smol-symphony 0.2.0 → 0.3.1

package/dist/shell/main-reconcilers.js

@@ -0,0 +1,225 @@
+// FCIS rewrite — reconciler-pass construction for the composition root (shell).
+//
+// Sliced out of src/shell/main.ts (mirroring main-adapters.ts) so the root keeps
+// only the core-wiring under the max-lines budget. This module builds the three
+// ReconcilerLoop passes (VM reaper / workspace janitor / PR autopilot) + the two
+// effect appliers (applyKillStep / applyPrEffect) the central interpreter routes
+// the `reaper` / `pr` families through. It imports NO core (only the root may) —
+// every pure decider arrives already injected via `ReconcilerCoreDeps`.
+//
+// Each pass is the imperative shell of one resource: OBSERVE live state through
+// the injected IO ports, DECIDE via the pure core decider, APPLY the returned
+// effects/actions back through the ports, and project a ResourceSnapshot for the
+// dashboard via the shared (pure) ledger reducer. The loop driver
+// (reconciler-loop.ts) owns coalescing + ordering + the backstop timer only.
+// The OBSERVE / apply-step / ledger primitives live in
+// ./main-reconcilers-helpers; the PR sticky-cache applier in ./main-reconcilers-pr.
+//
+// Shell rule: imports from src/types/** ONLY. Concrete ports are injected.
+import { buildPrApplier, EMPTY_PR_CACHE } from './main-reconcilers-pr.js';
+import { applyKillLedger, buildApplyKillStep, collectPrIntents, firstActiveState, observeDesiredWorkspaces, observeHandoffMarkers, observeInspections, recordPrLedger, resolveBaseRefSha, sanitizeWorkspaceKey, } from './main-reconcilers-helpers.js';
+/**
+ * Build the VM-reaper / workspace-janitor / PR-autopilot passes + the two
+ * appliers. Each pass observes → calls a pure core decider → applies through the
+ * ports → projects a ResourceSnapshot. Returns the appliers separately so the
+ * root can also inject them into the central EffectAdapters bundle (the
+ * interpreter's `reaper` / `pr` families).
+ */
+export function buildReconcilerPasses(deps) {
+    const applyKillStep = buildApplyKillStep(deps);
+    const pr = buildPrApplier(deps);
+    const ledgers = {
+        vm: deps.core.createLedger('vm', 32),
+        workspace: deps.core.createLedger('workspace', 32),
+        pr: deps.core.createLedger('pr', 64),
+    };
+    return {
+        passes: {
+            vm: () => vmPass(deps, applyKillStep, ledgers),
+            workspace: () => workspacePass(deps, ledgers),
+            pr: () => prPass(deps, pr, ledgers),
+        },
+        applyKillStep,
+        applyPrEffect: pr.applyFamily,
+    };
+}
+// ─── VM reaper pass ─────────────────────────────────────────────────────────
+async function vmPass(deps, applyKillStep, ledgers) {
+    const { core, log } = deps;
+    // gc STALE/dead-pid sessions first, then enumerate the LIVE set.
+    const observed = await observeVmSessions(deps);
+    let lastError = observed.error;
+    if (observed.sessions === null)
+        return core.ledgerResourceSnapshot(ledgers.vm, { ready: true, last_error: lastError });
+    const intendedLabels = new Set(deps.intended.inFlight().map((e) => e.sessionLabel));
+    const selfPid = deps.signal.selfPid();
+    const actions = core.decideVm({ sessions: observed.sessions, intendedLabels, selfPid });
+    if (actions.length > 0)
+        log.emit('info', 'vm reaper: killing orphan sessions', { orphans: actions.length });
+    for (const action of actions) {
+        const err = await driveKill(deps, applyKillStep, ledgers, action, selfPid);
+        if (err)
+            lastError = err;
+    }
+    return core.ledgerResourceSnapshot(ledgers.vm, { ready: true, last_error: lastError });
+}
+/** gc + live-session enumeration; `sessions === null` ⇒ enumeration failed (bail). */
+async function observeVmSessions(deps) {
+    let error = null;
+    try {
+        const reaped = await deps.vm.gc();
+        if (reaped > 0)
+            deps.log.emit('info', 'vm reaper: gondolin gc collected stale sessions', { reaped });
+    }
+    catch (err) {
+        error = `gondolin gc failed: ${err.message}`;
+        deps.log.emit('warn', 'vm reaper: gondolin gc failed', { error: err.message });
+    }
+    try {
+        const sessions = (await deps.vm.listSessions()).filter((s) => s.alive).map((s) => ({ pid: s.pid, label: s.label }));
+        return { sessions, error };
+    }
+    catch (err) {
+        deps.log.emit('warn', 'vm reaper: session enumeration failed', { error: err.message });
+        return { sessions: null, error: `session enumeration failed: ${err.message}` };
+    }
+}
+/**
+ * Drive one session's SIGTERM→grace→probe→SIGKILL escalation: the pure
+ * beginKill/foldKillStep emit the next KillStep, applyKillStep performs its IO
+ * and returns the result the fold consumes. Bounded by the pure terminal-`done`
+ * state. Returns the terminal error message (if any) for the snapshot.
