opencode-polkit 0.1.2 → 0.1.4

package/README.md

@@ -4,8 +4,14 @@ Redirect `sudo`/`doas` to `pkexec` in [OpenCode](https://opencode.ai).
 Triggers the system's native polkit authentication dialog (KDE, GNOME, etc.)
 instead of requiring a terminal for password input.
 
-When polkit is unavailable, privilege escalation commands are blocked with a
-clear error message.
+Like CachyOS Hello, the plugin does not check for a polkit agent up front:
+`sudo` is always redirected to `pkexec` at execution time, and polkitd routes
+the request to whatever agent is currently registered. Without an agent,
+`pkexec` fails fast with `Error creating textual authentication agent`
+(no TTY); the plugin reports that as a clear denial. A hang (dialog never
+appears) is bounded by the bash tool's own timeout (default 2 min,
+configurable up to 10 min) and left untranslated — it cannot be told
+apart from a long-running command.
 
 ## Install
 
@@ -21,17 +27,44 @@ Or add to `opencode.json` / `~/.config/opencode/opencode.jsonc`:
 }
 ```
 
+For local development, point opencode at the project directory instead:
+
+```json
+{
+  "plugin": ["/path/to/opencode-polkit"]
+}
+```
+
 ## Behavior
 
-| Command         | polkit available               | polkit unavailable   |
-|-----------------|--------------------------------|----------------------|
-| `sudo xxx`      | redirects to `pkexec xxx`      | blocked with error   |
-| `doas xxx`      | redirects to `pkexec xxx`      | blocked with error   |
-| `pkexec xxx`    | passes through                 | blocked with error   |
-| `sudoedit`      | blocked                        | blocked              |
-| `visudo`        | blocked                        | blocked              |
+| Command               | result                                                |
+|-----------------------|-------------------------------------------------------|
+| `sudo xxx`            | redirects to `pkexec xxx`                             |
+| `doas xxx`            | redirects to `pkexec xxx`                             |
+| `cat x \| sudo tee y` | redirects to `cat x \| pkexec tee y` (mid-command)    |
+| `pkexec xxx`          | passes through                                        |
+| `sudoedit` / `visudo` | blocked                                               |
+
+### Minimal intervention
+
+The command is rewritten **only** by replacing `sudo`/`doas` with
+`pkexec` — its shape is otherwise untouched, so the agent always sees a
+command that behaves like the one it wrote. Privilege keywords are found
+by a lexical scanner (quote/escape/heredoc aware): `sudo` inside string
+literals, comments or heredocs is ignored; `sudo` in any executable
+position (leading, after `&&`/`||`/`|`, in `$(...)` or subshells) is
+rewritten. `sudo a && sudo b` rewrites both.
+
+### Failures
 
-When a user denies the polkit authentication dialog, a clear error message is shown.
+Unambiguous authentication failures are reported as clear errors and the
+command is remembered so a retry is rejected without prompting again
+(cleared when opencode restarts): `Not authorized`, `Error executing
+command as another user`, `Error creating textual authentication agent`
+(no polkit agent + no TTY). A hang (dialog never appears) is bounded by
+the bash tool's own timeout (default 2 min, configurable up to 10 min)
+and is left untranslated — it cannot be told apart from a long-running
+command.
 
 ## i18n
 

package/dist/index.js

@@ -1,77 +1,138 @@
-const MATCH = /(?<![-\/.\w])(sudo|pkexec|doas|sudoedit|visudo)(?![-\/.\w])/i;
-const POLKIT_AGENTS = [
-    "polkit-kde-authentication-agent-1",
-    "polkit-gnome-authentication-agent-1",
-    "lxqt-policykit-agent",
-    "mate-polkit",
-    "xfce-polkit",
-    "dde-polkit-agent",
-];
+/**
+ * Lexical scan for privilege-escalation keywords OUTSIDE quotes.
