smol-symphony 0.2.0 → 0.3.0

package/dist/src/core/schedule/token-fold.js

@@ -0,0 +1,181 @@
+// FCIS rewrite — pure token-usage / runtime-event / tool-call-lifecycle folds.
+//
+// Ported faithfully from the original orchestrator (`reportTokenUsage`,
+// `reportRuntimeEvent`, `reportTurnStarted`, the `detectStalls` in-flight guard)
+// and `src/agent/tool-call-summary.ts:toolCallLifecycle`. The original mutated
+// the live `RunningEntry` map and the aggregate `SessionTotals` in place; here
+// every fold is a pure, SYNCHRONOUS `(data) -> data` returning the next state
+// (and, for the token fold, the per-report delta so the shell can add it into
+// the aggregate SessionTotals). No clock, no randomness, no IO, no Effects —
+// these are in-memory state folds, not side effects. Imports are restricted to
+// src/types.
+//
+// Three responsibilities, one per concern in the original:
+//   1. foldTokenUsage  — absolute totals → session deltas (no double counting).
+//   2. foldRuntimeEvent — append into the recent_events ring + last_event/at.
+//   3. tool-call lifecycle — active-tool-call set updates + stall-reaper guard.
+// ─── 1. Token-usage delta accounting ─────────────────────────────────────────
+/**
+ * Cap on the recent-events ring buffer. The original kept the last 50 events
+ * (`if (e.recent_events.length > 50) e.recent_events.shift()`).
+ */
+export const RECENT_EVENTS_CAP = 50;
+/**
+ * §9.4 token accounting: prefer the adapter's ABSOLUTE running totals, but only
+ * add the per-report DELTA into the aggregate so re-reported totals are not
+ * double counted.
+ *
+ * Mirrors the original `reportTokenUsage`:
+ *   - `dX = max(0, usage.X - last_reported_X)` (clamped at 0 — a regression /
+ *     reset in the absolute counter never SUBTRACTS from the aggregate),
+ *   - the entry's visible totals become the new absolute values,
+ *   - the baselines advance to the new absolute values.
+ *
+ * Pure: takes the prior baselines + the new reading, returns the TokenDelta the
+ * shell folds. The shell adds `*_delta` into the aggregate SessionTotals (see
+ * `addDeltaToTotals`) and stores the new `last_reported_*` + absolute totals on
+ * the running entry.
+ */
+export function foldTokenUsage(prior, usage) {
+    const input_delta = Math.max(0, usage.input_tokens - prior.last_reported_input);
+    const output_delta = Math.max(0, usage.output_tokens - prior.last_reported_output);
+    const total_delta = Math.max(0, usage.total_tokens - prior.last_reported_total);
+    return {
+        input_delta,
+        output_delta,
+        total_delta,
+        last_reported_input: usage.input_tokens,
+        last_reported_output: usage.output_tokens,
+        last_reported_total: usage.total_tokens,
+    };
+}
+/**
+ * Add a TokenDelta into the aggregate SessionTotals (no double counting — the
+ * delta is already de-duplicated by `foldTokenUsage`). `seconds_running` is
+ * carried through unchanged; it is accrued elsewhere (on attempt exit). Returns
+ * a new SessionTotals; does not mutate the input.
+ */
+export function addDeltaToTotals(totals, delta) {
+    return {
+        input_tokens: totals.input_tokens + delta.input_delta,
+        output_tokens: totals.output_tokens + delta.output_delta,
+        total_tokens: totals.total_tokens + delta.total_delta,
+        seconds_running: totals.seconds_running,
+    };
+}
+/**
+ * Fold one RuntimeEvent into a running entry's event slice. Mirrors the
+ * original `reportRuntimeEvent` (minus the live tool-call-set mutation, which is
+ * a separate concern handled by `foldToolCall`): updates `last_event` /
+ * `last_event_at` / `last_message` and pushes onto the recent-events ring,
+ * trimming the OLDEST when it exceeds `RECENT_EVENTS_CAP`.
+ *
+ * Pure: returns a new RuntimeEventState (and a fresh `recent_events` array); the
+ * input is not mutated.
