zelari-code 2.15.0 → 2.16.0

package/dist/cli/safety/osJail.js

@@ -0,0 +1,289 @@
+/**
+ * osJail — Pilastro A (HARNESS-10 t28): OS-level process jail for the CLI
+ * execution surface (`exec_process` + the CLI `bash` path).
+ *
+ * WHAT IT IS
+ *   ONE choke-point, {@link spawnJailed}, through which EVERY CLI spawn of
+ *   the exec tools must flow (grep-gated by scripts/verify-os-jail.mjs).
+ *   The {@link JailSpec} is derived from the SAME decision inputs the
+ *   permission layer already used — sandboxPath root + resourceClaims
+ *   network claims — there is deliberately NO second policy engine here.
+ *
+ * HONESTY CONTRACT (P3 — no fake containment, no jail-by-prompt)
+ *   Pure Node CANNOT create restricted tokens (win32) or landlock rulesets
+ *   (linux) without native modules, which this repo bans. Each backend in
+ *   ./jails/ therefore probes HONESTLY and reports `unavailable` when it
+ *   cannot actually contain the child:
+ *     - darwin : sandbox-exec (Seatbelt) profile as argv prefix
+ *     - linux  : bubblewrap (bwrap) argv wrapper — landlock needs syscalls
+ *                Node does not expose, so without bwrap there is NO backend
+ *     - win32  : restricted token + low integrity + Job Object needs native
+ *                APIs → the backend declares itself UNAVAILABLE in this task
+ *   Golden rule: backend missing + ZELARI_OS_JAIL=required ⇒ the tool is
+ *   DENIED (typed `[jail]` error) — NEVER warn/skip/upgrade-to-advisory.
+ *   The advisory fail-open is ALWAYS VISIBLE: console.error + audit entry +
+ *   a warning on the tool result. Silence would be a fake guarantee.
+ *
+ * MODE RESOLUTION (same pattern as safety/lifecycleHooks.resolveHookFailureMode)
+ *   1. ZELARI_OS_JAIL=off|advisory|required (exact match, case/space
+ *     -insensitive; any other value is IGNORED — a typo never weakens the jail)
+ *   2. default: `required` on strict surfaces (headless/mission/CI — see
+ *      policyLoadMode) WHEN the platform backend probes available, otherwise
+ *      VISIBLE advisory; `advisory` on the interactive TUI.
+ *
+ * A stub backend may be injected via {@link setJailBackendForTests} — that
+ * seam is for TESTS ONLY and is never set by production code paths.
+ *
+ * Out of scope (declared, not hidden): persistent LSP language servers
+ * (src/cli/lsp/manager.ts) and lifecycle hooks (packages/core LifecycleHookRunner,
+ * which core cannot route through a CLI module) do NOT pass through this jail.
+ *
+ * @since v2.17.0 (HARNESS-10 t28)
+ */
+import { spawn } from 'node:child_process';
+import { homedir, tmpdir } from 'node:os';
+import path from 'node:path';
+import { activePolicyLoadMode } from './policyLoadMode.js';
+import { darwinBackend } from './jails/darwin.js';
+import { linuxBackend } from './jails/linux.js';
+import { win32Backend } from './jails/win32.js';
+// ── Mode resolution (resolveHookFailureMode pattern) ─────────────────────
+/** Env override accepted by resolveJailMode. */
+export const OS_JAIL_ENV = 'ZELARI_OS_JAIL';
+/**
+ * Pure mode resolution. Exactly `off` / `advisory` / `required` (case/space
+ * -insensitive) wins; ANY other value is ignored and falls through to the
+ * surface default — strict policy ⇒ required, permissive ⇒ advisory. Same
+ * shape as safety/lifecycleHooks.resolveHookFailureMode (t22), one more
+ * consumer of the SAME policy load mode, not a second switch.
