orizu 0.5.26 → 0.5.28

package/dist/hosted-harvest.js

@@ -11,31 +11,139 @@
  *   2. If dirty: `git add -A` then `git commit` attributed to the agent identity
  *      (AGENT_GIT_IDENTITY) with message `checkpoint: run <runId> auto-harvest`.
  *   3. If there is anything unpushed (a fresh checkpoint OR pre-existing local
- *      commits the agent made but did not push), `git push` to the session branch
- *      (the repo-local credential helper configured by bootstrap authorizes it).
+ *      commits the agent made but did not push), push the exact HEAD SHA to the
+ *      session branch at bootstrap's independently validated repository locator.
  *   4. Return a typed outcome the loop records as a run event: `work_persisted`
- *      (sha + files), `work_none` (clean, nothing to push), or `work_persist_failed`
- *      (error). Harvest NEVER throws — a harvest failure must not change the run's
- *      terminal status; it is recorded and the run proceeds to terminal.
+ *      (sha + files), `work_none` (clean, nothing to push), `work_not_inspected`
+ *      (safety-gated), or `work_persist_failed` (error). Harvest NEVER throws —
+ *      a harvest failure must not change the run's terminal status; it is recorded
+ *      and the run proceeds to terminal.
  *
  * The loop runs IN the sandbox, so git is driven with `child_process` (matching
  * `defaultRunSetupHook` / `installOpenCodePinned` in `hosted-loop.ts`). `exec` is
- * injectable so the whole thing is unit-testable with no real git.
+ * injectable so the whole thing is unit-testable with no real git; the HTTPS
+ * smart-Git boundary tests independently prove the production transport.
  */
 import { spawnSync } from 'child_process';
+import { randomUUID } from 'crypto';
+import { mkdtempSync, readdirSync, rmSync, statSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { isValidCloudflareArtifactsGitRemote, parseCanonicalCredentialFreeHttpsUrl, } from './cloudflare-artifacts-git-remote.js';
+export const HOSTED_HARVEST_CA_BUNDLE_CANDIDATES = [
+    '/etc/pki/tls/certs/ca-bundle.crt',
+    '/etc/ssl/certs/ca-certificates.crt',
+    '/etc/ssl/cert.pem',
+];
+export const HOSTED_HARVEST_CA_PATH_CANDIDATES = [
+    '/etc/pki/ca-trust/extracted/pem/directory-hash',
+    '/etc/ssl/certs',
+];
+export const HOSTED_HARVEST_TRANSPORT_POLICY = {
+    environmentDenylist: [
+        'HTTP_PROXY', 'http_proxy', 'HTTPS_PROXY', 'https_proxy', 'ALL_PROXY', 'all_proxy',
+        'GIT_SSL_NO_VERIFY', 'GIT_PROXY_COMMAND', 'GIT_SSL_CAINFO', 'GIT_SSL_CAPATH',
+        'CURL_CA_BUNDLE', 'SSL_CERT_FILE', 'SSL_CERT_DIR', 'GIT_SSL_CERT', 'GIT_SSL_KEY',
+        'GIT_ASKPASS', 'GIT_ASKPASS_REQUIRE', 'SSH_ASKPASS', 'SSH_ASKPASS_REQUIRE',
+        'GIT_TERMINAL_PROMPT',
+    ],
+    exactUrlHttpConfig: [
+        ['proxy', ''], ['sslVerify', 'true'], ['curloptResolve', ''],
+        ['followRedirects', 'false'],
+    ],
+    rejectedLocalHttpKeys: [
+        'sslcert', 'sslkey', 'sslcertpasswordprotected', 'sslbackend',
+        'pinnedpubkey', 'sslversion', 'sslcipherlist',
+    ],
+};
+function isRegularFile(path) {
+    try {
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+export function resolveHostedHarvestCaBundle(candidates = HOSTED_HARVEST_CA_BUNDLE_CANDIDATES) {
+    return candidates.find(isRegularFile) ?? null;
+}
+function resolveHostedHarvestCaPath(candidates = HOSTED_HARVEST_CA_PATH_CANDIDATES) {
+    for (const candidate of candidates) {
+        try {
+            if (!statSync(candidate).isDirectory())
+                continue;
+            if (readdirSync(candidate).some(entry => /^[0-9a-f]{8}\.[0-9]+$/u.test(entry)))
+                return candidate;
+        }
+        catch {
+            // A missing or unreadable directory is not a trust source.