+ */
+export function foldRuntimeEvent(state, ev) {
+    const recent_events = [...state.recent_events, ev];
+    while (recent_events.length > RECENT_EVENTS_CAP)
+        recent_events.shift();
+    return {
+        last_event: ev.event,
+        last_event_at: ev.at,
+        last_message: ev.message,
+        recent_events,
+    };
+}
+// ─── 3. Active-tool-call lifecycle / stall-reaper suppression ─────────────────
+/**
+ * Map an ACP tool notification to its effect on the in-flight tool-call set.
+ * Ported verbatim from `src/agent/tool-call-summary.ts:toolCallLifecycle`.
+ *
+ * ACP `ToolCallStatus` is `pending | in_progress | completed | failed`;
+ * `completed` / `failed` are terminal. A `tool_call` STARTS a tool (in-flight)
+ * unless it already carries a terminal status. A `tool_call_update` acts ONLY on
+ * a known status: terminal → ended, pending / in_progress → in-flight; an
+ * omitted / null / unknown status is a content-or-title-only delta and must NOT
+ * mutate the set (returns `undefined` = "no change").
+ */
+export function toolCallLifecycle(event, status) {
+    const terminal = status === 'completed' || status === 'failed';
+    if (event === 'tool_call')
+        return { ended: terminal };
+    if (terminal)
+        return { ended: true };
+    if (status === 'pending' || status === 'in_progress')
+        return { ended: false };
+    return undefined;
+}
+/**
+ * Apply a tool-call lifecycle delta to the in-flight set. Mirrors the original
+ * `reportRuntimeEvent` tool branch: a non-terminal delta ADDS the id (in
+ * flight), a terminal delta DELETES it (ended). The set is modeled as a sorted,
+ * de-duplicated array of ids so core stays free of live `Set` handles and the
+ * result is deterministic. Pure: returns a new array; the input is not mutated.
+ *
+ * Pass `undefined` (the "no change" case from `toolCallLifecycle`) and the set
+ * is returned unchanged. An empty `id` is ignored (matches the original guard
+ * `if (ev.tool && ev.tool.id)`).
+ */
+export function applyToolDelta(active, delta) {
+    if (!delta || !delta.id)
+        return [...active];
+    if (delta.ended)
+        return active.filter((id) => id !== delta.id);
+    if (active.includes(delta.id))
+        return [...active];
+    return [...active, delta.id].sort();
+}
+/**
+ * Turn-boundary reset of the in-flight set. Mirrors the original
+ * `reportTurnStarted`, which `e.active_tool_calls.clear()`s at every turn
+ * boundary: the prior turn's `session/prompt` has resolved, so no tool call from
+ * it can still be in flight. Clearing here backstops a leaked terminal
+ * `tool_call_update` so a stale id can't mask a real mid-turn stall (RCA
+ * 2026-06-02). Pure: always returns an empty set.
+ */
+export function clearToolCallsAtTurnBoundary() {
+    return [];
+}
+/**
+ * Whether the no-activity stall reaper should be SUPPRESSED for a running entry.
+ * Mirrors the two `continue` guards in the original `detectStalls`:
+ *   - `steeringRequested` — the agent is intentionally paused while the human
+ *     composes a reply, which can legitimately exceed `stall_timeout_ms`.
+ *   - `activeToolCallCount > 0` — a long silent tool (e.g. `… | tail`) produces
+ *     no ACP frames for its whole duration, so the no-activity timer would reap a
+ *     legitimately-busy agent merely blocked on the tool.
+ *
+ * The hard `prompt_timeout_ms` cap (a separate concern) backstops a tool that
+ * genuinely hangs, and operator/terminal cancel still applies regardless.
+ */
+export function shouldSuppressStallReaper(args) {
+    return args.steeringRequested || args.activeToolCallCount > 0;
+}
+/**
+ * Whether a running entry has stalled: the no-activity reaper fires when the
+ * timeout is positive, the entry is NOT suppressed, and the elapsed time since
+ * the last reference point (`last_event_at` ?? `started_at`) exceeds the
+ * timeout. Mirrors the body of the original `detectStalls` loop.
