that resists — nothing resists SIGKILL. It exists for the pathological
+ * case where a process is wedged in uninterruptible kernel I/O (state `D`), where
+ * the kill is pending until that I/O completes and waiting longer would not help.
+ * Better to return late than to hang a shutdown forever.
+ */
+const KILL_CONFIRM_MS = 1_500;
+/** One shared buffer for the sync sleep; allocating per poll would churn. */
+const SLEEP_SLOT = new Int32Array(new SharedArrayBuffer(4));
+/**
+ * Block this thread for `ms` with no event loop involved.
+ *
+ * `Atomics.wait` on a value that never changes is the only true synchronous sleep
+ * in Node. setTimeout is useless here by definition: the callers of this module
+ * run from `process.on("exit")`, where no timer will ever fire again.
+ */
+function sleepSync(ms) {
+    Atomics.wait(SLEEP_SLOT, 0, 0, ms);
+}
+/**
+ * Kill `pid` and its descendants, blocking until it has happened.
+ *
+ * The variant that works from a `process.on("exit")` handler. No grace period: the
+ * process is on its way out and there is no event loop left to deliver a follow-up
+ * signal on, so a polite first attempt would simply be the only attempt and would
+ * leave anything that ignores SIGTERM running.
+ *
+ * "Blocking until it has happened" is the whole contract, and it used to be a lie.
+ * Sending a signal is not the same as the target being dead: `process.kill` returns
+ * as soon as the signal is QUEUED, and for a window after that the process is still
+ * scheduled, still holding its port, still listed as running. An exit handler gets
+ * no second chance to look, so a caller that returned into `process.exit` left a
+ * live process behind. MEASURED: `isProcessStopped` reported a just-SIGKILLed child
+ * as alive immediately after this function returned.
+ *
+ * So the kill is now CONFIRMED before returning, not merely sent.
+ */
+export function killTreeSync(pid) {
+    if (pid === undefined)
+        return;
+    try {
+        if (IS_WINDOWS) {
+            spawnSync("taskkill", killArgs(pid), { windowsHide: true, stdio: "ignore" });
+        }
+        else {
+            signalGroupThenSelf(pid, "SIGKILL");
+        }
+    }
+    catch {
+        // Already gone, or no permission — nothing more we can do.
+    }
+    // Poll until the OS agrees the process is gone. Costs nothing in the common case
+    // (the first check almost always passes); it is the rare slow reap that this
+    // exists for, because that is exactly when an exit handler would leak a process.
+    const deadline = Date.now() + KILL_CONFIRM_MS;
+    while (!isProcessStopped(pid) && Date.now() < deadline) {
+        sleepSync(1);
+    }
+}
+/**
+ * Has `pid` stopped running? Not the same as "does the pid exist".
+ *
+ * On POSIX a SIGKILLed child stays a ZOMBIE until its parent reaps it, and
+ * `kill(pid, 0)` succeeds against a zombie, so the obvious liveness check reports a
+ * process we just killed as still alive. MEASURED: right after killTreeSync, a
+ * correctly killed child sat in state `Z`. Callers that need "is it gone" therefore
+ * have to read the state, not just probe for existence.
+ *
+ * Windows has no zombie stage, so existence is the whole answer there.
+ */
+export function isProcessStopped(pid) {
+    if (pid === undefined)
+        return true;
+    try {
+        process.kill(pid, 0);
+    }
+    catch {
+        return true; // no such process
+    }
+    if (IS_WINDOWS)
+        return false;
+    try {
+        // /proc/<pid>/stat: the state letter follows the parenthesised command name,
+        // which can itself contain spaces or parens, so split on the LAST ") ".
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+        const after = stat.slice(stat.lastIndexOf(") ") + 2);
+        return after.startsWith("Z"); // reaped-pending is stopped for every practical purpose
+    }
+    catch {
+        return true; // /proc entry vanished between the two checks
+    }
+}
+//# sourceMappingURL=killTree.js.map

package/dist/tools/killTree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"killTree.js","sourceRoot":"","sources":["../../src/tools/killTree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAwC,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,mDAAmD;AACnD,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,IAAuB,EAAE,UAAwB,EAAE;IAC/F,OAAO,KAAK,CAAC,OAAO,EAAE,IAAgB,EAAE;QACtC,GAAG,OAAO;QACV,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,gFAAgF;QAChF,mFAAmF;QACnF,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;KAC1D,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH;;;;;;;;;;;;;;;GAeG;AACH,SAAS,mBAAmB,CAAC,GAAW,EAAE,MAAsB;IAC9D,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAuB;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC,EAAE,aAAa,CAAC,CAAC;QAClB,gEAAgE;QAChE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,iFAAiF;IACjF,6EAA6E;IAC7E,iFAAiF;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAC9C,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACvD,SAAS,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,kBAAkB;IACjC,CAAC;IACD,IAAI,UAAU;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,CAAC;QACH,6EAA6E;QAC7E,wEAAwE;QACxE,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,wDAAwD;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,8CAA8C;IAC7D,CAAC;AACH,CAAC"}

package/dist/tools/listDir.js

@@ -0,0 +1,143 @@
+/**
+ * listDir.ts — list the entries of one directory.
