waterplane 0.0.1 → 0.1.6

package/packages/host/dist/sidecar/sidecaropenai.js

@@ -0,0 +1,129 @@
+/**
+ * The openai slice of `sidecar.ts` — see that file's header for the seam's rules.
+ */
+import { env } from "../env.js";
+import { sayOnce } from "./sidecarroute.js";
+import { isHalted } from "../halt.js";
+import { localSwapGuard } from "../localslot.js";
+/**
+ * How long a local completion may take.
+ *
+ * Deliberately generous, and not a guess: ollama UNLOADS an idle model, so the
+ * first call after a quiet spell pays a cold load before it generates a token
+ * (~15 s measured here for a small model on this desktop; a larger one on a
+ * busy machine is worse). A tight timeout would make the local engine look
+ * broken exactly when it is doing the thing it was configured to do, and the
+ * cost of waiting is nothing: this call is advisory, runs off a turn boundary,
+ * and blocks no session.
+ */
+const SIDECAR_TIMEOUT_MS = Number(env("SIDECAR_TIMEOUT_MS") || 120_000);
+/**
+ * Completion budget for the local engine.
+ *
+ * Far more than a two-sentence summary needs, on purpose — see the
+ * reasoning-model trap in the header. Tokens on a local model are free; an
+ * empty `content` because the budget went on thinking is a summary nobody gets.
+ */
+const SIDECAR_MAX_TOKENS = Number(env("SIDECAR_MAX_TOKENS") || 2048);
+/** Optional bearer for servers that want one. Ollama does not. */
+const sidecarApiKey = () => env("SIDECAR_API_KEY") || "";
+// ── The openai-compat engine ───────────────────────────────────────────────
+/**
+ * The assistant's text out of a `/chat/completions` body — thinking removed.
+ *
+ * Exported because this is the part that a local model can break in four
+ * different ways, and the assertions belong on a pure function rather than on a
+ * live server. Anything it cannot read is "", which every caller here already
+ * treats as "no answer".
+ */
+export function completionText(body) {
+    const choices = body?.choices;
+    if (!Array.isArray(choices) || choices.length === 0)
+        return "";
+    const first = choices[0];
+    // `reasoning_content` / `reasoning` / `thinking` are deliberately NOT read:
+    // they are the model talking to itself, never the answer.
+    let content = first?.message?.content;
+    if (content === undefined && typeof first?.text === "string")
+        content = first.text; // legacy /completions shape
+    if (Array.isArray(content)) {
+        content = content
+            .map((p) => (typeof p === "string" ? p : p?.type === "text" ? (p.text ?? "") : ""))
+            .join("");
+    }
+    if (typeof content !== "string")
+        return "";
+    return stripThinking(content).trim();
+}
+/**
+ * Drop an inline thinking block.
+ *
+ * Some servers put the reasoning in `content` between `<think>` tags instead of
+ * in its own field. An UNCLOSED block is the response that ran out of budget
+ * mid-thought: everything from the tag on is thinking, so it all goes, and what
+ * is left is usually nothing — which is the correct answer, not a bug.
+ */
+function stripThinking(text) {
+    const closed = text.replace(/<think(?:ing)?>[\s\S]*?<\/think(?:ing)?>/gi, "");
+    const open = closed.search(/<think(?:ing)?>/i);
+    return open >= 0 ? closed.slice(0, open) : closed;
+}
+/**
+ * One completion against an OpenAI-compatible server. No tools, ever.
+ *
+ * Every failure — transport, timeout, non-2xx, unparseable body, empty content
+ * — is "". The caller cannot tell them apart and must not need to: there is one
+ * correct response to all of them, which is to leave what is on screen alone.
+ */
+export async function chatCompletion(route, req) {
+    if (isHalted())
+        return ""; // the emergency halt (`halt.ts`): "" is every failure's answer here
+    const url = `${route.baseURL}/chat/completions`;
+    // Never swap the local model out from under a working coding turn
+    // (`localslot.ts`): same runner, different model, an agent mid-turn ⇒ the
+    // empty result every caller already reads as "no answer".
+    const swap = localSwapGuard(route.baseURL, route.model);
+    if (swap) {
+        sayOnce(swap);
+        return "";
+    }
+    const messages = [
+        ...(req.system ? [{ role: "system", content: req.system }] : []),
+        { role: "user", content: req.prompt },
+    ];
+    const headers = { "content-type": "application/json" };
+    const key = sidecarApiKey();
+    if (key)
+        headers.authorization = `Bearer ${key}`;
+    try {
+        const res = await fetch(url, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({
+                model: route.model,
+                messages,
+                stream: false,
+                max_tokens: req.maxTokens ?? SIDECAR_MAX_TOKENS,
+            }),
+            signal: AbortSignal.timeout(req.timeoutMs ?? SIDECAR_TIMEOUT_MS),
+        });
+        if (!res.ok) {
+            sayOnce(`${url} answered ${res.status} — nothing was summarised by the local engine.`);
+            return "";
+        }
+        const text = await res.text();
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            return "";
+        }
+        return completionText(parsed);
+    }
+    catch (e) {
+        sayOnce(`${url} could not be reached (${e?.message ?? "no detail"}) — the local engine produced nothing.`);
+        return "";
+    }
+}
+//# sourceMappingURL=sidecaropenai.js.map