+ */
+export function resolveJailMode(override, env = process.env) {
+    const v = override?.trim().toLowerCase();
+    if (v === 'off')
+        return 'off';
+    if (v === 'advisory')
+        return 'advisory';
+    if (v === 'required')
+        return 'required';
+    if (activePolicyLoadMode(env) !== 'strict')
+        return 'advisory';
+    // Strict surfaces want a REAL jail — but the backend must exist. Defaulting
+    // to `required` on a platform with no honest backend (win32 today, linux
+    // without bwrap) would DENY every exec tool call there. The honest default
+    // is VISIBLE advisory (triple notice); `required` stays enforceable — and
+    // DENIES on a missing backend — when set explicitly via ZELARI_OS_JAIL.
+    return probeJailBackend().available ? 'required' : 'advisory';
+}
+/** Resolve the ACTIVE jail mode from env (injectable so tests never mutate process.env). */
+export function activeJailMode(env = process.env) {
+    return resolveJailMode(env[OS_JAIL_ENV], env);
+}
+// ── Backends ─────────────────────────────────────────────────────────────
+function platformBackend(platform = process.platform) {
+    switch (platform) {
+        case 'darwin':
+            return darwinBackend;
+        case 'linux':
+            return linuxBackend;
+        default:
+            // win32 (and anything else): the honest-unavailable restricted-token stub.
+            return win32Backend;
+    }
+}
+let testBackend = null; // TEST-ONLY injection, never production.
+let probeCache = null;
+/** Current backend: the injected test stub wins, otherwise the platform's. */
+function currentBackend(platform = process.platform) {
+    return testBackend ?? platformBackend(platform);
+}
+/**
+ * Probe the active backend (memoized for the real platform probe; the test
+ * stub is probed fresh every call so tests can flip availability freely).
+ */
+export function probeJailBackend(platform = process.platform) {
+    if (testBackend)
+        return testBackend.probe();
+    if (!probeCache || probeCache.platform !== platform) {
+        probeCache = { platform, result: platformBackend(platform).probe() };
+    }
+    return probeCache.result;
+}
+/**
+ * TEST-ONLY: inject a jail backend (or `null` to restore the platform one).
+ * Production code must never call this — a stub is NEVER active by default.
+ */
+export function setJailBackendForTests(backend) {
+    testBackend = backend;
+    probeCache = null;
+}
+// ── JailSpec construction (same decision inputs — no second policy engine) ──
+/** Spec-mandated default allowlist: today's exec tools inherited ALL of process.env. */
+export const BASE_ENV_ALLOWLIST = [
+    'PATH', 'HOME', 'USER', 'LANG', 'CI', 'TERM', 'NO_COLOR',
+];
+/**
+ * win32 additions WITHOUT which a jailed shell cannot even start (SystemRoot
+ * missing makes many Windows binaries fail outright); `MSYSTEM` is what the
+ * Git Bash branch of the bash tool sets. Documented default, still a tiny
+ * fraction of process.env.
+ */
+const WIN32_ENV_ALLOWLIST = [
+    'PATH', 'Path', 'HOMEDRIVE', 'HOMEPATH', 'SystemRoot', 'SystemDrive', 'ComSpec',
+    'PATHEXT', 'TEMP', 'TMP', 'APPDATA', 'LOCALAPPDATA', 'USERPROFILE', 'USERNAME',
+    'MSYSTEM', 'PROGRAMFILES', 'ProgramFiles', 'ProgramData', 'OS',
+    'NUMBER_OF_PROCESSORS', 'PROCESSOR_ARCHITECTURE', 'WINDIR',
+];
+export function defaultEnvAllowlist(platform = process.platform) {
+    return platform === 'win32' ? [...BASE_ENV_ALLOWLIST, ...WIN32_ENV_ALLOWLIST] : BASE_ENV_ALLOWLIST;
+}
+/** Writable = root + tmpdir + ~/.zelari-code (deduped, case-folded on win32). */
+export function defaultWritable(root, home = homedir(), tmp = tmpdir(), platform = process.platform) {
+    // All three entries go through the same resolution so that dedup is
+    // host-independent: a win32 case-folded collapse must hold on any host
+    // (path.resolve is identity for already-absolute native paths).