+ *
+ * The clock is INJECTED as `nowMs` (core never reads the wall clock).
+ * `lastReferenceMs` is the parsed `last_event_at ?? started_at` epoch ms (the
+ * shell parses the ISO timestamp; core stays free of `Date.parse`). A
+ * non-finite `lastReferenceMs` is treated as "cannot decide" → not stalled
+ * (matches the original `Number.isFinite(elapsed)` guard). Returns the elapsed
+ * ms when stalled so the shell can format the terminate reason
+ * (`stalled after <elapsed>ms`), or `null` when not stalled.
+ */
+export function detectStall(args) {
+    if (args.stallTimeoutMs <= 0)
+        return { stalled: false };
+    if (shouldSuppressStallReaper(args))
+        return { stalled: false };
+    const elapsed = args.nowMs - args.lastReferenceMs;
+    if (!Number.isFinite(elapsed))
+        return { stalled: false };
+    if (elapsed > args.stallTimeoutMs)
+        return { stalled: true, elapsedMs: elapsed };
+    return { stalled: false };
+}
+//# sourceMappingURL=token-fold.js.map

package/dist/src/core/schedule/token-fold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-fold.js","sourceRoot":"","sources":["../../../../src/core/schedule/token-fold.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,wEAAwE;AACxE,iFAAiF;AACjF,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,aAAa;AACb,EAAE;AACF,2DAA2D;AAC3D,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAKhF,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AASpC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,KAAqB,EAAE,KAAwB;IAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAChF,OAAO;QACL,WAAW;QACX,YAAY;QACZ,WAAW;QACX,mBAAmB,EAAE,KAAK,CAAC,YAAY;QACvC,oBAAoB,EAAE,KAAK,CAAC,aAAa;QACzC,mBAAmB,EAAE,KAAK,CAAC,YAAY;KACxC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB,EAAE,KAAiB;IACvE,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW;QACrD,aAAa,EAAE,MAAM,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY;QACxD,YAAY,EAAE,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW;QACrD,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC;AACJ,CAAC;AAYD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB,EAAE,EAAgB;IACzE,MAAM,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,aAAa,CAAC,MAAM,GAAG,iBAAiB;QAAE,aAAa,CAAC,KAAK,EAAE,CAAC;IACvE,OAAO;QACL,UAAU,EAAE,EAAE,CAAC,KAAK;QACpB,aAAa,EAAE,EAAE,CAAC,EAAE;QACpB,YAAY,EAAE,EAAE,CAAC,OAAO;QACxB,aAAa;KACd,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAuC,EACvC,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,QAAQ,CAAC;IAC/D,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACtD,IAAI,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAyB,EACzB,KAAiD;IAEjD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAGzC;IACC,OAAO,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,IAM3B;IACC,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACxD,IAAI,yBAAyB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzD,IAAI,OAAO,GAAG,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}

package/dist/src/core/state-resolve.js

@@ -0,0 +1,86 @@
+// FCIS rewrite — the ONE canonical case-insensitive declared-state-name resolver.
+//
+// Functional core: pure, synchronous (data) -> data. No IO, no clock, no
+// randomness, no node: imports. Imports ONLY from src/types.
+//
+// Collapses what used to be FIVE byte-equivalent copies of the same
+// case-insensitive declared-name lookup (the original spread it across
+// src/issues.ts, src/agent/runner.ts, and src/mcp.ts):
+//   - core/states.ts:resolveStateKey            (deleted — orphan module)
+//   - core/runner/dispatch-config.ts:resolveStateKey (re-points here)
+//   - core/mcp/url.ts:canonicalStateName        (re-points here)
+//   - core/mcp/dispatch.ts:canonicalStateName    (re-points to resolveDeclaredName)
+//   - core/schedule/eligibility.ts:canonicalStateKey (re-points here)
+//   - inlined in core/workflow/derive.ts:resolveActionsForState (re-points here)
+//
+// Resolution contract (ported verbatim from every copy): an exact own-property
+// match wins; failing that, a case-insensitive scan over the declared keys in
+// declaration order (first match wins). Matches the rest of symphony, where
+// eligibility, reconciliation, and the local-tracker directories all compare
+// lowercase, so a workflow that declares `Todo` and a tracker file living under
+// `todo/` still resolves correctly.
