smol-symphony 0.1.0 → 0.2.0

package/dist/agent/adapters.js

@@ -1,111 +1,331 @@
 // Registry of ACP adapters symphony knows how to launch end-to-end.
 //
-// Each profile encodes everything symphony needs to ship a working adapter into the
-// per-issue smolvm without per-workflow bash boilerplate:
+// Each profile encodes the executable inside the VM that speaks ACP, plus the
+// optional model/effort injection channels (env vars, extra argv, staged files)
+// the adapter natively understands. Credentials are NOT a per-adapter concern
+// here: the guest holds only a token-shaped placeholder and the host substitutes
+// the real upstream token (Anthropic OAuth for claude, an OpenAI API key or
+// ChatGPT-OAuth access token for codex, a minted GitHub Copilot token for
+// opencode) into the outbound request at Gondolin egress (TLS-MITM — see
+// `src/agent/credential-secrets.ts`). The real refresh/durable token never
+// enters the VM.
 //
-//   - hostCredentialPath : the file on the host (relative to $HOME) that authenticates
-//                          the adapter. Symphony reads this and stages it into the
-//                          workspace before VM boot.
-//   - guestCredentialPath: the absolute path inside the VM where the adapter expects
-//                          to find that file. Symphony's auto-generated acp launch
-//                          command copies the staged file here at startup.
-//   - binary             : the executable inside the VM that speaks ACP.
-//
-// To add a new adapter (e.g. opencode), populate the profile and add it to ADAPTERS.
-// Until an adapter has a verified profile, workflows can still target it by setting
-// `acp.command` explicitly — that opts out of symphony's auto-staging and the operator
-// becomes responsible for getting credentials to the adapter themselves.
-//
-// IMPORTANT: every host path here is treated as private. Symphony reads the file,
-// stages a copy into the workspace, and chmods the copy to 0600. The original host
-// file is never exposed via a bind mount.
-import { constants as fsConstants } from 'node:fs';
-import { access, copyFile, mkdir, chmod, lstat, rm, realpath } from 'node:fs/promises';
+// To add a new adapter, populate the profile and add it to ADAPTERS. Unprofiled
+// adapters are not supported at runtime.
+import { lstat, mkdir, readFile, realpath, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
 import path from 'node:path';
-import os from 'node:os';
+import { isKnownAdapter } from './adapter-names.js';
+// Re-export the names registry so orchestrator-side callers can keep importing
+// `isKnownAdapter` / `AcpAdapterId` from this module. The canonical home is
+// adapter-names.ts; this is just a convenience re-export.
+export { isKnownAdapter };
+// VM-facing env var names the opencode custom provider reads (via `{env:VAR}`)
+// for its base URL + bearer. The staged opencode.json (`buildOpencodeConfig`)
+// references these exact names; the token var MUST equal `OPENCODE_SECRET_NAME`
+// in `credential-secrets.ts` so the placeholder bearer Gondolin substitutes at
+// egress is keyed under the name the in-VM provider reads — a drift would
+// silently break the in-VM provider resolution.
+const OPENCODE_PROXY_BASE_URL_VAR = 'OPENCODE_PROXY_BASE_URL';
+const OPENCODE_PROXY_TOKEN_VAR = 'OPENCODE_PROXY_TOKEN';
 export const ADAPTERS = {
     claude: {
         id: 'claude',
-        hostCredentialPath: '.claude/.credentials.json',
-        guestCredentialPath: '/root/.claude/.credentials.json',
         binary: ['claude-agent-acp'],
+        // Anthropic subscription OAuth lives only on the host; the guest holds a
+        // token-shaped placeholder and Gondolin substitutes the real access token at
+        // egress on every upstream request (see `credential-secrets.ts`).
+        // claude-agent-acp reads ANTHROPIC_MODEL on startup (see acp-agent.js getAvailableModels:
+        // ANTHROPIC_MODEL > settings.model > default). The adapter resolves aliases like
+        // "opus" or "claude-sonnet-4-5" against the SDK's model list, so anything the user
+        // would type into Claude Code works here.
+        modelInjection: (model) => ({ env: { ANTHROPIC_MODEL: model } }),
+        // claude-agent-acp reads `effortLevel` out of merged settings (the SDK's
+        // `resolveSettings` walks `$CLAUDE_CONFIG_DIR/settings.json`, `<cwd>/.claude/settings.json`,
+        // etc.) and applies it via `query.applyFlagSettings`. There is no ANTHROPIC_EFFORT env var
+        // and the wrapper does not expose a CLI flag, so the only reachable channel from symphony
+        // is a settings.json staged next to the identity file and copied to /root/.claude/settings.json
+        // before the in-VM agent execs the adapter. Valid values are `low|medium|high|xhigh|max`, gated
+        // per-model by claude-agent-acp's `supportedEffortLevels`; symphony lets the adapter reject
+        // invalid choices rather than mirroring the gate.