+        }
+    }
+    return null;
+}
 function defaultHarvestExec(workspaceDir) {
     return (args) => {
-        const res = spawnSync('git', args, { cwd: workspaceDir, encoding: 'utf8' });
+        const env = { ...process.env };
+        for (const name of Object.keys(env)) {
+            if (HOSTED_HARVEST_TRANSPORT_POLICY.environmentDenylist.includes(name) ||
+                name === 'GIT_CONFIG' || name.startsWith('GIT_CONFIG_'))
+                delete env[name];
+        }
+        env.GIT_CONFIG_NOSYSTEM = '1';
+        env.GIT_CONFIG_GLOBAL = '/dev/null';
+        env.GIT_TERMINAL_PROMPT = '0';
+        const res = spawnSync('git', [...args], { cwd: workspaceDir, encoding: 'utf8', env });
         if (res.error) {
             return { exitCode: 1, stdout: '', stderr: res.error.message };
         }
         return { exitCode: res.status ?? 1, stdout: res.stdout ?? '', stderr: res.stderr ?? '' };
     };
 }
+function protectPinnedRemote(exec, remote, caBundle, caPath, credentialHelper) {
+    const httpConfig = HOSTED_HARVEST_TRANSPORT_POLICY.exactUrlHttpConfig.flatMap(([key, value]) => ['-c', `http.${remote}.${key}=${value}`]);
+    const credentialUsername = new URL(remote).hostname === 'github.com' ? 'x-access-token' : 'x';
+    const credentialConfig = credentialHelper ? [
+        // An empty helper resets Git's accumulated helper list, including URL-scoped entries.
+        '-c', 'credential.helper=',
+        '-c', `credential.helper=${credentialHelper}`,
+        '-c', 'credential.useHttpPath=true',
+        '-c', `credential.${remote}.useHttpPath=true`,
+        '-c', `credential.username=${credentialUsername}`,
+        '-c', `credential.${remote}.username=${credentialUsername}`,
+        '-c', 'credential.interactive=false',
+        '-c', 'core.askPass=',
+    ] : ['-c', 'credential.helper='];
+    return (args) => {
+        const alias = `https://orizu-harvest.invalid/${randomUUID()}`;
+        const temporaryCaPath = caPath ? null : mkdtempSync(join(tmpdir(), 'orizu-harvest-ca-'));
+        try {
+            return exec([
+                '-c', `url.${remote}.insteadOf=${alias}`,
+                '-c', `url.${remote}.pushInsteadOf=${alias}`,
+                ...httpConfig,
+                '-c', `http.${remote}.sslCAInfo=${caBundle}`,
+                '-c', `http.${remote}.sslCAPath=${caPath ?? temporaryCaPath}`,
+                ...credentialConfig,
+                ...args.map(arg => arg === remote ? alias : arg),
+            ]);
+        }
+        finally {
+            if (temporaryCaPath)
+                rmSync(temporaryCaPath, { recursive: true, force: true });
+        }
+    };
+}
 function detail(res) {
     const text = (res.stderr && res.stderr.trim()) || (res.stdout && res.stdout.trim()) || `exit ${res.exitCode}`;
     return text;
 }
+const GITHUB_PATH = /^\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\.git$/u;
+function isValidRepositoryRemote(remote) {
+    if (isValidCloudflareArtifactsGitRemote(remote))
+        return true;
+    const parsed = parseCanonicalCredentialFreeHttpsUrl(remote);
+    return parsed !== null && parsed.hostname === 'github.com' && GITHUB_PATH.test(parsed.pathname);
+}
 function splitLines(text) {
     return text
         .split('\n')
@@ -43,16 +151,20 @@ function splitLines(text) {
         .filter(line => line.length > 0);
 }
 /**
- * Count commits present locally but not on the upstream tracking branch. Returns
- * 0 when there is no upstream (`@{u}` unresolvable) — with no upstream a push
- * could not land anyway, so "nothing to push" is the safe reading.