+ */
+async function driveKill(deps, applyKillStep, ledgers, action, selfPid) {
+    let lastError = null;
+    let decision = deps.core.beginKill(action, selfPid);
+    ledgers.vm = applyKillLedger(ledgers.vm, decision, deps.core, deps.clock);
+    let guard = 0;
+    while (decision.next.kind !== 'done' && guard < 16) {
+        guard += 1;
+        const result = await applyKillStep(decision.next);
+        decision = deps.core.foldKillStep(decision.next, result);
+        ledgers.vm = applyKillLedger(ledgers.vm, decision, deps.core, deps.clock);
+        if (decision.ledger.op === 'error')
+            lastError = decision.ledger.message;
+    }
+    return lastError;
+}
+// ─── workspace janitor pass ─────────────────────────────────────────────────
+async function workspacePass(deps, ledgers) {
+    const { core, log } = deps;
+    const cfg = deps.getCfg();
+    const routing = deps.derivePrRouting(cfg);
+    const obs = await observeWorkspaceState(deps, cfg);
+    if (obs.error !== null) {
+        log.emit('warn', 'workspace reconcile: observe failed', { error: obs.error });
+        return core.ledgerResourceSnapshot(ledgers.workspace, { ready: true, last_error: obs.error });
+    }
+    const decision = core.decideWorkspace({ ...obs.observation, prMergeState: routing.mergeState });
+    for (const l of decision.logs)
+        log.emit(l.level, l.message, l.fields);
+    let lastError = null;
+    for (const action of decision.actions)
+        lastError = (await applyWorkspaceAction(deps, ledgers, action, cfg)) ?? lastError;
+    for (const mark of decision.marks) {
+        ledgers.workspace = core.ledgerRecord(ledgers.workspace, `mark_${mark.status}:${mark.identifier}`, 'done', deps.clock.iso(), mark.reason);
+    }
+    if (decision.lastError)
+        lastError = decision.lastError;
+    return core.ledgerResourceSnapshot(ledgers.workspace, { ready: true, last_error: lastError });
+}
+/** Observe the workspace inputs; `error` set ⇒ fail closed (leave dirs untouched). */
+async function observeWorkspaceState(deps, cfg) {
+    const empty = { desired: [], observed: [], baseRefSha: null, inspections: {}, handoffPending: new Set() };
+    let desired;
+    try {
+        desired = await observeDesiredWorkspaces(deps, cfg);
+    }
+    catch (err) {
+        return { error: `active_fetch_failed: ${err.message}`, observation: empty };
+    }
+    let observed;
+    try {
+        observed = await deps.workspace.list();
+    }
+    catch (err) {
+        return { error: `workspace_root_read_failed: ${err.message}`, observation: empty };
+    }
+    const baseRefSha = await resolveBaseRefSha(deps, cfg);
+    const inspections = baseRefSha === null ? {} : await observeInspections(deps, cfg, desired, observed);
+    const handoffPending = await observeHandoffMarkers(deps, desired, observed);
+    return { error: null, observation: { desired, observed, baseRefSha, inspections, handoffPending } };
+}
+/** Apply one create/remove workspace action through the port; ledger + return any error. */
+async function applyWorkspaceAction(deps, ledgers, action, cfg) {
+    const { core, clock } = deps;
+    const isRemove = action.kind === 'remove_workspace';
+    const key = isRemove ? `remove_workspace:${action.identifier}` : `create_workspace:${sanitizeWorkspaceKey(action.identifier)}`;
+    ledgers.workspace = core.ledgerStart(ledgers.workspace, key, clock.iso());
+    try {
+        if (isRemove)
+            await deps.workspace.remove(action.identifier, 'stale_issue');
+        else
+            await deps.workspace.ensureFor(action.identifier, { baseBranch: cfg.workspace.base_branch, githubRepo: cfg.workspace.github_repo });
+        ledgers.workspace = core.ledgerDone(ledgers.workspace, key, clock.iso());
+        return null;
+    }
+    catch (err) {
+        const msg = err.message;
+        ledgers.workspace = core.ledgerError(ledgers.workspace, key, msg, clock.iso());
+        return msg;
+    }
+}
+// ─── PR autopilot pass ──────────────────────────────────────────────────────
+async function prPass(deps, pr, ledgers) {
+    const cfg = deps.getCfg();
+    if (!cfg.pr.enabled)
+        return null;
+    const routing = deps.derivePrRouting(cfg);
+    if (routing.mergeState === null && routing.closeState === null)
+        return null;
+    const intents = await collectPrIntents(deps, cfg, routing);
+    pr.dropExcept(new Set(intents.map((i) => i.identifier)));
+    let lastError = null;
+    for (const intent of intents) {
+        try {
+            await drivePrIntent(deps, pr, ledgers, intent, routing);
+        }
+        catch (err) {
+            lastError = err.message;
+            deps.log.emit('warn', 'pr reconcile: per-issue pass threw', { identifier: intent.identifier, error: lastError });
+        }
+    }
+    return deps.core.ledgerResourceSnapshot(ledgers.pr, { ready: true, last_error: lastError });
+}
+async function drivePrIntent(deps, pr, ledgers, intent, routing) {
+    const { core, clock } = deps;
+    let obs = freshObservation(deps, intent, routing);
+    for (let i = 0; i < core.maxPrDecideIterations; i += 1) {
+        const effects = core.decidePr(obs);
+        if (effects.length === 0)
+            return;
+        for (const effect of effects) {
+            ledgers.pr = recordPrLedger(ledgers.pr, effect, 'start', clock, core);
+            const outcome = await pr.apply(intent, effect);
+            ledgers.pr = recordPrLedger(ledgers.pr, effect, 'done', clock, core);
+            obs = core.foldPrEffectOutcome(obs, effect, outcome);
+        }
+    }
+    deps.log.emit('warn', 'pr reconcile: decide loop iteration cap reached', { identifier: intent.identifier });
+}
+function freshObservation(deps, intent, routing) {
+    return {
+        intent,
+        cache: EMPTY_PR_CACHE,