package/packages/host/dist/sidecar/sidecaropenai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidecaropenai.js","sourceRoot":"","sources":["../../src/sidecar/sidecaropenai.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGjD;;;;;;;;;;GAUG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC,CAAC;AAErE,kEAAkE;AAClE,MAAM,aAAa,GAAG,GAAW,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;AAEjE,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,MAAM,OAAO,GAAI,IAA8B,EAAE,OAAO,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAoE,CAAC;IAC5F,4EAA4E;IAC5E,0DAA0D;IAC1D,IAAI,OAAO,GAAY,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,4BAA4B;IAChH,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,GAAG,OAAO;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAsC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAE,CAAuB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC/I,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,4CAA4C,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC/C,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAkB,EAAE,GAAgB;IACvE,IAAI,QAAQ,EAAE;QAAE,OAAO,EAAE,CAAC,CAAC,oEAAoE;IAC/F,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,OAAO,mBAAmB,CAAC;IAChD,kEAAkE;IAClE,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IACvC,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;KACtC,CAAC;IACF,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,GAAG;QAAE,OAAO,CAAC,aAAa,GAAG,UAAU,GAAG,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ;gBACR,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,GAAG,CAAC,SAAS,IAAI,kBAAkB;aAChD,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,kBAAkB,CAAC;SACjE,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,GAAG,aAAa,GAAG,CAAC,MAAM,gDAAgD,CAAC,CAAC;YACvF,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QACvD,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,GAAG,0BAA2B,CAAW,EAAE,OAAO,IAAI,WAAW,wCAAwC,CAAC,CAAC;QACtH,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/packages/host/dist/sidecar/sidecarroute.d.ts

