diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 7ceb3cc46..1de107b31 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,3 +1,6 @@ +# Built viewer bundles are generated output, not hand-edited source. +exclude: ^strix/interface/viewer/static/assets/ + repos: # Ruff for fast linting and formatting - repo: https://github.com/astral-sh/ruff-pre-commit @@ -9,21 +12,18 @@ repos: - id: ruff-format name: ruff-format - # MyPy for static type checking - - repo: https://github.com/pre-commit/mirrors-mypy - rev: v1.17.1 + # MyPy for static type checking. Runs the project's own mypy from the uv + # environment (`make dev-install`) so it sees the same dependencies and + # stubs as `make check-all`. + - repo: local hooks: - id: mypy - additional_dependencies: [ - types-requests, - types-python-dateutil, - pydantic, - fastapi, - pytest, - hatchling, - "openai-agents[litellm]>=0.19.0,<0.20", - ] - args: [--install-types, --non-interactive] + name: mypy + entry: uv run mypy + language: system + types_or: [python, pyi] + files: ^(strix|tests)/ + require_serial: true # Built-in hooks for basic file checks - repo: https://github.com/pre-commit/pre-commit-hooks @@ -62,5 +62,6 @@ ci: autoupdate_branch: "" autoupdate_commit_msg: "[pre-commit.ci] pre-commit autoupdate" autoupdate_schedule: weekly - skip: [] + # pre-commit.ci cannot run `language: system` hooks; mypy runs via `make check-all`. + skip: [mypy] submodules: false diff --git a/AGENTS.md b/AGENTS.md index b347278be..ab3fd988d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -28,7 +28,7 @@ Target-specific workflows built on the same engine: - **Open-source CLI (self-hosted):** free, fully local, BYO LLM key, needs Docker. Best for local dev loops, air-gapped/offline, and full control. ```bash curl -sSL https://strix.ai/install | bash # install - export STRIX_LLM="openai/gpt-5.4" # any LiteLLM model id + export STRIX_LLM="openrouter/z-ai/glm-5.3" # any LiteLLM model id export LLM_API_KEY="" strix -n -t ./ --scan-mode quick --max-budget 10 # headless scan; always use -n ``` @@ -38,13 +38,25 @@ Target-specific workflows built on the same engine: - **Managed cloud (app.strix.ai):** no Docker, no LLM key, no local install; adds team dashboards, scheduling, PR reviews, and downloadable PDF/DOCX reports (Enterprise plan). Best in sandboxed/CI environments and for teams. Use it when local infra isn't available. ```bash - # token from Settings → API Access; register the target as an asset, then: - curl -sS https://app.strix.ai/api/v1/scans -H "Authorization: Bearer $STRIX_API_TOKEN" \ - -H "Content-Type: application/json" -d '{"engagement_type":"live_test","domain_ids":[""]}' + strix cloud login --scopes scans:read scans:write uploads:write billing:read + strix cloud domains add --domain example.com --asset-type web_app + strix cloud scans start --engagement-type live_test --domain-ids --wait + strix cloud scans start --source . --dry-run --show-files --json # review + capture source.archive_sha256 + SOURCE_SHA256="" + strix cloud scans start --source . --approve-sha256 "$SOURCE_SHA256" --wait + strix cloud vulns list --severity critical + strix cloud billing topup --credits 20 --yes # explicit approval after exit code 5 ``` - - API docs: https://docs.app.strix.ai (OpenAPI: https://docs.app.strix.ai/openapi.json). + - Account setup runs from the CLI too: `strix cloud workspaces list|create|use` (`workspace` is an alias and `use` accepts a displayed number, name, or ID), `strix cloud session scopes|scopes set`, `strix cloud org members invite`, `strix cloud billing subscribe --plan strix_cloud`, `strix cloud billing portal`, `strix cloud integrations install github`, and `strix cloud domains verify `. Workspace switching preserves the server-side profile and can never widen past the login ceiling; ordinary switches do not reprompt. The last four end at a person: the command prints a link or a DNS record for the user to open or add, and it never completes the payment, installation, or DNS change for them. + - Every REST operation has a `strix cloud ` command. Run `strix cloud` to list them. Output is JSON when stdout is not a terminal (or with `--json`), and there are no prompts without a TTY. Binary downloads are the exception: redirect raw bytes intentionally, or combine `--output FILE --json` for structured download metadata. Exit codes: `0` success, `1` error, `2` usage, `4` auth or plan limit, `5` payment required. `--token` or `STRIX_API_TOKEN` is a stateless override and never replaces stored auth; set `--workspace-id`/`STRIX_WORKSPACE_ID` for an override CLI session. `--data` adds extra request fields as JSON, and accepts `@file` or `-` for standard input. + - Local source uploads require `uploads:write`. For an agent/CI handoff, review `scans start --source . --dry-run --show-files --json`, capture `source.archive_sha256`, then rerun with the same `--source`, `--exclude`, and `--include-*` selection flags plus `--approve-sha256 HASH`. A changed snapshot is rejected. `--yes` approves only the snapshot built in that invocation, so reserve it for a deliberate human or one-shot approval rather than a digest-bound two-step handoff. + - Git ignores, hidden files, `.git`, symlinks, dependency/build output, secret-like filenames, and nested archives are excluded by default; `.strixignore` and `--exclude` narrow the manifest further (a trailing `/` excludes a directory subtree). Limits: 20,000 files, 25 MiB/file, 250 MiB expanded, 50 MiB compressed. Source-only infers `code_review`; source plus a domain infers `live_test`. + - The temporary local archive is always removed. A staged upload is deleted after a definitive rejection, but retained when a network error, `5xx`, malformed success response, or interruption leaves the scan launch ambiguous. JSON reports its `upload_id` with `launch_outcome_unknown: true`, or with `cleanup_unknown: true` when automatic deletion cannot be confirmed. Check `scans list` before retrying; if no scan is linked, run `uploads delete UPLOAD_ID`. + - Non-Enterprise scans consume the scope estimate (a default-tier source-only review currently starts at 60 credits); Enterprise scans are plan-included. A rejected launch does not consume credits. + - Human output is compact and numbered; non-TTY output and `--json` retain full records. Enable tab completion with `source <(strix completions zsh)` (or `bash`), or `strix completions fish | source`. + - The REST API works directly too: https://docs.app.strix.ai (OpenAPI: https://docs.app.strix.ai/openapi.json). -- CLI docs index for LLMs: https://docs.strix.ai/llms.txt (full: https://docs.strix.ai/llms-full.txt). +- CLI docs index for LLMs: https://docs.strix.ai/llms.txt (full: https://docs.strix.ai/llms-full.txt). Managed API docs for LLMs: https://docs.app.strix.ai/llms.txt. - Only scan targets the user is authorized to test. ## Contributing to this repo diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 23028d3e5..37b20d631 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -31,7 +31,7 @@ Thank you for your interest in contributing to Strix! This guide will help you g 3. **Configure your LLM provider** ```bash - export STRIX_LLM="openai/gpt-5.4" + export STRIX_LLM="openrouter/z-ai/glm-5.3" export LLM_API_KEY="your-api-key" ``` diff --git a/README.md b/README.md index 99c235afb..351b96e75 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,9 @@ Website [![](https://dcbadge.limes.pink/api/server/strix-ai)](https://discord.gg/strix-ai) +Strix Cloud +Try Strix Enterprise + Ask DeepWiki GitHub Stars License @@ -34,7 +37,7 @@ > [!TIP] -> **New!** Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches production - [Get started with no setup required](https://app.strix.ai). +> **New!** Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches production - [Get started with no setup required](https://app.strix.ai?utm_source=github&utm_medium=readme&utm_content=tip_ci). --- @@ -82,7 +85,7 @@ Strix are autonomous AI penetration testing agents that act just like real hacke curl -sSL https://strix.ai/install | bash # Configure your AI provider -export STRIX_LLM="openai/gpt-5.4" +export STRIX_LLM="openrouter/z-ai/glm-5.3" export LLM_API_KEY="your-api-key" # Run your first security assessment @@ -94,9 +97,17 @@ strix --target ./app-directory --- -## ☁️ Strix Platform +## Ways to Run Strix -Try the Strix full-stack penetration testing platform at **[app.strix.ai](https://app.strix.ai)** - sign up for free, connect your repos and domains, and launch a pentest in minutes. +- **Open Source** - free, runs locally with Docker and your own LLM key. [Quick Start](https://docs.strix.ai/quickstart) +- **Strix Cloud** - no setup, validated findings, one-click autofix, and PR reviews. [Run a pentest →](https://app.strix.ai?intent=pentest&utm_source=github&utm_medium=readme&utm_content=table_cloud) +- **Enterprise** - SSO, compliance-ready reports, VPC or self-hosted deployment. [Try Strix Enterprise →](https://strix.ai/demo?utm_source=github&utm_medium=readme&utm_content=table_demo) + +--- + +## ☁️ Strix Cloud + +Try the Strix full-stack penetration testing platform at **[app.strix.ai](https://app.strix.ai?utm_source=github&utm_medium=readme&utm_content=cloud_heading)** - sign up for free, connect your repos and domains, and launch a pentest in minutes. - **Validated findings with PoCs** - every vulnerability includes a working proof-of-concept exploit and reproduction steps - **One-click autofix** - AI-generated security patches as ready-to-merge pull requests @@ -104,7 +115,13 @@ Try the Strix full-stack penetration testing platform at **[app.strix.ai](https: - **DevSecOps integrations** - GitHub, GitLab, Bitbucket, Slack, Jira, Linear, and CI/CD pipelines - **Continuous learning** - AI that builds on past findings, adapts to your codebase, and reduces false positives over time -[**Start your first pentest →**](https://app.strix.ai) +[**Run a pentest →**](https://app.strix.ai?intent=pentest&utm_source=github&utm_medium=readme&utm_content=cloud_cta) + +## 🏢 Enterprise + +Get the same Strix experience with enterprise-grade controls: SSO (SAML/OIDC), custom compliance-ready penetration testing reports (SOC 2, ISO 27001, PCI DSS), dedicated support and SLA, custom deployment options (VPC or self-hosted), BYOK model support, and tailored AI pentesting agents optimized for your environment. + +[**Try Strix Enterprise →**](https://strix.ai/demo?utm_source=github&utm_medium=readme&utm_content=enterprise_cta) --- @@ -116,7 +133,9 @@ Strix is agent-ready. Give Claude Code, Cursor, Codex, or any [SKILL.md-compatib npx skills add usestrix/strix ``` -This installs nine skills: **penetration-testing-with-strix** (run headless scans and read results), **managed-pentesting-with-strix** (drive the managed [app.strix.ai](https://app.strix.ai) platform via REST — no local Docker or LLM key), **fix-security-vulnerabilities-with-strix** (remediate + re-scan to verify), **ci-security-scanning-with-strix** (PR scanning in CI), plus target-specific workflows: **application-security-testing**, **web-app-penetration-testing**, **api-security-testing**, **owasp-top-10-testing**, and **find-security-vulnerabilities-in-code**. Agents can run Strix two ways with the same engine — the open-source CLI locally, or the managed cloud when there's no local infra — and read [`AGENTS.md`](AGENTS.md) for a quick reference, [docs.strix.ai/llms.txt](https://docs.strix.ai/llms.txt) for the CLI docs, and [docs.app.strix.ai](https://docs.app.strix.ai) for the API. +This installs nine skills for running pentests, fixing findings, and CI scanning, against code, web apps, APIs, and the OWASP Top 10. Agents can use the local CLI or the managed cloud with the same engine. + +See [`AGENTS.md`](AGENTS.md) for the quick reference, [docs.strix.ai/llms.txt](https://docs.strix.ai/llms.txt) for the CLI, and [docs.app.strix.ai](https://docs.app.strix.ai) for the API. --- @@ -172,18 +191,9 @@ strix view my-run-name strix view --host 0.0.0.0 --port 8080 --no-open ``` -`strix view` starts a lightweight local server (bound to `127.0.0.1` on a random port) and opens your browser to a private, tokened link. Nothing leaves your machine: the dashboard reads the run's files straight off disk, with no cloud account or upload required. The UI ships prebuilt with Strix, so there is no extra install and no JS build step. +The dashboard shows the findings, a live map of the agent team, and past runs. Nothing leaves your machine, and the UI ships prebuilt. `strix view` binds to `127.0.0.1` and prints a tokened link that grants access to the run, so share it carefully. -Use `--host 0.0.0.0` to make the viewer reachable from other machines. Replace `0.0.0.0` in the printed URL with the server's reachable IP or hostname. The token in that URL grants access to the selected run's scan data, history, and steering, so only share it with trusted users and restrict the port with your firewall. Requests without the token-derived session cannot read run data. - -### What's in the dashboard - -- **Overview**: run status, target, and a severity breakdown of everything found so far. -- **Vulnerabilities**: each validated finding with its severity, details, and reproduction steps. -- **Agent graph**: a live map of the multi-agent team, showing which agent is doing what. -- **Steering**: send instructions to a live scan from the browser to redirect the agents mid-run. -- **History**: browse past runs on this machine and jump between them. -- **Reports**: generate a shareable report and email it to yourself or your team. +See the [viewer documentation](https://docs.strix.ai/usage/viewer) for the options and for reaching the viewer from another machine. --- @@ -209,18 +219,9 @@ having to discover them by crawling. Pair the spec with the live base URL so the agent knows where to send traffic: ```bash -# OpenAPI / Swagger file (.json / .yaml) +# OpenAPI / Swagger file, Postman export, or a live collection by id strix --target ./openapi.yaml --target https://api.your-app.com - -# Postman collection export -strix --target ./collection.postman_collection.json --target https://api.your-app.com - -# Postman collection pulled live by id (no manual export) -export POSTMAN_API_KEY="PMAK-..." -strix --target postman:// - -# ...with a Postman environment to resolve {{baseUrl}} / token variables -strix --target "postman://?env=" +strix --target postman:// --target https://api.your-app.com ``` @@ -235,20 +236,10 @@ strix -t https://github.com/org/app -t https://your-app.com # Targets from a file, one target per non-empty, non-comment line strix --target-list ./targets.txt - -# White-box source-aware scan (local repository) -strix --target ./app-directory --scan-mode standard - -# Focused testing with custom instructions -strix --target api.your-app.com --instruction "Focus on business logic flaws and IDOR vulnerabilities" - -# Provide detailed instructions through file (e.g., rules of engagement, scope, exclusions) -strix --target api.your-app.com --instruction-file ./instruction.md - -# Force PR diff-scope against a specific base branch -strix -n --target ./ --scan-mode quick --scope-mode diff --diff-base origin/main ``` +See the [CLI reference](https://docs.strix.ai/usage/cli) for every option, including scan modes, diff scope, instruction files, and budgets. + ### Headless Mode Run Strix programmatically without interactive UI using the `-n/--non-interactive` flag - perfect for servers and automated jobs. The CLI prints real-time vulnerability findings and the final report before exiting. Exits with non-zero code when vulnerabilities are found. @@ -287,51 +278,55 @@ jobs: ``` > [!TIP] -> In CI pull request runs, Strix automatically scopes quick reviews to changed files. -> If diff-scope cannot resolve, ensure checkout uses full history (`fetch-depth: 0`) or pass -> `--diff-base` explicitly. +> In CI pull request runs, Strix automatically scopes quick reviews to changed files, which is why the +> checkout above fetches full history. See the +> [CI/CD documentation](https://docs.strix.ai/integrations/github-actions) for the details. ### Configuration ```bash -export STRIX_LLM="openai/gpt-5.4" +export STRIX_LLM="openrouter/z-ai/glm-5.3" export LLM_API_KEY="your-api-key" # Optional export LLM_API_BASE="your-api-base-url" # if using a local model, e.g. Ollama, LMStudio -export PERPLEXITY_API_KEY="your-api-key" # for search capabilities -export STRIX_REASONING_EFFORT="high" # control thinking effort (default: high, quick scan: medium) ``` > [!NOTE] > Strix automatically saves your configuration to `~/.strix/cli-config.json`, so you don't have to re-enter it on every run. +> See the [configuration reference](https://docs.strix.ai/advanced/configuration) for every environment variable. #### Sign in with a ChatGPT subscription Instead of a metered API key, you can run Strix on your ChatGPT Plus/Pro subscription: ```bash -strix auth login chatgpt # sign in with your ChatGPT account - +strix auth login chatgpt # sign in with your ChatGPT account export STRIX_LLM="chatgpt/gpt-5.4" # chatgpt/ runs on the subscription -strix --target ./app-directory - -strix auth status # show the active sign-in -strix auth logout # forget the sign-in +strix auth status # show the active sign-in, or logout to forget it ``` +#### Use the managed platform: `strix cloud` + +Run scans on [app.strix.ai](https://app.strix.ai) from the terminal, without Docker or an LLM key: + +```bash +strix cloud login # browser sign-in, one credential per install +strix cloud scans start --source . --yes --wait # scan local code, approving the upload +strix cloud scans start --engagement-type live_test --domain-ids --wait +strix cloud vulns list --severity critical +``` + +Every [REST API](https://docs.app.strix.ai) operation has a matching `strix cloud ` command. Run `strix cloud` to list the resources, and add `help` to a resource to list its verbs. Output is JSON when stdout is not a terminal or when you pass `--json`. Binary downloads are the exception: redirect the raw bytes, or combine `--output FILE --json` for download metadata. + +See the [cloud CLI documentation](https://docs.strix.ai/cloud/cli) for scopes, workspaces, billing, and source-upload options. + #### Connect your own MCP servers -Strix can connect to Model Context Protocol (MCP) servers you list and expose their tools to the agent during a run. Create `~/.strix/mcp-servers.json` with a JSON list of servers. Each entry is either a local `stdio` server that Strix launches as a subprocess, or a remote `http` server: +Strix can connect to Model Context Protocol (MCP) servers you list and expose their tools to the agent during a run. Create `~/.strix/mcp-servers.json` with a JSON list of local `stdio` servers or remote `http` servers: ```json [ - { - "name": "local_fs", - "transport": "stdio", - "command": "npx", - "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path/to/project"] - }, { "name": "github", "transport": "http", @@ -342,20 +337,19 @@ Strix can connect to Model Context Protocol (MCP) servers you list and expose th ] ``` -Each server's tools are namespaced by `name` (for example `local_fs_read_file`). Omit `allowed_tools` to expose every tool the server offers, or set it to a list to restrict which tools the agent can call. The file is optional, and a server that fails to connect is skipped without failing the run. You can point Strix at a different file with `STRIX_MCP_CONFIG`. +Each server's tools are namespaced by `name`, for example `github_list_issues`. See the [MCP documentation](https://docs.strix.ai/integrations/mcp) for the full schema, tool filtering, and `stdio` servers. **Recommended models for best results:** +- [Z.ai GLM-5.3 on OpenRouter](https://openrouter.ai/z-ai/glm-5.3) - `openrouter/z-ai/glm-5.3` (the default pick) - [OpenAI GPT-5.4](https://openai.com/api/) - `openai/gpt-5.4` - [Anthropic Claude Sonnet 4.6](https://claude.com/platform/api) - `anthropic/claude-sonnet-4-6` - [Google Gemini 3 Pro Preview](https://cloud.google.com/vertex-ai) - `vertex_ai/gemini-3-pro-preview` +- [DeepSeek V4 Pro](https://platform.deepseek.com) - `deepseek/deepseek-v4-pro` +- [Moonshot Kimi K3](https://platform.kimi.ai) - `moonshot/kimi-k3` See the [LLM Providers documentation](https://docs.strix.ai/llm-providers/overview) for all supported providers including Vertex AI, Bedrock, Azure, and local models. -## Enterprise Pentesting - -Get the same Strix experience with [enterprise-grade](https://strix.ai/demo) controls: SSO (SAML/OIDC), custom compliance-ready penetration testing reports (SOC 2, ISO 27001, PCI DSS), dedicated support & SLA, custom deployment options (VPC/self-hosted), BYOK model support, and tailored AI pentesting agents optimized for your environment. [Learn more](https://strix.ai/demo). - ## Documentation Full documentation is available at **[docs.strix.ai](https://docs.strix.ai)** - including detailed guides for usage, CI/CD integrations, skills, and advanced configuration. diff --git a/docs/advanced/configuration.mdx b/docs/advanced/configuration.mdx index f1542b752..98a9d690f 100644 --- a/docs/advanced/configuration.mdx +++ b/docs/advanced/configuration.mdx @@ -8,7 +8,7 @@ Configure Strix using environment variables or a config file. ## LLM Configuration - Model name in LiteLLM format (e.g., `openai/gpt-5.4`, `anthropic/claude-sonnet-4-6`). + Model name in LiteLLM format (e.g., `openrouter/z-ai/glm-5.3`, `openai/gpt-5.4`). @@ -80,6 +80,22 @@ affecting the agents that do the actual testing. API key for Perplexity AI. Enables real-time web search during scans for OSINT and vulnerability research. + + API key for Exa. Enables real-time web search through the Exa `/search` endpoint. Exa also powers the `web_get_contents` tool, which fetches the full text of a page through the Exa `/contents` endpoint. This is the preferred web search provider. + + + + Web search provider: `auto`, `perplexity`, or `exa`. With `auto`, Strix uses Exa when `EXA_API_KEY` is set, and Perplexity otherwise. Set an explicit provider to pin one when you configure both keys. + + + + Exa search mode: `auto`, `fast`, `instant`, `deep-lite`, `deep`, or `deep-reasoning`. Lower modes return results faster. Higher modes plan across more steps and take more time. This setting applies only to the Exa provider. + + + + Number of Exa results to return, from `1` to `100`. Each result includes a title, a URL, and a short security-focused summary. To read a full page, the agent calls `web_get_contents` with the result URL. This setting applies only to the Exa provider. + + Postman API key (`PMAK-…`). Enables fetching Postman collections by id as a target (`postman://`), and Postman environments (`postman://?env=`) to resolve collection variables. Not needed when passing a local collection export file. @@ -145,7 +161,7 @@ strix --target ./app --config /path/to/config.json ```json { "env": { - "STRIX_LLM": "openai/gpt-5.4", + "STRIX_LLM": "openrouter/z-ai/glm-5.3", "LLM_API_KEY": "sk-...", "STRIX_REASONING_EFFORT": "high" } @@ -156,10 +172,11 @@ strix --target ./app --config /path/to/config.json ```bash # Required -export STRIX_LLM="openai/gpt-5.4" +export STRIX_LLM="openrouter/z-ai/glm-5.3" export LLM_API_KEY="sk-..." -# Optional: Enable web search +# Optional: Enable web search (Exa preferred, Perplexity supported) +export EXA_API_KEY="..." export PERPLEXITY_API_KEY="pplx-..." # Optional: Custom timeouts diff --git a/docs/cloud/cli.mdx b/docs/cloud/cli.mdx new file mode 100644 index 000000000..d0f842927 --- /dev/null +++ b/docs/cloud/cli.mdx @@ -0,0 +1,103 @@ +--- +title: "Cloud CLI" +description: "Drive app.strix.ai from the terminal with strix cloud" +--- + +The `strix cloud` commands drive the managed platform ([app.strix.ai](https://app.strix.ai)) from the terminal. You do not need Docker or an LLM key. + +## Sign In + +Sign in once with the browser device flow. The sign-in creates your account and workspace on first use, and it stores a personal API token in `~/.strix/platform-auth.json`. + +```bash +strix cloud login # browser approval, then workspace and scope profile +strix cloud login --workspace "My Team" # select a workspace by name or ID +strix cloud whoami # local account and workspace status +strix cloud session # verify the remote session and consent ceiling +strix cloud logout # revoke remotely, then remove the local token +``` + +A browser sign-in creates one reusable credential for each CLI installation. A second sign-in on the same installation replaces the secret instead of adding another key. `strix cloud logout` revokes the server session before it deletes the local token. Use `--local-only` when you cannot reach the server. + +## Scopes + +The default **Recommended** preset covers normal scan work, local source uploads, workspace switching, and user-approved credit top-ups. It excludes credential creation, so request `tokens:write` when you need it. + +```bash +strix cloud login --scopes scans:read scans:write uploads:write billing:read +strix cloud login --scope-profile minimal # also accepts recommended or full +strix cloud session scopes # granted scopes and the login ceiling +strix cloud session scopes set minimal # narrow without another browser sign-in +``` + +A workspace switch keeps the credential and its expiry, preserves the server-side scope preference, and caps access by the target role. A switch can never exceed the login consent ceiling. Each process pins the workspace it started with, so a concurrent switch fails safely instead of sending a stale command to another organization. + +## Commands + +Every operation of the [REST API](https://docs.app.strix.ai) has a matching command in the form `strix cloud `. + +```bash +strix cloud # list all resources +strix cloud scans # run the safe default (scans list) +strix cloud scans help # list the verbs of a resource +strix cloud domains add --domain example.com --asset-type web_app +strix cloud scans start --engagement-type live_test --domain-ids --wait +strix cloud vulns list --severity critical +strix cloud credits # credit balance +``` + +Write commands take request fields as flags. Every write command also accepts one JSON object with `--data`: + +```bash +strix cloud scans start --data '{"engagement_type":"code_review"}' # literal JSON +strix cloud scans start --data @request.json # read a file +cat request.json | strix cloud scans start --data - # read standard input +``` + +`--token` and `STRIX_API_TOKEN` are stateless overrides for a single command, and they never replace the stored sign-in. Pair a CLI-session override with `--workspace-id` or `STRIX_WORKSPACE_ID`. + +## Workspaces And Account Setup + +```bash +strix cloud workspaces list # numbered list; workspace is also accepted +strix cloud workspaces create --name "My Team" # needs admin and organizations:write +strix cloud workspaces use 2 # switch by list number, exact name, or ID +strix cloud billing topup --credits 20 --yes # approve an agent payment after HTTP 402 +strix cloud billing subscribe --plan strix_cloud # opens the hosted checkout page +strix cloud billing portal # opens the billing portal +strix cloud integrations install github # opens the app installation page +strix cloud domains verify # prints the DNS record to add +``` + +The last four commands end at a person. Strix creates the link, opens the browser for an interactive terminal, and always prints the URL. The user enters the card, approves the installation, or adds the DNS record. Pass `--no-browser` to print the URL only. + +## Output And Exit Codes + +The commands work for people and for agents. Terminal output favors names, branches, lifecycle states, and numbered selectors. Redirected output, and `--json`, preserve the complete machine-readable record. + +- Human lists keep the selectors that follow-up commands need, and they omit internal organization and user IDs. A selector that is too long for the compact table is repeated losslessly in a copyable block. +- Paginated lists print the next `--page` or `--offset`. Detail views keep useful prose within a safe terminal bound, so use `--json` for the complete record. +- Token lists separate API keys from named CLI device sessions. +- Binary downloads are the exception to JSON output. Redirect the raw bytes on purpose, or use `--output FILE --json` to write the file and receive structured download metadata. +- There are no prompts when stdin is not a terminal. + +Exit codes: `0` success, `1` error, `2` invalid usage, `4` authentication or plan limit, `5` payment required. + +## Credits And Plan Limits + +Non-Enterprise scans consume the deterministic estimate shown for their scope. A source-only code review at the default `ultra` tier currently starts at 60 credits. Enterprise scans are plan-included and do not consume the credit wallet. + +Report downloads need Enterprise, schedules need Pro, and billing writes need an admin token. A plan block exits `4`. An insufficient credit wallet exits `5` without the creation of a scan and without a charge. + +## Local Source Scans + +See [Scan Local Source](/cloud/overview#scan-local-source) for the upload approval flow, the exclusion rules, and the size limits. + +## Tab Completion + +Enable native tab completion once for each shell session: + +```bash +source <(strix completions zsh) # use bash instead of zsh when appropriate +strix completions fish | source +``` diff --git a/docs/cloud/overview.mdx b/docs/cloud/overview.mdx index 8b6e584df..1dc5c69b3 100644 --- a/docs/cloud/overview.mdx +++ b/docs/cloud/overview.mdx @@ -35,6 +35,25 @@ Skip the setup. Run Strix in the cloud at [app.strix.ai](https://app.strix.ai). 2. Connect your repository or enter a target URL 3. Launch your first scan +## Scan Local Source + +Send a local working tree to the managed white-box scanner without connecting a source-control provider: + +```bash +# Review the exact file manifest and capture source.archive_sha256. Nothing is uploaded. +strix cloud scans start --source . --dry-run --show-files --json +SOURCE_SHA256="" + +# Repeat the same source-selection flags and approve that exact snapshot. +strix cloud scans start --source . --approve-sha256 "$SOURCE_SHA256" --wait +``` + +In a Git repository, Strix includes tracked files and untracked files that are not ignored. Hidden files, `.git`, symlinks, dependencies and build output, secret-like filenames, and nested archives are excluded by default. Use `.strixignore` or repeat `--exclude GLOB` for project-specific exclusions. `--include-hidden`, `--include-sensitive`, and `--include-archives` are explicit opt-ins. + +The CLI limits individual files, total expanded bytes, archive bytes, and file count. For an agent or CI handoff, repeat the same `--source`, `--exclude`, and `--include-*` flags with `--approve-sha256`; Strix refuses the upload if the rebuilt archive differs from the reviewed digest. `--yes` is a one-invocation approval for the snapshot built at that moment, not a digest-bound two-step approval. + +The temporary local archive is always removed. After a definitive launch rejection, Strix also deletes the staged remote upload. If a network error, server error, or interruption makes the launch outcome ambiguous, it retains the upload and reports its ID; check `strix cloud scans list` before retrying, then delete an unlinked upload with `strix cloud uploads delete UPLOAD_ID`. + Run your first pentest in minutes. diff --git a/docs/contributing.mdx b/docs/contributing.mdx index 4d7f8fb25..5622b82dc 100644 --- a/docs/contributing.mdx +++ b/docs/contributing.mdx @@ -33,7 +33,7 @@ description: "Contribute to Strix development" ```bash - export STRIX_LLM="openai/gpt-5.4" + export STRIX_LLM="openrouter/z-ai/glm-5.3" export LLM_API_KEY="your-api-key" ``` diff --git a/docs/docs.json b/docs/docs.json index 7573a0cdd..e51d98aff 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -25,7 +25,8 @@ "pages": [ "usage/cli", "usage/scan-modes", - "usage/instructions" + "usage/instructions", + "usage/viewer" ] }, { @@ -77,7 +78,8 @@ { "group": "Strix Cloud", "pages": [ - "cloud/overview" + "cloud/overview", + "cloud/cli" ] } ] diff --git a/docs/index.mdx b/docs/index.mdx index 2d4014893..910f1e2ec 100644 --- a/docs/index.mdx +++ b/docs/index.mdx @@ -78,7 +78,7 @@ Strix uses a graph of specialized agents for comprehensive security testing: curl -sSL https://strix.ai/install | bash # Configure -export STRIX_LLM="openai/gpt-5.4" +export STRIX_LLM="openrouter/z-ai/glm-5.3" export LLM_API_KEY="your-api-key" # Scan diff --git a/docs/integrations/coding-agents.mdx b/docs/integrations/coding-agents.mdx index 59e598f19..80f24597f 100644 --- a/docs/integrations/coding-agents.mdx +++ b/docs/integrations/coding-agents.mdx @@ -36,13 +36,14 @@ npx skills use usestrix/strix@penetration-testing-with-strix | claude Both use the same engine and produce the same validated findings and SARIF, so agents can pick per situation or combine them: - **Open-source CLI (self-hosted)** — runs locally in a Docker sandbox with your own LLM key. Free, fully local, air-gap capable. Best for local dev loops and full control. -- **Managed cloud** — runs on Strix's infrastructure via the [app.strix.ai REST API](https://docs.app.strix.ai). No Docker, no LLM key, no local install; adds team dashboards, scheduling, PR reviews, and downloadable PDF/DOCX reports (Enterprise plan). Best in sandboxed/CI environments and for teams. Create an API token under **Settings → API Access**; the `managed-pentesting-with-strix` skill has the full flow. +- **Managed cloud** — runs on Strix's infrastructure. Drive it with the `strix cloud` CLI (every REST operation has a `strix cloud ` command) or the [app.strix.ai REST API](https://docs.app.strix.ai) directly. No Docker, no LLM key; adds team dashboards, scheduling, PR reviews, and downloadable PDF/DOCX reports (Enterprise plan). Best in sandboxed/CI environments and for teams. Sign in with `strix cloud login` (browser device sign-in, account created on first use) or create a token in the dashboard under **Settings → API Access**. The `managed-pentesting-with-strix` skill has the full flow. ## Agent-Friendly Interfaces Everything an agent needs is machine-readable: - **Headless CLI** — `strix -n` runs without the TUI and exits with `0` (clean), `1` (error), or `2` (vulnerabilities found). +- **Cloud CLI** — `strix cloud` prints JSON when stdout is not a terminal (or with `--json`), never prompts without a TTY, and exits with `0` (success), `1` (error), `2` (usage), `4` (authentication required), or `5` (payment required). Credit top-ups pay the Stripe machine-payment challenge with an agent wallet (`strix cloud billing topup --credits N --yes`). Account setup also runs from the CLI: `strix cloud workspaces list|create|use`, `strix cloud org members invite`, `strix cloud billing subscribe`, `strix cloud billing portal`, and `strix cloud integrations install github`. The last three print a hosted link the user opens to finish the payment or approve the installation. - **REST API** — the managed platform exposes a documented [OpenAPI](https://docs.app.strix.ai/openapi.json) at `https://app.strix.ai/api/v1` (scans, vulnerabilities, assets, PR reviews, schedules, webhooks) with bearer tokens and scopes. - **Structured results** — every run writes `vulnerabilities.json`, `vulnerabilities.csv`, `findings.sarif` (SARIF 2.1.0), and per-finding Markdown under `strix_runs//`; the cloud exposes the same as JSON plus SARIF export. - **Budget controls** — `--max-budget` and `--max-turns` give agents hard cost/time caps. diff --git a/docs/integrations/github-actions.mdx b/docs/integrations/github-actions.mdx index 5952c3a03..8364c4257 100644 --- a/docs/integrations/github-actions.mdx +++ b/docs/integrations/github-actions.mdx @@ -37,7 +37,7 @@ Add these secrets to your repository: | Secret | Description | |--------|-------------| -| `STRIX_LLM` | Model name (e.g., `openai/gpt-5.4`) | +| `STRIX_LLM` | Model name (e.g., `openrouter/z-ai/glm-5.3`) | | `LLM_API_KEY` | API key for your LLM provider | ## Exit Codes diff --git a/docs/llm-providers/novita.mdx b/docs/llm-providers/novita.mdx index e7e35b67e..8ae514d46 100644 --- a/docs/llm-providers/novita.mdx +++ b/docs/llm-providers/novita.mdx @@ -17,6 +17,9 @@ export LLM_API_BASE="https://api.novita.ai/openai" | Model | Configuration | |-------|---------------| +| GLM-5.3 | `openai/zai-org/glm-5.3` | +| Kimi K3 | `openai/moonshotai/kimi-k3` | +| DeepSeek V4 Pro | `openai/deepseek/deepseek-v4-pro` | | Kimi K2.5 | `openai/moonshotai/kimi-k2.5` | | GLM-5 | `openai/zai-org/glm-5` | | MiniMax M2.5 | `openai/minimax/minimax-m2.5` | diff --git a/docs/llm-providers/openrouter.mdx b/docs/llm-providers/openrouter.mdx index 2b816e90d..a16587599 100644 --- a/docs/llm-providers/openrouter.mdx +++ b/docs/llm-providers/openrouter.mdx @@ -8,7 +8,7 @@ description: "Configure Strix with models via OpenRouter" ## Setup ```bash -export STRIX_LLM="openrouter/openai/gpt-5.4" +export STRIX_LLM="openrouter/z-ai/glm-5.3" export LLM_API_KEY="sk-or-..." ``` @@ -18,9 +18,12 @@ Access any model on OpenRouter using the format `openrouter//`: | Model | Configuration | |-------|---------------| +| GLM-5.3 (default) | `openrouter/z-ai/glm-5.3` | | GPT-5.4 | `openrouter/openai/gpt-5.4` | | Claude Sonnet 4.6 | `openrouter/anthropic/claude-sonnet-4.6` | | Gemini 3 Pro | `openrouter/google/gemini-3-pro-preview` | +| DeepSeek V4 Pro | `openrouter/deepseek/deepseek-v4-pro` | +| Kimi K3 | `openrouter/moonshotai/kimi-k3` | | GLM-4.7 | `openrouter/z-ai/glm-4.7` | ## Get API Key diff --git a/docs/llm-providers/overview.mdx b/docs/llm-providers/overview.mdx index 8c0d5002e..2b5070f3b 100644 --- a/docs/llm-providers/overview.mdx +++ b/docs/llm-providers/overview.mdx @@ -9,14 +9,17 @@ Strix uses [LiteLLM](https://docs.litellm.ai/docs/providers) for model compatibi Set your model and API key: -| Model | Provider | Configuration | -| ----------------- | ------------- | -------------------------------- | -| GPT-5.4 | OpenAI | `openai/gpt-5.4` | -| Claude Sonnet 4.6 | Anthropic | `anthropic/claude-sonnet-4-6` | -| Gemini 3 Pro | Google Vertex | `vertex_ai/gemini-3-pro-preview` | +| Model | Provider | Configuration | +| -------------------- | ----------------- | -------------------------------- | +| GLM-5.3 (default) | Z.ai (OpenRouter) | `openrouter/z-ai/glm-5.3` | +| GPT-5.4 | OpenAI | `openai/gpt-5.4` | +| Claude Sonnet 4.6 | Anthropic | `anthropic/claude-sonnet-4-6` | +| Gemini 3 Pro | Google Vertex | `vertex_ai/gemini-3-pro-preview` | +| DeepSeek V4 Pro | DeepSeek | `deepseek/deepseek-v4-pro` | +| Kimi K3 | Moonshot | `moonshot/kimi-k3` | ```bash -export STRIX_LLM="openai/gpt-5.4" +export STRIX_LLM="openrouter/z-ai/glm-5.3" export LLM_API_KEY="your-api-key" ``` @@ -62,6 +65,7 @@ See the [Local Models guide](/llm-providers/local) for setup instructions and re Use LiteLLM's `provider/model-name` format: ``` +openrouter/z-ai/glm-5.3 openai/gpt-5.4 anthropic/claude-sonnet-4-6 vertex_ai/gemini-3-pro-preview diff --git a/docs/quickstart.mdx b/docs/quickstart.mdx index ea9ddd895..dcd2e7c59 100644 --- a/docs/quickstart.mdx +++ b/docs/quickstart.mdx @@ -28,12 +28,12 @@ description: "Install Strix and run your first security scan" Set your LLM provider: ```bash -export STRIX_LLM="openai/gpt-5.4" +export STRIX_LLM="openrouter/z-ai/glm-5.3" export LLM_API_KEY="your-api-key" ``` -For best results, use `openai/gpt-5.4`, `anthropic/claude-opus-4-6`, or `openai/gpt-5.2`. +For best results, use `openrouter/z-ai/glm-5.3` (the default pick), `openai/gpt-5.4`, `anthropic/claude-opus-4-6`, or `openai/gpt-5.2`. ## Run Your First Scan diff --git a/docs/tools/overview.mdx b/docs/tools/overview.mdx index 4a5db0a07..466d91af6 100644 --- a/docs/tools/overview.mdx +++ b/docs/tools/overview.mdx @@ -28,6 +28,6 @@ Strix agents use specialized tools to test your applications like a real penetra | -------------- | ---------------------------------------- | | Python Runtime | Write and execute custom exploit scripts | | File Editor | Read and modify source code | -| Web Search | Real-time OSINT via Perplexity | +| Web Search | Real-time OSINT with Exa or Perplexity | | Notes | Document findings during the scan | | Reporting | Generate vulnerability reports with PoCs | diff --git a/docs/usage/viewer.mdx b/docs/usage/viewer.mdx new file mode 100644 index 000000000..01f42c57d --- /dev/null +++ b/docs/usage/viewer.mdx @@ -0,0 +1,49 @@ +--- +title: "Local Web Viewer" +description: "Browse a run in a local dashboard with strix view" +--- + +Every scan writes its results to disk as it runs. `strix view` serves those files in a local dashboard, for a live run or a finished one. + +```bash +strix view # the most recent run +strix view my-run-name # a specific run under ./strix_runs +strix view --host 0.0.0.0 --port 8080 --no-open +``` + +The UI ships prebuilt with Strix, so there is no extra install and no JavaScript build step. The dashboard reads the run files straight off disk. Nothing leaves your machine, and you do not need a cloud account. + +## Options + + + Run name under `./strix_runs`. Defaults to the most recent run. + + + + Host to bind to. Use `0.0.0.0` to reach the viewer from other machines. + + + + Port to serve on. The default selects an available ephemeral port. + + + + Do not open the browser automatically. + + +## What Is In The Dashboard + +- **Overview** — run status, target, and a severity breakdown of everything found so far. +- **Vulnerabilities** — each validated finding with its severity, details, and reproduction steps. +- **Agent graph** — a live map of the multi-agent team, and what each agent is doing. +- **Steering** — send instructions to a live scan to redirect the agents during the run. Steering works only in the dashboard the running scan opens. A standalone `strix view` has no live scan to steer. +- **History** — browse past runs on this machine and move between them. Verify your email address in the dashboard to unlock the other runs. +- **Reports** — generate a shareable report and send it by email. Verify your email address first. + +## Sharing The Link + + + The token in the printed URL grants access to the run data, and to the steering of a live scan. Share it only with trusted users. + + +To reach the viewer from another machine, start it with `--host 0.0.0.0` and replace `0.0.0.0` in the printed URL with a reachable IP address or hostname. Restrict the port with your firewall. A request without the token-derived session cannot read run data. diff --git a/pyproject.toml b/pyproject.toml index 1a8e646f0..b78fb3aa9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "strix-agent" -version = "1.5.3" +version = "1.6.2" description = "Open-source AI Hackers for your apps" readme = "README.md" license = "Apache-2.0" @@ -43,6 +43,7 @@ dependencies = [ "requests>=2.32.0", "cvss>=3.2", "caido-sdk-client>=0.2.0", + "markdown-it-py>=3.0.0", "reportlab>=4.0", "pypdf>=5.0", # Cap <49: 49.x drops the universal2 macOS wheel (arm64-only), which breaks @@ -229,6 +230,7 @@ ignore = [ # Test doubles use fixture tokens/passwords and match a callee signature whose # args they intentionally ignore. "tests/test_viewer_auth.py" = ["S105", "S106", "ARG001"] +"tests/test_cloud_cli.py" = ["S105", "ARG001"] "tests/test_codex_auth.py" = ["S105", "S106", "SLF001"] # Hatchling loads the build hook by path, not as an importable package. "scripts/tui_sidecar_hook.py" = ["INP001"] @@ -248,6 +250,7 @@ ignore = [ # Stdlib HTTP handler overrides (do_GET/do_POST) and lazy imports that avoid a # circular dependency with strix.telemetry / strix.interface.viewer.report_pdf. "strix/interface/viewer/server.py" = ["N802", "PLC0415"] +"strix/interface/cloud/payment_proxy.py" = ["N802"] # Lazy telemetry import to avoid importing PostHog before the viewer starts. "strix/interface/viewer/cli.py" = ["PLC0415"] # Lazy imports inside functions to avoid circular dependency with @@ -411,6 +414,8 @@ known_third_party = ["pydantic", "litellm"] # ============================================================================ [tool.bandit] -exclude_dirs = ["docs", "build", "dist"] +# Tests are covered by ruff's flake8-bandit rules (see per-file-ignores above), +# which is where fixture tokens and loopback URL opens are already waived. +exclude_dirs = ["docs", "build", "dist", "tests"] skips = ["B101", "B601", "B404", "B603", "B607"] # Skip assert, shell injection, subprocess import and partial path checks severity = "medium" diff --git a/scripts/install.sh b/scripts/install.sh index 5e2e8a710..e179b558e 100755 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -346,6 +346,9 @@ echo -e "${MUTED}For more information visit ${NC}https://strix.ai" echo -e "${MUTED}Supported models ${NC}https://docs.strix.ai/llm-providers/overview" echo -e "${MUTED}Join our community ${NC}https://discord.gg/strix-ai" echo "" +echo -e "${MUTED}Run a pentest in Strix Cloud ${NC}https://app.strix.ai" +echo -e "${MUTED}Enterprise ${NC}https://strix.ai/demo" +echo "" echo -e "${YELLOW}→${NC} Run ${MUTED}source ~/.$(basename $SHELL)rc${NC} or open a new terminal" echo "" diff --git a/skills/api-security-testing/SKILL.md b/skills/api-security-testing/SKILL.md index e47d427d7..7bf5a35ca 100644 --- a/skills/api-security-testing/SKILL.md +++ b/skills/api-security-testing/SKILL.md @@ -11,7 +11,7 @@ metadata: APIs fail differently from web UIs: there is no rendered surface to crawl, the interesting bugs are authorization-shaped rather than injection-shaped, and the same endpoint behaves differently per token. This workflow targets those specifics with Strix's autonomous agents, using the current [OWASP API Security Top 10 (2023)](https://owasp.org/API-Security/editions/2023/en/0x11-t10/) as the coverage checklist. For the web-app equivalent, the current edition is the OWASP Top 10:2025 — see **owasp-top-10-testing**. -Install, LLM setup, full CLI flags, and the managed-cloud path are in the **penetration-testing-with-strix** skill. Read it if `strix --version` fails or the target is not an API. +Install, LLM setup, full CLI flags, and the managed-cloud path are in the **penetration-testing-with-strix** skill. Read it if `strix --version` fails or the target is not an API. For a run with no Docker and no LLM key, the same binary drives the managed platform: `strix cloud login`, then `strix cloud scans start ...` (details in **managed-pentesting-with-strix**). ## 1. Gather what the agents need diff --git a/skills/application-security-testing/SKILL.md b/skills/application-security-testing/SKILL.md index 78a2f49f6..0c27bd5df 100644 --- a/skills/application-security-testing/SKILL.md +++ b/skills/application-security-testing/SKILL.md @@ -11,7 +11,7 @@ metadata: Entry point for "make my application secure" requests, where the target is not yet a single URL or repo. The job here is to pick the right test per asset, run it, and produce one ranked plan — not to run everything at maximum depth. -Install, LLM setup, all CLI flags, and the managed-cloud path live in the **penetration-testing-with-strix** skill. Read it first if `strix --version` fails. +Install, LLM setup, all CLI flags, and the managed-cloud path live in the **penetration-testing-with-strix** skill. Read it first if `strix --version` fails. For a run with no Docker and no LLM key, the same binary drives the managed platform: `strix cloud login`, then `strix cloud scans start ...` (details in **managed-pentesting-with-strix**). Only test assets the user owns or is authorized to test. Confirm authorization before the first run, and prefer staging over production, because the agents send real exploit payloads and can change data. diff --git a/skills/ci-security-scanning-with-strix/SKILL.md b/skills/ci-security-scanning-with-strix/SKILL.md index c53054bb8..e53be3fff 100644 --- a/skills/ci-security-scanning-with-strix/SKILL.md +++ b/skills/ci-security-scanning-with-strix/SKILL.md @@ -113,11 +113,11 @@ Gate the pipeline on the exit code (see the budget/fail-open caveat above — gi # Option B — Managed platform (no runner infra) -No workflow file, no Docker, no LLM key. Two ways to use it: +No workflow file, no Docker, no LLM key. Three ways to use it: 1. **PR-review app (zero code):** the user installs the Strix GitHub/GitLab/Bitbucket app and enables PR reviews for the repo in the app.strix.ai dashboard. Every PR is then reviewed automatically, with findings posted as PR comments. Nothing to add to the repo. This is the lowest-effort path — recommend it first when the user just wants PR gating. -2. **API-triggered from any pipeline:** if you want to trigger from an existing pipeline (or a system without the SCM app), call the API with a token that has `pr_reviews:write` (or `scans:write`). Store the token as a CI secret; ask the user to create it at **Settings → API Access**. Example GitHub Actions step: +2. **CLI-triggered from any pipeline:** if you want to trigger from an existing pipeline (or a system without the SCM app), use the same `strix` binary with a token that has `pr_reviews:write`. Store the token as a CI secret and ask the user to create it at **Settings → API Access**. Read the repository's `provider` and `installation_id` once with `strix cloud repos list`. Example GitHub Actions step: ```yaml - name: Strix PR review (managed) @@ -125,12 +125,25 @@ No workflow file, no Docker, no LLM key. Two ways to use it: env: STRIX_API_TOKEN: ${{ secrets.STRIX_API_TOKEN }} run: | - curl -sS --fail https://app.strix.ai/api/v1/pr-reviews/start \ - -H "Authorization: Bearer $STRIX_API_TOKEN" \ - -H "Content-Type: application/json" \ - -d "{\"repository_full_name\":\"${{ github.repository }}\",\"pr_number\":${{ github.event.pull_request.number }}}" + curl -sSL https://strix.ai/install | bash + strix cloud pr-reviews start \ + --provider github \ + --installation-id "${{ vars.STRIX_INSTALLATION_ID }}" \ + --repository-full-name "${{ github.repository }}" \ + --pr-number "${{ github.event.pull_request.number }}" ``` - To gate the build on results, poll the PR review / scan status and fail on unresolved criticals/highs. Full endpoints (PR reviews, scans, SARIF export, schedules for scheduled deep scans) are in the **managed-pentesting-with-strix** skill. + Output is JSON when stdout is not a terminal, and there are no prompts without a TTY. To gate the build on results, poll `strix cloud pr-reviews get --json` and fail on unresolved criticals or highs. The raw REST endpoint (`POST /api/v1/pr-reviews/start`) works too when the pipeline cannot install the CLI. + +3. **Source upload from a pipeline without an SCM app:** upload the checked-out tree as a cloud code review (`scans:write` and `uploads:write`). The two-step digest handoff keeps a human in control of what leaves the runner: + + ```bash + strix cloud scans start --source . --dry-run --show-files --json # review, capture source.archive_sha256 + strix cloud scans start --source . --approve-sha256 "$SOURCE_SHA256" --wait + ``` + + Exit codes: `0` success, `4` auth or plan limit, `5` payment required. Non-Enterprise scans consume credits. + +Full CLI coverage (PR reviews, scans, SARIF export, schedules) is in the **managed-pentesting-with-strix** skill. Recommend Option B for most teams (no maintenance, central dashboard); use Option A when scans must stay entirely within your own infrastructure. diff --git a/skills/find-security-vulnerabilities-in-code/SKILL.md b/skills/find-security-vulnerabilities-in-code/SKILL.md index 61667c137..b1829e9cb 100644 --- a/skills/find-security-vulnerabilities-in-code/SKILL.md +++ b/skills/find-security-vulnerabilities-in-code/SKILL.md @@ -11,7 +11,7 @@ metadata: White-box security review with Strix: the agents read the source to build a model of routes, sinks, and authorization checks, then attempt real exploitation. Findings come with a proof-of-concept, so the output is a short list of proven issues rather than the hundreds of "potential" hits a pattern-matching scanner produces. -Install, LLM setup, all flags, and the managed-cloud path are in the **penetration-testing-with-strix** skill. +Install, LLM setup, all flags, and the managed-cloud path are in the **penetration-testing-with-strix** skill. For a run with no Docker and no LLM key, the same binary drives the managed platform: `strix cloud login`, then `strix cloud scans start ...` (details in **managed-pentesting-with-strix**). ## Run it diff --git a/skills/fix-security-vulnerabilities-with-strix/SKILL.md b/skills/fix-security-vulnerabilities-with-strix/SKILL.md index 770a22bd7..6912cb542 100644 --- a/skills/fix-security-vulnerabilities-with-strix/SKILL.md +++ b/skills/fix-security-vulnerabilities-with-strix/SKILL.md @@ -18,7 +18,7 @@ Get the findings from wherever the scan ran: - **OSS CLI** — artifacts in `strix_runs//`: - `vulnerabilities/*.md` — one finding per file: description, severity, PoC steps or script, affected code locations, remediation guidance. - `vulnerabilities.json` — the same findings as JSON (ids, severity, CWE/CVE, `code_locations` with `fix_before`/`fix_after` suggestions when available). -- **Cloud (app.strix.ai)** — fetch the scan's `vulnerabilities[]` via `GET /api/v1/scans/{scanId}` (or `GET /api/v1/vulnerabilities` org-wide). Each carries `severity, cwe, endpoint, method, impact, technical_analysis, poc_description, poc_script_code` and, for code findings, `code_file`/`code_diff`/`code_before`/`code_after`. See the **managed-pentesting-with-strix** skill for auth. +- **Cloud (app.strix.ai)** — pull findings with the CLI: `strix cloud vulns list --scan-id --json` (or `strix cloud scans get --json | jq '.vulnerabilities'`, or `strix cloud vulns list --severity critical` org-wide). Each finding carries `severity, cwe, endpoint, method, impact, technical_analysis, poc_description, poc_script_code` and, for code findings, `code_file`/`code_diff`/`code_before`/`code_after`. After a fix is verified, mark it with `strix cloud vulns update --status fixed`. See the **managed-pentesting-with-strix** skill for `strix cloud login` and scopes. Order work by severity: critical → high → medium → low. Every Strix finding was validated with a working proof-of-concept, so do not dismiss findings as false positives without re-testing the PoC yourself. diff --git a/skills/managed-pentesting-with-strix/SKILL.md b/skills/managed-pentesting-with-strix/SKILL.md index 08feeb367..246aa8825 100644 --- a/skills/managed-pentesting-with-strix/SKILL.md +++ b/skills/managed-pentesting-with-strix/SKILL.md @@ -1,23 +1,59 @@ --- name: managed-pentesting-with-strix -description: Run a managed pentest of a web app or API through the app.strix.ai REST API — no local Docker, LLM key, or install needed. Create an API token, register domain/repository assets, launch and poll scans, triage vulnerabilities, export SARIF, download PDF/DOCX pentest reports for SOC 2 and other compliance evidence (Enterprise plan), start PR reviews, and set up schedules and webhooks. Use when the user wants continuous or scheduled pentesting-as-a-service, an auditor-ready pentest report, scans tracked in a team dashboard, or security testing from a sandboxed agent/CI environment with no infrastructure. +description: Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed. Safely review and upload local source, register assets, launch and poll scans, triage vulnerabilities, export SARIF, download compliance reports, start PR reviews, buy credits, and set up schedules or webhooks. Use for managed, continuous, scheduled, team-tracked, or sandboxed-agent security testing. license: Apache-2.0 metadata: author: usestrix homepage: https://docs.app.strix.ai --- -# Strix Cloud API (managed, no local infra) +# Strix Cloud (managed, no local infra) Use this when you want Strix's autonomous pentesting **without running Docker or an LLM yourself** — the scan runs on Strix's infrastructure and results are tracked in a team dashboard. This is the right choice in sandboxed/hosted agent and CI environments, for teams, and for scheduled/continuous testing (downloadable PDF/DOCX reports are an Enterprise-plan feature). For fully local, free, air-gapped, or BYO-LLM runs, use the open-source CLI in the **penetration-testing-with-strix** skill instead — both share the same engine and SARIF output, so you can mix them. -Full reference: **[docs.app.strix.ai](https://docs.app.strix.ai)** · OpenAPI: `https://docs.app.strix.ai/openapi.json` +There are two equivalent interfaces. Prefer the CLI: -## Setup +- **`strix cloud` CLI** — every REST operation has a command in the form `strix cloud `. Install with `curl -sSL https://strix.ai/install | bash`. Run `strix cloud` to list all resources and `strix cloud help` (or `-h`) to list a resource's verbs; a bare resource with a safe read operation runs its documented default. +- **REST API** — base URL `https://app.strix.ai/api/v1`, `Authorization: Bearer ` on every request. Full reference: **[docs.app.strix.ai](https://docs.app.strix.ai)** · agent index: `https://docs.app.strix.ai/llms.txt` · OpenAPI: `https://docs.app.strix.ai/openapi.json`. -- **Base URL:** `https://app.strix.ai/api/v1` -- **Auth:** every request sends `Authorization: Bearer `. Tokens are **org-scoped**. -- **Get a token:** the user creates one in the dashboard at **Settings → API Access** (app.strix.ai). Ask them for it; never hardcode, log, or commit it. Store it in an env var or the CI secret store. +The CLI is equally usable by agents and people. Output is complete JSON when stdout is not a terminal, or when you pass `--json`; terminal tables favor names, branches, lifecycle states, and numbered selectors. Human lists retain the selectors needed by follow-up commands but omit internal organization/user IDs; a selector too long for the compact table is repeated losslessly in a copyable block. Paginated lists print the next `--page` or `--offset`, and detail views preserve useful prose within a safe terminal bound; use `--json` for the complete record. Token lists label credentials as active, expired, or revoked. Binary downloads are the exception: redirect raw bytes intentionally, or use `--output FILE --json` to write the file and receive structured metadata. There are no interactive prompts when stdin is not a terminal. Exit codes: `0` success, `1` request/runtime error, `2` invalid usage, `4` authentication or plan limit, `5` payment required. + +Every resource group with a safe read operation has a useful default action, and `-h` or `help` always shows its verbs. Native tab completion includes resources, verbs, flags, workspace commands, and local paths: + +```bash +source <(strix completions zsh) # current zsh session +source <(strix completions bash) # current bash session +strix completions fish | source # current fish session +``` + +Write commands take request fields as flags. Every write command also accepts one JSON object with `--data`, which is the way to send fields that have no flag: + +```bash +strix cloud scans start --data '{"engagement_type":"code_review"}' # literal JSON +strix cloud scans start --data @request.json # read a file +cat request.json | strix cloud scans start --data - # read standard input +``` + +The platform enforces plan and role limits, and the CLI passes the platform message through. Report downloads need the Enterprise plan. Schedules need the Pro plan. Billing writes need an admin token. A blocked command exits with code `4`. + +## Setup: sign in + +Run the device sign-in. It creates the user's account and workspace on first use and stores a personal API token in `~/.strix/platform-auth.json`: + +```bash +strix cloud login +# Non-interactive least-privilege example: +strix cloud login --scopes scans:read scans:write uploads:write billing:read vulnerabilities:read assets:read assets:write +# Or use a stable named profile: +strix cloud login --scope-profile recommended +``` + +The user approves the sign-in in the browser. With `--scopes` (and optionally `--workspace `) there are no terminal prompts, so the command works from a non-interactive agent shell. In an interactive terminal without flags, the CLI offers a workspace picker and scope presets (Recommended, Full access, Minimal, Custom). Recommended covers ordinary scans, source uploads, workspace switching, and user-approved credit top-ups; it excludes `tokens:write`, which must be requested explicitly when credential management is required. Use explicit scopes for a narrower automation token. + +- `strix cloud whoami` is the fast local status. `strix cloud session --json` verifies the remote device session; `strix cloud session scopes` shows both effective access and the immutable login ceiling. +- `strix cloud logout` revokes the remote session before removing the local token. On a network or server failure it keeps the token so the user can retry; `--local-only` deliberately skips revocation. +- Every other `strix cloud` command uses the stored token automatically. `--token ` or `STRIX_API_TOKEN` is a stateless per-command override and never overwrites the stored account. For an override that is itself a CLI session, also pass `--workspace-id` or set `STRIX_WORKSPACE_ID`. +- Never hardcode, log, or commit the token. Store it in an env var or the CI secret store. - **Scopes (least-privilege):** assign only what the integration needs and rotate regularly: | Scope | Grants | @@ -28,15 +64,105 @@ Full reference: **[docs.app.strix.ai](https://docs.app.strix.ai)** · OpenAPI: ` | `schedules:read` / `:write` | read schedules · create/trigger recurring scans | | `pr_reviews:write` | trigger PR security reviews | | `webhooks:read` / `:write` | manage webhook subscriptions | - | `tokens:write` | create/revoke API tokens | + | `uploads:write` | upload local source or documents for a scan | + | `organizations:read` | read organization details (listing/switching the signed-in user's workspaces needs no API scope) | + | `organizations:write` | create/update workspaces (admin) | + | `tokens:write` | create/revoke ordinary API tokens (not needed to manage the current CLI session) | + | `knowledge:read` / `:write` | read/update organization knowledge | + | `audit:read` | read/export the Enterprise audit log | + | `billing:read` / `billing:write` | read credit balance & auto top-up settings · buy credits (admin) | + +HTTP errors map to messages and exit codes: `401` bad/expired token (exit `4`), `402` out of credits (exit `5`), `403` scope/plan-tier limit (exit `4`), `422` validation error (exit `1`). + +Create a time-limited automation token with `strix cloud tokens create`. Use +`--rbac-scopes` to restrict it to target IDs, tags, or business units; the value is a +JSON array of `{ "type": "target|tag|business_unit", "value": "..." }` objects: ```bash -export STRIX_API_TOKEN="" -BASE=https://app.strix.ai/api/v1 -auth=(-H "Authorization: Bearer $STRIX_API_TOKEN") +strix cloud tokens create --type service --name staging-ci \ + --expires-at 2026-12-31T23:59:59Z \ + --scopes scans:read scans:write \ + --rbac-scopes '[{"type":"tag","value":"staging"}]' ``` -All examples use `jq` to parse JSON. Handle HTTP errors: `401` bad/expired token, `402` out of credits, `403` scope/plan-tier limit, `422` validation error. +The token secret is returned once. Store it directly in a secret manager and do not +print or commit it. `--expires-at` and `--expires-in-days` are mutually exclusive. + +## 0. Credits & top-ups + +Non-Enterprise scans consume org credits. Enterprise engagements are plan-included and do not debit the wallet. Check the balance before a scan (`billing:read`): + +```bash +strix cloud credits +``` + +When the balance is too low, buy credits with `strix cloud billing topup` (`billing:write`, admin token). The server answers the first request with **HTTP 402 and a machine-payment challenge** (Stripe Machine Payments Protocol). The CLI pays the challenge with the Stripe Link wallet client when Node.js is available — the user approves the spend in the [Link app](https://link.com/agents). The response returns the receipt (`credits_granted`, `duplicate`, `reference`) and the new balance. + +A default-tier source-only code review currently starts at 60 credits. Source uploads are not free: they launch an ordinary `code_review` and use the same deterministic scope estimator. The service checks the full balance before launch, reserves credits atomically only after validation succeeds, and does not create or charge a rejected scan. Retests and Enterprise scans are exempt. + +```bash +strix cloud billing topup --credits 20 --yes # explicit approval; skips the TTY prompt +strix cloud billing topup --credits 20 --no-pay # print the 402 challenge without paying +``` + +The default payment path is the Stripe Link wallet. When no wallet is connected, an interactive `strix cloud billing topup` starts the Link sign-in for the user and prints the verification link. The user approves the connection one time in the Link app, and then approves each payment there. No keys or variables are necessary. In a non-interactive process, the command stops and tells the user to connect the wallet at [link.com/agents](https://link.com/agents) or to use the hosted checkout link. + +In a non-interactive agent or CI process, payment never proceeds unless the command includes `--yes`. Show the challenge or estimated spend to the user and obtain approval before adding it. `--no-pay` always stops after printing the challenge. + +If the user does not want a wallet, create a hosted checkout link with `strix cloud billing subscribe --plan strix_top_up` and give the link to the user. The user pays in the browser. + +Automatic top-ups (admin): `strix cloud billing auto-topup` shows the setting. Enable it with: + +```bash +strix cloud billing auto-topup update --enabled --topup-credits 20 --monthly-cap-credits 200 +``` + +An omitted `--monthly-cap-credits` keeps the stored cap. Pass `--no-monthly-cap` to remove the cap. + +### Workspaces and account setup + +Manage workspaces with a personal token from `strix cloud login`: + +```bash +strix cloud workspaces list # numbered name/role/current list +strix cloud workspaces create --name "My Team" # admin + organizations:write +strix cloud workspaces use 2 # displayed number, exact name, or ID +strix cloud workspace use "My Team" # singular `workspace` alias also works +strix cloud session scopes # effective scopes + consent ceiling +strix cloud session scopes set minimal # narrow the session +strix cloud org members invite --email dev@example.com --role analyst +``` + +`workspaces use` retargets the current personal token to a workspace the user already belongs to and stores the updated workspace metadata; the bearer secret and expiry stay unchanged. It does not reprompt during ordinary switches: the server preserves the chosen profile, enforces the immutable login ceiling, and caps effective scopes by the target role. Use `--scope-profile` or `--scopes` to narrow within that ceiling; broader consent requires `strix cloud login` again. The CLI pins each process to the workspace it started in, so concurrent shells fail with a recoverable conflict instead of silently crossing organizations. + +### Handoffs a person must finish + +Four steps end at the user. The command creates the link or the record and prints it. Strix opens the browser only in an interactive terminal. Pass `--no-browser` to print the URL only. + +```bash +strix cloud billing subscribe --plan strix_cloud # hosted checkout page for the Cloud plan +strix cloud billing portal # billing portal for the card and the plan +strix cloud integrations install github # GitHub App or Slack installation page +strix cloud domains verify # DNS record to add, then run it again +``` + +Give the printed URL or DNS record to the user and wait. Do not claim that the payment, the installation, or the DNS change is complete. Confirm the result afterwards with `strix cloud credits`, `strix cloud integrations list`, or `strix cloud domains list`. All four commands need an admin token, except `domains verify`, which needs `assets:write`. + +### Organization knowledge + +Agents can manage the organization knowledge base without the dashboard (`knowledge:read` / `knowledge:write`): + +```bash +strix cloud knowledge list --search authentication +strix cloud knowledge add --title "Authentication" --content "Staging uses SSO." +strix cloud knowledge update --content "Staging uses SSO and TOTP." +strix cloud knowledge delete +strix cloud knowledge policies add --key staging-only --content "Never test production." +strix cloud knowledge policies delete staging-only +strix cloud knowledge repos entries usestrix/strix +``` + +Knowledge policy writes require an admin token. Repository names are passed as normal `owner/name` values; the CLI handles URL encoding. The `costs` and `llm-settings` commands target on-prem installations and return `404` on app.strix.ai. ## 1. Register the target as an asset @@ -44,109 +170,152 @@ Scans run against **registered assets**, not raw URLs. Register once, then reuse ```bash # Domain (black-box / live target). Requires domain verification before external scanning. -# asset_type must be one of: web_app | api | attack_surface. -curl -sS "$BASE/domains" "${auth[@]}" -H "Content-Type: application/json" \ - -d '{"domain":"staging.example.com","asset_type":"web_app"}' | jq '{id:.domain.id, status, reachable, verification}' +# --asset-type must be one of: web_app | api | attack_surface. +strix cloud domains add --domain staging.example.com --asset-type web_app # Repository (white-box / code review). `full_name` is "owner/name". -# Send one repository object, or a bare JSON array for several — not an object -# wrapping a "repositories" key (that is rejected with 400). -curl -sS "$BASE/repositories" "${auth[@]}" -H "Content-Type: application/json" \ - -d '[{"full_name":"org/app","provider":"github"}]' | jq '.repositories[] | {id, full_name}' +strix cloud repos add --data '{"full_name":"org/app","provider":"github"}' ``` -Look up existing assets instead of re-adding: `GET /domains`, `GET /repositories` (both `assets:read`, paginated with `?page=&limit=`). +Look up existing assets instead of re-adding: `strix cloud domains list`, `strix cloud repos list` (both `assets:read`). ## 2. Launch a scan -`POST /scans` (`scans:write`). Provide at least one target via `domain_ids`, `repository_ids`, or `internal_targets` (internal infra needs a network connector — see docs). +`strix cloud scans start` (`scans:write`). Provide at least one target with `--domain-ids`, `--repository-ids`, or `--internal-targets` (internal infra needs a network connector — see docs). ```bash -scan_id=$(curl -sS "$BASE/scans" "${auth[@]}" -H "Content-Type: application/json" -d '{ - "engagement_type": "live_test", - "domain_ids": [""], - "focus": "IDOR, auth bypass, SSRF", - "context": "Staging. Test account creds are configured as a test user.", - "notify_on_completion": true -}' | jq -r .scan_id) -echo "$scan_id" +strix cloud scans start \ + --engagement-type live_test \ + --domain-ids \ + --focus "IDOR, auth bypass, SSRF" \ + --context "Staging. Test account creds are configured as a test user." \ + --notify-on-completion ``` -Useful `CreateScanRequest` fields: +Useful flags (each maps to a `CreateScanRequest` field): -| Field | Purpose | +| Flag | Purpose | |---|---| -| `engagement_type` | `live_test` (default), `code_review`, `internal_infra`, `compliance_pentest` | -| `domain_ids` / `repository_ids` / `internal_targets` | targets (at least one) | -| `domain_paths` / `repository_branches` | narrow to specific paths / branches | -| `credentials` | authenticated scanning, incl. `mfa_method` (`totp`/`email_otp`/…) + `totp_secret` | -| `headers` | extra HTTP headers (API keys, for example) for the target | -| `focus` / `concerns` / `context` | steer the agents | -| `upload_ids` | attach uploaded source/docs archives for white-box context | -| `notify_on_completion` / `notification_emails` | email when done | +| `--engagement-type` | `live_test` (default), `code_review`, `internal_infra`, `compliance_pentest` | +| `--domain-ids` / `--repository-ids` / `--internal-targets` | targets (at least one) | +| `--domain-paths` / `--repository-branches` | narrow to specific paths / branches (JSON maps) | +| `--credentials` | authenticated scanning, incl. `mfa_method` (`totp`/`email_otp`/…) + `totp_secret` (JSON list) | +| `--headers` | extra target HTTP headers as a JSON array of header objects | +| `--focus` / `--concerns` / `--context` | free-form strings that steer the agents | +| `--upload-ids` | attach uploaded source/docs archives for white-box context | +| `--notify-on-completion` / `--notification-emails` | email when done | -Response is `{ scan_id, title, status }` with `status` = `pending`. +Without `--source`, the response is `{ scan_id, title, status }` with `status` = `pending`. +Local-source success wraps that platform response as +`{ source, upload_id, scan: { scan_id, title, status } }`, so automation can retain the exact +approved manifest and staged-upload identifier alongside the created scan. -## 3. Poll to completion +### Scan a local workspace in the cloud -`GET /scans/{scanId}` (`scans:read`). Status flow: `pending → running → completed` (or `failed` / `cancelled`). Poll on an interval — scans take minutes to hours. Do not block. +For an agent or CI workflow, bind approval to the exact source snapshot that was reviewed. Run +the dry run with the intended source-selection flags, review the manifest and selected paths, +and capture `source.archive_sha256`. Then repeat the same `--source`, every `--exclude`, and +any `--include-hidden`, `--include-sensitive`, or `--include-archives` flags with +`--approve-sha256`: ```bash -while :; do - s=$(curl -sS "$BASE/scans/$scan_id" "${auth[@]}" | jq -r .status) - echo "status=$s"; [[ "$s" =~ ^(completed|failed|cancelled)$ ]] && break - sleep 60 -done +strix cloud scans start --source . --exclude 'private/' --dry-run --show-files --json +# After reviewing the output, capture its source.archive_sha256 value: +SOURCE_SHA256="" +# Repeat every source-selection flag unchanged; a source-only scan infers code_review. +strix cloud scans start --source . --exclude 'private/' \ + --approve-sha256 "$SOURCE_SHA256" --wait ``` +The CLI rebuilds the archive and refuses the upload if its SHA-256 no longer matches. `--yes` +has deliberately narrower semantics: it approves only the snapshot built during that one +invocation. Use it for a deliberate human or one-shot approval, not as the second half of a +digest-bound agent/CI review. Without a TTY, a source upload requires either matching +`--approve-sha256` approval or `--yes`; an interactive terminal can instead show the summary, +the selected filenames when `--show-files` is set, and a `[y/N]` confirmation for its current +snapshot. + +The default selection is privacy-conscious: in a Git worktree it includes tracked files plus untracked files that are not ignored; it honors `.gitignore`, excludes every hidden path component, always excludes `.git`, symlinks, dependencies/build output, secret-like filenames, and nested archives. Add project exclusions to `.strixignore` (one exclude glob per line) or repeat `--exclude GLOB`; a trailing slash such as `private/` excludes that directory subtree. + +The client refuses more than 20,000 files, a file over 25 MiB, more than 250 MiB expanded, or a ZIP over 50 MiB. The service then stream-inflates the ZIP and independently rejects malformed or unsupported entries, unsafe paths, too many entries, oversized entries, excessive expanded data, and oversized compressed input, so an untrusted client cannot bypass the ZIP-bomb controls by forging metadata. + +Only use `--include-hidden`, `--include-sensitive`, or `--include-archives` after the dry-run manifest shows that the scan needs them. Hidden and sensitive files are separate opt-ins: for example, including `.env` requires both `--include-hidden` and `--include-sensitive`. + +The CLI removes its private temporary local archive after every invocation. Once a remote +upload is staged, a definitive scan rejection causes the CLI to delete it. A network failure, +`5xx` response, malformed success response, or interruption after scan launch begins is +ambiguous—the platform may have accepted the scan—so the CLI retains the upload and returns +its `upload_id` with `launch_outcome_unknown: true`. If an automatic deletion attempt cannot +be confirmed, it instead returns the retained `upload_id` with `cleanup_unknown: true`. +Before retrying, run `strix cloud scans list` to avoid a duplicate scan or charge. If no scan +is linked to the retained upload, remove it with `strix cloud uploads delete UPLOAD_ID`; +linked uploads cannot be deleted. + +With no explicit type, source alone infers `code_review`. Any domain target wins and infers `live_test`, so source plus a deployed domain is the normal white-box live-test workflow. Pass `--engagement-type` when you need to override the inference. + +## 3. Wait for completion + +Pass `--wait` to `scans start` to poll until the scan reaches a final state, or poll yourself with `strix cloud scans get ` (`scans:read`). Bound automation with `--wait-timeout SECONDS`; timeout exits cleanly without cancelling the remote scan. Status flow: `pending → running → completed` (or `failed` / `cancelled`). Scans take minutes to hours — poll on an interval, do not block indefinitely. + ## 4. Read findings The scan-detail response includes `executive_summary`, `methodology`, `recommendations`, a `findings` severity roll-up, and a `vulnerabilities[]` array. Each vulnerability carries `title, severity, status, cvss, cwe, endpoint, method, impact, technical_analysis, poc_description, poc_script_code`, and (for code findings) `code_file`/`code_diff`/`code_before`/`code_after`. ```bash -curl -sS "$BASE/scans/$scan_id" "${auth[@]}" \ +strix cloud scans get --json \ | jq '["critical","high","medium","low","info"] as $order | .vulnerabilities | sort_by(.severity as $s | $order | index($s)) | .