smol-symphony 0.2.0 → 0.3.0

package/dist/agent/adapters.js

@@ -1,511 +0,0 @@
-// Registry of ACP adapters symphony knows how to launch end-to-end.
-//
-// Each profile encodes the executable inside the VM that speaks ACP, plus the
-// optional model/effort injection channels (env vars, extra argv, staged files)
-// the adapter natively understands. Credentials are NOT a per-adapter concern
-// here: the guest holds only a token-shaped placeholder and the host substitutes
-// the real upstream token (Anthropic OAuth for claude, an OpenAI API key or
-// ChatGPT-OAuth access token for codex, a minted GitHub Copilot token for
-// opencode) into the outbound request at Gondolin egress (TLS-MITM — see
-// `src/agent/credential-secrets.ts`). The real refresh/durable token never
-// enters the VM.
-//
-// To add a new adapter, populate the profile and add it to ADAPTERS. Unprofiled
-// adapters are not supported at runtime.
-import { lstat, mkdir, readFile, realpath, rm, writeFile } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import path from 'node:path';
-import { isKnownAdapter } from './adapter-names.js';
-// Re-export the names registry so orchestrator-side callers can keep importing
-// `isKnownAdapter` / `AcpAdapterId` from this module. The canonical home is
-// adapter-names.ts; this is just a convenience re-export.
-export { isKnownAdapter };
-// VM-facing env var names the opencode custom provider reads (via `{env:VAR}`)
-// for its base URL + bearer. The staged opencode.json (`buildOpencodeConfig`)
-// references these exact names; the token var MUST equal `OPENCODE_SECRET_NAME`
-// in `credential-secrets.ts` so the placeholder bearer Gondolin substitutes at
-// egress is keyed under the name the in-VM provider reads — a drift would
-// silently break the in-VM provider resolution.
-const OPENCODE_PROXY_BASE_URL_VAR = 'OPENCODE_PROXY_BASE_URL';
-const OPENCODE_PROXY_TOKEN_VAR = 'OPENCODE_PROXY_TOKEN';
-export const ADAPTERS = {
-    claude: {
-        id: 'claude',
-        binary: ['claude-agent-acp'],
-        // Anthropic subscription OAuth lives only on the host; the guest holds a
-        // token-shaped placeholder and Gondolin substitutes the real access token at
-        // egress on every upstream request (see `credential-secrets.ts`).
-        // claude-agent-acp reads ANTHROPIC_MODEL on startup (see acp-agent.js getAvailableModels:
-        // ANTHROPIC_MODEL > settings.model > default). The adapter resolves aliases like
-        // "opus" or "claude-sonnet-4-5" against the SDK's model list, so anything the user
-        // would type into Claude Code works here.
-        modelInjection: (model) => ({ env: { ANTHROPIC_MODEL: model } }),
-        // claude-agent-acp reads `effortLevel` out of merged settings (the SDK's
-        // `resolveSettings` walks `$CLAUDE_CONFIG_DIR/settings.json`, `<cwd>/.claude/settings.json`,
-        // etc.) and applies it via `query.applyFlagSettings`. There is no ANTHROPIC_EFFORT env var
-        // and the wrapper does not expose a CLI flag, so the only reachable channel from symphony
-        // is a settings.json staged next to the identity file and copied to /root/.claude/settings.json
-        // before the in-VM agent execs the adapter. Valid values are `low|medium|high|xhigh|max`, gated
-        // per-model by claude-agent-acp's `supportedEffortLevels`; symphony lets the adapter reject
-        // invalid choices rather than mirroring the gate.
-        effortInjection: (effort) => ({
-            stagedFiles: [
-                {
-                    stagedName: 'claude-settings.json',
-                    content: JSON.stringify({ effortLevel: effort }),
-                    guestPath: '/root/.claude/settings.json',
-                },
-            ],
-        }),
-    },
-    codex: {
-        id: 'codex',
-        binary: ['codex-acp'],
-        // codex (ChatGPT-OAuth) runs in its NATIVE mode: the guest holds a JWT-shaped
-        // placeholder as `~/.codex/auth.json:tokens.access_token` and Gondolin
-        // substitutes the real ChatGPT/OpenAI token at egress. The host stages a
-        // COMPLETE fake auth.json (placeholder tokens + the non-secret
-        // `account_id`/`auth_mode`/`last_refresh` codex 0.135's completeness check
-        // needs — see `gondolin-creds-staging.ts` `buildCodexFiles`); no real token,
-        // and no refresh token, ever enters the VM.
