smol-symphony 0.2.0 → 0.3.0

package/dist/tests/shell/credential-substrate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-substrate.test.js","sourceRoot":"","sources":["../../../tests/shell/credential-substrate.test.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,oFAAoF;AACpF,kFAAkF;AAClF,+CAA+C;AAC/C,gFAAgF;AAChF,mFAAmF;AACnF,2EAA2E;AAE3E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAK9E,oFAAoF;AACpF,OAAO,EACL,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,GACxD,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AACpG,OAAO,EACL,yCAAyC,EAAE,uBAAuB,EAAE,kBAAkB,GACvF,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AAEjF,MAAM,OAAO,GAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AAEpF,oEAAoE;AACpE,IAAI,GAAG,GAAG,CAAC,CAAC;AACZ,MAAM,WAAW,GAAiB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;AAEtE,MAAM,IAAI,GAAuB;IAC/B,IAAI,EAAE;QACJ,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB;QAC9E,oBAAoB;KACrB;IACD,yCAAyC;IACzC,uBAAuB;IACvB,sBAAsB;IACtB,kBAAkB;IAClB,kBAAkB;CACnB,CAAC;AAEF,SAAS,KAAK,CAAC,MAAoD,EAAE;IACnE,GAAG,GAAG,CAAC,CAAC;IACR,OAAO,wBAAwB,CAAC;QAC9B,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO;QAC1F,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO;KACxE,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,iBAAiB,GAAc;IACnC,WAAW,EAAE,sCAAsC;IACnD,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,gBAAgB,EAAE,sCAAsC;CACzD,CAAC;AAEF,IAAI,CAAC,8EAA8E,EAAE,GAAG,EAAE;IACxF,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAE5C,gEAAgE;IAChE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IAEtD,kFAAkF;IAClF,+EAA+E;IAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,cAAc,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU;QAC7E,cAAc,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI;KACjF,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAChF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAM,CAAC,OAAO,CAAqE,CAAC;IAC9G,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,kCAAkC;IACpG,4FAA4F;IAC5F,MAAM,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC1F,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAEzE,mFAAmF;IACnF,8EAA8E;IAC9E,MAAM,SAAS,GAAc,EAAE,WAAW,EAAE,0BAA0B,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC5F,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC;QACjC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC/E,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,KAAK,EAAE,SAAS;KACpG,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAEtE,kFAAkF;IAClF,kFAAkF;IAClF,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1F,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAC;IACrE,MAAM,CAAC,SAAS,CAAC,MAAO,CAAC,KAAK,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACvD,MAAM,CAAC,EAAE,CAAC,CAAC,MAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACzD,2EAA2E;IAC3E,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;IACpG,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC;QACjC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC9E,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,iBAAiB;KACnG,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACpI,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,SAAU,CAAC,GAAG,CAAC,CAAC;IAEnD,+EAA+E;IAC/E,kDAAkD;IAClD,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,OAAO,EAAE,kDAAkD,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,GAAc,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,8BAA8B,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;AAChG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uLAAuL,EAAE,KAAK,IAAI,EAAE;IACvM,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC;QACjC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC9E,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,YAAY,EAAE,CAAC,aAAa,EAAE,oBAAoB,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB;KAC5F,CAAC,CAAC;IACH,oFAAoF;IACpF,kFAAkF;IAClF,iFAAiF;IACjF,gFAAgF;IAChF,iFAAiF;IACjF,KAAK,MAAM,MAAM,IAAI;QACnB,wDAAwD;QACxD,oCAAoC;KACrC,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,SAAU,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,IAAI,GAAG,YAAY,OAAO,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;IACjG,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrF,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC;QACjC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC9E,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW;KAC7F,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,SAAU,CAAC,GAAG,CAAC,CAAC;IACnD,mFAAmF;IACnF,iFAAiF;IACjF,oEAAoE;IACpE,IAAI,GAAG,YAAY,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,KAAK,MAAM,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAU,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAqB,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACrH,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC;YACjC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;YAC9E,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK;SAC5F,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,OAAO,4BAA4B,CAAC,CAAC;QAC7F,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,OAAO,sBAAsB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC"}

package/dist/tests/shell/dockerfile-mise-pin.test.js

@@ -0,0 +1,51 @@
+// Guard test for the agent image's mise install (images/agents/Dockerfile.agents,
+// issue 209).
+//
+// LOAD-BEARING (issue 209 review): the base image must install mise from a PINNED,
+// checksum-verified artifact under repo control — NOT a live `curl https://mise.run | sh`
+// pipe that would run whatever installer + binary the endpoint serves at build time.
