pi-daddy 0.13.0

package/dist/pane-reaper.js

@@ -0,0 +1,120 @@
+/**
+ * Close herdr panes this process opened but never got to close.
+ *
+ * `runHerdrPane` closes its pane in a `finally`, which covers a thrown error and a timeout — **not the
+ * process being killed**. A pi session interrupted mid-fan-out left one pane per in-flight child, and
+ * `docs/probes/g16-herdr` records that an orphaned pane is not trivially closable afterwards.
+ *
+ * **Registered on `exit` only, deliberately — not on SIGINT or SIGTERM.** That is the part worth reading,
+ * because the obvious fix is the dangerous one. Adding a signal listener *suppresses Node's default
+ * termination*, so a library that adds one takes over an application-level decision it has no standing to
+ * make: pi uses SIGINT to interrupt a turn, and a listener here that re-raised would turn "cancel this
+ * delegation" into "exit pi". A governance package quietly changing the host's interrupt semantics is a
+ * worse defect than the leak it fixes, and it would land on **every** session rather than the opt-in ones.
+ *
+ * So the coverage is exact and stated rather than implied:
+ *
+ *  - **Covered:** normal exit, `process.exit()`, an uncaught exception that unwinds to the default handler.
+ *  - **NOT covered:** SIGKILL, and SIGTERM/SIGINT where nothing else in the process has installed a
+ *    listener. Node terminates without running `exit` handlers in those cases, by design. A pane can still
+ *    be orphaned there, and `herdr tab close <id>` is the manual remedy.
+ *
+ * Everything here is **synchronous**, because an `exit` handler is: a promise scheduled there never runs.
+ */
+import { execFileSync } from "node:child_process";
+import { rmSync } from "node:fs";
+/**
+ * Panes opened by THIS process and not yet closed. Keyed by tab id, so a double close is impossible.
+ *
+ * **That keying rests on tab ids being unique, which was measured rather than assumed** (herdr 0.7.5): ids
+ * are `w<workspace>:t<counter>`, allocated by the single server, and **not recycled** — creating a tab,
+ * closing it, and creating again yields the next counter value, never the freed one. If that ever changed,
+ * concurrent panes would collapse into one entry and an early finisher's `untrackPane` would drop a live
+ * sibling. Recorded because the hazard is invisible in the code and the precondition lives in another
+ * project.
+ */
+const open = new Map();
+let hookInstalled = false;
+/** A run has opened a pane. Idempotent per tab, and installs the exit hook on first use only. */
+export function trackPane(pane) {
+    open.set(pane.tab, pane);
+    if (hookInstalled)
+        return;
+    hookInstalled = true;
+    // `once`, and only ever one, so a fan-out of eight children does not install eight handlers and trip
+    // Node's MaxListenersExceededWarning — which would be this package printing a warning about itself.
+    process.once("exit", () => void reapOpenPanes());
+}
+/** A run closed its own pane the normal way. */
+export function untrackPane(tab) {
+    open.delete(tab);
+}
+/** How many panes are currently outstanding — for tests and for `/grants`. */
+export function openPaneCount() {
+    return open.size;
+}
+/** Per-command wall clock. `SIGKILL` because `timeout` alone is not a bound — see `TOTAL_BUDGET_MS`. */
+const PER_CALL_MS = 2000;
+/**
+ * Total wall clock the whole sweep may add to process exit.
+ *
+ * **Measured, and the reason this exists.** With eight panes and a hung herdr, a per-call timeout of 5s
+ * across two calls per pane is **80 seconds of silent hang at shutdown** — `stdio: "ignore"`, so the process
+ * looks wedged with no output. Worse, `timeout` is not a hard bound at all: `spawnSync` sends `SIGTERM` and
+ * then waits for the child to actually die, so a process ignoring `SIGTERM` runs to its own completion
+ * (measured: a 3s timeout took 59.8s against `trap '' TERM; sleep 60`). Hence `killSignal: "SIGKILL"` **and**
+ * a budget across the whole sweep rather than per call.
+ *
+ * A pane left open because the budget ran out is the failure this whole module downgrades to, and it is the
+ * right one: `herdr tab close <id>` is a five-second manual fix, whereas a shell that will not exit is not.
+ */
+const TOTAL_BUDGET_MS = 6000;
+/** Run one herdr command synchronously, swallowing everything: at exit there is nowhere to report. */
+const defaultSyncExec = (args) => {
+    execFileSync("herdr", args, { stdio: "ignore", timeout: PER_CALL_MS, killSignal: "SIGKILL" });
+};
+/**
+ * Close every outstanding pane and return the tab ids closed.
+ *
+ * Exported and parameterised so it can be tested without herdr installed: the exit hook is unreachable from
+ * a test (registering a real `exit` handler would run during the test runner's own shutdown), so the hook is
+ * one line and *this* is where the behaviour lives.
