{"version":3,"file":"index.mjs","names":[],"sources":["../src/compatibility.ts","../src/argument-normalization.ts","../src/description-projection.ts","../src/policy.ts","../src/result-filter.ts","../src/schema-projection.ts","../src/wrapper.ts","../src/supervisor.ts","../src/index.ts"],"sourcesContent":["import { createRequire } from 'node:module'\nimport { join } from 'node:path'\nimport type { ToolDefinition } from '@deepseek-ai/dsh-tools'\n\n// 仅列入已完成真实包测试或标签源码契约审计的 DSH 版本，避免仅凭 semver 范围放行未知契约。\nexport const SUPPORTED_DSH_VERSIONS = ['0.1.0-rc.5', '0.1.0-rc.6', '0.1.0-rc.7', '0.1.0-rc.8', '0.1.1-rc.1', '0.1.1-rc.2', '0.1.2-alpha.1', '0.1.2-alpha.2', '0.1.2-alpha.3', '0.1.2-alpha.4', '0.1.2-alpha.5', '0.1.2-rc.1', '0.1.3-alpha.1', '0.1.3-alpha.2', '0.1.5-alpha.1', '0.1.5-alpha.2', '0.1.5-rc.1', '0.1.5-rc.2', '0.1.6-alpha.1', '0.1.6-alpha.2'] as const\n\nconst DSH_PACKAGES = [\n  '@deepseek-ai/dsh-agent',\n  '@deepseek-ai/dsh-llm',\n  '@deepseek-ai/dsh-sandbox',\n  '@deepseek-ai/dsh-sandbox-policy',\n  '@deepseek-ai/dsh-scope',\n  '@deepseek-ai/dsh-session',\n  '@deepseek-ai/dsh-tools',\n  '@deepseek-ai/dsh-user-approval',\n] as const\nconst TARGET_NAMES = new Set(['bash', 'pwsh', 'write', 'edit'])\nconst ESCALATION_FIELDS = ['sandbox_permissions', 'justification'] as const\n\ntype ManifestReader = (name: string) => unknown\n\ninterface ManifestSource {\n  readonly label: string\n  readonly read: ManifestReader\n}\n\nexport interface DshRuntimeCompatibility {\n  mode: 'versioned' | 'structural'\n  unavailablePackages: readonly string[]\n}\n\nfunction isMissingModuleError(error: unknown): boolean {\n  const code = (error as NodeJS.ErrnoException | null)?.code\n  return code === 'MODULE_NOT_FOUND' || code === 'ERR_MODULE_NOT_FOUND'\n}\n\n/**\n * 按 Node.js 的真实加载优先级建立包清单解析根。\n *\n * 插件自身目录必须优先，因为运行时代码中的静态 import 也会先从插件物理位置向上解析；\n * 只有该目录完全不存在任何受检 DSH 包时，才允许从宿主当前工作目录读取完整包集，\n * 从而兼容 `link:`、工作区软链接和从 DSH 源码根目录启动的开发方式。\n * `DSH_HOME` 是配置与 Profile 数据目录，不是稳定的 Node.js 包根目录，因此不能参与解析。\n */\nfunction defaultManifestSources(): readonly ManifestSource[] {\n  const pluginRequire = createRequire(import.meta.url)\n  const hostRequire = createRequire(join(process.cwd(), 'package.json'))\n\n  return [\n    {\n      label: 'plugin module',\n      read: name => pluginRequire(`${name}/package.json`),\n    },\n    {\n      label: 'host working directory',\n      read: name => hostRequire(`${name}/package.json`),\n    },\n  ]\n}\n\nexport function validateDshVersionSet(\n  versions: Readonly<Record<string, string>>,\n): void {\n  const unique = new Set(Object.values(versions))\n  if (unique.size !== 1) {\n    const detail = Object.entries(versions)\n      .map(([name, version]) => `${name}@${version}`)\n      .join(', ')\n    throw new Error(`dsh-sandbox-escalation-fix: mixed DSH package versions are unsupported: ${detail}`)\n  }\n  const version = unique.values().next().value\n  if (version === undefined || !SUPPORTED_DSH_VERSIONS.includes(version as typeof SUPPORTED_DSH_VERSIONS[number])) {\n    throw new Error(`dsh-sandbox-escalation-fix: unsupported DSH version \"${version ?? 'unknown'}\"; supported versions: ${SUPPORTED_DSH_VERSIONS.join(', ')}`)\n  }\n}\n\nexport function validateDshRuntimeFromSources(\n  sources: readonly ManifestSource[],\n): DshRuntimeCompatibility {\n  for (const source of sources) {\n    const versions: Record<string, string> = {}\n    const unavailablePackages: string[] = []\n\n    for (const name of DSH_PACKAGES) {\n      let manifest: unknown\n      try {\n        manifest = source.read(name)\n      } catch (error) {\n        if (isMissingModuleError(error)) {\n          unavailablePackages.push(name)\n          continue\n        }\n        throw new Error(`dsh-sandbox-escalation-fix: cannot read ${name}/package.json from ${source.label}`, { cause: error })\n      }\n      if (typeof manifest !== 'object' || manifest === null\n        || !('version' in manifest) || typeof manifest.version !== 'string') {\n        throw new Error(`dsh-sandbox-escalation-fix: ${name}/package.json has no string version at ${source.label}`)\n      }\n      versions[name] = manifest.version\n    }\n\n    if (unavailablePackages.length === 0) {\n      validateDshVersionSet(versions)\n      return { mode: 'versioned', unavailablePackages }\n    }\n\n    // 同一解析根只出现部分 DSH 包，说明静态 import 可能已经从该根加载了部分运行时。\n    // 此时继续尝试后续根会掩盖双运行时或跨目录混装，因此必须立即拒绝启动。\n    if (unavailablePackages.length < DSH_PACKAGES.length) {\n      throw new Error(`dsh-sandbox-escalation-fix: only some DSH package manifests are readable from ${source.label}; unavailable packages: ${unavailablePackages.join(', ')}`)\n    }\n  }\n\n  // 所有候选根都完全看不到清单时，保留 Desktop 2.0.3 所需的严格结构校验回退。\n  return { mode: 'structural', unavailablePackages: [...DSH_PACKAGES] }\n}\n\nexport function validateDshRuntime(\n  readManifest?: ManifestReader,\n): DshRuntimeCompatibility {\n  const sources = readManifest === undefined\n    ? defaultManifestSources()\n    : [{ label: 'injected manifest reader', read: readManifest }]\n  return validateDshRuntimeFromSources(sources)\n}\n\nfunction record(value: unknown, label: string): Record<string, unknown> {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new Error(`dsh-sandbox-escalation-fix: ${label} must be an object`)\n  }\n  return value as Record<string, unknown>\n}\n\nexport function validateTargetTool(definition: ToolDefinition): void {\n  if (!TARGET_NAMES.has(definition.name)) {\n    throw new Error(`dsh-sandbox-escalation-fix: unsupported target tool \"${definition.name}\"`)\n  }\n  if (typeof definition.description !== 'string' || typeof definition.execute !== 'function') {\n    throw new Error(`dsh-sandbox-escalation-fix: tool \"${definition.name}\" has an incompatible definition`)\n  }\n  const parameters = record(definition.parameters, `tool \"${definition.name}\" parameters`)\n  if (parameters.type !