+// This test reads the tracked Dockerfile and asserts the install stays a download +
+// `sha256sum -c` against repo-pinned per-arch hashes, so a future edit can't silently
+// regress to an unchecked pipe-to-shell or drift the verified version away from its hash.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+const DOCKERFILE = fileURLToPath(new URL('../../images/agents/Dockerfile.agents', import.meta.url));
+const source = readFileSync(DOCKERFILE, 'utf8');
+// The build INSTRUCTIONS only (Dockerfile comments are full-line `#…`). The header
+// comments deliberately NAME the `curl https://mise.run | sh` anti-pattern to explain
+// what the install avoids, so the pipe-to-shell guard must inspect instructions, not prose.
+const instructions = source
+    .split('\n')
+    .filter((l) => !/^\s*#/.test(l))
+    .join('\n');
+// The repo-pinned mise version + per-arch tarball SHA-256s. These must match the
+// Dockerfile ARGs exactly; bumping mise is a conscious edit to BOTH the version and the
+// hashes (recomputed from the same registry tarball the build downloads — see the
+// Dockerfile comment). Keeping them here makes an accidental version/hash drift a test
+// failure rather than a build that verifies a stale or mismatched artifact.
+const PINNED_VERSION = '2026.4.16';
+const PINNED_SHA256 = {
+    amd64: '782fcbe718f0383c9a73483ab8fff6cbfd1106d0e1858617af24c038ca6c7c75',
+    arm64: '0c1ed86b847d4100f94aad88f1e5bf907984eda5eea705f6c1b1b385fbb5cdf2',
+};
+test('mise is NOT installed via a pipe-to-shell (no curl | sh, no mise.run)', () => {
+    assert.doesNotMatch(instructions, /mise\.run/, 'must not curl the mise.run installer (unpinned, served at build time)');
+    // No `... | sh` / `| bash` install pipe in any build instruction.
+    assert.doesNotMatch(instructions, /\|\s*(sh|bash)\b/, 'must not pipe a downloaded script into a shell');
+});
+test('mise install verifies the downloaded artifact with sha256sum -c', () => {
+    assert.match(instructions, /sha256sum\s+-c/, 'install must verify via `sha256sum -c`');
+});
+test('mise version + per-arch tarball SHA-256s are pinned under repo control', () => {
+    assert.match(source, new RegExp(`ARG\\s+MISE_VERSION=${PINNED_VERSION.replace(/\./g, '\\.')}\\b`), `MISE_VERSION must be pinned to ${PINNED_VERSION}`);
+    assert.match(source, new RegExp(`ARG\\s+MISE_SHA256_AMD64=${PINNED_SHA256.amd64}\\b`), 'amd64 tarball SHA-256 must be pinned to the verified value');
+    assert.match(source, new RegExp(`ARG\\s+MISE_SHA256_ARM64=${PINNED_SHA256.arm64}\\b`), 'arm64 tarball SHA-256 must be pinned to the verified value');
+});
+test('mise is downloaded from the registry.npmjs.org platform package', () => {
+    // The verified artifact is the @jdxcode/mise-linux-<arch> npm tarball (an already
+    // allowed mise egress host), so the pinned hash can be recomputed from the same source.
+    assert.match(source, /registry\.npmjs\.org\/@jdxcode\/mise-linux-/, 'must download the mise binary from the @jdxcode/mise-linux-<arch> npm package');
+});
+//# sourceMappingURL=dockerfile-mise-pin.test.js.map

package/dist/tests/shell/dockerfile-mise-pin.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerfile-mise-pin.test.js","sourceRoot":"","sources":["../../../tests/shell/dockerfile-mise-pin.test.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,cAAc;AACd,EAAE;AACF,mFAAmF;AACnF,0FAA0F;AAC1F,qFAAqF;AACrF,oFAAoF;AACpF,sFAAsF;AACtF,0FAA0F;AAE1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,aAAa,CAC9B,IAAI,GAAG,CAAC,uCAAuC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAClE,CAAC;AACF,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAEhD,mFAAmF;AACnF,sFAAsF;AACtF,4FAA4F;AAC5F,MAAM,YAAY,GAAG,MAAM;KACxB,KAAK,CAAC,IAAI,CAAC;KACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAC/B,IAAI,CAAC,IAAI,CAAC,CAAC;AAEd,iFAAiF;AACjF,wFAAwF;AACxF,kFAAkF;AAClF,uFAAuF;AACvF,4EAA4E;AAC5E,MAAM,cAAc,GAAG,WAAW,CAAC;AACnC,MAAM,aAAa,GAAG;IACpB,KAAK,EAAE,kEAAkE;IACzE,KAAK,EAAE,kEAAkE;CACjE,CAAC;AAEX,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACjF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ,WAAW,EACX,uEAAuE,CACxE,CAAC;IACF,kEAAkE;IAClE,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ,kBAAkB,EAClB,gDAAgD,CACjD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,wCAAwC,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,CAAC,KAAK,CACV,MAAM,EACN,IAAI,MAAM,CAAC,uBAAuB,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAC5E,kCAAkC,cAAc,EAAE,CACnD,CAAC;IACF,MAAM,CAAC,KAAK,CACV,MAAM,EACN,IAAI,MAAM,CAAC,4BAA4B,aAAa,CAAC,KAAK,KAAK,CAAC,EAChE,4DAA4D,CAC7D,CAAC;IACF,MAAM,CAAC,KAAK,CACV,MAAM,EACN,IAAI,MAAM,CAAC,4BAA4B,aAAa,CAAC,KAAK,KAAK,CAAC,EAChE,4DAA4D,CAC7D,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,kFAAkF;IAClF,wFAAwF;IACxF,MAAM,CAAC,KAAK,CACV,MAAM,EACN,6CAA6C,EAC7C,+EAA+E,CAChF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/tests/shell/doctor.test.js