+ *
+ * Failures are swallowed per pane rather than per call — one pane herdr will not close must not strand the
+ * other seven, and nothing at exit has anywhere to report to anyway.
+ */
+export function reapOpenPanes(syncExec = defaultSyncExec, now = Date.now) {
+    const closed = [];
+    const deadline = now() + TOTAL_BUDGET_MS;
+    for (const pane of [...open.values()]) {
+        // Checked BEFORE each pane rather than after, so the budget bounds what we start, not what we finish.
+        // Panes left behind stay in the map; there is no later sweep, and saying so is the honest position —
+        // `openPaneCount()` is non-zero afterwards precisely so a caller could report it if it ever wanted to.
+        if (now() >= deadline)
+            break;
+        try {
+            syncExec(["agent", "stop", pane.name]);
+        }
+        catch {
+            /* the agent may already be gone; the tab is what matters */
+        }
+        try {
+            syncExec(["tab", "close", pane.tab]);
+            closed.push(pane.tab);
+        }
+        catch {
+            /* an orphan we could not close: `herdr tab close` is the manual remedy, as documented above */
+        }
+        if (pane.promptDir) {
+            try {
+                rmSync(pane.promptDir, { recursive: true, force: true });
+            }
+            catch {
+                /* /tmp litter, not correctness */
+            }
+        }
+        open.delete(pane.tab);
+    }
+    return closed;
+}
+//# sourceMappingURL=pane-reaper.js.map

package/dist/pane-reaper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pane-reaper.js","sourceRoot":"","sources":["../src/pane-reaper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAWjC;;;;;;;;;GASG;AACH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;AACzC,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B,iGAAiG;AACjG,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,IAAI,aAAa;QAAE,OAAO;IAC1B,aAAa,GAAG,IAAI,CAAC;IACrB,qGAAqG;IACrG,oGAAoG;IACpG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,aAAa,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,wGAAwG;AACxG,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB;;;;;;;;;;;;GAYG;AACH,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,sGAAsG;AACtG,MAAM,eAAe,GAAG,CAAC,IAAc,EAAQ,EAAE;IAC/C,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;AAChG,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,WAAqC,eAAe,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG;IAChG,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,eAAe,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QACtC,sGAAsG;QACtG,qGAAqG;QACrG,uGAAuG;QACvG,IAAI,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM;QAC7B,IAAI,CAAC;YACH,QAAQ,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;QACD,IAAI,CAAC;YACH,QAAQ,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,+FAA+F;QACjG,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/pi-tools.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Facts about pi itself: its built-in tool names, and the capability that means "all of them".
+ *
+ * These lived in `agent-types.ts` until ADR-0016 deleted that module along with the rest of the
+ * `@tintinweb/pi-subagents` port. They are not about agent types at all — `PI_BUILTIN_TOOLS` is how the
+ * catalog tells a built-in from an extension tool, and `WILDCARD` is a capability id — so they outlive
+ * the port and belong somewhere that does not name a package we no longer depend on.
+ *
+ * **`PI_BUILTIN_TOOLS` is a pinned observation, and it has already drifted once** (R-31): pi 0.84.1
+ * exposes a `parallel` tool that the 0.83.0 list did not contain, which made it classify as an
+ * *extension* capability. The list is used for classification only — never for enforcement, which is
+ * `--tools`' job — so drift misfiles a capability rather than granting one. Keep it current anyway; a
+ * misfiled capability is a confusing catalog.
+ */
+import type { Capability } from "./resolve.ts";
+/** Capability held only by a delegator authorised to hand out everything. */
+export declare const WILDCARD: Capability;
+/** pi's built-in tools, observed against 0.84.1. `parallel` was added since 0.83.0 — see R-31. */
+export declare const PI_BUILTIN_TOOLS: readonly ["bash", "edit", "edit-diff", "find", "grep", "ls", "parallel", "read", "write"];
+//# sourceMappingURL=pi-tools.d.ts.map

package/dist/pi-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-tools.d.ts","sourceRoot":"","sources":["../src/pi-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,6EAA6E;AAC7E,eAAO,MAAM,QAAQ,EAAE,UAAqB,CAAC;AAG7C,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,2FAEnB,CAAC"}

package/dist/pi-tools.js

@@ -0,0 +1,21 @@
+/**
+ * Facts about pi itself: its built-in tool names, and the capability that means "all of them".
+ *
+ * These lived in `agent-types.ts` until ADR-0016 deleted that module along with the rest of the
+ * `@tintinweb/pi-subagents` port. They are not about agent types at all — `PI_BUILTIN_TOOLS` is how the
+ * catalog tells a built-in from an extension tool, and `WILDCARD` is a capability id — so they outlive
+ * the port and belong somewhere that does not name a package we no longer depend on.