-        // codex-acp takes config overrides via `-c key=value` where value is parsed as TOML
-        // (raw-string fallback on parse failure). We always emit a quoted TOML string so
-        // model names containing dots or hyphens don't surprise the TOML parser.
-        modelInjection: (model) => ({ extraArgs: ['-c', `model=${JSON.stringify(model)}`] }),
-        // KNOWN GO-LIVE BLOCKER (codex over Gondolin, native ChatGPT-OAuth): codex-acp
-        // 0.15 streams `/backend-api/codex/responses` over a WebSocket. Through the
-        // Gondolin substrate that stream disconnects (`ResponseStreamDisconnected`,
-        // http_status_code: None) — codex then misreads the drop as an auth failure and
-        // attempts a token refresh, which is egress-blocked (auth.openai.com not
-        // allowlisted) → 403 → the turn is REFUSED. The placeholder-JWT account-id fix
-        // (credential-secrets.ts) is necessary (it stops the *pre-emptive* refresh so
-        // codex reaches `/responses` at all) but NOT sufficient. Neither
-        // `allowWebSockets:true` (the WS still drops) nor a config override resolves it:
-        // codex 0.135 forbids overriding the reserved built-in `openai` provider
-        // (`supports_websockets=false` → "Built-in providers cannot be overridden"),
-        // and codex-acp has no user-facing knob to force the HTTP transport
-        // (`force_http_fallback` is an internal Rust symbol, not a TOML config key).
-        // `codex exec` (the CLI, HTTP SSE) works fine through Gondolin — so this is
-        // specific to codex-acp's WebSocket Responses transport vs Gondolin's WS-MITM.
-        // Resolving it needs a substrate-level or codex-acp-version change (escalate);
-        // claude is fully green on the same path.
-    },
-    opencode: {
-        id: 'opencode',
-        binary: ['opencode', 'acp'],
-        // opencode reaches GitHub Copilot via a staged opencode.json custom
-        // `@ai-sdk/openai-compatible` provider whose baseURL/apiKey read the
-        // OPENCODE_PROXY_* env vars through opencode's `{env:VAR}` interpolation. The
-        // guest sends only a `gho_`-shaped placeholder bearer; the host mints a
-        // short-lived GitHub Copilot token (exchanged host-side from the operator's
-        // `opencode auth login` GitHub OAuth token at
-        // api.github.com/copilot_internal/v2/token) and Gondolin substitutes it into
-        // the outbound request at egress, injecting the Copilot editor headers,
-        // against api.githubcopilot.com. The durable GitHub OAuth token never enters
-        // the VM. See `credential-secrets.ts` and
-        // docs/research/opencode-copilot-accept-matrix.md.
-        // opencode picks its model from the staged opencode.json `model` key
-        // ("<providerID>/<modelID>"); the ACP `session/new` carries no model. The
-        // provider block must exist even when no model is pinned, so the whole
-        // config (provider + model) is staged together via stageOpencodeConfig
-        // (see runner.stageAdapterExtras), not through this env/argv channel.
-        // Returning an empty injection keeps this path inert.
-        modelInjection: () => ({}),
-    },
-};
-/** Provider id of the opencode custom (credential-substituted) provider. */
-export const OPENCODE_PROXY_PROVIDER_ID = 'symphony-copilot';
-/**
- * Default GitHub Copilot model opencode uses when the workflow pins no
- * `acp.model`. DOC-DERIVED: `gpt-4o` is broadly available across Copilot
- * subscription tiers. Operators override per-state via `acp.model` (any id
- * their Copilot subscription exposes — GPT-5, Claude Sonnet, Gemini, …).
- */
-export const OPENCODE_DEFAULT_COPILOT_MODEL = 'gpt-4o';
-// A small pinned set of Copilot-backed model ids the custom provider advertises
-// so opencode does not need to hit `<baseURL>/models` for discovery (the
-// upstream serves /models too, but pinning avoids the round-trip and a discovery
-// dependency). DOC-DERIVED — the exact id set a given Copilot subscription
-// exposes is operator/tier-dependent; an operator's `acp.model` is always
-// merged in (see buildOpencodeConfig) so a pinned model that isn't in this list
-// still resolves.