[] | {title, severity, endpoint, cwe}' ``` -Cloud severities are `critical | high | medium | low` and statuses are `open | in_progress | fixed | ignored`. Sort by an explicit severity order rather than `sort_by(.severity)`, which sorts alphabetically (critical, high, low, medium). +Cloud severities are `critical | high | medium | low` and statuses are `open | in_progress | snoozed | fixed | ignored | not_affected`. Sort by an explicit severity order rather than `sort_by(.severity)`, which sorts alphabetically (critical, high, low, medium). -Org-wide triage across scans: `GET /vulnerabilities` (`vulnerabilities:read`; filter by severity/status). Update triage state with the vulnerabilities `:write` endpoints. To remediate, hand off to the **fix-security-vulnerabilities-with-strix** skill. +Org-wide triage across scans: `strix cloud vulns list --severity critical` (`vulnerabilities:read`, and it also filters by `--status`, `--scan-id`, and more). Update triage state with `strix cloud vulns update --status fixed`. To remediate, hand off to the **fix-security-vulnerabilities-with-strix** skill. ## 5. Export & report ```bash # SARIF 2.1.0 for GitHub code scanning / ASPM ingestion -curl -sS "$BASE/scans/$scan_id/sarif" "${auth[@]}" -o findings.sarif +strix cloud scans sarif --output findings.sarif -# Report. The format and file type are query params (`Accept` is ignored): -# format=technical (default) | retest | attestation | executive_summary -# type=pdf (default) | docx -# Any report download requires the Enterprise plan; formats beyond `technical`, +# Report. Formats: technical (default) | retest | attestation | executive_summary +# Types: pdf (default) | docx +# Any report download requires the Enterprise plan. Formats beyond `technical`, # DOCX, and white-label branding are Enterprise-only too. Scan must be completed. -curl -sS "$BASE/scans/$scan_id/report?format=technical&type=pdf" "${auth[@]}" -o strix-report.pdf +strix cloud scans report --format technical --type pdf --output strix-report.pdf +``` + +Downloads refuse to replace a file unless `--force` is explicit. Enterprise audit logs can be streamed as JSON or exported without trying to JSON-decode the body: + +```bash +strix cloud audit list --format csv --all --output audit.csv +strix cloud audit list --format ndjson --all --output audit.ndjson ``` ## 6. PR reviews -Trigger an automated security review of a pull request (`pr_reviews:write`); results appear as PR comments and in the dashboard: +Trigger an automated security review of a pull request (`pr_reviews:write`). Read the repository's `provider` and `installation_id` with `strix cloud repos list`; both identify the installed source-control integration. The results appear as PR comments and in the dashboard: ```bash -curl -sS "$BASE/pr-reviews/start" "${auth[@]}" -H "Content-Type: application/json" \ - -d '{"repository_full_name":"org/app","pr_number":123}' +strix cloud pr-reviews start \ + --provider github \ + --installation-id \ + --repository-full-name org/app \ + --pr-number 123 ``` -List/inspect via `GET /pr-reviews` and `GET /pr-reviews/{id}`. Repo-level PR-review behavior is configured with the repository-settings endpoint. +List/inspect with `strix cloud pr-reviews list` and `strix cloud pr-reviews get `. Repo-level PR-review behavior is configured with `strix cloud pr-reviews settings`. ## 7. Continuous testing (schedules & webhooks) -- **Schedules** (`schedules:write`, Pro plan): create recurring scans and trigger them on demand — the managed equivalent of a cron-driven CLI loop. -- **Webhooks** (`webhooks:write`): subscribe to pentest/vulnerability lifecycle events such as `scan.completed` and `vulnerability.created` to push results into Slack, ticketing, or your own pipeline instead of polling. +- **Schedules** (`schedules:write`, Pro plan): `strix cloud schedules create` makes recurring scans, and `strix cloud schedules trigger ` runs one on demand — the managed equivalent of a cron-driven CLI loop. +- **Webhooks** (`webhooks:write`): `strix cloud webhooks create` subscribes to pentest/vulnerability lifecycle events such as `scan.completed` and `vulnerability.created` to push results into Slack, ticketing, or your own pipeline instead of polling. See the schedules and webhooks sections at [docs.app.strix.ai](https://docs.app.strix.ai) for payloads. +Network connectors are Enterprise-only. `strix cloud connectors create` may return a one-time enrollment command containing credentials; do not paste it into logs, and request it with `--include-command` only when the user is ready to install it. Browser checkout, source-control installation, DNS verification, connector installation, chat sharing, and publishing SARIF to an external provider are user handoffs or explicit external mutations—prepare the command/link, then obtain the appropriate approval before completing them. + ## Safety Only scan assets the user's organization owns or is authorized to test. External domain scans require verification (DNS/file/meta-tag) enforced by the platform — do not try to bypass it. diff --git a/skills/owasp-top-10-testing/SKILL.md b/skills/owasp-top-10-testing/SKILL.md index c8c121bee..328e217f7 100644 --- a/skills/owasp-top-10-testing/SKILL.md +++ b/skills/owasp-top-10-testing/SKILL.md @@ -13,7 +13,7 @@ The OWASP Top 10 is a taxonomy of risk categories, not a test suite — "OWASP T **Use the current edition: [OWASP Top 10:2025](https://owasp.org/Top10/)** (8th installment, superseding 2021). Ask the user before targeting an older edition — some compliance checklists still reference 2021, and a report labelled with the wrong edition is misleading. Key differences from 2021: **SSRF is folded into A01**, **A03 Software Supply Chain Failures** expands the old "Vulnerable and Outdated Components", and **A10 Mishandling of Exceptional Conditions** is new; A02 Security Misconfiguration moved 5→2. -Install, LLM setup, and the managed-cloud alternative: **penetration-testing-with-strix**. +Install, LLM setup, and the managed-cloud alternative: **penetration-testing-with-strix**. For a run with no Docker and no LLM key, the same binary drives the managed platform: `strix cloud login`, then `strix cloud scans start ...` (details in **managed-pentesting-with-strix**). ## What is and is not testable by an agent diff --git a/skills/penetration-testing-with-strix/SKILL.md b/skills/penetration-testing-with-strix/SKILL.md index 1364ad8d9..fc7c6ba14 100644 --- a/skills/penetration-testing-with-strix/SKILL.md +++ b/skills/penetration-testing-with-strix/SKILL.md @@ -12,7 +12,7 @@ metadata: Strix runs autonomous AI pentesting agents that dynamically exploit a target and only report findings validated with a working proof-of-concept. There are **two ways to run it, built on the same engine and producing the same findings** — pick per situation, and mix them freely: - **Open-source CLI** (self-hosted) — runs on your machine in a Docker sandbox with your own LLM key. Free, fully local, BYO-LLM, air-gap capable. Docs: [docs.strix.ai](https://docs.strix.ai). -- **Cloud API** (managed) — runs on Strix's infrastructure via `https://app.strix.ai/api/v1`. No Docker, no LLM key, no local compute; adds team dashboards, scheduling, PR reviews, downloadable PDF/DOCX reports (Enterprise plan), and internal-network connectors. Docs: [docs.app.strix.ai](https://docs.app.strix.ai). Full workflow in the **managed-pentesting-with-strix** skill. +- **Managed cloud** — runs on Strix's infrastructure, driven from the same CLI (`strix cloud ...`) or the REST API at `https://app.strix.ai/api/v1`. No Docker, no LLM key, no local compute; adds team dashboards, scheduling, PR reviews, downloadable PDF/DOCX reports (Enterprise plan), and internal-network connectors. Docs: [docs.app.strix.ai](https://docs.app.strix.ai). Full workflow in the **managed-pentesting-with-strix** skill. ## Which one? (decide, do not default) @@ -122,27 +122,33 @@ Artifacts land in `strix_runs//`: --- -# Option B — Cloud API (managed, no local infra) +# Option B — Managed cloud (no local infra) -Full details, asset registration, polling, reports, PR reviews, schedules, and webhooks are in the **managed-pentesting-with-strix** skill. Minimal launch-and-poll: +The same `strix` binary drives the managed platform. Every command starts with `strix cloud`. Full details — asset registration, source uploads, reports, PR reviews, schedules, webhooks, and billing — are in the **managed-pentesting-with-strix** skill. Minimal flow: ```bash -export STRIX_API_TOKEN="" # org-scoped bearer, from Settings → API Access at app.strix.ai -BASE=https://app.strix.ai/api/v1 +# 1. Sign in (device flow — the user confirms a code in the browser; this also +# creates the account and workspace when needed) +strix cloud login -# 1. Launch a scan against an already-registered domain/repo asset -scan_id=$(curl -sS "$BASE/scans" \ - -H "Authorization: Bearer $STRIX_API_TOKEN" -H "Content-Type: application/json" \ - -d '{"engagement_type":"live_test","domain_ids":[""]}' | jq -r .scan_id) +# If you need specific scopes, request them with --scopes: +# strix cloud login --scopes scans:read scans:write assets:read assets:write \ +# vulnerabilities:read billing:read billing:write -# 2. Poll until terminal (pending → running → completed/failed/cancelled) -curl -sS "$BASE/scans/$scan_id" -H "Authorization: Bearer $STRIX_API_TOKEN" | jq '.status' +# 2. Register and verify the target domain (verification prints a DNS record for the user) +strix cloud domains add --domain staging.example.com --asset-type web_app +strix cloud domains verify -# 3. Read validated findings from the scan detail's `vulnerabilities[]`, or export SARIF -curl -sS "$BASE/scans/$scan_id/sarif" -H "Authorization: Bearer $STRIX_API_TOKEN" -o findings.sarif +# 3. Launch and wait +strix cloud scans start --engagement-type live_test --domain-ids --wait + +# 4. Read validated findings +strix cloud vulns list --severity critical ``` -Ask the user to create the token (and register the target as a domain/repository asset) if they have not. If Docker/local prerequisites are not already satisfied, use this path instead of trying to install infra. +For a local repository, `strix cloud scans start --source .` uploads the working tree (needs `uploads:write`) and infers a code review. When credits run out, `strix cloud billing topup` starts an agent-payable Stripe challenge — the managed skill covers the payment flow. Output is JSON when stdout is not a terminal, so the commands compose in scripts. + +The raw REST API works too (`https://app.strix.ai/api/v1`, org-scoped bearer token — see [docs.app.strix.ai](https://docs.app.strix.ai)). If Docker or local prerequisites are not already satisfied, use this path instead of trying to install infra. --- diff --git a/skills/web-app-penetration-testing/SKILL.md b/skills/web-app-penetration-testing/SKILL.md index 9694a3def..99331fa8b 100644 --- a/skills/web-app-penetration-testing/SKILL.md +++ b/skills/web-app-penetration-testing/SKILL.md @@ -11,7 +11,7 @@ metadata: Black-box (and optionally source-assisted) penetration testing of a running web app with Strix's autonomous agents. Every reported finding is validated with a working exploit, so there are no signature-based false positives to triage. -Install, LLM setup, all CLI flags, and the managed-cloud alternative are covered in the **penetration-testing-with-strix** skill — read it if the target is not a running web app, or if `strix --version` fails. This skill is the web-app-specific workflow. +Install, LLM setup, all CLI flags, and the managed-cloud alternative are covered in the **penetration-testing-with-strix** skill — read it if the target is not a running web app, or if `strix --version` fails. For a run with no Docker and no LLM key, the same binary drives the managed platform: `strix cloud login`, then `strix cloud scans start ...` (details in **managed-pentesting-with-strix**). This skill is the web-app-specific workflow. ## 1. Confirm authorization and scope diff --git a/strix/agents/factory.py b/strix/agents/factory.py index d284dfd39..b2fcbf08c 100644 --- a/strix/agents/factory.py +++ b/strix/agents/factory.py @@ -52,6 +52,7 @@ from strix.tools.reporting.tool import ( create_vulnerability_report, get_report, list_reports, + update_vulnerability_report, ) from strix.tools.respond.tool import respond_to_user from strix.tools.thinking.tool import think @@ -68,7 +69,7 @@ from strix.tools.todo.tools import ( mark_todo_pending, update_todo, ) -from strix.tools.web_search.tool import web_search +from strix.tools.web_search.tool import web_get_contents, web_search if TYPE_CHECKING: @@ -578,8 +579,10 @@ _BASE_TOOLS: tuple[Tool, ...] = ( save_threat_model, amend_threat_model, web_search, + web_get_contents, create_vulnerability_report, create_dependency_report, + update_vulnerability_report, list_reports, get_report, list_requests, diff --git a/strix/agents/prompts/system_prompt.jinja b/strix/agents/prompts/system_prompt.jinja index 399d468c2..f00acbd3d 100644 --- a/strix/agents/prompts/system_prompt.jinja +++ b/strix/agents/prompts/system_prompt.jinja @@ -244,7 +244,8 @@ VALIDATION REQUIREMENTS: - Before filing any report, run the counterevidence pass: argue the strongest case AGAINST the finding, record what you found in the `counterevidence` field, set `confidence` honestly (a static-only trace you couldn't execute is at best `medium`), and state what evidence would change the severity. See the counterevidence and severity-calibration knowledge above. - A vulnerability is ONLY considered reported when a reporting agent uses create_vulnerability_report (or create_dependency_report for known-CVE dependency/supply-chain findings) with full details. Mentions in agent_finish, finish_scan, or generic messages are NOT sufficient - Reporting and fixing are ONE step, not two: when source is available, the reporting agent derives the concrete fix and files it INLINE via create_vulnerability_report (`code_locations` with `fix_before`/`fix_after` + `fix_pr_body`) — the report is not complete without it. Do NOT report first and then spawn a separate downstream agent to re-derive and re-apply the same patch; that just re-does the analysis and wastes tokens. (Do not silently patch a finding WITHOUT filing a report — the report, with its embedded fix, is the deliverable.) -- DEDUPLICATION: The create_vulnerability_report tool uses LLM-based deduplication. If it rejects your report as a duplicate, DO NOT attempt to re-submit the same vulnerability. Accept the rejection and move on to testing other areas. The vulnerability has already been reported by another agent +- DEDUPLICATION: The create_vulnerability_report tool uses LLM-based deduplication. If it rejects your report as a duplicate, DO NOT attempt to re-submit the same vulnerability. Accept the rejection and move on to testing other areas. The vulnerability has already been reported by another agent. If your evidence proves more than the finding it matched (a working exploit where that one had only a static trace, a chain that raises the impact), revise that finding with update_vulnerability_report using the duplicate_of id — never re-file it. +- REVISING A FINDING: use update_vulnerability_report (report id + the fields you want to replace + update_reason) when you learn something a finding already on file does not carry — you built the PoC after filing it, a chain raised its impact, further testing weakened it, or its counterevidence/remediation/code locations were wrong. Editing a finding needs no duplicate verdict, and it is always better than filing a second report for the same issue. Read the finding first with get_report, and pass only the fields that change. - REVIEWING FILED FINDINGS (orchestrator/root agent): use list_reports to see every vulnerability filed so far in this scan (by any agent, root or child) — metadata-first with per-severity counts — and get_report to read one finding in full by its id. These are read-only orchestration tools: the root agent uses them to track coverage, avoid dispatching work on already-covered ground, assemble the finish_scan executive summary, and reason about attack-chaining across confirmed findings. Leaf/specialist agents should NOT call them — just do your assigned testing and file findings. Each entry shows which agent filed it (agent_name), and your own entries are flagged by_you. list_notes/get_note do the same for notes. STATE & COORDINATION TOOLS (when and how): diff --git a/strix/config/codex.py b/strix/config/codex.py index cf34f003d..9f81ff6db 100644 --- a/strix/config/codex.py +++ b/strix/config/codex.py @@ -183,7 +183,7 @@ def build_authorize_url(challenge: str, state: str) -> str: "code_challenge": challenge, "code_challenge_method": "S256", "state": state, - "id_token_add_organizations": "true", + "id_token_add_organizations": "true", # nosec B105 - boolean flag, not a secret "codex_cli_simplified_flow": "true", "originator": ORIGINATOR, } diff --git a/strix/config/loader.py b/strix/config/loader.py index fbcde8982..e6edd5484 100644 --- a/strix/config/loader.py +++ b/strix/config/loader.py @@ -10,11 +10,13 @@ from typing import TYPE_CHECKING, Any from pydantic import AliasChoices, BaseModel -from strix.config.settings import Settings +from strix.config.settings import LlmSettings, Settings from strix.utils.secret_files import write_secret_text if TYPE_CHECKING: + from collections.abc import Mapping + from pydantic.fields import FieldInfo @@ -25,6 +27,11 @@ _DEFAULT_PATH: Path = Path.home() / ".strix" / "cli-config.json" _override: Path | None = None _cached: Settings | None = None +# Model, API key, and API base describe one provider connection. When the shell +# changes any of them, the stored values of the others no longer belong together +# and are dropped rather than mixed with the new value. +_LINKED_LLM_FIELDS = ("model", "api_key", "api_base") + def load_settings() -> Settings: """Resolve settings from env + JSON file + defaults. Memoized. @@ -54,22 +61,31 @@ def apply_config_override(path: Path) -> None: def persist_current() -> None: - """Write currently-set env vars to the active config file (0o600).""" + """Merge currently-set env vars into the active config file (0o600). + + Values already in the file survive when their env var is unset, so a + run that gets its settings from the file does not erase them. An env + var set to the empty string clears the field from the file. A change to + any linked LLM connection var drops the whole stored connection first. + """ s = load_settings() target = _override or _DEFAULT_PATH target.parent.mkdir(parents=True, exist_ok=True) - env_block: dict[str, str] = {} - for sub_name in s.model_fields: + env_block = _drop_stale_llm_connection(_read_env_block(target)) + for sub_name in type(s).model_fields: sub_model = getattr(s, sub_name) if not isinstance(sub_model, BaseModel): continue for finfo in type(sub_model).model_fields.values(): - for alias in _aliases_for(finfo): - value = os.environ.get(alias.upper()) - if value: - env_block[alias.upper()] = value - break + aliases = [alias.upper() for alias in _aliases_for(finfo)] + active = next((alias for alias in aliases if alias in os.environ), None) + if active is None: + continue + for alias in aliases: + env_block.pop(alias, None) + if os.environ[active]: + env_block[active] = os.environ[active] write_secret_text(target, json.dumps({"env": env_block}, indent=2)) @@ -93,17 +109,9 @@ def _read_json_overrides(path: Path) -> dict[str, dict[str, Any]]: Only includes keys whose env var is NOT already set, so env always wins over the persisted file. """ - if not path.exists(): + env_block_upper = _drop_stale_llm_connection(_read_env_block(path)) + if not env_block_upper: return {} - try: - data = json.loads(path.read_text(encoding="utf-8")) - except (json.JSONDecodeError, OSError): - return {} - env_block = data.get("env", {}) if isinstance(data, dict) else {} - if not isinstance(env_block, dict): - return {} - - env_block_upper = {str(k).upper(): v for k, v in env_block.items()} env_present = {k.upper() for k in os.environ} nested: dict[str, dict[str, Any]] = {} @@ -123,3 +131,38 @@ def _read_json_overrides(path: Path) -> dict[str, dict[str, Any]]: if sub_data: nested[sub_name] = sub_data return nested + + +def _first_alias_value(aliases: list[str], source: Mapping[str, Any]) -> Any | None: + return next((source[alias] for alias in aliases if alias in source), None) + + +def _drop_stale_llm_connection(env_block: dict[str, Any]) -> dict[str, Any]: + """Remove every linked LLM var from ``env_block`` if the shell changed any of them.""" + linked_aliases = [ + [alias.upper() for alias in _aliases_for(LlmSettings.model_fields[name])] + for name in _LINKED_LLM_FIELDS + ] + changed = any( + (env_value := _first_alias_value(aliases, os.environ)) is not None + and env_value != _first_alias_value(aliases, env_block) + for aliases in linked_aliases + ) + if not changed: + return env_block + stale = {alias for aliases in linked_aliases for alias in aliases} + return {k: v for k, v in env_block.items() if k not in stale} + + +def _read_env_block(path: Path) -> dict[str, Any]: + """Return the ``env`` block stored in ``path`` with upper-cased keys, or ``{}``.""" + if not path.exists(): + return {} + try: + data = json.loads(path.read_text(encoding="utf-8")) + except (json.JSONDecodeError, OSError): + return {} + env_block = data.get("env", {}) if isinstance(data, dict) else {} + if not isinstance(env_block, dict): + return {} + return {str(k).upper(): v for k, v in env_block.items()} diff --git a/strix/config/models.py b/strix/config/models.py index 88349ad6c..3babbe37b 100644 --- a/strix/config/models.py +++ b/strix/config/models.py @@ -562,6 +562,8 @@ DEFAULT_MODEL_RETRY = ModelRetrySettings( ) RECOMMENDED_MODEL_NAMES = ( + "zai/glm-5.3", + "zai/glm-5.3-flash", "openai/gpt-5.6-sol", "openai/gpt-5.6-terra", "openai/gpt-5.6-luna", @@ -570,6 +572,7 @@ RECOMMENDED_MODEL_NAMES = ( "openai/gpt-5.5", "openai/gpt-5.4", "openai/gpt-5.3-codex", + "anthropic/claude-fable-5-1", "anthropic/claude-fable-5", "anthropic/claude-opus-5", "anthropic/claude-opus-4-8", @@ -577,6 +580,8 @@ RECOMMENDED_MODEL_NAMES = ( "anthropic/claude-sonnet-4-6", "vertex_ai/gemini-3.1-pro-preview", "gemini/gemini-3.1-pro-preview", + "vertex_ai/gemini-3.7-flash", + "gemini/gemini-3.7-flash", "gemini/gemini-3.6-flash", "deepseek/deepseek-v4-pro", "deepseek/deepseek-v4-flash", @@ -588,16 +593,27 @@ RECOMMENDED_MODEL_NAMES = ( _RECOMMENDED_MODEL_NAME_SET = frozenset(name.lower() for name in RECOMMENDED_MODEL_NAMES) -FRONTIER_MODEL_FAMILIES = ( - (("azure", "azure_ai", "bedrock_mantle", "chatgpt", "openai"), ("gpt-5",)), - ( - ("anthropic", "azure_ai", "bedrock", "claude", "databricks", "snowflake", "vertex_ai"), - ("claude-fable-5", "claude-opus-5", "claude-opus-4", "claude-sonnet-5", "claude-sonnet-4"), - ), - (("google", "gemini", "vertex_ai"), ("gemini-3",)), - (("deepseek",), ("deepseek-v4", "deepseek-r1", "deepseek-reasoner")), - (("alibaba", "dashscope", "qwen"), ("qwen3.8", "qwen3.7", "qwen3-max")), - (("moonshot", "moonshotai", "kimi"), ("kimi-k3", "kimi-k2.7", "kimi-k2.6")), +# Matched against the bare model name only: the route (``openai/``, ``openrouter/``, +# a local gateway, ...) says nothing about the model's quality. +FRONTIER_MODEL_PREFIXES = ( + "gpt-5", + "claude-fable-5", + "claude-opus-5", + "claude-opus-4", + "claude-sonnet-5", + "claude-sonnet-4", + "gemini-3", + "deepseek-v4", + "deepseek-r1", + "deepseek-reasoner", + "qwen3.8", + "qwen3.7", + "qwen3-max", + "kimi-k3", + "kimi-k2.7", + "kimi-k2.6", + "glm-5.3", + "glm-5.2", ) @@ -831,11 +847,8 @@ def is_recommended_or_frontier_model(model_name: str) -> bool: return False if name in _RECOMMENDED_MODEL_NAME_SET: return True - provider_name, bare_model_name = _split_model_provider(name) - return any( - _matches_frontier_family(provider_name, bare_model_name, provider_markers, prefixes) - for provider_markers, prefixes in FRONTIER_MODEL_FAMILIES - ) + bare_model_name = name.rsplit("/", 1)[-1] + return _matches_model_prefix(bare_model_name, FRONTIER_MODEL_PREFIXES) def _normalized_model_name(model_name: str) -> str: @@ -847,28 +860,6 @@ def _normalized_model_name(model_name: str) -> str: return name -def _split_model_provider(model_name: str) -> tuple[str | None, str]: - if "/" not in model_name: - return None, model_name - provider_name, bare_model_name = model_name.rsplit("/", 1) - return provider_name, bare_model_name - - -def _matches_frontier_family( - provider_name: str | None, - model_name: str, - provider_markers: tuple[str, ...], - model_prefixes: tuple[str, ...], -) -> bool: - if not _matches_model_prefix(model_name, model_prefixes): - return False - if provider_name is None: - return True - return _contains_provider_marker( - provider_name, provider_markers, split_compound_names=True - ) or _contains_provider_marker(model_name, provider_markers) - - def _matches_model_prefix(model_name: str, model_prefixes: tuple[str, ...]) -> bool: return any( candidate.startswith(prefix) @@ -886,16 +877,6 @@ def _model_name_candidates(model_name: str) -> tuple[str, ...]: return (model_name, *suffixes) -def _contains_provider_marker( - value: str, provider_markers: tuple[str, ...], *, split_compound_names: bool = False -) -> bool: - parts = set(value.replace(".", "/").split("/")) - if split_compound_names: - for separator in ("_", "-"): - parts.update(piece for part in tuple(parts) for piece in part.split(separator)) - return any(marker in parts for marker in provider_markers) - - def is_known_openai_bare_model(model_name: str) -> bool: import litellm diff --git a/strix/config/settings.py b/strix/config/settings.py index feced6fe7..7ed6d51ab 100644 --- a/strix/config/settings.py +++ b/strix/config/settings.py @@ -120,6 +120,10 @@ class TelemetrySettings(BaseSettings): enabled: bool = Field(default=True, alias="STRIX_TELEMETRY") +WebSearchProvider = Literal["auto", "perplexity", "exa"] +ExaSearchType = Literal["auto", "fast", "instant", "deep-lite", "deep", "deep-reasoning"] + + class IntegrationSettings(BaseSettings): model_config = _BASE_CONFIG @@ -128,6 +132,25 @@ class IntegrationSettings(BaseSettings): alias="PERPLEXITY_API_KEY", repr=False, ) + exa_api_key: str | None = Field( + default=None, + alias="EXA_API_KEY", + repr=False, + ) + web_search_provider: WebSearchProvider = Field( + default="auto", + alias="STRIX_WEB_SEARCH_PROVIDER", + ) + exa_search_type: ExaSearchType = Field( + default="auto", + alias="STRIX_EXA_SEARCH_TYPE", + ) + exa_num_results: int = Field( + default=5, + ge=1, + le=100, + alias="STRIX_EXA_NUM_RESULTS", + ) postman_api_key: str | None = Field( default=None, alias="POSTMAN_API_KEY", diff --git a/strix/core/agents.py b/strix/core/agents.py index edd7863b7..4d3d65cc6 100644 --- a/strix/core/agents.py +++ b/strix/core/agents.py @@ -24,6 +24,8 @@ logger = logging.getLogger(__name__) Status = Literal["running", "waiting", "completed", "stopped", "crashed", "failed", "budget_paused"] +TERMINAL_STATUSES: frozenset[str] = frozenset({"completed", "stopped", "crashed", "failed"}) + # Why an agent parked. The user can message any agent, so this - not the agent's # position in the tree - decides whether waiting is bounded: only an agent waiting # on other agents is re-checked on a timer. @@ -36,6 +38,10 @@ class AgentRuntime: task: asyncio.Task[Any] | None = None stream: Any | None = None interrupt_on_message: bool = False + # Whether the agent's loop parks after a terminal state and can be woken by a + # later message. A non-interactive loop returns instead, so once such an + # agent is terminal nothing will ever read its mailbox again. + resumable: bool = True wake: asyncio.Event = field(default_factory=asyncio.Event) mailbox: list[dict[str, Any]] = field(default_factory=list) user_wake_required: bool = False @@ -175,6 +181,7 @@ class AgentCoordinator: session: Session | None = None, task: asyncio.Task[Any] | None = None, interrupt_on_message: bool | None = None, + resumable: bool | None = None, ) -> None: async with self._lock: runtime = self.runtimes.setdefault(agent_id, AgentRuntime()) @@ -184,6 +191,8 @@ class AgentCoordinator: runtime.task = task if interrupt_on_message is not None: runtime.interrupt_on_message = interrupt_on_message + if resumable is not None: + runtime.resumable = resumable async def mark_running(self, agent_id: str) -> None: async with self._lock: @@ -275,10 +284,29 @@ class AgentCoordinator: self._parent_notified.add(agent_id) return True + def _unreachable_locked(self, agent_id: str) -> bool: + """True when the agent is terminal and no loop will ever read its mailbox.""" + if self.statuses.get(agent_id) not in TERMINAL_STATUSES: + return False + runtime = self.runtimes.get(agent_id) + return runtime is not None and not runtime.resumable + + async def reachability(self, agent_id: str) -> tuple[bool, Status | None]: + """Whether a message to ``agent_id`` can still be acted on, plus its status.""" + async with self._lock: + status = self.statuses.get(agent_id) + if status is None: + return False, None + return not self._unreachable_locked(agent_id), status + async def send( self, target_agent_id: str, message: dict[str, Any], *, interrupt: bool = True ) -> bool: - """Queue a user/peer message in the target's mailbox and wake it.""" + """Queue a user/peer message in the target's mailbox and wake it. + + Returns False when nothing will ever read the message: the target is + unknown, or it is terminal and its loop does not park for wake-ups. + """ from_user = message.get("from") == "user" if from_user and self._budget_paused: await self.resume_from_budget_pause(exclude=target_agent_id) @@ -286,6 +314,13 @@ class AgentCoordinator: if target_agent_id not in self.statuses: logger.debug("agent.send dropped unknown target=%s", target_agent_id) return False + if self._unreachable_locked(target_agent_id): + logger.info( + "agent.send dropped: target=%s is %s and cannot be woken", + target_agent_id, + self.statuses[target_agent_id], + ) + return False runtime = self.runtimes.setdefault(target_agent_id, AgentRuntime()) runtime.mailbox.append(dict(message)) self.pending_counts[target_agent_id] = self.pending_counts.get(target_agent_id, 0) + 1 diff --git a/strix/core/execution.py b/strix/core/execution.py index 9f2674d2c..dfcd39fa2 100644 --- a/strix/core/execution.py +++ b/strix/core/execution.py @@ -202,6 +202,7 @@ async def run_agent_loop( agent_id, session=session, interrupt_on_message=interactive, + resumable=interactive, ) result: RunResultBase | None = None @@ -1006,7 +1007,7 @@ async def _start_child_runner( ) -> None: session = open_agent_session(child_id, agents_db_path) sessions_to_close.append(session) - await coordinator.attach_runtime(child_id, session=session) + await coordinator.attach_runtime(child_id, session=session, resumable=interactive) child_ctx: dict[str, Any] = dict(parent_ctx) child_ctx["agent_id"] = child_id diff --git a/strix/core/runner.py b/strix/core/runner.py index 576715d72..b40a36b0e 100644 --- a/strix/core/runner.py +++ b/strix/core/runner.py @@ -45,6 +45,7 @@ from strix.core.paths import run_dir_for, runtime_state_dir from strix.core.sessions import open_agent_session from strix.report.state import get_global_report_state from strix.runtime import session_manager +from strix.telemetry import set_scan_phase from strix.telemetry.logging import set_scan_id, setup_scan_logging from strix.tools.output_store import ( WORKSPACE_SPILL_DIR, @@ -116,6 +117,13 @@ def _record_mcp_connections(connections: list[ConnectedMcpServer]) -> None: report_state.record_mcp_connections([connection.name for connection in connections]) +def _note_exit_reason(reason: str) -> None: + """Record why the scan stopped so the end-of-scan beacon reports it.""" + report_state = get_global_report_state() + if report_state is not None and report_state.scan_ended_exit_reason is None: + report_state.scan_ended_exit_reason = reason + + def _persist_mcp_status(roster: list[dict[str, Any]]) -> None: """Write the run's non-secret MCP connection status roster to run.json. @@ -313,6 +321,7 @@ async def run_strix_scan( root_id = uuid.uuid4().hex[:8] logger.info("Bringing up sandbox session for scan %s", scan_id) + set_scan_phase("sandbox_init") bundle = await session_manager.create_or_reuse( scan_id, image=image, @@ -322,6 +331,7 @@ async def run_strix_scan( ) report("Waiting for the first model response") logger.info("Sandbox ready for scan %s", scan_id) + set_scan_phase("agent_setup") sandbox_session = bundle["session"] @@ -428,6 +438,7 @@ async def run_strix_scan( } for summary in mcp_registry.summaries() ] + # Feed a non-secret connection roster (name / provider / # tool_count / dead) to two consumers: once now (all # currently healthy) and again whenever a connection later @@ -572,6 +583,7 @@ async def run_strix_scan( async with coordinator._lock: root_status = coordinator.statuses.get(root_id) + set_scan_phase("agent_loop") result = await run_agent_loop( agent=root_agent, initial_input=initial_input, @@ -609,6 +621,7 @@ async def run_strix_scan( return result # noqa: TRY300 except BudgetExceededError as exc: logger.info("Scan %s stopped: %s", scan_id, exc) + _note_exit_reason("budget_exceeded") if root_id is not None: with contextlib.suppress(Exception): await coordinator.set_status(root_id, "stopped") @@ -621,6 +634,7 @@ async def run_strix_scan( exc, scan_id, ) + _note_exit_reason("rate_limited") if root_id is not None: with contextlib.suppress(Exception): await coordinator.set_status(root_id, "stopped") diff --git a/strix/interface/cli.py b/strix/interface/cli.py index 18d9e1dbe..d840b57f1 100644 --- a/strix/interface/cli.py +++ b/strix/interface/cli.py @@ -106,14 +106,15 @@ async def run_cli(args: Any) -> None: # noqa: PLR0915 report_state.set_scan_config(scan_config) report_state.save_run_data() - def display_vulnerability(report: dict[str, Any]) -> None: + def display_vulnerability(report: dict[str, Any], *, updated: bool = False) -> None: report_id = report.get("id", "unknown") vuln_text = format_vulnerability_report(report) + suffix = " (updated)" if updated else "" vuln_panel = Panel( vuln_text, - title=f"[bold red]{report_id.upper()}", + title=f"[bold red]{report_id.upper()}{suffix}", title_align="left", border_style="red", padding=(1, 2), @@ -123,6 +124,9 @@ async def run_cli(args: Any) -> None: # noqa: PLR0915 console.print() report_state.vulnerability_found_callback = display_vulnerability + report_state.vulnerability_updated_callback = lambda report: display_vulnerability( + report, updated=True + ) def cleanup_on_exit() -> None: report_state.cleanup() diff --git a/strix/interface/cli_args.py b/strix/interface/cli_args.py index 54038cc80..37f15cbbc 100644 --- a/strix/interface/cli_args.py +++ b/strix/interface/cli_args.py @@ -169,6 +169,14 @@ def parse_arguments() -> argparse.Namespace: # {t("cli.example_workspace")} strix --target ./my-project --workspace-file ./wordlist.txt strix --target https://app.com --workspace-file ./openapi.yaml:specs/openapi.yaml + +Strix Cloud: + strix cloud login + strix cloud scans start --source . --yes --wait + strix cloud # list every cloud resource + + Run a pentest in Strix Cloud https://app.strix.ai + Try Strix Enterprise https://strix.ai/demo """, ) diff --git a/strix/interface/cloud/__init__.py b/strix/interface/cloud/__init__.py new file mode 100644 index 000000000..a906b4398 --- /dev/null +++ b/strix/interface/cloud/__init__.py @@ -0,0 +1,169 @@ +"""`strix cloud` — the managed Strix platform (app.strix.ai) from the terminal. + +Every command maps to one operation of the public REST API. Output is JSON +when stdout is not a terminal, so agents can parse every result. Exit codes: +0 success, 1 error, 2 invalid usage, 4 authentication required, 5 payment +required. +""" + +from __future__ import annotations + +import json +import sys + +from rich.console import Console +from rich.markup import escape + +from strix.interface.cloud import http +from strix.interface.cloud.render import json_mode +from strix.interface.cloud.runner import resolve, run +from strix.interface.cloud.session import run_session +from strix.interface.cloud.spec import DEFAULT_VERBS, GROUP_HELP, SPEC +from strix.interface.cloud.workspaces import run_workspace_use +from strix.interface.platform_cli import run_login +from strix.interface.terminal_text import sanitize_terminal_text + + +_USAGE_HEADER = """[bold]Usage:[/] strix cloud [arguments] + +[bold]Session commands:[/] + login Sign in to the managed platform and store an API token + logout Remove the stored API token + whoami Show the stored account, workspace, and token state + session Inspect or narrow the remote CLI session + credits Show the credit balance of the workspace + +[bold]Resource commands:[/]""" + +_USAGE_FOOTER = """ +Run [bold]strix cloud help[/] to list its verbs. Common read-only +commands may also run their default verb when no verb is given. +Every REST resource command accepts [bold]--json[/] and [bold]--token[/]. Write +commands accept [bold]--data[/] with a JSON object of extra request fields. +Login is an interactive device flow; [bold]whoami[/] and [bold]logout[/] also +produce JSON automatically when output is redirected. +API reference: https://docs.app.strix.ai""" + +_HELP_TOKENS = frozenset({"-h", "--help", "help"}) + + +def _is_help_request(argv: list[str]) -> bool: + """Recognize a help token with an optional JSON-output flag in either order.""" + return sum(argument in _HELP_TOKENS for argument in argv) == 1 and all( + argument in _HELP_TOKENS or argument == "--json" for argument in argv + ) + + +def run_cloud(argv: list[str]) -> int: + """Run a managed-cloud command without ever leaking a Ctrl-C traceback.""" + try: + return _run_cloud(argv) + except KeyboardInterrupt: + if json_mode(flag="--json" in argv): + sys.stdout.write(json.dumps({"error": "Interrupted.", "interrupted": True}) + "\n") + else: + Console(stderr=True).print("[yellow]Interrupted.