smol-symphony 0.3.2 → 0.4.0

package/AGENTS.md

@@ -94,11 +94,14 @@ re-express, not a directive.
 
 ## Build, test, and check before declaring done
 
-- `npm run typecheck` — must pass.
-- `npm test` — must pass.
+- `npm run verify` — must pass (typecheck + eslint purity/budgets + depcruise
+  walls + the three ratcheted arch gates against `arch-baseline.json` + tests).
+  CI runs the same gates, so a red gate here is a red PR.
 - `npm run build` — must pass.
 
-Run all three before calling `symphony.transition` into a terminal state.
+Run both before calling `symphony.transition` into a terminal state. If a gate
+fails "good news" (the count FELL), lower the matching `arch-baseline.json`
+number in the same commit — that is the ratchet locking in the win.
 
 ## Filing tracker issues
 

package/PRODUCT.md

@@ -23,7 +23,7 @@ process is logging.
 
 smol-symphony is a small TypeScript orchestrator that takes Markdown issues off a
 local tracker, prepares per-issue workspaces, and runs coding agents
-(Claude Code, Codex, OpenCode) inside isolated per-issue Gondolin microVMs over
+(Claude Code, Codex) inside isolated per-issue Gondolin microVMs over
 ACP. The
 HTTP dashboard exists to do two things well:
 
@@ -83,7 +83,7 @@ Three patterns this must never resemble:
    stuck?" and "is anything running?" Density beats whitespace luxury for
    the running / retry / issue tables.
 
-4. **Agents are not the brand.** This tool dispatches Claude, Codex, OpenCode —
+4. **Agents are not the brand.** This tool dispatches Claude, Codex —
    it does not perform AI-ness. The product narrative is "small orchestrator
    with isolated VM execution", not "AI-powered work runner". Visual language
    should reflect that.

package/README.md

@@ -5,15 +5,18 @@
 > repository was authored by those agents under human review.
 
 A small TypeScript orchestrator that reads issues off a local Markdown tracker,
-prepares per-issue workspaces, and runs coding agents (Claude Code, Codex,
-OpenCode) inside isolated per-issue [Gondolin](https://github.com/earendil-works/gondolin)
+prepares per-issue workspaces, and runs coding agents (Claude Code, Codex)
+inside isolated per-issue [Gondolin](https://github.com/earendil-works/gondolin)
 microVMs over the [Agent Client Protocol](https://agentclientprotocol.com).
 
-The agent signals progress through an injected MCP server (`transition`,
-`request_human_steering`, `propose_issue`); the orchestrator handles state,
-retry, concurrency, and opens a pull request per issue when configured for
-a GitHub remote. In local-only mode the per-issue branch is left in the
-workspace for review.
+You file issues; symphony dispatches one agent per issue and handles state,
+retry, and concurrency. The agent signals progress through an injected MCP
+server (`transition`, `request_human_steering`, `propose_issue`). When you point
+it at a GitHub remote it opens a pull request per issue; in local-only mode the
+per-issue `agent/<id>` branch is left in the workspace for review.
+
+**New here? Jump to [Quick start](#quick-start)** — install, scaffold, run, with
+no repo checkout and no image to build.
 
 ```
 ┌──────────────────────────────────────────────────────────────────────────┐
@@ -45,96 +48,103 @@ original architectural narrative, see
 
 ## Quick start
 
-The golden path from zero to your first dispatched issue. The details behind
-each step live in [Prerequisites in detail](#prerequisites-in-detail) below — you
-should not need them to get here.
+From zero to your first dispatched issue. **No repo checkout, no image to build** —
+the agent image is a prebuilt asset symphony fetches from a published release the
+first time it runs.
 
 ```bash
-# 1. Build the agent rootfs image once. This ships only `mise` (jdx/mise) — node +
-#    the coding-agent CLIs are mise-installed at dispatch, the launcher is injected —
-#    and tags the result `symphony-agents:latest` — the tag the scaffolded
-#    WORKFLOW.yaml pins, so a first run needs no edit.
-git clone https://github.com/dizk/smol-symphony.git
-cd smol-symphony && npm install && npm run build:image
+# 1. Install symphony. (Or skip this and prefix each command below with `npx`,
+#    e.g. `npx smol-symphony doctor WORKFLOW.yaml`.)
+npm i -g smol-symphony
 