@@ -0,0 +1,101 @@
+// Shell test for the `symphony doctor` credential probe wiring — pins the §4a fix:
+// the doctor must resolve host-credential PATHS through the SAME injected core
+// builders the startup probe (workflow-loader) uses, instead of joining them
+// inline; this asserts the doctor's codex probe message embeds the core-derived
+// `hostCodexCredentialPath`.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import os from 'node:os';
+import path from 'node:path';
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
+import { parse as parseYaml } from 'yaml';
+import { defaultDoctorDeps, runDoctorCli } from '../../src/shell/cli/doctor.js';
+import { loadWorkflowProbed } from '../../src/shell/adapter/workflow-loader.js';
+// REAL core credential decisions (the SAME bundle main.ts injects into the doctor).
+import { hostClaudeCredentialPath, hostCodexCredentialPath, codexCredentialAvailable, codexMissingCredentialMessage, isKnownAdapter, } from '../../src/core/credential/availability.js';
+import { requiredAdapterIds } from '../../src/core/workflow/derive.js';
+import { parseWorkflow } from '../../src/core/workflow/parse.js';
+import { probePromptTemplates } from '../../src/core/workflow/prompt-probe.js';
+// REAL core doctor render bundle (the SAME functions main.ts threads into runDoctorCli).
+import { checkNodeVersion, checkWorkflow, checkGondolinImage, checkTrackerRoot, checkDashboardPort, formatDoctorReport, doctorReportPassed, } from '../../src/core/doctor/checks.js';
+const CORE = {
+    hostClaudeCredentialPath,
+    hostCodexCredentialPath,
+    codexCredentialAvailable,
+    codexMissingCredentialMessage,
+    requiredAdapterIds,
+    isKnownAdapter,
+};
+test('doctor codex probe message embeds the core-derived hostCodexCredentialPath', () => {
+    const home = os.homedir();
+    const deps = defaultDoctorDeps(CORE);
+    // OPENAI_API_KEY set → codex available (no fs read), and the PASS detail names
+    // the core codex path. This is deterministic regardless of the host fs.
+    const probe = deps.probeCredential('codex', { OPENAI_API_KEY: 'sk-test' });
+    assert.equal(probe.readable, true);
+    assert.match(probe.detail, new RegExp(hostCodexCredentialPath(home).replace(/[.]/g, '\\.')));
+});
+test('doctor classifiers throw a clear error when the composition root never injected core', () => {
+    const deps = defaultDoctorDeps(); // no core bundle
+    assert.throws(() => deps.probeCredential('codex', {}), /core credential\/adapter decisions must be injected/);
+});
+// ─── render-probe threaded through the doctor load path ────────────────────────
+//
+// Pins the fix: `symphony doctor` must FAIL on an UNPARSEABLE per-state prompt_file,
+// not just a missing one. Wire the doctor EXACTLY as main.ts does — load through
+// loadWorkflowProbed (which runs the pure render-probe) and render with the real
+// core check bundle — against a split workflow whose Todo.md has an unknown Liquid
+// tag. The workflow check must FAIL with the render error, and the doctor exits 1.
+const DOCTOR_RENDER = {
+    checkNodeVersion,
+    checkWorkflow,
+    checkGondolinImage,
+    checkTrackerRoot,
+    checkDashboardPort,
+    formatDoctorReport,
+    doctorReportPassed,
+};
+const parse = (text, workflowPath) => {
+    const { config, definition } = parseWorkflow(text, workflowPath, { parseYaml }, process.env);
+    return { config, definition };
+};
+test('symphony doctor FAILs an unparseable prompt_file via the threaded render-probe', async () => {
+    const dir = await mkdtemp(path.join(os.tmpdir(), 'sym-doctor-bad-prompt-'));
+    try {
+        await mkdir(path.join(dir, 'prompts'), { recursive: true });
+        // `{% include %}` is the no-include escape hatch the strict-Liquid subset rejects.