+        summaryResolved: false,
+        summary: null,
+        viewResolved: false,
+        view: null,
+        closeAttempted: false,
+        closeOutcome: null,
+        halt: false,
+        config: { strategy: routing.strategy, conflictRouteTo: routing.conflictRouteTo ?? firstActiveState(deps.getCfg()) },
+    };
+}
+//# sourceMappingURL=main-reconcilers.js.map

package/dist/shell/main-reconcilers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main-reconcilers.js","sourceRoot":"","sources":["../../src/shell/main-reconcilers.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,wEAAwE;AACxE,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,kEAAkE;AAClE,6EAA6E;AAC7E,uDAAuD;AACvD,oFAAoF;AACpF,EAAE;AACF,2EAA2E;AAa3E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG;QACd,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QAClD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;KACrC,CAAC;IACF,OAAO;QACL,MAAM,EAAE;YACN,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC;YAC9C,SAAS,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC;YAC7C,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC;SACpC;QACD,aAAa;QACb,aAAa,EAAE,EAAE,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC;AASD,+EAA+E;AAE/E,KAAK,UAAU,MAAM,CAAC,IAAwB,EAAE,aAA+C,EAAE,OAAgB;IAC/G,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3B,iEAAiE;IACjE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC/B,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IAEvH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5G,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,GAAG;YAAE,SAAS,GAAG,GAAG,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,iBAAiB,CAAC,IAAwB;IACvD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,iDAAiD,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACvG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,GAAG,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,+BAA+B,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,uCAAuC,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAClG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,+BAAgC,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC5F,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CACtB,IAAwB,EACxB,aAA+C,EAC/C,OAAgB,EAChB,MAAyB,EACzB,OAAe;IAEf,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,QAAQ,GAAqB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtE,OAAO,CAAC,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACnD,KAAK,IAAI,CAAC,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClD,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,CAAC,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,OAAO;YAAE,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,aAAa,CAAC,IAAwB,EAAE,OAAgB;IACrE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAE1C,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAChG,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAEtE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO;QAAE,SAAS,GAAG,CAAC,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC;IACzH,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS;QAAE,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACvD,OAAO,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,qBAAqB,CAClC,IAAwB,EACxB,GAAkB;IAElB,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;IAClH,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,wBAAyB,GAAa,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,+BAAgC,GAAa,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtG,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,CAAC;AACtG,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,oBAAoB,CACjC,IAAwB,EACxB,OAAgB,EAChB,MAA6E,EAC7E,GAAkB;IAElB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,oBAAoB,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/H,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,IAAI,QAAQ;YAAE,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;;YACvE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QACzI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,MAAM,CAAC,IAAwB,EAAE,EAAa,EAAE,OAAgB;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE5E,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,EAAE,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAEzD,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAI,GAAa,CAAC,OAAO,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAwB,EAAE,EAAa,EAAE,OAAgB,EAAE,MAAgB,EAAE,OAAkB;IAC1H,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC7B,IAAI,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/C,OAAO,CAAC,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACrE,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,iDAAiD,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAwB,EAAE,MAAgB,EAAE,OAAkB;IACtF,OAAO;QACL,MAAM;QACN,KAAK,EAAE,cAAc;QACrB,eAAe,EAAE,KAAK;QACtB,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,KAAK;QACnB,IAAI,EAAE,IAAI;QACV,cAAc,EAAE,KAAK;QACrB,YAAY,EAAE,IAAI;QAClB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;KACpH,CAAC;AACJ,CAAC"}

package/dist/shell/main-runner.js

@@ -0,0 +1,355 @@
+// FCIS rewrite — RUNNER-slice construction for the composition root (kind: shell).
+//
+// THE CAPSTONE WIRING. Replaces the `runWorker: async () => undefined` stub with a
+// real per-dispatch worker: it builds the per-attempt `RunnerLoopDeps` (the
+// workspace→VM→ACP→turn-loop→actions pipeline `runAttempt` drives), the terminal-
+// actions runner, the SINGLE dispatcher-backed VM bring-up (the real
+// `GondolinDispatcher`: stages the guest files INCL. the vm-agent.mjs launcher,
+// builds the `{ tcp: { hosts }, dns }` tunnel, runs the BYO probe + the §2a security
+// mount guard, registers the per-VM egress secret, and launches the agent), and the
+// DispatchRunner (`runWorker`) the orchestrator loop spawns per dispatch.