-const OPENCODE_PINNED_COPILOT_MODELS = [
-    'gpt-4o',
-    'gpt-4.1',
-    'o4-mini',
-    'claude-sonnet-4.5',
-    'claude-sonnet-4',
-    'gemini-2.5-pro',
-];
-/**
- * Build the opencode.json staged into the VM (pure; exported for tests). It
- * declares the `symphony-copilot` custom provider whose baseURL/apiKey read the
- * OPENCODE_PROXY_* env vars via `{env:…}` interpolation, advertises a pinned
- * Copilot model set (plus the operator's selected model), and pins the default
- * model to `<providerID>/<model>`. Two-space-indented so it reads cleanly if an
- * operator inspects the staged file.
- *
- * The `{env:VAR}` names are the shared OPENCODE_PROXY_* constants, so the in-VM
- * opencode resolves the same base URL + placeholder bearer the host stages (the
- * token var matches `OPENCODE_SECRET_NAME` in `credential-secrets.ts`).
- */
-export function buildOpencodeConfig(model) {
-    const selected = model && model.length > 0 ? model : OPENCODE_DEFAULT_COPILOT_MODEL;
-    const ids = new Set([...OPENCODE_PINNED_COPILOT_MODELS, selected]);
-    const models = {};
-    for (const id of ids)
-        models[id] = {};
-    return JSON.stringify({
-        $schema: 'https://opencode.ai/config.json',
-        provider: {
-            [OPENCODE_PROXY_PROVIDER_ID]: {
-                npm: '@ai-sdk/openai-compatible',
-                name: 'Symphony Copilot proxy',
-                options: {
-                    baseURL: `{env:${OPENCODE_PROXY_BASE_URL_VAR}}`,
-                    apiKey: `{env:${OPENCODE_PROXY_TOKEN_VAR}}`,
-                },
-                models,
-            },
-        },
-        model: `${OPENCODE_PROXY_PROVIDER_ID}/${selected}`,
-    }, null, 2);
-}
-/**
- * Absolute guest path the staged opencode.json is copied to inside the VM.
- * opencode reads its global config from `$XDG_CONFIG_HOME/opencode/opencode.json`
- * (defaulting to `~/.config/opencode/opencode.json`); the VM runs as root, so
- * `/root/.config/opencode/opencode.json`. DOC-DERIVED: that `opencode acp`
- * honours the global config + custom provider + `{env:VAR}` interpolation is
- * recorded in docs/research/opencode-copilot-accept-matrix.md.
- */
-export const OPENCODE_CONFIG_GUEST_PATH = '/root/.config/opencode/opencode.json';
-/**
- * Stage the opencode.json (custom-provider + model) into the workspace runtime
- * tree. Mirrors stageCodexPlaceholderAuth: synthetic content (no secret — the
- * placeholder bearer arrives via env, never a real token), so it never fails on
- * a missing host file.
- */
-export async function stageOpencodeConfig(workspacePath, model) {
-    return stageRuntimeFile(workspacePath, 'opencode.json', buildOpencodeConfig(model));
-}
-export function profileFor(id) {
-    return ADAPTERS[id];
-}
-export async function stageRuntimeFile(workspacePath, stagedName, content) {
-    return stageNamedFileUnder(workspacePath, 'runtime', stagedName, content);
-}
-/**
- * Stage the host's claude identity into the workspace runtime tree. Reads
- * `~/.claude.json`, extracts only the operator's `oauthAccount.accountUuid`
- * and `oauthAccount.organizationUuid`, and writes a minimal JSON file at
- * `<workspace>/.git/symphony-runtime/identity/claude.json` (or the
- * `.symphony-runtime/` fallback when the workspace has no `.git/`). The
- * in-VM claude-agent-acp reads these fields to compose a well-formed
- * `metadata.user_id` on every upstream call so a future re-activation of
- * Anthropic's server-side fingerprint check doesn't break dispatch.