+ *
+ * The quickest way for the model to get its bearings: what's in this folder?
+ * Read-only, single level (use glob for a recursive search). Directories are
+ * marked with a trailing slash so the model can tell them from files at a glance.
+ */
+import { promises as fs } from "node:fs";
+import { join } from "node:path";
+import { isMultiRoot, relativize, searchUnits } from "./paths.js";
+import { DEFAULT_IGNORES } from "./walk.js";
+import { fail } from "./results.js";
+/** Entries shown per directory before the list is cut short (the cut is always
+ *  announced). Exported so the number in the description is pinned to the real value. */
+export const MAX_ENTRIES = 400;
+export const listDir = {
+    name: "list_dir",
+    readOnly: true,
+    // The trailing-slash promise was the whole reading key and it was silently wrong on
+    // symlinked directories, so the marks each get spelled out now. The paragraph about
+    // seeing more than a search does is the one that earns its place: this is the only
+    // tool that reports the disk as it is, so it is where the model finds out that a
+    // file it cannot grep for, or cannot read at all, nevertheless exists.
+    description: "List the immediate contents of a directory: one level, not recursive. Use glob to " +
+        "match paths recursively, and grep to search inside files. Given no path it lists " +
+        "every session root.\n" +
+        "HOW TO READ IT: entries come directories first, then alphabetically. A trailing " +
+        "slash means a directory. `(symlink)` means the entry is a link, and it still gets " +
+        "the slash when it points at a directory; `(broken symlink)` means the target is " +
+        "gone. `(skipped by search)` marks a directory that is really there but that glob " +
+        "and grep will not descend into, which is why a file inside it can exist and still " +
+        `never appear in a search. Long listings stop after ${MAX_ENTRIES} entries and say ` +
+        "how many were left out.\n" +
+        "This reports the DISK, not the searchable tree, so it shows more than the search " +
+        "tools do: secrets, other agents' folders, and ignored build output all appear " +
+        "here. Seeing something listed is therefore not a promise you may open it — " +
+        "read_file still refuses secrets, and asks before another agent's data. Treat a " +
+        "listing as evidence of what exists, and let the read decide what you may see.",
+    parameters: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+            path: {
+                type: "string",
+                description: "Directory (or a root's label) to list. Defaults to every session root.",
+            },
+        },
+    },
+    async execute(args, ctx) {
+        const rawPath = typeof args.path === "string" && args.path.trim() ? args.path.trim() : undefined;
+        const units = searchUnits(ctx, rawPath);
+        const multi = isMultiRoot(ctx) && !rawPath; // group with headers when sweeping roots
+        const blocks = [];
+        let total = 0;
+        for (const unit of units) {
+            const dir = unit.sub ? join(unit.root, unit.sub) : unit.root;
+            const listed = await listOne(ctx, dir, unit);
+            if (!listed) {
+                if (rawPath)
+                    return fail(await whyUnreadable(dir, rawPath));
+                continue;
+            }
+            total += listed.count;
+            blocks.push(multi ? `${relativize(ctx, dir)}/\n${indent(listed.body)}` : listed.body);
+        }
+        if (blocks.length === 0)
+            return fail(`directory not found: ${rawPath ?? "."}`);
+        return {
+            output: blocks.join("\n\n"),
+            summary: `list ${units.length > 1 ? `${units.length} roots` : relativize(ctx, units[0].sub ? join(units[0].root, units[0].sub) : units[0].root)} (${total} item${total === 1 ? "" : "s"})`,
+        };
+    },
+};
+/**
+ * What an entry actually IS, following symlinks.
+ *
+ * `readdir` reports a symlink as a symlink and nothing else: for a junction or
+ * symlink pointing at a directory, `isDirectory()` and `isFile()` are BOTH false
+ * (measured, not assumed). So the trailing slash this tool promises never appeared
+ * on a linked directory and it read as an ordinary file — which matters most exactly
+ * where links are common, in node_modules/.bin and in a linked monorepo package.