+ * Count commits present locally but not on the private ref fetched from the
+ * pinned repository. Exit-zero empty output is zero; lookup failures are unknown.
  */
-function countUnpushed(exec) {
-    const res = exec(['rev-list', '--count', '@{u}..HEAD']);
+function countUnpushed(exec, pinnedRef) {
+    const res = exec(['rev-list', '--count', `${pinnedRef}..HEAD`]);
     if (res.exitCode !== 0)
+        return null;
+    const output = res.stdout.trim();
+    if (output === '')
         return 0;
-    const n = Number.parseInt(res.stdout.trim(), 10);
-    return Number.isFinite(n) ? n : 0;
+    if (!/^\d+$/u.test(output))
+        return null;
+    const count = Number(output);
+    return Number.isSafeInteger(count) ? count : null;
 }
 /**
  * Persist any uncommitted or unpushed work in the workspace. Deterministic and
@@ -60,12 +172,58 @@ function countUnpushed(exec) {
  */
 export function harvestWorkspace(opts) {
     // Safety gate: never touch a real repo unless explicitly enabled or given an
-    // injected exec. Absent both, report nothing-to-do rather than run host git.
+    // injected exec. Absent both, report that inspection was skipped.
     if (!opts.exec && !opts.enabled) {
-        return { kind: 'work_none' };
+        return { kind: 'work_not_inspected' };
     }
-    const exec = opts.exec ?? defaultHarvestExec(opts.workspaceDir);
+    if (!isValidRepositoryRemote(opts.repositoryRemote)) {
+        return { kind: 'work_persist_failed', error: 'repository_locator_invalid' };
+    }
+    // Every invocation gets a fresh, one-shot alias. Its exact command-scoped
+    // rewrite outranks repo-local prefix rules and resolves to the validated URL
+    // byte-for-byte; an observer of one argv cannot redirect a later command.
+    if (!opts.exec && (!opts.credentialHelper || /[\r\n\0]/u.test(opts.credentialHelper))) {
+        return { kind: 'work_persist_failed', error: 'checkpoint_credential_helper_invalid' };
+    }
+    const caBundleCandidates = opts.caBundleCandidates ?? HOSTED_HARVEST_CA_BUNDLE_CANDIDATES;
+    const caBundle = resolveHostedHarvestCaBundle(caBundleCandidates);
+    if (!caBundle) {
+        return {
+            kind: 'work_persist_failed',
+            error: `hosted_harvest_ca_bundle_missing: ${caBundleCandidates.join(', ')}`,
+        };
+    }
+    const caPath = resolveHostedHarvestCaPath(opts.caPathCandidates);
+    const rawExec = opts.exec ?? defaultHarvestExec(opts.workspaceDir);
+    const exec = protectPinnedRemote(rawExec, opts.repositoryRemote, caBundle, caPath, opts.credentialHelper);
+    const pinnedRef = `refs/orizu/pinned/${opts.sessionBranch}`;
     try {
+        const rejectedKeyPattern = HOSTED_HARVEST_TRANSPORT_POLICY.rejectedLocalHttpKeys.join('|');
+        const localTransportConfig = exec([
+            'config', '--includes', '--show-origin', '--name-only', '--get-regexp',
+            `^http\\.(.*\\.)?(${rejectedKeyPattern})$`,
+        ]);
+        if (localTransportConfig.exitCode !== 0 && localTransportConfig.exitCode !== 1) {
+            return { kind: 'work_persist_failed', error: `git config inspection failed: ${detail(localTransportConfig)}` };
+        }
+        if (splitLines(localTransportConfig.stdout).length > 0) {
+            return { kind: 'work_persist_failed', error: 'hosted_harvest_transport_config_present' };
+        }
+        if (!opts.exec) {
+            const effectiveSslVerify = exec([
+                'config', '--get-urlmatch', 'http.sslVerify', `${opts.repositoryRemote}/`,
+            ]);
+            if (effectiveSslVerify.exitCode !== 0 || effectiveSslVerify.stdout.trim() !== 'true') {
+                return { kind: 'work_persist_failed', error: 'hosted_harvest_tls_policy_ineffective' };
+            }
+            const effectiveCaPath = exec(['config', '--get-urlmatch', 'http.sslCAPath', `${opts.repositoryRemote}/`]);
+            const resolvedCaPath = effectiveCaPath.stdout.trim();
+            const expectedTemporaryPrefix = join(tmpdir(), 'orizu-harvest-ca-');
+            const isExpectedCaPath = caPath ? resolvedCaPath === caPath : resolvedCaPath.startsWith(expectedTemporaryPrefix);
+            if (effectiveCaPath.exitCode !== 0 || !isExpectedCaPath) {
+                return { kind: 'work_persist_failed', error: 'hosted_harvest_ca_path_policy_ineffective' };
+            }
+        }
         // Never harvest bootstrap-injected runtime scaffolding (ALI-1051): the
         // .claude/skills symlink is a sandbox-local pointer, not the agent's work.