@@ -0,0 +1,65 @@
+/** The unattended calls this daemon makes, one routing knob each. */
+export type SidecarTask = "summary" | "assess" | "review" | "name" | "commit";
+/** How a completion is obtained. */
+export type SidecarEngine = "claude-p" | "openai-compat";
+/** The environment variable that routes each task. */
+export declare const SIDECAR_ENV: Readonly<Record<SidecarTask, string>>;
+export interface ClaudeRoute {
+    readonly engine: "claude-p";
+}
+export interface OpenAIRoute {
+    readonly engine: "openai-compat";
+    /** Server base, no trailing slash. `/chat/completions` is appended. */
+    readonly baseURL: string;
+    readonly model: string;
+}
+/** A route that will not be taken, and the sentence saying why. */
+export interface RefusedRoute {
+    readonly engine: "refused";
+    readonly reason: string;
+}
+export type SidecarPlan = ClaudeRoute | OpenAIRoute | RefusedRoute;
+/**
+ * Parse one routing spec.
+ *
+ * Grammar — `.env.example` is authoritative, this is the implementation of it:
+ *
+ * ```
+ *   spec   := "claude" | "claude-p" | "openai-compat:" target
+ *   target := <baseURL> "|" <model>        (exact — use this one)
+ *           | <baseURL> ":" <model>        (accepted where it cannot mis-split)
+ * ```
+ *
+ * **Why a pipe.** The obvious `openai-compat:<baseURL>:<model>` is ambiguous
+ * against real values: the URL carries a colon in its scheme AND its port
+ * (`http://localhost:11434/v1`) and the model carries one in its tag
+ * (`gemma4:e4b`), so there is no colon a splitter can point at and be right.
+ * `|` cannot appear unescaped in a URL and does not appear in a model tag, so
+ * splitting on the first one is exact.
+ *
+ * The colon form is still accepted, because it is what a person will type, but
+ * ONLY in the shape where it is decidable: the URL must have a path, and the
+ * split is the first colon AFTER the start of that path. That reads
+ * `http://localhost:11434/v1:gemma4:e4b` correctly (base `…/v1`, model
+ * `gemma4:e4b`) and REFUSES `http://localhost:11434:model`, which could equally
+ * mean a port or a model. One residual: a URL whose PATH contains a colon
+ * before the model would split early — it then fails as a bad base URL and
+ * yields no completion, never a wrong one, and the pipe form is the fix.
+ *
+ * Anything unrecognised is REFUSED with a sentence. It is never silently
+ * treated as `claude`: the whole reason to set this knob is to stop a call
+ * going to Anthropic, so a typo that quietly sent it there anyway would defeat
+ * the only thing it was for.
+ */
+export declare function parseSidecarSpec(raw: string | undefined | null, envName?: string): SidecarPlan;
+/**
+ * The route one task will take, from the environment.
+ *
+ * Also where a task whose contract needs tools refuses the toolless engine —
+ * in words naming the variable, because the person who set it is the only one
+ * who can unset it.
+ */
+export declare function sidecarPlan(task: SidecarTask, env?: NodeJS.ProcessEnv): SidecarPlan;
+export declare function sayOnce(reason: string): void;
+/** Test seam: forget what has been said, so a case can assert it is said. */
+export declare function resetSidecarWarnings(): void;