+ * Only symlinks cost an extra stat, and a broken one is reported rather than thrown.
+ */
+async function classify(dir, e) {
+    if (!e.isSymbolicLink())
+        return { isDir: e.isDirectory(), note: "" };
+    try {
+        const st = await fs.stat(join(dir, e.name)); // follows the link
+        return { isDir: st.isDirectory(), note: "  (symlink)" };
+    }
+    catch {
+        return { isDir: false, note: "  (broken symlink)" };
+    }
+}
+/** List one directory's immediate entries (dirs first), or null if unreadable. */
+async function listOne(ctx, dir, _unit) {
+    let entries;
+    try {
+        entries = await fs.readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return null;
+    }
+    const resolved = await Promise.all(entries.map(async (e) => ({ name: e.name, ...(await classify(dir, e)) })));
+    resolved.sort((a, b) => {
+        const ad = a.isDir ? 0 : 1;
+        const bd = b.isDir ? 0 : 1;
+        return ad !== bd ? ad - bd : a.name.localeCompare(b.name);
+    });
+    if (resolved.length === 0)
+        return { body: "(empty directory)", count: 0 };
+    const truncated = resolved.length > MAX_ENTRIES;
+    const shown = resolved.slice(0, MAX_ENTRIES).map((e) => {
+        const noisy = e.isDir && DEFAULT_IGNORES.has(e.name);
+        return `${e.name}${e.isDir ? "/" : ""}${e.note}${noisy ? "  (skipped by search)" : ""}`;
+    });
+    if (truncated)
+        shown.push(`… (${resolved.length - MAX_ENTRIES} more)`);
+    return { body: shown.join("\n"), count: resolved.length };
+}
+/**
+ * Say why a directory could not be listed instead of always claiming it is missing.
+ *
+ * `readdir` fails the same way for a path that does not exist, a path that is a FILE,
+ * and a directory the OS will not open. Reporting all three as "directory not found"
+ * sent the model looking for a file it had already found: pointing `list_dir` at a
+ * real file answered as though the file were not there.
+ */
+async function whyUnreadable(dir, shown) {
+    try {
+        const st = await fs.stat(dir);
+        if (st.isDirectory())
+            return `cannot read directory (permission denied?): ${shown}`;
+        return `not a directory, it is a file: ${shown} — use read_file to see its contents`;
+    }
+    catch {
+        return `directory not found: ${shown}`;
+    }
+}
+function indent(text) {
+    return text.split("\n").map((l) => `  ${l}`).join("\n");
+}
+//# sourceMappingURL=listDir.js.map

package/dist/tools/listDir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listDir.js","sourceRoot":"","sources":["../../src/tools/listDir.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAe,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpC;yFACyF;AACzF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC;AAE/B,MAAM,CAAC,MAAM,OAAO,GAAS;IAC3B,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,IAAI;IACd,oFAAoF;IACpF,oFAAoF;IACpF,mFAAmF;IACnF,iFAAiF;IACjF,uEAAuE;IACvE,WAAW,EACT,oFAAoF;QACpF,mFAAmF;QACnF,uBAAuB;QACvB,kFAAkF;QAClF,oFAAoF;QACpF,kFAAkF;QAClF,mFAAmF;QACnF,oFAAoF;QACpF,sDAAsD,WAAW,mBAAmB;QACpF,2BAA2B;QAC3B,mFAAmF;QACnF,gFAAgF;QAChF,6EAA6E;QAC7E,iFAAiF;QACjF,+EAA+E;IACjF,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,UAAU,EAAE;YACV,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,wEAAwE;aACtF;SACF;KACF;IAED,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;QACrB,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,yCAAyC;QAErF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,OAAO;oBAAE,OAAO,IAAI,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC5D,SAAS;YACX,CAAC;YACD,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxF,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,wBAAwB,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QAC/E,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAC3B,OAAO,EAAE,QAAQ,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;SAC/L,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,CAAS;IAC5C,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB;QAChE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,OAAO,CAAC,GAAgB,EAAE,GAAW,EAAE,KAAiB;IACrE,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC1E,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAE1E,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;IACH,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,GAAG,WAAW,QAAQ,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,KAAa;IACrD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,EAAE,CAAC,WAAW,EAAE;YAAE,OAAO,+CAA+C,KAAK,EAAE,CAAC;QACpF,OAAO,kCAAkC,KAAK,sCAAsC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,KAAK,EAAE,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC"}