== 'object') {\n    throw new Error(`dsh-sandbox-escalation-fix: tool \"${definition.name}\" parameters must have type \"object\"`)\n  }\n  record(parameters.properties, `tool \"${definition.name}\" parameters.properties`)\n  const properties = parameters.properties as Record<string, unknown>\n  const fields = ESCALATION_FIELDS.filter(field => properties[field] !== undefined)\n  if (fields.length === 1) {\n    throw new Error(`dsh-sandbox-escalation-fix: tool \"${definition.name}\" must expose sandbox_permissions and justification together or omit both`)\n  }\n  const output = record(definition.output, `tool \"${definition.name}\" output`)\n  if (typeof output.render !== 'function' || typeof output.schema !== 'object' || output.schema === null) {\n    throw new Error(`dsh-sandbox-escalation-fix: tool \"${definition.name}\" output contract is incompatible`)\n  }\n}\n","import type { SandboxMode } from '@deepseek-ai/dsh-sandbox'\nimport { realpathSync } from 'node:fs'\nimport { dirname, isAbsolute, relative, resolve, sep } from 'node:path'\n\nexport interface EscalationNormalizationContext {\n  toolName?: string\n  workspaceRoot?: string\n}\n\nfunction withoutEscalation(record: Record<string, unknown>): Record<string, unknown> {\n  const normalized = { ...record }\n  delete normalized.sandbox_permissions\n  delete normalized.justification\n  return normalized\n}\n\nfunction isWithin(root: string, path: string): boolean {\n  const relativePath = relative(root, path)\n  return relativePath === ''\n    || (!isAbsolute(relativePath) && relativePath !== '..' && !relativePath.startsWith(`..${sep}`))\n}\n\nfunction nearestExistingPath(path: string): string | undefined {\n  let current = path\n  while (true) {\n    try {\n      return realpathSync.native(current)\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code\n      if (code !== 'ENOENT' && code !== 'ENOTDIR') return undefined\n      const parent = dirname(current)\n      if (parent === current) return undefined\n      current = parent\n    }\n  }\n}\n\nfunction isWorkspaceFilePath(filePath: unknown, workspaceRoot: string | undefined): boolean {\n  if (typeof filePath !== 'string' || filePath.trim().length === 0 || workspaceRoot === undefined) return false\n  const resolvedRoot = resolve(workspaceRoot)\n  const target = resolve(resolvedRoot, filePath)\n  if (!isWithin(resolvedRoot, target)) return false\n  let canonicalRoot: string\n  try {\n    canonicalRoot = realpathSync.native(resolvedRoot)\n  } catch {\n    return false\n  }\n  const canonicalTarget = nearestExistingPath(target)\n  return canonicalTarget !== undefined && isWithin(canonicalRoot, canonicalTarget)\n}\n\nexport function normalizeEscalationArguments(\n  args: unknown,\n  effectiveMode: SandboxMode,\n  context: EscalationNormalizationContext = {},\n): unknown {\n  if (typeof args !== 'object' || args === null || Array.isArray(args)) return args\n  const record = args as Record<string, unknown>\n  if (!Object.hasOwn(record, 'sandbox_permissions') || !Object.hasOwn(record, 'justification')) {\n    return args\n  }\n  if (record.sandbox_permissions === effectiveMode) return withoutEscalation(record)\n  if (\n    effectiveMode === 'workspace-write'\n    && record.sandbox_permissions === 'danger-full-access'\n    && (context.toolName === 'write' || context.toolName === 'edit')\n    && isWorkspaceFilePath(record.file_path, context.workspaceRoot)\n  ) {\n    return withoutEscalation(record)\n  }\n  return args\n}\n","const ESCALATION_START = ' Attempting a command the sandbox may deny is safe and expected:'\n\nexport function projectEscalationDescription(\n  description: string,\n  hasEscalationTargets: boolean,\n): string {\n  if (hasEscalationTargets) return description\n  const first = description.indexOf(ESCALATION_START)\n  if (first === -1) return description\n  if (description.indexOf(ESCALATION_START, first + ESCALATION_START.length) !== -1) {\n    throw new Error('dsh-sandbox-escalation-fix: shell description escalation anchor is ambiguous')\n  }\n  return description.slice(0, first)\n}\n","import type { Context } from '@deepseek-ai/cordis'\nimport type { Agent } from '@deepseek-ai/dsh-agent'\nimport { WIDER_MODES } from '@deepseek-ai/dsh-sandbox'\nimport type { SandboxMode } from '@deepseek-ai/dsh-sandbox'\nimport type { ApprovalPolicy } from '@deepseek-ai/dsh-user-approval'\n\nexport interface EscalationPolicyView {\n  effectiveMode: SandboxMode\n  approvalPolicy: ApprovalPolicy\n  viableTargets: readonly SandboxMode[]\n}\n\nexport function viableEscalationTargets(\n  effectiveMode: SandboxMode,\n  approvalPolicy: ApprovalPolicy,\n): readonly SandboxMode[] {\n  return approvalPolicy === 'never' ? [] : WIDER_MODES[effectiveMode] ?? []\n}\n\nexport function escalationPolicyFor(ctx: Context, agent: Agent): EscalationPolicyView {\n  const effectiveMode = ctx.sandboxPolicy.resolve({ session: agent.session }).mode\n  const approvalPolicy = ctx.approval.overrideOf(agent.session)\n    ?? ctx.approval.config.policy\n    ?? 'ask'\n  return {\n    effectiveMode,\n    approvalPolicy,\n    viableTargets: viableEscalationTargets(effectiveMode, approvalPolicy),\n  }\n}\n","import type { ContentBlock } from '@deepseek-ai/dsh-llm'\n\nexport function removeEscalationHint(\n  text: string,\n  denialMarker: string,\n  hint: string,\n): string {\n  const lines = text.split('\\n')\n  if (!lines.includes(denialMarker) || !lines.includes(hint)) return text\n  return lines.filter(line => line !== hint).join('\\n')\n}\n\nexport function cleanSingleTextContent(\n  content: readonly ContentBlock[],\n  denialMarker: string,\n  hint: string,\n): ContentBlock[] | undefined {\n  if (content.length !== 1 || content[0]?.type !== 'text') return undefined\n  const text = removeEscalationHint(content[0].text, denialMarker, hint)\n  return text === content[0].text ? undefined : [{ type: 'text', text }]\n}\n","import type { SandboxMode } from '@deepseek-ai/dsh-sandbox'\n\nconst SANDBOX_PERMISSIONS = 'sandbox_permissions'\nconst JUSTIFICATION = 'justification'\n\nfunction objectRecord(value: unknown, label: string): Record<string, unknown> {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new Error(`dsh-sandbox-escalation-fix: ${label} must be an object`)\n  }\n  return value as Record<string, unknown>\n}\n\nexport function projectEscalationParameters(\n  parameters: Record<string, unknown>,\n  targets: readonly SandboxMode[],\n): Record<string, unknown> {\n  const projected = structuredClone(parameters)\n  const root = objectRecord(projected, 'tool parameters')\n  if (root.type !