-# 2. In your project, scaffold the minimal WORKFLOW.yaml. With no workflow file
-#    present, symphony offers to write a ~30-line starter (every key required,
-#    no power features), then exits so you can glance at it.
+# 2. In your project, scaffold a starter workflow. With no WORKFLOW.yaml present,
+#    symphony offers to write a ~30-line starter (plus a prompts/Todo.md and an
+#    issue-filing skill), then exits so you can glance at it. It runs as-is.
 cd /path/to/your/project
-npx smol-symphony WORKFLOW.yaml
-
-# 3. Verify the whole setup in one pass before the first dispatch. `symphony
-#    doctor` runs every adoption-prerequisite probe — Node version, the
-#    `gondolin.image` pin, each configured adapter's host credential, a
-#    writable `tracker.root`, and a bindable dashboard port — and prints a
-#    PASS/FAIL line per check with a one-line fix for each failure, exiting 0
-#    iff every check passes. Unlike startup (which bails on the first failure),
-#    it runs all probes so you see the whole picture at once.
-npx smol-symphony doctor WORKFLOW.yaml
-
-# 4. Drop one issue into the tracker.
-mkdir -p issues/Todo
-printf -- '---\ntitle: "Say hi"\n---\nAdd a hi() that returns "hi".\n' > issues/Todo/1.md
-
-# 5. Run symphony and watch it dispatch.
-npx smol-symphony WORKFLOW.yaml --port 8787
-# Open http://127.0.0.1:8787/ — issue 1 moves from "on disk" into a running
-# session as symphony boots a per-issue microVM and dispatches the agent.
+symphony WORKFLOW.yaml
+
+# 3. Check the host is ready before the first dispatch. `doctor` runs every
+#    prerequisite probe — Node version, the agent image, your adapter credential,
+#    a writable tracker, a bindable dashboard port — and prints a PASS/FAIL line
+#    with a one-line fix for each failure, exiting 0 only if every check passes.
+symphony doctor WORKFLOW.yaml
+
+# 4. Run symphony. The first run downloads the prebuilt agent image (one-time,
+#    surfaced on the dashboard); then it serves the dashboard and starts dispatching.
+symphony WORKFLOW.yaml --port 8787
+
+# 5. Open http://127.0.0.1:8787/ and add your first issue from the "new issue"
+#    form. symphony picks it up, boots a per-issue microVM, and dispatches the
+#    agent — watch the issue move from "on disk" into a running session.
 ```
 
-The same first-run scaffold also installs an issue-filing skill at
-`.claude/skills/symphony-issues/SKILL.md` (best-effort — it never blocks the
-workflow scaffold), so a coding agent in the freshly-onboarded repo can file
-well-formed tracker issues and decompose a large task into a `blocked_by` DAG
-from day one.
+That's the whole path. Two host prerequisites symphony can't install for you,
+both checked by `doctor` in step 3:
+
+- **Node.js ≥ 23.6** (the `engines.node` floor; `doctor` reports your version).
+- **One adapter credential.** For the default `claude` adapter, a
+  `~/.claude/.credentials.json` on the host — run `claude login` once. (For
+  `codex`, see [WORKFLOW.template.yaml](./WORKFLOW.template.yaml).) The credential
+  never enters the VM — see [Trust posture](#trust-posture).
 
-The scaffolded file ([WORKFLOW.minimal.yaml](./WORKFLOW.minimal.yaml) is the shipped
-copy) runs as-is once `symphony-agents:latest` exists; the only edits a different
-setup needs are `gondolin.image` (if you pinned a build id) and the adapter
-credential for your chosen agent. When you want a power feature it omits — typed
-action DAGs, PR autopilot, per-state adapters, egress allowlists — graduate to
-the annotated [WORKFLOW.template.yaml](./WORKFLOW.template.yaml).
+The scaffolded [WORKFLOW.minimal.yaml](./WORKFLOW.minimal.yaml) runs as-is on the
+managed image; the only edits a different setup needs are that adapter credential
+and — if you'd rather pin your own image than fetch the managed one —
+`gondolin.image`. The first-run scaffold also drops an issue-filing skill at
+`.claude/skills/symphony-issues/SKILL.md` (best-effort — it never blocks the
+scaffold), so a coding agent in the freshly-onboarded repo can file well-formed
+tracker issues and decompose a large task into a `blocked_by` DAG from day one.
 
-(Or `npm i -g smol-symphony` and then `symphony doctor` / `symphony WORKFLOW.yaml`
-to skip the `npx` fetch — both invoke the `symphony` bin shipped in this
-package.)
+When you want a power feature the starter omits — typed action DAGs, PR autopilot,
+per-state adapters, egress allowlists, sleep-cycle reflection — graduate to the
+annotated [WORKFLOW.template.yaml](./WORKFLOW.template.yaml). Full detail behind
+each step is in [Prerequisites in detail](#prerequisites-in-detail) — you should
+not need it to get here.
 
 ### Prerequisites in detail
 
-- **Node.js ≥ 20.**
-- **The agent rootfs image** (step 1). Gondolin is the in-process microVM
+- **Node.js ≥ 23.6.** The `engines.node` floor; `symphony doctor` reports your
+  running version against it.
+- **The agent image — fetched, not built.** Gondolin is the in-process microVM
   substrate (`@earendil-works/gondolin`), so there is no separate VM daemon to