+ *
+ * **`PI_BUILTIN_TOOLS` is a pinned observation, and it has already drifted once** (R-31): pi 0.84.1
+ * exposes a `parallel` tool that the 0.83.0 list did not contain, which made it classify as an
+ * *extension* capability. The list is used for classification only — never for enforcement, which is
+ * `--tools`' job — so drift misfiles a capability rather than granting one. Keep it current anyway; a
+ * misfiled capability is a confusing catalog.
+ */
+/** Capability held only by a delegator authorised to hand out everything. */
+export const WILDCARD = "tool:*";
+/** pi's built-in tools, observed against 0.84.1. `parallel` was added since 0.83.0 — see R-31. */
+export const PI_BUILTIN_TOOLS = [
+    "bash", "edit", "edit-diff", "find", "grep", "ls", "parallel", "read", "write",
+];
+//# sourceMappingURL=pi-tools.js.map

package/dist/pi-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-tools.js","sourceRoot":"","sources":["../src/pi-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,QAAQ,GAAe,QAAQ,CAAC;AAG7C,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO;CACtE,CAAC"}

package/dist/propagation.d.ts

@@ -0,0 +1,185 @@
+/**
+ * Race-free grant propagation.
+ *
+ * The first implementation wrote each child's computed grant into `process.env` inside the `tool_call`
+ * handler. The environment is process-global, so two concurrent spawns could read each other's values —
+ * a real hole in a security control.
+ *
+ * The fix removes the need for a per-child channel entirely, rather than trying to build one:
+ *
+ *   1. Everything pushed to children is a property of the PARENT, not of the individual spawn — the
+ *      parent's own grant, the child depth (parent depth + 1), and the configured bounds. Those are
+ *      identical for every sibling, so concurrent spawns cannot disagree and there is nothing to race.
+ *      `ENV_APPROVED` (approvals a human granted at or above this level) is safe on the same global
+ *      channel for the same reason: it is intersected with the parent's own grant before being written,
+ *      which is itself a parent-level fact, so it too is identical for every sibling.
+ *   2. Each child derives ITS OWN grant on arrival: `inheritedParentGrant ∩ ownObservedTools`, where the
+ *      observed set comes from the `tools` array of its first provider request — authoritative, because
+ *      it is literally what pi sent the model.
+ *
+ * The environment is therefore written ONCE per session, before any spawn can occur (the first provider
+ * request precedes any tool call), and never mutated per spawn.
+ *
+ * The invariant still holds transitively: own = observed ∩ inheritedParent ⊆ inheritedParent, so no
+ * descendant can exceed the root. It is also defence in depth — even if a spawn slipped past the
+ * interceptor and pi handed the child more than the parent held, the intersection clamps it back.
+ */
+import type { Capability } from "./resolve.ts";
+import { type InheritableApproval } from "./approval.ts";
+export declare const ENV_GRANT = "PI_GRANTS_GRANT";
+/**
+ * Total descendants this session may create in its whole subtree (`src/fanout.ts`).
+ *
+ * In `GRANT_ENV_KEYS` and therefore stripped from a child's environment and re-supplied only by the spawn
+ * plan — like depth, and for the same reason: it is capability state that must ATTENUATE downward, not an
+ * operator preference that should inherit. `PI_GRANTS_CHILD_TIMEOUT` is deliberately the other kind.
+ */
+export declare const ENV_FANOUT = "PI_GRANTS_FANOUT";
+/**
+ * This session's ledger id, so a child's records name their real parent (review finding F8).
+ *
+ * Without it every level restarts at `d0` and the ledger cannot be joined into a tree across processes.
+ */
+export declare const ENV_PARENT_ID = "PI_GRANTS_PARENT_ID";
+export declare const ENV_DEPTH = "PI_GRANTS_DEPTH";
+export declare const ENV_MAX_DEPTH = "PI_GRANTS_MAX_DEPTH";
+export declare const ENV_GATED = "PI_GRANTS_GATED";
+export declare const ENV_LEDGER = "PI_GRANTS_LEDGER";
+export declare const ENV_APPROVED = "PI_GRANTS_APPROVED";
+/**
+ * Every variable this package uses to push governance state at a child.
+ *
+ * Named as a set so `mergeChildEnv` can guarantee that none of them survives from the parent's own
+ * environment into a child's — a governance variable a child inherits by accident is one nobody decided
+ * to give it.
+ */
+export declare const GRANT_ENV_KEYS: readonly ["PI_GRANTS_GRANT", "PI_GRANTS_DEPTH", "PI_GRANTS_MAX_DEPTH", "PI_GRANTS_GATED", "PI_GRANTS_LEDGER", "PI_GRANTS_APPROVED", "PI_GRANTS_FANOUT", "PI_GRANTS_PARENT_ID"];
+export declare const parseList: (raw: string | undefined) => Capability[];
+/**
+ * Derive this session's own grant from what it inherited and what pi actually gave it.