== 'object') {\n    throw new Error('dsh-sandbox-escalation-fix: tool parameters root must have type \"object\"')\n  }\n  const properties = objectRecord(root.properties, 'tool parameters.properties')\n  const permissions = properties[SANDBOX_PERMISSIONS]\n  const justification = properties[JUSTIFICATION]\n  if (permissions === undefined && justification === undefined) return projected\n  if (permissions === undefined || justification === undefined) {\n    throw new Error('dsh-sandbox-escalation-fix: escalation schema must declare sandbox_permissions and justification together')\n  }\n  const permissionsSchema = objectRecord(permissions, 'sandbox_permissions schema')\n  const justificationSchema = objectRecord(justification, 'justification schema')\n  if (permissionsSchema.type !== 'string' || !Array.isArray(permissionsSchema.enum)\n    || !permissionsSchema.enum.every(value => typeof value === 'string')) {\n    throw new Error('dsh-sandbox-escalation-fix: sandbox_permissions must be a string enum')\n  }\n  if (justificationSchema.type !== 'string') {\n    throw new Error('dsh-sandbox-escalation-fix: justification must be a string')\n  }\n  if (targets.length === 0) {\n    delete properties[SANDBOX_PERMISSIONS]\n    delete properties[JUSTIFICATION]\n    if (Array.isArray(root.required)) {\n      const required = root.required.filter(\n        value => value !== SANDBOX_PERMISSIONS && value !== JUSTIFICATION,\n      )\n      if (required.length === 0) delete root.required\n      else root.required = required\n    }\n    return projected\n  }\n  permissionsSchema.enum = [...targets]\n  return projected\n}\n","import type { ToolDefinition, ToolRunContext } from '@deepseek-ai/dsh-tools'\nimport { TOOL_WRAPPER_PROTOCOL } from './wrapper-protocol.ts'\nimport type { CooperativeToolDefinition, WrapperLayer } from './wrapper-protocol.ts'\n\nexport const PLUGIN_OWNER = 'dsh-sandbox-escalation-fix'\n\nexport interface WrapperBinding {\n  readonly definition: ToolDefinition\n  updateDelegate(delegate: ToolDefinition): void\n  contribute(layer: WrapperLayer): () => void\n  releaseOwnLayer(): void\n}\n\nfunction sortedLayers(layers: ReadonlyMap<string, WrapperLayer>): WrapperLayer[] {\n  return [...layers.values()].sort(\n    (left, right) => left.priority - right.priority || left.owner.localeCompare(right.owner),\n  )\n}\n\nexport function createWrapperBinding(\n  initialDelegate: ToolDefinition,\n  ownLayer: WrapperLayer,\n): WrapperBinding {\n  let currentDelegate = initialDelegate\n  const layers = new Map<string, WrapperLayer>([[ownLayer.owner, ownLayer]])\n  const context = { toolName: initialDelegate.name }\n  const delegate = (): ToolDefinition => currentDelegate\n\n  const release = (owner: string): void => {\n    layers.delete(owner)\n  }\n\n  const definition: CooperativeToolDefinition = {\n    name: initialDelegate.name,\n    get description(): string {\n      const current = delegate()\n      return sortedLayers(layers).reduce(\n        (value, layer) => layer.projectDescription?.(value, context) ?? value,\n        current.description,\n      )\n    },\n    get parameters(): Record<string, unknown> {\n      const current = delegate()\n      return sortedLayers(layers).reduce(\n        (value, layer) => layer.projectParameters?.(value, context) ?? value,\n        current.parameters,\n      )\n    },\n    get output() {\n      return delegate().output\n    },\n    execute(args: unknown, exec: ToolRunContext): Promise<unknown> {\n      const currentDelegate = delegate()\n      const active = sortedLayers(layers).filter(\n        (layer): layer is WrapperLayer & Required<Pick<WrapperLayer, 'execute'>> => layer.execute !== undefined,\n      )\n      const dispatch = (index: number, current: unknown): Promise<unknown> => {\n        const layer = active[index]\n        if (layer === undefined) {\n          return Reflect.apply(currentDelegate.execute, currentDelegate, [current, exec]) as Promise<unknown>\n        }\n        let called = false\n        return layer.execute(current, exec, (nextArgs) => {\n          if (called) throw new Error(`dsh-sandbox-escalation-fix: wrapper \"${layer.owner}\" called next() more than once`)\n          called = true\n          return dispatch(index + 1, nextArgs)\n        })\n      }\n      return dispatch(0, args)\n    },\n    [TOOL_WRAPPER_PROTOCOL]: {\n      version: 1,\n      owner: PLUGIN_OWNER,\n      name: initialDelegate.name,\n      contribute(layer: WrapperLayer): () => void {\n        if (layers.has(layer.owner)) {\n          throw new Error(`dsh-sandbox-escalation-fix: wrapper owner \"${layer.owner}\" is already registered for \"${initialDelegate.name}\"`)\n        }\n        layers.set(layer.owner, layer)\n        let active = true\n        return () => {\n          if (!active) return\n          active = false\n          release(layer.owner)\n        }\n      },\n    },\n  }\n\n  // timeoutMs 是 DSH timeout policy 的内部执行预算。父工具可在运行期替换，\n  // 因此必须始终从当前委托读取，避免新工具后来声明超时预算时被包装器遮蔽。\n  Object.defineProperty(definition, 'timeoutMs', {\n    enumerable: true,\n    get: () => delegate().timeoutMs,\n  })\n\n  if (initialDelegate.finalizeContent !== undefined) {\n    definition.finalizeContent = (exec, result) => {\n      const current = delegate()\n      return current.finalizeContent?.call(current, exec, result)\n    }\n  }\n  if (initialDelegate.isConcurrencySafe !== undefined) {\n    definition.isConcurrencySafe = args => {\n      const current = delegate()\n      return current.isConcurrencySafe?.call(current, args) === true\n    }\n  }\n  if (initialDelegate.presentCall !== undefined) {\n    definition.presentCall = args => {\n      const current = delegate()\n      return current.presentCall?.call(current, args)\n    }\n  }\n  if (initialDelegate.presentResult !