-  run. The image is built **once** from `images/agents/` via
-  `npm run build:image`: it starts from `node:24-bookworm-slim`, installs base
-  CLI tooling, and ships only the `mise` (jdx/mise) binary. node + every
-  ACP-capable coding agent (`claude-agent-acp`, `codex-acp`, …) are
-  NO LONGER baked — they come from a mise SYSTEM config symphony stages into the
-  guest at dispatch (`assets/symphony-mise.system.toml`) and installs via
-  `mise install` into a warm-cached data dir; a consuming repo's own `mise.toml`
-  adds project toolchains (rust, go, kotlin+gradle, …) on top. The in-VM stdio
-  launcher is likewise injected at dispatch, not baked. So bumping an agent CLI is
-  a one-line edit to the staged mise config + a restart — no image rebuild + repin.
-  The build prints a content-addressed build id; pin it (or the
-  `symphony-agents:latest` tag) in `WORKFLOW.yaml`'s `gondolin.image`. See
-  [images/agents/README.md](./images/agents/README.md) for the build steps and
-  requirements, and `gondolin.mise` in
-  [WORKFLOW.template.yaml](./WORKFLOW.template.yaml) to tune the data dir or opt out.
+  run. The scaffolded workflow sets `gondolin.image: managed`, which fetches a
+  **prebuilt** agent rootfs from a published smol-symphony release on first run —
+  one asset per host arch (`x86_64`, `aarch64`), keyed to the symphony version.
+  No docker, no `npm run build:image`, no local OCI convert. The image ships only
+  the `mise` (jdx/mise) binary; node + every ACP-capable coding agent CLI
+  (`claude-agent-acp`, `codex-acp`) come from a mise SYSTEM config symphony stages
+  into the guest at dispatch (`assets/symphony-mise.system.toml`), and a consuming
+  repo's own `mise.toml` adds project toolchains (rust, go, kotlin+gradle, …) on
+  top. So bumping an agent CLI is a one-line edit to the staged mise config + a
+  restart — no image rebuild. On an unsupported arch (no published asset), or when
+  you'd rather build/pin your own, set `gondolin.image` to a local build id /
+  `name:tag` (`npm run build:image` from a checkout prints one — see
+  [images/agents/README.md](./images/agents/README.md)) or `gondolin.oci_image` to
+  an OCI ref symphony auto-converts on first reconcile. Tune the managed fetch and
+  the mise data dir via the `gondolin` keys in
+  [WORKFLOW.template.yaml](./WORKFLOW.template.yaml).
 - **An adapter credential.** For the default `acp.adapter: claude`: a
-  credentials file at `~/.claude/.credentials.json` on the host. Symphony reads
-  it only on the host side: the guest holds only a token-shaped placeholder, and
-  the host substitutes the real OAuth access token into the outbound request at
-  Gondolin egress (TLS-MITM). The credential file itself is never staged into
-  the VM. (For `acp.adapter: codex`, see [WORKFLOW.template.yaml](./WORKFLOW.template.yaml).)
-- **Skipping the `npx` fetch.** `npm i -g smol-symphony` installs the `symphony`
-  bin globally so `symphony WORKFLOW.yaml` works without re-fetching; the image
-  build still needs a checkout (it lives in `images/agents/`).
+  credentials file at `~/.claude/.credentials.json` on the host (run
+  `claude login` once). Symphony reads it only on the host side: the guest holds
+  only a token-shaped placeholder, and the host substitutes the real OAuth access
+  token into the outbound request at Gondolin egress (TLS-MITM). The credential
+  file itself is never staged into the VM. (For `acp.adapter: codex`, see
+  [WORKFLOW.template.yaml](./WORKFLOW.template.yaml).)
+- **Where state lives.** The tracker, run logs, and per-issue workspaces default
+  to `~/.symphony/{trackers,logs,workspaces}/<project>` — outside your repo, so a
+  delete / re-clone doesn't wipe them. `<project>` is derived from
+  `workspace.github_repo` (or the workflow-file directory name). The startup
+  banner prints the resolved tracker root, workspace root, dashboard URL, and log
+  file; override any with the matching `*.root` key (e.g. `tracker.root: ./issues`
+  to keep issues inside the repo).
 - **Console output.** With the default log file configured, symphony prints a
   one-line-per-field startup banner (workflow, tracker root, dashboard URL,
-  log-file path) and routes the structured `key=value` stream to
-  `.symphony/logs/symphony.log` only. `tail -f` that file to follow the detail.
-  Pass `--verbose` (alias `--foreground`) to mirror the structured stream back
-  to the console for interactive debugging. With no log file configured (the
-  `SYMPHONY_LOG_FILE=""` override), the structured stream stays on stderr.
+  log-file path) and routes the structured `key=value` stream to the log file only
+  (`~/.symphony/logs/<project>/symphony.log` by default). `tail -f` that file to
+  follow the detail. Pass `--verbose` (alias `--foreground`) to mirror the
+  structured stream back to the console for interactive debugging. With no log
+  file configured (the `SYMPHONY_LOG_FILE=""` override), the structured stream
+  stays on stderr.
 
 ### From a checkout
 
@@ -365,12 +375,16 @@ posture:
 