         // Bootstrap also excludes it via .git/info/exclude; this pathspec is the
@@ -86,6 +244,12 @@ export function harvestWorkspace(opts) {
                 `user.name=${opts.author.name}`,
                 '-c',
                 `user.email=${opts.author.email}`,
+                '-c',
+                'core.hooksPath=/dev/null',
+                '-c',
+                'commit.gpgsign=false',
+                '-c',
+                'gpg.program=',
                 'commit',
                 '--author',
                 `${opts.author.name} <${opts.author.email}>`,
@@ -96,23 +260,53 @@ export function harvestWorkspace(opts) {
                 return { kind: 'work_persist_failed', error: `git commit failed: ${detail(commit)}` };
             }
         }
-        // Nothing to push when the tree was clean AND there are no local-only commits.
-        const unpushed = countUnpushed(exec);
-        if (!dirty && unpushed <= 0) {
+        // Never derive checkpoint truth from mutable `origin`. Refresh a private ref
+        // from the independently validated repository before deciding there is no work.
+        const fetchPinned = exec([
+            'fetch', '--no-tags', '--force', opts.repositoryRemote,
+            `+refs/heads/${opts.sessionBranch}:${pinnedRef}`,
+        ]);
+        const hasPinnedBase = fetchPinned.exitCode === 0;
+        const unpushed = hasPinnedBase ? countUnpushed(exec, pinnedRef) : null;
+        // Unknown is not none. Preserve round-3 behavior by attempting the exact
+        // pinned-repository push; omit file claims if no trustworthy base exists.
+        if (!dirty && unpushed === 0)
             return { kind: 'work_none' };
-        }
         const headRes = exec(['rev-parse', 'HEAD']);
         const sha = headRes.exitCode === 0 ? headRes.stdout.trim() : '';
-        // Files: the checkpoint commit's tree when we just committed, else everything
-        // spanned by the unpushed commits.
-        const filesRes = dirty
-            ? exec(['diff-tree', '--no-commit-id', '--name-only', '-r', 'HEAD'])
-            : exec(['diff', '--name-only', '@{u}..HEAD']);
-        const files = filesRes.exitCode === 0 ? splitLines(filesRes.stdout) : [];
-        const push = exec(['push']);
+        if (!/^[a-f0-9]{40}$/.test(sha)) {
+            return { kind: 'work_persist_failed', error: `git rev-parse HEAD failed: ${detail(headRes)}` };
+        }
+        // Files are the complete delta the exact push delivers, including any local
+        // commits the agent made before the final auto-harvest commit.
+        const filesRes = hasPinnedBase
+            ? exec(['diff', '--name-only', `${pinnedRef}..HEAD`])
+            : null;
+        const files = filesRes?.exitCode === 0 ? splitLines(filesRes.stdout) : null;
+        // --no-verify blocks hostile hooks, including Git LFS's legitimate upload
+        // hook. Run the equivalent upload explicitly before publishing the pointer ref.