+/**
+ * Resolve `name` to its canonical declared form given the declared names in
+ * declaration order. Exact match wins; otherwise a case-insensitive scan
+ * (first match in declaration order). Returns null when no declared name
+ * matches.
+ *
+ * This is the shape-agnostic core: callers that hold a `Record<string,
+ * StateConfig>` use {@link resolveStateKey}; callers that hold a precomputed
+ * declared-name list (e.g. the MCP `McpStatesView.order`) call this directly.
+ */
+export function resolveDeclaredName(order, name) {
+    for (const declared of order) {
+        if (declared === name)
+            return declared;
+    }
+    const lower = name.toLowerCase();
+    for (const declared of order) {
+        if (declared.toLowerCase() === lower)
+            return declared;
+    }
+    return null;
+}
+/**
+ * Resolve a (possibly differently-cased) state name to its canonical declared
+ * key in `states`, or null when no state matches. Thin wrapper over
+ * {@link resolveDeclaredName} keyed by `Object.keys(states)` (which is the
+ * declaration order). An exact own-property hit short-circuits the scan.
+ */
+export function resolveStateKey(states, state) {
+    if (Object.prototype.hasOwnProperty.call(states, state))
+        return state;
+    const lower = state.toLowerCase();
+    for (const name of Object.keys(states)) {
+        if (name.toLowerCase() === lower)
+            return name;
+    }
+    return null;
+}
+/**
+ * Is moving `fromState -> toState` *in-flow* given the from-state's
+ * `allowed_transitions`? The ONE definition shared by the agent's hard gate
+ * (`decideTransition`, src/core/mcp/dispatch.ts — it rejects an off-flow move
+ * with `transition_not_allowed`) and the operator's soft warning
+ * (`decideMoveTransition`, src/core/http/decisions.ts — it merely flags
+ * `off_flow` and lets the move through). Factoring it here keeps the two from
+ * drifting (issue 126).
+ *
+ * A move is in-flow when ANY of:
+ *   - it is a self-transition (case-insensitive `from === to`) — always a no-op;
+ *   - the from-state's `allowed_transitions` is null/undefined — the open
+ *     default ("any declared state is reachable");
+ *   - the target is a member of a non-null `allowed_transitions` list
+ *     (case-insensitive).
+ * It is OFF-flow only when the list is non-null and does not include the target.
+ * An empty list (`[]`) therefore makes every non-self target off-flow.
+ */
+export function isInFlowTransition(allowedTransitions, fromState, toState) {
+    if (fromState.toLowerCase() === toState.toLowerCase())
+        return true;
+    if (allowedTransitions == null)
+        return true;
+    const wanted = toState.toLowerCase();
+    return allowedTransitions.some((s) => s.toLowerCase() === wanted);
+}
+//# sourceMappingURL=state-resolve.js.map

package/dist/src/core/state-resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-resolve.js","sourceRoot":"","sources":["../../../src/core/state-resolve.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAC7D,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,uDAAuD;AACvD,0EAA0E;AAC1E,sEAAsE;AACtE,iEAAiE;AACjE,oFAAoF;AACpF,sEAAsE;AACtE,iFAAiF;AACjF,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,oCAAoC;AAIpC;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAwB,EAAE,IAAY;IACxE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC;IACzC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAmC,EACnC,KAAa;IAEb,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAChC,kBAAwD,EACxD,SAAiB,EACjB,OAAe;IAEf,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,kBAAkB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;AACpE,CAAC"}

package/dist/src/core/vm-guards.js

@@ -0,0 +1,278 @@
+// FCIS rewrite — pure VM safety guards (the *teeth* of the host-only-refresh
+// invariant). These are the createVm-options-building checks the Gondolin
+// dispatch path runs so the guest is enforced-by-construction to hold only
+// placeholders: real refresh / durable tokens never leave the host.