+        await writeFile(path.join(dir, 'prompts', 'Todo.md'), 'Body: {% include "x.md" %}');
+        const wf = path.join(dir, 'WORKFLOW.yaml');
+        await writeFile(wf, [
+            'tracker:',
+            '  kind: local',
+            'states:',
+            '  Todo:',
+            '    role: active',
+            '    prompt_file: prompts/Todo.md',
+            '  Done:',
+            '    role: terminal',
+            '  Triage:',
+            '    role: holding',
+        ].join('\n'));
+        let report = '';
+        // loadConfig wired identically to main.ts's doctor closure (load + render-probe).
+        const deps = {
+            ...defaultDoctorDeps(CORE),
+            loadConfig: (p) => loadWorkflowProbed(p, parse, probePromptTemplates).then((r) => r.config),
+        };
+        const code = await runDoctorCli({ workflowPath: wf, port: null }, DOCTOR_RENDER, deps, (s) => {
+            report += s;
+        });
+        assert.equal(code, 1, 'doctor must exit non-zero on an unparseable prompt_file');
+        assert.match(report, /FAIL\s+workflow/, 'the workflow check must FAIL');
+        assert.match(report, /failed to render/, 'the render-probe error must surface in the report');
+        // Error attribution: the doctor report must name the offending SOURCE FILE
+        // (absolute path of the bad prompt_file), not just the assembled blob/state.
+        assert.ok(report.includes(path.join(dir, 'prompts', 'Todo.md')), 'the doctor report must name the offending prompt file path');
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=doctor.test.js.map

package/dist/tests/shell/doctor.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.test.js","sourceRoot":"","sources":["../../../tests/shell/doctor.test.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,6BAA6B;AAE7B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAEhF,oFAAoF;AACpF,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,cAAc,GACf,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,yFAAyF;AACzF,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AAEzC,MAAM,IAAI,GAAG;IACX,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,6BAA6B;IAC7B,kBAAkB;IAClB,cAAc;CACf,CAAC;AAEF,IAAI,CAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,SAAS,EAAwC,CAAC,CAAC;IACjH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,GAAG,EAAE;IAChG,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;IACnD,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAwC,CAAC,EAC7E,qDAAqD,CACtD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,kFAAkF;AAClF,EAAE;AACF,qFAAqF;AACrF,iFAAiF;AACjF,iFAAiF;AACjF,mFAAmF;AACnF,mFAAmF;AAEnF,MAAM,aAAa,GAAG;IACpB,gBAAgB;IAChB,aAAa;IACb,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;CACnB,CAAC;AAEF,MAAM,KAAK,GAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE;IACtD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC,CAAC;AAEF,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;IAChG,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,mFAAmF;QACnF,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,4BAA4B,CAAC,CAAC;QACpF,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC3C,MAAM,SAAS,CACb,EAAE,EACF;YACE,UAAU;YACV,eAAe;YACf,SAAS;YACT,SAAS;YACT,kBAAkB;YAClB,kCAAkC;YAClC,SAAS;YACT,oBAAoB;YACpB,WAAW;YACX,mBAAmB;SACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QAEF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,kFAAkF;QAClF,MAAM,IAAI,GAAG;YACX,GAAG,iBAAiB,CAAC,IAAI,CAAC;YAC1B,UAAU,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;SACpG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;YAC3F,MAAM,IAAI,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,yDAAyD,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;QACxE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,mDAAmD,CAAC,CAAC;QAC9F,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,EACrD,4DAA4D,CAC7D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/tests/shell/effect-vm-create.test.js

@@ -0,0 +1,52 @@
+// Focused test for the `vm` effect family's `create` handler (issue 222): the
+// `vm:create` effect carries `rootfsSize` and the handler threads it into the
+// CreateVmOptions it hands the VmClient port. Only `deps.vm` is exercised, so the rest
+// of EffectAdapters is an inert cast.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { buildFamilies } from '../../src/shell/effect-interpreter-families.js';
+function createEffect(rootfsSize) {
+    return {
+        family: 'vm',
+        kind: 'create',
+        sessionLabel: 'symphony-test',
+        imagePath: '/img',
+        cpus: 1,
+        memMib: 512,
+        rootfsSize,
+        mounts: [],
+        env: {},
+        guestFiles: [],
+        allowWebSockets: false,