package/packages/host/dist/sidecar/sidecarroute.js

@@ -0,0 +1,158 @@
+/**
+ * The route slice of `sidecar.ts` — see that file's header for the seam's rules.
+ */
+import { BRAND, resolveEnv } from "@waterplane/shared";
+/** The environment variable that routes each task. */
+export const SIDECAR_ENV = {
+    summary: `${BRAND.envPrefix}SIDECAR_SUMMARY`,
+    assess: `${BRAND.envPrefix}SIDECAR_ASSESS`,
+    review: `${BRAND.envPrefix}SIDECAR_REVIEW`,
+    name: `${BRAND.envPrefix}SIDECAR_NAME`,
+    commit: `${BRAND.envPrefix}SIDECAR_COMMIT`,
+};
+/**
+ * Does this task's contract need TOOLS?
+ *
+ * The one fact that decides whether the toolless local engine is even
+ * admissible. `summary` is false by construction — see the header.
+
+ */
+const NEEDS_TOOLS = {
+    summary: false,
+    assess: true,
+    review: true,
+    // `name` is on the summary's side of the line and for the summary's reason,
+    // not a weaker one: a naming pass is handed the items' own words and is asked
+    // what to CALL them. It opens no file, runs no git, and could not use a tool
+    // if it had one — the answer is a title for a sentence that is already in the
+    // prompt. It is also the cheapest task here, so it is the one most worth
+    // being able to move off the account entirely.
+    name: false,
+    // `commit` is on the same side of the line, and the reason is the same one
+    // stated three times above: the diff, the file list and the repo's own recent
+    // subjects are IN the prompt. It runs no git of its own, opens no file, and
+    // writes nothing — the answer is a sentence a person then reads, edits and
+    // commits by hand.
+    commit: false,
+};
+// ── Routing ────────────────────────────────────────────────────────────────
+/**
+ * Parse one routing spec.
+ *
+ * Grammar — `.env.example` is authoritative, this is the implementation of it:
+ *
+ * ```
+ *   spec   := "claude" | "claude-p" | "openai-compat:" target
+ *   target := <baseURL> "|" <model>        (exact — use this one)
+ *           | <baseURL> ":" <model>        (accepted where it cannot mis-split)
+ * ```
+ *
+ * **Why a pipe.** The obvious `openai-compat:<baseURL>:<model>` is ambiguous
+ * against real values: the URL carries a colon in its scheme AND its port
+ * (`http://localhost:11434/v1`) and the model carries one in its tag
+ * (`gemma4:e4b`), so there is no colon a splitter can point at and be right.
+ * `|` cannot appear unescaped in a URL and does not appear in a model tag, so
+ * splitting on the first one is exact.
+ *
+ * The colon form is still accepted, because it is what a person will type, but
+ * ONLY in the shape where it is decidable: the URL must have a path, and the
+ * split is the first colon AFTER the start of that path. That reads
+ * `http://localhost:11434/v1:gemma4:e4b` correctly (base `…/v1`, model
+ * `gemma4:e4b`) and REFUSES `http://localhost:11434:model`, which could equally
+ * mean a port or a model. One residual: a URL whose PATH contains a colon
+ * before the model would split early — it then fails as a bad base URL and
+ * yields no completion, never a wrong one, and the pipe form is the fix.
+ *
+ * Anything unrecognised is REFUSED with a sentence. It is never silently
+ * treated as `claude`: the whole reason to set this knob is to stop a call
+ * going to Anthropic, so a typo that quietly sent it there anyway would defeat
+ * the only thing it was for.
+ */
+export function parseSidecarSpec(raw, envName = "the sidecar route") {
+    const spec = (raw ?? "").trim();
+    if (!spec)
+        return { engine: "claude-p" };
+    const lower = spec.toLowerCase();
+    if (lower === "claude" || lower === "claude-p")
+        return { engine: "claude-p" };
+    const PREFIX = "openai-compat";
+    if (!lower.startsWith(PREFIX)) {
+        return { engine: "refused", reason: `${envName} is set to "${spec}", which is not an engine this host knows. It can run: claude, openai-compat:<baseURL>|<model>.` };
+    }
+    const sep = spec.slice(PREFIX.length, PREFIX.length + 1);
+    const target = spec.slice(PREFIX.length + 1);
+    if (sep !== ":" || !target) {
+        return { engine: "refused", reason: `${envName} is set to "${spec}", which names the openai-compat engine but no server. Write it as openai-compat:<baseURL>|<model>, e.g. openai-compat:http://localhost:11434/v1|gemma4:e4b.` };
+    }
+    let rawBase;
+    let model;
+    const pipe = target.indexOf("|");
+    if (pipe >= 0) {
+        rawBase = target.slice(0, pipe);
+        model = target.slice(pipe + 1);
+    }
+    else {
+        // Colon form: find where the URL's PATH begins, then split at the first
+        // colon after it. Before that point every colon belongs to the scheme or
+        // the port, and guessing between them is the mis-split this refuses.
+        const schemeAt = target.indexOf("://");
+        const pathAt = schemeAt >= 0 ? target.indexOf("/", schemeAt + 3) : target.indexOf("/");
+        const at = pathAt >= 0 ? target.indexOf(":", pathAt) : -1;
+        if (at < 0) {
+            return { engine: "refused", reason: `${envName} is set to "${spec}", and where the server URL ends and the model begins cannot be told apart. Separate them with a pipe: openai-compat:<baseURL>|<model>.` };
+        }
+        rawBase = target.slice(0, at);
+        model = target.slice(at + 1);
+    }
+    rawBase = rawBase.trim().replace(/\/+$/, "");
+    model = model.trim();
+    if (!model) {
+        return { engine: "refused", reason: `${envName} is set to "${spec}" and names no model. Write it as openai-compat:<baseURL>|<model>.` };
+    }
+    let parsed;
+    try {
+        parsed = new URL(rawBase);
+    }
+    catch {
+        return { engine: "refused", reason: `${envName} is set to "${spec}" and "${rawBase}" is not a URL. Write it as openai-compat:<baseURL>|<model>, e.g. openai-compat:http://localhost:11434/v1|gemma4:e4b.` };
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return { engine: "refused", reason: `${envName} is set to "${spec}" and "${rawBase}" is not an http(s) URL.` };
+    }
+    return { engine: "openai-compat", baseURL: rawBase, model };
+}
+/**
+ * The route one task will take, from the environment.
+ *
+ * Also where a task whose contract needs tools refuses the toolless engine —
+ * in words naming the variable, because the person who set it is the only one
+ * who can unset it.
+ */
+export function sidecarPlan(task, env = process.env) {
+    const name = SIDECAR_ENV[task];
+    const plan = parseSidecarSpec(resolveEnv(env, name.slice(BRAND.envPrefix.length)).value, name);
+    if (plan.engine === "openai-compat" && NEEDS_TOOLS[task]) {
+        return {
+            engine: "refused",
+            reason: `${name} is set to the openai-compat engine, which runs one completion with no tools. The ${task} task has to read the repo (and write its files), so it cannot run that way and nothing was run. Unset ${name} to run it on claude.`,
+        };
+    }
+    return plan;
+}
+/**
+ * Say a refusal once.
+ *
+ * A misrouted task refuses on every single fire — one per turn-end per session
+ * for the summary — and a line per fire is a log nobody reads. The reason is
+ * the same sentence every time, so the first one is the whole message.
+ */
+const said = new Set();
+export function sayOnce(reason) {
+    if (said.has(reason))
+        return;
+    said.add(reason);
+    console.warn(`[sidecar] ${reason}`);
+}
+/** Test seam: forget what has been said, so a case can assert it is said. */
+export function resetSidecarWarnings() { said.clear(); }
+//# sourceMappingURL=sidecarroute.js.map