[/]") + return 130 + + +def _run_cloud(argv: list[str]) -> int: # noqa: PLR0911, PLR0912 + """Entry point for ``strix cloud …``. Returns a process exit code.""" + console = Console() + as_json = json_mode(flag="--json" in argv) + if not argv or _is_help_request(argv): + if as_json: + _print_usage_json() + else: + _print_usage(console) + return 0 + if argv == ["--json"]: + _print_usage_json() + return 0 + + group, rest = argv[0], argv[1:] + if group == "workspace": + group = "workspaces" + if group in ("login", "logout", "whoami"): + return _run_session(console, group, rest) + if group == "session": + return run_session(rest) + if group == "credits": + group, rest = "billing", ["credits", *rest] + if group == "workspaces" and rest and rest[0] == "use": + try: + return run_workspace_use(rest[1:]) + except http.CloudError as exc: + if "--json" in rest: + sys.stdout.write(json.dumps({"error": str(exc)}) + "\n") + else: + console.print(f"[red]Error:[/] {escape(sanitize_terminal_text(exc))}") + return exc.exit_code + + if group not in SPEC: + if as_json: + sys.stdout.write(json.dumps({"error": f"unknown command: {group}"}) + "\n") + return 2 + console.print(f"[red]Unknown command:[/] {escape(sanitize_terminal_text(group))}") + _print_usage(console) + return 2 + group_help = _is_help_request(rest) + resolved = None if group_help else resolve(group, rest) + if resolved is None: + help_tokens: set[str] = set(_HELP_TOKENS) if group_help else set() + invalid = [arg for arg in rest if arg != "--json" and arg not in help_tokens] + _print_verbs(console, group, as_json=as_json, error="unknown verb" if invalid else None) + return 2 if invalid else 0 + cmd, remaining = resolved + verb_label = " ".join(rest[: len(rest) - len(remaining)]) or DEFAULT_VERBS.get(group, "") + return run(group, verb_label, cmd, remaining) + + +def _run_session(_console: Console, group: str, rest: list[str]) -> int: + if rest and rest[0] == "help": + rest = ["--help", *rest[1:]] + session_argv = { + "login": rest, + "logout": ["logout", *rest], + "whoami": ["status", *rest], + } + return run_login(session_argv[group]) + + +def _print_usage(console: Console) -> None: + console.print(_USAGE_HEADER) + for group in SPEC: + console.print(f" {group:<14}{GROUP_HELP.get(group, '')}") + console.print(_USAGE_FOOTER) + + +def _print_verbs( + console: Console, group: str, *, as_json: bool = False, error: str | None = None +) -> None: + if as_json: + verbs: list[dict[str, str]] = [ + {"name": verb, "help": command.help} for verb, command in SPEC[group].items() + ] + if group == "workspaces": + verbs.append({"name": "use", "help": "Switch the stored token to another workspace."}) + payload: dict[str, object] = { + "command": f"strix cloud {group}", + "verbs": verbs, + } + if error: + payload["error"] = error + sys.stdout.write(json.dumps(payload, indent=2) + "\n") + return + console.print(f"[bold]strix cloud {group}[/] verbs:") + for verb, cmd in SPEC[group].items(): + console.print(f" {verb:<28}{cmd.help}") + if group == "workspaces": + console.print(f" {'use':<28}Switch the stored token to another workspace.") + + +def _print_usage_json() -> None: + payload = { + "command": "strix cloud", + "session_commands": ["login", "logout", "whoami", "session", "credits"], + "resource_commands": [{"name": group, "help": GROUP_HELP.get(group, "")} for group in SPEC], + } + sys.stdout.write(json.dumps(payload, indent=2) + "\n") diff --git a/strix/interface/cloud/arguments.py b/strix/interface/cloud/arguments.py new file mode 100644 index 000000000..d1924572d --- /dev/null +++ b/strix/interface/cloud/arguments.py @@ -0,0 +1,18 @@ +"""Argument parsing that reports managed-cloud usage errors through one contract.""" + +from __future__ import annotations + +import argparse +from typing import NoReturn + +import strix.interface.cloud.http as http # noqa: PLR0402 + + +class CloudArgumentParser(argparse.ArgumentParser): + """Raise a typed usage error instead of printing argparse prose and exiting.""" + + def error(self, message: str) -> NoReturn: + raise http.CloudError( + f"invalid arguments for {self.prog}: {message}", + exit_code=http.EXIT_USAGE, + ) diff --git a/strix/interface/cloud/billing.py b/strix/interface/cloud/billing.py new file mode 100644 index 000000000..4bc0c1f87 --- /dev/null +++ b/strix/interface/cloud/billing.py @@ -0,0 +1,718 @@ +"""Billing top-up and agent-wallet execution for ``strix cloud``.""" + +from __future__ import annotations + +import json +import os +import re +import shutil +import subprocess +import sys +import tempfile +import webbrowser +from contextlib import suppress +from dataclasses import dataclass +from pathlib import Path +from typing import TYPE_CHECKING, Any, cast + +import strix.interface.cloud.http as http # noqa: PLR0402 +from strix.interface.cloud.payment_proxy import WalletUpstreamResponse, wallet_payment_bridge +from strix.interface.cloud.render import emit +from strix.interface.terminal_text import sanitize_terminal_text + + +if TYPE_CHECKING: + import argparse + + from rich.console import Console + + +_MAX_WALLET_DETAIL_CHARS = 2_000 +# Keep the wallet client on the exact protocol implementation used by the +# platform. This version is also old enough to remain installable in npm +# environments that apply a short package-publication safety window. +_MPPX_PACKAGE = "mppx@0.8.17" +# Stripe's own wallet client. It runs the complete challenge flow: it creates a +# spend request, waits for the person to approve it in the Link app, and retries +# the payment with the approved credential. +_LINK_CLI_PACKAGE = "@stripe/link-cli@0.13.1" +_LINK_CLI_CLIENT_NAME = "Strix CLI" +_LINK_LOGIN_TIMEOUT_S = 300 +# Poll every 2 seconds while the person approves the spend request in the Link +# app. 150 attempts give the person 5 minutes. +_LINK_APPROVAL_POLL_INTERVAL_S = 2 +_LINK_APPROVAL_MAX_ATTEMPTS = 150 +# Bound every wallet subprocess so a stalled npm download or wallet request +# cannot block the top-up command forever. The poll step gets the full +# approval window plus this margin. +_WALLET_STEP_TIMEOUT_S = 300 +_LINK_APPROVAL_TIMEOUT_S = ( + _LINK_APPROVAL_POLL_INTERVAL_S * _LINK_APPROVAL_MAX_ATTEMPTS + _WALLET_STEP_TIMEOUT_S +) +_NPM_REGISTRY = "https://registry.npmjs.org" +_WALLET_ENV_NAMES = frozenset( + { + "ALL_PROXY", + "APPDATA", + "COLORTERM", + "COMSPEC", + "FORCE_COLOR", + "HOME", + "HTTPS_PROXY", + "HTTP_PROXY", + "LANG", + "LC_ALL", + "LC_CTYPE", + "LOCALAPPDATA", + "NO_COLOR", + "NO_PROXY", + "PATH", + "PATHEXT", + "SSL_CERT_DIR", + "SSL_CERT_FILE", + "SYSTEMROOT", + "TEMP", + "TERM", + "TMP", + "TMPDIR", + "USERPROFILE", + "XDG_CONFIG_HOME", + "XDG_DATA_HOME", + "XDG_STATE_HOME", + "all_proxy", + "http_proxy", + "https_proxy", + "no_proxy", + } +) +_AUTHORIZATION_SECRET = re.compile(r"(?i)((?:bearer|payment)\s+)[^\s\"']+") +_LOOPBACK_NO_PROXY = ("127.0.0.1", "localhost", "::1") + + +@dataclass(frozen=True) +class _WalletClientResult: + process: subprocess.CompletedProcess[str] + upstream_responses: tuple[WalletUpstreamResponse, ...] + + +def run_topup( # noqa: PLR0911, PLR0912, PLR0915 + console: Console, + args: argparse.Namespace, + body: dict[str, Any], + *, + as_json: bool, + token: str | None, +) -> int: + """Handle the HTTP 402 challenge and optional agent-wallet payment.""" + response = http.request("POST", "/billing/topup", token=token, body=body) + if response.status_code != 402: + emit(console, http.check(response), as_json=as_json) + return http.EXIT_OK + + challenge = http.parsed(response) + if getattr(args, "no_pay", False): + emit( + console, + {"error": "Payment required", "challenge": challenge}, + as_json=as_json, + ) + return http.EXIT_PAYMENT + + credit_count = body.get("credits") + if not getattr(args, "yes", False): + if as_json or not (sys.stdin.isatty() and sys.stdout.isatty()): + emit( + console, + { + "error": ( + "Payment requires explicit approval in non-interactive mode. " + "Review the challenge, then re-run with --yes to authorize payment." + ), + "challenge": challenge, + }, + as_json=as_json, + ) + return http.EXIT_PAYMENT + answer = console.input(f"Buy {credit_count} credit(s) now? [y/N]: ").strip().lower() + if answer not in ("y", "yes"): + console.print("[yellow]Payment cancelled.[/]") + return http.EXIT_PAYMENT + + npx = shutil.which("npx") + if npx is None: + message = ( + "Payment requires a wallet client. Install Node.js and run the command again, " + "or pay the challenge with an MPP wallet client." + ) + if as_json: + emit( + console, + {"error": message, "challenge": challenge}, + as_json=True, + ) + else: + emit(console, challenge, as_json=False) + console.print(f"[yellow]Payment required.[/] {message}") + return http.EXIT_PAYMENT + + payment_method = getattr(args, "payment_method", None) or os.environ.get( + "MPPX_STRIPE_PAYMENT_METHOD" + ) + use_link_wallet = payment_method is None and not _mppx_wallet_configured() + if use_link_wallet: + setup_error = _prepare_link_wallet(console, npx, as_json=as_json) + if setup_error is not None: + emit( + console, + {"error": setup_error, "challenge": challenge}, + as_json=as_json, + ) + return http.EXIT_PAYMENT + try: + wallet_result = _run_wallet_client( + console, + npx, + args, + body, + token=token, + payment_method=payment_method, + use_link_wallet=use_link_wallet, + capture_output=as_json, + ) + except KeyboardInterrupt: + emit( + console, + { + "error": ( + "Payment was interrupted after the wallet started. The outcome is unknown; " + "run `strix cloud billing credits` and check the balance before retrying." + ), + "interrupted": True, + "payment_outcome_unknown": True, + }, + as_json=as_json, + ) + return 130 + except OSError: + emit( + console, + { + "error": "Could not start the wallet client securely.", + "challenge": challenge, + }, + as_json=as_json, + ) + return http.EXIT_PAYMENT + + result = wallet_result.process + confirmed_receipt = _confirmed_topup_receipt(wallet_result.upstream_responses) + if confirmed_receipt is not None: + emit(console, confirmed_receipt, as_json=as_json) + return http.EXIT_OK + + stdout = str(getattr(result, "stdout", "") or "").strip() + stderr = str(getattr(result, "stderr", "") or "").strip() + if not as_json: + console.print( + "[yellow]The wallet exited without a confirmed receipt. The payment outcome is " + "unknown; run `strix cloud billing credits` before retrying.[/]" + ) + detail = _wallet_detail(stderr or stdout or "") + if detail: + console.print(f"[dim]Wallet output: {detail}[/]") + return http.EXIT_PAYMENT + if result.returncode == 0: + try: + receipt = json.loads(stdout) + except (TypeError, ValueError): + emit( + console, + { + "error": ( + "The wallet reported success but did not return JSON. Check the credit " + "balance before retrying payment." + ), + "detail": _wallet_detail(stdout or stderr or "No wallet output was returned."), + "payment_outcome_unknown": True, + }, + as_json=True, + ) + return http.EXIT_PAYMENT + if not _valid_topup_receipt(receipt): + emit( + console, + { + "error": ( + "The wallet returned an invalid top-up receipt. Check the credit balance " + "before retrying payment." + ), + "detail": _wallet_detail(stdout), + "payment_outcome_unknown": True, + }, + as_json=True, + ) + return http.EXIT_PAYMENT + emit( + console, + { + "error": ( + "The wallet returned a receipt, but the Strix billing endpoint did not " + "confirm it. Check the credit balance before retrying payment." + ), + "detail": _wallet_detail(stdout), + "payment_outcome_unknown": True, + }, + as_json=True, + ) + return http.EXIT_PAYMENT + + emit( + console, + { + "error": ( + "The wallet exited without a confirmed receipt. The payment outcome is unknown; " + "run `strix cloud billing credits` and check the balance before retrying." + ), + "detail": _wallet_detail( + stderr or stdout or f"Wallet client exited with status {result.returncode}." + ), + "wallet_exit_code": result.returncode, + "payment_outcome_unknown": True, + }, + as_json=True, + ) + return http.EXIT_PAYMENT + + +def _run_wallet_client( + console: Console, + npx: str, + args: argparse.Namespace, + body: dict[str, Any], + *, + token: str | None, + payment_method: str | None, + use_link_wallet: bool, + capture_output: bool, +) -> _WalletClientResult: + """Run the wallet through the loopback bridge without exposing the API token.""" + upstream_url = f"{http.app_url()}/api/v1/billing/topup" + body_json = json.dumps(body) + wallet_env = _wallet_environment() + upstream_responses: list[WalletUpstreamResponse] = [] + with tempfile.TemporaryDirectory(prefix="strix-wallet-") as wallet_cwd: + wallet_root = Path(wallet_cwd) + user_config = wallet_root / "user.npmrc" + global_config = wallet_root / "global.npmrc" + user_config.touch(mode=0o600) + global_config.touch(mode=0o600) + npx_prefix = _npx_prefix(npx, wallet_root) + with wallet_payment_bridge( + upstream_url=upstream_url, + api_token=http.api_token(token), + workspace_id=http.expected_workspace_id(token_override=token is not None), + expected_body=body_json.encode(), + timeout=getattr(args, "timeout", None), + response_observer=upstream_responses.append, + ) as wallet_url: + if use_link_wallet: + process = _run_link_wallet_flow( + console, + npx_prefix, + wallet_url, + body, + body_json, + wallet_env, + wallet_root, + quiet=capture_output, + ) + else: + command = [ + *npx_prefix, + _MPPX_PACKAGE, + wallet_url, + "--fail", + "-J", + body_json, + ] + if payment_method: + command += ["-M", f"paymentMethod={payment_method}"] + try: + process = subprocess.run( # noqa: S603 + command, + check=False, + capture_output=capture_output, + text=True, + env=wallet_env, + cwd=wallet_root, + timeout=_LINK_APPROVAL_TIMEOUT_S, + ) + except subprocess.TimeoutExpired as timeout_error: + process = subprocess.CompletedProcess( + args=command, + returncode=1, + stdout=_decoded_stream(timeout_error.stdout), + stderr=( + "The wallet step did not complete within " + f"{_LINK_APPROVAL_TIMEOUT_S} seconds." + ), + ) + return _WalletClientResult(process=process, upstream_responses=tuple(upstream_responses)) + + +def _run_link_wallet_flow( + console: Console, + npx_prefix: list[str], + wallet_url: str, + body: dict[str, Any], + body_json: str, + wallet_env: dict[str, str], + wallet_root: Path, + *, + quiet: bool, +) -> subprocess.CompletedProcess[str]: + """Create the spend request, wait for approval in the Link app, then pay.""" + + def run_step( + arguments: list[str], + progress_message: str, + timeout: int = _WALLET_STEP_TIMEOUT_S, + ) -> subprocess.CompletedProcess[str]: + command = [*npx_prefix, _LINK_CLI_PACKAGE, *arguments] + + def run() -> subprocess.CompletedProcess[str]: + try: + return subprocess.run( # noqa: S603 + command, + check=False, + capture_output=True, + text=True, + env=wallet_env, + cwd=wallet_root, + timeout=timeout, + ) + except subprocess.TimeoutExpired as timeout_error: + return subprocess.CompletedProcess( + args=command, + returncode=1, + stdout=_decoded_stream(timeout_error.stdout), + stderr=f"The wallet step did not complete within {timeout} seconds.", + ) + + if quiet: + return run() + with console.status(progress_message): + return run() + + created = run_step( + [ + "mpp", + "pay", + wallet_url, + "--method", + "POST", + "--data", + body_json, + "--context", + _payment_context(body), + "--format", + "json", + ], + "Starting the Stripe Link wallet…", + ) + spend_request = _pending_spend_request(created.stdout) + if spend_request is None: + return created + request_id, approval_url = spend_request + + if not quiet: + console.print(f"[yellow]Approve the payment in the Link app:[/] {approval_url}") + if sys.stdin.isatty() and sys.stdout.isatty() and approval_url.startswith("https://"): + with suppress(Exception): + webbrowser.open(approval_url) + polled = run_step( + [ + "spend-request", + "retrieve", + request_id, + "--interval", + str(_LINK_APPROVAL_POLL_INTERVAL_S), + "--max-attempts", + str(_LINK_APPROVAL_MAX_ATTEMPTS), + "--format", + "jsonl", + ], + "Waiting for the approval in the Link app…", + timeout=_LINK_APPROVAL_TIMEOUT_S, + ) + if _final_spend_request_status(polled.stdout) != "approved": + return polled + + return run_step( + [ + "mpp", + "pay", + wallet_url, + "--spend-request-id", + request_id, + "--method", + "POST", + "--data", + body_json, + "--format", + "json", + ], + "Completing the payment…", + ) + + +def _decoded_stream(stream: str | bytes | None) -> str: + """Return captured subprocess output as text.""" + if stream is None: + return "" + if isinstance(stream, bytes): + return stream.decode(errors="replace") + return stream + + +def _embedded_json_documents(text: str) -> list[Any]: + """Extract JSON documents from wallet output that can contain other text.""" + documents: list[Any] = [] + decoder = json.JSONDecoder() + position = 0 + while position < len(text): + start_candidates = [ + index for index in (text.find("[", position), text.find("{", position)) if index != -1 + ] + if not start_candidates: + break + start = min(start_candidates) + try: + document, end = decoder.raw_decode(text, start) + except ValueError: + position = start + 1 + continue + documents.append(document) + position = end + return documents + + +def _spend_request_records(stdout: str) -> list[dict[str, Any]]: + """Parse spend-request records from JSON or JSON-lines wallet output.""" + records: list[dict[str, Any]] = [] + for candidate in _embedded_json_documents((stdout or "").strip()): + items = candidate if isinstance(candidate, list) else [candidate] + for item in items: + if not isinstance(item, dict): + continue + record = cast("dict[str, Any]", item) + data = record.get("data") + if isinstance(data, dict): + record = cast("dict[str, Any]", data) + records.append(record) + return records + + +def _pending_spend_request(stdout: str) -> tuple[str, str] | None: + """Find a spend request that waits for approval in the Link app.""" + for record in _spend_request_records(stdout): + request_id = record.get("id") + approval_url = record.get("approval_url") + if ( + record.get("status") == "pending_approval" + and isinstance(request_id, str) + and request_id + and isinstance(approval_url, str) + ): + return request_id, approval_url + return None + + +def _final_spend_request_status(stdout: str) -> str | None: + """Return the last reported status from the approval poll output.""" + status: str | None = None + for record in _spend_request_records(stdout): + value = record.get("status") + if isinstance(value, str): + status = value + return status + + +def _npx_prefix(npx: str, wallet_root: Path) -> list[str]: + """Install the wallet client from a fixed registry without lifecycle scripts.""" + return [ + npx, + "--yes", + f"--registry={_NPM_REGISTRY}", + "--ignore-scripts", + f"--userconfig={wallet_root / 'user.npmrc'}", + f"--globalconfig={wallet_root / 'global.npmrc'}", + f"--cache={_wallet_npm_cache()}", + ] + + +def _wallet_npm_cache() -> Path: + """Keep one private npm cache so the pinned wallet client installs once.""" + cache = Path.home() / ".strix" / "wallet-npm-cache" + cache.mkdir(mode=0o700, parents=True, exist_ok=True) + return cache + + +def _payment_context(body: dict[str, Any]) -> str: + """Describe the purchase for the person who approves it in the Link app.""" + credits_requested = body.get("credits") + return ( + f"Strix scan credits. The Strix command line interface asks to buy " + f"{credits_requested} scan credit(s) for the selected Strix workspace on " + "app.strix.ai. Strix spends the credits on managed penetration test scans " + "that the user starts." + ) + + +def _mppx_wallet_configured() -> bool: + """Report whether the person already configured the mppx wallet client.""" + return bool(os.environ.get("MPPX_ACCOUNT") or os.environ.get("MPPX_STRIPE_SECRET_KEY")) + + +def _run_link_cli( + npx: str, + arguments: list[str], + *, + capture_output: bool, + timeout: float | None = None, +) -> subprocess.CompletedProcess[str]: + """Run one Stripe Link wallet command in an isolated npm environment.""" + with tempfile.TemporaryDirectory(prefix="strix-wallet-") as wallet_cwd: + wallet_root = Path(wallet_cwd) + (wallet_root / "user.npmrc").touch(mode=0o600) + (wallet_root / "global.npmrc").touch(mode=0o600) + return subprocess.run( # noqa: S603 + [*_npx_prefix(npx, wallet_root), _LINK_CLI_PACKAGE, *arguments], + check=False, + capture_output=capture_output, + text=True, + env=_wallet_environment(), + cwd=wallet_root, + timeout=timeout, + ) + + +def _link_wallet_authenticated(npx: str) -> bool: + """Report whether a Link wallet is already connected to this machine.""" + try: + result = _run_link_cli( + npx, + ["auth", "status", "--format", "json"], + capture_output=True, + timeout=_LINK_LOGIN_TIMEOUT_S, + ) + except (OSError, subprocess.SubprocessError): + return False + try: + payload = json.loads(result.stdout or "null") + except (TypeError, ValueError): + return False + if isinstance(payload, list): + payload = payload[0] if payload else None + return bool(isinstance(payload, dict) and payload.get("authenticated")) + + +def _prepare_link_wallet(console: Console, npx: str, *, as_json: bool) -> str | None: + """Connect a Link wallet when none is present. Return an error message on failure.""" + if _link_wallet_authenticated(npx): + return None + + manual_setup = ( + "Payment needs a Stripe Link wallet. Run `strix cloud billing topup` in an " + "interactive terminal to connect one, or set up the wallet at " + "https://link.com/agents. For a browser checkout instead, run " + "`strix cloud billing subscribe --plan strix_top_up`." + ) + if as_json or not (sys.stdin.isatty() and sys.stdout.isatty()): + return manual_setup + + console.print( + "[yellow]No Stripe Link wallet is connected.[/] Strix starts the Link sign-in now. " + "Approve the connection in the Link app, then Strix continues the payment. " + "The user approves every payment in the Link app." + ) + try: + _run_link_cli( + npx, + [ + "auth", + "login", + "--client-name", + _LINK_CLI_CLIENT_NAME, + "--interval", + "3", + "--timeout", + str(_LINK_LOGIN_TIMEOUT_S), + ], + capture_output=False, + timeout=_LINK_LOGIN_TIMEOUT_S + 30, + ) + except (OSError, subprocess.SubprocessError): + return manual_setup + if _link_wallet_authenticated(npx): + return None + return manual_setup + + +def _wallet_environment() -> dict[str, str]: + """Pass only platform essentials and explicit wallet variables to npm/mppx.""" + environment = { + name: value + for name, value in os.environ.items() + if name in _WALLET_ENV_NAMES or name.startswith(("LINK_", "MPPX_")) + } + for name in ("NO_PROXY", "no_proxy"): + entries = [entry.strip() for entry in environment.get(name, "").split(",") if entry.strip()] + normalized = {entry.lower().strip("[]") for entry in entries} + entries.extend(host for host in _LOOPBACK_NO_PROXY if host not in normalized) + environment[name] = ",".join(entries) + return environment + + +def _wallet_detail(value: str) -> str: + """Bound and redact third-party wallet diagnostics before returning JSON.""" + redacted = _AUTHORIZATION_SECRET.sub(r"\1[redacted]", sanitize_terminal_text(value)) + if len(redacted) <= _MAX_WALLET_DETAIL_CHARS: + return redacted + return redacted[: _MAX_WALLET_DETAIL_CHARS - 1] + "…" + + +def _valid_topup_receipt(value: Any) -> bool: + """Require the documented success shape before reporting a paid top-up.""" + if not isinstance(value, dict): + return False + fields = cast("dict[str, Any]", value) + credits_granted = fields.get("credits_granted") + balance = fields.get("balance") + return ( + isinstance(credits_granted, int) + and not isinstance(credits_granted, bool) + and credits_granted >= 0 + and isinstance(fields.get("duplicate"), bool) + and isinstance(fields.get("reference"), str) + and bool(fields["reference"]) + and isinstance(balance, int) + and not isinstance(balance, bool) + and balance >= 0 + ) + + +def _confirmed_topup_receipt( + responses: tuple[WalletUpstreamResponse, ...], +) -> dict[str, Any] | None: + """Return a receipt only when the trusted bridge observed its successful response.""" + for response in reversed(responses): + if not 200 <= response.status_code < 300: + continue + try: + receipt = json.loads(response.body) + except (TypeError, ValueError): + continue + if _valid_topup_receipt(receipt): + return cast("dict[str, Any]", receipt) + return None diff --git a/strix/interface/cloud/http.py b/strix/interface/cloud/http.py new file mode 100644 index 000000000..1531f0b58 --- /dev/null +++ b/strix/interface/cloud/http.py @@ -0,0 +1,408 @@ +"""HTTP client for the managed Strix platform API (app.strix.ai).""" + +from __future__ import annotations + +import ipaddress +import math +import os +import re +from typing import TYPE_CHECKING, Any, cast +from urllib.parse import SplitResult, urlsplit + +import requests + +from strix.config import load_settings +from strix.interface.platform_cli import read_record + + +if TYPE_CHECKING: + from pathlib import Path + + +_DEFAULT_TIMEOUT_S = 120 +_SUPABASE_STORAGE_HOST = re.compile(r"^[a-z0-9-]+\.supabase\.co$") +_STORAGE_PATH_PREFIX = "/storage/v1/" +_app_url_override: str | None = None +_token_override_active = False +_workspace_id_override: str | None = None +_timeout_s: float = _DEFAULT_TIMEOUT_S + +EXIT_OK = 0 +EXIT_ERROR = 1 +EXIT_USAGE = 2 +EXIT_AUTH = 4 +EXIT_PAYMENT = 5 + + +TOPUP_COMMAND = "strix cloud billing topup --credits " +BALANCE_COMMAND = "strix cloud billing credits" + + +class CloudError(Exception): + """A failed cloud command. Carries the process exit code. + + `next_step` is a short recovery instruction that the runner prints on its + own line after the error, so a person or an agent can act without reading + the docs. + """ + + def __init__( + self, + message: str, + *, + exit_code: int = EXIT_ERROR, + payload: Any = None, + next_step: str | None = None, + ) -> None: + super().__init__(message) + self.exit_code = exit_code + self.payload = payload + self.next_step = next_step + + +class CloudTransportError(CloudError): + """A request may have reached the platform, but no response was received.""" + + +def configure( + *, + base_url: str | None = None, + timeout: float | None = None, + token_override: bool = False, + workspace_id: str | None = None, +) -> None: + """Set the platform URL and the request timeout for this process.""" + global _app_url_override, _timeout_s, _token_override_active # noqa: PLW0603 + global _workspace_id_override # noqa: PLW0603 + _app_url_override = base_url.rstrip("/") if base_url else None + _token_override_active = token_override + explicit_workspace = workspace_id or os.environ.get("STRIX_WORKSPACE_ID") + if explicit_workspace: + _workspace_id_override = explicit_workspace.strip() + elif not token_override and not os.environ.get("STRIX_API_TOKEN"): + record = read_record() + stored_workspace = record.get("organization_id") if record is not None else None + _workspace_id_override = ( + stored_workspace.strip() + if isinstance(stored_workspace, str) and stored_workspace.strip() + else None + ) + else: + _workspace_id_override = None + if timeout is not None: + if not math.isfinite(timeout) or timeout <= 0: + raise CloudError( + "request timeout must be a finite number greater than 0.", + exit_code=EXIT_USAGE, + ) + _timeout_s = timeout + + +def app_url() -> str: + if _app_url_override: + return _app_url_override + viewer = load_settings().viewer + configured = viewer.app_url.rstrip("/") + explicitly_configured = bool(os.environ.get("STRIX_APP_URL")) or "app_url" in getattr( + viewer, "model_fields_set", set[str]() + ) + if explicitly_configured or _token_override_active or os.environ.get("STRIX_API_TOKEN"): + return configured + record = read_record() + stored = record.get("app_url") if record is not None else None + if isinstance(stored, str) and stored: + try: + _parse_origin_url(stored, label="stored platform URL") + except CloudError: + pass + else: + return stored.rstrip("/") + return configured + + +def api_token(override: str | None = None) -> str: + token = override or os.environ.get("STRIX_API_TOKEN") + if not token: + record = read_record() + if record is not None: + stored = record.get("api_token") + if isinstance(stored, str): + _validate_stored_token_origin(record) + token = stored + if not token or not token.strip(): + raise CloudError( + "not signed in. Run `strix cloud login`, or set STRIX_API_TOKEN.", + exit_code=EXIT_AUTH, + ) + return token.strip() + + +def _validate_stored_token_origin(record: dict[str, Any]) -> None: + """Never send a stored bearer token to an origin other than its issuer.""" + stored_url = record.get("app_url") + if not isinstance(stored_url, str) or not stored_url: + raise CloudError( + "the stored sign-in is not bound to a trusted platform. Run `strix cloud login` " + "again before using it.", + exit_code=EXIT_AUTH, + ) + try: + stored_origin = _origin(_parse_origin_url(stored_url, label="stored platform URL")) + active_origin = _origin(_parse_origin_url(app_url(), label="configured platform URL")) + except CloudError as exc: + raise CloudError( + "the stored sign-in has an invalid platform binding. Run `strix cloud login` again.", + exit_code=EXIT_AUTH, + ) from exc + if stored_origin != active_origin: + raise CloudError( + "the stored sign-in belongs to a different platform. Refusing to send its token; " + "run `strix cloud login` for the configured platform or supply an explicit token.", + exit_code=EXIT_AUTH, + ) + + +def request( + method: str, + path: str, + *, + token: str | None = None, + query: dict[str, Any] | None = None, + body: dict[str, Any] | None = None, + stream: bool = False, + idempotency_key: str | None = None, +) -> requests.Response: + url = f"{app_url()}/api/v1{path}" + headers = { + "Authorization": f"Bearer {api_token(token)}", + } + workspace_id = expected_workspace_id(token_override=token is not None) + if workspace_id: + headers["X-Strix-Workspace"] = workspace_id + if idempotency_key is not None: + headers["Idempotency-Key"] = idempotency_key + try: + response = requests.request( + method, + url, + headers=headers, + params={ + key: ("true" if value else "false") if isinstance(value, bool) else value + for key, value in (query or {}).items() + if value is not None + } + or None, + json=body, + timeout=_timeout_s, + stream=stream, + allow_redirects=False, + ) + except requests.RequestException as exc: + raise CloudTransportError(f"could not reach {app_url()}: {exc}") from exc + return response + + +def expected_workspace_id(*, token_override: bool) -> str | None: + """Pin every request in this process to the workspace selected at startup.""" + if _workspace_id_override: + return _workspace_id_override + if token_override or _token_override_active or os.environ.get("STRIX_API_TOKEN"): + return None + return None + + +def upload_file(signed_url: str, upload_token: str, path: Path) -> None: + """Stream a file to a platform-issued storage URL.""" + _validate_upload_url(signed_url) + response: requests.Response | None = None + try: + with path.open("rb") as stream: + response = requests.put( + signed_url, + data=stream, + headers={ + "Authorization": f"Bearer {upload_token}", + "Content-Type": "application/zip", + }, + timeout=_timeout_s, + allow_redirects=False, + ) + except (OSError, requests.RequestException) as exc: + raise CloudError(f"source upload failed: {exc}") from exc + try: + if 300 <= response.status_code < 400: + raise CloudError("source upload refused an unexpected redirect") + if not response.ok: + detail = "" + try: + payload = response.json() + if isinstance(payload, dict): + fields = cast("dict[str, Any]", payload) + detail = str(fields.get("message") or fields.get("error") or "") + except ValueError: + pass + raise CloudError(detail or f"source upload failed (HTTP {response.status_code})") + finally: + response.close() + + +def _validate_upload_url(signed_url: str) -> None: + """Allow uploads only to the trusted app origin or managed Supabase storage.""" + # Supabase signed upload URLs carry their signature in the query string. + # Keep every origin/path restriction below, but allow that opaque query on + # this one platform-issued URL type. + target = _parse_origin_url( + signed_url, + label="source upload URL", + allow_query=True, + ) + if not target.path.startswith(_STORAGE_PATH_PREFIX): + raise CloudError("source upload refused a URL outside the storage API") + + configured_app = _parse_origin_url(app_url(), label="configured platform URL") + if _origin(target) == _origin(configured_app): + return + if _is_loopback_host(configured_app.hostname or "") and _is_loopback_host( + target.hostname or "" + ): + return + + hostname = target.hostname or "" + if ( + target.scheme == "https" + and target.port in (None, 443) + and _SUPABASE_STORAGE_HOST.fullmatch(hostname) + ): + return + raise CloudError( + "source upload refused an untrusted storage origin; only the configured platform " + "origin and managed Supabase storage are allowed" + ) + + +def _parse_origin_url( + value: str, + *, + label: str, + allow_query: bool = False, +) -> SplitResult: + try: + parsed = urlsplit(value) + port = parsed.port + except (TypeError, ValueError) as exc: + raise CloudError(f"{label} is invalid") from exc + hostname = parsed.hostname + if ( + parsed.scheme not in {"http", "https"} + or not hostname + or parsed.username is not None + or parsed.password is not None + or (parsed.query and not allow_query) + or parsed.fragment + or "\\" in value + or any(character.isspace() for character in value) + or "%" in parsed.netloc + ): + raise CloudError(f"{label} is invalid") + try: + hostname.encode("ascii") + except UnicodeEncodeError as exc: + raise CloudError(f"{label} contains a non-ASCII hostname") from exc + if port is not None and not 1 <= port <= 65535: + raise CloudError(f"{label} is invalid") + return parsed + + +def _origin(parsed: SplitResult) -> tuple[str, str, int]: + default_port = 443 if parsed.scheme == "https" else 80 + return parsed.scheme, (parsed.hostname or "").lower(), parsed.port or default_port + + +def _is_loopback_host(hostname: str) -> bool: + normalized = hostname.lower().rstrip(".") + if normalized == "localhost" or normalized.endswith(".localhost"): + return True + try: + return ipaddress.ip_address(normalized).is_loopback + except ValueError: + return False + + +def parsed(response: requests.Response) -> Any: + content_type = response.headers.get("content-type", "") + if "application/json" in content_type: + try: + return response.json() + except ValueError: + return response.text + return response.text + + +def check(response: requests.Response) -> Any: + data = parsed(response) + if 200 <= response.status_code < 300: + content_type = response.headers.get("content-type", "").lower() + if "application/json" not in content_type: + raise CloudError( + "the server returned a non-JSON response. Check STRIX_APP_URL and preview " + "access, then retry." + ) + try: + return response.json() + except ValueError as exc: + raise CloudError( + "the server returned malformed JSON. Check STRIX_APP_URL and preview " + "access, then retry." + ) from exc + detail = "" + error_code = "" + if isinstance(data, dict): + raw = cast("dict[str, Any]", data) + detail = str(raw.get("detail") or raw.get("error") or "") + error_code = str(raw.get("code") or raw.get("error_code") or "") + nested_error = raw.get("error") + if isinstance(nested_error, dict): + nested = cast("dict[str, Any]", nested_error) + error_code = error_code or str(nested.get("code") or "") + detail = str(nested.get("message") or detail) + message = detail or f"HTTP {response.status_code}" + if error_code == "scan_credit_limit_reached" or response.status_code == 402: + raise payment_required_error(data, detail=detail) + if response.status_code in (401, 403): + raise CloudError(message, exit_code=EXIT_AUTH, payload=data) + raise CloudError(message, exit_code=EXIT_ERROR, payload=data) + + +def topup_url() -> str: + return f"{app_url()}/settings/billing" + + +def topup_next_step(url: str | None = None) -> str: + return ( + f"Buy credits with `{TOPUP_COMMAND}` or at {url or topup_url()}. " + f"Run `{BALANCE_COMMAND}` to see the balance. Then retry this command." + ) + + +def payment_required_error(data: Any, *, detail: str = "") -> CloudError: + """Build the error for an exhausted credit balance. + + The platform sends the recovery instruction in `hint` and repeats it inside + `detail`. The CLI shows the instruction once, on its own line, and adds its + own instruction when the platform sends none. + """ + server_hint = "" + server_url: str | None = None + if isinstance(data, dict): + raw = cast("dict[str, Any]", data) + server_hint = str(raw.get("hint") or "").strip() + raw_url = raw.get("topup_url") + if isinstance(raw_url, str) and raw_url.startswith("https://"): + server_url = raw_url + message = detail.strip() + if server_hint and message.endswith(server_hint): + message = message[: -len(server_hint)].strip() + if not message: + message = "Not enough credits to run this command." + next_step = server_hint or topup_next_step(server_url) + return CloudError(message, exit_code=EXIT_PAYMENT, payload=data, next_step=next_step) diff --git a/strix/interface/cloud/payment_proxy.py b/strix/interface/cloud/payment_proxy.py new file mode 100644 index 000000000..9041f7f6b --- /dev/null +++ b/strix/interface/cloud/payment_proxy.py @@ -0,0 +1,286 @@ +"""Loopback bridge for wallet clients that only accept secrets in argv. + +The ``mppx`` CLI accepts custom HTTP headers through ``-H`` only. Passing a +Strix API token that way exposes it to process-listing tools. This module keeps +the token in the Strix process and injects it while forwarding the wallet's few +requests (challenge probes and the paid retry) to the fixed billing endpoint. +""" + +from __future__ import annotations + +import secrets +import threading +from contextlib import contextmanager, suppress +from dataclasses import dataclass, field +from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer +from typing import TYPE_CHECKING, Any + +import requests + + +if TYPE_CHECKING: + from collections.abc import Callable, Generator + + +_DEFAULT_REQUEST_TIMEOUT_S = 120.0 +_MAX_REQUEST_BODY_BYTES = 64 * 1024 +_MAX_UPSTREAM_RESPONSE_BYTES = 1024 * 1024 +_MAX_WALLET_REQUESTS = 3 +_HOP_BY_HOP_HEADERS = frozenset( + { + "connection", + "keep-alive", + "proxy-authenticate", + "proxy-authorization", + "proxy-connection", + "te", + "trailer", + "transfer-encoding", + "upgrade", + } +) + + +@dataclass +class _BridgeState: + upstream_url: str + authorization: str + workspace_id: str | None + expected_body: bytes + path: str + timeout: float + response_observer: Callable[[WalletUpstreamResponse], None] | None = None + request_count: int = 0 + lock: threading.Lock = field(default_factory=threading.Lock) + + def claim_request(self) -> bool: + """Allow only the challenge probes and the one paid retry.""" + with self.lock: + if self.request_count >= _MAX_WALLET_REQUESTS: + return False + self.request_count += 1 + return True + + +class _ResponseTooLargeError(Exception): + """The fixed billing endpoint returned more data than a wallet needs.""" + + +@dataclass(frozen=True) +class WalletUpstreamResponse: + """A bounded upstream response observed by the trusted loopback bridge.""" + + status_code: int + body: bytes + + +def _bounded_response_body(response: requests.Response) -> bytes: + content_length = response.headers.get("Content-Length") + if content_length: + try: + if int(content_length) > _MAX_UPSTREAM_RESPONSE_BYTES: + raise _ResponseTooLargeError + except ValueError: + pass + + chunks: list[bytes] = [] + total = 0 + for chunk in response.iter_content(chunk_size=64 * 1024): + if not chunk: + continue + total += len(chunk) + if total > _MAX_UPSTREAM_RESPONSE_BYTES: + raise _ResponseTooLargeError + chunks.append(chunk) + return b"".join(chunks) + + +def _connection_header_names(handler: BaseHTTPRequestHandler) -> set[str]: + value = handler.headers.get("Connection", "") + return {item.strip().lower() for item in value.split(",") if item.strip()} + + +def _forward_request_headers(handler: BaseHTTPRequestHandler) -> dict[str, str]: + blocked = { + *_HOP_BY_HOP_HEADERS, + *_connection_header_names(handler), + "content-length", + "forwarded", + "host", + "true-client-ip", + "x-forwarded-for", + "x-forwarded-host", + "x-forwarded-proto", + "x-real-ip", + "x-strix-authorization", + "x-strix-workspace", + "x-vercel-forwarded-for", + } + return {name: value for name, value in handler.headers.items() if name.lower() not in blocked} + + +def _send_json_error(handler: BaseHTTPRequestHandler, status: int, message: str) -> None: + body = f'{{"error": "{message}"}}'.encode() + handler.close_connection = True + handler.send_response(status) + handler.send_header("Content-Type", "application/json") + handler.send_header("Content-Length", str(len(body))) + handler.send_header("Cache-Control", "no-store") + handler.send_header("Connection", "close") + handler.end_headers() + with suppress(BrokenPipeError, ConnectionResetError): + handler.wfile.write(body) + + +def _make_handler(state: _BridgeState) -> type[BaseHTTPRequestHandler]: + class WalletBridgeHandler(BaseHTTPRequestHandler): + protocol_version = "HTTP/1.1" + + def log_message(self, format: str, *args: Any) -> None: # noqa: A002 + """Do not write wallet request metadata to stderr.""" + del format, args + + def do_POST(self) -> None: # noqa: PLR0911, PLR0912 + if self.path != state.path: + _send_json_error(self, 404, "Not found") + return + if self.headers.get("Transfer-Encoding"): + _send_json_error(self, 400, "Chunked request bodies are not supported") + return + try: + content_length = int(self.headers.get("Content-Length", "")) + except ValueError: + _send_json_error(self, 411, "A valid Content-Length is required") + return + if content_length < 0 or content_length > _MAX_REQUEST_BODY_BYTES: + _send_json_error(self, 413, "Request body is too large") + return + body = self.rfile.read(content_length) + if body != state.expected_body: + _send_json_error(self, 403, "Request body did not match the approved top-up") + return + if not state.claim_request(): + _send_json_error(self, 429, "Wallet request limit reached") + return + + headers = _forward_request_headers(self) + headers["X-Strix-Authorization"] = state.authorization + if state.workspace_id: + headers["X-Strix-Workspace"] = state.workspace_id + try: + response = requests.request( + "POST", + state.upstream_url, + headers=headers, + data=body, + timeout=state.timeout, + allow_redirects=False, + stream=True, + ) + try: + response_body = _bounded_response_body(response) + response_status = response.status_code + response_headers = dict(response.headers) + finally: + response.close() + except _ResponseTooLargeError: + _send_json_error(self, 502, "Strix billing response was too large") + return + except requests.RequestException: + _send_json_error(self, 502, "Could not reach the Strix billing endpoint") + return + + if state.response_observer is not None: + with suppress(Exception): + state.response_observer( + WalletUpstreamResponse(status_code=response_status, body=response_body) + ) + + if 300 <= response_status < 400: + _send_json_error(self, 502, "Strix billing refused an unexpected redirect") + return + + self.send_response(response_status) + response_connection_headers = { + item.strip().lower() + for item in response_headers.get("Connection", "").split(",") + if item.strip() + } + blocked_response_headers = { + *_HOP_BY_HOP_HEADERS, + *response_connection_headers, + "cache-control", + "content-encoding", + "content-length", + "location", + } + for name, value in response_headers.items(): + if ( + name.lower() not in blocked_response_headers + and "\r" not in value + and "\n" not in value + ): + self.send_header(name, value) + self.send_header("Content-Length", str(len(response_body))) + self.send_header("Cache-Control", "no-store") + self.end_headers() + with suppress(BrokenPipeError, ConnectionResetError): + self.wfile.write(response_body) + + def do_GET(self) -> None: + _send_json_error(self, 405, "Method not allowed") + + def do_PUT(self) -> None: + _send_json_error(self, 405, "Method not allowed") + + def do_PATCH(self) -> None: + _send_json_error(self, 405, "Method not allowed") + + def do_DELETE(self) -> None: + _send_json_error(self, 405, "Method not allowed") + + return WalletBridgeHandler + + +@contextmanager +def wallet_payment_bridge( + *, + upstream_url: str, + api_token: str, + workspace_id: str | None = None, + expected_body: bytes, + timeout: float | None = None, + response_observer: Callable[[WalletUpstreamResponse], None] | None = None, +) -> Generator[str]: + """Yield a one-run loopback URL that injects the Strix API token upstream. + + The random path prevents accidental cross-process requests and limits local + denial-of-service races. It is not an authentication boundary against a + same-user process that can inspect another process's argv. + """ + capability = secrets.token_urlsafe(32) + path = f"/topup/{capability}" + state = _BridgeState( + upstream_url=upstream_url, + authorization=f"Bearer {api_token}", + workspace_id=workspace_id, + expected_body=expected_body, + path=path, + timeout=timeout or _DEFAULT_REQUEST_TIMEOUT_S, + response_observer=response_observer, + ) + server = ThreadingHTTPServer(("127.0.0.1", 0), _make_handler(state)) + server.daemon_threads = True + thread = threading.Thread( + target=server.serve_forever, + kwargs={"poll_interval": 0.05}, + name="strix-wallet-bridge", + daemon=True, + ) + thread.start() + try: + yield f"http://127.0.0.1:{server.server_port}{path}" + finally: + server.shutdown() + server.server_close() + thread.join(timeout=1) diff --git a/strix/interface/cloud/render.py b/strix/interface/cloud/render.py new file mode 100644 index 000000000..69a497f3d --- /dev/null +++ b/strix/interface/cloud/render.py @@ -0,0 +1,1759 @@ +"""Output rendering for `strix cloud` commands.""" + +from __future__ import annotations + +import json +import re +import sys +from datetime import UTC, datetime +from typing import TYPE_CHECKING, Any, TypeGuard + +from rich.markup import escape +from rich.table import Table + +from strix.interface.terminal_text import sanitize_terminal_text + + +if TYPE_CHECKING: + from collections.abc import Iterable + + from rich.console import Console + + +_MAX_TABLE_COLUMNS = 8 +_MAX_CELL_LENGTH = 60 +_MAX_DETAIL_CELL_LENGTH = 2000 +_MAX_DETAIL_FIELDS = 36 +_MAX_NESTED_PREVIEW = 5 +_NARROW_TABLE_WIDTH = 120 +_CAMEL_BOUNDARY = re.compile(r"(?<=[a-z0-9])(?=[A-Z])") +_COPYABLE_SELECTOR_COLUMNS = frozenset( + { + "event_id", + "id", + "installation_id", + "parent_id", + "path", + "policy_key", + "repo_key", + "retest_scan_id", + "scan_id", + "test_user_id", + "vulnerability_id", + } +) +_SELECTOR_NO_WRAP_MAX = 40 +_INTERNAL_COLUMNS = frozenset( + { + "organization_id", + "user_id", + "userId", + "installation_id", + "added_by", + "created_by", + "connected_by", + "invited_by", + "uploaded_by", + "avatarUrl", + } +) +_LOSSLESS_DETAIL_KEYS = frozenset( + { + "api_token", + "command", + "docker_command", + "enrollment_command", + "secret", + "signing_secret", + "token", + "webhook_secret", + } +) + +_PREFERRED_KEYS = ( + "name", + "title", + "repository_full_name", + "pr_number", + "pr_title", + "head_branch", + "base_branch", + "verdict", + "domain", + "target", + "default_branch", + "branch", + "display_number", + "status", + "state", + "workspace_state", + "severity", + "cve", + "cvss", + "finding_type", + "findings_count", + "open_findings_count", + "role", + "email", + "firstName", + "lastName", + "url", + "provider", + "secret_prefix", + "events", + "action", + "resource_type", + "response_status", + "attempts", + "scan_type", + "engagement_type", + "estimated_credits", + "cron_expression", + "timezone", + "next_run_at", + "is_active", + "created_at", + "updated_at", + "expires_at", + "last_used_at", + "id", +) + +_DETAIL_PRIORITY_KEYS = ( + "id", + "display_number", + "title", + "name", + "status", + "state", + "severity", + "finding_type", + "cve", + "cwe", + "cvss", + "filed_at", + "target", + "location_meta", + "urls", + "repositories", + "internal_targets", + "endpoint", + "method", + "url", + "events", + "business_unit", + "is_active", + "secret_prefix", + "last_success_at", + "last_failure_at", + "run_id", + "sandbox_attached", + "description", + "impact", + "technical_analysis", + "evidence", + "assumptions", + "remediation_steps", + "fix_pr_eligible", + "fix_pr_reason", + "fix_pr_url", + "poc_description", + "poc_script_code", + "code_file", + "code_locations", + "code_diff", + "code_before", + "code_after", + "dependency_metadata", + "fix_effort", + "executive_summary", + "methodology", + "recommendations", + "auth_status", + "auth_failure_code", + "auth_detail", + "scan_scope", + "findings", + "duration", + "created_at", + "updated_at", +) + +_LIST_ENVELOPE_KEYS = frozenset( + { + "items", + "data", + "scans", + "agents", + "chats", + "vulnerabilities", + "findings", + "files", + "messages", + "runs", + "steps", + "components", + "domains", + "repositories", + "repos", + "schedules", + "reviews", + "pr_reviews", + "workspaces", + "members", + "invitations", + "integrations", + "connectors", + "webhooks", + "deliveries", + "entries", + "documents", + "docs", + "policies", + "tokens", + "uploads", + "events", + "audit_logs", + "logs", + } +) +_ENVELOPE_METADATA_KEYS = frozenset( + { + "total", + "total_count", + "totalCount", + "count", + "page", + "limit", + "page_size", + "pageSize", + "has_more", + "hasMore", + "next_cursor", + "nextCursor", + "meta", + "pagination", + "summary", + "stats", + "scansThisMonth", + "organization_id", + } +) + +_VIEW_COLUMNS: dict[str, tuple[str, ...]] = { + "GET /scans": ( + "title", + "target", + "engagement_type", + "scan_type", + "status", + "findings_count", + "created_at", + "id", + ), + "GET /vulnerabilities": ( + "display_number", + "title", + "severity", + "status", + "location", + "cvss", + "finding_type", + "id", + ), + "GET /pr-reviews": ( + "repository", + "pull_request", + "branches", + "status", + "verdict", + "findings", + "updated_at", + "id", + ), + "GET /integrations": ( + "provider", + "account_login", + "installation_id", + "instance_url", + "status", + "repository_selection", + "default_collection_name", + "connected_at", + ), + "GET /domains": ( + "domain", + "asset_type", + "verified", + "last_scan_at", + "context", + "tags", + "business_unit", + "id", + ), + "GET /repositories": ( + "full_name", + "provider", + "pr_review_enabled", + "last_scan_at", + "business_unit", + "tags", + "id", + ), + "GET /knowledge": ( + "title", + "source_type", + "source_id", + "tags", + "severity", + "status", + "updated_at", + "id", + ), + "GET /knowledge/repos/{repo}/entries": ( + "title", + "source_type", + "source_id", + "tags", + "severity", + "status", + "updated_at", + "id", + ), + "GET /knowledge/repos": ("repo_key", "docs_count", "last_updated_at"), + "GET /knowledge/policies": ( + "policy_key", + "policy_type", + "is_active", + "policy_value", + "updated_at", + "created_at", + "id", + ), + "GET /domains/{domainId}/test-users": ( + "label", + "username", + "password", + "mfa", + "verification", + "login_url", + "updated_at", + "id", + ), + "GET /tokens": ( + "name", + "type", + "status", + "scopes", + "access", + "expires_at", + "last_used_at", + "id", + ), + "GET /chat": ("title", "status", "last_message_at", "created_at", "id"), + "GET /chat/{chatId}/files": ("path", "size"), + "GET /chat/{chatId}/findings": ( + "title", + "severity", + "status", + "location", + "cvss", + "filed_at", + "created_at", + "id", + ), + "GET /domains/{domainId}/test-users/{userId}/inbox": ( + "from", + "subject", + "detected_code", + "timestamp", + "preview", + "id", + ), + "GET /scans/{scanId}/agents": ( + "name", + "status", + "task", + "finding_count", + "parent_id", + "created_at", + "id", + ), + "GET /scans/{scanId}/trace": ( + "timestamp", + "kind", + "tool_name", + "status", + "summary", + "event_id", + ), + "GET /scans/{scanId}/retests": ( + "title", + "severity", + "issue_status", + "retest_status", + "created_at", + "vulnerability_id", + "retest_scan_id", + ), + "GET /pr-reviews/findings": ( + "repository", + "pull_request", + "pr_state", + "title", + "severity", + "status", + "created_at", + "id", + ), + "GET /vulnerabilities/{vulnerabilityId}/history": ( + "created_at", + "previous_status", + "new_status", + "snooze", + "previous_severity", + "new_severity", + "note", + "reason", + ), + "GET /repositories/{repositoryId}/supply-chain/findings": ( + "title", + "package", + "severity", + "status", + "fixed_version", + "manifest_path", + "direct", + "id", + ), + "GET /repositories/{repositoryId}/supply-chain/components": ( + "name", + "version", + "ecosystem", + "relationship", + "status", + "highest_open_severity", + "manifest_path", + "id", + ), + "GET /schedules": ( + "name", + "target", + "cron_expression", + "timezone", + "state", + "last_run_status", + "next_run_at", + "id", + ), + "GET /connectors": ("name", "last_status", "last_status_checked_at", "created_at", "id"), + "GET /organization/members": ( + "email", + "firstName", + "lastName", + "role", + "access", + "status", + "joinedAt", + "id", + ), + "GET /organization/invitations": ( + "email", + "role", + "access", + "state", + "expiresAt", + "createdAt", + "id", + ), + "GET /webhooks": ( + "url", + "events", + "is_active", + "business_unit", + "last_success_at", + "last_failure_at", + "created_at", + "id", + ), + "GET /webhooks/{webhookId}/deliveries": ( + "event_type", + "status", + "response_status", + "last_error", + "attempts", + "sent_at", + "next_attempt_at", + "id", + ), + "GET /audit": ( + "action", + "resource_type", + "resource_id", + "actor_email", + "ip_address", + "created_at", + ), + "supply_chain_totals": ( + "repositories", + "components", + "findings", + "open_issues", + "malicious", + "suspicious", + "vulnerable", + ), + "supply_chain_repositories": ( + "repository", + "components", + "findings", + "severity", + "risks", + "latest_scan", + "policy", + "id", + ), + "chat_credentials_attached": ( + "label", + "username", + "login_url", + "mfa_method", + "password", + "totp", + "test_user_id", + ), + "chat_credentials_test_users": ( + "label", + "username", + "domain", + "login_url", + "mfa_method", + "password", + "totp", + "id", + ), + "chat_credentials_scans": ( + "scan_title", + "username", + "login_url", + "mfa_method", + "password", + "totp", + "scan_id", + ), +} + +_VIEW_LIST_KEYS: dict[str, str] = { + "GET /chat": "chats", + "GET /chat/{chatId}/files": "files", + "GET /chat/{chatId}/findings": "findings", + "GET /domains/{domainId}/test-users/{userId}/inbox": "messages", + "GET /scans/{scanId}/agents": "agents", + "GET /scans/{scanId}/trace": "steps", + "GET /scans/{scanId}/retests": "runs", + "GET /pr-reviews/findings": "items", + "GET /vulnerabilities/{vulnerabilityId}/history": "items", + "GET /knowledge/repos/{repo}/entries": "docs", + "GET /repositories/{repositoryId}/supply-chain/findings": "findings", + "GET /repositories/{repositoryId}/supply-chain/components": "components", + "GET /schedules": "schedules", + "GET /organization/members": "members", + "GET /organization/invitations": "invitations", +} + +_DETAIL_ENVELOPE_KEYS: dict[str, str] = { + "GET /chat/{chatId}": "chat", + "GET /webhooks/{webhookId}": "webhook", +} + + +def _is_record(value: object) -> TypeGuard[dict[str, Any]]: + return isinstance(value, dict) + + +def _is_list(value: object) -> TypeGuard[list[Any]]: + return isinstance(value, list) + + +def json_mode(*, flag: bool) -> bool: + """JSON output is on when the flag is set or when stdout is not a terminal.""" + return flag or not sys.stdout.isatty() + + +def emit( # noqa: PLR0911, PLR0912, PLR0915 + console: Console, + data: Any, + *, + as_json: bool, + row_numbers: bool = False, + omit_columns: frozenset[str] = frozenset(), + hint: str | None = None, + view: str | None = None, + warning: str | None = None, +) -> None: + if as_json: + sys.stdout.write(json.dumps(data, indent=2, default=str) + "\n") + return + if warning: + console.print(f"[bold yellow]Save this now:[/] {escape(sanitize_terminal_text(warning))}") + hint = _combine_hints(hint, _pagination_hint(data)) + if view == "source_manifest" and _is_record(data): + _print_source_manifest(console, data) + return + if view == "GET /analytics/scan-frequency": + _print_scan_frequency(console, data) + return + if view in {"GET /analytics/overview", "GET /analytics/stats"} and _is_record(data): + _print_analytics(console, data) + return + if view == "GET /supply-chain/summary" and _is_record(data): + _print_supply_chain_summary(console, data) + return + if view == "GET /chat/{chatId}/credentials" and _is_record(data): + _print_chat_credentials(console, data) + return + detail_key = _DETAIL_ENVELOPE_KEYS.get(view or "") + if detail_key and _is_record(data): + detail = data.get(detail_key) + if _is_record(detail): + _print_detail(console, _detail_envelope_record(detail, view)) + return + if view == "GET /integrations": + integration_rows = _integration_rows(data) + if integration_rows is not None: + _print_table( + console, + integration_rows, + row_numbers=row_numbers, + omit_columns=omit_columns, + hint=hint, + view=view, + ) + return + if view == "GET /tokens": + token_rows = _token_rows(data) + if token_rows is not None: + _print_table( + console, + token_rows, + row_numbers=row_numbers, + omit_columns=omit_columns, + hint=hint, + view=view, + ) + return + if view == "GET /scans": + scan_rows = _scan_rows(data) + if scan_rows is not None: + _print_table( + console, + scan_rows, + row_numbers=False, + omit_columns=omit_columns, + hint=_combine_hints("Inspect one scan with `strix cloud scans get ID`.", hint), + view=view, + ) + return + if view == "GET /vulnerabilities": + vulnerability_rows = _finding_location_rows(data) + if vulnerability_rows is not None: + _print_table( + console, + vulnerability_rows, + row_numbers=False, + omit_columns=omit_columns | frozenset({"scan_id"}), + hint=_combine_hints("Inspect one finding with `strix cloud vulns get ID`.", hint), + view=view, + ) + return + if view == "GET /pr-reviews": + review_rows = _pr_review_rows(data) + if review_rows is not None: + _print_table( + console, + review_rows, + row_numbers=False, + omit_columns=omit_columns, + hint=_combine_hints( + "Use `strix cloud pr-reviews get ID` for one review.", + _view_hint(data, view), + hint, + ), + view=view, + ) + return + view_rows = _rows_for_view(data, view) + if view_rows is not None: + _print_table( + console, + view_rows, + row_numbers=row_numbers, + omit_columns=omit_columns, + hint=_combine_hints(_view_hint(data, view), hint), + view=view, + ) + return + rows = _list_of_dicts(data) + if rows is not None: + _print_table( + console, + rows, + row_numbers=row_numbers, + omit_columns=omit_columns, + hint=hint, + view=view, + ) + return + if isinstance(data, str): + console.print(sanitize_terminal_text(data), markup=False) + return + if _is_record(data): + _print_detail(console, data) + return + console.print_json(json.dumps(data, default=str)) + + +def _list_of_dicts(data: Any) -> list[dict[str, Any]] | None: + """Extract a record list from a raw list or a common paginated envelope.""" + if _is_record(data): + # Some endpoints wrap the actual envelope in a top-level ``data`` or + # ``result`` object. Only recurse through an object wrapper; a list in + # ``data`` is handled with the other named envelope keys below. + for wrapper in ("data", "result"): + nested = data.get(wrapper) + if _is_record(nested): + nested_rows = _list_of_dicts(nested) + if nested_rows is not None: + return nested_rows + candidates = [ + (key, value) + for key, value in data.items() + if key in _LIST_ENVELOPE_KEYS + and _is_list(value) + and all(_is_record(item) for item in value) + ] + if len(candidates) == 1: + list_key, records = candidates[0] + other_keys = set(data) - {list_key} + if list_key in {"items", "data"} or other_keys <= _ENVELOPE_METADATA_KEYS: + data = records + if not _is_list(data): + return None + if not data: + return [] + records = [item for item in data if _is_record(item)] + if len(records) != len(data): + return None + return records + + +def _records_at_key(data: Any, key: str) -> list[dict[str, Any]] | None: + """Extract one deliberate collection even when an envelope has other lists.""" + if _is_list(data): + return _list_of_dicts(data) + if not _is_record(data): + return None + value = data.get(key) + if not _is_list(value) or not all(_is_record(item) for item in value): + return None + return list(value) + + +def _detail_envelope_record(data: dict[str, Any], view: str | None) -> dict[str, Any]: + record = dict(data) + if view == "GET /webhooks/{webhookId}" and not record.get("business_unit"): + record["business_unit"] = "all organization" + if view == "GET /chat/{chatId}": + record["sandbox_attached"] = bool(record.pop("sandbox_api_url", False)) + return record + + +def _rows_for_view(data: Any, view: str | None) -> list[dict[str, Any]] | None: + """Shape non-standard list envelopes into compact, actionable rows.""" + if view == "GET /domains/{domainId}/test-users": + return _test_user_rows(data) + key = _VIEW_LIST_KEYS.get(view or "") + if key is None: + return None + records = _records_at_key(data, key) + if records is None: + return None + transforms = { + "GET /scans/{scanId}/trace": _trace_rows, + "GET /chat/{chatId}/findings": _finding_location_rows, + "GET /pr-reviews/findings": _pr_finding_rows, + "GET /vulnerabilities/{vulnerabilityId}/history": _vulnerability_history_rows, + "GET /repositories/{repositoryId}/supply-chain/findings": (_supply_chain_finding_rows), + "GET /schedules": _schedule_rows, + "GET /organization/members": _access_rows, + "GET /organization/invitations": _access_rows, + } + transform = transforms.get(view or "") + return transform(records) if transform else records + + +def _view_hint(data: Any, view: str | None) -> str | None: + hint: str | None = None + if view == "GET /scans/{scanId}/trace" and _is_record(data): + hint = _trace_view_hint(data) + elif view == "GET /scans/{scanId}/retests" and _is_record(data): + total = data.get("total") + completed = data.get("completed") + running = data.get("running") + if all(isinstance(value, int) for value in (total, completed, running)): + hint = f"{completed}/{total} retest(s) complete; {running} running." + elif view == "GET /knowledge/repos/{repo}/entries" and _is_record(data): + hint = _knowledge_repo_hint(data) + elif view == "GET /pr-reviews" and _is_record(data): + hint = _metric_hint( + "Review counts", + data.get("counts"), + ("all", "open", "attention", "merged_open", "passed", "running"), + ) + elif view == "GET /pr-reviews/findings" and _is_record(data): + hint = _metric_hint( + "Impact", + data.get("stats"), + ("prs_reviewed", "issues_found", "critical_high_found", "merges_blocked"), + ) + elif view == "GET /domains/{domainId}/test-users/{userId}/inbox" and _is_record(data): + address = data.get("address") + if isinstance(address, str) and address.strip(): + hint = f"Inbox: {sanitize_terminal_text(address.strip())}." + elif view == "GET /schedules": + hint = "Inspect one schedule with `strix cloud schedules get ID`." + return hint + + +def _trace_view_hint(data: dict[str, Any]) -> str | None: + scan_id = data.get("scan_id") + suffix = f" {scan_id}" if scan_id else " SCAN_ID" + parts = [ + f"Inspect a complete event with `strix cloud scans trace-event{suffix} EVENT_ID`; " + "use --json for full tool arguments and results." + ] + cursor = data.get("cursor") + if data.get("has_more") and isinstance(cursor, str) and cursor: + parts.append( + f"Continue the same trace command with `--cursor {cursor}`; keep its " + "--agent-id, --tool-name, and --limit options." + ) + note = data.get("note") + if isinstance(note, str) and note.strip(): + parts.append(note.strip()) + return _combine_hints(*parts) + + +def _knowledge_repo_hint(data: dict[str, Any]) -> str | None: + parts: list[str] = [] + profile = data.get("profile") + if _is_record(profile): + title = sanitize_terminal_text(str(profile.get("title") or "present")) + parts.append(f"Repository profile: {title}.") + policies = data.get("policies") + if _is_list(policies): + noun = "policy" if len(policies) == 1 else "policies" + parts.append(f"{len(policies)} {noun} apply.") + if parts: + parts.append("Use --json to view the profile and policy metadata.") + return _combine_hints(*parts) + + +def _metric_hint(label: str, value: Any, keys: tuple[str, ...]) -> str | None: + if not _is_record(value): + return None + metrics = [ + f"{_human_label(key)} {value[key]}" for key in keys if isinstance(value.get(key), int) + ] + return f"{label}: {', '.join(metrics)}." if metrics else None + + +def _combine_hints(*hints: str | None) -> str | None: + combined = " ".join(hint.strip() for hint in hints if hint and hint.strip()) + return combined or None + + +def _pagination_hint(data: Any) -> str | None: + """Explain how to continue a paginated human list without hiding API metadata.""" + if not _is_record(data): + return None + candidates = [data.get(key) for key in ("meta", "pagination")] + for pagination in candidates: + if not _is_record(pagination): + continue + message = _pagination_message(pagination) + if message: + return message + for wrapper in ("data", "result"): + nested = data.get(wrapper) + if _is_record(nested): + hint = _pagination_hint(nested) + if hint: + return hint + return None + + +def _pagination_message(pagination: dict[str, Any]) -> str | None: + page = pagination.get("page") + total_pages = pagination.get("total_pages") + total = pagination.get("total_items", pagination.get("total")) + has_next = pagination.get("has_next") + if isinstance(page, int) and isinstance(total_pages, int): + return _page_pagination_message(page, total_pages, total, has_next=has_next) + + offset = pagination.get("offset") + limit = pagination.get("limit") + if not isinstance(offset, int) or not isinstance(limit, int) or not isinstance(total, int): + return None + if total <= 0: + return "0 total." + if offset >= total: + last_offset = max(0, ((total - 1) // max(1, limit)) * max(1, limit)) + return f"No items at offset {offset}; {total} total. Retry with `--offset {last_offset}`." + shown_through = min(offset + limit, total) + message = f"Showing {offset + 1}-{shown_through} of {total}." + if offset + limit < total: + message += f" Continue with `--offset {offset + limit}`." + return message + + +def _page_pagination_message(page: int, total_pages: int, total: Any, *, has_next: Any) -> str: + if total == 0: + return "0 total." + last_page = max(1, total_pages) + if page > last_page: + total_note = f"; {total} total" if isinstance(total, int) else "" + return f"No items on page {page}{total_note}. Retry with `--page {last_page}`." + parts = [f"Page {page}/{last_page}"] + if isinstance(total, int): + parts.append(f"{total} total") + message = " · ".join(parts) + "." + if (has_next is True or page < total_pages) and page >= 0: + message += f" Continue with `--page {page + 1}`." + return message + + +def _test_user_rows(data: Any) -> list[dict[str, Any]] | None: + records = _records_at_key(data, "items") + if records is None: + return None + checks = data.get("auth_checks") if _is_record(data) else None + rows: list[dict[str, Any]] = [] + for record in records: + row = dict(record) + row["password"] = "set" if record.get("has_password") else "not set" + method = str(record.get("mfa_method") or "none") + if method == "totp": + row["mfa"] = "totp (secret set)" if record.get("has_totp_secret") else "totp (missing)" + elif method in {"email_otp", "magic_link"}: + address = str(record.get("mfa_email") or "address missing") + row["mfa"] = f"{method}: {address}" + elif record.get("has_totp_secret"): + row["mfa"] = "none (TOTP secret stored)" + else: + row["mfa"] = "none" + + check: Any = None + if _is_record(checks): + check = checks.get(str(record.get("id") or "")) + elif _is_list(checks): + check = next( + ( + candidate + for candidate in checks + if _is_record(candidate) and candidate.get("test_user_id") == record.get("id") + ), + None, + ) + if _is_record(check): + status = str(check.get("status") or "unknown") + failure = str(check.get("failure_code") or "").strip() + row["verification"] = f"{status}: {failure}" if failure else status + else: + row["verification"] = "not checked" + rows.append(row) + return rows + + +def _trace_rows(records: list[dict[str, Any]]) -> list[dict[str, Any]]: + rows: list[dict[str, Any]] = [] + for record in records: + row = dict(record) + finding = record.get("finding") + if _is_record(finding): + title = str(finding.get("title") or "finding") + severity = str(finding.get("severity") or "").strip() + row["summary"] = f"{severity}: {title}" if severity else title + elif record.get("result") is not None: + row["summary"] = _trace_payload_shape("result", record["result"]) + elif record.get("args") is not None: + row["summary"] = _trace_payload_shape("arguments", record["args"]) + elif record.get("content") is not None: + row["summary"] = _trace_payload_shape("message", record["content"]) + rows.append(row) + return rows + + +def _trace_payload_shape(label: str, value: Any) -> str: + """Describe trace payload structure without leaking credentials or response bodies.""" + if _is_record(value): + return f"{label}: {len(value)} field(s)" + if _is_list(value): + return f"{label}: {len(value)} item(s)" + if value is None: + return f"{label}: empty" + text = str(value) + kind = "text" if isinstance(value, str) else type(value).