+//
+// 100% PURE + SYNCHRONOUS. No IO, no node: imports, no clock/randomness. POSIX
+// path normalization is done LEXICALLY and inline (the original leaned on
+// `node:path` + an injected `fs.realpath`; core may import neither). The lexical
+// denylist check is *more conservative* than a symlink-resolving one — it cannot
+// be widened by a symlink that resolves out of a denied dir, and a non-existent
+// path can't be mounted anyway.
+//
+// The reference's `realpath` symlink-resolution (codex HIGH) is IO and lives in
+// the shell: the shell canonicalizes the mount source through `fs.realpathSync`
+// and passes BOTH the lexical and resolved forms through assertNoCredentialMounts.
+// This pure core does only the lexical check by design.
+import { CredentialMountError } from '../types/errors.js';
+import { joinPosix } from './path.js';
+// The synthetic guest↔host control-plane vocabulary lives canonically in
+// core/mcp/url.ts (the dedicated MCP/ACP URL module); only MCP_GUEST_BASE_URL is
+// used locally (by guestMcpBaseUrl below) — the rest is re-exported, see the
+// "ACP / MCP guest control-plane URL derivation" section at the bottom.
+import { MCP_GUEST_BASE_URL } from './mcp/url.js';
+// ---------------------------------------------------------------------------
+// Lexical POSIX path helpers. `joinPosix` is the canonical one from core/path.ts
+// (this module's old copy lacked the empty-base/absolute-rel handling that the
+// canonical adopts — behaviour-identical for every call here, which only ever
+// passes a non-empty base + a relative rel). `resolvePosix` (with `.`/`..`
+// collapse) stays local — it is a stronger, security-load-bearing canonicalizer.
+// ---------------------------------------------------------------------------
+const SEP = '/';
+/**
+ * Lexically resolve an absolute POSIX path, collapsing `.` / `..` and
+ * duplicate separators WITHOUT touching the filesystem. A relative input is
+ * resolved against `base` (default the POSIX root `/`), mirroring how the
+ * original relied on `path.resolve` to absolutize a relative mount source. We do
+ * not consult cwd (that would be ambient state); the shell passes absolute mount
+ * sources, and `base` is supplied explicitly for any relative input.
+ */
+function resolvePosix(input, base = SEP) {
+    // Normalize Windows-style separators defensively, then anchor.
+    const raw = input.replace(/\\/g, SEP);
+    const anchored = raw.startsWith(SEP) ? raw : joinPosix(base, raw);
+    const out = [];
+    for (const part of anchored.split(SEP)) {
+        if (part === '' || part === '.')
+            continue;
+        if (part === '..') {
+            if (out.length > 0)
+                out.pop();
+            continue;
+        }
+        out.push(part);
+    }
+    return SEP + out.join(SEP);
+}
+/**
+ * Lexically canonicalize a host path WITHOUT touching the filesystem: expand a
+ * leading `~` / `~/…` against `homeDir`, then lexically resolve (collapse
+ * `.`/`..`, make absolute). Mirrors the reference's `canonicalizeHostPath` but
+ * uses inline POSIX logic instead of `node:path` so it stays importable from the
+ * functional core. We deliberately do NOT `fs.realpath` — the path need not
+ * exist, and a symlink-following resolve is IO + a TOCTOU surface; the deny check
+ * is a prefix test on the lexical canonical form, which is strictly more
+ * conservative.
+ */
+export function canonicalizeHostPath(hostPath, homeDir) {
+    let p = hostPath;
+    if (p === '~') {
+        p = homeDir;
+    }
+    else if (p.startsWith('~/') || p.startsWith('~\\')) {
+        p = joinPosix(homeDir, p.slice(2));
+    }
+    return resolvePosix(p, resolvePosix(homeDir));
+}
+/**
+ * True when `child` is `parent` or lies beneath it. Compares canonical absolute
+ * paths with a trailing-separator guard so `/home/u/.codexible` does not count as
+ * under `/home/u/.codex`.