- *
- * Defensive shape: NO token strings, NO `device_id`/`session_id` (those are
- * per-process — the in-VM client mints fresh ones on first run), NO local
- * config (prompt-history pointers, theme, recent paths). Identity only. See
- * the `stageClaudeIdentity` test in tests/adapters.test.ts which greps the
- * staged file for `accessToken`/`refreshToken` substrings.
- *
- * When `~/.claude.json` is missing or contains no `oauthAccount` we skip the
- * staging (returning null) rather than fail the dispatch — the egress-substitution
- * seam is defense in depth, not a hard gate on running.
- */
-export async function stageClaudeIdentity(workspacePath) {
-    const src = path.join(homedir(), '.claude.json');
-    let raw;
-    try {
-        raw = await readFile(src, 'utf8');
-    }
-    catch (err) {
-        if (err.code === 'ENOENT')
-            return null;
-        throw err;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-    const account = extractOauthAccountIdentity(parsed);
-    if (!account)
-        return null;
-    const content = JSON.stringify({ oauthAccount: account });
-    return stageNamedFileUnder(workspacePath, 'identity', 'claude.json', content);
-}
-/**
- * Stage a FAKE placeholder `~/.codex/auth.json` into the workspace for the codex
- * adapter. codex-acp's session-init credential check fails with "Authentication
- * required" when no auth.json file exists, even though the placeholder bearer is
- * supplied via the `OPENAI_API_KEY` env var (a live dispatch proved this — #116
- * staged only the env). This file exists PURELY to satisfy that init check: it
- * contains NO real credential — `OPENAI_API_KEY` is a token-shaped placeholder
- * and there is no OAuth `tokens` block — so codex falls through to the env
- * `OPENAI_API_KEY` (= the placeholder, which has precedence over the file) as its
- * request bearer, and Gondolin substitutes the real OpenAI token at egress
- * (TLS-MITM). No real token, and no refresh token, ever enters the VM.
- *
- * `auth_mode: 'apikey'` so codex takes the API-key path (the env placeholder),
- * never an OAuth handshake. `last_refresh` is omitted (no OAuth tokens to age).
- */
-export async function stageCodexPlaceholderAuth(workspacePath) {
-    const placeholder = JSON.stringify({
-        OPENAI_API_KEY: 'sk-symphony-placeholder',
-        auth_mode: 'apikey',
-    });
-    return stageNamedFileUnder(workspacePath, 'credential', 'auth.json', placeholder);
-}
-/**
- * Pull just the identity fields out of the parsed `~/.claude.json`. Anything
- * outside `accountUuid`/`organizationUuid` is dropped — see
- * `stageClaudeIdentity`'s contract.
- */
-function extractOauthAccountIdentity(parsed) {
-    const acct = pickObjectField(parsed, 'oauthAccount');
-    if (!acct)
-        return null;
-    const accountUuid = pickStringField(acct, 'accountUuid');
-    const organizationUuid = pickStringField(acct, 'organizationUuid');
-    if (accountUuid === null || organizationUuid === null)
-        return null;
-    return { accountUuid, organizationUuid };
-}
-function pickObjectField(value, key) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return null;
-    const v = value[key];
-    if (!v || typeof v !== 'object' || Array.isArray(v))
-        return null;
-    return v;
-}
-function pickStringField(obj, key) {
-    const v = obj[key];
-    if (typeof v !== 'string' || v.length === 0)
-        return null;
-    return v;
-}
-/**
- * Shared implementation for the runtime/identity staging paths. Writes
- * `content` into `<staging-root>/<subdir>/<stagedName>` (0600) with the same
- * symlink/race defenses we previously used for the credential file: explicit
- * cleanup of the leaf, exclusive create via `flag: 'wx'`, and a post-write
- * `realpath` check to detect a symlink that raced into a parent between
- * `ensureRealDir` and the write.