+        effortInjection: (effort) => ({
+            stagedFiles: [
+                {
+                    stagedName: 'claude-settings.json',
+                    content: JSON.stringify({ effortLevel: effort }),
+                    guestPath: '/root/.claude/settings.json',
+                },
+            ],
+        }),
     },
     codex: {
         id: 'codex',
-        hostCredentialPath: '.codex/auth.json',
-        guestCredentialPath: '/root/.codex/auth.json',
         binary: ['codex-acp'],
+        // codex (ChatGPT-OAuth) runs in its NATIVE mode: the guest holds a JWT-shaped
+        // placeholder as `~/.codex/auth.json:tokens.access_token` and Gondolin
+        // substitutes the real ChatGPT/OpenAI token at egress. The host stages a
+        // COMPLETE fake auth.json (placeholder tokens + the non-secret
+        // `account_id`/`auth_mode`/`last_refresh` codex 0.135's completeness check
+        // needs — see `gondolin-creds-staging.ts` `buildCodexFiles`); no real token,
+        // and no refresh token, ever enters the VM.
+        // codex-acp takes config overrides via `-c key=value` where value is parsed as TOML
+        // (raw-string fallback on parse failure). We always emit a quoted TOML string so
+        // model names containing dots or hyphens don't surprise the TOML parser.
+        modelInjection: (model) => ({ extraArgs: ['-c', `model=${JSON.stringify(model)}`] }),
+        // KNOWN GO-LIVE BLOCKER (codex over Gondolin, native ChatGPT-OAuth): codex-acp
+        // 0.15 streams `/backend-api/codex/responses` over a WebSocket. Through the
+        // Gondolin substrate that stream disconnects (`ResponseStreamDisconnected`,
+        // http_status_code: None) — codex then misreads the drop as an auth failure and
+        // attempts a token refresh, which is egress-blocked (auth.openai.com not
+        // allowlisted) → 403 → the turn is REFUSED. The placeholder-JWT account-id fix
+        // (credential-secrets.ts) is necessary (it stops the *pre-emptive* refresh so
+        // codex reaches `/responses` at all) but NOT sufficient. Neither
+        // `allowWebSockets:true` (the WS still drops) nor a config override resolves it:
+        // codex 0.135 forbids overriding the reserved built-in `openai` provider
+        // (`supports_websockets=false` → "Built-in providers cannot be overridden"),
+        // and codex-acp has no user-facing knob to force the HTTP transport
+        // (`force_http_fallback` is an internal Rust symbol, not a TOML config key).
+        // `codex exec` (the CLI, HTTP SSE) works fine through Gondolin — so this is
+        // specific to codex-acp's WebSocket Responses transport vs Gondolin's WS-MITM.
+        // Resolving it needs a substrate-level or codex-acp-version change (escalate);
+        // claude is fully green on the same path.
+    },
+    opencode: {
+        id: 'opencode',
+        binary: ['opencode', 'acp'],
+        // opencode reaches GitHub Copilot via a staged opencode.json custom
+        // `@ai-sdk/openai-compatible` provider whose baseURL/apiKey read the
+        // OPENCODE_PROXY_* env vars through opencode's `{env:VAR}` interpolation. The
+        // guest sends only a `gho_`-shaped placeholder bearer; the host mints a
+        // short-lived GitHub Copilot token (exchanged host-side from the operator's
+        // `opencode auth login` GitHub OAuth token at
+        // api.github.com/copilot_internal/v2/token) and Gondolin substitutes it into
+        // the outbound request at egress, injecting the Copilot editor headers,
+        // against api.githubcopilot.com. The durable GitHub OAuth token never enters
+        // the VM. See `credential-secrets.ts` and
+        // docs/research/opencode-copilot-accept-matrix.md.
+        // opencode picks its model from the staged opencode.json `model` key
+        // ("<providerID>/<modelID>"); the ACP `session/new` carries no model. The
+        // provider block must exist even when no model is pinned, so the whole
+        // config (provider + model) is staged together via stageOpencodeConfig
+        // (see runner.stageAdapterExtras), not through this env/argv channel.
+        // Returning an empty injection keeps this path inert.
+        modelInjection: () => ({}),
     },
 };
-export function isKnownAdapter(id) {
-    return id === 'claude' || id === 'codex';
+/** Provider id of the opencode custom (credential-substituted) provider. */
+export const OPENCODE_PROXY_PROVIDER_ID = 'symphony-copilot';
+/**
+ * Default GitHub Copilot model opencode uses when the workflow pins no
+ * `acp.model`. DOC-DERIVED: `gpt-4o` is broadly available across Copilot
+ * subscription tiers. Operators override per-state via `acp.model` (any id
+ * their Copilot subscription exposes — GPT-5, Claude Sonnet, Gemini, …).
+ */
+export const OPENCODE_DEFAULT_COPILOT_MODEL = 'gpt-4o';
+// A small pinned set of Copilot-backed model ids the custom provider advertises
+// so opencode does not need to hit `<baseURL>/models` for discovery (the
+// upstream serves /models too, but pinning avoids the round-trip and a discovery
+// dependency). DOC-DERIVED — the exact id set a given Copilot subscription
+// exposes is operator/tier-dependent; an operator's `acp.model` is always
+// merged in (see buildOpencodeConfig) so a pinned model that isn't in this list
+// still resolves.