+//
+// PER-DISPATCH BRACKETING (the contract the task pins):
+//   • MCP lifecycle: an `mcp` activate effect at bring-up (mints the per-dispatch
+//     bearer the guest's tools/call authenticates with; the token rides back on the
+//     EffectResult) and an `mcp` deactivate effect at teardown (entry removed + parked
+//     steering cancelled). Both cross the CENTRAL interpreter, NOT a direct poke on the
+//     runtime read surface (the app-db one-mutation-seam rule).
+//   • ACP dispatch context: registered (vmId → issue/workspace + the MCP server set)
+//     when the VM comes up so `sessionNew(vmId)` resolves; deregistered at teardown.
+//   • the SECURITY mount guard fires IMMEDIATELY before createVm (host-only-refresh),
+//     over BOTH the lexical AND the realpath-resolved mount set (symlink bypass).
+//   • ONE AdapterCredentialSpec per dispatch threaded through guest staging + the
+//     egress hooks (placeholder parity), keyed on the LIVE token (codex route active).
+//
+// Core-free: imports src/types + sibling shell ONLY — every pure decider arrives
+// injected via `input.core` (only the composition root imports core).
+import os from 'node:os';
+import { realpath } from 'node:fs/promises';
+import { runAttempt } from './runner-loop.js';
+import { createActionsRunner } from './actions-runner.js';
+import { GondolinDispatcher } from './adapter/gondolin-dispatch.js';
+/**
+ * Build the runner slice: returns the `runWorker` DispatchRunner the orchestrator
+ * loop calls per dispatch plan. Everything per-dispatch (adapter resolution, the
+ * single dispatcher-backed VM bring-up, the MCP/ACP bracketing) is captured in a
+ * closure so the loop just hands it `(plan, entry, cancel)`.
+ */
+export function buildRunnerSlice(input) {
+    const actions = createActionsRunner({
+        core: input.core.actions,
+        interpreter: input.ports.interpreter,
+        clock: input.ports.clock,
+        log: input.ports.log,
+        runlog: input.ports.runlog,
+        cfg: input.getLiveCfg,
+        readEnv: input.readEnv,
+    });
+    const runWorker = async (plan, entry, cancel) => {
+        await runOneDispatch(input, actions, plan, entry, cancel);
+    };
+    return { runWorker };
+}
+// ─── one dispatch: activate MCP, run the attempt, deactivate, report exit ──────
+async function runOneDispatch(input, actions, plan, entry, cancel) {
+    const { core, substrates } = input;
+    // Pin the dispatch-time actor on the entry (RunningEntry.resolved_actor) so the
+    // dashboard + breaker-trip moves carry `<adapter>/<model>` (§2c resolveActorString).
+    const cfg = input.getLiveCfg();
+    entry.resolved_actor = core.resolveActorString(cfg.states, cfg.acp.adapter, cfg.acp.model, entry.issue.state);
+    // MCP activate at bring-up: mint the per-dispatch bearer the in-VM agent's
+    // tools/call authenticates with. The bearer + the synthetic-guest MCP URL form
+    // the MCP server descriptor the ACP session advertises.
+    const mcpServers = await activateMcp(input, entry);
+    // Register the `/acp` WS registration NOW — BEFORE the agent launches — so the
+    // dial-back token in the launch env matches a pending registration the guest dials
+    // back against. The returned `acpReg.token` is threaded into the VmPlan launch env
+    // (buildRunnerDeps → runAttempt → buildVmPlan), and `acpReg.accepted` is carried
+    // into the ACP dispatch context so `sessionNew` CONSUMES it (it must NOT register a
+    // second, divergent token — that late-registration race was the dial-back rejection).
+    const acpReg = substrates.acpRegistry.register(entry.issue_id, entry.identifier);
+    // ONE AdapterCredentialSpec per dispatch (codex HIGH): the randomized placeholder
+    // is built ONCE and memoized, then threaded through BOTH guest staging (→ buildVmPlan)
+    // AND the egress substitution hooks, so the guest placeholder and the substitution
+    // placeholder can never diverge. Keyed by adapter (one per dispatch in practice).
+    const specFor = buildDispatchSpec(input);
+    const credStager = buildCredStager(input, specFor);
+    const bringUp = buildBringUp(input, entry, mcpServers, specFor, acpReg);
+    let outcome;
+    try {
+        const deps = buildRunnerDeps(input, credStager, actions, bringUp, cfg, acpReg.token);
+        outcome = await runAttemptSafely(input, deps, entry, cancel);
+    }
+    finally {
+        // Teardown bracket: MCP deactivate + ACP context deregister always run, even on
+        // a thrown attempt, so a dispatch's control-plane registrations never leak. Cancel
+        // the WS registration too so a dispatch that tore down before the guest connected
+        // doesn't leave a pending registration (and its unsettled `accepted` promise) behind.
+        // The deactivate crosses the seam as an `mcp` effect (removes the active entry +
+        // cancels any parked steering inside the runtime) — never a direct poke.
+        await input.ports.interpreter.execute({ family: 'mcp', kind: 'deactivate', identifier: entry.identifier });
+        deregisterAcpContext(input, entry);
+        acpReg.cancel('dispatch_ended');
+    }
+    reportWorkerExit(input, plan, entry, outcome.ok, outcome.reason, outcome.turnsCompleted);
+}
+/**
+ * Per-dispatch ONE-spec resolver (codex HIGH fix). `buildAdapterSpec` mints a fresh
+ * RANDOM placeholder each call, so calling it twice in a dispatch (once for guest
+ * staging, once for egress hooks) yields two different placeholders → the egress
+ * substitution never matches the guest's bearer. This memoizes the spec per adapter
+ * for the dispatch so the SAME `AdapterCredentialSpec` is threaded everywhere.