__name__ + return f"{label}: {kind} ({len(text)} character(s))" + + +def _pr_finding_rows(records: list[dict[str, Any]]) -> list[dict[str, Any]]: + rows: list[dict[str, Any]] = [] + for record in records: + row = dict(record) + row["repository"] = record.get("repository_full_name") + number = record.get("pr_number") + title = str(record.get("pr_title") or "").strip() + row["pull_request"] = " ".join( + part for part in (f"#{number}" if number is not None else "", title) if part + ) + rows.append(row) + return rows + + +def _finding_location_rows(data: Any) -> list[dict[str, Any]] | None: + records = _list_of_dicts(data) + if records is None: + return None + rows: list[dict[str, Any]] = [] + for record in records: + row = dict(record) + endpoint = str(record.get("endpoint") or "").strip() + method = str(record.get("method") or "").strip().upper() + target = str(record.get("target") or "").strip() + row["location"] = f"{method} {endpoint}".strip() if endpoint else target + rows.append(row) + return rows + + +def _supply_chain_finding_rows(records: list[dict[str, Any]]) -> list[dict[str, Any]]: + rows: list[dict[str, Any]] = [] + for record in records: + row = dict(record) + name = str(record.get("package_name") or "").strip() + version = str(record.get("package_version") or "").strip() + row["package"] = f"{name}@{version}" if name and version else name or version + rows.append(row) + return rows + + +def _schedule_rows(records: list[dict[str, Any]]) -> list[dict[str, Any]]: + rows: list[dict[str, Any]] = [] + for record in records: + row = dict(record) + row["cron_expression"] = record.get("cron") or record.get("cron_expression") + row["state"] = "paused" if record.get("isPaused") else "active" + targets: list[str] = [] + if record.get("supply_chain") is True: + targets.append("supply chain") + for key, singular in (("domain_ids", "domain"), ("repository_ids", "repo")): + values = record.get(key) + if _is_list(values) and values: + noun = singular if len(values) == 1 else f"{singular}s" + targets.append(f"{len(values)} {noun}") + internal_targets = record.get("internal_targets") + if _is_list(internal_targets) and internal_targets: + first = sanitize_terminal_text(str(internal_targets[0])) + suffix = f" (+{len(internal_targets) - 1} more)" if len(internal_targets) > 1 else "" + targets.append(f"{first}{suffix}") + if record.get("connector_id"): + targets.append("network connector") + row["target"] = " · ".join(targets) if targets else "no targets" + rows.append(row) + return rows + + +def _access_rows(records: list[dict[str, Any]]) -> list[dict[str, Any]]: + rows: list[dict[str, Any]] = [] + for record in records: + row = dict(record) + row["access"] = _scope_summary(record.get("scopes")) + rows.append(row) + return rows + + +def _scope_summary(scopes: Any) -> str: + if not _is_list(scopes) or not scopes: + return "all assets" + labels: list[str] = [] + for scope in scopes[:2]: + if _is_record(scope): + scope_type = str(scope.get("type") or "scope").strip() + value = str(scope.get("value") or "").strip() + labels.append(f"{scope_type}:{value}" if value else scope_type) + else: + labels.append(str(scope)) + suffix = f" (+{len(scopes) - len(labels)} more)" if len(scopes) > len(labels) else "" + return ", ".join(labels) + suffix + + +def _credential_summary_rows(data: dict[str, Any], key: str) -> list[dict[str, Any]]: + records = _records_at_key(data, key) or [] + rows: list[dict[str, Any]] = [] + for record in records: + row = dict(record) + row["password"] = "set" if record.get("has_password") else "not set" + row["totp"] = "set" if record.get("has_totp_secret") else "not set" + rows.append(row) + return rows + + +def _print_chat_credentials(console: Console, data: dict[str, Any]) -> None: + """Render attached and attachable credential metadata without exposing secrets.""" + sections = ( + ( + "Attached credentials", + _credential_summary_rows(data, "credentials"), + "chat_credentials_attached", + None, + ), + ( + "Available saved test users", + _credential_summary_rows(data, "available_test_users"), + "chat_credentials_test_users", + "Attach one with `strix cloud chat credentials set CHAT_ID --test-user-ids ID`.", + ), + ( + "Credentials from requested scans", + _credential_summary_rows(data, "available_scan_credentials"), + "chat_credentials_scans", + ( + "Discover these with `strix cloud chat credentials CHAT_ID --scan-ids SCAN_ID`; " + "attach them with `strix cloud chat credentials set CHAT_ID --scan-ids SCAN_ID`." + ), + ), + ) + for title, rows, section_view, section_hint in sections: + console.print(f"[bold]{title}[/]") + _print_table( + console, + rows, + view=section_view, + hint=section_hint, + show_json_hint=False, + ) + console.print("[dim]Use --json for the complete credential metadata.[/]") + + +def _integration_rows(data: Any) -> list[dict[str, Any]] | None: + """Flatten the two integration collections into one compact human view.""" + if not _is_record(data): + return _list_of_dicts(data) + rows: list[dict[str, Any]] = [] + found_collection = False + for key in ("integrations", "merge_accounts"): + collection = data.get(key) + if not _is_list(collection): + continue + found_collection = True + for item in collection: + if not _is_record(item): + continue + row = dict(item) + if not row.get("account_login") and row.get("account_email"): + row["account_login"] = row["account_email"] + rows.append(row) + return rows if found_collection else None + + +def _token_rows(data: Any) -> list[dict[str, Any]] | None: + """Add an explicit lifecycle state to token rows for the human view.""" + records = _list_of_dicts(data) + if records is None: + return None + rows: list[dict[str, Any]] = [] + for record in records: + row = dict(record) + row["access"] = _scope_summary(record.get("rbac_scopes")) + if record.get("revoked_at"): + row["status"] = "revoked" + elif _timestamp_has_passed(record.get("expires_at")): + row["status"] = "expired" + else: + row["status"] = "active" + rows.append(row) + return rows + + +def _timestamp_has_passed(value: Any) -> bool: + if not isinstance(value, str) or not value.strip(): + return False + try: + parsed = datetime.fromisoformat(value.replace("Z", "+00:00")) + except ValueError: + return False + if parsed.tzinfo is None: + parsed = parsed.replace(tzinfo=UTC) + return parsed <= datetime.now(UTC) + + +def _scan_rows(data: Any) -> list[dict[str, Any]] | None: + """Flatten the nested target and finding summaries returned by scan lists.""" + records = _list_of_dicts(data) + if records is None: + return None + rows: list[dict[str, Any]] = [] + for record in records: + row = dict(record) + if not row.get("title") and row.get("name"): + row["title"] = row["name"] + if not row.get("id") and isinstance(row.get("scan_id"), str): + row["id"] = row["scan_id"] + + targets = _scan_targets(record) + if targets: + visible_targets = targets[:2] + summary = " | ".join(visible_targets) + if len(targets) > len(visible_targets): + summary += f" (+{len(targets) - len(visible_targets)} more)" + row["target"] = summary + + findings = record.get("findings") + if _is_record(findings) and findings.get("total") is not None: + row["findings_count"] = findings["total"] + rows.append(row) + return rows + + +def _scan_targets(record: dict[str, Any]) -> list[str]: + targets: list[str] = [] + urls = record.get("urls") + if _is_list(urls): + targets.extend(url.strip() for url in urls if isinstance(url, str) and url.strip()) + repositories = record.get("repositories") + if _is_list(repositories): + for repository in repositories: + if not _is_record(repository): + continue + identifier = str( + repository.get("full_name") or repository.get("name") or repository.get("url") or "" + ).strip() + branch = str(repository.get("branch") or "").strip() + if identifier: + targets.append(f"{identifier} @ {branch}" if branch else identifier) + internal_targets = record.get("internal_targets") + if _is_list(internal_targets): + targets.extend( + target.strip() + for target in internal_targets + if isinstance(target, str) and target.strip() + ) + if record.get("has_code_upload") is True: + targets.append("uploaded source") + return targets + + +def _pr_review_rows(data: Any) -> list[dict[str, Any]] | None: + """Collapse related PR fields into an eight-column, action-oriented human view.""" + records = _list_of_dicts(data) + if records is None: + return None + rows: list[dict[str, Any]] = [] + for record in records: + row = dict(record) + number = record.get("pr_number") + title = str(record.get("pr_title") or "").strip() + row["repository"] = record.get("repository_full_name") or record.get("repository") + pull_request = " ".join( + part for part in (f"#{number}" if number is not None else "", title) if part + ) + pr_state = str(record.get("pr_state") or "").strip() + row["pull_request"] = f"{pull_request} [{pr_state}]" if pr_state else pull_request + head = str(record.get("head_branch") or "").strip() + base = str(record.get("base_branch") or "").strip() + row["branches"] = f"{head} → {base}" if head and base else head or base + findings = record.get("findings") + total = findings.get("total") if _is_record(findings) else None + unresolved = findings.get("unresolved") if _is_record(findings) else None + opened = unresolved.get("total") if _is_record(unresolved) else None + if not isinstance(total, int): + total = record.get("findings_count") + if not isinstance(opened, int): + opened = record.get("open_findings_count") + if isinstance(total, int) and isinstance(opened, int): + row["findings"] = f"{opened} open / {total} total" + elif isinstance(total, int): + row["findings"] = total + rows.append(row) + return rows + + +def _vulnerability_history_rows(records: list[dict[str, Any]]) -> list[dict[str, Any]]: + rows: list[dict[str, Any]] = [] + for record in records: + row = dict(record) + previous = record.get("previous_snoozed_until") + current = record.get("new_snoozed_until") + if previous != current: + if previous and current: + row["snooze"] = f"{previous} → {current}" + elif current: + row["snooze"] = f"set until {current}" + else: + row["snooze"] = f"cleared (was {previous})" + rows.append(row) + return rows + + +def _print_table( + console: Console, + rows: list[dict[str, Any]], + *, + row_numbers: bool = False, + omit_columns: frozenset[str] = frozenset(), + hint: str | None = None, + view: str | None = None, + show_json_hint: bool = True, +) -> None: + if not rows: + console.print("[dim]No items.[/]") + if hint: + console.print(f"[dim]{escape(sanitize_terminal_text(hint))}[/]") + return + integration_view = view == "GET /integrations" + visible_internal: set[str] = {"installation_id"} if integration_view else set() + view_omissions: set[str] = {"id"} if integration_view else set() + omit_columns = omit_columns | (_INTERNAL_COLUMNS - visible_internal) | view_omissions + preferred = _VIEW_COLUMNS.get(view or "", _PREFERRED_KEYS) + columns: list[str] = [ + key + for key in preferred + if key not in omit_columns and any(_meaningful(row.get(key)) for row in rows) + ] + if view not in _VIEW_COLUMNS: + _append_fallback_columns(rows, columns, omit_columns) + columns = columns[:_MAX_TABLE_COLUMNS] + if console.width < _NARROW_TABLE_WIDTH: + _print_cards(console, rows, columns, row_numbers=row_numbers) + _print_copyable_selectors(console, rows, columns) + footer = f"{len(rows)} item(s)." + if show_json_hint: + footer += " Use --json for the full records." + console.print(f"[dim]{footer}[/]") + if hint: + console.print(f"[dim]{escape(sanitize_terminal_text(hint))}[/]") + return + table = Table(show_lines=False) + if row_numbers: + table.add_column("#", justify="right", style="cyan", no_wrap=True) + for column in columns: + table.add_column( + escape(_human_label(column)), + no_wrap=_selector_can_no_wrap(column, rows), + ) + for index, row in enumerate(rows, start=1): + cells = [escape(_cell(row.get(column))) for column in columns] + if row_numbers: + cells.insert(0, str(index)) + table.add_row(*cells) + console.print(table) + _print_copyable_selectors(console, rows, columns) + footer = f"{len(rows)} item(s)." + if show_json_hint: + footer += " Use --json for the full records." + console.print(f"[dim]{footer}[/]") + if hint: + console.print(f"[dim]{escape(sanitize_terminal_text(hint))}[/]") + + +def _print_cards( + console: Console, + rows: list[dict[str, Any]], + columns: list[str], + *, + row_numbers: bool, +) -> None: + """Render list rows legibly when a terminal is too narrow for a table.""" + for index, row in enumerate(rows, start=1): + parts = [ + f"[bold]{escape(_human_label(column))}:[/] {escape(_cell(row.get(column)))}" + for column in columns + if row.get(column) is not None + ] + prefix = f"[cyan]{index}.[/] " if row_numbers else "[cyan]•[/] " + if not parts: + console.print(prefix.rstrip()) + continue + console.print(prefix + parts[0], soft_wrap=True) + continuation = " " if row_numbers else " " + for part in parts[1:]: + console.print(continuation + part, soft_wrap=True) + + +def _append_fallback_columns( + rows: list[dict[str, Any]], + columns: list[str], + omit_columns: frozenset[str], +) -> None: + for row in rows: + for key in row: + if ( + key not in columns + and key not in omit_columns + and len(columns) < _MAX_TABLE_COLUMNS + and not isinstance(row[key], dict | list) + ): + columns.append(key) + + +def _meaningful(value: Any) -> bool: + return value is not None and value not in ("", [], {}) + + +def _is_selector_column(column: str) -> bool: + return column in _COPYABLE_SELECTOR_COLUMNS + + +def _selector_can_no_wrap(column: str, rows: list[dict[str, Any]]) -> bool: + return _is_selector_column(column) and all( + len(str(row[column])) <= _SELECTOR_NO_WRAP_MAX + for row in rows + if row.get(column) is not None + ) + + +def _print_copyable_selectors( + console: Console, + rows: list[dict[str, Any]], + columns: list[str], +) -> None: + """Print command selectors losslessly when their compact cell is shortened.""" + selector_columns = [column for column in columns if _is_selector_column(column)] + selectors = [ + (index, row, column, str(row[column])) + for index, row in enumerate(rows, start=1) + for column in selector_columns + if row.get(column) is not None and len(str(row[column])) > _SELECTOR_NO_WRAP_MAX + ] + if not selectors: + return + console.print("[dim]Copyable selectors:[/]") + for index, row, column, value in selectors: + label = next( + ( + str(row[key]) + for key in ("title", "name", "label", "domain", "full_name") + if row.get(key) + ), + f"item {index}", + ) + console.print( + f" {index}. {sanitize_terminal_text(label)} ({_human_label(column)}): " + f"{sanitize_terminal_text(value)}", + markup=False, + soft_wrap=True, + ) + + +def _print_detail(console: Console, data: dict[str, Any]) -> None: + """Render one API record as a readable field/value view.""" + keys = [key for key in _DETAIL_PRIORITY_KEYS if key in data and key not in _INTERNAL_COLUMNS] + keys.extend( + key + for key in _PREFERRED_KEYS + if key in data and key not in keys and key not in _INTERNAL_COLUMNS + ) + keys.extend(key for key in data if key not in keys and key not in _INTERNAL_COLUMNS) + table = Table(show_header=False, show_edge=False, box=None, padding=(0, 2)) + table.add_column("field", style="bold cyan", no_wrap=True) + table.add_column("value", overflow="fold") + populated_keys = [key for key in keys if data.get(key) is not None] + visible_keys = populated_keys[:_MAX_DETAIL_FIELDS] + lossless_fields: list[tuple[str, Any]] = [] + for key in visible_keys: + value = data.get(key) + if _is_lossless_detail(key, value): + lossless_fields.append((key, value)) + continue + rendered = ( + _nested_summary(value) if _is_record(value) or _is_list(value) else _detail_cell(value) + ) + table.add_row(escape(_human_label(key)), escape(rendered)) + if table.row_count: + console.print(table) + for key, value in lossless_fields: + console.print(f"{_human_label(key)}:", style="bold cyan", markup=False) + console.print(_lossless_detail_value(value), markup=False, soft_wrap=True) + if len(populated_keys) > len(visible_keys): + console.print( + f"[dim]{len(populated_keys) - len(visible_keys)} additional field(s) omitted from " + "this view.[/]" + ) + console.print("[dim]Use --json for the lossless machine-readable record.[/]") + + +def _is_lossless_detail(key: str, value: Any) -> bool: + """Keep one-time credentials and enrollment commands complete and copyable.""" + sensitive_key = key in _LOSSLESS_DETAIL_KEYS or key.endswith(("_token", "_secret")) + return sensitive_key and not _is_record(value) and not _is_list(value) + + +def _lossless_detail_value(value: Any) -> str: + """Preserve structural newlines while making every other control byte visible.""" + return "\n".join(sanitize_terminal_text(line) for line in str(value).split("\n")) + + +def _nested_summary(value: dict[str, Any] | list[Any]) -> str: + """Bound nested records so one detail response cannot flood a terminal.""" + if _is_record(value): + scalar_items = [ + (nested_key, nested_value) + for nested_key, nested_value in value.items() + if not isinstance(nested_value, dict | list) and nested_value is not None + ] + lines = [ + f"{_human_label(str(nested_key))}: {_cell(nested_value)}" + for nested_key, nested_value in scalar_items[:_MAX_NESTED_PREVIEW] + ] + omitted = len(value) - len(lines) + if omitted > 0: + lines.append(f"… {omitted} more field(s)") + return "\n".join(lines) if lines else f"{len(value)} nested field(s)" + if not _is_list(value): + return "none" + if not value: + return "none" + if all(not isinstance(item, dict | list) for item in value): + preview = ", ".join(_cell(item) for item in value[:12]) + if len(value) > 12: + preview += f", … {len(value) - 12} more" + return preview + records = [item for item in value if _is_record(item)] + lines = [f"{len(value)} item(s)"] + for record in records[:_MAX_NESTED_PREVIEW]: + label = record.get("title") or record.get("name") or record.get("message") + severity = record.get("severity") + status = record.get("status") or record.get("state") + prefix = " / ".join(_cell(part) for part in (severity, status) if part) + summary = str(label or record.get("id") or "record") + lines.append(f"- {prefix + ': ' if prefix else ''}{_cell(summary)}") + if len(value) > len(records[:_MAX_NESTED_PREVIEW]): + lines.append(f"… {len(value) - len(records[:_MAX_NESTED_PREVIEW])} more; use --json") + return "\n".join(lines) + + +def _print_source_manifest(console: Console, data: dict[str, Any]) -> None: + source = data.get("source") + manifest = source if _is_record(source) else data + files = manifest.get("files") + summary = {key: value for key, value in manifest.items() if key != "files"} + _print_detail(console, summary) + if _is_list(files): + console.print(f"\n[bold]Selected files ({len(files):,})[/]") + for path in files: + console.print(f" {escape(sanitize_terminal_text(path))}", soft_wrap=True) + + +def _print_supply_chain_summary(console: Console, data: dict[str, Any]) -> None: + """Render organization totals and one actionable row per repository.""" + totals = data.get("totals") + console.print("[bold]Supply-chain totals[/]") + _print_table( + console, + [dict(totals)] if _is_record(totals) else [], + view="supply_chain_totals", + show_json_hint=False, + ) + + console.print("[bold]Repositories[/]") + _print_table( + console, + _supply_chain_repository_rows(data), + view="supply_chain_repositories", + hint="Inspect one repository with `strix cloud repos supply-chain summary ID`.", + show_json_hint=False, + ) + console.print("[dim]Use --json for complete totals and repository records.[/]") + + +def _supply_chain_repository_rows(data: dict[str, Any]) -> list[dict[str, Any]]: + entries = data.get("repositories") + if not _is_list(entries): + return [] + rows: list[dict[str, Any]] = [] + for entry in entries: + if not _is_record(entry): + continue + repository = entry.get("repository") + summary = entry.get("summary") + if not _is_record(repository) or not _is_record(summary): + continue + row: dict[str, Any] = { + "repository": repository.get("full_name") or repository.get("name"), + "components": summary.get("component_count", 0), + "findings": summary.get("finding_count", 0), + "severity": _supply_chain_severity_summary(summary.get("severity_counts")), + "risks": _supply_chain_risk_summary(summary), + "latest_scan": _supply_chain_scan_summary(entry.get("latest_supply_chain_scan")), + "policy": _supply_chain_policy_summary(summary.get("policy")), + "id": repository.get("id"), + } + rows.append(row) + return rows + + +def _supply_chain_risk_summary(summary: dict[str, Any]) -> str: + return " · ".join( + ( + f"{summary.get('malicious_count', 0)} malicious", + f"{summary.get('suspicious_count', 0)} suspicious", + f"{summary.get('vulnerable_count', 0)} vulnerable", + ) + ) + + +def _supply_chain_severity_summary(value: Any) -> str: + if not _is_record(value): + return "none" + ordered = ("critical", "high", "medium", "low", "info", "unknown") + counts = [f"{key} {value[key]}" for key in ordered if isinstance(value.get(key), int)] + return " · ".join(counts) if counts else "none" + + +def _supply_chain_scan_summary(value: Any) -> str: + if not _is_record(value): + return "not run" + status = str(value.get("status") or "unknown") + created_at = str(value.get("created_at") or "").strip() + return f"{status} · {created_at}" if created_at else status + + +def _supply_chain_policy_summary(value: Any) -> str: + if not _is_record(value): + return "unknown" + if value.get("enabled") is False: + return "disabled" + mode = str(value.get("mode") or "monitor") + if value.get("pr_checks_enabled") is False: + return f"{mode} · PR checks off" + return mode + + +def _print_analytics(console: Console, data: dict[str, Any]) -> None: + rows = list(_flatten_summary(data)) + table = Table(show_header=False, show_edge=False, box=None, padding=(0, 2)) + table.add_column("metric", style="bold cyan") + table.add_column("value", overflow="fold") + for label, value in rows[:_MAX_DETAIL_FIELDS]: + table.add_row(escape(label), escape(value)) + console.print(table) + if len(rows) > _MAX_DETAIL_FIELDS: + console.print( + f"[dim]Showing {_MAX_DETAIL_FIELDS} of {len(rows)} summary metrics. " + "Use --json for all data.[/]" + ) + else: + console.print("[dim]Use --json for the complete analytics record.[/]") + + +def _flatten_summary(value: Any, prefix: str = "", depth: int = 0) -> Iterable[tuple[str, str]]: + if _is_record(value) and depth < 4: + for key, nested in value.items(): + label = f"{prefix} / {_human_label(key)}" if prefix else _human_label(key) + yield from _flatten_summary(nested, label, depth + 1) + return + if _is_list(value): + if all(not isinstance(item, dict | list) for item in value): + yield prefix, _nested_summary(value) + else: + yield prefix, f"{len(value)} data point(s)" + return + yield prefix or "value", _cell(value) + + +def _print_scan_frequency(console: Console, data: Any) -> None: + rows = _find_record_series(data) + if rows is None: + if _is_record(data): + _print_analytics(console, data) + else: + console.print_json(json.dumps(data, default=str)) + return + nonzero = [row for row in rows if _row_has_activity(row)] + selected = (nonzero[-30:] if nonzero else rows[-14:]) if rows else [] + _print_table(console, selected, view="GET /analytics/scan-frequency") + if rows: + qualifier = "non-zero" if nonzero else "most recent" + console.print( + f"[dim]Showing {len(selected)} {qualifier} point(s) from {len(rows)} total. " + "Use --json for the full series.[/]" + ) + + +def _find_record_series(data: Any) -> list[dict[str, Any]] | None: + direct = _list_of_dicts(data) + if direct is not None: + return direct + if _is_record(data): + candidates = [ + series for value in data.values() if (series := _find_record_series(value)) is not None + ] + if candidates: + return max(candidates, key=len) + return None + + +def _row_has_activity(row: dict[str, Any]) -> bool: + count_keys = ("count", "scans", "scan_count", "total", "value") + return any(isinstance(row.get(key), int | float) and row[key] > 0 for key in count_keys) + + +def _human_label(column: str) -> str: + column = sanitize_terminal_text(column) + if column == "secret_prefix": + return "prefix" + labels = { + "repository_full_name": "repo", + "pr_number": "PR", + "pr_title": "title", + "head_branch": "head", + "base_branch": "base", + "findings_count": "findings", + "open_findings_count": "open", + "display_number": "finding", + "created_at": "created", + "updated_at": "updated", + "expires_at": "expires", + "last_used_at": "last used", + } + return labels.get(column, _CAMEL_BOUNDARY.sub(" ", column).replace("_", " ").lower()) + + +def _cell(value: Any) -> str: + if value is None: + return "" + if isinstance(value, bool): + return "yes" if value else "no" + if _is_list(value) and all(not _is_record(item) and not _is_list(item) for item in value): + text = ", ".join(str(item) for item in value) + elif _is_record(value) or _is_list(value): + text = f"{len(value)} item(s)" + else: + text = str(value) + text = sanitize_terminal_text(text) + if len(text) > _MAX_CELL_LENGTH: + return text[: _MAX_CELL_LENGTH - 1] + "…" + return text + + +def _detail_cell(value: Any) -> str: + """Keep prose useful in a detail view while bounding hostile responses.""" + if value is None: + return "" + if isinstance(value, bool): + return "yes" if value else "no" + text = "\n".join(sanitize_terminal_text(line) for line in str(value).split("\n")) + if len(text) > _MAX_DETAIL_CELL_LENGTH: + suffix = "… [truncated; use --json]" + return text[: _MAX_DETAIL_CELL_LENGTH - len(suffix)] + suffix + return text diff --git a/strix/interface/cloud/runner.py b/strix/interface/cloud/runner.py new file mode 100644 index 000000000..f35cc4366 --- /dev/null +++ b/strix/interface/cloud/runner.py @@ -0,0 +1,1132 @@ +"""Generic command runner for `strix cloud`. + +The runner turns one entry of the command table into an argument parser, +sends the HTTP request, renders the result, and returns the exit code. +""" + +from __future__ import annotations + +import argparse +import json +import math +import os +import re +import sys +import tempfile +import time +import webbrowser +from contextlib import suppress +from pathlib import Path +from typing import TYPE_CHECKING, Any, cast +from urllib.parse import quote +from uuid import uuid4 + +import requests +from rich.console import Console +from rich.markup import escape + +import strix.interface.cloud.http as http # noqa: PLR0402 +from strix.interface.cloud.arguments import CloudArgumentParser +from strix.interface.cloud.billing import run_topup +from strix.interface.cloud.render import emit, json_mode +from strix.interface.cloud.source_scan import LocalSourceScan +from strix.interface.cloud.spec import DEFAULT_VERBS, SPEC, Cmd, P +from strix.interface.terminal_text import sanitize_terminal_text +from strix.interface.url_safety import is_safe_web_url + + +if TYPE_CHECKING: + from collections.abc import Iterator + + +_PLACEHOLDER = re.compile(r"\{([^{}]+)\}") +_CAMEL_BOUNDARY = re.compile(r"(?<=[a-z0-9])(?=[A-Z])") +_WAIT_POLL_S = 15 +_DEFAULT_WAIT_TIMEOUT_S = 4 * 60 * 60 +_TERMINAL_STATUSES = frozenset( + { + "completed", + "failed", + "cancelled", + "canceled", + "stopped", + "error", + "expired", + "succeeded", + } +) +_DEFINITIVE_SCAN_REJECTION_STATUSES = frozenset({400, 401, 402, 403, 404, 409, 413, 415, 422}) +_IDEMPOTENCY_KEY = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:/=-]{0,199}$") +_IDEMPOTENCY_RETRY_DELAYS_S = (0.25, 1.0) +_RETRYABLE_IDEMPOTENCY_CODES = frozenset( + {"idempotency_request_in_progress", "idempotency_outcome_unknown"} +) + + +def _dest(name: str) -> str: + return _CAMEL_BOUNDARY.sub("_", name).lower() + + +def _metavar(name: str) -> str: + return _CAMEL_BOUNDARY.sub("_", name).upper() + + +def _positive_seconds(value: str) -> float: + try: + parsed = float(value) + except ValueError as exc: + raise argparse.ArgumentTypeError("must be a number greater than 0") from exc + if not math.isfinite(parsed) or parsed <= 0: + raise argparse.ArgumentTypeError("must be a finite number greater than 0") + return parsed + + +def _resolve_idempotency_key(cmd: Cmd, args: argparse.Namespace) -> str | None: + if not cmd.idempotent: + return None + supplied = getattr(args, "idempotency_key", None) + key = supplied if isinstance(supplied, str) else str(uuid4()) + if not _IDEMPOTENCY_KEY.fullmatch(key): + raise http.CloudError( + "--idempotency-key must be 1-200 characters, start with a letter or digit, and " + "contain only letters, digits, '.', '_', ':', '/', '=', or '-'.", + exit_code=http.EXIT_USAGE, + ) + return key + + +def _audit_export_format(cmd: Cmd, query: dict[str, Any]) -> str | None: + if cmd.method != "GET" or cmd.path != "/audit": + return None + value = query.get("format") + if not isinstance(value, str): + return None + normalized = value.strip().lower() + return normalized if normalized in {"csv", "ndjson", "jsonl", "snowflake", "splunk"} else None + + +def _contains_response_key(value: Any, keys: frozenset[str], *, depth: int = 0) -> bool: + if depth > 2: + return False + if isinstance(value, dict): + fields = cast("dict[str, Any]", value) + if any(key in fields and fields[key] not in (None, "") for key in keys): + return True + return any(_contains_response_key(item, keys, depth=depth + 1) for item in fields.values()) + return False + + +def _one_time_secret_warning(cmd: Cmd, args: argparse.Namespace, result: Any) -> str | None: + if ( + cmd.method == "POST" + and cmd.path == "/tokens" + and _contains_response_key(result, frozenset({"token", "api_token", "secret"})) + ): + return "This API token is shown only once. Store it securely before leaving this output." + if cmd.path.startswith("/webhooks") and _contains_response_key( + result, frozenset({"secret", "signing_secret", "webhook_secret"}) + ): + return ( + "This webhook signing secret is shown only once. Store it securely before leaving " + "this output." + ) + connector_command_requested = cmd.method == "POST" or bool( + getattr(args, "include_command", False) + ) + if ( + cmd.path.startswith("/connectors") + and connector_command_requested + and _contains_response_key( + result, frozenset({"command", "enrollment_command", "docker_command", "token"}) + ) + ): + return ( + "This connector enrollment command contains one-time credentials. Store it securely " + "and do not share it." + ) + return None + + +def resolve(group: str, tokens: list[str]) -> tuple[Cmd, list[str]] | None: + """Find the command for a verb. Two-word verbs match before one-word verbs.""" + commands = SPEC.get(group) + if commands is None: + return None + if len(tokens) >= 2: + two = f"{tokens[0]} {tokens[1]}" + if two in commands: + return commands[two], tokens[2:] + if tokens and tokens[0] in commands: + return commands[tokens[0]], tokens[1:] + default = DEFAULT_VERBS.get(group) + if default is not None and (not tokens or tokens[0].startswith("-")): + return commands[default], tokens + return None + + +def run(group: str, verb_label: str, cmd: Cmd, argv: list[str]) -> int: + console = Console() + parser = _build_parser(group, verb_label, cmd) + as_json = json_mode(flag="--json" in argv) + raw_binary_stdout = _argv_uses_raw_binary_stdout(cmd, argv) + try: + args = parser.parse_args(argv) + except KeyboardInterrupt: + _emit_interrupted(console, as_json=as_json, to_stderr=raw_binary_stdout) + return 130 + except http.CloudError as exc: + _emit_error( + console, + exc, + as_json=as_json and not raw_binary_stdout, + to_stderr=raw_binary_stdout, + ) + return exc.exit_code + except SystemExit as exc: + return exc.code if isinstance(exc.code, int) else 2 + + path = cmd.path + for name in _PLACEHOLDER.findall(cmd.path): + value = quote(str(getattr(args, _dest(name))), safe="") + path = path.replace("{" + name + "}", value) + + as_json = json_mode(flag=bool(getattr(args, "json", False))) + raw_binary_stdout = _uses_raw_binary_stdout(cmd, args) + token = getattr(args, "token", None) + try: + http.configure( + base_url=getattr(args, "app_url", None), + timeout=getattr(args, "timeout", None), + token_override=bool(token), + workspace_id=getattr(args, "workspace_id", None), + ) + query = _collect(args, cmd.query) + body = _collect(args, cmd.body) + data = getattr(args, "data", None) + if data: + _merge_extra_body(body, _load_data(data)) + _validate_body(cmd, body) + if getattr(args, "no_monthly_cap", False): + body["monthly_cap_credits"] = None + return _execute(console, cmd, args, path, query, body, as_json=as_json, token=token) + except KeyboardInterrupt: + _emit_interrupted(console, as_json=as_json, to_stderr=raw_binary_stdout) + return 130 + except http.CloudError as exc: + _emit_error( + console, + exc, + as_json=as_json and not raw_binary_stdout, + to_stderr=raw_binary_stdout, + ) + return exc.exit_code + + +def _uses_raw_binary_stdout(cmd: Cmd, args: argparse.Namespace) -> bool: + if bool(getattr(args, "json", False)) or getattr(args, "output", None): + return False + format_value = str(getattr(args, "format", "") or "").strip().lower() + audit_export = ( + cmd.method == "GET" + and cmd.path == "/audit" + and format_value + in { + "csv", + "ndjson", + "jsonl", + "snowflake", + "splunk", + } + ) + return not sys.stdout.isatty() and bool(cmd.binary or audit_export) + + +def _argv_uses_raw_binary_stdout(cmd: Cmd, argv: list[str]) -> bool: + """Choose the error channel before argparse can reject a binary command.""" + if "--json" in argv or any(arg.startswith("--json=") for arg in argv): + return False + has_output = any( + (arg.startswith("--output=") and bool(arg.partition("=")[2])) + or (arg == "--output" and index + 1 < len(argv) and not argv[index + 1].startswith("-")) + for index, arg in enumerate(argv) + ) + if has_output: + return False + format_value = "" + for index, arg in enumerate(argv): + if arg.startswith("--format="): + format_value = arg.partition("=")[2] + elif arg == "--format" and index + 1 < len(argv): + format_value = argv[index + 1] + audit_export = ( + cmd.method == "GET" + and cmd.path == "/audit" + and format_value.lower() + in { + "csv", + "ndjson", + "jsonl", + "snowflake", + "splunk", + } + ) + return not sys.stdout.isatty() and bool(cmd.binary or audit_export) + + +def _request_with_idempotency( + cmd: Cmd, + path: str, + *, + token: str | None, + query: dict[str, Any], + body: dict[str, Any], + stream: bool, + idempotency_key: str | None, +) -> requests.Response: + """Retry only exact, caller-keyed mutations whose outcome may be ambiguous.""" + attempts = 1 + (len(_IDEMPOTENCY_RETRY_DELAYS_S) if idempotency_key else 0) + for attempt in range(attempts): + try: + response = http.request( + cmd.method, + path, + token=token, + query=query or None, + body=body if cmd.method in ("POST", "PUT", "PATCH") else None, + stream=stream, + idempotency_key=idempotency_key, + ) + except http.CloudTransportError: + if attempt + 1 >= attempts: + raise + else: + if attempt + 1 >= attempts or not _idempotency_response_is_retryable(response): + return response + response.close() + time.sleep(_IDEMPOTENCY_RETRY_DELAYS_S[attempt]) + raise AssertionError("idempotent request retry loop exhausted without returning") + + +def _idempotency_response_is_retryable(response: requests.Response) -> bool: + if 500 <= response.status_code < 600 or response.status_code == 429: + return True + if response.status_code != 409: + return False + payload = http.parsed(response) + if not isinstance(payload, dict): + return False + fields = cast("dict[str, Any]", payload) + return fields.get("retry_safe") is True or fields.get("code") in _RETRYABLE_IDEMPOTENCY_CODES + + +def _scan_rejection_is_definitive(response: requests.Response) -> bool: + payload = http.parsed(response) + if isinstance(payload, dict): + fields = cast("dict[str, Any]", payload) + if fields.get("retry_safe") is True: + return False + if fields.get("terminal") is True: + return True + return response.status_code in _DEFINITIVE_SCAN_REJECTION_STATUSES + + +def _execute( # noqa: PLR0912, PLR0915 + console: Console, + cmd: Cmd, + args: argparse.Namespace, + path: str, + query: dict[str, Any], + body: dict[str, Any], + *, + as_json: bool, + token: str | None, +) -> int: + if cmd.path == "/billing/topup": + return run_topup(console, args, body, as_json=as_json, token=token) + audit_export = _audit_export_format(cmd, query) + output_path = getattr(args, "output", None) + explicit_json = bool(getattr(args, "json", False)) + binary_response = bool(cmd.binary or audit_export) + if binary_response and explicit_json and not output_path: + raise http.CloudError( + "--json for a binary response requires --output FILE; omit --json only when " + "intentionally redirecting the raw bytes.", + exit_code=http.EXIT_USAGE, + ) + binary_json_metadata = explicit_json or bool(output_path and not sys.stdout.isatty()) + if cmd.path == "/audit" and getattr(args, "output", None) and not audit_export: + raise http.CloudError( + "--output requires --format csv, ndjson, jsonl, snowflake, or splunk.", + exit_code=http.EXIT_USAGE, + ) + idempotency_key = _resolve_idempotency_key(cmd, args) + source_workflow = LocalSourceScan(idempotency_key=idempotency_key) + scan_request_started = False + try: + if cmd.path == "/scans" and cmd.method == "POST": + _set_default_scan_engagement( + body, + has_local_source=getattr(args, "source", None) is not None, + ) + if