+ *
+ * `observedTools` is the bare tool-name list from the session's own provider payload, or null when it
+ * has not been observed yet — in which case the inherited grant is used unchanged (it is already an
+ * upper bound, so this is safe, just less tight).
+ *
+ * A wildcard holder stays a wildcard holder: an enumerated observation must not silently downgrade an
+ * explicitly unlimited grant, or a root session would lose the authority it was configured with.
+ *
+ * **R-36 / ADR-0017 step 1: only tool-shaped capabilities are filtered.** The observation is a list of
+ * TOOLS, so it is evidence about `tool:` and `ext:` and about nothing else. Until this was fixed, a child
+ * inheriting `tool:read, skill:review` held only `tool:read` from its first provider request onward — it
+ * still *had* the skill (it arrives as `--skill`), but could not re-grant it and `/grants` stopped listing
+ * it. Silently, and in the narrowing direction, which is why it survived: nothing fails when a grant
+ * quietly shrinks. It also made ADR-0017's `agent:` prerequisite unsatisfiable below the root.
+ */
+export declare function deriveOwnGrant(inheritedParentGrant: Capability[], observedTools: string[] | null): Capability[];
+/**
+ * Parse a bound from the environment, distinguishing **absent** from **malformed**.
+ *
+ * G7 / A-S4 + B-I4. `Number.parseInt` is the wrong tool for reading configuration: it accepts a numeric
+ * prefix (`parseInt("2abc")` is `2`), returns `NaN` for anything else, and `NaN` silently passes every
+ * comparison as false — so a malformed `PI_GRANTS_MAX_DEPTH` did not tighten the limit, it removed it.
+ *
+ * The three-way return is the point. `undefined` means "not configured, use the documented default";
+ * `null` means "configured wrongly", which callers must treat as a failure rather than a default,
+ * because a value someone tried to set and mistyped is not the same as one they never set.
+ */
+export declare function parseBound(raw: string | undefined): number | null | undefined;
+export interface DepthConfig {
+    depth: number;
+    maxDepth: number;
+    /** Names of the variables that were set but unreadable, for an operator-facing warning. */
+    malformed: string[];
+}
+/**
+ * Resolve this session's depth bounds, failing closed on anything malformed.
+ *
+ * **Malformed input disables spawning entirely (`maxDepth: 0`)** rather than falling back to a default,
+ * and that applies to a bad `PI_GRANTS_DEPTH` just as much as a bad `PI_GRANTS_MAX_DEPTH`. The old
+ * `|| 0` guard on depth failed open in a subtler way than the missing guard on maxDepth: a session that
+ * could not read its own depth was treated as a **root**, which is the most permissive answer available
+ * and precisely the value an attacker would choose. If we do not know how deep we are, we must not spawn.
+ */
+export declare function depthConfig(depthRaw: string | undefined, maxDepthRaw: string | undefined): DepthConfig;
+/** The documented default child-depth bound when `PI_GRANTS_MAX_DEPTH` is not set. */
+export declare const DEFAULT_MAX_DEPTH = 2;
+/**
+ * Gated by default in a governed session (ADR-0012).
+ *
+ * `bash` is not one capability among others; it is an execution primitive. A child holding it can run
+ * `env -u PI_GRANTS_GRANT pi …` and obtain a completely **ungoverned** descendant — measured, not
+ * theorised (`docs/probes/g5-bash-escape`). Handing that down silently is the thing worth changing.
+ *
+ * Subsumption-aware gating (also ADR-0012) means this single entry covers `write`, `edit`, `read`,
+ * `grep`, `find` and `ls` as well, since `bash` confers all of them.
+ */
+export declare const DEFAULT_GATED: Capability[];
+/**
+ * Read the gate list, distinguishing **absent** from **explicitly empty**.
+ *
+ * `parseList` alone cannot: it maps both `undefined` and `""` to `[]`. That distinction is the operator's
+ * only way to turn the default off — without it, someone who wants no gates would have to stop governing
+ * altogether, which is strictly worse than the thing they were trying to avoid.
+ */
+export declare function gatedFromEnv(raw: string | undefined): Capability[];
+export interface ChildEnvInput {
+    /** This session's own grant — becomes the child's inherited parent grant. */
+    ownGrant: Capability[];
+    /** This session's depth; children are one deeper. */
+    depth: number;
+    maxDepth: number;
+    gated: Capability[];
+    /**
+     * Gated capabilities a human approved at or above this level.
+     *
+     * Safe to push on the GLOBAL channel because it is intersected with THIS session's own grant, which is
+     * a parent-level fact — identical for every sibling, so there is nothing to race on. Each child then
+     * re-intersects with its own grant on arrival, exactly as it does for the grant itself.
+     */
+    /**
+     * Approvals eligible to cross the boundary (ADR-0014): capability, subject and scope. `once` is
+     * dropped by `inheritApprovals`, and the subject is preserved so it cannot satisfy another one.