+ */
+function buildDispatchSpec(input) {
+    const cache = new Map();
+    return (adapter) => {
+        const hit = cache.get(adapter);
+        if (hit)
+            return hit;
+        const spec = input.substrates.credential.buildAdapterSpec(adapter);
+        cache.set(adapter, spec);
+        return spec;
+    };
+}
+/** Run one attempt, converting a thrown worker into an abnormal-exit outcome. */
+async function runAttemptSafely(input, deps, entry, cancel) {
+    try {
+        const result = await runAttempt(deps, entry.issue, entry.retry_attempt, cancel, entry);
+        if (result.threadId)
+            entry.thread_id = result.threadId;
+        entry.turn_count = result.turnsCompleted;
+        return { ok: result.ok, reason: result.reason, turnsCompleted: result.turnsCompleted };
+    }
+    catch (err) {
+        input.ports.log.withIssue(entry.issue_id).emit('error', 'runner worker threw', { error: err.message });
+        return { ok: false, reason: err.message, turnsCompleted: 0 };
+    }
+}
+/** MCP activate → the guest MCP server descriptor (bearer + synthetic-guest URL). */
+async function activateMcp(input, entry) {
+    const cfg = input.getLiveCfg();
+    if (!cfg.mcp.enabled)
+        return [];
+    // Cross the seam: the central interpreter performs the `mcp` activate effect
+    // (registers the live entry + mints the bearer) and hands the token back on the
+    // EffectResult — the runner never pokes the runtime's active-entry map directly.
+    const res = await input.ports.interpreter.execute({ family: 'mcp', kind: 'activate', entry });
+    const token = 'kind' in res && res.kind === 'mcp_activated' ? res.token : null;
+    if (!token) {
+        input.ports.log.withIssue(entry.issue_id).emit('warn', 'mcp activate produced no bearer; tools/call disabled', {
+            reason: 'error' in res ? res.error : 'unexpected effect result',
+        });
+        return [];
+    }
+    entry.mcp_token = token;
+    const url = input.core.guestMcpUrl(entry.identifier, { host: cfg.mcp.host, explicit_host_url: cfg.mcp.explicit_host_url }, input.boundMcpPort());
+    if (!url) {
+        input.ports.log.withIssue(entry.issue_id).emit('warn', 'mcp enabled but no reachable url', {
+            host: cfg.mcp.host,
+            explicit_host_url: cfg.mcp.explicit_host_url,
+        });
+        return [];
+    }
+    return [{ type: 'http', name: 'symphony', url, headers: [{ name: 'Authorization', value: `Bearer ${token}` }] }];
+}
+/** Deregister the ACP dispatch context for every vm id this dispatch registered. */
+function deregisterAcpContext(input, entry) {
+    const vmId = vmIdFor.get(entry.issue_id);
+    if (vmId) {
+        input.substrates.acpContext.deregister(vmId);
+        vmIdFor.delete(entry.issue_id);
+    }
+}
+/** issueId → live vmId, set by the credential-aware VmClient at createVm. */
+const vmIdFor = new Map();
+/** Fold the attempt outcome into the orchestrator's worker-exit reducer event. */
+function reportWorkerExit(input, plan, entry, ok, reason, turnsCompleted) {
+    if (entry.last_transition)
+        input.ports.runlog.system(entry.issue_id, 'transition', { ...entry.last_transition });
+    input.ports.runlog.system(entry.issue_id, 'attempt_ended', { ok, reason, turns_completed: turnsCompleted });
+    // TODO(compose) §2h: emit `write_summary` here so the sibling `*.summary.json` is
+    // written (core summarizeRunLog → RunLogStore.writeSummary). DEFERRED, not cheap:
+    // summarizeRunLog needs the per-issue accumulated trajectory (the buffered .jsonl
+    // entries), which FsRunLogStore owns internally and does NOT yet surface. Wiring
+    // it means (a) exposing the accumulator off the runlog store and (b) injecting the
+    // core summarizeRunLog into this slice. The .jsonl is written today; only the
+    // reflector's sibling summary is absent. Tracked as the §2h gap.
+    // The orchestrator loop owns the running map + onWorkerExit; it injects the exit
+    // reporter so the runner slice stays decoupled from the loop's internals.