- */
-async function stageNamedFileUnder(workspacePath, subdir, stagedName, content) {
-    if (!/^[A-Za-z0-9._-]+$/.test(stagedName)) {
-        throw new Error(`stageNamedFileUnder: stagedName ${JSON.stringify(stagedName)} contains characters outside ` +
-            `[A-Za-z0-9._-]; refuse to compose into the staging path.`);
-    }
-    const { stagingRootAbs, stagingRootRel } = await resolveStagingLocation(workspacePath);
-    const subDir = path.join(stagingRootAbs, subdir);
-    await ensureRealDir(stagingRootAbs);
-    await ensureRealDir(subDir);
-    const dst = path.join(subDir, stagedName);
-    await rm(dst, { force: true, recursive: false });
-    await writeFile(dst, content, { mode: 0o600, flag: 'wx' });
-    const expectedReal = path.join(await realpath(workspacePath), stagingRootRel, subdir, stagedName);
-    const actualReal = await realpath(dst);
-    if (actualReal !== expectedReal) {
-        await rm(dst, { force: true }).catch(() => undefined);
-        throw new Error(`staging path redirected: wrote to ${actualReal}, expected ${expectedReal}. ` +
-            `A symlink raced in during staging; manually inspect and remove any leaked ` +
-            `file at the actual path before retrying.`);
-    }
-    const relPath = path.posix.join(stagingRootRel, subdir, stagedName);
-    return { absPath: dst, relPath };
-}
-/**
- * Decide where to stage runtime files based on workspace shape. See
- * StagedRuntimePaths for the policy. Returns absolute + relative (POSIX,
- * relative to workspacePath) paths to the staging root directory; the caller
- * composes `<subdir>/<name>` under it.
- */
-async function resolveStagingLocation(workspacePath) {
-    const gitPath = path.join(workspacePath, '.git');
-    let gitSt;
-    try {
-        gitSt = await lstat(gitPath);
-    }
-    catch (err) {
-        if (err.code === 'ENOENT') {
-            // No `.git` in the workspace itself. The workspace-root fallback is only
-            // safe when the workspace is also NOT inside an ancestor git repo — git's
-            // repository discovery walks up the directory tree, so a workspace at e.g.
-            // `<parent>/.symphony/workspaces/X` with no own `.git` ends up inside
-            // `<parent>/.git`. A `git add -A` (from a host-side hook, or from any
-            // process with the host filesystem visible) would then stage the file in
-            // the parent's index. Detect that and refuse.
-            //
-            // Resolve symlinks first: git's discovery follows the resolved path, so
-            // walking the lexical `workspacePath` would miss an ancestor `.git` that
-            // sits above the symlink's real target (e.g. `/home/user/repo-link`
-            // pointing at `/srv/repo` where `/srv/.git` exists). A broken symlink at
-            // workspacePath itself is treated as a refusal: we cannot prove the
-            // workspace isn't inside someone's working tree, so don't stage.
-            let resolvedWorkspace;
-            try {
-                resolvedWorkspace = await realpath(workspacePath);
-            }
-            catch (resolveErr) {
-                throw new Error(`cannot auto-stage runtime files: workspace ${workspacePath} could not be resolved ` +
-                    `(realpath failed: ${resolveErr.message}). Refusing to stage without a ` +
-                    `canonical path; fix the workspace.`);
-            }
-            const ancestor = await findAncestorGit(resolvedWorkspace);
-            if (ancestor !== null) {
-                throw new Error(`cannot auto-stage runtime files: workspace ${workspacePath} has no .git of its own ` +
-                    `but is inside an ancestor git repo at ${ancestor}. The canonical workspace setup ` +
-                    `clones each issue into its own repo; ensure the workspace is a nested clone.`);
-            }
-            return {
-                stagingRootAbs: path.join(workspacePath, '.symphony-runtime'),
-                stagingRootRel: '.symphony-runtime',
-            };
-        }
-        throw err;
-    }
-    if (gitSt.isDirectory()) {
-        // Normal clone: stage inside `.git/`, which is outside the working tree.
-        // Git never recurses into `.git/` for `add`/`status`, so the file is
-        // structurally untrackable — no `info/exclude` games needed, and a tracked
-        // `.symphony-runtime/...` at workspace root cannot interfere.
-        return {
-            stagingRootAbs: path.join(workspacePath, '.git', 'symphony-runtime'),
-            stagingRootRel: path.posix.join('.git', 'symphony-runtime'),
-        };
-    }
-    if (gitSt.isFile()) {
-        // Linked worktree: .git is a pointer file at /<worktree>/.git -> per-worktree
-        // gitdir (typically /<main>/.git/worktrees/<name>/). The per-worktree gitdir
-        // lives outside the workspace mount, so symphony cannot place the file
-        // there and still have the in-VM agent reach it. Any worktree-internal path
-        // is inside the working tree, where `.gitignore` negation or a tracked file
-        // could still expose state to `git add -A`. Linked worktrees are
-        // currently unsupported — use a non-linked workspace clone (e.g.