package/packages/host/dist/sidecar/sidecarroute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidecarroute.js","sourceRoot":"","sources":["../../src/sidecar/sidecarroute.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAQvD,sDAAsD;AACtD,MAAM,CAAC,MAAM,WAAW,GAA0C;IAChE,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,iBAAiB;IAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,gBAAgB;IAC1C,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,gBAAgB;IAC1C,IAAI,EAAE,GAAG,KAAK,CAAC,SAAS,cAAc;IACtC,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,gBAAgB;CAC3C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,GAA2C;IAC1D,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;IACZ,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,+CAA+C;IAC/C,IAAI,EAAE,KAAK;IACX,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,mBAAmB;IACnB,MAAM,EAAE,KAAK;CACd,CAAC;AAaF,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA8B,EAAE,OAAO,GAAG,mBAAmB;IAC5F,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE9E,MAAM,MAAM,GAAG,eAAe,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,eAAe,IAAI,iGAAiG,EAAE,CAAC;IACvK,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,eAAe,IAAI,8JAA8J,EAAE,CAAC;IACpO,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,KAAa,CAAC;IAClB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACd,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAChC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,eAAe,IAAI,yIAAyI,EAAE,CAAC;QAC/M,CAAC;QACD,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,eAAe,IAAI,oEAAoE,EAAE,CAAC;IAC1I,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,eAAe,IAAI,UAAU,OAAO,uHAAuH,EAAE,CAAC;IAC9M,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,eAAe,IAAI,UAAU,OAAO,0BAA0B,EAAE,CAAC;IACjH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACjF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,MAAM,KAAK,eAAe,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,GAAG,IAAI,qFAAqF,IAAI,0GAA0G,IAAI,uBAAuB;SAC9O,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;AAC/B,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO;IAC7B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,KAAW,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC"}