+const OPENCODE_PINNED_COPILOT_MODELS = [
+    'gpt-4o',
+    'gpt-4.1',
+    'o4-mini',
+    'claude-sonnet-4.5',
+    'claude-sonnet-4',
+    'gemini-2.5-pro',
+];
+/**
+ * Build the opencode.json staged into the VM (pure; exported for tests). It
+ * declares the `symphony-copilot` custom provider whose baseURL/apiKey read the
+ * OPENCODE_PROXY_* env vars via `{env:…}` interpolation, advertises a pinned
+ * Copilot model set (plus the operator's selected model), and pins the default
+ * model to `<providerID>/<model>`. Two-space-indented so it reads cleanly if an
+ * operator inspects the staged file.
+ *
+ * The `{env:VAR}` names are the shared OPENCODE_PROXY_* constants, so the in-VM
+ * opencode resolves the same base URL + placeholder bearer the host stages (the
+ * token var matches `OPENCODE_SECRET_NAME` in `credential-secrets.ts`).
+ */
+export function buildOpencodeConfig(model) {
+    const selected = model && model.length > 0 ? model : OPENCODE_DEFAULT_COPILOT_MODEL;
+    const ids = new Set([...OPENCODE_PINNED_COPILOT_MODELS, selected]);
+    const models = {};
+    for (const id of ids)
+        models[id] = {};
+    return JSON.stringify({
+        $schema: 'https://opencode.ai/config.json',
+        provider: {
+            [OPENCODE_PROXY_PROVIDER_ID]: {
+                npm: '@ai-sdk/openai-compatible',
+                name: 'Symphony Copilot proxy',
+                options: {
+                    baseURL: `{env:${OPENCODE_PROXY_BASE_URL_VAR}}`,
+                    apiKey: `{env:${OPENCODE_PROXY_TOKEN_VAR}}`,
+                },
+                models,
+            },
+        },
+        model: `${OPENCODE_PROXY_PROVIDER_ID}/${selected}`,
+    }, null, 2);
+}
+/**
+ * Absolute guest path the staged opencode.json is copied to inside the VM.
+ * opencode reads its global config from `$XDG_CONFIG_HOME/opencode/opencode.json`
+ * (defaulting to `~/.config/opencode/opencode.json`); the VM runs as root, so
+ * `/root/.config/opencode/opencode.json`. DOC-DERIVED: that `opencode acp`
+ * honours the global config + custom provider + `{env:VAR}` interpolation is
+ * recorded in docs/research/opencode-copilot-accept-matrix.md.
+ */
+export const OPENCODE_CONFIG_GUEST_PATH = '/root/.config/opencode/opencode.json';
+/**
+ * Stage the opencode.json (custom-provider + model) into the workspace runtime
+ * tree. Mirrors stageCodexPlaceholderAuth: synthetic content (no secret — the
+ * placeholder bearer arrives via env, never a real token), so it never fails on
+ * a missing host file.
+ */
+export async function stageOpencodeConfig(workspacePath, model) {
+    return stageRuntimeFile(workspacePath, 'opencode.json', buildOpencodeConfig(model));
 }
 export function profileFor(id) {
     return ADAPTERS[id];
 }
-/** Absolute path on the host where the adapter's credential file lives. */
-export function hostCredentialAbsPath(profile) {
-    return path.join(os.homedir(), profile.hostCredentialPath);
+export async function stageRuntimeFile(workspacePath, stagedName, content) {
+    return stageNamedFileUnder(workspacePath, 'runtime', stagedName, content);
 }
-/** Verify the host credential file exists and is readable. Used at startup validation. */
-export async function assertHostCredentialReadable(profile) {
-    const p = hostCredentialAbsPath(profile);
+/**
+ * Stage the host's claude identity into the workspace runtime tree. Reads
+ * `~/.claude.json`, extracts only the operator's `oauthAccount.accountUuid`
+ * and `oauthAccount.organizationUuid`, and writes a minimal JSON file at
+ * `<workspace>/.git/symphony-runtime/identity/claude.json` (or the
+ * `.symphony-runtime/` fallback when the workspace has no `.git/`). The
+ * in-VM claude-agent-acp reads these fields to compose a well-formed
+ * `metadata.user_id` on every upstream call so a future re-activation of
+ * Anthropic's server-side fingerprint check doesn't break dispatch.
+ *
+ * Defensive shape: NO token strings, NO `device_id`/`session_id` (those are
+ * per-process — the in-VM client mints fresh ones on first run), NO local
+ * config (prompt-history pointers, theme, recent paths). Identity only. See
+ * the `stageClaudeIdentity` test in tests/adapters.test.ts which greps the
+ * staged file for `accessToken`/`refreshToken` substrings.
+ *
+ * When `~/.claude.json` is missing or contains no `oauthAccount` we skip the
+ * staging (returning null) rather than fail the dispatch — the egress-substitution
+ * seam is defense in depth, not a hard gate on running.