+    const raw = [path.resolve(root), path.resolve(tmp), path.join(home, '.zelari-code')];
+    const out = [];
+    for (const p of raw) {
+        const key = platform === 'win32' ? p.toLowerCase() : p;
+        if (!out.some((q) => (platform === 'win32' ? q.toLowerCase() : q) === key))
+            out.push(p);
+    }
+    return out;
+}
+/**
+ * Build a JailSpec. `network` defaults to the conservative deny; pass the
+ * result of {@link networkSpecFromClaimHosts} to honor the claims decision.
+ */
+export function buildJailSpec(opts) {
+    return {
+        root: path.resolve(opts.root),
+        network: opts.network ?? { mode: 'deny' },
+        envAllowlist: opts.envAllowlist ?? defaultEnvAllowlist(),
+        writable: opts.writable ?? defaultWritable(opts.root),
+    };
+}
+/**
+ * Pure bridge from the EXISTING claims engine (resourceClaims): hosts whose
+ * layered claim verdict was `allow` become the allow-list; anything else
+ * (no claims / ask / deny) stays conservative `deny`.
+ */
+export function networkSpecFromClaimHosts(allowedHosts) {
+    if (!allowedHosts || allowedHosts.length === 0)
+        return { mode: 'deny' };
+    return { mode: 'allow-list', hosts: [...new Set(allowedHosts)] };
+}
+/**
+ * Env sanitation for a jailed child: keep ONLY allowlisted variables
+ * (case-insensitive on win32, preserving the original key casing) and always
+ * propagate the CI fast-fail flag. Pure — `env` is never mutated.
+ */
+export function sanitizeEnv(env, allowlist, platform = process.platform) {
+    const wanted = new Set(allowlist.map((k) => (platform === 'win32' ? k.toLowerCase() : k)));
+    const out = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (v === undefined)
+            continue;
+        const key = platform === 'win32' ? k.toLowerCase() : k;
+        if (wanted.has(key))
+            out[k] = v;
+    }
+    return out;
+}
+/** Canonical deny reason (golden rule) shared by preflight and spawn paths. */
+export function jailDenyReason(probe, mode) {
+    return (`OS jail backend unavailable (${probe.backend}: ${probe.reason}) with ZELARI_OS_JAIL=${mode} — ` +
+        'execution is DENIED instead of running unjailed (t28 golden rule: missing backend + required ⇒ deny, never warn/skip). ' +
+        'Set ZELARI_OS_JAIL=advisory (visible fail-open) or =off to explicitly allow unjailed execution.');
+}
+/** Canonical advisory notice — the fail-open must be SEEN, never silent. */
+export function jailAdvisoryNotice(probe) {
+    return (`advisory: OS jail backend unavailable (${probe.backend}: ${probe.reason}) — ` +
+        'this process will run UNJAILED (visible fail-open). Set ZELARI_OS_JAIL=required to deny instead.');
+}
+/**
+ * Pure decision of WHAT a spawn may do under the current jail mode:
+ *   required + backend missing ⇒ deny (typed `[jail]`, no spawn at all);
+ *   advisory + backend missing ⇒ unjailed spawn + notice (visible fail-open);
+ *   backend available          ⇒ wrapped argv + sanitized env;
+ *   off                        ⇒ today's plain behavior, untouched.
+ * When the jail is active (mode != off) the env is sanitized EVEN on the
+ * fail-open path — env allowlisting is ours, not the kernel's.