+    input.onWorkerExit({
+        kind: 'worker_exit',
+        issueId: entry.issue_id,
+        identifier: entry.identifier,
+        normal: ok,
+        reason,
+        priorAttempt: entry.retry_attempt,
+        targetState: entry.issue.state,
+        progress: { issue_id: entry.issue_id, identifier: entry.identifier, last_transition: entry.last_transition },
+        trackerRootAtDispatch: entry.tracker_root_at_dispatch,
+        resolvedActor: entry.resolved_actor || null,
+    });
+}
+// ─── the single VM bring-up path (GondolinDispatcher: stage+probe+tunnel+guard) ─
+/**
+ * Build the per-dispatch VM bring-up backed by the REAL {@link GondolinDispatcher} —
+ * the ONE bring-up path (codex CRITICAL: the old bespoke VmClient skipped guest-file
+ * staging, the BYO probe, and the `{ tcp: { hosts }, dns }` tunnel shape). Per call
+ * it: builds the per-VM egress hooks keyed on the LIVE token (so the codex
+ * chatgpt-backend route is active — codex CRITICAL #2), constructs a dispatcher whose
+ * mount guard ALSO resolves symlinks (codex HIGH #3), and dispatches the core-built
+ * VmPlan. The ACP dispatch context is registered the moment the VM exists (onVmCreated),
+ * and the returned `teardown` releases the VM + the per-VM secret registration.
+ */
+function buildBringUp(input, entry, mcpServers, specFor, acpReg) {
+    const { core, ports, substrates } = input;
+    const dispatcher = new GondolinDispatcher(ports.baseVm, substrates.credential.registry, core.assertNoCredentialMounts, resolveMountRealpath, core.byoProbeFailureMessage, core.byoProbeScript, core.miseInstallFailureMessage, core.hasProjectMiseConfig, ports.log);
+    return {
+        bringUp: async (req) => {
+            // The live credential keys the codex chatgpt-backend route swap (PR#119) — the
+            // REAL token lands ONLY in the egress SecretManager + the route hook (host side),
+            // NEVER in the guest (the guest holds the placeholder from the SAME spec).
+            const token = await resolveLiveToken(ports, req.adapterId);
+            const egress = buildEgress(input, req.adapterId, specFor(req.adapterId), token);
+            const opts = {
+                plan: req.plan,
+                launchEnv: req.launchEnv,
+                // The probe resolves the ADAPTER CLI name on PATH — NOT the launcher path
+                // (plan.agentCommand is `[node, launcher]`). core threads the CLI name into
+                // launchEnv.SYMPHONY_ADAPTER_BIN (same value the launcher spawns); fall back
+                // to the adapter id only if absent.
+                adapterBin: req.launchEnv.SYMPHONY_ADAPTER_BIN ?? req.adapterId,
+                workdir: req.workspacePath,
+                egress,
+                onStderr: req.onStderr,
+                onVmCreated: (vmId) => {
+                    vmIdFor.set(entry.issue_id, vmId);
+                    // Carry the dial-back stream of the WS registration created BEFORE bring-up so
+                    // `sessionNew(vmId)` CONSUMES the same `accepted` the guest (presenting the
+                    // launch-env token) resolves — no second, mismatched registration.
+                    substrates.acpContext.register(vmId, {
+                        issueId: entry.issue_id,
+                        identifier: entry.identifier,
+                        workspacePath: req.workspacePath || entry.workspace_path,
+                        mcpServers,
+                        accepted: acpReg.accepted,
+                        cancelAccept: acpReg.cancel,
+                    });
+                },
+            };
+            const handle = await dispatcher.dispatch(opts);
+            return { vm: handle.vm, exec: handle.exec, teardown: () => handle.teardown() };
+        },
+    };
+}
+/** Resolve the live host credential for this dispatch (null = none / will 401 visibly). */
+async function resolveLiveToken(ports, adapter) {
+    try {
+        return await ports.credentialPort.probe(adapter);
+    }
+    catch (err) {
+        ports.log.emit('warn', 'credential probe failed; egress route built without live token', {
+            adapter, error: err.message,
+        });
+        return null;
+    }
+}
+/**
+ * Build the per-dispatch egress hooks + secret manager from the ONE shared spec.
+ * The live `token` keys the codex chatgpt-backend route swap (PR#119); the secret
+ * substitution + egress audit are wired inside the substrate. The SAME spec.placeholder
+ * is staged into the guest (buildFakeCreds) so the substitution matches at egress.
+ */
+function buildEgress(input, adapterId, spec, token) {
+    const { credential } = input.substrates;
+    const hooksConfig = credential.buildHooksConfig([spec], input.getLiveCfg().egress.allowed_hosts);
+    const result = credential.buildPerVmHooks({
+        adapterId,
+        secretName: spec.secretName,
+        placeholder: spec.placeholder,
+        substitutionHosts: spec.substitutionHosts,
+        allowedHosts: hooksConfig.allowedHosts,
+        token,
+    });
+    return {
+        httpHooks: result.httpHooks,
+        secretManager: result.secretManager,
+        secretName: spec.secretName,
+        adapterId,
+    };
+}
+/**
+ * Symlink-resolving mount canonicalizer (IO) injected into the dispatcher's guard so
+ * a symlink whose lexical path is benign but whose target overlaps a credential dir
+ * is still rejected (codex HIGH). A non-existent path resolves to itself (it can't be
+ * mounted anyway — the lexical check then governs).
+ */
+const resolveMountRealpath = async (hostPath) => {
+    try {
+        return await realpath(hostPath);
+    }
+    catch {
+        return hostPath;
+    }
+};
+// ─── per-adapter fake-cred staging (CredStager) ────────────────────────────────
+/**
+ * Build the CredStager from the per-dispatch shared spec resolver: the guest is
+ * staged the placeholder-only fake creds keyed on the SAME `AdapterCredentialSpec`
+ * the egress hooks substitute (codex HIGH #4 — one spec, threaded everywhere).