+ */
+export async function stageClaudeIdentity(workspacePath) {
+    const src = path.join(homedir(), '.claude.json');
+    let raw;
     try {
-        await access(p, fsConstants.R_OK);
+        raw = await readFile(src, 'utf8');
     }
     catch (err) {
-        throw new Error(`adapter "${profile.id}" requires a host credential at ${p}, but it is missing or unreadable: ${err.message}`);
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
     }
+    catch {
+        return null;
+    }
+    const account = extractOauthAccountIdentity(parsed);
+    if (!account)
+        return null;
+    const content = JSON.stringify({ oauthAccount: account });
+    return stageNamedFileUnder(workspacePath, 'identity', 'claude.json', content);
 }
 /**
- * Copy the host's credential file into the workspace's runtime staging area, chmod 600.
- * Re-runs every attempt so a host-side token rotation is picked up automatically.
+ * Stage a FAKE placeholder `~/.codex/auth.json` into the workspace for the codex
+ * adapter. codex-acp's session-init credential check fails with "Authentication
+ * required" when no auth.json file exists, even though the placeholder bearer is
+ * supplied via the `OPENAI_API_KEY` env var (a live dispatch proved this — #116
+ * staged only the env). This file exists PURELY to satisfy that init check: it
+ * contains NO real credential — `OPENAI_API_KEY` is a token-shaped placeholder
+ * and there is no OAuth `tokens` block — so codex falls through to the env
+ * `OPENAI_API_KEY` (= the placeholder, which has precedence over the file) as its
+ * request bearer, and Gondolin substitutes the real OpenAI token at egress
+ * (TLS-MITM). No real token, and no refresh token, ever enters the VM.
  *
- * Defense layers, in order:
- *   1. `resolveStagingLocation` picks a path OUTSIDE the working tree when git is
- *      present (`.git/symphony-runtime/...`) so `git add -A`, a tracked file at
- *      `.symphony-runtime/`, or a `.gitignore` negation cannot expose the secret.
- *      Linked worktrees are refused (operator must override acp.command).
- *   2. `ensureRealDir` walks each parent we materialize and refuses if any exists
- *      as a symlink or non-directory.
- *   3. `rm + copyFile(COPYFILE_EXCL)` closes the local race on the leaf path:
- *      after explicit cleanup, the create is strict and fails if anything raced
- *      back in.
- *   4. Post-write `realpath` check confirms the file landed at the expected
- *      absolute path. On mismatch (a parent was swapped for a symlink between
- *      ensureRealDir and copyFile), we unlink the staging path itself — which
- *      removes a symlink without following it — and refuse. We deliberately do
- *      NOT touch whatever the symlink resolved to, since that file is by
- *      definition attacker-chosen.
+ * `auth_mode: 'apikey'` so codex takes the API-key path (the env placeholder),
+ * never an OAuth handshake. `last_refresh` is omitted (no OAuth tokens to age).
+ */
+export async function stageCodexPlaceholderAuth(workspacePath) {
+    const placeholder = JSON.stringify({
+        OPENAI_API_KEY: 'sk-symphony-placeholder',
+        auth_mode: 'apikey',
+    });
+    return stageNamedFileUnder(workspacePath, 'credential', 'auth.json', placeholder);
+}
+/**
+ * Pull just the identity fields out of the parsed `~/.claude.json`. Anything
+ * outside `accountUuid`/`organizationUuid` is dropped — see
+ * `stageClaudeIdentity`'s contract.
  */
-export async function stageCredential(workspacePath, profile) {
-    const src = hostCredentialAbsPath(profile);
+function extractOauthAccountIdentity(parsed) {
+    const acct = pickObjectField(parsed, 'oauthAccount');
+    if (!acct)
+        return null;
+    const accountUuid = pickStringField(acct, 'accountUuid');
+    const organizationUuid = pickStringField(acct, 'organizationUuid');
+    if (accountUuid === null || organizationUuid === null)
+        return null;
+    return { accountUuid, organizationUuid };
+}
+function pickObjectField(value, key) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const v = value[key];
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        return null;
+    return v;
+}
+function pickStringField(obj, key) {
+    const v = obj[key];
+    if (typeof v !== 'string' || v.length === 0)
+        return null;
+    return v;
+}
+/**
+ * Shared implementation for the runtime/identity staging paths. Writes
+ * `content` into `<staging-root>/<subdir>/<stagedName>` (0600) with the same
+ * symlink/race defenses we previously used for the credential file: explicit
+ * cleanup of the leaf, exclusive create via `flag: 'wx'`, and a post-write
+ * `realpath` check to detect a symlink that raced into a parent between
+ * `ensureRealDir` and the write.
+ */
+async function stageNamedFileUnder(workspacePath, subdir, stagedName, content) {
+    if (!/^[A-Za-z0-9._-]+$/.test(stagedName)) {
+        throw new Error(`stageNamedFileUnder: stagedName ${JSON.stringify(stagedName)} contains characters outside ` +
+            `[A-Za-z0-9._-]; refuse to compose into the staging path.`);
+    }
     const { stagingRootAbs, stagingRootRel } = await resolveStagingLocation(workspacePath);
-    const credsDir = path.join(stagingRootAbs, 'credentials');
+    const subDir = path.join(stagingRootAbs, subdir);
     await ensureRealDir(stagingRootAbs);
-    await ensureRealDir(credsDir);
-    const dst = path.join(credsDir, profile.id);
+    await ensureRealDir(subDir);
+    const dst = path.join(subDir, stagedName);
     await rm(dst, { force: true, recursive: false });
-    await copyFile(src, dst, fsConstants.COPYFILE_EXCL);
-    await chmod(dst, 0o600);
-    const expectedReal = path.join(await realpath(workspacePath), stagingRootRel, 'credentials', profile.id);
+    await writeFile(dst, content, { mode: 0o600, flag: 'wx' });
+    const expectedReal = path.join(await realpath(workspacePath), stagingRootRel, subdir, stagedName);
     const actualReal = await realpath(dst);
     if (actualReal !== expectedReal) {
-        // Unlinking dst removes the symlink itself (does not follow). Leaked
-        // credential at actualReal is left in place because we cannot prove
-        // ownership; operator must inspect.