+     */
+    approved?: InheritableApproval[];
+    ledgerPath?: string;
+    /**
+     * Whether THIS session is governed — i.e. `PI_GRANTS_GRANT` was set for it.
+     *
+     * G7 / B-I8. Governance is opt-in: with the variable unset the README promises "nothing is blocked".
+     * That was true of the session itself and false of its children, because this function still exported
+     * a grant, a depth and a bound, so an ungoverned parent silently started governing its descendants —
+     * and the grant it exported was its own observed tool surface, which is a real restriction arrived at
+     * by accident. An ungoverned session must be transparent, not a source of policy.
+     *
+     * Defaults to `true` so that every existing caller keeps publishing; only the extension, which alone
+     * knows whether the variable was set, passes `false`.
+     */
+    governed?: boolean;
+}
+/**
+ * The environment a child should inherit. Constant across all of this session's children by
+ * construction, which is what makes concurrent spawning safe.
+ *
+ * **The wildcard is never inherited.** A root may HOLD `tool:*` — that is authority to grant anything —
+ * but handing it down would let every descendant reacquire the full catalog, which makes attenuation
+ * meaningless below the root. Children therefore inherit the ENUMERATED grant only.
+ *
+ * Consequence, deliberate: a wildcard root that has not yet observed its own tools hands children an
+ * empty grant, so they can spawn nothing. That fails closed. It is also unreachable in normal flow,
+ * because a session's first provider request always precedes its first tool call.
+ */
+export declare function childEnv(input: ChildEnvInput): Record<string, string>;
+/**
+ * The environment for a child this process spawns itself: the parent's environment with every governance
+ * variable stripped, then the per-child plan applied.
+ *
+ * Spreading `{ ...process.env, ...plan.env }` is not enough. `plan.env` omits keys that do not apply to
+ * this child (an empty approval set, no gated list), and an omitted key does not overwrite — so the
+ * parent's own value survives into the child. Stripping first makes the plan the ONLY source of every
+ * governance variable, which is what `delegate.ts`'s "nothing is written to the shared `process.env`"
+ * claim actually requires. Consumers re-clamp anyway; this is the defence in depth behind that.
+ */
+export declare function mergeChildEnv(parentEnv: NodeJS.ProcessEnv, planEnv: Record<string, string>): NodeJS.ProcessEnv;
+/** Extract bare tool names from a provider payload's tool array, tolerating provider shape differences. */
+export declare function observeToolNames(payload: unknown): string[] | null;
+//# sourceMappingURL=propagation.d.ts.map

package/dist/propagation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"propagation.d.ts","sourceRoot":"","sources":["../src/propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAE3E,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAC3C;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,qBAAqB,CAAC;AAC7C;;;;GAIG;AACH,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAC3C,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAC3C,eAAO,MAAM,UAAU,qBAAqB,CAAC;AAC7C,eAAO,MAAM,YAAY,uBAAuB,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,gLASjB,CAAC;AAEX,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,UAAU,EACW,CAAC;AAkB1E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,oBAAoB,EAAE,UAAU,EAAE,EAClC,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,GAC7B,UAAU,EAAE,CAgBd;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAO7E;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAStG;AAED,sFAAsF;AACtF,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,EAAE,UAAU,EAAkB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,EAAE,CAGlE;AAED,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB;;;;;;OAMG;IACH;;;OAGG;IACH,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBrE;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,CAAC,UAAU,EAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAAC,UAAU,CAInB;AAED,2GAA2G;AAC3G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAoBlE"}

package/dist/propagation.js

@@ -0,0 +1,255 @@
+/**
+ * Race-free grant propagation.
+ *
+ * The first implementation wrote each child's computed grant into `process.env` inside the `tool_call`
+ * handler. The environment is process-global, so two concurrent spawns could read each other's values —
+ * a real hole in a security control.
+ *
+ * The fix removes the need for a per-child channel entirely, rather than trying to build one:
+ *
+ *   1. Everything pushed to children is a property of the PARENT, not of the individual spawn — the
+ *      parent's own grant, the child depth (parent depth + 1), and the configured bounds. Those are
+ *      identical for every sibling, so concurrent spawns cannot disagree and there is nothing to race.
+ *      `ENV_APPROVED` (approvals a human granted at or above this level) is safe on the same global
+ *      channel for the same reason: it is intersected with the parent's own grant before being written,
+ *      which is itself a parent-level fact, so it too is identical for every sibling.
+ *   2. Each child derives ITS OWN grant on arrival: `inheritedParentGrant ∩ ownObservedTools`, where the
+ *      observed set comes from the `tools` array of its first provider request — authoritative, because
+ *      it is literally what pi sent the model.
+ *
+ * The environment is therefore written ONCE per session, before any spawn can occur (the first provider
+ * request precedes any tool call), and never mutated per spawn.