-        // `git clone --local`) or fork scripts/vm-agent.mjs to stage runtime
-        // files in whatever shape your worktree layout needs.
-        throw new Error(`cannot auto-stage runtime files in a linked worktree (.git at ${gitPath} is a file). ` +
-            `Linked worktrees are unsupported under the ACP TCP bridge transport; use a ` +
-            `non-linked workspace clone or fork scripts/vm-agent.mjs.`);
-    }
-    throw new Error(`cannot auto-stage runtime files: ${gitPath} is neither a directory nor a file ` +
-        `(symlink, device, or other unexpected entry).`);
-}
-/**
- * Walk up from `workspacePath` looking for an ancestor `.git` entry (file or dir).
- * Returns the absolute path of the first one found, or null when the walk reaches
- * the filesystem root without hitting one. Used to detect workspaces that, despite
- * having no `.git` of their own, are still inside the working tree of an ancestor
- * git repo.
- *
- * The caller is expected to pass an already-canonical (realpath-resolved) path:
- * git discovery follows the resolved path, so a lexical walk on a symlinked input
- * would miss the real ancestor. Once the input is canonical, every `path.dirname`
- * step stays canonical (a directory's parent is itself a directory component,
- * never a symlink), so no per-level re-resolve is needed.
- */
-async function findAncestorGit(workspacePath) {
-    const root = path.parse(workspacePath).root;
-    let current = path.dirname(workspacePath);
-    while (current && current !== root) {
-        const candidate = path.join(current, '.git');
-        try {
-            await lstat(candidate);
-            return candidate;
-        }
-        catch (err) {
-            if (err.code !== 'ENOENT')
-                throw err;
-        }
-        const next = path.dirname(current);
-        if (next === current)
-            break;
-        current = next;
-    }
-    // Final check at the root itself.
-    try {
-        await lstat(path.join(root, '.git'));
-        return path.join(root, '.git');
-    }
-    catch (err) {
-        if (err.code !== 'ENOENT')
-            throw err;
-    }
-    return null;
-}
-/**
- * Ensure `p` is a real directory we own. Creates it if missing; refuses if it exists
- * as a symlink (defense against the staging-via-symlink attack) or as a non-directory.
- */
-async function ensureRealDir(p) {
-    let st;
-    try {
-        st = await lstat(p);
-    }
-    catch (err) {
-        if (err.code === 'ENOENT') {
-            await mkdir(p, { recursive: false });
-            return;
-        }
-        throw err;
-    }
-    if (st.isSymbolicLink()) {
-        throw new Error(`refusing to write symphony-runtime through a symlink at ${p}`);
-    }
-    if (!st.isDirectory()) {
-        throw new Error(`expected a directory at ${p}, found a non-directory`);
-    }
-}
-/**
- * Build the bash command symphony will exec inside the VM. For each staged
- * extra file: `mkdir -p` the destination directory, `cp` the file into place,
- * `chmod 600`. Then exec the in-VM agent at `/opt/symphony/vm-agent.mjs`. It
- * reads its config — SYMPHONY_ACP_URL, SYMPHONY_ACP_TOKEN,
- * SYMPHONY_ADAPTER_BIN, SYMPHONY_ADAPTER_ARGS — from the environment that
- * symphony sets on the in-VM exec invocation, dials the host's TCP ACP
- * bridge, and spawns the adapter with kernel pipes.
- *
- * Why TCP through the in-VM agent: the in-VM exec stdin pump does not reliably
- * wake the in-VM reader for kernel events unless host stdin keeps writing. Piping
- * ACP frames through the in-VM exec stdio caused the adapter to hang after the
- * first session/update. The TCP bridge (see src/acp-bridge.ts) bypasses that pump
- * entirely and decouples symphony from any specific sandbox tech — any sandbox
- * that can launch a process with env vars and reach the host loopback can run
- * this stack unchanged.