+ */
+export function decideJailSpawn(spec, input) {
+    const mode = input.mode ?? activeJailMode();
+    const merged = { ...(input.env ?? process.env), ...(input.envExtras ?? {}) };
+    if (mode === 'off')
+        return { action: 'spawn-plain', env: merged };
+    const probe = probeJailBackend();
+    if (!probe.available) {
+        if (mode === 'required')
+            return { action: 'deny', reason: jailDenyReason(probe, mode) };
+        return { action: 'spawn-plain', env: sanitizeEnv(merged, spec.envAllowlist), notice: jailAdvisoryNotice(probe) };
+    }
+    const wrapped = currentBackend().wrap(spec, input.program, input.argv);
+    return {
+        action: 'spawn-jailed',
+        probe,
+        program: wrapped.program,
+        argv: wrapped.argv,
+        env: sanitizeEnv(merged, spec.envAllowlist),
+    };
+}
+/**
+ * THE spawn choke-point for the CLI exec surface (exec_process + CLI bash
+ * via the core seam). The only place in those paths that touches
+ * child_process.spawn. Always `shell:false`, stdin closed; deny reasons are
+ * prefixed `[jail]` so callers surface a typed tool error.
+ */
+export function spawnJailed(spec, req) {
+    const decision = decideJailSpawn(spec, {
+        program: req.program,
+        argv: req.argv,
+        env: req.env,
+        envExtras: req.envExtras,
+    });
+    if (decision.action === 'deny') {
+        return { outcome: 'denied', reason: `[jail] ${decision.reason}` };
+    }
+    const notice = decision.action === 'spawn-plain' ? decision.notice : undefined;
+    if (notice) {
+        // P3: fail-open is visible. Console first (chip-style line), then the sink.
+        console.error(`[os-jail] ${notice}`);
+        req.onNotice?.(notice);
+    }
+    const jailed = decision.action === 'spawn-jailed';
+    const program = jailed ? decision.program : req.program;
+    const argv = jailed ? decision.argv : [...req.argv];
+    try {
+        const child = spawn(program, argv, {
+            cwd: req.cwd,
+            signal: req.signal,
+            shell: false,
+            env: decision.env,
+            stdio: ['ignore', 'pipe', 'pipe'], // non-interactive by construction
+        });
+        return {
+            outcome: 'spawned',
+            child,
+            backend: jailed ? decision.probe.backend : 'none',
+            jailed,
+            ...(notice ? { notice } : {}),
+        };
+    }
+    catch (err) {
+        return { outcome: 'failed', reason: err instanceof Error ? err.message : String(err) };
+    }
+}
+/**
+ * Availability snapshot for preflight call sites (the bash wrapper): what
+ * mode is active and whether a backend exists. `off` short-circuits to a
+ * neutral probe without touching the backend.
+ */
+export function jailAvailability(env = process.env) {
+    const mode = activeJailMode(env);
+    const probe = mode === 'off'
+        ? { backend: 'none', available: false, reason: 'jail disabled (ZELARI_OS_JAIL=off)' }
+        : probeJailBackend();
+    return { mode, probe };
+}
+//# sourceMappingURL=osJail.js.map

package/dist/cli/safety/osJail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"osJail.js","sourceRoot":"","sources":["../../../src/cli/safety/osJail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAiDhD,4EAA4E;AAE5E,gDAAgD;AAChD,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,QAA4B,EAC5B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACxC,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACxC,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IAC9D,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,OAAO,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AAChE,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,4EAA4E;AAE5E,SAAS,eAAe,CAAC,WAAmB,OAAO,CAAC,QAAQ;IAC1D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,YAAY,CAAC;QACtB;YACE,2EAA2E;YAC3E,OAAO,YAAY,CAAC;IACxB,CAAC;AACH,CAAC;AAED,IAAI,WAAW,GAAuB,IAAI,CAAC,CAAC,yCAAyC;AACrF,IAAI,UAAU,GAAyD,IAAI,CAAC;AAE5E,8EAA8E;AAC9E,SAAS,cAAc,CAAC,WAAmB,OAAO,CAAC,QAAQ;IACzD,OAAO,WAAW,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,OAAO,CAAC,QAAQ;IAClE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC,KAAK,EAAE,CAAC;IAC5C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpD,UAAU,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA2B;IAChE,WAAW,GAAG,OAAO,CAAC;IACtB,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,+EAA+E;AAE/E,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU;CACzD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAsB;IAC7C,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS;IAC/E,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU;IAC9E,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI;IAC9D,sBAAsB,EAAE,wBAAwB,EAAE,QAAQ;CAC3D,