         await rm(dst, { force: true }).catch(() => undefined);
         throw new Error(`staging path redirected: wrote to ${actualReal}, expected ${expectedReal}. ` +
             `A symlink raced in during staging; manually inspect and remove any leaked ` +
-            `credential at the actual path before retrying.`);
+            `file at the actual path before retrying.`);
     }
-    const relPath = path.posix.join(stagingRootRel, 'credentials', profile.id);
+    const relPath = path.posix.join(stagingRootRel, subdir, stagedName);
     return { absPath: dst, relPath };
 }
 /**
- * Decide where to stage credentials based on workspace shape. See StagedCredentialPaths
- * for the policy. Returns absolute + relative (POSIX, relative to workspacePath)
- * paths to the staging root directory; the caller composes `credentials/<id>` under it.
+ * Decide where to stage runtime files based on workspace shape. See
+ * StagedRuntimePaths for the policy. Returns absolute + relative (POSIX,
+ * relative to workspacePath) paths to the staging root directory; the caller
+ * composes `<subdir>/<name>` under it.
  */
 async function resolveStagingLocation(workspacePath) {
     const gitPath = path.join(workspacePath, '.git');
@@ -120,8 +340,8 @@ async function resolveStagingLocation(workspacePath) {
             // repository discovery walks up the directory tree, so a workspace at e.g.
             // `<parent>/.symphony/workspaces/X` with no own `.git` ends up inside
             // `<parent>/.git`. A `git add -A` (from a host-side hook, or from any
-            // process with the host filesystem visible) would then stage the
-            // credential in the parent's index. Detect that and refuse.
+            // process with the host filesystem visible) would then stage the file in
+            // the parent's index. Detect that and refuse.
             //
             // Resolve symlinks first: git's discovery follows the resolved path, so
             // walking the lexical `workspacePath` would miss an ancestor `.git` that
@@ -134,15 +354,15 @@ async function resolveStagingLocation(workspacePath) {
                 resolvedWorkspace = await realpath(workspacePath);
             }
             catch (resolveErr) {
-                throw new Error(`cannot auto-stage credentials: workspace ${workspacePath} could not be resolved ` +
+                throw new Error(`cannot auto-stage runtime files: workspace ${workspacePath} could not be resolved ` +
                     `(realpath failed: ${resolveErr.message}). Refusing to stage without a ` +
-                    `canonical path; fix the workspace or set acp.command explicitly.`);
+                    `canonical path; fix the workspace.`);
             }
             const ancestor = await findAncestorGit(resolvedWorkspace);
             if (ancestor !== null) {
-                throw new Error(`cannot auto-stage credentials: workspace ${workspacePath} has no .git of its own ` +
-                    `but is inside an ancestor git repo at ${ancestor}. Either create a nested clone ` +
-                    `(e.g. via hooks.after_create) or set acp.command explicitly.`);
+                throw new Error(`cannot auto-stage runtime files: workspace ${workspacePath} has no .git of its own ` +
+                    `but is inside an ancestor git repo at ${ancestor}. The canonical workspace setup ` +
+                    `clones each issue into its own repo; ensure the workspace is a nested clone.`);
             }
             return {
                 stagingRootAbs: path.join(workspacePath, '.symphony-runtime'),
@@ -153,9 +373,9 @@ async function resolveStagingLocation(workspacePath) {
     }
     if (gitSt.isDirectory()) {
         // Normal clone: stage inside `.git/`, which is outside the working tree.
-        // Git never recurses into `.git/` for `add`/`status`, so the credential is
+        // Git never recurses into `.git/` for `add`/`status`, so the file is
         // structurally untrackable — no `info/exclude` games needed, and a tracked
-        // `.symphony-runtime/credentials/<id>` at workspace root cannot interfere.
+        // `.symphony-runtime/...` at workspace root cannot interfere.
         return {
             stagingRootAbs: path.join(workspacePath, '.git', 'symphony-runtime'),
             stagingRootRel: path.posix.join('.git', 'symphony-runtime'),
@@ -164,16 +384,18 @@ async function resolveStagingLocation(workspacePath) {
     if (gitSt.isFile()) {
         // Linked worktree: .git is a pointer file at /<worktree>/.git -> per-worktree
         // gitdir (typically /<main>/.git/worktrees/<name>/). The per-worktree gitdir
-        // lives outside the workspace mount, so symphony cannot place the credential
+        // lives outside the workspace mount, so symphony cannot place the file
         // there and still have the in-VM agent reach it. Any worktree-internal path
         // is inside the working tree, where `.gitignore` negation or a tracked file
-        // could still expose the secret to `git add -A`. Refuse loudly; operators
-        // who need a worktree workspace must set acp.command and manage credentials
-        // themselves.