+        tcpHosts: {},
+    };
+}
+function familiesCapturingCreate() {
+    let captured = null;
+    const vm = {
+        createVm: async (opts) => {
+            captured = opts;
+            return { id: 'vm-1', exec: () => { throw new Error('unused'); }, close: async () => undefined };
+        },
+        listSessions: async () => [],
+        gc: async () => 0,
+        killAllVms: () => 0,
+    };
+    const families = buildFamilies({ vm });
+    return {
+        run: (rootfsSize) => Promise.resolve(families.vm(createEffect(rootfsSize))),
+        captured: () => captured,
+    };
+}
+test('vm:create effect threads rootfsSize into CreateVmOptions', async () => {
+    const f = familiesCapturingCreate();
+    const result = await f.run('5G');
+    assert.deepEqual(result, { kind: 'vm_created', vmId: 'vm-1', hostPid: undefined });
+    assert.equal(f.captured()?.rootfsSize, '5G');
+});
+test('vm:create effect with no rootfsSize leaves it undefined (substrate default)', async () => {
+    const f = familiesCapturingCreate();
+    await f.run(undefined);
+    assert.equal(f.captured()?.rootfsSize, undefined);
+});
+//# sourceMappingURL=effect-vm-create.test.js.map

package/dist/tests/shell/effect-vm-create.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effect-vm-create.test.js","sourceRoot":"","sources":["../../../tests/shell/effect-vm-create.test.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,uFAAuF;AACvF,sCAAsC;AAEtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAK/E,SAAS,YAAY,CAAC,UAAmB;IACvC,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,MAAM;QACjB,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,GAAG;QACX,UAAU;QACV,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,EAAE;QACP,UAAU,EAAE,EAAE;QACd,eAAe,EAAE,KAAK;QACtB,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,MAAM,EAAE,GAAa;QACnB,QAAQ,EAAE,KAAK,EAAE,IAAqB,EAAqB,EAAE;YAC3D,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QAClG,CAAC;QACD,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;QAC5B,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACjB,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;KACpB,CAAC;IACF,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,EAAE,EAA+B,CAAC,CAAC;IACpE,OAAO;QACL,GAAG,EAAE,CAAC,UAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QACrF,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;IAC1E,MAAM,CAAC,GAAG,uBAAuB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;IAC7F,MAAM,CAAC,GAAG,uBAAuB,EAAE,CAAC;IACpC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC"}

package/dist/tests/shell/gh-port.test.js

@@ -0,0 +1,63 @@
+// GhCliPort `--repo <slug>` injection (issue: PR-autopilot repo targeting).
+//
+// The autopilot runs `gh` from the stable source repo, whose `origin` may not be
+// the configured `workspace.github_repo` (the out-of-repo control-dir layout) or
+// may be absent. So the adapter appends `--repo <slug>` to autopilot `gh pr`
+// verbs — except `pr create`, which runs in the per-issue workspace whose origin
+// is already the target. A null slug (local-only) leaves argv untouched.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { GhCliPort } from '../../src/shell/interp/gh.js';
+function fakeProc() {
+    const calls = [];
+    const proc = {
+        run: async (argv) => {
+            calls.push(argv);
+            // argv is ['gh','pr',<sub>,...]; feed the read methods parseable payloads.
+            const sub = argv[2];
+            const stdout = sub === 'list' ? '[]' : sub === 'view' ? '{}' : '';
+            return { ran: true, exit_code: 0, signal: null, timed_out: false, stdout, stderr: '' };
+        },
+    };
+    return { proc, calls };
+}
+const repoArg = (c) => c && c.includes('--repo') ? c[c.indexOf('--repo') + 1] : undefined;
+test('GhCliPort: --repo <slug> is appended to autopilot pr verbs (merge/close/update/view/list)', async () => {
+    const { proc, calls } = fakeProc();
+    const gh = new GhCliPort(proc, { repoSlug: () => 'o/r' });
+    await gh.run(['pr', 'merge', '7', '--auto', '--squash', '--delete-branch'], '/cwd');
+    await gh.run(['pr', 'close', '7'], '/cwd');
+    await gh.run(['pr', 'update-branch', '7'], '/cwd');
+    await gh.prView('/cwd', 7);
+    await gh.prListForBranch('/cwd', 'agent/7');
+    assert.equal(calls.length, 5);
+    for (const c of calls) {
+        assert.equal(c[0], 'gh');
+        assert.equal(repoArg(c), 'o/r', `expected --repo o/r in: ${c.join(' ')}`);
+    }
+});
+test('GhCliPort: pr create is exempt (runs in the workspace whose origin is the target)', async () => {
+    const { proc, calls } = fakeProc();
+    const gh = new GhCliPort(proc, { repoSlug: () => 'o/r' });
+    await gh.run(['pr', 'create', '--head', 'agent/7', '--base', 'main', '--title', 't'], '/cwd');