+ */
+function isUnder(child, parent) {
+    if (child === parent)
+        return true;
+    const withSep = parent.endsWith(SEP) ? parent : parent + SEP;
+    return child.startsWith(withSep);
+}
+// ---------------------------------------------------------------------------
+// Credential-mount denylist guard.
+// ---------------------------------------------------------------------------
+/**
+ * Built-in credential directories/files, `~`-relative. `~/.claude` and `~/.codex`
+ * hold the adapter OAuth credentials; `~/.config`, `~/.ssh`, and `~/.symphony/oauth`
+ * round out the denylist.
+ */
+const BUILTIN_CRED_RELATIVE = [
+    '.claude',
+    '.codex',
+    '.config',
+    '.ssh',
+    '.symphony/oauth',
+];
+/** Resolve the full denylist (built-ins + extras) to canonical absolute paths. */
+function resolveDenylist(homeDir, extra) {
+    const home = resolvePosix(homeDir);
+    const out = new Set();
+    for (const rel of BUILTIN_CRED_RELATIVE)
+        out.add(joinPosix(home, rel));
+    for (const e of extra)
+        out.add(canonicalizeHostPath(e, homeDir));
+    return [...out];
+}
+/** Throw if `candidate` is the home root or overlaps any denylist entry. */
+function assertCandidateAllowed(candidate, homeRoot, denylist) {
+    // The home root is always denied — mounting it exposes every credential dir at
+    // once, and a workspace legitimately lives *under* home so the root can't just
+    // go in the per-dir denylist.
+    if (candidate === homeRoot) {
+        throw new CredentialMountError(`refusing to mount the home directory root ${candidate} into a guest VM ` +
+            `(exposes every credential directory at once)`);
+    }
+    for (const denied of denylist) {
+        // Bidirectional overlap: reject if the mount is UNDER a credential dir, IS
+        // one, OR is an ANCESTOR that contains one (e.g. mounting `~/.symphony`
+        // exposes `~/.symphony/oauth`). Read-only sources are NOT exempt.
+        if (isUnder(candidate, denied) || isUnder(denied, candidate)) {
+            throw new CredentialMountError(`refusing to mount ${candidate} into a guest VM: it overlaps the credential ` +
+                `path ${denied} (mounting it, a parent of it, or a child of it all expose ` +
+                `the credential tree; read-only sources are NOT exempt)`);
+        }
+    }
+}
+/**
+ * HARD-FAIL if any mount's host path OVERLAPS a credential directory (the mount
+ * is under one, IS one, or is an ancestor that contains one) or is the home-dir
+ * root. Lexical-only (see module header). Read-only mounts are NOT exempt. Throws
+ * {@link CredentialMountError} on the first offender; returns void on success.
+ */
+export function assertNoCredentialMounts(mounts, opts) {
+    const homeRoot = resolvePosix(opts.homeDir);
+    const denylist = resolveDenylist(opts.homeDir, opts.extraDenylist ?? []);
+    for (const m of mounts) {
+        const candidate = canonicalizeHostPath(m.host, opts.homeDir);
+        assertCandidateAllowed(candidate, homeRoot, denylist);
+    }
+}
+// ---------------------------------------------------------------------------
+// assertContained — path-escape guard for workspace restore (critic gap).
+// ---------------------------------------------------------------------------
+/**
+ * HARD-FAIL if `target` escapes `root` after lexical normalization. The
+ * workspace-restore path materializes agent-named entries under a workspace root;
+ * an entry like `../../.ssh/authorized_keys` (or an absolute path) would write
+ * outside the sandbox. This guard rejects any `target` that does not resolve to
+ * `root` itself or a path strictly beneath it.
+ *
+ * `target` is resolved RELATIVE TO `root` (so a bare relative path is anchored at
+ * the workspace), but an absolute `target` resolves to itself and is rejected
+ * unless it already lies under `root`. Returns the canonical contained path on
+ * success; throws {@link CredentialMountError} on escape — reused as the typed
+ * sandbox-violation error (the closest existing boundary-violation class; no
+ * separate `PathEscapeError` exists in src/types).