 ```bash
 npm run typecheck    # tsc --noEmit
-npm test             # 170 tests across workflow, tracker, prompt, workspace,
-                     # adapters, http, mcp, acp-bridge, orchestrator, run log,
-                     # runner state resolution, and tool-call summary surfaces
+npm test             # ~1400 tests across the core deciders + shell adapters:
+                     # workflow, tracker, prompt, workspace, adapters, http, mcp,
+                     # acp-bridge, orchestrator, run log, and runner state resolution
 npm run build        # tsc emit to dist/
 ```
 
+`npm run verify` runs the full gate set CI enforces: typecheck, the eslint
+purity/budget rules, the dependency-cruiser layering walls, the ratcheted
+architecture gates, and the tests.
+
 An end-to-end smoke run needs the built agent image (see `images/agents/`).
 
 See [CHANGELOG.md](./CHANGELOG.md) for operator-visible changes between

package/WORKFLOW.template.yaml

@@ -54,13 +54,16 @@ tracker:
 #                and the landing directory for `symphony.propose_issue`.
 #   adapter   (string, optional): override the workflow-level `acp.adapter` for
 #             agents dispatched in this state. Must be a known profile (claude,
-#             codex). Both use host-side credential substitution at Gondolin
+#             codex, pi). All use host-side credential substitution at Gondolin
 #             egress and are startup-probed so a missing credential fails fast.
 #             claude has a single host credential file
 #             (~/.claude/.credentials.json) that is probed for readability; codex
 #             passes when either ~/.codex/auth.json holds a token (ChatGPT-OAuth
 #             tokens.access_token or a top-level OPENAI_API_KEY) or the host
-#             OPENAI_API_KEY env var is set.
+#             OPENAI_API_KEY env var is set; pi passes when ~/.pi/agent/auth.json
+#             holds a `github-copilot` entry (access or refresh token — log in
+#             once with `pi` /login on the host) or the host COPILOT_GITHUB_TOKEN
+#             env var is set.
 #   prompt_file (path): this state's prompt template, in its own file. The shell
 #             loader reads it and assembles `prompt.preamble_file` + this file +
 #             `prompt.footer_file` (see the top-level `prompt:` block below) into
@@ -189,11 +192,20 @@ tracker:
 #             a trigger fires the orchestrator MINTS a FRESH ephemeral issue into
 #             this state (it runs once and terminates in a dedicated terminal),
 #             instead of re-arming one immortal parked ticket. Fields:
-#               • on_idle (bool): spawn when the orchestrator is idle AND >=1
-#                 issue reached a terminal state since the last cycle (the ">=1
-#                 since last cycle" gate is load-bearing — without it an idle
-#                 orchestrator re-spawns in a tight loop with nothing new to
-#                 mine). Default false.
+#               • on_idle (bool): spawn when the orchestrator is idle AND at
+#                 least `idle_min_terminal` issues reached a terminal state since
+#                 the last cycle (the "since last cycle" gate is load-bearing —
+#                 without it an idle orchestrator re-spawns in a tight loop with
+#                 nothing new to mine). Default false.
+#               • idle_min_terminal (int): the idle trigger's signal floor — the
+#                 minimum terminal transitions since the last cycle that on_idle
+#                 requires before it fires. Default 1 (fire on any single finish,
+#                 the historic behavior). Raise it to reflect only once enough new
+#                 signal has accumulated, collapsing strings of single-finish idle
+#                 cycles into one; the after_terminal backstop still covers busy
+#                 stretches, so reflection never starves. Keep it >= 1 — a floor of
+#                 0 lets the idle trigger fire with nothing finished, reintroducing
+#                 the tight re-spawn loop. Has no effect when on_idle is false.
 #               • after_terminal (int): a backstop for busy stretches that never
 #                 go idle — spawn once this many issues have reached a terminal
 #                 state (Done/Cancelled/the spawn's terminal) since the last
@@ -371,9 +383,10 @@ states:
 #     checks the lesson against the evidence rather than the reflector's summary.
 #
 # CADENCE: the orchestrator auto-spawns a fresh reflection issue from the
-# Reflect state's `spawn:` block — `on_idle` (idle with >=1 issue finished since
-# the last cycle) or `after_terminal` (a backstop once N issues have reached a
-# terminal state since the last cycle). The counter resets on a successful mint;
+# Reflect state's `spawn:` block — `on_idle` (idle with >=`idle_min_terminal`
+# issues finished since the last cycle; default 1) or `after_terminal` (a backstop