+        const lfsVersion = exec(['lfs', 'version']);
+        if (lfsVersion.exitCode === 0) {
+            const lfsFiles = exec(['lfs', 'ls-files', '--name-only']);
+            if (lfsFiles.exitCode !== 0) {
+                return { kind: 'work_persist_failed', error: `git_lfs_inspection_failed: ${detail(lfsFiles)}` };
+            }
+            if (splitLines(lfsFiles.stdout).length > 0) {
+                const lfsPush = exec(['lfs', 'push', opts.repositoryRemote, sha]);
+                if (lfsPush.exitCode !== 0) {
+                    return { kind: 'work_persist_failed', error: `git_lfs_push_failed: ${detail(lfsPush)}` };
+                }
+            }
+        }
+        // Push the exact object we report to the exact session destination. This
+        // avoids separately deriving a local claim and a tracking-branch update.
+        const push = exec([
+            'push', '--no-verify', opts.repositoryRemote, `${sha}:refs/heads/${opts.sessionBranch}`,
+        ]);
         if (push.exitCode !== 0) {
             return { kind: 'work_persist_failed', error: `git push failed: ${detail(push)}` };
         }
+        exec(['update-ref', pinnedRef, sha]);
         return { kind: 'work_persisted', sha, files };
     }
     catch (error) {

package/dist/hosted-loop-lifecycle.d.ts

@@ -22,6 +22,7 @@
  * (`@/packages/cli/src/hosted-loop`) is unchanged.
  */
 import type { HarnessEvent } from './hosted-harness.js';
+import type { HostedSessionOrigin } from './hosted-runtime-assets.js';
 /**
  * Default provider-qualified hosted model — the SINGLE source of truth
  * (ALI-1086). Imported by both the operator-path session CLI
@@ -56,9 +57,20 @@ export interface HostedLoopContext {
     taskFile: string;
     /** Directory the agent operates in (the cloned session-branch workspace). */
     workspaceDir: string;
+    /** Validated destination branch for the CLI-owned checkpoint push. */
+    sessionBranch: string;
+    /** Credential-free repository locator established by bootstrap. */
+    repositoryRemote: string;
+    /** Bootstrap-owned helper re-applied command-scoped during checkpoint transport. */
+    repositoryCredentialHelper?: string;
     /** Provider-qualified model, e.g. "anthropic/claude-opus-4-8". */
     model: string;
     reasoningEffort?: string;
+    /**
+     * Session entry surface (ALI-1867). Missing values fail safely to CLI's
+     * unattended behavior; only `hosted-web` enables human question custody.
+     */
+    sessionOrigin?: HostedSessionOrigin;
     /** Idempotency / correlation key for the prompt. */
     messageId: string;
     /** Git identity for commit attribution during the prompt. */
@@ -143,14 +155,14 @@ export interface EgressProbeResult {
     detail: string;
 }
 /**
- * Default probe: attempt a bounded HTTPS GET to `host`. A live default-deny
- * firewall makes this THROW for a DENIED host (connection reset / timeout / DNS
+ * Default probe: attempt a bounded GET to a full URL target, or HTTPS when the
+ * target is a bare host. A live default-deny firewall makes this THROW for a DENIED host (connection reset / timeout / DNS
  * failure) → `reachable: false`. Any response at all — even an error status —
  * proves the host was reachable → `reachable: true`. Used for BOTH the allowed
  * (positive-control) and denied probes.