== undefined) {\n    definition.presentResult = (args, result) => {\n      const current = delegate()\n      return current.presentResult?.call(current, args, result)\n    }\n  }\n\n  return {\n    definition,\n    updateDelegate(next): void {\n      if (next.name !== initialDelegate.name) {\n        throw new Error(`delegate name changed from \"${initialDelegate.name}\" to \"${next.name}\"`)\n      }\n      currentDelegate = next\n    },\n    contribute(layer): () => void {\n      return definition[TOOL_WRAPPER_PROTOCOL]!.contribute(layer)\n    },\n    releaseOwnLayer(): void {\n      release(ownLayer.owner)\n    },\n  }\n}\n","import type { Context } from '@deepseek-ai/cordis'\nimport type { Agent } from '@deepseek-ai/dsh-agent'\nimport { escalationHintMarker, sandboxDenialMarker } from '@deepseek-ai/dsh-sandbox'\nimport type { SessionId } from '@deepseek-ai/dsh-session'\nimport type { PostToolDecision, ToolDefinition, ToolExecutionResult } from '@deepseek-ai/dsh-tools'\nimport { normalizeEscalationArguments } from './argument-normalization.ts'\nimport { validateTargetTool } from './compatibility.ts'\nimport { projectEscalationDescription } from './description-projection.ts'\nimport { escalationPolicyFor } from './policy.ts'\nimport { cleanSingleTextContent, removeEscalationHint } from './result-filter.ts'\nimport { projectEscalationParameters } from './schema-projection.ts'\nimport { protocolOf } from './wrapper-protocol.ts'\nimport type { WrapperLayer } from './wrapper-protocol.ts'\nimport { createWrapperBinding, PLUGIN_OWNER } from './wrapper.ts'\nimport type { WrapperBinding } from './wrapper.ts'\n\nconst TARGET_TOOLS = ['bash', 'pwsh', 'write', 'edit'] as const\ntype TargetToolName = typeof TARGET_TOOLS[number]\n\ninterface AgentState {\n  readonly agent: Agent\n  readonly targets: Map<TargetToolName, TargetState>\n  readonly disposers: Array<() => unknown>\n  disposed: boolean\n}\n\ninterface TargetState {\n  readonly name: TargetToolName\n  binding?: WrapperBinding\n  attachment: TargetAttachment\n  lastReportedError?: string\n}\n\ntype TargetAttachment =\n  | { readonly kind: 'dormant' }\n  | { readonly kind: 'owned'; readonly unregister: () => unknown }\n  | { readonly kind: 'cooperative'; readonly release: () => void }\n  | { readonly kind: 'incompatible'; readonly reason: string }\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Events {\n    'agent-preset/selected'(sessionId: SessionId, agentPreset: string): void\n  }\n}\n\nfunction visibleDelegate(ctx: Context, agent: Agent, name: TargetToolName): ToolDefinition | undefined {\n  return ctx.tools.get(name, agent)\n}\n\nfunction ownLayer(ctx: Context, agent: Agent, toolName: TargetToolName): WrapperLayer {\n  return {\n    owner: PLUGIN_OWNER,\n    priority: 100,\n    projectDescription(value: string): string {\n      const policy = escalationPolicyFor(ctx, agent)\n      return projectEscalationDescription(value, policy.viableTargets.length > 0)\n    },\n    projectParameters(value: Record<string, unknown>): Record<string, unknown> {\n      return projectEscalationParameters(value, escalationPolicyFor(ctx, agent).viableTargets)\n    },\n    execute(args: unknown, exec: Parameters<ToolDefinition['execute']>[1], next: (args: unknown) => Promise<unknown>): Promise<unknown> {\n      const callAgent = exec.agent ?? agent\n      const policy = ctx.sandboxPolicy.resolve({ session: callAgent.session })\n      return next(normalizeEscalationArguments(args, policy.mode, {\n        toolName,\n        workspaceRoot: policy.workspaceRoot,\n      }))\n    },\n  }\n}\n\nfunction rewriteFsFailure(\n  ctx: Context,\n  agent: Agent,\n  result: ToolExecutionResult,\n): ToolExecutionResult {\n  if (!result.isError || result.error.info?.code !== 'FS_SANDBOX_DENIED') return result\n  const policy = escalationPolicyFor(ctx, agent)\n  if (policy.viableTargets.length > 0) return result\n  const denial = sandboxDenialMarker(policy.effectiveMode)\n  const hint = escalationHintMarker('operation')\n  const message = removeEscalationHint(result.error.message, denial, hint)\n  if (message === result.error.message) return result\n  return {\n    ...result,\n    error: { ...result.error, message },\n    content: [{ type: 'text', text: `Error: ${message}` }],\n  }\n}\n\nfunction rewriteSuccessfulDecision(\n  ctx: Context,\n  agent: Agent,\n  name: string,\n  result: ToolExecutionResult,\n  decision: PostToolDecision,\n): PostToolDecision {\n  if (decision.kind === 'block' || result.isError) return decision\n  const policy = escalationPolicyFor(ctx, agent)\n  if (policy.viableTargets.length > 0) return decision\n  const denial = sandboxDenialMarker(policy.effectiveMode)\n  const hint = escalationHintMarker('command')\n  if (name === 'job_output') {\n    if (Object.hasOwn(decision, 'value') || decision.content !== undefined) {\n      return {\n        kind: 'block',\n        feedback: [{ type: 'text', text: 'Conflicting plugins both attempted to rewrite job_output. Disable one result-rewriting plugin.' }],\n      }\n    }\n    const value = result.value as unknown\n    if (typeof value !== 'object' || value === null || Array.isArray(value)) return decision\n    const record = value as Record<string, unknown>\n    if (typeof record.text !== 'string') return decision\n    const text = removeEscalationHint(record.text, denial, hint)\n    return text === record.text ? decision : { kind: 'accept', value: { ...record, text } }\n  }\n  if (name !== 'bash' && name !== 'pwsh') return decision\n  if (Object.hasOwn(decision, 'value')) {\n    return {\n      kind: 'block',\n      feedback: [{ type: 'text', text: `Conflicting plugins both attempted to rewrite ${name}. Disable one result-rewriting plugin.