+ */
+export function assertContained(root, target) {
+    const canonRoot = resolvePosix(root);
+    // An absolute target resolves to itself; a relative one anchors at the root.
+    const canonTarget = target.startsWith(SEP)
+        ? resolvePosix(target)
+        : resolvePosix(joinPosix(canonRoot, target));
+    if (!isUnder(canonTarget, canonRoot)) {
+        throw new CredentialMountError(`refusing to write ${canonTarget}: it escapes the workspace root ${canonRoot} ` +
+            `(path-traversal guard for workspace restore)`);
+    }
+    return canonTarget;
+}
+// ---------------------------------------------------------------------------
+// Credential env-var stripping.
+// ---------------------------------------------------------------------------
+/**
+ * Exact credential env-var names dropped regardless of the family-suffix rules.
+ * Covers each adapter's token var plus the GitHub durable-token vars.
+ */
+const NAMED_CREDENTIAL_VARS = new Set([
+    'ANTHROPIC_AUTH_TOKEN',
+    'ANTHROPIC_API_KEY',
+    'OPENAI_API_KEY',
+    'GITHUB_TOKEN',
+    'GH_TOKEN',
+]);
+/**
+ * Vendor name prefixes whose entire family is credential-bearing under the strict
+ * boot-env policy.
+ */
+const CREDENTIAL_NAME_PREFIXES = [
+    'ANTHROPIC_',
+    'OPENAI_',
+    'GITHUB_',
+    'GH_',
+];
+/** Secret-bearing name suffixes across any vendor (`*_API_KEY` / `*_TOKEN` / `*_SECRET`). */
+const CREDENTIAL_NAME_SUFFIXES = ['_API_KEY', '_TOKEN', '_SECRET'];
+/**
+ * True when a name is a *secret-bearing token* by the named-set or the
+ * `*_API_KEY`/`*_TOKEN`/`*_SECRET` suffix rule. Deliberately does NOT include the
+ * vendor *prefix* families — this is the strip applied to adapter-injected runtime
+ * env, which legitimately carries non-secret config like `ANTHROPIC_MODEL` /
+ * `OPENAI_BASE_URL`.
+ */
+export function isCredentialTokenName(name) {
+    const upper = name.toUpperCase();
+    if (NAMED_CREDENTIAL_VARS.has(upper))
+        return true;
+    for (const suffix of CREDENTIAL_NAME_SUFFIXES) {
+        if (upper.endsWith(suffix))
+            return true;
+    }
+    return false;
+}
+/**
+ * True when an env var name is credential-bearing under ANY rule: the named set,
+ * the vendor prefix families, or the secret suffix families. The strict boot-env policy.
+ */
+export function isCredentialEnvName(name) {
+    if (isCredentialTokenName(name))
+        return true;
+    const upper = name.toUpperCase();
+    for (const prefix of CREDENTIAL_NAME_PREFIXES) {
+        if (upper.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
+function stripBy(env, drop) {
+    const out = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (drop(k))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+/**
+ * Return a copy of `env` with every credential-bearing var removed (the strict
+ * boot-env policy — named set + vendor prefix families + secret suffixes). Use
+ * for the operator-forwarded boot env.
+ */
+export function stripCredentialEnv(env) {
+    return stripBy(env, isCredentialEnvName);
+}
+/**
+ * Return a copy of `env` with only secret-bearing TOKENS removed (named set +
+ * secret suffixes), preserving non-secret vendor-prefixed config like
+ * `ANTHROPIC_MODEL` / `OPENAI_BASE_URL`. Defense-in-depth for the adapter runtime env.
+ */
+export function stripCredentialTokenVars(env) {
+    return stripBy(env, isCredentialTokenName);
+}
+// ---------------------------------------------------------------------------
+// ACP / MCP guest control-plane URL derivation.