+ *
+ * The invariant still holds transitively: own = observed ∩ inheritedParent ⊆ inheritedParent, so no
+ * descendant can exceed the root. It is also defence in depth — even if a spawn slipped past the
+ * interceptor and pi handed the child more than the parent held, the intersection clamps it back.
+ */
+import { WILDCARD } from "./pi-tools.js";
+import { inheritApprovals } from "./approval.js";
+export const ENV_GRANT = "PI_GRANTS_GRANT";
+/**
+ * Total descendants this session may create in its whole subtree (`src/fanout.ts`).
+ *
+ * In `GRANT_ENV_KEYS` and therefore stripped from a child's environment and re-supplied only by the spawn
+ * plan — like depth, and for the same reason: it is capability state that must ATTENUATE downward, not an
+ * operator preference that should inherit. `PI_GRANTS_CHILD_TIMEOUT` is deliberately the other kind.
+ */
+export const ENV_FANOUT = "PI_GRANTS_FANOUT";
+/**
+ * This session's ledger id, so a child's records name their real parent (review finding F8).
+ *
+ * Without it every level restarts at `d0` and the ledger cannot be joined into a tree across processes.
+ */
+export const ENV_PARENT_ID = "PI_GRANTS_PARENT_ID";
+export const ENV_DEPTH = "PI_GRANTS_DEPTH";
+export const ENV_MAX_DEPTH = "PI_GRANTS_MAX_DEPTH";
+export const ENV_GATED = "PI_GRANTS_GATED";
+export const ENV_LEDGER = "PI_GRANTS_LEDGER";
+export const ENV_APPROVED = "PI_GRANTS_APPROVED";
+/**
+ * Every variable this package uses to push governance state at a child.
+ *
+ * Named as a set so `mergeChildEnv` can guarantee that none of them survives from the parent's own
+ * environment into a child's — a governance variable a child inherits by accident is one nobody decided
+ * to give it.
+ */
+export const GRANT_ENV_KEYS = [
+    ENV_GRANT,
+    ENV_DEPTH,
+    ENV_MAX_DEPTH,
+    ENV_GATED,
+    ENV_LEDGER,
+    ENV_APPROVED,
+    ENV_FANOUT,
+    ENV_PARENT_ID,
+];
+export const parseList = (raw) => (raw ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+/** Does a bare pi tool name correspond to this capability? `read` matches `tool:read` and `ext:pkg/read`. */
+function matchesToolName(capability, toolName) {
+    if (capability === `tool:${toolName}`)
+        return true;
+    return capability.startsWith("ext:") && capability.slice(capability.lastIndexOf("/") + 1) === toolName;
+}
+/**
+ * Is this capability something an observed tool array can speak about at all? (R-36, ADR-0017 step 1.)
+ *
+ * `tool:` and `ext:` name tools, so a tool array that omits one is evidence the session does not have it.
+ * `skill:` and `agent:` name a loadable instruction file and a spawnable definition — neither is ever a
+ * tool, so an observation says **nothing** about them and must not be read as evidence of absence.
+ */
+const isToolCapability = (capability) => capability.startsWith("tool:") || capability.startsWith("ext:");
+/**
+ * Derive this session's own grant from what it inherited and what pi actually gave it.
+ *
+ * `observedTools` is the bare tool-name list from the session's own provider payload, or null when it
+ * has not been observed yet — in which case the inherited grant is used unchanged (it is already an
+ * upper bound, so this is safe, just less tight).
+ *
+ * A wildcard holder stays a wildcard holder: an enumerated observation must not silently downgrade an
+ * explicitly unlimited grant, or a root session would lose the authority it was configured with.
+ *
+ * **R-36 / ADR-0017 step 1: only tool-shaped capabilities are filtered.** The observation is a list of
+ * TOOLS, so it is evidence about `tool:` and `ext:` and about nothing else. Until this was fixed, a child
+ * inheriting `tool:read, skill:review` held only `tool:read` from its first provider request onward — it
+ * still *had* the skill (it arrives as `--skill`), but could not re-grant it and `/grants` stopped listing
+ * it. Silently, and in the narrowing direction, which is why it survived: nothing fails when a grant
+ * quietly shrinks. It also made ADR-0017's `agent:` prerequisite unsatisfiable below the root.
+ */
+export function deriveOwnGrant(inheritedParentGrant, observedTools) {
+    if (observedTools === null)
+        return [...inheritedParentGrant];
+    // Capabilities an observation cannot speak about ride through both branches untouched.
+    const nonTool = inheritedParentGrant.filter((c) => !isToolCapability(c) && c !== WILDCARD);
+    if (inheritedParentGrant.includes(WILDCARD)) {
+        // Keep the wildcard, and additionally enumerate what was observed so descendants can be checked
+        // against concrete names too.