` }],\n    }\n  }\n  const content = decision.content ?? result.content\n  const cleaned = cleanSingleTextContent(content, denial, hint)\n  return cleaned === undefined\n    ? decision\n    : { kind: 'accept', content: cleaned, ...decision.additionalContexts ? { additionalContexts: decision.additionalContexts } : {} }\n}\n\nexport class Supervisor {\n  private readonly states = new Map<Agent, AgentState>()\n  private reconciling = 0\n  private expectedToolChanges = 0\n  private reconcilePending = false\n\n  constructor(private readonly ctx: Context) {}\n\n  start(): () => Promise<void> {\n    const stopCreated = this.ctx.on('agent/created', ({ agent }) => {\n      this.install(agent)\n    })\n    const stopDisposed = this.ctx.on('agent/disposed', ({ agent }) => {\n      try {\n        this.remove(agent)\n      } catch (error) {\n        this.ctx.logger.warn(`dsh-sandbox-escalation-fix: agent \"${agent.id}\" cleanup failed: ${String(error)}`)\n      }\n    })\n    const stopPreset = this.ctx.on('agent-preset/selected', (sessionId) => {\n      const agent = this.ctx.agents.get(sessionId)\n      if (agent !== undefined) this.reconcileAgent(agent)\n    })\n    const stopTools = this.ctx.on('tools/change', () => {\n      if (this.expectedToolChanges > 0) {\n        this.expectedToolChanges -= 1\n        return\n      }\n      if (this.reconciling > 0) {\n        this.reconcilePending = true\n        return\n      }\n      this.reconcileAll()\n    })\n    for (const agent of this.ctx.agents.list()) this.install(agent)\n    return () => {\n      stopTools()\n      stopPreset()\n      stopDisposed()\n      stopCreated()\n      const states = [...this.states.values()]\n      this.states.clear()\n      for (const state of states) {\n        try {\n          this.coordinate(() => this.disposeState(state))\n        } catch (error) {\n          this.ctx.logger.warn(`dsh-sandbox-escalation-fix: agent \"${state.agent.id}\" cleanup failed: ${String(error)}`)\n        }\n      }\n      return Promise.resolve()\n    }\n  }\n\n  private install(agent: Agent): void {\n    if (this.states.has(agent)) return\n    const targets = new Map<TargetToolName, TargetState>(\n      TARGET_TOOLS.map(name => [name, {\n        name,\n        attachment: { kind: 'dormant' },\n      }]),\n    )\n    const disposers: Array<() => unknown> = []\n    const state: AgentState = {\n      agent,\n      targets,\n      disposers,\n      disposed: false,\n    }\n    this.states.set(agent, state)\n    try {\n      this.coordinate(() => this.reconcileState(state, true))\n      disposers.push(this.ctx.on('tools/execute', async (exec, next): Promise<ToolExecutionResult> => {\n        const result = await next()\n        return exec.agent === agent && (exec.name === 'write' || exec.name === 'edit')\n          ? rewriteFsFailure(this.ctx, agent, result)\n          : result\n      }, { prepend: true }))\n      disposers.push(this.ctx.on('tools/post-execute', async (exec, result, next): Promise<PostToolDecision> => {\n        const decision = await next()\n        return exec.agent === agent\n          ? rewriteSuccessfulDecision(this.ctx, agent, exec.name, result, decision)\n          : decision\n      }, { prepend: true }))\n    } catch (error) {\n      this.states.delete(agent)\n      this.coordinate(() => this.disposeState(state))\n      throw error\n    }\n  }\n\n  private remove(agent: Agent): void {\n    const state = this.states.get(agent)\n    if (state === undefined) return\n    this.states.delete(agent)\n    this.coordinate(() => this.disposeState(state))\n  }\n\n  private reconcileAgent(agent: Agent): void {\n    if (this.reconciling > 0) return\n    const state = this.states.get(agent)\n    if (state === undefined) return\n    this.coordinate(() => this.reconcileState(state, false))\n  }\n\n  private reconcileAll(): void {\n    if (this.reconciling > 0) return\n    this.coordinate(() => {\n      for (const state of this.states.values()) {\n        this.reconcileState(state, false)\n      }\n    })\n  }\n\n  private reconcileState(state: AgentState, strict: boolean): void {\n    if (state.disposed) return\n    for (const target of state.targets.values()) {\n      try {\n        this.reconcileTarget(state.agent, target)\n      } catch (error) {\n        if (strict) throw error\n        this.reportFailure(state.agent, target, error)\n      }\n    }\n  }\n\n  private reconcileTarget(agent: Agent, target: TargetState): void {\n    this.detachTarget(target)\n    const delegate = visibleDelegate(this.ctx, agent, target.name)\n    if (delegate === undefined) {\n      delete target.lastReportedError\n      return\n    }\n    try {\n      validateTargetTool(delegate)\n      const protocol = protocolOf(delegate)\n      if (protocol !== undefined) {\n        target.attachment = {\n          kind: 'cooperative',\n          release: protocol.contribute(ownLayer(this.ctx, agent, target.name)),\n        }\n      } else {\n        const binding = target.binding\n          ?? createWrapperBinding(delegate, ownLayer(this.ctx, agent, target.name))\n        if (target.binding === undefined) {\n          target.binding = binding\n        } else {\n          binding.updateDelegate(delegate)\n        }\n        const registrationCtx = agent.ctx.extend({ fiber: this.ctx.fiber })\n        target.attachment = {\n          kind: 'owned',\n          unregister: this.mutateTools(\n            () => registrationCtx.tools.register(binding.definition),\n          ),\n        }\n      }\n      delete target.lastReportedError\n    } catch (error) {\n      const reason = error instanceof Error ? error.message : String(error)\n      target.attachment = { kind: 'incompatible', reason }\n      throw error\n    }\n  }\n\n  private detachTarget(target: TargetState): void {\n    const attachment = target.attachment\n    if (attachment.kind === 'dormant') return\n    if (attachment.kind === 'incompatible') {\n      target.attachment = { kind: 'dormant' }\n      return\n    }\n    if (attachment.kind === 'owned') {\n      this.mutateTools(attachment.unregister)\n    } else {\n      attachment.release()\n    }\n    target.attachment = { kind: 'dormant' }\n  }\n\n  private disposeState(state: AgentState): void {\n    if (state.disposed) return\n    state.disposed = true\n    const