+ */
+function buildCredStager(input, specFor) {
+    const { credential } = input.substrates;
+    return {
+        stageFakeCreds: async (adapter) => {
+            const spec = specFor(adapter);
+            const [claudeIdentity, codexIdentity] = await Promise.all([
+                input.ports.credentialPort.readClaudeIdentity(),
+                input.ports.credentialPort.readCodexIdentity(),
+            ]);
+            return credential.buildFakeCreds({ adapter, placeholder: spec.placeholder, secretName: spec.secretName, claudeIdentity, codexIdentity });
+        },
+    };
+}
+// ─── per-attempt RunnerLoopDeps assembly ───────────────────────────────────────
+function buildRunnerDeps(input, credStager, actions, bringUp, cfg, acpToken) {
+    const { core, ports, substrates } = input;
+    return {
+        cfg,
+        workflow: input.getWorkflow(),
+        core: core.loop,
+        workspaces: ports.workspaces,
+        tracker: ports.tracker,
+        bringUp,
+        acp: ports.acp,
+        adapters: ports.adapters,
+        actions,
+        credStager,
+        steering: substrates.mcp.steering,
+        // Teardown's steering.cancel rides the SAME central interpreter the HTTP reply path
+        // does (issue 200): emit the Effect through ports.interpreter, never poke the awaiter.
+        performSteering: (effect) => ports.interpreter.execute(effect),
+        runlog: ports.runlog,
+        log: ports.log,
+        clock: ports.clock,
+        random: ports.random,
+        launcherSource: input.launcherSource,
+        // The symphony-bundled mise SYSTEM config source (issue 209), read off host disk
+        // once at startup; core always stages it at /etc/mise/config.toml (issue 233).
+        miseSystemConfigSource: input.miseSystemConfigSource,
+        // The pre-minted ACP bearer (AcpWsRegistry.register) — the SAME token the
+        // dial-back registration is keyed on (unified-token fix).
+        acpToken,
+        boundMcpPort: input.boundMcpPort(),
+        resolvedNodeBin: input.resolvedNodeBin(),
+        allowWebSockets: (adapter) => adapter === 'codex',
+        // In-session 401 recovery (issue 214): refresh the host token + fan it out into the
+        // live VM's SecretManager, reporting whether a fresh token landed.
+        refreshCredential: (adapter) => substrates.credential.refreshCredential(adapter),
+        // Resolved at dispatch time (issue 206): the asset auto-converted from
+        // `gondolin.oci_image`, or null when inactive / not yet ready. buildVmPlan uses
+        // it as the boot imagePath only when the `gondolin.image` escape hatch is unset.
+        convertedImageSelector: input.resolveImageSelector?.() ?? null,
+        readEnv: input.readEnv,
+    };
+}
+//# sourceMappingURL=main-runner.js.map

package/dist/shell/main-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main-runner.js","sourceRoot":"","sources":["../../src/shell/main-runner.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,mFAAmF;AACnF,4EAA4E;AAC5E,kFAAkF;AAClF,qEAAqE;AACrE,gFAAgF;AAChF,qFAAqF;AACrF,oFAAoF;AACpF,0EAA0E;AAC1E,EAAE;AACF,wDAAwD;AACxD,kFAAkF;AAClF,oFAAoF;AACpF,uFAAuF;AACvF,wFAAwF;AACxF,gEAAgE;AAChE,qFAAqF;AACrF,qFAAqF;AACrF,sFAAsF;AACtF,kFAAkF;AAClF,kFAAkF;AAClF,uFAAuF;AACvF,EAAE;AACF,iFAAiF;AACjF,sEAAsE;AAEtE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAY5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAIpE;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;QACxB,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;QACxB,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG;QACpB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;QAC1B,GAAG,EAAE,KAAK,CAAC,UAAU;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IAEH,MAAM,SAAS,GAA6B,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACxE,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAED,kFAAkF;AAElF,KAAK,UAAU,cAAc,CAC3B,KAAuB,EACvB,OAA+C,EAC/C,IAAkB,EAClB,KAAmB,EACnB,MAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACnC,gFAAgF;IAChF,qFAAqF;IACrF,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;IAC/B,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAE9G,2EAA2E;IAC3E,+EAA+E;IAC/E,wDAAwD;IACxD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAEnD,+EAA+E;IAC/E,mFAAmF;IACnF,mFAAmF;IACnF,iFAAiF;IACjF,oFAAoF;IACpF,sFAAsF;IACtF,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAEjF,kFAAkF;IAClF,uFAAuF;IACvF,mFAAmF;IACnF,kFAAkF;IAClF,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAExE,IAAI,OAAgE,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACrF,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,gFAAgF;QAChF,mFAAmF;QACnF,kFAAkF;QAClF,sFAAsF;QACtF,iFAAiF;QACjF,yEAAyE;QACzE,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3G,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAClC,CAAC;IAED,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,KAAuB;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC7D,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACnE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,gBAAgB,CAC7B,KAAuB,EACvB,IAAoB,EACpB,KAAmB,EACnB,MAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACvF,IAAI,MAAM,CAAC,QAAQ;YAAE,