+# once N issues have reached a terminal state since the last cycle). The counter
+# resets on a successful mint;
 # `max_in_flight: 1` prevents a second cycle while one is live. An operator can
 # also mint a cycle by hand by creating a Reflect issue (a real dashboard
 # "reflect now" button or a `symphony reflect` verb is a natural fit) — a clean
@@ -392,6 +405,7 @@ states:
 #       allowed_transitions: [Reflected]
 #       spawn:
 #         on_idle: true
+#         idle_min_terminal: 3       # idle signal floor (default 1); >=N finished since last cycle
 #         after_terminal: 10         # backstop for busy stretches (0 disables)
 #         title: "Reflection {{ stamp }}"
 #         max_in_flight: 1           # never two reflections live at once
@@ -470,7 +484,8 @@ pr:
 #       role: active
 #       allowed_transitions: [Reflected]
 #       spawn:
-#         on_idle: true            # spawn when idle with >=1 terminal since last cycle
+#         on_idle: true            # spawn when idle with >=idle_min_terminal finished since last cycle
+#         idle_min_terminal: 3     # idle signal floor (default 1)
 #         after_terminal: 10       # spawn after N terminal transitions (0 disables)
 #         title: "Reflection {{ stamp }}"
 #         max_in_flight: 1         # never two reflections live at once
@@ -734,6 +749,11 @@ acp:
   #              bearer (in a fake ~/.codex/auth.json); the host substitutes the
   #              real OpenAI/ChatGPT token at egress. No real credential — and no
   #              real OPENAI_API_KEY — enters the VM.
+  #   pi       — pi-acp wrapping `pi --mode rpc` (the pi coding agent), backed by a
+  #              GitHub Copilot subscription. Same model: the guest holds a
+  #              placeholder COPILOT_GITHUB_TOKEN env bearer; the host substitutes
+  #              the real short-lived Copilot token at egress. No real credential
+  #              enters the VM.
   adapter: claude
 
   # Credentials never enter the VM (issue 113; codex generalized in 116). The
@@ -756,6 +776,23 @@ acp:
   # so codex-acp runs in its native mode without an in-VM OAuth handshake or
   # refresh (both stay host-side). Every credential-bearing var is stripped from
   # the forwarded VM boot env.
+  #
+  # For pi: the host credential is the `github-copilot` entry in
+  # ~/.pi/agent/auth.json — run `pi` once on the host and `/login` with GitHub
+  # Copilot to create it (or export COPILOT_GITHUB_TOKEN with a ready Copilot
+  # bearer). The host reads the short-lived `access` Copilot token (NEVER the
+  # durable `refresh` GitHub-OAuth token) and substitutes it at egress to
+  # api.individual.githubcopilot.com; when it nears expiry the host re-exchanges
+  # the refresh token against api.github.com/copilot_internal/v2/token directly
+  # (no model call) and rewrites auth.json. In the guest, pi resolves its bearer
+  # from the COPILOT_GITHUB_TOKEN placeholder env var (used verbatim — pi's env
+  # path performs no exchange/refresh), and `defaultProvider: github-copilot` is
+  # pinned via a staged ~/.pi/agent/settings.json. Because pi has no built-in MCP
+  # client (and pi-acp ignores the ACP mcpServers descriptor), symphony also
+  # stages a per-dispatch extension at ~/.pi/agent/extensions/symphony-mcp.ts
+  # that bridges the symphony tools (transition / request_human_steering /
+  # propose_issue) to the MCP endpoint. Business/enterprise Copilot endpoints
+  # (api.business.githubcopilot.com etc.) are not wired — individual only.
 
   # model (string | null): optional model selector forwarded to the chosen adapter.
   # Each adapter profile knows how to surface it natively:
@@ -763,6 +800,10 @@ acp:
   #             claude-agent-acp would (aliases like "opus", "sonnet", or full IDs
   #             like "claude-opus-4-7").
   #   codex   — passed as `-c model="<value>"` argv to codex-acp (parsed as TOML).
+  #   pi      — written as `defaultModel` into the staged ~/.pi/agent/settings.json
+  #             (pi-acp forwards no argv and pi has no model env var). Accepts a
+  #             Copilot model id (e.g. "gpt-5", "claude-sonnet-4-6") or pi's
+  #             provider/id + fuzzy forms; unset ⇒ pi's own Copilot default.
   # Leave unset / null to use the adapter's own default model. Default: null.
   # model: claude-opus-4-7
 
@@ -777,6 +818,9 @@ acp:
   #             from drifting from the adapter's own supported list.
   #   codex   — not wired (codex-acp has no first-class effort knob on the wrapper);
   #             setting `acp.effort` for a codex-backed state is a no-op.
+  #   pi      — not wired (pi's thinking level shares the same settings.json the
+  #             model pin is staged into, and the injection channels have no merge
+  #             semantics); setting `acp.effort` for a pi-backed state is a no-op.
   # Leave unset / null for the adapter's own default. Default: null.
   # effort: xhigh
 

package/WORKFLOW.yaml