+    assert.equal(repoArg(calls[0]), undefined, 'pr create must NOT get --repo');
+});
+test('GhCliPort: a null slug (local-only) infers from cwd — argv untouched', async () => {
+    const { proc, calls } = fakeProc();
+    const gh = new GhCliPort(proc, { repoSlug: () => null });
+    await gh.run(['pr', 'merge', '7', '--auto'], '/cwd');
+    assert.equal(repoArg(calls[0]), undefined, 'null slug → no --repo');
+});
+test('GhCliPort: no repoSlug accessor configured — argv untouched', async () => {
+    const { proc, calls } = fakeProc();
+    const gh = new GhCliPort(proc);
+    await gh.run(['pr', 'merge', '7'], '/cwd');
+    assert.equal(repoArg(calls[0]), undefined, 'no accessor → no --repo');
+});
+test('GhCliPort: non-pr commands are never repo-scoped', async () => {
+    const { proc, calls } = fakeProc();
+    const gh = new GhCliPort(proc, { repoSlug: () => 'o/r' });
+    await gh.run(['api', 'user'], '/cwd');
+    assert.equal(repoArg(calls[0]), undefined, 'non-pr command → no --repo');
+});
+//# sourceMappingURL=gh-port.test.js.map

package/dist/tests/shell/gh-port.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gh-port.test.js","sourceRoot":"","sources":["../../../tests/shell/gh-port.test.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,6EAA6E;AAC7E,iFAAiF;AACjF,yEAAyE;AAEzE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAIzD,SAAS,QAAQ;IACf,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAkB;QAC1B,GAAG,EAAE,KAAK,EAAE,IAAc,EAA0B,EAAE;YACpD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,2EAA2E;YAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACzF,CAAC;KACF,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAuB,EAAsB,EAAE,CAC9D,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAErE,IAAI,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;IAC3G,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC;IACpF,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;IACnG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9F,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,+BAA+B,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;IACtF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;IAC7E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;IAClE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,4BAA4B,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC"}

package/dist/tests/shell/gondolin-dispatch-guard.test.js

@@ -0,0 +1,144 @@
+// Focused tests for the §2a security wire: the GondolinDispatcher must HARD-FAIL
+// (via the injected core credential-mount guard) BEFORE createVm if any plan mount
+// overlaps a credential directory — the runtime teeth of the host-only-refresh
+// invariant vm-plan.ts documents.
+//
+// Wires the REAL pure core guard (assertNoCredentialMounts) into the dispatcher,
+// the same way main.ts injects it.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import os from 'node:os';
+import { GondolinDispatcher } from '../../src/shell/adapter/gondolin-dispatch.js';
+import { assertNoCredentialMounts } from '../../src/core/vm-guards.js';
+import { byoProbeFailureMessage } from '../../src/core/runner/vm-plan.js';
+import { CredentialMountError } from '../../src/types/errors.js';
+const HOME = os.homedir();
+/** Identity realpath: the guard tests exercise LEXICAL overlap; a dedicated test
+ *  below injects a symlink-resolving stub to prove the resolved-path rejection. */
+const identityRealpath = async (p) => p;
+/** A per-dispatch egress bundle — inert hooks + a no-op secret manager (the guard
+ *  tests never reach createVm's hooks; this just satisfies the option shape). */
+const egress = {
+    httpHooks: {},
+    secretManager: {},
+    secretName: 'ANTHROPIC_AUTH_TOKEN',
+    adapterId: 'claude',
+};
+function planWith(mounts) {
+    return {
+        sessionLabel: 'symphony-test',
+        imagePath: '/img',
+        cpus: 1,
+        memMib: 512,
+        rootfsSize: '3G',
+        mounts,
+        env: {},
+        guestFiles: [{ guestPath: '/opt/vm-agent.mjs', content: 'x', mode: 0o755 }],
+        agentCommand: ['node', '/opt/vm-agent.mjs'],
+        tunnel: { mcpGuestBaseUrl: 'http://symphony-mcp:7001', acpWsGuestUrl: 'ws://symphony-mcp:7001/acp', tcpHostEntry: {} },
+        allowWebSockets: false,
+        // These guard tests abort at the mount guard (or the createVm sentinel) before the
+        // install/probe steps, so the mise slice is never executed (empty commands).
+        mise: { env: {}, prepCommand: [], installCommand: [] },
+    };
+}
+// Inert mise deciders — these guard tests never reach the install/probe steps, so the
+// injected probe-script / install-failure / project-detect deciders are never called.