+ *
+ * Shell commands may contain `sudo` anywhere a command starts (pipes,
+ * `&&`/`||`, subshells, command substitution), and string literals /
+ * comments may contain the same words spuriously. A plain regex cannot
+ * tell those apart; this scanner tracks quote state (' " and backslash
+ * escapes) and only reports keywords in executable position.
+ *
+ * - `node -e "…sudo…"`        → no hit (inside quotes)
+ * - `cat x | sudo tee y`       → hit at index 8 (command boundary)
+ * - `cd /tmp && sudo ./x`      → hit (after `&&`)
+ */
+function scanPrivileged(command) {
+    const hits = [];
+    let inSingle = false;
+    let inDouble = false;
+    let escaped = false;
+    // Heredoc delimiters waiting to close (stack; multiple << are legal).
+    const heredocs = [];
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        // Inside a heredoc body: only a line consisting of the delimiter ends
+        // it. Content there is a string literal, never a command.
+        if (heredocs.length > 0) {
+            const lineEnd = command.indexOf("\n", i);
+            const line = lineEnd === -1 ? command.slice(i) : command.slice(i, lineEnd);
+            if (heredocs.some((d) => line === d)) {
+                heredocs.pop();
+            }
+            i = lineEnd === -1 ? command.length : lineEnd;
+            continue;
+        }
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === "\\" && !inSingle) {
+            escaped = true;
+            continue;
+        }
+        if (ch === "'" && !inDouble) {
+            inSingle = !inSingle;
+            continue;
+        }
+        if (ch === '"' && !inSingle) {
+            inDouble = !inDouble;
+            continue;
+        }
+        if (inSingle || inDouble)
+            continue;
+        // Heredoc start: `<<[-]DELIM` (delim may be quoted or unquoted).
+        if (ch === "<" && command[i + 1] === "<") {
+            let j = i + 2;
+            if (command[j] === "-")
+                j++;
+            while (j < command.length && /\s/.test(command[j]))
+                j++;
+            if (j < command.length && (command[j] === "'" || command[j] === '"')) {
+                const q = command[j];
+                const end = command.indexOf(q, j + 1);
+                if (end !== -1) {
+                    heredocs.push(command.slice(j + 1, end));
+                    i = end;
+                    continue;
+                }
+            }
+            else {
+                const m = /^[^\s|;&<>()]+/.exec(command.slice(j));
+                if (m) {
+                    heredocs.push(m[0]);
+                    i = j + m[0].length - 1;
+                    continue;
+                }
+            }
+        }
+        const prev = i > 0 ? command[i - 1] : "";
+        if (/[-\/.\w]/.test(prev))
+            continue;
+        for (const kw of ["sudoedit", "visudo", "sudo", "doas", "pkexec"]) {
+            if (command.startsWith(kw, i)) {
+                const next = command[i + kw.length] ?? "";
+                if (!/[-\/.\w]/.test(next)) {
+                    hits.push({ index: i, kw });
+                    i += kw.length - 1;
+                    break;
+                }
+            }
+        }
+    }
+    return hits;
+}
 const translations = {
     en: {
         blocked: "Privilege escalation command blocked by plugin",
-        noPolkit: "sudo/doas blocked: no polkit agent detected, cannot escalate safely",
-        noPolkitPkexec: "pkexec unavailable: no polkit agent detected",
         polkitDenied: "Polkit authentication denied by user",
     },