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,WAAmB,OAAO,CAAC,QAAQ;IACrE,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,kBAAkB,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;AACrG,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,OAAe,OAAO,EAAE,EACxB,MAAc,MAAM,EAAE,EACtB,WAAmB,OAAO,CAAC,QAAQ;IAEnC,oEAAoE;IACpE,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAK7B;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QACzC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,mBAAmB,EAAE;QACxD,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAA2C;IACnF,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,GAAsB,EACtB,SAA4B,EAC5B,WAAmB,OAAO,CAAC,QAAQ;IAEnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,MAAM,GAAG,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAoBD,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,KAAsB,EAAE,IAAc;IACnE,OAAO,CACL,gCAAgC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,yBAAyB,IAAI,KAAK;QAChG,yHAAyH;QACzH,iGAAiG,CAClG,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,OAAO,CACL,0CAA0C,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,MAAM;QAC9E,kGAAkG,CACnG,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,KAA2B;IACzE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;IAChG,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IACnH,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO;QACL,MAAM,EAAE,cAAc;QACtB,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC;KAC5C,CAAC;AACJ,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,GAAuB;IACjE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE;QACrC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,IAAI,MAAM,EAAE,CAAC;QACX,4EAA4E;QAC5E,OAAO,CAAC,KAAK,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;QACrC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,cAAc,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,kCAAkC;SACtE,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,KAAK;YACL,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YACjD,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAInE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GACT,IAAI,KAAK,KAAK;QACZ,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE;QACrF,CAAC,CAAC,gBAAgB,EAAE,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC"}

package/dist/cli/safety/policyLoadMode.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyLoadMode.js","sourceRoot":"","sources":["../../../src/cli/safety/policyLoadMode.ts"],"names":[],"mappings":"AAqBA,sDAAsD;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D,oFAAoF;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAWvC,SAAS,YAAY,CAAC,CAAqB;IACzC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAiC;IACrE,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IAC5C,yEAAyE;IACzE,sEAAsE;IACtE,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACjF,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,4EAA4E;AAC5E,wEAAwE;AACxE,wEAAwE;AAExE,IAAI,aAAa,GAAsB,KAAK,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CAAC,OAA0B;IACnE,aAAa,GAAG,OAAO,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB;IACrC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,OAAO,qBAAqB,CAAC;QAC3B,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,GAAG,CAAC,oBAAoB,CAAC;QACnC,EAAE,EAAE,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;KACpD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"policyLoadMode.js","sourceRoot":"","sources":["../../../src/cli/safety/policyLoadMode.ts"],"names":[],"mappings":"AA4BA,sDAAsD;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D,oFAAoF;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAWvC,SAAS,YAAY,CAAC,CAAqB;IACzC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAiC;IACrE,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IAC5C,yEAAyE;IACzE,sEAAsE;IACtE,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACjF,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,4EAA4E;AAC5E,wEAAwE;AACxE,wEAAwE;AAExE,IAAI,aAAa,GAAsB,KAAK,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CAAC,OAA0B;IACnE,aAAa,GAAG,OAAO,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB;IACrC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,OAAO,qBAAqB,CAAC;QAC3B,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,GAAG,CAAC,oBAAoB,CAAC;QACnC,EAAE,EAAE,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;KACpD,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/serve/harnessClient.js

@@ -0,0 +1,150 @@
+/**
+ * harnessClient — minimal NDJSON client for the harness App Server wire
+ * protocol (t32, Pilastro B residuo; see harnessServer.ts for the server
+ * contract). Shared seam for Node hosts: the companion RunManager client
+ * mode (ZELARI_HARNESS_SERVER=1) drives it today.