+const probeScript = () => 'set -e';
+const miseInstallMsg = () => 'mise install failed';
+const noProjectConfig = () => false;
+const noopLog = {
+    emit: () => undefined,
+    withIssue: () => noopLog,
+};
+function dispatchOptions(plan) {
+    return { plan, launchEnv: {}, adapterBin: 'claude', workdir: '/work', egress, onStderr: () => undefined };
+}
+// A VmClient whose createVm records whether it was reached (and throws a sentinel
+// so we don't have to drive the full post-create bring-up).
+class SENTINEL extends Error {
+}
+function spyVmClient() {
+    let called = false;
+    let mounts = null;
+    const client = {
+        createVm: async (opts) => {
+            called = true;
+            mounts = opts.mounts;
+            throw new SENTINEL('createVm reached');
+        },
+        listSessions: async () => [],
+        gc: async () => 0,
+        killAllVms: () => 0,
+    };
+    return { client, createVmCalled: () => called, mountsSeen: () => mounts };
+}
+const noopRegistry = {
+    register: async () => ({ deregister: () => undefined }),
+};
+test('dispatch HARD-FAILS before createVm when a mount overlaps a credential dir', async () => {
+    const spy = spyVmClient();
+    const dispatcher = new GondolinDispatcher(spy.client, noopRegistry, assertNoCredentialMounts, identityRealpath, byoProbeFailureMessage, probeScript, miseInstallMsg, noProjectConfig, noopLog);
+    const plan = planWith([{ host: '/home/u/work', guest: '/work', readonly: false }, { host: '~/.codex', guest: '/g', readonly: true }]);
+    await assert.rejects(() => dispatcher.dispatch(dispatchOptions(plan)), CredentialMountError);
+    // The guard threw → createVm must NEVER have been reached.
+    assert.equal(spy.createVmCalled(), false);
+});
+test('dispatch HARD-FAILS before createVm when a mount is the home root', async () => {
+    const spy = spyVmClient();
+    const dispatcher = new GondolinDispatcher(spy.client, noopRegistry, assertNoCredentialMounts, identityRealpath, byoProbeFailureMessage, probeScript, miseInstallMsg, noProjectConfig, noopLog);
+    const plan = planWith([{ host: HOME, guest: '/g', readonly: false }]);
+    await assert.rejects(() => dispatcher.dispatch(dispatchOptions(plan)), CredentialMountError);
+    assert.equal(spy.createVmCalled(), false);
+});
+test('dispatch proceeds to createVm with the plan mounts when no mount is credential-bearing', async () => {
+    const spy = spyVmClient();
+    const dispatcher = new GondolinDispatcher(spy.client, noopRegistry, assertNoCredentialMounts, identityRealpath, byoProbeFailureMessage, probeScript, miseInstallMsg, noProjectConfig, noopLog);
+    const benign = [{ host: '/srv/work/issue-1', guest: '/srv/work/issue-1', readonly: false }];
+    const plan = planWith(benign);
+    // createVm is reached (then throws our sentinel) — the guard passed.
+    await assert.rejects(() => dispatcher.dispatch(dispatchOptions(plan)), SENTINEL);
+    assert.equal(spy.createVmCalled(), true);
+    assert.deepEqual(spy.mountsSeen(), benign);
+});
+test('the injected guard is invoked BEFORE createVm (order check)', async () => {
+    const order = [];
+    let createVmReached = false;
+    const client = {
+        createVm: async () => {
+            order.push('createVm');
+            createVmReached = true;
+            throw new SENTINEL('stop');
+        },
+        listSessions: async () => [],
+        gc: async () => 0,
+        killAllVms: () => 0,
+    };
+    // Recording guard that throws, so createVm must never run.
+    const recordingGuard = (mounts) => {
+        order.push('guard');
+        assertNoCredentialMounts(mounts, { homeDir: HOME });
+    };
+    const dispatcher = new GondolinDispatcher(client, noopRegistry, recordingGuard, identityRealpath, byoProbeFailureMessage, probeScript, miseInstallMsg, noProjectConfig, noopLog);
+    const plan = planWith([{ host: '~/.ssh', guest: '/g', readonly: true }]);
+    await assert.rejects(() => dispatcher.dispatch(dispatchOptions(plan)), CredentialMountError);
+    assert.deepEqual(order, ['guard']);
+    assert.equal(createVmReached, false);
+});
+test('dispatch HARD-FAILS on a SYMLINKED credential mount (lexical-benign, resolves to ~/.codex) — codex HIGH', async () => {
+    const spy = spyVmClient();
+    // The mount's lexical host path is benign (/srv/links/creds) — the LEXICAL-only
+    // core guard would pass it — but its realpath resolves into ~/.codex. The injected
+    // resolver mimics fs.realpath following that symlink; the dispatcher must feed the
+    // RESOLVED path to the guard and reject.