source_workflow.prepare_and_attach( + console, + args, + body, + as_json=as_json, + token=token, + ): + return http.EXIT_OK + + source_workflow.mark_launch_started() + # Every wait-path mutation creates a scan, even when the endpoint has + # not yet adopted idempotency keys (for example vulnerability retests). + # Once sent, transport and malformed-success failures are ambiguous. + scan_request_started = cmd.idempotent or cmd.wait_path is not None + response = _request_with_idempotency( + cmd, + path, + token=token, + query=query, + body=body, + stream=bool(cmd.binary or audit_export), + idempotency_key=idempotency_key, + ) + except BaseException as exc: + source_workflow.handle_request_failure(exc, token=token) + if scan_request_started: + if isinstance(exc, KeyboardInterrupt): + raise _interrupted_scan_launch_error(idempotency_key) from None + if isinstance(exc, Exception): + raise _ambiguous_scan_launch_error(exc, idempotency_key) from exc + raise + finally: + source_workflow.close() + if audit_export: + return _emit_binary( + console, + response, + output_path, + force=bool(getattr(args, "force", False)), + json_metadata=binary_json_metadata, + ) + if cmd.binary: + return _emit_binary( + console, + response, + output_path, + force=bool(getattr(args, "force", False)), + json_metadata=binary_json_metadata, + ) + try: + result = _validated_operation_result(http.check(response), cmd) + except BaseException as exc: + source_workflow.handle_response_failure( + exc, + definitive=_scan_rejection_is_definitive(response), + token=token, + ) + if ( + source_workflow.upload_id is None + and scan_request_started + and not _scan_rejection_is_definitive(response) + and isinstance(exc, Exception) + ): + raise _ambiguous_scan_launch_error(exc, idempotency_key) from exc + raise + if getattr(args, "wait", False): + wait_timeout = cast("float", getattr(args, "wait_timeout", _DEFAULT_WAIT_TIMEOUT_S)) + try: + if cmd.wait_self: + result = _poll( + console, + path, + token=token, + as_json=as_json, + wait_timeout=wait_timeout, + ) + elif cmd.wait_path: + result = _wait( + console, + cmd, + result, + token=token, + as_json=as_json, + wait_timeout=wait_timeout, + ) + except KeyboardInterrupt: + raise _wait_status_error(result, interrupted=True) from None + except http.CloudError as exc: + raise _wait_status_error(result, error=exc) from exc + result = source_workflow.wrap_result(result, args) + if cmd.link: + return _handoff_link(console, cmd, args, result, as_json=as_json) + workspace_list = cmd.method == "GET" and cmd.path == "/workspaces" + integration_list = cmd.method == "GET" and cmd.path == "/integrations" + emit( + console, + result, + as_json=as_json, + row_numbers=workspace_list or integration_list, + omit_columns=frozenset({"id"}) if workspace_list else frozenset(), + hint=( + "Switch with `strix cloud workspaces use NUMBER`." + if workspace_list + else ( + "For Git providers, disconnect with `strix cloud integrations disconnect " + "PROVIDER --installation-id INSTALLATION_ID`; omit the ID for Slack." + if integration_list + else None + ) + ), + view=f"{cmd.method} {cmd.path}", + warning=_one_time_secret_warning(cmd, args, result), + ) + return http.EXIT_OK + + +def _set_default_scan_engagement(body: dict[str, Any], *, has_local_source: bool = False) -> None: + """Infer the scan type from its targets when the caller did not choose one.""" + if body.get("engagement_type"): + return + if body.get("internal_targets"): + body["engagement_type"] = "internal_infra" + elif body.get("domain_ids"): + body["engagement_type"] = "live_test" + elif has_local_source or body.get("repository_ids") or body.get("upload_ids"): + body["engagement_type"] = "code_review" + + +def _validate_body(cmd: Cmd, body: dict[str, Any]) -> None: + missing = [ + "--" + (param.flag or param.name.replace("_", "-")) + for param in cmd.body + if param.required and body.get(param.name) is None + ] + if missing: + raise http.CloudError( + "missing required request field(s): " + + ", ".join(missing) + + ". Supply them as options or with --data @file/-.", + exit_code=http.EXIT_USAGE, + ) + if ( + cmd.method == "POST" + and cmd.path == "/tokens" + and body.get("expires_at") is not None + and body.get("expires_in_days") is not None + ): + raise http.CloudError( + "--expires-at and --expires-in-days are mutually exclusive.", + exit_code=http.EXIT_USAGE, + ) + + +def _handoff_link( + console: Console, cmd: Cmd, args: argparse.Namespace, result: Any, *, as_json: bool +) -> int: + """Print a hosted URL a person must open, and open the browser when interactive.""" + fields = cast("dict[str, Any]", result) if isinstance(result, dict) else {} + url = fields.get(cmd.link) if cmd.link else None + if not isinstance(url, str) or not url: + raise http.CloudError( + f"the platform response did not include the expected {cmd.link or 'continuation'} URL." + ) + if not is_safe_web_url(url, trusted_origin=http.app_url()): + raise http.CloudError("the platform returned an invalid continuation URL.") + interactive = ( + not as_json + and sys.stdin.isatty() + and sys.stdout.isatty() + and not getattr(args, "no_browser", False) + ) + if as_json: + emit(console, result, as_json=True) + else: + console.print("Open this URL to continue:") + console.print(f" {sanitize_terminal_text(url)}", markup=False, soft_wrap=True) + if interactive: + webbrowser.open(url) + return http.EXIT_OK + + +def _load_data(value: str) -> dict[str, Any]: + """Read a JSON object from a literal string, a `@file` path, or `-` for stdin.""" + if value == "-": + text = sys.stdin.read() + elif value.startswith("@"): + path = Path(value[1:]).expanduser() + try: + text = path.read_text(encoding="utf-8") + except OSError as exc: + raise http.CloudError(f"could not read {path}: {exc}") from exc + else: + text = value + try: + parsed_value = json.loads(text) + except ValueError as exc: + raise http.CloudError("--data must be a JSON object.", exit_code=http.EXIT_USAGE) from exc + if not isinstance(parsed_value, dict): + raise http.CloudError("--data must be a JSON object.", exit_code=http.EXIT_USAGE) + return cast("dict[str, Any]", parsed_value) + + +def _merge_extra_body(body: dict[str, Any], extra_body: dict[str, Any]) -> None: + collisions = sorted(body.keys() & extra_body.keys()) + if collisions: + flags = ", ".join(f"--{name.replace('_', '-')}" for name in collisions) + raise http.CloudError( + f"--data cannot override explicit option(s): {flags}", + exit_code=http.EXIT_USAGE, + ) + body.update(extra_body) + + +def _build_parser(group: str, verb_label: str, cmd: Cmd) -> argparse.ArgumentParser: + parser = CloudArgumentParser(prog=f"strix cloud {group} {verb_label}", description=cmd.help) + for name in _PLACEHOLDER.findall(cmd.path): + parser.add_argument(_dest(name), metavar=_metavar(name)) + for param in cmd.query: + _add_option(parser, param, required=param.required) + for param in cmd.body: + # Required body fields may be supplied securely through --data @file/-; + # validate them only after the two body sources are merged. + _add_option(parser, param, required=False) + json_help = "Print the raw JSON response." + if cmd.binary: + json_help = "With --output, print structured download metadata as JSON." + elif cmd.path == "/audit": + json_help = "Print JSON results, or download metadata when exporting with --output." + parser.add_argument("--json", action="store_true", help=json_help) + parser.add_argument("--token", default=None, help="API token override.") + parser.add_argument( + "--workspace-id", + default=None, + metavar="ORG_ID", + help="Expected workspace for an override CLI token (or STRIX_WORKSPACE_ID).", + ) + parser.add_argument("--app-url", default=None, metavar="URL", help="Platform URL override.") + parser.add_argument( + "--timeout", + default=None, + type=_positive_seconds, + metavar="SECONDS", + help="Request timeout in seconds.", + ) + if cmd.method in ("POST", "PUT", "PATCH"): + parser.add_argument( + "--data", + default=None, + metavar="JSON", + help="JSON object with extra request fields. Use @file to read a file, or - for stdin.", + ) + _add_idempotency_option(parser, cmd) + if cmd.path == "/billing/auto-topup" and cmd.method == "PUT": + parser.add_argument( + "--no-monthly-cap", + action="store_true", + help="Remove the monthly cap. Omit this flag to keep the stored cap.", + ) + if cmd.binary or cmd.path == "/audit": + output_help = ( + "Write the CSV or NDJSON-compatible export to this file." + if cmd.path == "/audit" and not cmd.binary + else "Write to this file." + ) + parser.add_argument("--output", default=None, metavar="FILE", help=output_help) + parser.add_argument( + "--force", + action="store_true", + help="Replace --output if it already exists.", + ) + if cmd.link: + parser.add_argument( + "--no-browser", + action="store_true", + help="Do not open the browser. Print the URL only.", + ) + if cmd.wait_path or cmd.wait_self: + parser.add_argument( + "--wait", action="store_true", help="Wait until the operation reaches a final state." + ) + parser.add_argument( + "--wait-timeout", + type=_positive_seconds, + default=float(_DEFAULT_WAIT_TIMEOUT_S), + metavar="SECONDS", + help=( + "Maximum total time to wait before returning an error " + f"(default: {_DEFAULT_WAIT_TIMEOUT_S})." + ), + ) + if cmd.path == "/billing/topup": + payment_mode = parser.add_mutually_exclusive_group() + payment_mode.add_argument( + "--yes", + action="store_true", + help=( + "Explicitly authorize payment without a TTY prompt. Required in " + "non-interactive mode." + ), + ) + payment_mode.add_argument( + "--no-pay", + action="store_true", + help="Print the payment challenge instead of paying it.", + ) + parser.add_argument( + "--payment-method", + default=None, + metavar="PM_ID", + help=( + "Pay with the mppx wallet client and this Stripe payment method " + "instead of the Stripe Link wallet. Defaults to " + "MPPX_STRIPE_PAYMENT_METHOD." + ), + ) + if cmd.path == "/scans" and cmd.method == "POST": + parser.add_argument( + "--source", + default=None, + metavar="DIRECTORY", + help="Package a local directory, upload it, and attach it to this scan.", + ) + parser.add_argument( + "--dry-run", + action="store_true", + help="Build and print the source manifest without uploading or starting a scan.", + ) + source_approval = parser.add_mutually_exclusive_group() + source_approval.add_argument( + "--yes", + action="store_true", + help="Approve the source snapshot built by this invocation without a prompt.", + ) + source_approval.add_argument( + "--approve-sha256", + default=None, + metavar="SHA256", + help=( + "Upload only if the archive exactly matches this --dry-run SHA-256 digest. " + "Best for agent and CI approval handoffs." + ), + ) + parser.add_argument( + "--show-files", + action="store_true", + help="Include every selected relative path in the source manifest.", + ) + parser.add_argument( + "--exclude", + action="append", + default=[], + metavar="GLOB", + help="Exclude a path glob from the upload. May be repeated.", + ) + parser.add_argument( + "--include-hidden", + action="store_true", + help="Include hidden files except .git and secret-like filenames.", + ) + parser.add_argument( + "--include-sensitive", + action="store_true", + help="Include files with secret-like names. Use only after reviewing --dry-run.", + ) + parser.add_argument( + "--include-archives", + action="store_true", + help="Include nested archives. Use only when they are required source inputs.", + ) + return parser + + +def _add_idempotency_option(parser: argparse.ArgumentParser, cmd: Cmd) -> None: + if not cmd.idempotent: + return + parser.add_argument( + "--idempotency-key", + default=None, + metavar="KEY", + help=( + "Stable key for an exact retry after an ambiguous response. A fresh UUID is " + "generated when omitted; never reuse a key for a different request." + ), + ) + + +def _wait_status_error( + result: Any, + *, + error: http.CloudError | None = None, + interrupted: bool = False, +) -> http.CloudError: + operation_id = _created_id(result) + suffix = f" Operation ID: {operation_id}." if operation_id else "" + prefix = ( + "Interrupted while waiting" + if interrupted + else f"Waiting for the remote operation failed: {error}" + ) + message = ( + f"{prefix}; the remote operation may still be running.{suffix} " + "Check its status before retrying." + ) + payload: dict[str, Any] = { + "error": message, + "status_unknown": True, + } + if interrupted: + payload["interrupted"] = True + if operation_id: + payload["operation_id"] = operation_id + return http.CloudError( + message, + exit_code=130 if interrupted else (error.exit_code if error else http.EXIT_ERROR), + payload=payload, + ) + + +def _interrupted_scan_launch_error(idempotency_key: str | None = None) -> http.CloudError: + retry_note = _idempotency_retry_note(idempotency_key) + message = ( + "Interrupted while starting the scan. The launch outcome is unknown; check " + f"`strix cloud scans list` before retrying.{retry_note}" + ) + payload: dict[str, Any] = { + "error": message, + "interrupted": True, + "launch_outcome_unknown": True, + } + _attach_idempotency_recovery(payload, idempotency_key) + return http.CloudError( + message, + exit_code=130, + payload=payload, + ) + + +def _ambiguous_scan_launch_error( + error: Exception, idempotency_key: str | None = None +) -> http.CloudError: + retry_note = _idempotency_retry_note(idempotency_key) + message = ( + f"{error} The scan launch outcome is unknown; check `strix cloud scans list` before " + f"retrying to avoid a duplicate scan or charge.{retry_note}" + ) + payload: dict[str, Any] = { + "error": message, + "launch_outcome_unknown": True, + } + exit_code = http.EXIT_ERROR + if isinstance(error, http.CloudError): + exit_code = error.exit_code + raw_payload: Any = error.payload + error_payload = cast("dict[str, Any]", raw_payload) + if isinstance(raw_payload, dict): + payload.update(error_payload) + payload["error"] = message + _attach_idempotency_recovery(payload, idempotency_key) + return http.CloudError(message, exit_code=exit_code, payload=payload) + + +def _idempotency_retry_note(idempotency_key: str | None) -> str: + if not idempotency_key: + return "" + return ( + f" An exact retry is safe with the same request and `--idempotency-key {idempotency_key}`." + ) + + +def _attach_idempotency_recovery(payload: dict[str, Any], idempotency_key: str | None) -> None: + if not idempotency_key: + return + payload.update( + { + "idempotency_key": idempotency_key, + "retry_safe": True, + "retry_same_request": True, + } + ) + + +def _add_option(parser: argparse.ArgumentParser, param: P, *, required: bool) -> None: + flag = "--" + (param.flag or param.name.replace("_", "-")) + if param.kind == "bool": + parser.add_argument( + flag, + dest=param.name, + action=argparse.BooleanOptionalAction, + default=None, + required=required, + help=param.help, + ) + elif param.kind == "list": + parser.add_argument( + flag, + dest=param.name, + nargs="+", + default=None, + required=required, + help=param.help, + ) + elif param.kind in ("int", "float"): + parser.add_argument( + flag, + dest=param.name, + type=int if param.kind == "int" else float, + default=None, + required=required, + help=param.help, + ) + else: + parser.add_argument(flag, dest=param.name, default=None, required=required, help=param.help) + + +def _collect(args: argparse.Namespace, params: tuple[P, ...]) -> dict[str, Any]: + values: dict[str, Any] = {} + for param in params: + value = getattr(args, param.name, None) + if value is None: + continue + if param.kind in ("json", "json-list") and isinstance(value, str): + try: + value = json.loads(value) + except ValueError as exc: + raise http.CloudError( + f"--{param.name.replace('_', '-')} must be JSON", + exit_code=http.EXIT_USAGE, + ) from exc + if param.kind == "json-list" and not isinstance(value, list): + raise http.CloudError( + f"--{param.name.replace('_', '-')} must be a JSON array", + exit_code=http.EXIT_USAGE, + ) + values[param.name] = value + return values + + +def _emit_binary( + console: Console, + response: Any, + output: str | None, + *, + force: bool = False, + json_metadata: bool = False, +) -> int: + try: + if not 200 <= response.status_code < 300: + http.check(response) + if output: + return _write_binary_file( + console, + response, + Path(output).expanduser(), + force=force, + as_json=json_metadata, + ) + if sys.stdout.isatty(): + raise http.CloudError( + "binary responses require --output FILE when stdout is a terminal; " + "redirect stdout only when intentionally piping the bytes.", + exit_code=http.EXIT_USAGE, + ) + output_stream: Any = getattr(sys.stdout, "buffer", None) + try: + for chunk in _response_chunks(response): + if output_stream is not None: + output_stream.write(chunk) + else: + sys.stdout.write(chunk.decode("utf-8")) + except (OSError, UnicodeDecodeError, requests.RequestException) as exc: + raise http.CloudError(f"could not write the response to stdout: {exc}") from exc + return http.EXIT_OK + finally: + close = getattr(response, "close", None) + if callable(close): + with suppress(Exception): + close() + + +def _write_binary_file( + console: Console, response: Any, path: Path, *, force: bool, as_json: bool +) -> int: + if path.exists() and not force: + raise http.CloudError( + f"refusing to replace existing file {path}; pass --force to overwrite it." + ) + temporary: Path | None = None + bytes_written = 0 + try: + try: + path.parent.mkdir(parents=True, exist_ok=True) + with tempfile.NamedTemporaryFile( + mode="wb", + prefix=f".{path.name}.", + suffix=".tmp", + dir=path.parent, + delete=False, + ) as stream: + temporary = Path(stream.name) + for chunk in _response_chunks(response): + stream.write(chunk) + bytes_written += len(chunk) + except (OSError, requests.RequestException) as exc: + raise http.CloudError(f"could not write {path}: {exc}") from exc + + try: + if force: + temporary.replace(path) + else: + os.link(temporary, path) + temporary.unlink() + except FileExistsError as exc: + raise http.CloudError( + f"refusing to replace existing file {path}; pass --force to overwrite it." + ) from exc + except OSError as exc: + raise http.CloudError(f"could not write {path}: {exc}") from exc + + if as_json: + content_type = str(getattr(response, "headers", {}).get("content-type", "")) + emit( + console, + { + "output": str(path), + "bytes": bytes_written, + **({"content_type": content_type} if content_type else {}), + }, + as_json=True, + view="binary_download", + ) + else: + console.print("Saved to:") + console.print(sanitize_terminal_text(path), markup=False, soft_wrap=True) + return http.EXIT_OK + finally: + if temporary is not None: + temporary.unlink(missing_ok=True) + + +def _response_chunks(response: Any) -> Iterator[bytes]: + iter_content = getattr(response, "iter_content", None) + if callable(iter_content): + chunks = cast("Iterator[bytes]", iter_content(chunk_size=1024 * 1024)) + for chunk in chunks: + if chunk: + yield bytes(chunk) + return + content = getattr(response, "content", b"") + if content: + yield bytes(content) + + +def _emit_error( + console: Console, exc: http.CloudError, *, as_json: bool, to_stderr: bool = False +) -> None: + if as_json: + raw_payload: Any = exc.payload + error_payload = cast("dict[str, Any]", raw_payload) + if isinstance(raw_payload, dict): + payload = dict(error_payload) + payload.setdefault("error", str(exc)) + if payload.get("detail") == payload.get("error"): + payload.pop("detail", None) + else: + payload = {"error": str(exc)} + if exc.payload is not None: + payload["detail"] = exc.payload + if exc.next_step: + payload["next_step"] = exc.next_step + sys.stdout.write(json.dumps(payload, indent=2, default=str) + "\n") + return + target = Console(stderr=True) if to_stderr else console + target.print(f"[red]Error:[/] {escape(sanitize_terminal_text(exc))}") + if exc.next_step: + target.print(f"[yellow]Next step:[/] {escape(sanitize_terminal_text(exc.next_step))}") + + +def _emit_interrupted(console: Console, *, as_json: bool, to_stderr: bool) -> None: + if as_json and not to_stderr: + sys.stdout.write(json.dumps({"error": "Interrupted.", "interrupted": True}) + "\n") + return + target = Console(stderr=True) if to_stderr else console + target.print("[yellow]Interrupted.[/]") + + +def _created_id(created: Any) -> str | None: + """Read the identifier of a created item. The API names it `id` or `_id`.""" + if not isinstance(created, dict): + return None + fields = cast("dict[str, Any]", created) + for key, value in fields.items(): + if (key == "id" or key.endswith("_id")) and isinstance(value, str) and value.strip(): + return value + return None + + +def _validated_operation_result(result: Any, cmd: Cmd) -> Any: + """Reject malformed success bodies for mutations that create a scan.""" + if cmd.wait_path and _created_id(result) is None: + raise http.CloudError( + "the platform returned a successful operation response without an operation ID." + ) + return result + + +def _wait( + console: Console, + cmd: Cmd, + created: Any, + *, + token: str | None, + as_json: bool, + wait_timeout: float, +) -> Any: + item_id = _created_id(created) + if not cmd.wait_path: + return created + if not item_id: + raise http.CloudError( + "cannot wait because the platform response did not include an operation ID." + ) + path = cmd.wait_path.replace("{id}", str(item_id)) + if not as_json: + console.print( + f"[dim]Waiting for {escape(sanitize_terminal_text(item_id))} to reach a final state…[/]" + ) + return _poll( + console, + path, + token=token, + as_json=as_json, + wait_timeout=wait_timeout, + ) + + +def _poll( + console: Console, + path: str, + *, + token: str | None, + as_json: bool, + wait_timeout: float, +) -> Any: + """Poll a GET path until its status is final. Returns the last response.""" + deadline = time.monotonic() + wait_timeout + while True: + current: Any = http.check(http.request("GET", path, token=token)) + fields = cast("dict[str, Any]", current) if isinstance(current, dict) else {} + status = str(fields.get("status", "")) + if status.lower() in _TERMINAL_STATUSES: + return fields if isinstance(current, dict) else current + if not as_json: + console.print( + f"[dim] status: {escape(sanitize_terminal_text(status or 'unknown'))}[/]" + ) + remaining = deadline - time.monotonic() + if remaining <= 0: + raise http.CloudError( + f"wait timed out after {wait_timeout:g} seconds; the remote operation is still " + "running. Re-run its get command to check the status." + ) + time.sleep(min(_WAIT_POLL_S, remaining)) diff --git a/strix/interface/cloud/session.py b/strix/interface/cloud/session.py new file mode 100644 index 000000000..d2ec0861f --- /dev/null +++ b/strix/interface/cloud/session.py @@ -0,0 +1,167 @@ +"""Inspect and safely narrow a managed Strix CLI session.""" + +from __future__ import annotations + +import os +from typing import TYPE_CHECKING, Any, cast + +from rich.console import Console +from rich.markup import escape + +import strix.interface.cloud.http as http # noqa: PLR0402 +from strix.interface.cloud.arguments import CloudArgumentParser +from strix.interface.cloud.render import emit, json_mode +from strix.interface.platform_cli import read_record, save_record +from strix.interface.terminal_text import sanitize_terminal_text + + +if TYPE_CHECKING: + import argparse + + +def run_session(argv: list[str]) -> int: + console = Console() + normalized = ["show", *argv] if not argv or argv[0].startswith("-") else list(argv) + if normalized[0] == "help": + normalized = ["--help", *normalized[1:]] + if normalized[0] in {"-h", "--help"}: + _print_help(console) + return 0 + verb = normalized.pop(0) + if verb == "scopes" and normalized and normalized[0] == "set": + normalized.pop(0) + return _run_scopes_set(console, normalized) + if verb not in {"show", "scopes"}: + console.print(f"[red]Unknown session command:[/] {escape(sanitize_terminal_text(verb))}") + _print_help(console) + return http.EXIT_USAGE + return _run_show(console, normalized, scopes_only=verb == "scopes") + + +def _common(parser: argparse.ArgumentParser) -> None: + parser.add_argument("--json", action="store_true", help="Print the raw JSON response.") + parser.add_argument("--show-scopes", action="store_true", help="Print every granted scope.") + parser.add_argument("--token", default=None, help="API token override.") + parser.add_argument("--workspace-id", default=None, metavar="ORG_ID") + parser.add_argument("--app-url", default=None, metavar="URL") + parser.add_argument("--timeout", default=None, type=float, metavar="SECONDS") + + +def _configure(args: argparse.Namespace) -> bool: + external = args.token is not None or bool(os.environ.get("STRIX_API_TOKEN", "").strip()) + http.configure( + base_url=args.app_url, + timeout=args.timeout, + token_override=bool(args.token), + workspace_id=args.workspace_id, + ) + return external + + +def _run_show(console: Console, argv: list[str], *, scopes_only: bool) -> int: + parser = CloudArgumentParser(prog=f"strix cloud session {'scopes' if scopes_only else 'show'}") + _common(parser) + as_json = json_mode(flag="--json" in argv) + try: + args = parser.parse_args(argv) + _configure(args) + payload = http.check(http.request("GET", "/cli/session", token=args.token)) + except SystemExit as exc: + return int(exc.code or 0) + except http.CloudError as exc: + return _error(console, exc, as_json=as_json) + if not isinstance(payload, dict): + return _error(console, http.CloudError("invalid CLI session response"), as_json=as_json) + record = cast("dict[str, Any]", payload) + if as_json: + emit(console, record, as_json=True) + return http.EXIT_OK + scopes = _string_list(record.get("scopes")) + ceiling = _string_list(record.get("scope_ceiling")) + profile = str(record.get("scope_profile") or "custom").title() + if not scopes_only: + device_name = escape(str(record.get("device_name") or "this device")) + console.print(f"[green]Active CLI session[/] on [bold]{device_name}[/]") + console.print(f" Workspace: {escape(str(record.get('organization_id') or 'unknown'))}") + console.print(f" Access: {profile} · {len(scopes)} scopes granted · {len(ceiling)} maximum") + if args.show_scopes or scopes_only: + console.print(f" Granted: [dim]{escape(' '.join(scopes))}[/]") + console.print(f" Ceiling: [dim]{escape(' '.join(ceiling))}[/]") + return http.EXIT_OK + + +def _run_scopes_set(console: Console, argv: list[str]) -> int: + parser = CloudArgumentParser( + prog="strix cloud session scopes set", + description="Change scopes within the access approved at browser sign-in.", + ) + mode = parser.add_mutually_exclusive_group(required=True) + mode.add_argument("profile", nargs="?", choices=("minimal", "recommended", "full")) + mode.add_argument("--scopes", nargs="+", metavar="SCOPE") + _common(parser) + as_json = json_mode(flag="--json" in argv) + try: + args = parser.parse_args(argv) + external = _configure(args) + body = ( + {"scope_profile": args.profile} + if args.profile + else {"scope_profile": "custom", "scopes": args.scopes} + ) + payload = http.check(http.request("PATCH", "/cli/session", token=args.token, body=body)) + except SystemExit as exc: + return int(exc.code or 0) + except http.CloudError as exc: + return _error(console, exc, as_json=as_json) + if not isinstance(payload, dict): + return _error(console, http.CloudError("invalid CLI session response"), as_json=as_json) + result = cast("dict[str, Any]", payload) + if not external: + stored = read_record() + if stored is not None: + stored.update( + { + key: result[key] + for key in ("scopes", "requested_scopes", "scope_ceiling", "scope_profile") + if key in result + } + ) + save_record(stored) + if as_json: + emit(console, result, as_json=True) + else: + scopes = _string_list(result.get("scopes")) + profile = str(result.get("scope_profile") or "custom").title() + console.print(f"[green]✓ CLI access updated.[/] {profile} · {len(scopes)} scopes granted") + if args.show_scopes: + console.print(f" Scopes: [dim]{escape(' '.join(scopes))}[/]") + return http.EXIT_OK + + +def _string_list(value: Any) -> list[str]: + if not isinstance(value, list): + return [] + items = cast("list[Any]", cast("Any", value)) + return [str(item) for item in items] + + +def _error(console: Console, error: http.CloudError, *, as_json: bool) -> int: + if as_json: + raw_payload: Any = error.payload + error_payload = cast("dict[str, Any]", raw_payload) + payload = dict(error_payload) if isinstance(raw_payload, dict) else {} + payload["error"] = str(error) + if payload.get("detail") == payload.get("error"): + payload.pop("detail", None) + emit(console, payload, as_json=True) + else: + console.print(f"[red]Error:[/] {escape(sanitize_terminal_text(error))}") + return error.exit_code + + +def _print_help(console: Console) -> None: + console.print("[bold]strix cloud session[/] commands:") + console.print(" show Show the remote CLI session (default).") + console.print(" scopes Show granted scopes and consent ceiling.") + console.print(" scopes set PROFILE Use minimal, recommended, or full.") + console.print(" scopes set --scopes SCOPE… Use a custom set within the ceiling.") diff --git a/strix/interface/cloud/source_scan.py b/strix/interface/cloud/source_scan.py new file mode 100644 index 000000000..7893bf5af --- /dev/null +++ b/strix/interface/cloud/source_scan.py @@ -0,0 +1,403 @@ +"""Local-source approval, upload, and scan-launch lifecycle.""" + +from __future__ import annotations + +import re +import sys +from dataclasses import dataclass +from typing import TYPE_CHECKING, Any, cast +from urllib.parse import quote + +from rich.markup import escape + +import strix.interface.cloud.http as http # noqa: PLR0402 +from strix.interface.cloud.render import emit +from strix.interface.cloud.source_upload import prepare_source, remove_bundle +from strix.interface.terminal_text import sanitize_terminal_text + + +if TYPE_CHECKING: + import argparse + from typing import NoReturn + + from rich.console import Console + + from strix.interface.cloud.source_upload import SourceBundle + + +_SHA256 = re.compile(r"^[0-9a-fA-F]{64}$") + + +@dataclass +class LocalSourceScan: + """Own one local bundle and its staged upload through a scan launch.""" + + bundle: SourceBundle | None = None + upload_id: str | None = None + idempotency_key: str | None = None + _launch_started: bool = False + + def prepare_and_attach( + self, + console: Console, + args: argparse.Namespace, + body: dict[str, Any], + *, + as_json: bool, + token: str | None, + ) -> bool: + """Prepare source, emit a dry run, or upload and attach it to ``body``. + + Returns ``True`` when a dry run was emitted and request execution should stop. + """ + self.bundle = prepare_scan_source(console, args, as_json=as_json) + if self.bundle is None: + return False + if getattr(args, "dry_run", False): + emit( + console, + {"source": self.bundle.summary(show_files=getattr(args, "show_files", False))}, + as_json=as_json, + view="source_manifest", + ) + return True + self.upload_id = _upload_scan_source(self.bundle, token=token) + existing = body.get("upload_ids") + body["upload_ids"] = [ + *(existing if isinstance(existing, list) else []), + self.upload_id, + ] + return False + + def mark_launch_started(self) -> None: + """Record that the scan-creation request may have reached the platform.""" + self._launch_started = self.upload_id is not None + + def handle_request_failure(self, error: BaseException, *, token: str | None) -> None: + """Clean or retain a staged upload according to request ambiguity.""" + if self.upload_id is None: + return + if self._launch_started: + if isinstance(error, KeyboardInterrupt): + raise _interrupted_source_upload_error( + self.upload_id, self.idempotency_key + ) from None + if isinstance(error, Exception): + raise _retained_source_upload_error( + self.upload_id, error, self.idempotency_key + ) from error + return + try: + _delete_upload(self.upload_id, token=token) + except (http.CloudError, KeyboardInterrupt) as cleanup_error: + if isinstance(error, Exception): + raise _source_cleanup_error(self.upload_id, error, cleanup_error) from error + interrupted = http.CloudError("source upload interrupted.", exit_code=130) + raise _source_cleanup_error(self.upload_id, interrupted, cleanup_error) from None + + def handle_response_failure( + self, + error: BaseException, + *, + definitive: bool, + token: str | None, + ) -> None: + """Clean a rejected upload or retain one whose scan result is ambiguous.""" + if self.upload_id is None: + return + if definitive: + try: + _delete_upload(self.upload_id, token=token) + except (http.CloudError, KeyboardInterrupt) as cleanup_error: + if isinstance(error, Exception): + raise _source_cleanup_error(self.upload_id, error, cleanup_error) from error + interrupted = http.CloudError("source upload interrupted.", exit_code=130) + raise _source_cleanup_error(self.upload_id, interrupted, cleanup_error) from None + return + if isinstance(error, Exception): + raise _retained_source_upload_error( + self.upload_id, error, self.idempotency_key + ) from error + + def wrap_result(self, result: Any, args: argparse.Namespace) -> Any: + """Attach the approved source manifest to a successful scan response.""" + if self.bundle is None: + return result + return { + "source": self.bundle.summary(show_files=getattr(args, "show_files", False)), + "upload_id": self.upload_id, + "scan": result, + } + + def close(self) -> None: + """Remove the private temporary bundle, if one was built.""" + if self.bundle is not None: + remove_bundle(self.bundle) + + +def prepare_scan_source( + console: Console, args: argparse.Namespace, *, as_json: bool +) -> SourceBundle | None: + """Build and approve the exact local-source snapshot for one invocation.""" + source = getattr(args, "source", None) + source_flags = ( + "dry_run", + "show_files", + "include_hidden", + "include_sensitive", + "include_archives", + "approve_sha256", + ) + if source is None: + if any(getattr(args, name, False) for name in source_flags) or getattr(args, "exclude", []): + raise http.CloudError("source upload options require --source DIRECTORY.") + return None + bundle = prepare_source( + source, + include_hidden=bool(getattr(args, "include_hidden", False)), + include_sensitive=bool(getattr(args, "include_sensitive", False)), + include_archives=bool(getattr(args, "include_archives", False)), + exclude=cast("list[str]", getattr(args, "exclude", [])), + ) + keep_bundle = False + try: + approved_digest = _validate_source_digest_approval(args, bundle) + if getattr(args, "dry_run", False): + keep_bundle = True + return bundle + if getattr(args, "yes", False) or approved_digest is not None: + keep_bundle = True + return bundle + if as_json or not (sys.stdin.isatty() and sys.stdout.isatty()): + _source_approval_error( + "source upload requires explicit approval in non-interactive mode. " + "Review with --dry-run --show-files, then rerun with " + "--approve-sha256 ; use --yes only for a deliberate " + "one-shot approval of the snapshot built by that invocation." + ) + console.print( + "[bold]Local source upload[/]\n" + f" {len(bundle.manifest.files):,} file(s), " + f"{_format_bytes(bundle.manifest.total_bytes)} " + f"({_format_bytes(bundle.archive_bytes)} compressed)\n" + f" {sum(bundle.manifest.excluded.values()):,} path(s) excluded\n" + " Only the selected files will be sent to Strix Cloud." + ) + if getattr(args, "show_files", False): + console.print(f"\n[bold]Selected files ({len(bundle.manifest.files):,})[/]") + for selected in bundle.manifest.files: + console.print( + f" {escape(sanitize_terminal_text(selected.archive_name))}", soft_wrap=True + ) + answer = ( + console.input("Upload this source and start the scan? [y/N]: ", markup=False) + .strip() + .lower() + ) + if answer not in ("y", "yes"): + _source_approval_error("source upload cancelled.") + keep_bundle = True + return bundle + finally: + if not keep_bundle: + remove_bundle(bundle) + + +def _validate_source_digest_approval(args: argparse.Namespace, bundle: SourceBundle) -> str | None: + approved_digest = getattr(args, "approve_sha256", None) + if approved_digest is None: + return None + if not isinstance(approved_digest, str) or not _SHA256.fullmatch(approved_digest): + _source_approval_error("--approve-sha256 must be exactly 64 hexadecimal characters.") + if bundle.archive_sha256 != approved_digest.lower(): + _source_approval_error( + "source archive SHA-256 does not match --approve-sha256; review a fresh " + "--dry-run before uploading." + ) + return approved_digest + + +def _source_approval_error(message: str) -> NoReturn: + raise http.CloudError(message) + + +def _upload_scan_source(bundle: SourceBundle, *, token: str | None) -> str: + file_name = f"strix-source-{bundle.archive_sha256[:12]}.zip" + requested = http.check( + http.request( + "POST", + "/uploads/request", + token=token, + body={ + "file_name": file_name, + "file_size": bundle.archive_bytes, + "category": "repository", + }, + ) + ) + if not isinstance(requested, dict): + raise http.CloudError("the platform returned an invalid source upload response.") + fields = cast("dict[str, Any]", requested) + upload_id = fields.get("upload_id") + signed_url = fields.get("signed_url") + upload_token = fields.get("token") + if not all(isinstance(value, str) and value for value in (upload_id, signed_url, upload_token)): + error = http.CloudError("the platform did not return complete source upload credentials.") + if isinstance(upload_id, str) and upload_id: + try: + _delete_upload(upload_id, token=token) + except (http.CloudError, KeyboardInterrupt) as cleanup_error: + raise _source_cleanup_error(upload_id, error, cleanup_error) from error + raise error + try: + http.upload_file(cast("str", signed_url), cast("str", upload_token), bundle.archive_path) + completed = http.check( + http.request( + "POST", + "/uploads/complete", + token=token, + body={"upload_id": upload_id}, + ) + ) + _validate_completed_upload(completed, expected_id=cast("str", upload_id)) + except BaseException as error: + try: + _delete_upload(cast("str", upload_id), token=token) + except (http.CloudError, KeyboardInterrupt) as cleanup_error: + if isinstance(error, Exception): + raise _source_cleanup_error(cast("str", upload_id), error, cleanup_error) from error + interrupted = http.CloudError("source upload interrupted.", exit_code=130) + raise _source_cleanup_error( + cast("str", upload_id), interrupted, cleanup_error + ) from None + raise + return cast("str", upload_id) + + +def _validate_completed_upload(completed: Any, *, expected_id: str) -> None: + fields = cast("dict[str, Any]", completed) if isinstance(completed, dict) else {} + if fields.get("id") != expected_id: + raise http.CloudError("the platform returned an invalid source upload completion response.") + + +def _delete_upload(upload_id: str, *, token: str | None) -> None: + response = http.request("DELETE", f"/uploads/{quote(upload_id, safe='')}", token=token) + if response.status_code == 404 or 200 <= response.status_code < 300: + return + http.check(response) + + +def _source_cleanup_note(upload_id: str, cleanup_error: BaseException) -> str: + return ( + f"Cleanup of source upload {upload_id} could not be confirmed: {cleanup_error}. " + f"Retry with `strix cloud uploads delete {upload_id}`." + ) + + +def _source_cleanup_error( + upload_id: str, error: Exception, cleanup_error: BaseException +) -> http.CloudError: + """Report a staged source object whenever automatic deletion is uncertain.""" + message = f"{error} {_source_cleanup_note(upload_id, cleanup_error)}" + payload: dict[str, Any] = {} + exit_code = http.EXIT_ERROR + if isinstance(error, http.CloudError): + exit_code = error.exit_code + raw_payload: Any = error.payload + if isinstance(raw_payload, dict): + payload.update(cast("dict[str, Any]", raw_payload)) + elif raw_payload is not None: + payload["detail"] = raw_payload + payload.update( + { + "error": message, + "upload_id": upload_id, + "upload_retained": True, + "cleanup_unknown": True, + } + ) + return http.CloudError(message, exit_code=exit_code, payload=payload) + + +def _interrupted_source_upload_error( + upload_id: str, idempotency_key: str | None = None +) -> http.CloudError: + retry_note = _idempotency_retry_note(idempotency_key) + message = ( + "Interrupted while starting the scan. The launch outcome is unknown, so source upload " + f"{upload_id} was retained. Check `strix cloud scans list` before retrying; if no scan " + f"was created, run `strix cloud uploads delete {upload_id}`.