     zh: {
         blocked: "权限提升命令已被插件拦截",
-        noPolkit: "sudo/doas 已被拦截：未检测到 polkit agent，无法安全提权",
-        noPolkitPkexec: "pkexec 不可用：未检测到 polkit agent",
         polkitDenied: "Polkit 认证已被用户拒绝",
     },
     ja: {
         blocked: "特権昇格コマンドはプラグインによりブロックされました",
-        noPolkit: "sudo/doas がブロックされました：polkit エージェントが見つからないため、安全に昇格できません",
-        noPolkitPkexec: "pkexec は利用できません：polkit エージェントが見つかりません",
         polkitDenied: "Polkit 認証がユーザーによって拒否されました",
     },
     ko: {
         blocked: "권한 상승 명령이 플러그인에 의해 차단되었습니다",
-        noPolkit: "sudo/doas 차단됨: polkit 에이전트가 감지되지 않아 안전하게 권한 상승할 수 없습니다",
-        noPolkitPkexec: "pkexec 사용 불가: polkit 에이전트가 감지되지 않았습니다",
         polkitDenied: "Polkit 인증이 사용자에 의해 거부되었습니다",
     },
     de: {
         blocked: "Berechtigungseskalation vom Plugin blockiert",
-        noPolkit: "sudo/doas blockiert: kein polkit-Agent erkannt, sichere Eskalation nicht möglich",
-        noPolkitPkexec: "pkexec nicht verfügbar: kein polkit-Agent erkannt",
         polkitDenied: "Polkit-Authentifizierung vom Benutzer abgelehnt",
     },
     fr: {
         blocked: "Commande d'élévation de privilèges bloquée par le plugin",
-        noPolkit: "sudo/doas bloqué : aucun agent polkit détecté, élévation impossible",
-        noPolkitPkexec: "pkexec indisponible : aucun agent polkit détecté",
         polkitDenied: "Authentification polkit refusée par l'utilisateur",
     },
     es: {
         blocked: "Comando de elevación de privilegios bloqueado por el plugin",
-        noPolkit: "sudo/doas bloqueado: no se detectó agente polkit, no se puede elevar de forma segura",
-        noPolkitPkexec: "pkexec no disponible: no se detectó agente polkit",
         polkitDenied: "Autenticación polkit denegada por el usuario",
     },
     pt: {
         blocked: "Comando de elevação de privilégios bloqueado pelo plugin",
-        noPolkit: "sudo/doas bloqueado: nenhum agente polkit detectado, não é possível elevar com segurança",
-        noPolkitPkexec: "pkexec indisponível: nenhum agente polkit detectado",
         polkitDenied: "Autenticação polkit negada pelo usuário",
     },
     ru: {
         blocked: "Команда повышения привилегий заблокирована плагином",
-        noPolkit: "sudo/doas заблокирован: не обнаружен polkit-агент, невозможно безопасно повысить привилегии",
-        noPolkitPkexec: "pkexec недоступен: не обнаружен polkit-агент",
         polkitDenied: "Аутентификация polkit отклонена пользователем",
     },
     tr: {
         blocked: "Yetki yükseltme komutu eklenti tarafından engellendi",
-        noPolkit: "sudo/doas engellendi: polkit aracısı algılanmadı, güvenli şekilde yetki yükseltilemez",
-        noPolkitPkexec: "pkexec kullanılamıyor: polkit aracısı algılanmadı",
         polkitDenied: "Polkit kimlik doğrulaması kullanıcı tarafından reddedildi",
     },
     uk: {
         blocked: "Команду підвищення привілеїв заблоковано плагіном",
-        noPolkit: "sudo/doas заблоковано: не виявлено агента polkit, неможливо безпечно підвищити привілеї",
-        noPolkitPkexec: "pkexec недоступний: не виявлено агента polkit",
         polkitDenied: "Автентифікацію polkit відхилено користувачем",
     },
 };
@@ -85,29 +146,6 @@ function detectLocale() {
     return "en";
 }
 const MSG = translations[detectLocale()] ?? translations.en;
-function polkitAvailable() {
-    try {
-        if (process.env.DBUS_SESSION_BUS_ADDRESS) {
-            const proc = Bun.spawnSync(["busctl", "--user", "list"], {
-                stdio: ["ignore", "pipe", "pipe"],
-            });