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QACvD,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;IACzF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,WAAW,CAAC,KAAuB,EAAE,KAAmB;IACrE,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAChC,6EAA6E;IAC7E,gFAAgF;IAChF,iFAAiF;IACjF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,sDAAsD,EAAE;YAC7G,MAAM,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,0BAA0B;SAChE,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAChC,KAAK,CAAC,UAAU,EAChB,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,EACpE,KAAK,CAAC,YAAY,EAAE,CACrB,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,kCAAkC,EAAE;YACzF,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI;YAClB,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,iBAAiB;SAC7C,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC;AAED,oFAAoF;AACpF,SAAS,oBAAoB,CAAC,KAAuB,EAAE,KAAmB;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE1C,kFAAkF;AAClF,SAAS,gBAAgB,CACvB,KAAuB,EACvB,IAAkB,EAClB,KAAmB,EACnB,EAAW,EACX,MAAc,EACd,cAAsB;IAEtB,IAAI,KAAK,CAAC,eAAe;QAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;IACjH,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC;IAC5G,kFAAkF;IAClF,kFAAkF;IAClF,kFAAkF;IAClF,iFAAiF;IACjF,mFAAmF;IACnF,8EAA8E;IAC9E,iEAAiE;IACjE,iFAAiF;IACjF,0EAA0E;IAC1E,KAAK,CAAC,YAAY,CAAC;QACjB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,KAAK,CAAC,QAAQ;QACvB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,EAAE;QACV,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,aAAa;QACjC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;QAC9B,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;QAC5G,qBAAqB,EAAE,KAAK,CAAC,wBAAwB;QACrD,aAAa,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AAEnF;;;;;;;;;GASG;AACH,SAAS,YAAY,CACnB,KAAuB,EACvB,KAAmB,EACnB,UAAuB,EACvB,OAAyD,EACzD,MAAyB;IAEzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,kBAAkB,CACvC,KAAK,CAAC,MAAM,EACZ,UAAU,CAAC,UAAU,CAAC,QAAQ,EAC9B,IAAI,CAAC,wBAAwB,EAC7B,oBAAoB,EACpB,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,yBAAyB,EAC9B,IAAI,CAAC,oBAAoB,EACzB,KAAK,CAAC,GAAG,CACV,CAAC;IACF,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,GAAG,EAA4B,EAAE;YAC/C,+EAA+E;YAC/E,kFAAkF;YAClF,2EAA2E;YAC3E,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;YAChF,MAAM,IAAI,GAA4B;gBACpC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,0EAA0E;gBAC1E,4EAA4E;gBAC5E,6EAA6E;gBAC7E,oCAAoC;gBACpC,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,oBAAoB,IAAI,GAAG,CAAC,SAAS;gBAC/D,OAAO,EAAE,GAAG,CAAC,aAAa;gBAC1B,MAAM;gBACN,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;oBACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;oBAClC,+EAA+E;oBAC/E,4EAA4E;oBAC5E,mEAAmE;oBACnE,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE;wBACnC,OAAO,EAAE,KAAK,CAAC,QAAQ;wBACvB,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,KAAK,CAAC,cAAc;wBACxD,UAAU;wBACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,YAAY,EAAE,MAAM,CAAC,MAAM;qBAC5B,CAAC,CAAC;gBACL,CAAC;aACF,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,gBAAgB,CAAC,KAAgC,EAAE,OAAqB;IACrF,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,gEAAgE,EAAE;YACvF,OAAO,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,KAAuB,EACvB,SAAuB,EACvB,IAA2B,EAC3B,KAAuB;IAEvB,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC;IACxC,MAAM,WAAW,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,UAAU,CAAC,eAAe,CAAC;QACxC,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,KAAK;KACN,CAAC,CAAC;IACH,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAsB;QACxC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,oBAAoB,GAAyB,KAAK,EAAE,QAAQ,EAAE,EAAE;IACpE,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC,CAAC;AAEF,kFAAkF;AAElF;;;;GAIG;AACH,SAAS,eAAe,CACtB,KAAuB,EACvB,OAAyD;IAEzD,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC;IACxC,OAAO;QACL,cAAc,EAAE,KAAK,EAAE,OAAqB,EAA8B,EAAE;YAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACxD,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,kBAAkB,EAAE;gBAC/C,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,iBAAiB,EAAE;aAC/C,CAAC,CAAC;YACH,OAAO,UAAU,CAAC,cAAc,CAC9B,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,CACvG,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAElF,SAAS,eAAe,CACtB,KAAuB,EACvB,UAAsB,EACtB,OAA+C,EAC/C,OAAkB,EAClB,GAAkB,EAClB,QAAgB;IAEhB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC1C,OAAO;QACL,GAAG;QACH,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO;QACP,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO;QACP,UAAU;QACV,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ;QACjC,oFAAoF;QACpF,uFAAuF;QACvF,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,iFAAiF;QACjF,+EAA+E;QAC/E,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,0EAA0E;QAC1E,0DAA0D;QAC1D,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;QAClC,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;QACxC,eAAe,EAAE,CAAC,OAAqB,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO;QAC/D,oFAAoF;QACpF,mEAAmE;QACnE,iBAAiB,EAAE,CAAC,OAAqB,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAC9F,uEAAuE;QACvE,gFAAgF;QAChF,iFAAiF;QACjF,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}