  */
 export declare function defaultProbeEgress(host: string): Promise<EgressProbeResult>;
-/** The two hosts the positive-control canary probes. */
+/** The two host/URL targets the positive-control canary probes. */
 export interface EgressCanaryTargets {
     /** A known-ALLOWED host (the Orizu API base) that MUST be reachable — the
      *  positive control that distinguishes "policy blocking" from "network dead". */

package/dist/hosted-loop-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-loop-lifecycle.d.ts","sourceRoot":"","sources":["../src/hosted-loop-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,oBAAoB,8BAA8B,CAAA;AAE/D;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;IACjB,6DAA6D;IAC7D,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACvC;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAA;IACzC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,kDAAkD;IAClD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAYpG;AAED,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,gBAAgB,CAAA;AAKvD,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAA;IAClB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAejF;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC;qFACiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,iBAAiB,CAAA;IAC1B,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE;IAAE,MAAM,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,EACxD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,EACnD,GAAG,GAAE,MAAM,MAAyB,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAkE/B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMlE;AAED,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,GAAG,EAAE,OAAO,CAAA;IACZ,wEAAwE;IACxE,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf"}
+{"version":3,"file":"hosted-loop-lifecycle.d.ts","sourceRoot":"","sources":["../src/hosted-loop-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,oBAAoB,8BAA8B,CAAA;AAE/D;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAA;IACpB,sEAAsE;IACtE,aAAa,EAAE,MAAM,CAAA;IACrB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAA;IACxB,oFAAoF;IACpF,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;IACjB,6DAA6D;IAC7D,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACvC;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAA;IACzC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,kDAAkD;IAClD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAYpG;AAED,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,gBAAgB,CAAA;AAKvD,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAA;IAClB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgBjF;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC;qFACiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,iBAAiB,CAAA;IAC1B,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE;IAAE,MAAM,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,EACxD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,EACnD,GAAG,GAAE,MAAM,MAAyB,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAkE/B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOlE;AAED,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,GAAG,EAAE,OAAO,CAAA;IACZ,wEAAwE;IACxE,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf"}

package/dist/hosted-loop-lifecycle.js

@@ -68,8 +68,8 @@ export const DEFAULT_EGRESS_CANARY_HOST = 'example.com';
  *  reachable host answers well within this. */
 const EGRESS_CANARY_TIMEOUT_MS = 5000;
 /**
- * Default probe: attempt a bounded HTTPS GET to `host`. A live default-deny
- * firewall makes this THROW for a DENIED host (connection reset / timeout / DNS
+ * Default probe: attempt a bounded GET to a full URL target, or HTTPS when the
+ * target is a bare host. A live default-deny firewall makes this THROW for a DENIED host (connection reset / timeout / DNS
  * failure) → `reachable: false`. Any response at all — even an error status —
  * proves the host was reachable → `reachable: true`. Used for BOTH the allowed
  * (positive-control) and denied probes.
@@ -78,7 +78,8 @@ export async function defaultProbeEgress(host) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), EGRESS_CANARY_TIMEOUT_MS);
     try {
-        const response = await fetch(`https://${host}/`, {
+        const target = URL.canParse(host) ? new URL('/', host).toString() : `https://${host}/`;
+        const response = await fetch(target, {
             method: 'GET',
             redirect: 'manual',
             signal: controller.signal,
@@ -184,7 +185,8 @@ export async function runEgressCanary(targets, sink, probe, now = () => Date.now
  */
 export function egressCanaryAllowedHost(apiBaseUrl) {
     try {
-        return new URL(apiBaseUrl).hostname;
+        const parsed = new URL(apiBaseUrl);
+        return parsed.port === '' ? parsed.hostname : parsed.origin;
     }
     catch {
         return apiBaseUrl.replace(/^[a-z]+:\/\//i, '').split('/')[0].split(':')[0];

package/dist/hosted-loop.d.ts

@@ -16,7 +16,8 @@
  *      driver; 'claude-agent-sdk': construct the in-process Claude-Agent-SDK
  *      driver — no server to install or spawn), then drive the SINGLE task prompt
  *      (v0: no queue) through `drainHarnessToSink`;
- *   5. the terminal event decides the run's final status via the sink's PATCH.
+ *   5. checkpoint dirty or local-only Git work without replacing the agent's
+ *      terminal result, then deliver that original result through the sink.
  *
  * SWAPPABILITY (ALI-929 / P3.6): harness SELECTION is the ONLY thing that differs
  * between the two drivers — `start()` → `runPrompt()` → `drainHarnessToSink()` →
@@ -29,10 +30,11 @@
  * per-exec fallback — with firewall brokering the real key never reaches here).
  *
  * TESTABILITY: `runHostedLoop` takes injected `fetchImpl`, `spawnOpenCode`,
- * `installOpenCode`, and `createHarness`, so the whole loop runs in-process
- * against a fake broker + fake OpenCode server with no real binary.
+ * `installOpenCode`, `createHarness`, and Git execution, so the whole loop can
+ * run in-process against fake boundaries; separate tests exercise the real
+ * packaged CLI, HTTPS smart-Git transport, and OpenCode process boundary.