- *
- * No real credential enters the VM: the guest holds only a token-shaped
- * placeholder (staged as fake native creds + env), and Gondolin substitutes the
- * real upstream token (Anthropic OAuth for claude, an OpenAI API key or
- * ChatGPT-OAuth access token for codex, a minted GitHub Copilot token for
- * opencode) into the outbound request at egress (TLS-MITM). See
- * `credential-secrets.ts` / `gondolin-creds-staging.ts`.
- */
-export function deriveAcpCommand(profile, extraFiles = []) {
-    if (profile.binary.length === 0) {
-        throw new Error(`adapter "${profile.id}" has an empty binary launch vector`);
-    }
-    const steps = [];
-    for (const f of extraFiles) {
-        const extraDir = path.posix.dirname(f.guestPath);
-        steps.push(`mkdir -p ${shQuote(extraDir)}`);
-        steps.push(`cp ${shQuote(f.stagedRelPath)} ${shQuote(f.guestPath)}`);
-        steps.push(`chmod 600 ${shQuote(f.guestPath)}`);
-    }
-    steps.push(`exec node /opt/symphony/vm-agent.mjs`);
-    return steps.join(' && ');
-}
-// Minimal POSIX-shell single-quoting. None of the paths we emit contain `'`, but be
-// defensive in case a future binary name or path changes.
-function shQuote(s) {
-    if (/^[A-Za-z0-9_\-./]+$/.test(s))
-        return s;
-    return `'${s.replace(/'/g, `'\\''`)}'`;
-}
-//# sourceMappingURL=adapters.js.map

package/dist/agent/adapters.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../../src/agent/adapters.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,iBAAiB;AACjB,EAAE;AACF,gFAAgF;AAChF,yCAAyC;AAEzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAqB,MAAM,oBAAoB,CAAC;AAEvE,+EAA+E;AAC/E,4EAA4E;AAC5E,0DAA0D;AAC1D,OAAO,EAAE,cAAc,EAAqB,CAAC;AA+D7C,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,0EAA0E;AAC1E,gDAAgD;AAChD,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAC9D,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAExD,MAAM,CAAC,MAAM,QAAQ,GAAyC;IAC5D,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,MAAM,EAAE,CAAC,kBAAkB,CAAC;QAC5B,yEAAyE;QACzE,6EAA6E;QAC7E,kEAAkE;QAClE,0FAA0F;QAC1F,iFAAiF;QACjF,mFAAmF;QACnF,0CAA0C;QAC1C,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC;QAChE,yEAAyE;QACzE,6FAA6F;QAC7F,2FAA2F;QAC3F,0FAA0F;QAC1F,gGAAgG;QAChG,gGAAgG;QAChG,4FAA4F;QAC5F,kDAAkD;QAClD,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5B,WAAW,EAAE;gBACX;oBACE,UAAU,EAAE,sBAAsB;oBAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;oBAChD,SAAS,EAAE,6BAA6B;iBACzC;aACF;SACF,CAAC;KACH;IACD,KAAK,EAAE;QACL,EAAE,EAAE,OAAO;QACX,MAAM,EAAE,CAAC,WAAW,CAAC;QACrB,8EAA8E;QAC9E,uEAAuE;QACvE,yEAAyE;QACzE,+DAA+D;QAC/D,2EAA2E;QAC3E,6EAA6E;QAC7E,4CAA4C;QAC5C,oFAAoF;QACpF,iFAAiF;QACjF,yEAAyE;QACzE,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACpF,+EAA+E;QAC/E,4EAA4E;QAC5E,4EAA4E;QAC5E,gFAAgF;QAChF,yEAAyE;QACzE,+EAA+E;QAC/E,8EAA8E;QAC9E,iEAAiE;QACjE,iFAAiF;QACjF,yEAAyE;QACzE,6EAA6E;QAC7E,oEAAoE;QACpE,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,+EAA+E;QAC/E,0CAA0C;KAC3C;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;QAC3B,oEAAoE;QACpE,qEAAqE;QACrE,8EAA8E;QAC9E,wEAAwE;QACxE,4EAA4E;QAC5E,8CAA8C;QAC9C,6EAA6E;QAC7E,wEAAwE;QACxE,6EAA6E;QAC7E,0CAA0C;QAC1C,mDAAmD;QACnD,qEAAqE;QACrE,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,sDAAsD;QACtD,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;KAC3B;CACF,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,QAAQ,CAAC;AAEvD,gFAAgF;AAChF,yEAAyE;AACzE,iFAAiF;AACjF,2EAA2E;AAC3E,0EAA0E;AAC1E,gFAAgF;AAChF,kBAAkB;AAClB,MAAM,8BAA8B,GAAsB;IACxD,QAAQ;IACR,SAAS;IACT,SAAS;IACT,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;CACjB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAoB;IACtD,MAAM,QAAQ,GAAG,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,8BAA8B,CAAC;IACpF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,8BAA8B,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAA0C,EAAE,CAAC;IACzD,KAAK,MAAM,EAAE,IAAI,GAAG;QAAE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;IACtC,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,OAAO,EAAE,iCAAiC;QAC1C,QAAQ,EAAE;YACR,CAAC,0BAA0B,CAAC,EAAE;gBAC5B,GAAG,EAAE,2BAA2B;gBAChC,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE;oBACP,OAAO,EAAE,QAAQ,2BAA2B,GAAG;oBAC/C,MAAM,EAAE,QAAQ,wBAAwB,GAAG;iBAC5C;gBACD,MAAM;aACP;SACF;QACD,KAAK,EAAE,GAAG,0BAA0B,IAAI,QAAQ,EAAE;KACnD,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sCAAsC,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAAqB,EACrB,KAAoB;IAEpB,OAAO,gBAAgB,CAAC,aAAa,EAAE,eAAe,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAgB;IACzC,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAgCD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,UAAkB,EAClB,OAAe;IAEf,OAAO,mBAAmB,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,OAAO,mBAAmB,CAAC,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,aAAqB;IAErB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,cAAc,EAAE,yBAAyB;QACzC,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IACH,OAAO,mBAAmB,CAAC,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,SAAS,2BAA2B,CAClC,MAAe;IAEf,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACnE,IAAI,WAAW,KAAK,IAAI,IAAI,gBAAgB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,GAAW;IAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,CAAC,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,CAA4B,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B,EAAE,GAAW;IAChE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,mBAAmB,CAChC,aAAqB,EACrB,MAA6C,EAC7C,UAAkB,EAClB,OAAe;IAEf,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,+BAA+B;YAC1F,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC;IACpC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAChC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,qCAAqC,UAAU,cAAc,YAAY,IAAI;YAC3E,4EAA4E;YAC5E,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAIzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,yEAAyE;YACzE,0EAA0E;YAC1E,2EAA2E;YAC3E,sEAAsE;YACtE,sEAAsE;YACtE,yEAAyE;YACzE,8CAA8C;YAC9C,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,oEAAoE;YACpE,iEAAiE;YACjE,IAAI,iBAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,iBAAiB,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,8CAA8C,aAAa,yBAAyB;oBAClF,qBAAsB,UAAoB,CAAC,OAAO,iCAAiC;oBACnF,oCAAoC,CACvC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC,CAAC;YAC1D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,8CAA8C,aAAa,0BAA0B;oBACnF,yCAAyC,QAAQ,kCAAkC;oBACnF,8EAA8E,CACjF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC;gBAC7D,cAAc,EAAE,mBAAmB;aACpC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,yEAAyE;QACzE,qEAAqE;QACrE,2EAA2E;QAC3E,8DAA8D;QAC9D,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,kBAAkB,CAAC;YACpE,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,8EAA8E;QAC9E,6EAA6E;QAC7E,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,iEAAiE;QACjE,iEAAiE;QACjE,qEAAqE;QACrE,sDAAsD;QACtD,MAAM,IAAI,KAAK,CACb,iEAAiE,OAAO,eAAe;YACrF,6EAA6E;YAC7E,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,oCAAoC,OAAO,qCAAqC;QAC9E,+CAA+C,CAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,eAAe,CAAC,aAAqB;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC;IAC5C,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,OAAO,OAAO,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,OAAO;YAAE,MAAM;QAC5B,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,CAAS;IACpC,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAuB,EACvB,aAAwC,EAAE;IAE1C,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,YAAY,OAAO,CAAC,EAAE,qCAAqC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,oFAAoF;AACpF,0DAA0D;AAC1D,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC"}