package/packages/host/dist/sidecar/sidecartasks.d.ts

@@ -0,0 +1,20 @@
+export interface SummaryRequest {
+    readonly cwd: string;
+    /** The whole prompt, transcript included — as `sessions/record.ts` assembles it. */
+    readonly prompt: string;
+    /** The system prompt that replaces Claude Code's own. */
+    readonly system: string;
+    /** The model the claude engine runs on (`WATERPLANE_SUMMARY_MODEL`). */
+    readonly model: string;
+}
+/**
+ * The tab name call (`sessions/record.ts`'s `nameTab`/`nameNow`) — the cheap
+ * toolless completion every other unattended call copies its flags from. (The
+ * identifiers keep the name of the per-turn summary it was written for.)
+ *
+ * Returns "" on every failure, which the callers read as "leave the existing
+ * name alone". That contract is older than this file and is not being
+ * changed: it is the reason a broken sidecar costs an absent name rather than
+ * a wrong one.
+ */
+export declare function runSummaryTask(req: SummaryRequest): Promise<string>;

package/packages/host/dist/sidecar/sidecartasks.js

@@ -0,0 +1,63 @@
+/**
+ * The tasks slice of `sidecar.ts` — see that file's header for the seam's rules.
+ */
+import { detectHeadlessLimit } from "../limit.js";
+import { sayOnce, sidecarPlan } from "./sidecarroute.js";
+import { runHeadlessClaude } from "./sidecarclaude.js";
+import { chatCompletion } from "./sidecaropenai.js";
+/** One line, normalised the way the session row stores it. */
+const tidy = (s) => s.replace(/\s+/g, " ").trim().slice(0, 240);
+/**
+ * The tab name call (`sessions/record.ts`'s `nameTab`/`nameNow`) — the cheap
+ * toolless completion every other unattended call copies its flags from. (The
+ * identifiers keep the name of the per-turn summary it was written for.)
+ *
+ * Returns "" on every failure, which the callers read as "leave the existing
+ * name alone". That contract is older than this file and is not being
+ * changed: it is the reason a broken sidecar costs an absent name rather than
+ * a wrong one.
+ */
+export async function runSummaryTask(req) {
+    const plan = sidecarPlan("summary");
+    if (plan.engine === "refused") {
+        sayOnce(plan.reason);
+        return "";
+    }
+    if (plan.engine === "openai-compat") {
+        return tidy(await chatCompletion(plan, { prompt: req.prompt, system: req.system }));
+    }
+    // ── claude engine: the call as it has always been ──────────────────────
+    const run = await runHeadlessClaude({
+        cwd: req.cwd,
+        args: [
+            "-p", "--output-format", "json",
+            "--model", req.model,
+            // Skip the PROJECT's settings — this is where its CLAUDE.md comes from.
+            "--setting-sources", "user",
+            // Nothing to read: the transcript is in the prompt.
+            "--tools", "",
+            "--system-prompt", req.system,
+        ],
+        prompt: req.prompt,
+        timeoutMs: 60_000,
+        maxBuffer: 4 * 1024 * 1024,
+    });
+    // A run the account refused summarised nothing: its "summary" would be the
+    // quota banner, which is both false as a summary and the last text that
+    // should be paraphrased back onto a session's screen.
+    if (detectHeadlessLimit(run.stdout, run.stderr).blocked)
+        return "";
+    let text = run.stdout;
+    try {
+        const env = JSON.parse(text);
+        // An errored run's `result` is the error ("Failed to authenticate: OAuth
+        // session expired…"), not an answer — it once became a tab's name.
+        if (env && env.is_error === true)
+            return "";
+        if (env && typeof env.result === "string")
+            text = env.result;
+    }
+    catch { /* raw */ }
+    return tidy(text);
+}
+//# sourceMappingURL=sidecartasks.js.map