+ *
+ * Wire rules (protocol v2, unchanged):
+ *   requests carry `id`; responses answer with the same `id` + ok/result |
+ *   error; unsolicited server lines carry `type` (protocol_info handshake,
+ *   BrainEvents, §24 control acks) and are demultiplexed to `onEvent`.
+ *
+ * Transports are pluggable:
+ *   - createInProcessHarnessTransport(): boots a real startHarnessServer
+ *     over a PassThrough pair — same NDJSON bytes, ZERO child processes
+ *     (tests and embedders);
+ *   - a stdio transport to `--serve-harness` (RunManager builds one) keeps
+ *     full BrainEvent fidelity for long-lived deployments.
+ */
+import { createInterface } from 'node:readline';
+import { PassThrough } from 'node:stream';
+import { startHarnessServer } from './harnessServer.js';
+/** Typed protocol error — `code` mirrors the server error codes. */
+export class HarnessClientError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'HarnessClientError';
+    }
+}
+export class HarnessClient {
+    transport;
+    onEvent;
+    nextId = 1;
+    pending = new Map();
+    closed = false;
+    constructor(transport, 
+    /** Unsolicited server events (protocol_info, BrainEvents, control acks). */
+    onEvent) {
+        this.transport = transport;
+        this.onEvent = onEvent;
+        transport.onLine((line) => this.handleLine(line));
+    }
+    handleLine(line) {
+        const trimmed = line.trim();
+        if (trimmed.length === 0)
+            return;
+        let envelope;
+        try {
+            envelope = JSON.parse(trimmed);
+        }
+        catch {
+            return; // a malformed server line is never a client crash
+        }
+        const id = envelope['id'];
+        if (id !== undefined && id !== null && this.pending.has(id)) {
+            const pendingRequest = this.pending.get(id);
+            this.pending.delete(id);
+            if (envelope['ok'] === true) {
+                pendingRequest.resolve(envelope['result']);
+            }
+            else {
+                const error = envelope['error'];
+                pendingRequest.reject(new HarnessClientError(error?.code ?? 'method_failed', error?.message ?? 'harness request failed'));
+            }
+            return;
+        }
+        this.onEvent?.(envelope);
+    }
+    /** One request/response roundtrip; rejects with HarnessClientError on !ok. */
+    request(method, params = {}) {
+        if (this.closed) {
+            return Promise.reject(new HarnessClientError('transport_closed', 'harness client is closed'));
+        }
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            this.pending.set(id, { resolve, reject });
+            this.transport.write(JSON.stringify({ id, method, params }));
+        });
+    }
+    async createSession(workspaceRoot) {
+        const result = (await this.request('session.create', { workspaceRoot }));
+        return result.sessionId;
+    }
+    /** `run.turn` — resolves with the final turn result ({exitCode, …}). */
+    async runTurn(sessionId, input) {
+        return (await this.request('run.turn', {
+            sessionId,
+            ...input,
+        }));
+    }
+    /** Session-scoped steer (§24: resolves on ACCEPTANCE, not application). */
+    async steer(sessionId, text, controlId) {
+        const params = { sessionId, text };
+        if (controlId !== undefined)
+            params['controlId'] = controlId;
+        return (await this.request('session.steer', params));
+    }
+    async cancel(sessionId, reason) {
+        const params = { sessionId };
+        if (reason !== undefined)
+            params['reason'] = reason;
+        return (await this.request('session.cancel', params));
+    }
+    async disposeSession(sessionId) {
+        await this.request('session.dispose', { sessionId });
+    }
+    /** Rejects every pending request, then tears the transport down. */
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        for (const pendingRequest of this.pending.values()) {
+            pendingRequest.reject(new HarnessClientError('transport_closed', 'harness client closed'));
+        }
+        this.pending.clear();
+        await this.transport.close();
+    }
+}
+/**
+ * In-process transport: a real startHarnessServer over a PassThrough pair.