  */
-import type { AgentHarness } from './hosted-harness.js';
+import { type AgentHarness } from './hosted-harness.js';
 import { type HarvestExec } from './hosted-harvest.js';
 import { type ModelValidationOutcome, type SpawnOpenCodeOptions, type SpawnedOpenCode } from './hosted-harness-opencode.js';
 import { type HostedFetch, type TerminalStatus } from './hosted-run-event-sink.js';
@@ -51,8 +53,35 @@ export interface InstallResult {
     ok: boolean;
     detail: string;
 }
+interface HostedLoopSharedRuntime {
+    harness: AgentHarness | null;
+    spawned: SpawnedOpenCode | null;
+    agentSessionId: string | null;
+    installOk: boolean;
+    startupComplete: boolean;
+    spawnLogPath: string;
+    closed: boolean;
+}
+export interface HostedLoopSessionContext extends Omit<HostedLoopContext, 'runId' | 'bearerFile' | 'taskFile' | 'messageId'> {
+    sessionId: string;
+    projectId: string | null;
+    sessionDir: string;
+}
+export interface HostedLoopTurnContext {
+    runId: string;
+    ordinal: number;
+    taskFile: string;
+    messageId: string;
+    bearerFile: string;
+}
+export interface HostedLoopSessionHandle {
+    context: HostedLoopSessionContext;
+    runtime: HostedLoopSharedRuntime;
+}
 export interface RunHostedLoopOptions {
     context: HostedLoopContext;
+    /** Internal session runtime used by the public session/turn lifecycle. */
+    sharedRuntime?: HostedLoopSharedRuntime;
     /**
      * Agent bearer, as a FIXED string (tests / in-process launcher) OR omitted in
      * favor of `bearerProvider`. In production the loop reads the rotated 0600
@@ -91,6 +120,9 @@ export interface RunHostedLoopOptions {
     }) => Promise<ModelValidationOutcome>;
     now?: () => number;
     signal?: AbortSignal;
+    /** Prompt-only human interrupt. Unlike `signal`, this never controls harness
+     *  provisioning or the session-scoped runtime. */
+    interruptSignal?: AbortSignal;
     /** Extra verbatim secrets to redact (the bearer is added by the sink itself). */
     redactSecretsList?: readonly string[];
     /** Egress-canary probe (default: a bounded `fetch` to https://<host>/).
@@ -104,9 +136,9 @@ export interface RunHostedLoopOptions {
         workspaceDir: string;
     }) => Promise<SetupHookOutcome> | SetupHookOutcome;
     /**
-     * Standing preamble wrapped around the user task (ALI-1036). Defaults to
-     * `HOSTED_TASK_PREAMBLE`; pass an override to customize it, or an empty string
-     * to send the task verbatim (tests). The user task is always kept verbatim
+     * Standing preamble wrapped around the user task (ALI-1036/ALI-1867). Defaults
+     * according to `context.sessionOrigin`; pass an override to customize it, or
+     * an empty string to send the task verbatim (tests). The task stays verbatim
      * beneath a delimiter (see `composeHostedTaskPrompt`).