errors: unknown[] = []\n    for (const target of [...state.targets.values()].reverse()) {\n      try {\n        this.detachTarget(target)\n      } catch (error) {\n        errors.push(error)\n      }\n    }\n    for (const dispose of state.disposers.splice(0).reverse()) {\n      try {\n        dispose()\n      } catch (error) {\n        errors.push(error)\n      }\n    }\n    if (errors.length > 0) {\n      throw new AggregateError(errors, `agent \"${state.agent.id}\" cleanup failed`)\n    }\n  }\n\n  private reportFailure(agent: Agent, target: TargetState, error: unknown): void {\n    const message = error instanceof Error ? error.message : String(error)\n    if (target.lastReportedError === message) return\n    target.lastReportedError = message\n    this.ctx.logger.warn(\n      `dsh-sandbox-escalation-fix: agent \"${agent.id}\" tool \"${target.name}\" dynamic reconciliation failed: ${message}`,\n    )\n  }\n\n  private coordinate(action: () => void): void {\n    this.reconciling += 1\n    try {\n      action()\n    } finally {\n      this.reconciling -= 1\n      if (this.reconciling === 0 && this.reconcilePending) {\n        this.reconcilePending = false\n        this.reconcileAll()\n      }\n    }\n  }\n\n  private mutateTools<T>(action: () => T): T {\n    this.expectedToolChanges += 1\n    const expected = this.expectedToolChanges\n    try {\n      return action()\n    } finally {\n      if (this.expectedToolChanges === expected) {\n        this.expectedToolChanges -= 1\n      }\n    }\n  }\n\n}\n","import type { Context } from '@deepseek-ai/cordis'\nimport z from '@deepseek-ai/schemastery'\nimport type {} from '@deepseek-ai/dsh-agent'\nimport type {} from '@deepseek-ai/dsh-sandbox-policy'\nimport type {} from '@deepseek-ai/dsh-user-approval'\nimport { validateDshRuntime } from './compatibility.ts'\nimport type { DshRuntimeCompatibility } from './compatibility.ts'\nimport { Supervisor } from './supervisor.ts'\n\nexport interface Config {\n  logLevel?: 'silent' | 'info' | 'debug'\n}\n\nexport const Config: z<Config> = z.object({\n  logLevel: z.union(['silent', 'info', 'debug'] as const).default('info'),\n})\n\nexport const name = 'sandbox-escalation-fix'\nexport const inject = ['agents', 'tools', 'sandboxPolicy', 'approval']\n\nexport function startPlugin(\n  ctx: Context,\n  config: Config = {},\n  compatibility: DshRuntimeCompatibility = validateDshRuntime(),\n): void {\n  if (compatibility.mode === 'structural') {\n    ctx.logger.warn('dsh-sandbox-escalation-fix: DSH package manifests are hidden by the host; using strict runtime tool-contract validation')\n  }\n  const supervisor = new Supervisor(ctx)\n  ctx.effect(() => supervisor.start(), 'sandbox-escalation-fix.lifecycle()')\n  if ((config.logLevel ?? 'info') !== 'silent') {\n    ctx.logger.info('sandbox-escalation-fix: session-aware tool wrappers enabled')\n  }\n}\n\nexport function apply(ctx: Context, config: Config = {}): void {\n  startPlugin(ctx, config)\n}\n\nexport default { name, inject, Config, apply }\n"],"mappings":";;;;;;;AAKA,MAAa,yBAAyB;CAAC;CAAc;CAAc;CAAc;CAAc;CAAc;CAAc;CAAiB;CAAiB;CAAiB;CAAiB;CAAiB;CAAc;CAAiB;CAAiB;CAAiB;CAAiB;CAAc;CAAc;CAAiB;AAAe;AAE9V,MAAM,eAAe;CACnB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAM,+BAAe,IAAI,IAAI;CAAC;CAAQ;CAAQ;CAAS;AAAM,CAAC;AAC9D,MAAM,oBAAoB,CAAC,uBAAuB,eAAe;AAcjE,SAAS,qBAAqB,OAAyB;CACrD,MAAM,OAAQ,OAAwC;CACtD,OAAO,SAAS,sBAAsB,SAAS;AACjD;;;;;;;;;AAUA,SAAS,yBAAoD;CAC3D,MAAM,gBAAgB,cAAc,YAAY,GAAG;CACnD,MAAM,cAAc,cAAc,KAAK,QAAQ,IAAI,GAAG,cAAc,CAAC;CAErE,OAAO,CACL;EACE,OAAO;EACP,OAAM,SAAQ,cAAc,GAAG,KAAK,cAAc;CACpD,GACA;EACE,OAAO;EACP,OAAM,SAAQ,YAAY,GAAG,KAAK,cAAc;CAClD,CACF;AACF;AAEA,SAAgB,sBACd,UACM;CACN,MAAM,SAAS,IAAI,IAAI,OAAO,OAAO,QAAQ,CAAC;CAC9C,IAAI,OAAO,SAAS,GAAG;EACrB,MAAM,SAAS,OAAO,QAAQ,QAAQ,CAAC,CACpC,KAAK,CAAC,MAAM,aAAa,GAAG,KAAK,GAAG,SAAS,CAAC,CAC9C,KAAK,IAAI;EACZ,MAAM,IAAI,MAAM,2EAA2E,QAAQ;CACrG;CACA,MAAM,UAAU,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;CACvC,IAAI,YAAY,KAAA,KAAa,CAAC,uBAAuB,SAAS,OAAgD,GAC5G,MAAM,IAAI,MAAM,wDAAwD,WAAW,UAAU,yBAAyB,uBAAuB,KAAK,IAAI,GAAG;AAE7J;AAEA,SAAgB,8BACd,SACyB;CACzB,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,WAAmC,CAAC;EAC1C,MAAM,sBAAgC,CAAC;EAEvC,KAAK,MAAM,QAAQ,cAAc;GAC/B,IAAI;GACJ,IAAI;IACF,WAAW,OAAO,KAAK,IAAI;GAC7B,SAAS,OAAO;IACd,IAAI,qBAAqB,KAAK,GAAG;KAC/B,oBAAoB,KAAK,IAAI;KAC7B;IACF;IACA,MAAM,IAAI,MAAM,2CAA2C,KAAK,qBAAqB,OAAO,SAAS,EAAE,OAAO,MAAM,CAAC;GACvH;GACA,IAAI,OAAO,aAAa,YAAY,aAAa,QAC5C,EAAE,aAAa,aAAa,OAAO,SAAS,YAAY,UAC3D,MAAM,IAAI,MAAM,+BAA+B,KAAK,yCAAyC,OAAO,OAAO;GAE7G,SAAS,QAAQ,SAAS;EAC5B;EAEA,IAAI,oBAAoB,WAAW,GAAG;GACpC,sBAAsB,QAAQ;GAC9B,OAAO;IAAE,MAAM;IAAa;GAAoB;EAClD;EAIA,IAAI,oBAAoB,SAAS,aAAa,QAC5C,MAAM,IAAI,MAAM,iFAAiF,OAAO,MAAM,0BAA0B,oBAAoB,KAAK,IAAI,GAAG;CAE5K;CAGA,OAAO;EAAE,MAAM;EAAc,qBAAqB,CAAC,GAAG,YAAY;CAAE;AACtE;AAEA,SAAgB,mBACd,cACyB;CAIzB,OAAO,8BAHS,iBAAiB,KAAA,IAC7B,uBAAuB,IACvB,CAAC;EAAE,OAAO;EAA4B,MAAM;CAAa,CAAC,CAClB;AAC9C;AAEA,SAAS,OAAO,OAAgB,OAAwC;CACtE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,+BAA+B,MAAM,mBAAmB;CAE1E,OAAO;AACT;AAEA,SAAgB,mBAAmB,YAAkC;CACnE,IAAI,CAAC,aAAa,IAAI,WAAW,IAAI,GACnC,MAAM,IAAI,MAAM,wDAAwD,WAAW,KAAK,EAAE;CAE5F,IAAI,OAAO,WAAW,gBAAgB,YAAY,OAAO,WAAW,YAAY,YAC9E,MAAM,IAAI,MAAM,qCAAqC,WAAW,KAAK,iCAAiC;CAExG,MAAM,aAAa,OAAO,WAAW,YAAY,SAAS,WAAW,KAAK,aAAa;CACvF,IAAI,WAAW,SAAS,UACtB,MAAM,IAAI,MAAM,qCAAqC,WAAW,KAAK,qCAAqC;CAE5G,OAAO,WAAW,YAAY,SAAS,WAAW,KAAK,wBAAwB;CAC/E,MAAM,aAAa,WAAW;CAE9B,IADe,kBAAkB,QAAO,UAAS,WAAW,WAAW,KAAA,CAC9D,CAAC,CAAC,WAAW,GACpB,MAAM,IAAI,MAAM,qCAAqC,WAAW,KAAK,0EAA0E;CAEjJ,MAAM,SAAS,OAAO,WAAW,QAAQ,SAAS,WAAW,KAAK,SAAS;CAC3E,IAAI,OAAO,OAAO,WAAW,cAAc,OAAO,OAAO,WAAW,YAAY,OAAO,WAAW,MAChG,MAAM,IAAI,MAAM,qCAAqC,WAAW,KAAK,kCAAkC;AAE3G;;;AClJA,SAAS,kBAAkB,QAA0D;CACnF,MAAM,aAAa,EAAE,GAAG,OAAO;CAC/B,OAAO,WAAW;CAClB,OAAO,WAAW;CAClB,OAAO;AACT;AAEA,SAAS,SAAS,MAAc,MAAuB;CACrD,MAAM,eAAe,SAAS,MAAM,IAAI;CACxC,OAAO,iBAAiB,MAClB,CAAC,WAAW,YAAY,KAAK,iBAAiB,QAAQ,CAAC,aAAa,WAAW,KAAK,KAAK;AACjG;AAEA,SAAS,oBAAoB,MAAkC;CAC7D,IAAI,UAAU;CACd,OAAO,MACL,IAAI;EACF,OAAO,aAAa,OAAO,OAAO;CACpC,SAAS,OAAO;EACd,MAAM,OAAQ,MAAgC;