+// ---------------------------------------------------------------------------
+//
+// The synthetic guest↔host control-plane vocabulary (the `symphony-mcp:7001`
+// tunnel constants + the ACP-URL / tcp.hosts derivations) lives canonically in
+// core/mcp/url.ts — the dedicated MCP/ACP URL module. It is re-exported here so
+// vm-guards importers keep their `vm-guards.js` specifier WITHOUT a second
+// source of truth: a single home for MCP_GUEST_PORT / MCP_SYNTHETIC_HOST means a
+// port changed in one place can't silently desync the `tcp.hosts` rewire from
+// the URLs it's supposed to back. `guestMcpBaseUrl` is vm-guards-only (no
+// equivalent in url.ts) and stays defined here.
+export { MCP_SYNTHETIC_HOST, MCP_GUEST_PORT, MCP_GUEST_BASE_URL, ACP_WS_PATH, ACP_WS_GUEST_URL, acpWsUrlFromExplicit, guestAcpWsUrl, buildMcpTcpHostEntry, } from './mcp/url.js';
+/**
+ * The guest MCP base URL: the synthetic-tunnel base unless an explicit host URL
+ * is configured (in which case the guest reaches the orchestrator directly).
+ */
+export function guestMcpBaseUrl(mcp) {
+    return mcp.explicit_host_url ?? MCP_GUEST_BASE_URL;
+}
+//# sourceMappingURL=vm-guards.js.map

package/dist/src/core/vm-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vm-guards.js","sourceRoot":"","sources":["../../../src/core/vm-guards.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,oEAAoE;AACpE,EAAE;AACF,+EAA+E;AAC/E,0EAA0E;AAC1E,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,gCAAgC;AAChC,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,mFAAmF;AACnF,wDAAwD;AAGxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,yEAAyE;AACzE,iFAAiF;AACjF,6EAA6E;AAC7E,wEAAwE;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,8EAA8E;AAC9E,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,iFAAiF;AACjF,8EAA8E;AAE9E,MAAM,GAAG,GAAG,GAAG,CAAC;AAEhB;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,OAAe,GAAG;IACrD,+DAA+D;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAC1C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IACpE,IAAI,CAAC,GAAG,QAAQ,CAAC;IACjB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACd,CAAC,GAAG,OAAO,CAAC;IACd,CAAC;SAAM,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;IAC7D,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,qBAAqB,GAAsB;IAC/C,SAAS;IACT,QAAQ;IACR,SAAS;IACT,MAAM;IACN,iBAAiB;CAClB,CAAC;AAYF,kFAAkF;AAClF,SAAS,eAAe,CAAC,OAAe,EAAE,KAAwB;IAChE,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,qBAAqB;QAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,SAAS,sBAAsB,CAC7B,SAAiB,EACjB,QAAgB,EAChB,QAA2B;IAE3B,+EAA+E;IAC/E,+EAA+E;IAC/E,8BAA8B;IAC9B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,6CAA6C,SAAS,mBAAmB;YACvE,8CAA8C,CACjD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,2EAA2E;QAC3E,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,oBAAoB,CAC5B,qBAAqB,SAAS,+CAA+C;gBAC3E,QAAQ,MAAM,6DAA6D;gBAC3E,wDAAwD,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA0B,EAC1B,IAAiC;IAEjC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7D,sBAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc;IAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,6EAA6E;IAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QACxC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;QACtB,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,oBAAoB,CAC5B,qBAAqB,WAAW,mCAAmC,SAAS,GAAG;YAC7E,8CAA8C,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,sBAAsB;IACtB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,UAAU;CACX,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,wBAAwB,GAAsB;IAClD,YAAY;IACZ,SAAS;IACT,SAAS;IACT,KAAK;CACN,CAAC;AAEF,6FAA6F;AAC7F,MAAM,wBAAwB,GAAsB,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAEtF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CACd,GAA2B,EAC3B,IAA+B;IAE/B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QACtB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAA2B;IAC5D,OAAO,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAA2B;IAClE,OAAO,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAC9E,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,iFAAiF;AACjF,8EAA8E;AAC9E,0EAA0E;AAC1E,gDAAgD;AAEhD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAEtB;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAyC;IACvE,OAAO,GAAG,CAAC,iBAAiB,IAAI,kBAAkB,CAAC;AACrD,CAAC"}