-            if (proc.exitCode === 0 && /\bpolkit\b/i.test(new TextDecoder().decode(proc.stdout))) {
-                return true;
-            }
-        }
-    }
-    catch { /* fall through */ }
-    try {
-        const proc = Bun.spawnSync(["pgrep", "-x", ...POLKIT_AGENTS], {
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-        return proc.exitCode === 0;
-    }
-    catch {
-        return false;
-    }
-}
-const hasPolkit = polkitAvailable();
 export const PolkitPlugin = async (_input) => {
     const deniedCommands = new Set();
     return {
@@ -115,37 +153,56 @@ export const PolkitPlugin = async (_input) => {
             if (hookInput.tool !== "bash")
                 return;
             const command = hookOutput?.args?.command ?? "";
-            if (!MATCH.test(command))
+            const hits = scanPrivileged(command);
+            if (hits.length === 0)
                 return;
             if (deniedCommands.has(command)) {
                 throw new Error(MSG.polkitDenied);
             }
-            if (/^pkexec(?![-\/.\w])/.test(command.trim())) {
-                if (!hasPolkit)
-                    throw new Error(MSG.noPolkitPkexec);
-                return;
-            }
-            if (/(?<![-\/.\w])(sudoedit|visudo)(?![-\/.\w])/.test(command)) {
+            if (hits.some((h) => h.kw === "sudoedit" || h.kw === "visudo")) {
                 throw new Error(MSG.blocked);
             }
-            if (!hasPolkit) {
-                throw new Error(MSG.noPolkit);
+            // Already pkexec (leading or mid-command): pass through untouched.
+            if (hits.every((h) => h.kw === "pkexec"))
+                return;
+            // Rewrite every in-command sudo/doas to pkexec (back to front so
+            // indices stay valid): `cat x | sudo tee y` -> `cat x | pkexec tee y`.
+            // No other rewriting: the command keeps its exact shape so the agent
+            // sees only the minimal change (sudo -> pkexec).
+            let rewritten = command;
+            for (const h of [...hits].reverse()) {
+                if (h.kw === "sudo" || h.kw === "doas") {
+                    rewritten =
+                        rewritten.slice(0, h.index) + "pkexec" + rewritten.slice(h.index + h.kw.length);
+                }
             }
-            hookOutput.args.command = command.replace(/(?<![-\/.\w])(sudo|doas)(?![-\/.\w])/, "pkexec");
+            hookOutput.args.command = rewritten;
         },
         "tool.execute.after": async (hookInput, hookOutput) => {
             if (hookInput.tool !== "bash")
                 return;
             const command = hookInput.args?.command ?? "";
-            if (!MATCH.test(command))
+            const hits = scanPrivileged(command);
+            if (hits.length === 0)
                 return;
-            const originalCommand = command.replace(/(?<![-\/.\w])pkexec(?![-\/.\w])/, "sudo");
+            // Reconstruct the user's original command for the deny list: map
+            // pkexec back to sudo.
+            let original = command;
+            for (const h of [...scanPrivileged(original)].reverse()) {
+                if (h.kw === "pkexec") {
+                    original = original.slice(0, h.index) + "sudo" + original.slice(h.index + 6);
+                }
+            }
+            // Only unambiguous authentication failures are reported and deny
+            // listed. A hang (dialog never appears) is bounded by the bash tool's
+            // own timeout (default 2 min) and is NOT translated here: it cannot
+            // be told apart from a long-running command.