+        const enumerated = observedTools.map((t) => `tool:${t}`);
+        return [...new Set([WILDCARD, ...enumerated, ...nonTool])].sort();
+    }
+    return [
+        ...inheritedParentGrant.filter((c) => isToolCapability(c) && observedTools.some((t) => matchesToolName(c, t))),
+        ...nonTool,
+    ].sort();
+}
+/**
+ * Parse a bound from the environment, distinguishing **absent** from **malformed**.
+ *
+ * G7 / A-S4 + B-I4. `Number.parseInt` is the wrong tool for reading configuration: it accepts a numeric
+ * prefix (`parseInt("2abc")` is `2`), returns `NaN` for anything else, and `NaN` silently passes every
+ * comparison as false — so a malformed `PI_GRANTS_MAX_DEPTH` did not tighten the limit, it removed it.
+ *
+ * The three-way return is the point. `undefined` means "not configured, use the documented default";
+ * `null` means "configured wrongly", which callers must treat as a failure rather than a default,
+ * because a value someone tried to set and mistyped is not the same as one they never set.
+ */
+export function parseBound(raw) {
+    if (raw === undefined)
+        return undefined;
+    const trimmed = raw.trim();
+    // Exact non-negative decimal integers only: no signs, no fractions, no 0x, no numeric prefixes.
+    if (!/^\d+$/.test(trimmed))
+        return null;
+    const value = Number(trimmed);
+    return Number.isSafeInteger(value) ? value : null;
+}
+/**
+ * Resolve this session's depth bounds, failing closed on anything malformed.
+ *
+ * **Malformed input disables spawning entirely (`maxDepth: 0`)** rather than falling back to a default,
+ * and that applies to a bad `PI_GRANTS_DEPTH` just as much as a bad `PI_GRANTS_MAX_DEPTH`. The old
+ * `|| 0` guard on depth failed open in a subtler way than the missing guard on maxDepth: a session that
+ * could not read its own depth was treated as a **root**, which is the most permissive answer available
+ * and precisely the value an attacker would choose. If we do not know how deep we are, we must not spawn.
+ */
+export function depthConfig(depthRaw, maxDepthRaw) {
+    const depth = parseBound(depthRaw);
+    const maxDepth = parseBound(maxDepthRaw);
+    const malformed = [];
+    if (depth === null)
+        malformed.push(ENV_DEPTH);
+    if (maxDepth === null)
+        malformed.push(ENV_MAX_DEPTH);
+    if (malformed.length > 0)
+        return { depth: depth ?? 0, maxDepth: 0, malformed };
+    return { depth: depth ?? 0, maxDepth: maxDepth ?? DEFAULT_MAX_DEPTH, malformed };
+}
+/** The documented default child-depth bound when `PI_GRANTS_MAX_DEPTH` is not set. */
+export const DEFAULT_MAX_DEPTH = 2;
+/**
+ * Gated by default in a governed session (ADR-0012).
+ *
+ * `bash` is not one capability among others; it is an execution primitive. A child holding it can run
+ * `env -u PI_GRANTS_GRANT pi …` and obtain a completely **ungoverned** descendant — measured, not
+ * theorised (`docs/probes/g5-bash-escape`). Handing that down silently is the thing worth changing.
+ *
+ * Subsumption-aware gating (also ADR-0012) means this single entry covers `write`, `edit`, `read`,
+ * `grep`, `find` and `ls` as well, since `bash` confers all of them.
+ */
+export const DEFAULT_GATED = ["tool:bash"];
+/**
+ * Read the gate list, distinguishing **absent** from **explicitly empty**.
+ *
+ * `parseList` alone cannot: it maps both `undefined` and `""` to `[]`. That distinction is the operator's
+ * only way to turn the default off — without it, someone who wants no gates would have to stop governing
+ * altogether, which is strictly worse than the thing they were trying to avoid.
+ */
+export function gatedFromEnv(raw) {
+    if (raw === undefined)
+        return [...DEFAULT_GATED];
+    return parseList(raw);
+}
+/**
+ * The environment a child should inherit. Constant across all of this session's children by
+ * construction, which is what makes concurrent spawning safe.
+ *
+ * **The wildcard is never inherited.** A root may HOLD `tool:*` — that is authority to grant anything —
+ * but handing it down would let every descendant reacquire the full catalog, which makes attenuation
+ * meaningless below the root. Children therefore inherit the ENUMERATED grant only.
+ *
+ * Consequence, deliberate: a wildcard root that has not yet observed its own tools hands children an
+ * empty grant, so they can spawn nothing. That fails closed. It is also unreachable in normal flow,
+ * because a session's first provider request always precedes its first tool call.