+ * Zero child processes — same wire bytes as the stdio deployment, and the
+ * kernel guarantees still hold (close() awaits server.dispose(), which
+ * drains pending completion-proof writes before services die).
+ */
+export function createInProcessHarnessTransport(options = {}) {
+    const clientToServer = new PassThrough();
+    const serverToClient = new PassThrough();
+    const started = startHarnessServer({
+        io: { input: clientToServer, output: serverToClient },
+        ...options,
+    });
+    const transport = {
+        write(line) {
+            try {
+                clientToServer.write(line + '\n');
+            }
+            catch {
+                /* server side gone — in-flight requests surface as transport_closed */
+            }
+        },
+        onLine(listener) {
+            const rl = createInterface({ input: serverToClient });
+            rl.on('line', listener);
+        },
+        close: () => started.close(),
+    };
+    return { transport, server: started.server, close: () => started.close() };
+}
+//# sourceMappingURL=harnessClient.js.map

package/dist/cli/serve/harnessClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessClient.js","sourceRoot":"","sources":["../../../src/cli/serve/harnessClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAkC,MAAM,oBAAoB,CAAC;AAYxF,oEAAoE;AACpE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC;IADX,YACW,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAOD,MAAM,OAAO,aAAa;IAML;IAEA;IAPX,MAAM,GAAG,CAAC,CAAC;IACF,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IACrD,MAAM,GAAG,KAAK,CAAC;IAEvB,YACmB,SAA2B;IAC5C,4EAA4E;IAC3D,OAAkD;QAFlD,cAAS,GAAT,SAAS,CAAkB;QAE3B,YAAO,GAAP,OAAO,CAA2C;QAEnE,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,UAAU,CAAC,IAAY;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,IAAI,QAAiC,CAAC;QACtC,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,kDAAkD;QAC5D,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAY,CAAC,EAAE,CAAC;YACtE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAY,CAAE,CAAC;YACvD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;YAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5B,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAoD,CAAC;gBACnF,cAAc,CAAC,MAAM,CACnB,IAAI,kBAAkB,CACpB,KAAK,EAAE,IAAI,IAAI,eAAe,EAC9B,KAAK,EAAE,OAAO,IAAI,wBAAwB,CAC3C,CACF,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAC9E,OAAO,CAAC,MAAc,EAAE,SAAkC,EAAE;QAC1D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,aAAqB;QACvC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,aAAa,EAAE,CAAC,CAEtE,CAAC;QACF,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,OAAO,CACX,SAAiB,EACjB,KAA8B;QAE9B,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;YACrC,SAAS;YACT,GAAG,KAAK;SACT,CAAC,CAAmD,CAAC;IACxD,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,KAAK,CACT,SAAiB,EACjB,IAAY,EACZ,SAAkB;QAElB,MAAM,MAAM,GAA4B,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5D,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;QAC7D,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAA4B,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,MAAe;QAC7C,MAAM,MAAM,GAA4B,EAAE,SAAS,EAAE,CAAC;QACtD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;QACpD,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAA4B,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,cAAc,CAAC,MAAM,CACnB,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,UAAqC,EAAE;IAEvC,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,kBAAkB,CAAC;QACjC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE;QACrD,GAAG,OAAO;KACX,CAAC,CAAC;IACH,MAAM,SAAS,GAAqB;QAClC,KAAK,CAAC,IAAY;YAChB,IAAI,CAAC;gBACH,cAAc,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;YACzE,CAAC;QACH,CAAC;QACD,MAAM,CAAC,QAAgC;YACrC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACtD,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE;KAC7B,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAC7E,CAAC"}