package/packages/host/dist/sidecar/sidecartasks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidecartasks.js","sourceRoot":"","sources":["../../src/sidecar/sidecartasks.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAcpD,8DAA8D;AAC9D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAmB;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,0EAA0E;IAC1E,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC;QAClC,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,IAAI,EAAE;YACJ,IAAI,EAAE,iBAAiB,EAAE,MAAM;YAC/B,SAAS,EAAE,GAAG,CAAC,KAAK;YACpB,wEAAwE;YACxE,mBAAmB,EAAE,MAAM;YAC3B,oDAAoD;YACpD,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,GAAG,CAAC,MAAM;SAC9B;QACD,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;KAC3B,CAAC,CAAC;IACH,2EAA2E;IAC3E,wEAAwE;IACxE,sDAAsD;IACtD,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACnE,IAAI,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC5C,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC"}

package/packages/host/dist/sidecar/sidecartrust.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Where the CLI keeps its per-folder trust: `$CLAUDE_CONFIG_DIR/.claude.json`,
+ * else `~/.claude.json`. Read at call time, so a test (or an e2e host) can
+ * point it at a fixture through the same variable the CLI itself honours.
+ */
+export declare function claudeConfigPath(e?: NodeJS.ProcessEnv): string;
+/**
+ * Whether the claude CLI trusts `cwd` — **read, never written**.
+ *
+ * Measured on claude 2.1.289, 2026-10-04: `claude -p` in a folder nobody ever
+ * trusted SKIPS the workspace-trust dialog and still loads the repo's own
+ * `.claude/settings.json` — its `SessionStart` and `UserPromptSubmit` hooks ran
+ * — and records nothing. A hook is any shell command, so `assess` and the
+ * reviewers, which keep project settings because they need the repo's
+ * `CLAUDE.md`, would run a freshly cloned repo's code with nobody asked. The
+ * interactive CLI asks; this is the same question, asked of the CLI's own
+ * answer rather than of a second ledger that could disagree with it.
+ *
+ * The rule is the CLI's, measured the same day: a folder whose own entry says
+ * `hasTrustDialogAccepted: false` opened with no dialog because a PARENT said
+ * `true`, and a folder with no trusted ancestor got the dialog. So: trusted iff
+ * the folder or any ancestor is `true`, an own `false` vetoes nothing. Both the
+ * path as given and its realpath are walked (the CLI keys `/private/tmp`, a
+ * caller may hold `/tmp`).
+ *
+ * `null` = the file could not be read or parsed: this cannot tell, and the gate
+ * treats cannot-tell as not trusted — a refusal is a sentence, a wrong yes runs
+ * a stranger's hook.
+ */
+export declare function workspaceTrust(cwd: string, configPath?: string): Promise<boolean | null>;
+/** The sentence a refused run carries, or `undefined` when it may run. */
+export declare function trustRefusal(cwd: string, trust: boolean | null): string | undefined;