EAC9C,IAAI,SAAS,YAAY,SAAS,WAAW,OAAO,KAAA;EACpD,MAAM,SAAS,QAAQ,OAAO;EAC9B,IAAI,WAAW,SAAS,OAAO,KAAA;EAC/B,UAAU;CACZ;AAEJ;AAEA,SAAS,oBAAoB,UAAmB,eAA4C;CAC1F,IAAI,OAAO,aAAa,YAAY,SAAS,KAAK,CAAC,CAAC,WAAW,KAAK,kBAAkB,KAAA,GAAW,OAAO;CACxG,MAAM,eAAe,QAAQ,aAAa;CAC1C,MAAM,SAAS,QAAQ,cAAc,QAAQ;CAC7C,IAAI,CAAC,SAAS,cAAc,MAAM,GAAG,OAAO;CAC5C,IAAI;CACJ,IAAI;EACF,gBAAgB,aAAa,OAAO,YAAY;CAClD,QAAQ;EACN,OAAO;CACT;CACA,MAAM,kBAAkB,oBAAoB,MAAM;CAClD,OAAO,oBAAoB,KAAA,KAAa,SAAS,eAAe,eAAe;AACjF;AAEA,SAAgB,6BACd,MACA,eACA,UAA0C,CAAC,GAClC;CACT,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG,OAAO;CAC7E,MAAM,SAAS;CACf,IAAI,CAAC,OAAO,OAAO,QAAQ,qBAAqB,KAAK,CAAC,OAAO,OAAO,QAAQ,eAAe,GACzF,OAAO;CAET,IAAI,OAAO,wBAAwB,eAAe,OAAO,kBAAkB,MAAM;CACjF,IACE,kBAAkB,qBACf,OAAO,wBAAwB,yBAC9B,QAAQ,aAAa,WAAW,QAAQ,aAAa,WACtD,oBAAoB,OAAO,WAAW,QAAQ,aAAa,GAE9D,OAAO,kBAAkB,MAAM;CAEjC,OAAO;AACT;;;ACxEA,MAAM,mBAAmB;AAEzB,SAAgB,6BACd,aACA,sBACQ;CACR,IAAI,sBAAsB,OAAO;CACjC,MAAM,QAAQ,YAAY,QAAQ,gBAAgB;CAClD,IAAI,UAAU,IAAI,OAAO;CACzB,IAAI,YAAY,QAAQ,kBAAkB,QAAQ,EAAuB,MAAM,IAC7E,MAAM,IAAI,MAAM,8EAA8E;CAEhG,OAAO,YAAY,MAAM,GAAG,KAAK;AACnC;;;ACDA,SAAgB,wBACd,eACA,gBACwB;CACxB,OAAO,mBAAmB,UAAU,CAAC,IAAI,YAAY,kBAAkB,CAAC;AAC1E;AAEA,SAAgB,oBAAoB,KAAc,OAAoC;CACpF,MAAM,gBAAgB,IAAI,cAAc,QAAQ,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC;CAC5E,MAAM,iBAAiB,IAAI,SAAS,WAAW,MAAM,OAAO,KACvD,IAAI,SAAS,OAAO,UACpB;CACL,OAAO;EACL;EACA;EACA,eAAe,wBAAwB,eAAe,cAAc;CACtE;AACF;;;AC3BA,SAAgB,qBACd,MACA,cACA,MACQ;CACR,MAAM,QAAQ,KAAK,MAAM,IAAI;CAC7B,IAAI,CAAC,MAAM,SAAS,YAAY,KAAK,CAAC,MAAM,SAAS,IAAI,GAAG,OAAO;CACnE,OAAO,MAAM,QAAO,SAAQ,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI;AACtD;AAEA,SAAgB,uBACd,SACA,cACA,MAC4B;CAC5B,IAAI,QAAQ,WAAW,KAAK,QAAQ,EAAE,EAAE,SAAS,QAAQ,OAAO,KAAA;CAChE,MAAM,OAAO,qBAAqB,QAAQ,EAAE,CAAC,MAAM,cAAc,IAAI;CACrE,OAAO,SAAS,QAAQ,EAAE,CAAC,OAAO,KAAA,IAAY,CAAC;EAAE,MAAM;EAAQ;CAAK,CAAC;AACvE;;;AClBA,MAAM,sBAAsB;AAC5B,MAAM,gBAAgB;AAEtB,SAAS,aAAa,OAAgB,OAAwC;CAC5E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,+BAA+B,MAAM,mBAAmB;CAE1E,OAAO;AACT;AAEA,SAAgB,4BACd,YACA,SACyB;CACzB,MAAM,YAAY,gBAAgB,UAAU;CAC5C,MAAM,OAAO,aAAa,WAAW,iBAAiB;CACtD,IAAI,KAAK,SAAS,UAChB,MAAM,IAAI,MAAM,4EAA0E;CAE5F,MAAM,aAAa,aAAa,KAAK,YAAY,4BAA4B;CAC7E,MAAM,cAAc,WAAW;CAC/B,MAAM,gBAAgB,WAAW;CACjC,IAAI,gBAAgB,KAAA,KAAa,kBAAkB,KAAA,GAAW,OAAO;CACrE,IAAI,gBAAgB,KAAA,KAAa,kBAAkB,KAAA,GACjD,MAAM,IAAI,MAAM,2GAA2G;CAE7H,MAAM,oBAAoB,aAAa,aAAa,4BAA4B;CAChF,MAAM,sBAAsB,aAAa,eAAe,sBAAsB;CAC9E,IAAI,kBAAkB,SAAS,YAAY,CAAC,MAAM,QAAQ,kBAAkB,IAAI,KAC3E,CAAC,kBAAkB,KAAK,OAAM,UAAS,OAAO,UAAU,QAAQ,GACnE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,IAAI,oBAAoB,SAAS,UAC/B,MAAM,IAAI,MAAM,4DAA4D;CAE9E,IAAI,QAAQ,WAAW,GAAG;EACxB,OAAO,WAAW;EAClB,OAAO,WAAW;EAClB,IAAI,MAAM,QAAQ,KAAK,QAAQ,GAAG;GAChC,MAAM,WAAW,KAAK,SAAS,QAC7B,UAAS,UAAU,uBAAuB,UAAU,aACtD;GACA,IAAI,SAAS,WAAW,GAAG,OAAO,KAAK;QAClC,KAAK,WAAW;EACvB;EACA,OAAO;CACT;CACA,kBAAkB,OAAO,CAAC,GAAG,OAAO;CACpC,OAAO;AACT;;;AC/CA,MAAa,eAAe;AAS5B,SAAS,aAAa,QAA2D;CAC/E,OAAO,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,MACzB,MAAM,UAAU,KAAK,WAAW,MAAM,YAAY,KAAK,MAAM,cAAc,MAAM,KAAK,CACzF;AACF;AAEA,SAAgB,qBACd,iBACA,UACgB;CAChB,IAAI,kBAAkB;CACtB,MAAM,yBAAS,IAAI,IAA0B,CAAC,CAAC,SAAS,OAAO,QAAQ,CAAC,CAAC;CACzE,MAAM,UAAU,EAAE,UAAU,gBAAgB,KAAK;CACjD,MAAM,iBAAiC;CAEvC,MAAM,WAAW,UAAwB;EACvC,OAAO,OAAO,KAAK;CACrB;CAEA,MAAM,aAAwC;EAC5C,MAAM,gBAAgB;EACtB,IAAI,cAAsB;GACxB,MAAM,UAAU,SAAS;GACzB,OAAO,aAAa,MAAM,CAAC,CAAC,QACzB,OAAO,UAAU,MAAM,qBAAqB,OAAO,OAAO,KAAK,OAChE,QAAQ,WACV;EACF;EACA,IAAI,aAAsC;GACxC,MAAM,UAAU,SAAS;GACzB,OAAO,aAAa,MAAM,CAAC,CAAC,QACzB,OAAO,UAAU,MAAM,oBAAoB,OAAO,OAAO,KAAK,OAC/D,QAAQ,UACV;EACF;EACA,IAAI,SAAS;GACX,OAAO,SAAS,CAAC,CAAC;EACpB;EACA,QAAQ,MAAe,MAAwC;GAC7D,MAAM,kBAAkB,SAAS;GACjC,MAAM,SAAS,aAAa,MAAM,CAAC,CAAC,QACjC,UAA2E,MAAM,YAAY,KAAA,CAChG;GACA,MAAM,YAAY,OAAe,YAAuC;IACtE,MAAM,QAAQ,OAAO;IACrB,IAAI,UAAU,KAAA,GACZ,OAAO,QAAQ,MAAM,gBAAgB,SAAS,iBAAiB,CAAC,SAAS,IAAI,CAAC;IAEhF,IAAI,SAAS;IACb,OAAO,MAAM,QAAQ,SAAS,OAAO,aAAa;KAChD,IAAI,QAAQ,MAAM,IAAI,MAAM,wCAAwC,MAAM,MAAM,+BAA+B;KAC/G,SAAS;KACT,OAAO,SAAS,QAAQ,GAAG,QAAQ;IACrC,CAAC;GACH;GACA,OAAO,SAAS,GAAG,IAAI;EACzB;GACC,wBAAwB;GACvB,SAAS;GACT,OAAO;GACP,MAAM,gBAAgB;GACtB,WAAW,OAAiC;IAC1C,IAAI,OAAO,IAAI,MAAM,KAAK,GACxB,MAAM,IAAI,MAAM,8CAA8C,MAAM,MAAM,+BAA+B,gBAAgB,KAAK,EAAE;IAElI,OAAO,IAAI,MAAM,OAAO,KAAK;IAC7B,IAAI,SAAS;IACb,aAAa;KACX,IAAI,CAAC,QAAQ;KACb,SAAS;KACT,QAAQ,MAAM,KAAK;IACrB;GACF;EACF;CACF;CAIA,OAAO,eAAe,YAAY,aAAa;EAC7C,YAAY;EACZ,WAAW,SAAS,CAAC,CAAC;CACxB,CAAC;CAED,IAAI,gBAAgB,oBAAoB,KAAA,GACtC,WAAW,mBAAmB,MAAM,WAAW;EAC7C,MAAM,UAAU,SAAS;EACzB,OAAO,QAAQ,iBAAiB,KAAK,SAAS,MAAM,MAAM;CAC5D;CAEF,IAAI,gBAAgB,sBAAsB,KAAA,GACxC,WAAW,qBAAoB,SAAQ;EACrC,MAAM,UAAU,SAAS;EACzB,OAAO,QAAQ,mBAAmB,KAAK,SAAS,IAAI,MAAM;CAC5D;CAEF,IAAI,gBAAgB,gBAAgB,KAAA,GAClC,WAAW,eAAc,SAAQ;EAC/B,MAAM,UAAU,SAAS;EACzB,OAAO,QAAQ,aAAa,KAAK,SAAS,IAAI;CAChD;CAEF,IAAI,gBAAgB,kBAAkB,KAAA,GACpC,WAAW,iBAAiB,MAAM,WAAW;EAC3C,MAAM,UAAU,SAAS;EACzB,OAAO,QAAQ,eAAe,KAAK,SAAS,MAAM,MAAM;CAC1D;CAGF,OAAO;EACL;EACA,eAAe,MAAY;GACzB,IAAI,KAAK,SAAS,gBAAgB,MAChC,MAAM,IAAI,MAAM,+BAA+B,gBAAgB,KAAK,QAAQ,KAAK,KAAK,EAAE;GAE1F,kBAAkB;EACpB;EACA,WAAW,OAAmB;GAC5B,OAAO,WAAW,sBAAsB,CAAE,WAAW,KAAK;EAC5D;EACA,kBAAwB;GACtB,QAAQ,SAAS,KAAK;EACxB;CACF;AACF;;;ACxHA,MAAM,eAAe;CAAC;CAAQ;CAAQ;CAAS;AAAM;AA6BrD,SAAS,gBAAgB,KAAc,OAAc,MAAkD;CACrG,OAAO,IAAI,MAAM,IAAI,MAAM,KAAK;AAClC;AAEA,SAAS,SAAS,KAAc,OAAc,UAAwC;CACpF,OAAO;EACL,OAAO;EACP,UAAU;EACV,mBAAmB,OAAuB;GAExC,OAAO,6BAA6B,OADrB,oBAAoB,KAAK,KACG,CAAA,CAAO,cAAc,SAAS,CAAC;EAC5E;EACA,kBAAkB,OAAyD;GACzE,OAAO,4BAA4B,OAAO,oBAAoB,KAAK,KAAK,CAAC,CAAC,aAAa;EACzF;EACA,QAAQ,MAAe,MAAgD,MAA6D;GAClI,MAAM,YAAY,KAAK,SAAS;GAChC,MAAM,SAAS,IAAI,cAAc,QAAQ,EAAE,SAAS,UAAU,QAAQ,CAAC;GACvE,OAAO,KAAK,6BAA6B,MAAM,OAAO,MAAM;IAC1D;IACA,eAAe,OAAO;GACxB,CAAC,CAAC;EACJ;CACF;AACF;AAEA,SAAS,iBACP,KACA,OACA,QACqB;CACrB,IAAI,CAAC,OAAO,WAAW,OAAO,MAAM,MAAM,SAAS,qBAAqB,OAAO;CAC/E,MAAM,SAAS,oBAAoB,KAAK,KAAK;CAC7C,IAAI,OAAO,cAAc,SAAS,GAAG,OAAO;CAC5C,MAAM,SAAS,oBAAoB,OAAO,aAAa;CACvD,MAAM,OAAO,qBAAqB,WAAW;CAC7C,MAAM,UAAU,qBAAqB,OAAO,MAAM,SAAS,QAAQ,IAAI;CACvE,IAAI,YAAY,OAAO,MAAM,SAAS,OAAO;CAC7C,OAAO;EACL,GAAG;EACH,OAAO;GAAE,GAAG,OAAO;GAAO;EAAQ;EAClC,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,UAAU;EAAU,CAAC;CACvD;AACF;AAEA,SAAS,0BACP,KACA,OACA,MACA,QACA,UACkB;CAClB,IAAI,SAAS,SAAS,WAAW,OAAO,SAAS,OAAO;CACxD,MAAM,SAAS,oBAAoB,KAAK,KAAK;CAC7C,IAAI,OAAO,cAAc,SAAS,GAAG,OAAO;CAC5C,MAAM,SAAS,oBAAoB,OAAO,aAAa;CACvD,MAAM,OAAO,qBAAqB,SAAS;CAC3C,IAAI,SAAS,cAAc;EACzB,IAAI,OAAO,OAAO,UAAU,OAAO,KAAK,SAAS,YAAY,KAAA,GAC3D,OAAO;GACL,MAAM;GACN,UAAU,CAAC;IAAE,MAAM;IAAQ,MAAM;GAAiG,CAAC;EACrI;EAEF,MAAM,QAAQ,OAAO;EACrB,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO;EAChF,MAAM,SAAS;EACf,IAAI,OAAO,OAAO,SAAS,UAAU,OAAO;EAC5C,MAAM,OAAO,qBAAqB,OAAO,MAAM,QAAQ,IAAI;EAC3D,OAAO,SAAS,OAAO,OAAO,WAAW;GAAE,MAAM;GAAU,OAAO;IAAE,GAAG;IAAQ;GAAK;EAAE;CACxF;CACA,IAAI,SAAS,UAAU,SAAS,QAAQ,OAAO;CAC/C,IAAI,OAAO,OAAO,UAAU,OAAO,GACjC,OAAO;EACL,MAAM;EACN,UAAU,CAAC;GAAE,MAAM;GAAQ,MAAM,iDAAiD,KAAK;EAAwC,CAAC;CAClI;CAGF,MAAM,UAAU,uBADA,SAAS,WAAW,OAAO,SACK,QAAQ,IAAI;CAC5D,OAAO,YAAY,KAAA,IACf,WACA;EAAE,MAAM;EAAU,SAAS;EAAS,GAAG,SAAS,qBAAqB,EAAE,oBAAoB,SAAS,mBAAmB,IAAI,CAAC;CAAE;AACpI;AAEA,IAAa,aAAb,MAAwB;CAMO;CAL7B,yBAA0B,IAAI,IAAuB;CACrD,cAAsB;CACtB,sBAA8B;CAC9B,mBAA2B;CAE3B,YAAY,KAA+B;EAAd,KAAA,MAAA;CAAe;CAE5C,QAA6B;EAC3B,MAAM,cAAc,KAAK,IAAI,GAAG,kBAAkB,EAAE,YAAY;GAC9D,KAAK,QAAQ,KAAK;EACpB,CAAC;EACD,MAAM,eAAe,KAAK,IAAI,GAAG,mBAAmB,EAAE,YAAY;GAChE,IAAI;IACF,KAAK,OAAO,KAAK;GACnB,SAAS,OAAO;IACd,KAAK,IAAI,OAAO,KAAK,sCAAsC,MAAM,GAAG,oBAAoB,OAAO,KAAK,GAAG;GACzG;EACF,CAAC;EACD,MAAM,aAAa,KAAK,IAAI,GAAG,0BAA0B,cAAc;GACrE,MAAM,QAAQ,KAAK,IAAI,OAAO,IAAI,SAAS;GAC3C,IAAI,UAAU,KAAA,GAAW,KAAK,eAAe,KAAK;EACpD,CAAC;EACD,MAAM,YAAY,KAAK,IAAI,GAAG,sBAAsB;GAClD,IAAI,KAAK,sBAAsB,GAAG;IAChC,KAAK,uBAAuB;IAC5B;GACF;GACA,IAAI,KAAK,cAAc,GAAG;IACxB,KAAK,mBAAmB;IACxB;GACF;GACA,KAAK,aAAa;EACpB,CAAC;EACD,KAAK,MAAM,SAAS,KAAK,IAAI,OAAO,KAAK,GAAG,KAAK,QAAQ,KAAK;EAC9D,aAAa;GACX,UAAU;GACV,WAAW;GACX,aAAa;GACb,YAAY;GACZ,MAAM,SAAS,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC;GACvC,KAAK,OAAO,MAAM;GAClB,KAAK,MAAM,SAAS,QAClB,IAAI;IACF,KAAK,iBAAiB,KAAK,aAAa,KAAK,CAAC;GAChD,SAAS,OAAO;IACd,KAAK,IAAI,OAAO,KAAK,sCAAsC,MAAM,MAAM,GAAG,oBAAoB,OAAO,KAAK,GAAG;GAC/G;GAEF,OAAO,QAAQ,QAAQ;EACzB;CACF;CAEA,QAAgB,OAAoB;EAClC,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG;EAC5B,MAAM,UAAU,IAAI,IAClB,aAAa,KAAI,SAAQ,CAAC,MAAM;GAC9B;GACA,YAAY,EAAE,MAAM,UAAU;EAChC,CAAC,CAAC,CACJ;EACA,MAAM,YAAkC,CAAC;EACzC,MAAM,QAAoB;GACxB;GACA;GACA;GACA,UAAU;EACZ;EACA,KAAK,OAAO,IAAI,OAAO,KAAK;EAC5B,IAAI;GACF,KAAK,iBAAiB,KAAK,eAAe,OAAO,IAAI,CAAC;GACtD,UAAU,KAAK,KAAK,IAAI,GAAG,iBAAiB,OAAO,MAAM,SAAuC;IAC9F,MAAM,SAAS,MAAM,KAAK;IAC1B,OAAO,KAAK,UAAU,UAAU,KAAK,SAAS,WAAW,KAAK,SAAS,UACnE,iBAAiB,KAAK,KAAK,OAAO,MAAM,IACxC;GACN,GAAG,EAAE,SAAS,KAAK,CAAC,CAAC;GACrB,UAAU,KAAK,KAAK,IAAI,GAAG,sBAAsB,OAAO,MAAM,QAAQ,SAAoC;IACxG,MAAM,WAAW,MAAM,KAAK;IAC5B,OAAO,KAAK,UAAU,QAClB,0BAA0B,KAAK,KAAK,OAAO,KAAK,MAAM,QAAQ,QAAQ,IACtE;GACN,GAAG,EAAE,SAAS,KAAK,CAAC,CAAC;EACvB,SAAS,OAAO;GACd,KAAK,OAAO,OAAO,KAAK;GACxB,KAAK,iBAAiB,KAAK,aAAa,KAAK,CAAC;GAC9C,MAAM;EACR;CACF;CAEA,OAAe,OAAoB;EACjC,MAAM,QAAQ,KAAK,OAAO,IAAI,KAAK;EACnC,IAAI,UAAU,KAAA,GAAW;EACzB,KAAK,OAAO,OAAO,KAAK;EACxB,KAAK,iBAAiB,KAAK,aAAa,KAAK,CAAC;CAChD;CAEA,eAAuB,OAAoB;EACzC,IAAI,KAAK,cAAc,GAAG;EAC1B,MAAM,QAAQ,KAAK,OAAO,IAAI,KAAK;EACnC,IAAI,UAAU,KAAA,GAAW;EACzB,KAAK,iBAAiB,KAAK,eAAe,OAAO,KAAK,CAAC;CACzD;CAEA,eAA6B;EAC3B,IAAI,KAAK,cAAc,GAAG;EAC1B,KAAK,iBAAiB;GACpB,KAAK,MAAM,SAAS,KAAK,OAAO,OAAO,GACrC,KAAK,eAAe,OAAO,KAAK;EAEpC,CAAC;CACH;CAEA,eAAuB,OAAmB,QAAuB;EAC/D,IAAI,MAAM,UAAU;EACpB,KAAK,MAAM,UAAU,MAAM,QAAQ,OAAO,GACxC,IAAI;GACF,KAAK,gBAAgB,MAAM,OAAO,MAAM;EAC1C,SAAS,OAAO;GACd,IAAI,QAAQ,MAAM;GAClB,KAAK,cAAc,MAAM,OAAO,QAAQ,KAAK;EAC/C;CAEJ;CAEA,gBAAwB,OAAc,QAA2B;EAC/D,KAAK,aAAa,MAAM;EACxB,MAAM,WAAW,gBAAgB,KAAK,KAAK,OAAO,OAAO,IAAI;EAC7D,IAAI,aAAa,KAAA,GAAW;GAC1B,OAAO,OAAO;GACd;EACF;EACA,IAAI;GACF,mBAAmB,QAAQ;GAC3B,MAAM,WAAW,WAAW,QAAQ;GACpC,IAAI,aAAa,KAAA,GACf,OAAO,aAAa;IAClB,MAAM;IACN,SAAS,SAAS,WAAW,SAAS,KAAK,KAAK,OAAO,OAAO,IAAI,CAAC;GACrE;QACK;IACL,MAAM,UAAU,OAAO,WAClB,qBAAqB,UAAU,SAAS,KAAK,KAAK,OAAO,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,YAAY,KAAA,GACrB,OAAO,UAAU;SAEjB,QAAQ,eAAe,QAAQ;IAEjC,MAAM,kBAAkB,MAAM,IAAI,OAAO,EAAE,OAAO,KAAK,IAAI,MAAM,CAAC;IAClE,OAAO,aAAa;KAClB,MAAM;KACN,YAAY,KAAK,kBACT,gBAAgB,MAAM,SAAS,QAAQ,UAAU,CACzD;IACF;GACF;GACA,OAAO,OAAO;EAChB,SAAS,OAAO;GAEd,OAAO,aAAa;IAAE,MAAM;IAAgB,QAD7B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACjB;GACnD,MAAM;EACR;CACF;CAEA,aAAqB,QAA2B;EAC9C,MAAM,aAAa,OAAO;EAC1B,IAAI,WAAW,SAAS,WAAW;EACnC,IAAI,WAAW,SAAS,gBAAgB;GACtC,OAAO,aAAa,EAAE,MAAM,UAAU;GACtC;EACF;EACA,IAAI,WAAW,SAAS,SACtB,KAAK,YAAY,WAAW,UAAU;OAEtC,WAAW,QAAQ;EAErB,OAAO,aAAa,EAAE,MAAM,UAAU;CACxC;CAEA,aAAqB,OAAyB;EAC5C,IAAI,MAAM,UAAU;EACpB,MAAM,WAAW;EACjB,MAAM,SAAoB,CAAC;EAC3B,KAAK,MAAM,UAAU,CAAC,GAAG,MAAM,QAAQ,OAAO,CAAC,CAAC,CAAC,QAAQ,GACvD,IAAI;GACF,KAAK,aAAa,MAAM;EAC1B,SAAS,OAAO;GACd,OAAO,KAAK,KAAK;EACnB;EAEF,KAAK,MAAM,WAAW,MAAM,UAAU,OAAO,CAAC,CAAC,CAAC,QAAQ,GACtD,IAAI;GACF,QAAQ;EACV,SAAS,OAAO;GACd,OAAO,KAAK,KAAK;EACnB;EAEF,IAAI,OAAO,SAAS,GAClB,MAAM,IAAI,eAAe,QAAQ,UAAU,MAAM,MAAM,GAAG,iBAAiB;CAE/E;CAEA,cAAsB,OAAc,QAAqB,OAAsB;EAC7E,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,IAAI,OAAO,sBAAsB,SAAS;EAC1C,OAAO,oBAAoB;EAC3B,KAAK,IAAI,OAAO,KACd,sCAAsC,MAAM,GAAG,UAAU,OAAO,KAAK,mCAAmC,SAC1G;CACF;CAEA,WAAmB,QAA0B;EAC3C,KAAK,eAAe;EACpB,IAAI;GACF,OAAO;EACT,UAAU;GACR,KAAK,eAAe;GACpB,IAAI,KAAK,gBAAgB,KAAK,KAAK,kBAAkB;IACnD,KAAK,mBAAmB;IACxB,KAAK,aAAa;GACpB;EACF;CACF;CAEA,YAAuB,QAAoB;EACzC,KAAK,uBAAuB;EAC5B,MAAM,WAAW,KAAK;EACtB,IAAI;GACF,OAAO,OAAO;EAChB,UAAU;GACR,IAAI,KAAK,wBAAwB,UAC/B,KAAK,uBAAuB;EAEhC;CACF;AAEF;;;ACjWA,MAAa,SAAoB,EAAE,OAAO,EACxC,UAAU,EAAE,MAAM;CAAC;CAAU;CAAQ;AAAO,CAAU,CAAC,CAAC,QAAQ,MAAM,EACxE,CAAC;AAED,MAAa,OAAO;AACpB,MAAa,SAAS;CAAC;CAAU;CAAS;CAAiB;AAAU;AAErE,SAAgB,YACd,KACA,SAAiB,CAAC,GAClB,gBAAyC,mBAAmB,GACtD;CACN,IAAI,cAAc,SAAS,cACzB,IAAI,OAAO,KAAK,yHAAyH;CAE3I,MAAM,aAAa,IAAI,WAAW,GAAG;CACrC,IAAI,aAAa,WAAW,MAAM,GAAG,oCAAoC;CACzE,KAAK,OAAO,YAAY,YAAY,UAClC,IAAI,OAAO,KAAK,6DAA6D;AAEjF;AAEA,SAAgB,MAAM,KAAc,SAAiB,CAAC,GAAS;CAC7D,YAAY,KAAK,MAAM;AACzB;AAEA,IAAA,cAAe;CAAE;CAAM;CAAQ;CAAQ;AAAM"}