+ */
+export function childEnv(input) {
+    if (input.governed === false)
+        return {};
+    const inheritable = input.ownGrant.filter((c) => c !== WILDCARD);
+    const env = {
+        [ENV_GRANT]: inheritable.join(","),
+        [ENV_DEPTH]: String(input.depth + 1),
+        [ENV_MAX_DEPTH]: String(input.maxDepth),
+    };
+    if (input.gated.length > 0)
+        env[ENV_GATED] = input.gated.join(",");
+    // ALWAYS written, empty string included. This is the one value that changes during a session (a human
+    // approves something, or the session's own grant narrows on observation), and the interceptor path
+    // publishes it by ASSIGNING into the process-global `process.env`. Omitting it when empty would leave
+    // whatever was there before — the parent's own, unclamped `PI_GRANTS_APPROVED` — visible to every child.
+    // `parseList("")` is `[]`, so an empty value reads back exactly as an absent one.
+    env[ENV_APPROVED] = inheritApprovals(input.approved ?? [], inheritable).join(",");
+    if (input.ledgerPath)
+        env[ENV_LEDGER] = input.ledgerPath;
+    return env;
+}
+/**
+ * The environment for a child this process spawns itself: the parent's environment with every governance
+ * variable stripped, then the per-child plan applied.
+ *
+ * Spreading `{ ...process.env, ...plan.env }` is not enough. `plan.env` omits keys that do not apply to
+ * this child (an empty approval set, no gated list), and an omitted key does not overwrite — so the
+ * parent's own value survives into the child. Stripping first makes the plan the ONLY source of every
+ * governance variable, which is what `delegate.ts`'s "nothing is written to the shared `process.env`"
+ * claim actually requires. Consumers re-clamp anyway; this is the defence in depth behind that.
+ */
+export function mergeChildEnv(parentEnv, planEnv) {
+    const merged = { ...parentEnv };
+    for (const key of GRANT_ENV_KEYS)
+        delete merged[key];
+    return { ...merged, ...planEnv };
+}
+/** Extract bare tool names from a provider payload's tool array, tolerating provider shape differences. */
+export function observeToolNames(payload) {
+    if (!payload || typeof payload !== "object")
+        return null;
+    const record = payload;
+    for (const key of ["tools", "functions"]) {
+        const candidate = record[key];
+        if (!Array.isArray(candidate))
+            continue;
+        const names = candidate
+            .map((entry) => {
+            if (!entry || typeof entry !== "object")
+                return undefined;
+            const e = entry;
+            // Anthropic/OpenAI tool objects, and OpenAI's nested `function.name` form.
+            const nested = e.function;
+            const name = e.name ?? nested?.name;
+            return typeof name === "string" ? name : undefined;
+        })
+            .filter((n) => Boolean(n));
+        // An empty tools array is a real observation (the session has no tools), not a failure to observe.
+        return names;
+    }
+    return null;
+}
+//# sourceMappingURL=propagation.js.map

package/dist/propagation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propagation.js","sourceRoot":"","sources":["../src/propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAA4B,MAAM,eAAe,CAAC;AAE3E,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAC3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAC7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAC3C,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,UAAU;IACV,YAAY;IACZ,UAAU;IACV,aAAa;CACL,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAuB,EAAgB,EAAE,CACjE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAE1E,6GAA6G;AAC7G,SAAS,eAAe,CAAC,UAAsB,EAAE,QAAgB;IAC/D,IAAI,UAAU,KAAK,QAAQ,QAAQ,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC;AACzG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,UAAsB,EAAW,EAAE,CAC3D,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,oBAAkC,EAClC,aAA8B;IAE9B,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,oBAAoB,CAAC,CAAC;IAC7D,uFAAuF;IACvF,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC3F,IAAI,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,gGAAgG;QAChG,8BAA8B;QAC9B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO;QACL,GAAG,oBAAoB,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAC/E;QACD,GAAG,OAAO;KACX,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,GAAuB;IAChD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,gGAAgG;IAChG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,QAA4B,EAAE,WAA+B;IACvF,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,IAAI;QAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAErD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,IAAI,iBAAiB,EAAE,SAAS,EAAE,CAAC;AACnF,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAiB,CAAC,WAAW,CAAC,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAqCD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAoB;IAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACjE,MAAM,GAAG,GAA2B;QAClC,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;QAClC,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QACpC,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;KACxC,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,sGAAsG;IACtG,mGAAmG;IACnG,sGAAsG;IACtG,yGAAyG;IACzG,kFAAkF;IAClF,GAAG,CAAC,YAAY,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IACzD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,SAA4B,EAC5B,OAA+B;IAE/B,MAAM,MAAM,GAAsB,EAAE,GAAG,SAAS,EAAE,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,cAAc;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,SAAS;aACpB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;YAC3C,2EAA2E;YAC3E,MAAM,MAAM,GAAG,CAAC,CAAC,QAA+C,CAAC;YACjE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,EAAE,IAAI,CAAC;YACpC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,mGAAmG;QACnG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}