package/packages/host/dist/sidecar/sidecartrust.js

@@ -0,0 +1,74 @@
+/**
+ * The trust slice of `sidecar.ts` — see that file's header for the seam's rules.
+ */
+import { readFile, realpath } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+// ── Workspace trust ────────────────────────────────────────────────────────
+/**
+ * Where the CLI keeps its per-folder trust: `$CLAUDE_CONFIG_DIR/.claude.json`,
+ * else `~/.claude.json`. Read at call time, so a test (or an e2e host) can
+ * point it at a fixture through the same variable the CLI itself honours.
+ */
+export function claudeConfigPath(e = process.env) {
+    return join(e.CLAUDE_CONFIG_DIR || homedir(), ".claude.json");
+}
+/**
+ * Whether the claude CLI trusts `cwd` — **read, never written**.
+ *
+ * Measured on claude 2.1.289, 2026-10-04: `claude -p` in a folder nobody ever
+ * trusted SKIPS the workspace-trust dialog and still loads the repo's own
+ * `.claude/settings.json` — its `SessionStart` and `UserPromptSubmit` hooks ran
+ * — and records nothing. A hook is any shell command, so `assess` and the
+ * reviewers, which keep project settings because they need the repo's
+ * `CLAUDE.md`, would run a freshly cloned repo's code with nobody asked. The
+ * interactive CLI asks; this is the same question, asked of the CLI's own
+ * answer rather than of a second ledger that could disagree with it.
+ *
+ * The rule is the CLI's, measured the same day: a folder whose own entry says
+ * `hasTrustDialogAccepted: false` opened with no dialog because a PARENT said
+ * `true`, and a folder with no trusted ancestor got the dialog. So: trusted iff
+ * the folder or any ancestor is `true`, an own `false` vetoes nothing. Both the
+ * path as given and its realpath are walked (the CLI keys `/private/tmp`, a
+ * caller may hold `/tmp`).
+ *
+ * `null` = the file could not be read or parsed: this cannot tell, and the gate
+ * treats cannot-tell as not trusted — a refusal is a sentence, a wrong yes runs
+ * a stranger's hook.
+ */
+export async function workspaceTrust(cwd, configPath = claudeConfigPath()) {
+    let projects;
+    try {
+        const parsed = JSON.parse(await readFile(configPath, "utf8"));
+        projects = parsed && typeof parsed.projects === "object" && parsed.projects !== null
+            ? parsed.projects
+            : {};
+    }
+    catch {
+        return null;
+    }
+    const starts = new Set([resolve(cwd)]);
+    try {
+        starts.add(await realpath(cwd));
+    }
+    catch { /* a folder that is gone is checked as given */ }
+    for (const start of starts) {
+        for (let dir = start;; dir = dirname(dir)) {
+            if (projects[dir]?.hasTrustDialogAccepted === true)
+                return true;
+            if (dirname(dir) === dir)
+                break;
+        }
+    }
+    return false;
+}
+/** The sentence a refused run carries, or `undefined` when it may run. */
+export function trustRefusal(cwd, trust) {
+    if (trust === true)
+        return undefined;
+    if (trust === null) {
+        return `Could not read ${claudeConfigPath()} to tell whether Claude Code trusts ${cwd}, so nothing was run — a headless run there would load the repo's own hooks without asking.`;
+    }
+    return `Claude Code does not trust ${cwd} yet, so nothing was run — a headless run would load the repo's own hooks without asking. Open a session in this repo and answer Claude's trust question, then try again.`;
+}
+//# sourceMappingURL=sidecartrust.js.map

package/packages/host/dist/sidecar/sidecartrust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidecartrust.js","sourceRoot":"","sources":["../../src/sidecar/sidecartrust.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB,OAAO,CAAC,GAAG;IACjE,OAAO,IAAI,CAAC,CAAC,CAAC,iBAAiB,IAAI,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,UAAU,GAAG,gBAAgB,EAAE;IAC/E,IAAI,QAA0E,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAA2B,CAAC;QACxF,QAAQ,GAAG,MAAM,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YAClF,CAAC,CAAC,MAAM,CAAC,QAA2B;YACpC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,+CAA+C,CAAC,CAAC;IAClG,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,IAAI,GAAG,GAAG,KAAK,GAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,sBAAsB,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChE,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;gBAAE,MAAM;QAClC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,KAAqB;IAC7D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,kBAAkB,gBAAgB,EAAE,uCAAuC,GAAG,6FAA6F,CAAC;IACrL,CAAC;IACD,OAAO,8BAA8B,GAAG,2KAA2K,CAAC;AACtN,CAAC"}