-        throw new Error(`cannot auto-stage credentials in a linked worktree (.git at ${gitPath} is a file). ` +
-            `Set acp.command explicitly and manage credentials in that command.`);
+        // could still expose state to `git add -A`. Linked worktrees are
+        // currently unsupported — use a non-linked workspace clone (e.g.
+        // `git clone --local`) or fork scripts/vm-agent.mjs to stage runtime
+        // files in whatever shape your worktree layout needs.
+        throw new Error(`cannot auto-stage runtime files in a linked worktree (.git at ${gitPath} is a file). ` +
+            `Linked worktrees are unsupported under the ACP TCP bridge transport; use a ` +
+            `non-linked workspace clone or fork scripts/vm-agent.mjs.`);
     }
-    throw new Error(`cannot auto-stage credentials: ${gitPath} is neither a directory nor a file ` +
+    throw new Error(`cannot auto-stage runtime files: ${gitPath} is neither a directory nor a file ` +
         `(symlink, device, or other unexpected entry).`);
 }
 /**
@@ -242,28 +464,42 @@ async function ensureRealDir(p) {
     }
 }
 /**
- * Build the bash command symphony will exec inside the VM. Copies the staged credential
- * (located at `stagedRelPath`, a POSIX path relative to the in-VM cwd which equals the
- * workspace mount) to the adapter's expected location, chmods it, and exec's the
- * adapter binary.
+ * Build the bash command symphony will exec inside the VM. For each staged
+ * extra file: `mkdir -p` the destination directory, `cp` the file into place,
+ * `chmod 600`. Then exec the in-VM agent at `/opt/symphony/vm-agent.mjs`. It
+ * reads its config — SYMPHONY_ACP_URL, SYMPHONY_ACP_TOKEN,
+ * SYMPHONY_ADAPTER_BIN, SYMPHONY_ADAPTER_ARGS — from the environment that
+ * symphony sets on the in-VM exec invocation, dials the host's TCP ACP
+ * bridge, and spawns the adapter with kernel pipes.
  *
- * Every interpolated value (binary tokens, paths) is run through shQuote so future
- * profiles with spaces or metacharacters compose safely. `stagedRelPath` comes from
- * `stageCredential`, which picks a path outside the working tree when git is present.
+ * Why TCP through the in-VM agent: the in-VM exec stdin pump does not reliably
+ * wake the in-VM reader for kernel events unless host stdin keeps writing. Piping
+ * ACP frames through the in-VM exec stdio caused the adapter to hang after the
+ * first session/update. The TCP bridge (see src/acp-bridge.ts) bypasses that pump
+ * entirely and decouples symphony from any specific sandbox tech — any sandbox
+ * that can launch a process with env vars and reach the host loopback can run
+ * this stack unchanged.
+ *
+ * No real credential enters the VM: the guest holds only a token-shaped
+ * placeholder (staged as fake native creds + env), and Gondolin substitutes the
+ * real upstream token (Anthropic OAuth for claude, an OpenAI API key or
+ * ChatGPT-OAuth access token for codex, a minted GitHub Copilot token for
+ * opencode) into the outbound request at egress (TLS-MITM). See
+ * `credential-secrets.ts` / `gondolin-creds-staging.ts`.
  */
-export function deriveAcpCommand(profile, stagedRelPath) {
+export function deriveAcpCommand(profile, extraFiles = []) {
     if (profile.binary.length === 0) {
         throw new Error(`adapter "${profile.id}" has an empty binary launch vector`);
     }
-    const guestDir = path.posix.dirname(profile.guestCredentialPath);
-    const guestPath = profile.guestCredentialPath;
-    const execCmd = profile.binary.map(shQuote).join(' ');
-    return [
-        `mkdir -p ${shQuote(guestDir)}`,
-        `cp ${shQuote(stagedRelPath)} ${shQuote(guestPath)}`,
-        `chmod 600 ${shQuote(guestPath)}`,
-        `exec ${execCmd}`,
-    ].join(' && ');
+    const steps = [];
+    for (const f of extraFiles) {
+        const extraDir = path.posix.dirname(f.guestPath);
+        steps.push(`mkdir -p ${shQuote(extraDir)}`);
+        steps.push(`cp ${shQuote(f.stagedRelPath)} ${shQuote(f.guestPath)}`);
+        steps.push(`chmod 600 ${shQuote(f.guestPath)}`);
+    }
+    steps.push(`exec node /opt/symphony/vm-agent.mjs`);
+    return steps.join(' && ');
 }
 // Minimal POSIX-shell single-quoting. None of the paths we emit contain `'`, but be
 // defensive in case a future binary name or path changes.