@@ -101,9 +101,14 @@ states:
     allowed_transitions: [Reflected]
     # Recurring spawn trigger. This active state mints a FRESH ephemeral
     # reflection issue into itself: `on_idle` when the orchestrator is idle and
-    # >=1 issue reached a terminal state since the last cycle, and `after_terminal`
-    # as a backstop once that many issues have reached a terminal state since the
-    # last cycle. The terminal-transition counter resets to 0 on a successful mint.
+    # `idle_min_terminal` issues have reached a terminal state since the last
+    # cycle, and `after_terminal` as a backstop once that many issues have reached
+    # a terminal state since the last cycle. The terminal-transition counter resets
+    # to 0 on a successful mint. `idle_min_terminal: 3` raises the idle signal floor
+    # (was a hardcoded >=1): a quiet period reflects once >=3 issues have finished,
+    # collapsing strings of single-finish idle cycles into one and skipping cycles
+    # with too little new signal. The `after_terminal: 10` backstop still covers
+    # busy stretches, so reflection never starves.
     # `max_in_flight: 1` is load-bearing — it replaces the immortal ticket's
     # built-in "one location = one reflection" mutex, so a busy stretch never mints
     # a second cycle while one is still live. `title` stamps the mint time
@@ -113,6 +118,7 @@ states:
     # approve/discard, so this does not bypass the human gate.
     spawn:
       on_idle: true
+      idle_min_terminal: 3
       after_terminal: 10
       title: "Reflection {{ stamp }}"
       max_in_flight: 1

package/assets/symphony-mise.system.toml

@@ -66,3 +66,9 @@ node = "24"
 "npm:@agentclientprotocol/claude-agent-acp" = "0.39.0"
 "npm:@zed-industries/codex-acp" = { version = "0.15.0", npm_args = "--ignore-scripts=false" }
 "npm:opencode-ai" = { version = "1.15.12", npm_args = "--ignore-scripts=false" }
+# pi (adapter: pi) — the pi coding agent + the pi-acp ACP wrapper that spawns
+# `pi --mode rpc` (pi has no native ACP mode). Both are pure JS with NO install
+# scripts (pi's own docs install with --ignore-scripts), so plain pins suffice.
+# pi-coding-agent needs node >= 22.19 — satisfied by the node pin above.
+"npm:@earendil-works/pi-coding-agent" = "0.79.1"
+"npm:pi-acp" = "0.0.27"

package/dist/core/credential/adapter-config.js

@@ -102,6 +102,27 @@ export function codexPlaceholderAuthSpec() {
         guestPath: CODEX_AUTH_GUEST_PATH,
     };
 }
+// ── pi settings.json (provider + model) ────────────────────────────────────
+/** Absolute guest path pi's global settings.json lands at. */
+export const PI_SETTINGS_GUEST_PATH = '/root/.pi/agent/settings.json';
+/**
+ * The pi `~/.pi/agent/settings.json` spec. pi-acp spawns `pi --mode rpc` with
+ * NO passthrough argv and pi has no model env var, so provider/model selection
+ * rides pi's own global settings file. `defaultProvider` is always pinned to
+ * `github-copilot` (the only provider symphony stages a credential for);
+ * `defaultModel` is included only when a model was chosen (omitted ⇒ pi's own
+ * Copilot default).
+ */
+export function piSettingsSpec(model) {
+    return {
+        stagedName: 'pi-settings.json',
+        content: JSON.stringify({
+            defaultProvider: 'github-copilot',
+            ...(model !== null && model.length > 0 ? { defaultModel: model } : {}),
+        }),
+        guestPath: PI_SETTINGS_GUEST_PATH,
+    };
+}
 /**
  * Aggregate every staged-file spec one adapter dispatch needs into a single
  * `StagedFileSpec[]`, in a stable order (identity/config first, then the
@@ -113,6 +134,9 @@ export function codexPlaceholderAuthSpec() {
  *   • claude    — optional non-secret identity (when extracted) + optional
  *                 effortLevel settings.json (when effort is set).
  *   • codex     — the fake placeholder auth.json (always; the init check needs it).
+ *   • pi        — the settings.json provider/model pin (always; `effort` is not
+ *                 wired for pi — there is no collision-free channel for pi's
+ *                 thinking level alongside the model file).
  */
 export function buildStagedConfigs(input) {
     const specs = [];
@@ -130,6 +154,10 @@ export function buildStagedConfigs(input) {
             specs.push(codexPlaceholderAuthSpec());
             break;
         }
+        case 'pi': {
+            specs.push(piSettingsSpec(input.model));
+            break;
+        }
     }
     return specs;
 }