             if (/\bNot authorized\b/.test(hookOutput.output) ||
-                /\bError executing command as another user\b/.test(hookOutput.output)) {
-                deniedCommands.add(originalCommand);
+                /\bError executing command as another user\b/.test(hookOutput.output) ||
+                /\bError creating textual authentication agent\b/.test(hookOutput.output)) {
+                deniedCommands.add(original);
                 throw new Error(MSG.polkitDenied);
             }
         },
     };
 };
-//# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-polkit",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Redirect sudo/doas to pkexec in OpenCode — uses system polkit agent for native auth dialogs",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,8 +17,8 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "npm run build"
+    "build": "deno task build",
+    "check": "deno task check"
   },
   "engines": {
     "opencode": ">=1.0.0"

package/dist/index.d.ts

@@ -1,3 +0,0 @@
-import type { Plugin } from "@opencode-ai/plugin";
-export declare const PolkitPlugin: Plugin;
-//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAA;AA2H9D,eAAO,MAAM,YAAY,EAAE,MAgD1B,CAAA"}

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,KAAK,GAAG,8DAA8D,CAAA;AAE5E,MAAM,aAAa,GAAG;IACpB,mCAAmC;IACnC,qCAAqC;IACrC,sBAAsB;IACtB,aAAa;IACb,aAAa;IACb,kBAAkB;CACnB,CAAA;AASD,MAAM,YAAY,GAA6B;IAC7C,EAAE,EAAE;QACF,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,qEAAqE;QAC/E,cAAc,EAAE,8CAA8C;QAC9D,YAAY,EAAE,sCAAsC;KACrD;IACD,EAAE,EAAE;QACF,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,yCAAyC;QACnD,cAAc,EAAE,8BAA8B;QAC9C,YAAY,EAAE,iBAAiB;KAChC;IACD,EAAE,EAAE;QACF,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,wDAAwD;QAClE,cAAc,EAAE,uCAAuC;QACvD,YAAY,EAAE,2BAA2B;KAC1C;IACD,EAAE,EAAE;QACF,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,wDAAwD;QAClE,cAAc,EAAE,uCAAuC;QACvD,YAAY,EAAE,4BAA4B;KAC3C;IACD,EAAE,EAAE;QACF,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,kFAAkF;QAC5F,cAAc,EAAE,mDAAmD;QACnE,YAAY,EAAE,iDAAiD;KAChE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,qEAAqE;QAC/E,cAAc,EAAE,kDAAkD;QAClE,YAAY,EAAE,mDAAmD;KAClE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,6DAA6D;QACtE,QAAQ,EAAE,sFAAsF;QAChG,cAAc,EAAE,mDAAmD;QACnE,YAAY,EAAE,8CAA8C;KAC7D;IACD,EAAE,EAAE;QACF,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,0FAA0F;QACpG,cAAc,EAAE,qDAAqD;QACrE,YAAY,EAAE,yCAAyC;KACxD;IACD,EAAE,EAAE;QACF,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,6FAA6F;QACvG,cAAc,EAAE,8CAA8C;QAC9D,YAAY,EAAE,+CAA+C;KAC9D;IACD,EAAE,EAAE;QACF,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,uFAAuF;QACjG,cAAc,EAAE,mDAAmD;QACnE,YAAY,EAAE,2DAA2D;KAC1E;IACD,EAAE,EAAE;QACF,OAAO,EAAE,mDAAmD;QAC5D,QAAQ,EAAE,yFAAyF;QACnG,cAAc,EAAE,+CAA+C;QAC/D,YAAY,EAAE,8CAA8C;KAC7D;CACF,CAAA;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAA;IAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9D,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAClF,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,GAAG,GAAa,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAA;AAErE,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACvD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAA;YACF,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrF,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,EAAE;YAC5D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,SAAS,GAAG,eAAe,EAAE,CAAA;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAW,KAAK,EAAE,MAAmB,EAAE,EAAE;IAChE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IAExC,OAAO;QACL,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACrD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAM;YACrC,MAAM,OAAO,GAAW,UAAU,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,CAAA;YACvD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAM;YAEhC,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACnC,CAAC;YAED,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YAED,IAAI,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC9B,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC/B,CAAC;YAED,UAAU,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CACvC,sCAAsC,EACtC,QAAQ,CACT,CAAA;QACH,CAAC;QACD,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACpD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAM;YACrC,MAAM,OAAO,GAAW,SAAS,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAA;YACrD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAM;YAEhC,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CACrC,iCAAiC,EACjC,MAAM,CACP,CAAA;YAED,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC5C,6CAA6C,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1E,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;gBACnC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}