package/dist/agent/adapters.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../../src/agent/adapters.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,oFAAoF;AACpF,0DAA0D;AAC1D,EAAE;AACF,uFAAuF;AACvF,mFAAmF;AACnF,qDAAqD;AACrD,qFAAqF;AACrF,mFAAmF;AACnF,2EAA2E;AAC3E,yEAAyE;AACzE,EAAE;AACF,qFAAqF;AACrF,oFAAoF;AACpF,uFAAuF;AACvF,yEAAyE;AACzE,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,0CAA0C;AAE1C,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAkBzB,MAAM,CAAC,MAAM,QAAQ,GAAyC;IAC5D,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,kBAAkB,EAAE,2BAA2B;QAC/C,mBAAmB,EAAE,iCAAiC;QACtD,MAAM,EAAE,CAAC,kBAAkB,CAAC;KAC7B;IACD,KAAK,EAAE;QACL,EAAE,EAAE,OAAO;QACX,kBAAkB,EAAE,kBAAkB;QACtC,mBAAmB,EAAE,wBAAwB;QAC7C,MAAM,EAAE,CAAC,WAAW,CAAC;KACtB;CACF,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,OAAO,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAgB;IACzC,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,OAAuB;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAC7D,CAAC;AA8BD,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAAuB;IACxE,MAAM,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,CAAC,EAAE,mCAAmC,CAAC,sCACvD,GAAa,CAAC,OACjB,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,OAAuB;IAEvB,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IAC1D,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC;IACpC,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAExB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,MAAM,QAAQ,CAAC,aAAa,CAAC,EAC7B,cAAc,EACd,aAAa,EACb,OAAO,CAAC,EAAE,CACX,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAChC,qEAAqE;QACrE,oEAAoE;QACpE,oCAAoC;QACpC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,qCAAqC,UAAU,cAAc,YAAY,IAAI;YAC3E,4EAA4E;YAC5E,gDAAgD,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAIzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,yEAAyE;YACzE,0EAA0E;YAC1E,2EAA2E;YAC3E,sEAAsE;YACtE,sEAAsE;YACtE,iEAAiE;YACjE,4DAA4D;YAC5D,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,oEAAoE;YACpE,iEAAiE;YACjE,IAAI,iBAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,iBAAiB,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,4CAA4C,aAAa,yBAAyB;oBAChF,qBAAsB,UAAoB,CAAC,OAAO,iCAAiC;oBACnF,kEAAkE,CACrE,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC,CAAC;YAC1D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,4CAA4C,aAAa,0BAA0B;oBACjF,yCAAyC,QAAQ,iCAAiC;oBAClF,8DAA8D,CACjE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC;gBAC7D,cAAc,EAAE,mBAAmB;aACpC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,kBAAkB,CAAC;YACpE,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,8EAA8E;QAC9E,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,cAAc;QACd,MAAM,IAAI,KAAK,CACb,+DAA+D,OAAO,eAAe;YACnF,oEAAoE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,kCAAkC,OAAO,qCAAqC;QAC5E,+CAA+C,CAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,eAAe,CAAC,aAAqB;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC;IAC5C,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,OAAO,OAAO,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,OAAO;YAAE,MAAM;QAC5B,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,CAAS;IACpC,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAuB,EAAE,aAAqB;IAC7E,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,YAAY,OAAO,CAAC,EAAE,qCAAqC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,OAAO;QACL,YAAY,OAAO,CAAC,QAAQ,CAAC,EAAE;QAC/B,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE;QACpD,aAAa,OAAO,CAAC,SAAS,CAAC,EAAE;QACjC,QAAQ,OAAO,EAAE;KAClB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,0DAA0D;AAC1D,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC"}
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../../src/agent/adapters.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,iBAAiB;AACjB,EAAE;AACF,gFAAgF;AAChF,yCAAyC;AAEzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAqB,MAAM,oBAAoB,CAAC;AAEvE,+EAA+E;AAC/E,4EAA4E;AAC5E,0DAA0D;AAC1D,OAAO,EAAE,cAAc,EAAqB,CAAC;AA+D7C,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,0EAA0E;AAC1E,gDAAgD;AAChD,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAC9D,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAExD,MAAM,CAAC,MAAM,QAAQ,GAAyC;IAC5D,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,MAAM,EAAE,CAAC,kBAAkB,CAAC;QAC5B,yEAAyE;QACzE,6EAA6E;QAC7E,kEAAkE;QAClE,0FAA0F;QAC1F,iFAAiF;QACjF,mFAAmF;QACnF,0CAA0C;QAC1C,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC;QAChE,yEAAyE;QACzE,6FAA6F;QAC7F,2FAA2F;QAC3F,0FAA0F;QAC1F,gGAAgG;QAChG,gGAAgG;QAChG,4FAA4F;QAC5F,kDAAkD;QAClD,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5B,WAAW,EAAE;gBACX;oBACE,UAAU,EAAE,sBAAsB;oBAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;oBAChD,SAAS,EAAE,6BAA6B;iBACzC;aACF;SACF,CAAC;KACH;IACD,KAAK,EAAE;QACL,EAAE,EAAE,OAAO;QACX,MAAM,EAAE,CAAC,WAAW,CAAC;QACrB,8EAA8E;QAC9E,uEAAuE;QACvE,yEAAyE;QACzE,+DAA+D;QAC/D,2EAA2E;QAC3E,6EAA6E;QAC7E,4CAA4C;QAC5C,oFAAoF;QACpF,iFAAiF;QACjF,yEAAyE;QACzE,