package/dist/core/credential/adapter-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-config.js","sourceRoot":"","sources":["../../../src/core/credential/adapter-config.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,gEAAgE;AAChE,mFAAmF;AACnF,qEAAqE;AACrE,+EAA+E;AAC/E,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAC/E,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,EAAE;AACF,sFAAsF;AACtF,gFAAgF;AAChF,iFAAiF;AACjF,qFAAqF;AACrF,mDAAmD;AACnD,mFAAmF;AACnF,EAAE;AACF,mDAAmD;AACnD,gFAAgF;AAChF,8EAA8E;AAC9E,kFAAkF;AAClF,0EAA0E;AAC1E,uEAAuE;AACvE,gFAAgF;AAChF,8DAA8D;AAS9D,8EAA8E;AAE9E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AAExE,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO;QACL,UAAU,EAAE,sBAAsB;QAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;QAChD,SAAS,EAAE,0BAA0B;KACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA+B;IAChE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,UAAU,EAAE,aAAa;QACzB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;YACtB,YAAY,EAAE;gBACZ,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;aAC5C;SACF,CAAC;QACF,SAAS,EAAE,0BAA0B;KACtC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,UAAU,EAAE,WAAW;QACvB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;YACtB,cAAc,EAAE,yBAAyB;YACzC,SAAS,EAAE,QAAQ;SACpB,CAAC;QACF,SAAS,EAAE,qBAAqB;KACjC,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IACzD,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAC1D,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;YACvC,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"adapter-config.js","sourceRoot":"","sources":["../../../src/core/credential/adapter-config.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,gEAAgE;AAChE,mFAAmF;AACnF,qEAAqE;AACrE,+EAA+E;AAC/E,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAC/E,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,EAAE;AACF,sFAAsF;AACtF,gFAAgF;AAChF,iFAAiF;AACjF,qFAAqF;AACrF,mDAAmD;AACnD,mFAAmF;AACnF,EAAE;AACF,mDAAmD;AACnD,gFAAgF;AAChF,8EAA8E;AAC9E,kFAAkF;AAClF,0EAA0E;AAC1E,uEAAuE;AACvE,gFAAgF;AAChF,8DAA8D;AAS9D,8EAA8E;AAE9E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AAExE,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO;QACL,UAAU,EAAE,sBAAsB;QAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;QAChD,SAAS,EAAE,0BAA0B;KACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA+B;IAChE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,UAAU,EAAE,aAAa;QACzB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;YACtB,YAAY,EAAE;gBACZ,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;aAC5C;SACF,CAAC;QACF,SAAS,EAAE,0BAA0B;KACtC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,UAAU,EAAE,WAAW;QACvB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;YACtB,cAAc,EAAE,yBAAyB;YACzC,SAAS,EAAE,QAAQ;SACpB,CAAC;QACF,SAAS,EAAE,qBAAqB;KACjC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,OAAO;QACL,UAAU,EAAE,kBAAkB;QAC9B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;YACtB,eAAe,EAAE,gBAAgB;YACjC,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;QACF,SAAS,EAAE,sBAAsB;KAClC,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IACzD,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAC1D,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;YACvC,MAAM;QACR,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/credential/availability.js

@@ -31,7 +31,7 @@ import { nonEmptyString } from './strings.js';
 // The seam between the config layer and the IO adapter layer: both sides agree
 // on which adapter ids exist. The full adapter *profile* lives elsewhere
 // (AdapterProfile / the shell's adapter registry); this is only the id set.
-export const KNOWN_ADAPTER_IDS = ['claude', 'codex'];
+export const KNOWN_ADAPTER_IDS = ['claude', 'codex', 'pi'];
 export function isKnownAdapter(id) {
     return KNOWN_ADAPTER_IDS.includes(id);
 }
@@ -53,6 +53,10 @@ export function hostClaudeCredentialPath(homeDir) {
 export function hostCodexCredentialPath(homeDir) {
     return joinPath(homeDir, '.codex', 'auth.json');
 }
+/** Absolute path to the host's pi credential file (`~/.pi/agent/auth.json`). */
+export function hostPiCredentialPath(homeDir) {
+    return joinPath(homeDir, '.pi', 'agent', 'auth.json');
+}
 // ─── codex credential resolution ─────────────────────────────────────────────
 /**
  * Pure: does codex have a resolvable credential from either valid source? The
@@ -80,6 +84,45 @@ export function codexCredentialAvailable(authFileText, env) {
 export function codexMissingCredentialMessage(homeDir) {
     return `adapter "codex" requires a host credential, but none is available: neither a token in ${hostCodexCredentialPath(homeDir)} (ChatGPT-OAuth tokens.access_token or OPENAI_API_KEY) nor an OPENAI_API_KEY environment variable is present`;
 }
+// ─── pi (GitHub Copilot) credential resolution ───────────────────────────────
+/**
+ * Pure: does pi have a resolvable GitHub-Copilot credential from either valid
+ * source? The host reads two — the `github-copilot` entry in `~/.pi/agent/auth.json`
+ * (either a live short-lived `access` Copilot token or the durable `refresh`
+ * GitHub-OAuth token the host refresher can mint one from) or a
+ * `COPILOT_GITHUB_TOKEN` env var (used verbatim as the Copilot bearer, no
+ * refresh). The shell reads the file (passing `null` when absent/unreadable)
+ * and its env in, mirroring the dispatch-time resolution.
+ */