      */
     taskPreamble?: string;
@@ -124,6 +156,9 @@ export interface RunHostedLoopOptions {
     /** Injectable sleep for the terminal-delivery retry backoff (ALI-1065
      *  finding 2). Tests pass a no-op to avoid real delays. */
     sleepImpl?: (ms: number) => Promise<void>;
+    /** Value-free local diagnostics shared with the event sink. Production routes
+     *  this through hosted-boot's stderr seam; consumer failures are ignored. */
+    onDiagnostic?: (message: string) => void;
 }
 export interface HostedLoopResult {
     status: TerminalStatus;
@@ -156,6 +191,11 @@ export declare const TERMINAL_DELIVERY_RETRY_DELAYS_MS: readonly number[];
  */
 export { INJECTED_ENV_VARS_ENV } from './hosted-environment.js';
 export declare function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedLoopResult>;
+export declare function startHostedLoopSession(context: HostedLoopSessionContext): Promise<HostedLoopSessionHandle>;
+export declare function runHostedLoopTurn(session: HostedLoopSessionHandle, turn: HostedLoopTurnContext, options: Omit<RunHostedLoopOptions, 'context' | 'taskPrompt' | 'sharedRuntime'> & {
+    taskPrompt: string;
+}): Promise<HostedLoopResult>;
+export declare function closeHostedLoopSession(session: HostedLoopSessionHandle): Promise<void>;
 export interface HostedLoopCommandIo {
     print: (line: string) => void;
     printErr?: (line: string) => void;

package/dist/hosted-loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-loop.d.ts","sourceRoot":"","sources":["../src/hosted-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,qBAAqB,CAAA;AAQtE,OAAO,EAAoB,KAAK,WAAW,EAAuB,MAAM,qBAAqB,CAAA;AAE7F,OAAO,EAML,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAOL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,4BAA4B,CAAA;AAKnC,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,GAChB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,4BAA4B,CAAA;AAOnC,eAAO,MAAM,wBAAwB,QAAgB,CAAA;AAErD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKrF;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,iBAAiB,CAAA;IAC1B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;yEACqE;IACrE,cAAc,CAAC,EAAE,MAAM,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB;2FACuF;IACvF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,YAAY,CAAA;IAC7F;gFAC4E;IAC5E,mBAAmB,CAAC,EAAE,MAAM,YAAY,CAAA;IACxC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAC1F,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;IAC9C;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC9F,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC;;kFAE8E;IAC9E,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC1D;;oDAEgD;IAChD,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAChG;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;+DAC2D;IAC3D,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAeD;;;;;iDAKiD;AACjD,eAAO,MAAM,6BAA6B,QAAiB,CAAA;AAa3D;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAAmB,CAAA;AAKlF;;;;;;GAMG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AA4E/D,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgZzF;AAID,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AASD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,mBAAmB,GACtB,OAAO,CAAC,MAAM,CAAC,CAwBjB"}
+{"version":3,"file":"hosted-loop.d.ts","sourceRoot":"","sources":["../src/hosted-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAOH,OAAO,EAAyB,KAAK,YAAY,EAAyC,MAAM,qBAAqB,CAAA;AAQrH,OAAO,EAAoB,KAAK,WAAW,EAAuB,MAAM,qBAAqB,CAAA;AAE7F,OAAO,EAOL,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAA;AAIrC,OAAO,EAML,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAOL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,4BAA4B,CAAA;AAKnC,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,GAChB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,4BAA4B,CAAA;AAOnC,eAAO,MAAM,wBAAwB,QAAgB,CAAA;AAErD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKrF;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf;AAED,UAAU,uBAAuB;IAC/B,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;IAC5B,OAAO,EAAE,eAAe,GAAG,IAAI,CAAA;IAC/B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,OAAO,CAAA;IAClB,eAAe,EAAE,OAAO,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,YAAY,GAAG,UAAU,GAAG,WAAW,CAAC;IAC1H,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,wBAAwB,CAAA;IACjC,OAAO,EAAE,uBAAuB,CAAA;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,iBAAiB,CAAA;IAC1B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,uBAAuB,CAAA;IACvC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;yEACqE;IACrE,cAAc,CAAC,EAAE,MAAM,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB;2FACuF;IACvF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,YAAY,CAAA;IAC7F;gFAC4E;IAC5E,mBAAmB,CAAC,EAAE,MAAM,YAAY,CAAA;IACxC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAC1F,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;IAC9C;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC9F,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;sDACkD;IAClD,eAAe,CAAC,EAAE,WAAW,CAAA;IAC7B,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC;;kFAE8E;IAC9E,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC1D;;oDAEgD;IAChD,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAChG;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;+DAC2D;IAC3D,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC;iFAC6E;IAC7E,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAeD;;;;;iDAKiD;AACjD,eAAO,MAAM,6BAA6B,QAAiB,CAAA;AAa3D;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAAmB,CAAA;AAKlF;;;;;;GAMG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AA+E/D,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2hBzF;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAalC;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,uBAAuB,EAChC,IAAI,EAAE,qBAAqB,EAC3B,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe,CAAC,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GACvG,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAU5F;AAID,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAyCD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,mBAAmB,GACtB,OAAO,CAAC,MAAM,CAAC,CA8BjB"}