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACpF,+EAA+E;QAC/E,4EAA4E;QAC5E,4EAA4E;QAC5E,gFAAgF;QAChF,yEAAyE;QACzE,+EAA+E;QAC/E,8EAA8E;QAC9E,iEAAiE;QACjE,iFAAiF;QACjF,yEAAyE;QACzE,6EAA6E;QAC7E,oEAAoE;QACpE,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,+EAA+E;QAC/E,0CAA0C;KAC3C;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;QAC3B,oEAAoE;QACpE,qEAAqE;QACrE,8EAA8E;QAC9E,wEAAwE;QACxE,4EAA4E;QAC5E,8CAA8C;QAC9C,6EAA6E;QAC7E,wEAAwE;QACxE,6EAA6E;QAC7E,0CAA0C;QAC1C,mDAAmD;QACnD,qEAAqE;QACrE,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,sDAAsD;QACtD,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;KAC3B;CACF,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,QAAQ,CAAC;AAEvD,gFAAgF;AAChF,yEAAyE;AACzE,iFAAiF;AACjF,2EAA2E;AAC3E,0EAA0E;AAC1E,gFAAgF;AAChF,kBAAkB;AAClB,MAAM,8BAA8B,GAAsB;IACxD,QAAQ;IACR,SAAS;IACT,SAAS;IACT,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;CACjB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAoB;IACtD,MAAM,QAAQ,GAAG,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,8BAA8B,CAAC;IACpF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,8BAA8B,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAA0C,EAAE,CAAC;IACzD,KAAK,MAAM,EAAE,IAAI,GAAG;QAAE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;IACtC,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,OAAO,EAAE,iCAAiC;QAC1C,QAAQ,EAAE;YACR,CAAC,0BAA0B,CAAC,EAAE;gBAC5B,GAAG,EAAE,2BAA2B;gBAChC,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE;oBACP,OAAO,EAAE,QAAQ,2BAA2B,GAAG;oBAC/C,MAAM,EAAE,QAAQ,wBAAwB,GAAG;iBAC5C;gBACD,MAAM;aACP;SACF;QACD,KAAK,EAAE,GAAG,0BAA0B,IAAI,QAAQ,EAAE;KACnD,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sCAAsC,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAAqB,EACrB,KAAoB;IAEpB,OAAO,gBAAgB,CAAC,aAAa,EAAE,eAAe,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAgB;IACzC,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAgCD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,UAAkB,EAClB,OAAe;IAEf,OAAO,mBAAmB,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,OAAO,mBAAmB,CAAC,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,aAAqB;IAErB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,cAAc,EAAE,yBAAyB;QACzC,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IACH,OAAO,mBAAmB,CAAC,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,SAAS,2BAA2B,CAClC,MAAe;IAEf,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACnE,IAAI,WAAW,KAAK,IAAI,IAAI,gBAAgB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,GAAW;IAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,CAAC,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,CAA4B,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B,EAAE,GAAW;IAChE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,mBAAmB,CAChC,aAAqB,EACrB,MAA6C,EAC7C,UAAkB,EAClB,OAAe;IAEf,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,+BAA+B;YAC1F,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC;IACpC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAChC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,qCAAqC,UAAU,cAAc,YAAY,IAAI;YAC3E,4EAA4E;YAC5E,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAIzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,yEAAyE;YACzE,0EAA0E;YAC1E,2EAA2E;YAC3E,sEAAsE;YACtE,sEAAsE;YACtE,yEAAyE;YACzE,8CAA8C;YAC9C,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,oEAAoE;YACpE,iEAAiE;YACjE,IAAI,iBAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,iBAAiB,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,8CAA8C,aAAa,yBAAyB;oBAClF,qBAAsB,UAAoB,CAAC,OAAO,iCAAiC;oBACnF,oCAAoC,CACvC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC,CAAC;YAC1D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,8CAA8C,aAAa,0BAA0B;oBACnF,yCAAyC,QAAQ,kCAAkC;oBACnF,8EAA8E,CACjF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC;gBAC7D,cAAc,EAAE,mBAAmB;aACpC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,yEAAyE;QACzE,qEAAqE;QACrE,2EAA2E;QAC3E,8DAA8D;QAC9D,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,kBAAkB,CAAC;YACpE,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,8EAA8E;QAC9E,6EAA6E;QAC7E,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,iEAAiE;QACjE,iEAAiE;QACjE,qEAAqE;QACrE,sDAAsD;QACtD,MAAM,IAAI,KAAK,CACb,iEAAiE,OAAO,eAAe;YACrF,6EAA6E;YAC7E,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,oCAAoC,OAAO,qCAAqC;QAC9E,+CAA+C,CAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,eAAe,CAAC,aAAqB;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC;IAC5C,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,OAAO,OAAO,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,OAAO;YAAE,MAAM;QAC5B,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,CAAS;IACpC,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAuB,EACvB,aAAwC,EAAE;IAE1C,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,YAAY,OAAO,CAAC,EAAE,qCAAqC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,oFAAoF;AACpF,0DAA0D;AAC1D,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC"}