+export function piCredentialAvailable(authFileText, env) {
+    if (nonEmptyString(env['COPILOT_GITHUB_TOKEN']))
+        return true;
+    if (authFileText === null)
+        return false;
+    let parsed;
+    try {
+        parsed = JSON.parse(authFileText);
+    }
+    catch {
+        return false;
+    }
+    return piAuthFileHasCredential(parsed);
+}
+/** Human-readable explanation of which pi credential sources were checked. */
+export function piMissingCredentialMessage(homeDir) {
+    return `adapter "pi" requires a host credential, but none is available: neither a github-copilot entry in ${hostPiCredentialPath(homeDir)} (run \`pi\` on the host and /login with GitHub Copilot) nor a COPILOT_GITHUB_TOKEN environment variable is present`;
+}
+function piAuthFileHasCredential(parsed) {
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return false;
+    const entry = parsed['github-copilot'];
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+        return false;
+    const rec = entry;
+    // Either a live access token (substitutable now) or the durable refresh token
+    // (the host refresher mints a fresh access token before dispatch needs it).
+    return nonEmptyString(rec['access']) !== null || nonEmptyString(rec['refresh']) !== null;
+}
 function codexAuthFileHasToken(parsed) {
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
         return false;

package/dist/core/credential/availability.js.map

@@ -1 +1 @@
-{"version":3,"file":"availability.js","sourceRoot":"","sources":["../../../src/core/credential/availability.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,oEAAoE;AACpE,6DAA6D;AAC7D,0EAA0E;AAC1E,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,yDAAyD;AACzD,EAAE;AACF,0DAA0D;AAC1D,EAAE;AACF,6DAA6D;AAC7D,2EAA2E;AAC3E,iFAAiF;AACjF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,+EAA+E;AAC/E,oFAAoF;AACpF,uEAAuE;AACvE,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,qEAAqE;AAIrE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,yEAAyE;AACzE,4EAA4E;AAE5E,MAAM,CAAC,MAAM,iBAAiB,GAA4B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAE9E,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAQ,iBAAuC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,yEAAyE;AACzE,oEAAoE;AACpE,MAAM,QAAQ,GAAG,cAAc,CAAC;AAEhC,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,mDAAmD;AAEnD,gGAAgG;AAChG,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAA2B,EAC3B,GAAgB;IAEhB,IAAI,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,yFAAyF,uBAAuB,CACrH,OAAO,CACR,8GAA8G,CAAC;AAClH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAe;IAC5C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,MAAM,IAAI,GAAG,MAAiC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,IAAI,cAAc,CAAE,MAAkC,CAAC,cAAc,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvF,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AAED,sEAAsE;AACtE,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E"}
+{"version":3,"file":"availability.js","sourceRoot":"","sources":["../../../src/core/credential/availability.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,oEAAoE;AACpE,6DAA6D;AAC7D,0EAA0E;AAC1E,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,yDAAyD;AACzD,EAAE;AACF,0DAA0D;AAC1D,EAAE;AACF,6DAA6D;AAC7D,2EAA2E;AAC3E,iFAAiF;AACjF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,+EAA+E;AAC/E,oFAAoF;AACpF,uEAAuE;AACvE,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,qEAAqE;AAIrE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,yEAAyE;AACzE,4EAA4E;AAE5E,MAAM,CAAC,MAAM,iBAAiB,GAA4B,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAEpF,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAQ,iBAAuC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,yEAAyE;AACzE,oEAAoE;AACpE,MAAM,QAAQ,GAAG,cAAc,CAAC;AAEhC,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,mDAAmD;AAEnD,gGAAgG;AAChG,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAA2B,EAC3B,GAAgB;IAEhB,IAAI,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,yFAAyF,uBAAuB,CACrH,OAAO,CACR,8GAA8G,CAAC;AAClH,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAA2B,EAC3B,GAAgB;IAEhB,IAAI,cAAc,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,OAAO,qGAAqG,oBAAoB,CAC9H,OAAO,CACR,qHAAqH,CAAC;AACzH,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAe;IAC9C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,MAAM,KAAK,GAAI,MAAkC,CAAC,gBAAgB,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,8EAA8E;IAC9E,4EAA4E;IAC5E,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,CAAC;AAC3F,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAe;IAC5C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,MAAM,IAAI,GAAG,MAAiC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,IAAI,cAAc,CAAE,MAAkC,CAAC,cAAc,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvF,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AAED,sEAAsE;AACtE,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E"}