+    const codexDir = `${HOME}/.codex`;
+    const symlinkRealpath = async (p) => p === '/srv/links/creds' ? codexDir : p;
+    const dispatcher = new GondolinDispatcher(spy.client, noopRegistry, assertNoCredentialMounts, symlinkRealpath, byoProbeFailureMessage, probeScript, miseInstallMsg, noProjectConfig, noopLog);
+    const plan = planWith([{ host: '/srv/links/creds', guest: '/g', readonly: true }]);
+    // Sanity: the LEXICAL guard alone would NOT catch this (proves the resolved-path
+    // pass is what rejects it, not the lexical one).
+    assertNoCredentialMounts(plan.mounts, { homeDir: HOME }); // does not throw
+    await assert.rejects(() => dispatcher.dispatch(dispatchOptions(plan)), CredentialMountError);
+    assert.equal(spy.createVmCalled(), false, 'symlinked credential mount must abort before createVm');
+});
+//# sourceMappingURL=gondolin-dispatch-guard.test.js.map

package/dist/tests/shell/gondolin-dispatch-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-dispatch-guard.test.js","sourceRoot":"","sources":["../../../tests/shell/gondolin-dispatch-guard.test.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,mFAAmF;AACnF,+EAA+E;AAC/E,kCAAkC;AAClC,EAAE;AACF,iFAAiF;AACjF,mCAAmC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAUjE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;AAE1B;mFACmF;AACnF,MAAM,gBAAgB,GAAyB,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAE9D;iFACiF;AACjF,MAAM,MAAM,GAA2B;IACrC,SAAS,EAAE,EAAW;IACtB,aAAa,EAAE,EAAW;IAC1B,UAAU,EAAE,sBAAsB;IAClC,SAAS,EAAE,QAAQ;CACpB,CAAC;AAEF,SAAS,QAAQ,CAAC,MAAiB;IACjC,OAAO;QACL,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,MAAM;QACjB,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,GAAG;QACX,UAAU,EAAE,IAAI;QAChB,MAAM;QACN,GAAG,EAAE,EAAE;QACP,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC3E,YAAY,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC;QAC3C,MAAM,EAAE,EAAE,eAAe,EAAE,0BAA0B,EAAE,aAAa,EAAE,4BAA4B,EAAE,YAAY,EAAE,EAAE,EAAE;QACtH,eAAe,EAAE,KAAK;QACtB,mFAAmF;QACnF,6EAA6E;QAC7E,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;KACvD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,sFAAsF;AACtF,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,QAAQ,CAAC;AAC3C,MAAM,cAAc,GAAG,GAAW,EAAE,CAAC,qBAAqB,CAAC;AAC3D,MAAM,eAAe,GAAG,GAAY,EAAE,CAAC,KAAK,CAAC;AAE7C,MAAM,OAAO,GAAY;IACvB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO;CACH,CAAC;AAExB,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AAC5G,CAAC;AAED,kFAAkF;AAClF,4DAA4D;AAC5D,MAAM,QAAS,SAAQ,KAAK;CAAG;AAC/B,SAAS,WAAW;IAClB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,KAAK,EAAE,IAAqB,EAAE,EAAE;YACxC,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACzC,CAAC;QACD,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;QAC5B,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACjB,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;KACG,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,YAAY,GAAmB;IACnC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;CACxD,CAAC;AAEF,IAAI,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;IAC5F,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAE/L,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtI,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAE7F,2DAA2D;IAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;IACnF,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAE/L,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC7F,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;IACxG,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAE/L,MAAM,MAAM,GAAc,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,qEAAqE;IACrE,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;IAC7E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvB,eAAe,GAAG,IAAI,CAAC;YACvB,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;QAC5B,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACjB,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;KACG,CAAC;IACzB,2DAA2D;IAC3D,MAAM,cAAc,GAAG,CAAC,MAA0B,EAAQ,EAAE;QAC1D,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,wBAAwB,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IACjL,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC7F,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yGAAyG,EAAE,KAAK,IAAI,EAAE;IACzH,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,gFAAgF;IAChF,mFAAmF;IACnF,mFAAmF;IACnF,yCAAyC;IACzC,MAAM,QAAQ,GAAG,GAAG,IAAI,SAAS,CAAC;IAClC,MAAM,eAAe,GAAyB,KAAK,EAAE,CAAC,EAAE,EAAE,CACxD,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,wBAAwB,EAAE,eAAe,EAAE,sBAAsB,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAE9L,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnF,iFAAiF;IACjF,iDAAiD;IACjD,wBAAwB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,iBAAiB;IAC3E,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC7F,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,uDAAuD,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC"}