{retry_note}" + ) + payload: dict[str, Any] = { + "error": message, + "interrupted": True, + "upload_id": upload_id, + "upload_retained": True, + "launch_outcome_unknown": True, + } + _attach_idempotency_recovery(payload, idempotency_key) + return http.CloudError(message, exit_code=130, payload=payload) + + +def _retained_source_upload_error( + upload_id: str, + error: Exception, + idempotency_key: str | None = None, +) -> http.CloudError: + """Preserve source when the platform may already have accepted its scan.""" + retry_note = _idempotency_retry_note(idempotency_key) + message = ( + f"{error} The scan launch outcome is unknown, so source upload {upload_id} was retained. " + "Check `strix cloud scans list` before retrying; if no scan was created, clean it up " + f"with `strix cloud uploads delete {upload_id}`. Linked uploads cannot be deleted." + f"{retry_note}" + ) + payload: dict[str, Any] = {} + exit_code = http.EXIT_ERROR + if isinstance(error, http.CloudError): + exit_code = error.exit_code + raw_payload: Any = error.payload + error_payload = cast("dict[str, Any]", raw_payload) + if isinstance(raw_payload, dict): + payload.update(error_payload) + elif raw_payload is not None: + payload["detail"] = raw_payload + payload.update( + { + "error": message, + "upload_id": upload_id, + "upload_retained": True, + "launch_outcome_unknown": True, + } + ) + _attach_idempotency_recovery(payload, idempotency_key) + return http.CloudError(message, exit_code=exit_code, payload=payload) + + +def _idempotency_retry_note(idempotency_key: str | None) -> str: + if not idempotency_key: + return "" + return ( + " An exact retry is safe only with the same request body and " + f"`--idempotency-key {idempotency_key}`." + ) + + +def _attach_idempotency_recovery(payload: dict[str, Any], idempotency_key: str | None) -> None: + if not idempotency_key: + return + payload.update( + { + "idempotency_key": idempotency_key, + "retry_safe": True, + "retry_same_request": True, + } + ) + + +def _format_bytes(value: int) -> str: + if value < 1024: + return f"{value} B" + if value < 1024 * 1024: + return f"{value / 1024:.1f} KB" + return f"{value / (1024 * 1024):.1f} MB" diff --git a/strix/interface/cloud/source_upload.py b/strix/interface/cloud/source_upload.py new file mode 100644 index 000000000..780a84569 --- /dev/null +++ b/strix/interface/cloud/source_upload.py @@ -0,0 +1,734 @@ +"""Privacy-conscious local source packaging for managed scans.""" + +from __future__ import annotations + +import fnmatch +import hashlib +import os +import shutil +import stat +import subprocess # nosec B404 +import tempfile +import zipfile +from collections import Counter +from dataclasses import dataclass +from pathlib import Path, PurePosixPath +from typing import TYPE_CHECKING + +import strix.interface.cloud.http as http # noqa: PLR0402 + + +if TYPE_CHECKING: + from collections.abc import Iterator + from typing import Protocol + + class _ScandirIterator(Iterator[os.DirEntry[str]], Protocol): + def close(self) -> None: ... + + +MAX_FILES = 20_000 +MAX_FILE_BYTES = 25 * 1024 * 1024 +MAX_TOTAL_BYTES = 250 * 1024 * 1024 +MAX_ARCHIVE_BYTES = 50 * 1024 * 1024 +MAX_CANDIDATE_PATHS = 200_000 +MAX_IGNORE_BYTES = 64 * 1024 +MAX_IGNORE_PATTERNS = 1_000 +MAX_IGNORE_PATTERN_CHARS = 1_024 + +_ALWAYS_EXCLUDED_DIRS = frozenset( + { + ".git", + ".hg", + ".svn", + "node_modules", + "vendor", + "venv", + ".venv", + "env", + "__pycache__", + ".tox", + ".pytest_cache", + ".mypy_cache", + ".ruff_cache", + "dist", + "build", + "coverage", + "target", + ".next", + ".nuxt", + ".gradle", + } +) +_SENSITIVE_NAMES = frozenset( + { + "id_rsa", + "id_dsa", + "id_ecdsa", + "id_ed25519", + "credentials.json", + "service-account.json", + "service_account.json", + ".env", + ".npmrc", + ".pypirc", + ".netrc", + ".git-credentials", + "application_default_credentials.json", + } +) +_SENSITIVE_PATTERNS = ( + "*.pem", + "*.key", + "*.p12", + "*.pfx", + "*.keystore", + "*.jks", + "secrets.*", + "secret.*", + ".env.*", +) +_SENSITIVE_PATH_SUFFIXES = ( + (".aws", "credentials"), + (".aws", "config"), + (".docker", "config.json"), + (".config", "gcloud", "credentials.db"), + (".azure", "accesstokens.json"), + (".azure", "azureprofile.json"), + (".kube", "config"), +) +_ARCHIVE_SUFFIXES = ( + ".zip", + ".tar", + ".tgz", + ".tar.gz", + ".tar.bz2", + ".tar.xz", + ".7z", + ".rar", + ".gz", + ".bz2", + ".xz", + ".jar", + ".war", + ".whl", + ".nupkg", + ".apk", + ".ipa", +) +_ARCHIVE_MAGIC_PREFIXES = ( + b"PK\x03\x04", + b"PK\x05\x06", + b"PK\x07\x08", + b"\x1f\x8b", + b"BZh", + b"\xfd7zXZ\x00", + b"7z\xbc\xaf\x27\x1c", + b"Rar!\x1a\x07", +) + + +@dataclass(frozen=True) +class SelectedFile: + path: Path + archive_name: str + size: int + device: int + inode: int + mtime_ns: int + ctime_ns: int + + +@dataclass(frozen=True) +class SourceManifest: + source: Path + files: tuple[SelectedFile, ...] + excluded: Counter[str] + include_hidden: bool + include_sensitive: bool + include_archives: bool + + @property + def total_bytes(self) -> int: + return sum(item.size for item in self.files) + + def as_dict( + self, + *, + show_files: bool, + archive_bytes: int | None = None, + archive_sha256: str | None = None, + ) -> dict[str, object]: + result: dict[str, object] = { + "source": str(self.source), + "file_count": len(self.files), + "uncompressed_bytes": self.total_bytes, + "excluded_count": sum(self.excluded.values()), + "excluded_by_reason": dict(sorted(self.excluded.items())), + "include_hidden": self.include_hidden, + "include_sensitive": self.include_sensitive, + "include_archives": self.include_archives, + } + if archive_bytes is not None: + result["archive_bytes"] = archive_bytes + if archive_sha256 is not None: + result["archive_sha256"] = archive_sha256 + if show_files: + result["files"] = [item.archive_name for item in self.files] + return result + + +@dataclass(frozen=True) +class SourceBundle: + manifest: SourceManifest + archive_path: Path + archive_bytes: int + archive_sha256: str + + def summary(self, *, show_files: bool) -> dict[str, object]: + return self.manifest.as_dict( + show_files=show_files, + archive_bytes=self.archive_bytes, + archive_sha256=self.archive_sha256, + ) + + +def prepare_source( + value: str, + *, + include_hidden: bool, + include_sensitive: bool, + include_archives: bool, + exclude: list[str], +) -> SourceBundle: + """Select safe source files and build a bounded temporary ZIP archive.""" + source = Path(value).expanduser().resolve() + if not source.is_dir(): + if source.is_file() and ( + source.name.lower().endswith(_ARCHIVE_SUFFIXES) or _has_archive_magic(source) + ): + raise http.CloudError( + f"--source must be a directory, not an archive: {source}", + next_step=( + "Extract the archive and pass the directory to --source. Strix packs the " + "directory and excludes dependencies, build output, and secret-like files. " + "Add --dry-run --show-files to review the selection first." + ), + ) + raise http.CloudError(f"--source must be a directory: {source}") + manifest = select_source( + source, + include_hidden=include_hidden, + include_sensitive=include_sensitive, + include_archives=include_archives, + exclude=exclude, + ) + if not manifest.files: + raise http.CloudError("no files remain after applying source upload exclusions.") + + with tempfile.NamedTemporaryFile(prefix="strix-source-", suffix=".zip", delete=False) as handle: + archive_path = Path(handle.name) + try: + _write_archive(archive_path, manifest.files) + except BaseException: + archive_path.unlink(missing_ok=True) + raise + archive_bytes = archive_path.stat().st_size + if archive_bytes > MAX_ARCHIVE_BYTES: + archive_path.unlink(missing_ok=True) + raise _archive_too_large_error(manifest, archive_bytes) + digest = _sha256(archive_path) + return SourceBundle(manifest, archive_path, archive_bytes, digest) + + +_LARGEST_FILES_SHOWN = 5 + + +def _format_mib(size: int) -> str: + return f"{size / (1024 * 1024):.1f} MiB" + + +def _archive_too_large_error(manifest: SourceManifest, archive_bytes: int) -> http.CloudError: + """Name the largest selected files so the user knows what to exclude.""" + largest = sorted(manifest.files, key=lambda item: item.size, reverse=True) + listed = ", ".join( + f"{item.archive_name} ({_format_mib(item.size)})" for item in largest[:_LARGEST_FILES_SHOWN] + ) + return http.CloudError( + f"the source archive is {_format_mib(archive_bytes)}, larger than the " + f"{_format_mib(MAX_ARCHIVE_BYTES)} upload limit. Largest files: {listed}.", + next_step=( + "Add --exclude patterns for large files or directories, or point --source at a " + "smaller directory. Run with --dry-run --show-files to review the selection." + ), + ) + + +def select_source( + source: Path, + *, + include_hidden: bool = False, + include_sensitive: bool = False, + include_archives: bool = False, + exclude: list[str] | None = None, +) -> SourceManifest: + excluded: Counter[str] = Counter() + selected: list[SelectedFile] = [] + patterns = [*_load_ignore_patterns(source), *(exclude or [])] + _validate_patterns(patterns) + total_bytes = 0 + for relative in _candidate_paths( + source, + include_hidden=include_hidden, + patterns=patterns, + excluded=excluded, + ): + archive_name = relative.as_posix() + reason = _exclusion_reason( + relative, + include_hidden=include_hidden, + include_sensitive=include_sensitive, + include_archives=include_archives, + patterns=patterns, + ) + if reason: + excluded[reason] += 1 + continue + path = source / relative + try: + info = path.lstat() + except OSError: + excluded["unreadable"] += 1 + continue + if not stat.S_ISREG(info.st_mode): + excluded["symlink_or_non_file"] += 1 + continue + if not include_archives and _has_archive_magic(path): + excluded["nested_archive"] += 1 + continue + if info.st_size > MAX_FILE_BYTES: + raise http.CloudError( + f"{archive_name} is larger than the 25 MB per-file limit; exclude it explicitly." + ) + selected.append( + SelectedFile( + path=path, + archive_name=archive_name, + size=info.st_size, + device=info.st_dev, + inode=info.st_ino, + mtime_ns=info.st_mtime_ns, + ctime_ns=info.st_ctime_ns, + ) + ) + total_bytes += info.st_size + if len(selected) > MAX_FILES: + raise http.CloudError( + f"source contains more than {MAX_FILES:,} files; narrow --source or add exclusions." + ) + if total_bytes > MAX_TOTAL_BYTES: + raise http.CloudError( + "selected source is larger than the 250 MB expanded-size limit; narrow --source " + "or add --exclude patterns." + ) + selected.sort(key=lambda item: item.archive_name) + return SourceManifest( + source, + tuple(selected), + excluded, + include_hidden, + include_sensitive, + include_archives, + ) + + +def remove_bundle(bundle: SourceBundle) -> None: + bundle.archive_path.unlink(missing_ok=True) + + +def _candidate_paths( + source: Path, + *, + include_hidden: bool, + patterns: list[str], + excluded: Counter[str], +) -> Iterator[Path]: + git_root = _git_root(source) + if git_root is not None: + git = shutil.which("git") + if git is not None: + yield from _git_candidate_paths(git, git_root, source) + return + yield from _walk_candidate_paths( + source, + include_hidden=include_hidden, + patterns=patterns, + excluded=excluded, + ) + + +def _git_candidate_paths(git: str, git_root: Path, source: Path) -> Iterator[Path]: + """Stream Git's NUL-delimited manifest without buffering an unbounded repository.""" + relative_source = source.relative_to(git_root) + command = [ + git, + "-C", + str(git_root), + "ls-files", + "-z", + "--cached", + "--others", + "--exclude-standard", + "--", + ] + if relative_source != Path(): + command.append(relative_source.as_posix()) + try: + process = subprocess.Popen( # noqa: S603 # nosec B603 + command, + stdout=subprocess.PIPE, + stderr=subprocess.DEVNULL, + ) + except OSError as exc: + raise http.CloudError(f"could not enumerate Git source files: {exc}") from exc + assert process.stdout is not None + buffer = b"" + count = 0 + try: + while chunk := process.stdout.read(64 * 1024): + buffer += chunk + records = buffer.split(b"\0") + buffer = records.pop() + for raw in records: + relative = _git_relative_path(raw, relative_source) + if relative is None: + continue + count += 1 + _check_candidate_limit(count) + yield relative + if buffer: + raise http.CloudError("Git returned a malformed source file manifest.") + if process.wait() != 0: + raise http.CloudError("Git could not enumerate the source directory.") + finally: + process.stdout.close() + if process.poll() is None: + process.terminate() + try: + process.wait(timeout=1) + except subprocess.TimeoutExpired: + process.kill() + process.wait() + + +def _git_relative_path(raw: bytes, relative_source: Path) -> Path | None: + repo_relative = Path(os.fsdecode(raw)) + try: + relative = repo_relative.relative_to(relative_source) + except ValueError: + return None + if relative.is_absolute() or ".." in relative.parts: + raise http.CloudError("Git returned an unsafe source path.") + return relative + + +def _walk_candidate_paths( + source: Path, + *, + include_hidden: bool, + patterns: list[str], + excluded: Counter[str], +) -> Iterator[Path]: + """Walk top-down so excluded dependency, VCS, and hidden trees are never traversed.""" + count = 0 + stack: list[tuple[Path, _ScandirIterator]] = [] + try: + stack.append((source, os.scandir(source))) + while stack: + root_path, entries = stack[-1] + try: + entry = next(entries) + except StopIteration: + entries.close() + stack.pop() + continue + count += 1 + _check_candidate_limit(count) + path = root_path / entry.name + relative = path.relative_to(source) + try: + is_directory = entry.is_dir(follow_symlinks=False) + is_symlink = entry.is_symlink() + except OSError: + excluded["unreadable"] += 1 + continue + if is_directory: + reason = _pruned_directory_reason( + relative, + include_hidden=include_hidden, + patterns=patterns, + ) + if reason: + excluded[reason] += 1 + continue + try: + stack.append((path, os.scandir(path))) + except OSError: + excluded["unreadable"] += 1 + continue + if is_symlink: + excluded["symlink_or_non_file"] += 1 + continue + yield relative + except OSError as exc: + raise http.CloudError(f"could not enumerate source directory {source}: {exc}") from exc + finally: + for _, entries in stack: + entries.close() + + +def _pruned_directory_reason( + relative: Path, + *, + include_hidden: bool, + patterns: list[str], +) -> str | None: + lower_parts = tuple(part.lower() for part in relative.parts) + if any(part == ".git" for part in lower_parts): + return "git_metadata" + if any(part in _ALWAYS_EXCLUDED_DIRS for part in lower_parts): + return "dependency_or_build_output" + if not include_hidden and any(part.startswith(".") for part in relative.parts): + return "hidden" + if any(_matches_user_pattern(relative, pattern) for pattern in patterns): + return "user_pattern" + return None + + +def _check_candidate_limit(count: int) -> None: + if count > MAX_CANDIDATE_PATHS: + raise http.CloudError( + f"source enumeration exceeded {MAX_CANDIDATE_PATHS:,} paths before filtering; " + "narrow --source or add directory exclusions." + ) + + +def _git_root(source: Path) -> Path | None: + git = shutil.which("git") + if git is None: + return None + result = subprocess.run( # noqa: S603 # nosec B603 + [git, "-C", str(source), "rev-parse", "--show-toplevel"], + check=False, + capture_output=True, + text=True, + ) + if result.returncode != 0: + return None + try: + return Path(result.stdout.strip()).resolve() + except OSError: + return None + + +def _exclusion_reason( # noqa: PLR0911 + relative: Path, + *, + include_hidden: bool, + include_sensitive: bool, + include_archives: bool, + patterns: list[str], +) -> str | None: + parts = relative.parts + lower_parts = tuple(part.lower() for part in parts) + if any(part == ".git" for part in lower_parts): + return "git_metadata" + if any(part in _ALWAYS_EXCLUDED_DIRS for part in lower_parts[:-1]): + return "dependency_or_build_output" + if not include_hidden and any(part.startswith(".") for part in parts): + return "hidden" + if any(_matches_user_pattern(relative, pattern) for pattern in patterns): + return "user_pattern" + name = relative.name.lower() + if not include_sensitive and ( + name in _SENSITIVE_NAMES + or any(fnmatch.fnmatch(name, pattern) for pattern in _SENSITIVE_PATTERNS) + or any( + lower_parts[-len(suffix) :] == suffix + for suffix in _SENSITIVE_PATH_SUFFIXES + if len(lower_parts) >= len(suffix) + ) + ): + return "sensitive_filename" + if not include_archives and name.endswith(_ARCHIVE_SUFFIXES): + return "nested_archive" + return None + + +def _matches_user_pattern(relative: Path, pattern: str) -> bool: + """Match exclude globs, including intuitive trailing-slash directory rules.""" + relative_posix = relative.as_posix() + posix = PurePosixPath(relative_posix) + if pattern.endswith("/"): + directory_pattern = pattern.rstrip("/") + if not directory_pattern: + return False + return ( + posix.match(directory_pattern) + or fnmatch.fnmatch(relative_posix, directory_pattern) + or any( + PurePosixPath(parent.as_posix()).match(directory_pattern) + or fnmatch.fnmatch(parent.as_posix(), directory_pattern) + for parent in posix.parents + if parent != PurePosixPath(".") + ) + ) + return posix.match(pattern) or fnmatch.fnmatch(relative_posix, pattern) + + +def _write_archive(destination: Path, files: tuple[SelectedFile, ...]) -> None: + with zipfile.ZipFile( + destination, "w", compression=zipfile.ZIP_DEFLATED, compresslevel=6 + ) as archive: + for item in files: + flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) + try: + descriptor = os.open(item.path, flags) + except OSError as exc: + raise http.CloudError(f"could not safely read {item.archive_name}: {exc}") from exc + with os.fdopen(descriptor, "rb") as source_file: + current = os.fstat(source_file.fileno()) + if ( + not stat.S_ISREG(current.st_mode) + or current.st_size != item.size + or current.st_dev != item.device + or current.st_ino != item.inode + or current.st_mtime_ns != item.mtime_ns + or current.st_ctime_ns != item.ctime_ns + ): + raise http.CloudError( + f"{item.archive_name} changed while the source archive was being built; " + "retry." + ) + info = zipfile.ZipInfo(item.archive_name) + info.compress_type = zipfile.ZIP_DEFLATED + info.external_attr = 0o100644 << 16 + with archive.open(info, "w", force_zip64=True) as target: + remaining = item.size + while remaining: + chunk = source_file.read(min(1024 * 1024, remaining)) + if not chunk: + raise http.CloudError( + f"{item.archive_name} changed while the source archive was being " + "built; retry." + ) + target.write(chunk) + remaining -= len(chunk) + final = os.fstat(source_file.fileno()) + if ( + source_file.read(1) + or not stat.S_ISREG(final.st_mode) + or final.st_size != item.size + or final.st_dev != item.device + or final.st_ino != item.inode + or final.st_mtime_ns != item.mtime_ns + or final.st_ctime_ns != item.ctime_ns + ): + raise http.CloudError( + f"{item.archive_name} changed while the source archive was being " + "built; retry." + ) + + +def _sha256(path: Path) -> str: + digest = hashlib.sha256() + with path.open("rb") as stream: + for chunk in iter(lambda: stream.read(1024 * 1024), b""): + digest.update(chunk) + return digest.hexdigest() + + +def _has_archive_magic(path: Path) -> bool: + """Recognize common archive containers even when their suffix is disguised.""" + flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) + try: + descriptor = os.open(path, flags) + with os.fdopen(descriptor, "rb") as stream: + header = stream.read(512) + except OSError: + return False + return header.startswith(_ARCHIVE_MAGIC_PREFIXES) or header[257:262] == b"ustar" + + +def _load_ignore_patterns(source: Path) -> list[str]: + path = source / ".strixignore" + raw_text = _read_ignore_file(path) + if raw_text is None: + return [] + if len(raw_text) > MAX_IGNORE_BYTES: + raise http.CloudError(f"{path} is larger than the {MAX_IGNORE_BYTES:,}-byte limit.") + try: + lines = raw_text.decode("utf-8").splitlines() + except UnicodeDecodeError as exc: + raise http.CloudError(f"{path} must be UTF-8 text.") from exc + patterns: list[str] = [] + for line_number, raw in enumerate(lines, start=1): + value = raw.strip() + if not value or value.startswith("#"): + continue + if value.startswith("!"): + raise http.CloudError( + f"{path}:{line_number}: negated patterns are not supported; use exclude-only globs." + ) + patterns.append(value) + if len(patterns) > MAX_IGNORE_PATTERNS: + raise http.CloudError( + f"{path} contains more than {MAX_IGNORE_PATTERNS:,} exclusion patterns." + ) + return patterns + + +def _read_ignore_file(path: Path) -> bytes | None: + """Read a bounded regular ignore file without blocking on a FIFO or device.""" + try: + descriptor = os.open( + path, + os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0), + ) + except FileNotFoundError: + return None + except OSError as exc: + raise http.CloudError(f"could not read {path}: {exc}") from exc + try: + info = os.fstat(descriptor) + except OSError as exc: + os.close(descriptor) + raise http.CloudError(f"could not inspect {path}: {exc}") from exc + if not stat.S_ISREG(info.st_mode): + os.close(descriptor) + raise http.CloudError(f"{path} must be a regular file.") + try: + stream = os.fdopen(descriptor, "rb") + except OSError as exc: + os.close(descriptor) + raise http.CloudError(f"could not read {path}: {exc}") from exc + try: + return stream.read(MAX_IGNORE_BYTES + 1) + except OSError as exc: + raise http.CloudError(f"could not read {path}: {exc}") from exc + finally: + stream.close() + + +def _validate_patterns(patterns: list[str]) -> None: + if len(patterns) > MAX_IGNORE_PATTERNS: + raise http.CloudError( + f"source upload accepts at most {MAX_IGNORE_PATTERNS:,} exclusion patterns." + ) + for pattern in patterns: + if len(pattern) > MAX_IGNORE_PATTERN_CHARS: + raise http.CloudError( + "source exclusion patterns must be at most " + f"{MAX_IGNORE_PATTERN_CHARS:,} characters each." + ) + if "\x00" in pattern: + raise http.CloudError("source exclusion patterns cannot contain NUL bytes.") diff --git a/strix/interface/cloud/spec.py b/strix/interface/cloud/spec.py new file mode 100644 index 000000000..c9ec5d2bf --- /dev/null +++ b/strix/interface/cloud/spec.py @@ -0,0 +1,1148 @@ +"""Declarative command table for `strix cloud`. + +Each command maps one CLI verb to one managed API operation. The runner +builds the argument parser and the HTTP request from this table, so the +CLI surface stays aligned with the OpenAPI specification. +""" + +from __future__ import annotations + +from dataclasses import dataclass + + +@dataclass(frozen=True) +class P: + """One command parameter. + + ``kind`` is one of ``str``, ``int``, ``float``, ``bool``, ``list``, ``json``, + or ``json-list``. + """ + + name: str + kind: str = "str" + required: bool = False + help: str = "" + # Command-line name when the field name collides with a common option. + flag: str | None = None + + +@dataclass(frozen=True) +class Cmd: + method: str + path: str + help: str + query: tuple[P, ...] = () + body: tuple[P, ...] = () + binary: bool = False + wait_path: str | None = None + # When true, `--wait` polls GET on this same path until the status is final. + wait_self: bool = False + # Response field that holds a URL a person must open, for example a hosted + # checkout page. The runner opens the browser for an interactive terminal + # and always prints the URL. + link: str | None = None + # Caller retries for this mutation must carry one stable opaque key. The + # platform binds it to the authenticated actor and exact request body. + idempotent: bool = False + + +def _q(*names: str) -> tuple[P, ...]: + return tuple(P(name) for name in names) + + +_SCAN_START_BODY = ( + P( + "engagement_type", + help=("Test category: code_review, live_test, internal_infra, or compliance_pentest."), + ), + P("domain_ids", "list", help="Domain asset IDs to test."), + P("domain_paths", "json", help="JSON map of domain ID to start paths."), + P("repository_ids", "list", help="Repository asset IDs to test."), + P("repository_branches", "json", help="JSON map of repository ID to branch."), + P("credentials", "json", help="JSON list of credential objects."), + P( + "headers", + "json", + help='JSON array of target header objects: [{"name":"...","value":"...","notes":"..."}].', + ), + P("concerns", help="Free-form security concerns to investigate."), + P("focus", help="Free-form focus instructions for the agents."), + P("context", help="Extra context about the target."), + P("upload_ids", "list", help="Upload IDs to attach to the scan."), + P("connector_id", help="Network connector ID for internal targets."), + P("internal_targets", "list", help="Internal IP addresses or ranges."), + P("org_knowledge_enabled", "bool", help="Use the organization knowledge base."), + P("notify_on_completion", "bool", help="Send an email when the scan completes."), + P("notification_emails", "list", help="Extra notification email addresses."), + P( + "scan_tier", + help=( + "Scan tier: lite, standard, or ultra (default). " + "Not used for Enterprise or self-hosted scans." + ), + ), + P("model_config_id", help="Self-hosted only: model configuration ID to run with."), + P("max_budget_usd", "float", help="Self-hosted only: budget limit for the scan in USD."), +) + +_TEST_USER_ADD_BODY = ( + P("label", required=True, help="Display label for the test user."), + P("username", required=True, help="Sign-in username or email address."), + P("password", help="Sign-in password."), + P("notes", help="Free-form notes for the agents."), + P("login_url", help="URL of the sign-in page."), + P("mfa_method", help="MFA method: none, totp, email_otp, or magic_link."), + P("totp_secret", help="TOTP secret for MFA sign-in."), + P("mfa_email", help="Email address that receives MFA codes."), + P("scope_domain_ids", "list", help="Domain IDs where this user applies."), +) + +_TEST_USER_BODY = ( + P("label", help="Display label for the test user."), + P("username", help="Sign-in username or email address."), + P("password", help="Sign-in password."), + P("notes", help="Free-form notes for the agents."), + P("login_url", help="URL of the sign-in page."), + P("mfa_method", help="MFA method: none, totp, email_otp, or magic_link."), + P("totp_secret", help="TOTP secret for MFA sign-in."), + P("mfa_email", help="Email address that receives MFA codes."), + P("scope_domain_ids", "list", help="Domain IDs where this user applies."), +) + +_GIT_TOKEN_BODY = ( + P("access_token", required=True, help="Provider access token.", flag="provider-token"), + P("instance_url", help="GitLab base URL, for example https://gitlab.com."), + P("account_email", help="Bitbucket account email address."), + P("installation_id", "int", help="Existing installation ID to update."), +) + + +SPEC: dict[str, dict[str, Cmd]] = { + "scans": { + "list": Cmd( + "GET", + "/scans", + "List scans.", + query=( + P("page", "int", help="Results page (starts at 1)."), + P("limit", "int", help="Results per page (1-100)."), + *_q( + "status", + "scan_type", + "date_from", + "date_to", + "domain_id", + "repository_id", + "search", + ), + P("include_retests", "bool", help="Include per-finding retest scans."), + P("sort_by", help="Sort key; currently created_at."), + P("sort_order", help="Sort order: asc or desc."), + ), + ), + "start": Cmd( + "POST", + "/scans", + "Start a scan.", + body=_SCAN_START_BODY, + wait_path="/scans/{id}", + idempotent=True, + ), + "get": Cmd("GET", "/scans/{scanId}", "Get one scan."), + "delete": Cmd("DELETE", "/scans/{scanId}", "Delete a scan."), + "agents": Cmd("GET", "/scans/{scanId}/agents", "List the agents of a scan."), + "cancel": Cmd("POST", "/scans/{scanId}/cancel", "Cancel a running scan."), + "message": Cmd( + "POST", + "/scans/{scanId}/message", + "Send a message to the scan agents.", + body=( + P( + "message", + help="Message text for the agents. Required unless --cancel-current is used.", + ), + P("cancel_current", "bool", help="Cancel the current task before delivery."), + P("agent_id", help="Target one agent instead of the root agent."), + ), + ), + "report": Cmd( + "GET", + "/scans/{scanId}/report", + "Download the scan report.", + query=( + P( + "format", + help=( + "Report content: technical (default), retest, attestation, or " + "executive_summary. Advanced formats require Enterprise." + ), + ), + P( + "type", + help="Rendered file type: pdf (default) or docx. DOCX requires Enterprise.", + ), + P( + "providerName", + flag="provider-name", + help="Enterprise report-cover provider name (up to 80 characters).", + ), + P( + "memberName0", + flag="member-name-0", + help="First Enterprise report preparer's name (up to 120 characters).", + ), + P( + "memberEmail0", + flag="member-email-0", + help="First Enterprise report preparer's email address.", + ), + P( + "memberName1", + flag="member-name-1", + help="Second Enterprise report preparer's name (up to 120 characters).", + ), + P( + "memberEmail1", + flag="member-email-1", + help="Second Enterprise report preparer's email address.", + ), + ), + binary=True, + ), + "rerun": Cmd( + "POST", + "/scans/{scanId}/rerun", + "Run the scan again.", + wait_path="/scans/{id}", + idempotent=True, + ), + "retest-all": Cmd( + "POST", + "/scans/{scanId}/retest-all", + "Retest all open findings of a scan.", + body=( + P("scope", help="Retest scope."), + P("upload_ids", "list", help="Upload IDs with updated code."), + ), + ), + "retests": Cmd("GET", "/scans/{scanId}/retests", "List the retests of a scan."), + "sarif": Cmd( + "GET", + "/scans/{scanId}/sarif", + "Download the scan findings as SARIF.", + query=_q("repository"), + binary=True, + ), + "sarif-upload": Cmd( + "POST", + "/scans/{scanId}/sarif", + "Upload the scan findings to GitHub code scanning.", + body=( + P("repository", help="Repository full name."), + P("ref", help="Git ref for the upload."), + P("commit_sha", help="Commit SHA for the upload."), + P("checkout_uri", help="Checkout URI for the upload."), + P("github_api_base_url", help="GitHub API base URL."), + ), + ), + "template": Cmd("GET", "/scans/{scanId}/template", "Get the scan configuration template."), + "trace": Cmd( + "GET", + "/scans/{scanId}/trace", + "List trace events for one agent of a scan.", + query=( + P("agent_id", required=True, help="Agent ID to read the trace for."), + P("cursor"), + P("limit", "int"), + P("tool_name"), + ), + ), + "trace-event": Cmd( + "GET", "/scans/{scanId}/trace/{eventId}", "Get one trace event of a scan." + ), + }, + "vulns": { + "list": Cmd( + "GET", + "/vulnerabilities", + "List vulnerabilities.", + query=( + P("page", "int", help="Results page (starts at 1)."), + P("limit", "int", help="Results per page (1-100)."), + *_q( + "scan_id", + "severity", + "status", + "search", + "from", + "to", + "domain_id", + "repository_id", + "finding_type", + "dependency_relation", + "reachability", + "sort_by", + ), + P("sort_order", help="Sort order: asc or desc."), + ), + ), + "get": Cmd("GET", "/vulnerabilities/{vulnerabilityId}", "Get one vulnerability."), + "history": Cmd( + "GET", + "/vulnerabilities/{vulnerabilityId}/history", + "Get the change history of a vulnerability.", + ), + "update": Cmd( + "PATCH", + "/vulnerabilities/{vulnerabilityId}", + "Update the status or severity of a vulnerability.", + body=( + P( + "status", + help=( + "New status: open, in_progress, snoozed, fixed, ignored, or not_affected." + ), + ), + P("note", help="Note that explains the change."), + P("severity", help="New severity."), + P("severity_reason", help="Reason for the severity change."), + ), + ), + "retest": Cmd( + "POST", + "/vulnerabilities/{vulnerabilityId}/retest", + "Retest one vulnerability.", + body=(P("upload_ids", "list", help="Upload IDs with updated code."),), + wait_path="/scans/{id}", + ), + "fix-pr": Cmd( + "POST", + "/vulnerabilities/{vulnerabilityId}/create-fix-pr", + "Create a fix pull request for a vulnerability.", + ), + "push": Cmd( + "POST", + "/vulnerabilities/{vulnerabilityId}/push", + "Push one vulnerability to an issue tracker.", + body=( + P("provider", required=True, help="Tracker provider, for example jira or linear."), + P("collection_id", help="Tracker project or collection ID."), + ), + ), + "push-bulk": Cmd( + "POST", + "/vulnerabilities/bulk-push", + "Push many vulnerabilities to an issue tracker.", + body=( + P("provider", required=True, help="Tracker provider, for example jira or linear."), + P("vulnerability_ids", "list", required=True, help="Vulnerability IDs to push."), + P("collection_id", help="Tracker project or collection ID."), + ), + ), + }, + "domains": { + "list": Cmd( + "GET", + "/domains", + "List domain assets.", + query=( + P("page", "int", help="Results page (starts at 1)."), + P("limit", "int", help="Results per page (1-100)."), + *_q("search", "verified", "business_unit", "tags", "sort_by"), + P("sort_order", help="Sort order: asc or desc."), + ), + ), + "add": Cmd( + "POST", + "/domains", + "Add a domain asset.", + body=( + P("domain", required=True, help="Domain name or URL."), + P("asset_type", required=True, help="Asset type, for example web_app or api."), + P("context", help="Extra context about the asset."), + P("tags", "list", help="Tags for the asset."), + P("business_unit", help="Business unit for the asset."), + ), + ), + "update": Cmd( + "PATCH", + "/domains/{domainId}", + "Update a domain asset.", + body=( + P("context", help="Extra context about the asset."), + P("tags", "list", help="Tags for the asset."), + P("business_unit", help="Business unit for the asset."), + ), + ), + "remove": Cmd("DELETE", "/domains/{domainId}", "Remove a domain asset."), + "verify": Cmd("POST", "/domains/{domainId}/verify", "Verify domain ownership."), + "auto-verify": Cmd( + "POST", + "/domains/{domainId}/auto-verify", + "Verify domain ownership through a DNS provider.", + body=(P("provider", required=True, help="DNS provider name."),), + ), + "test-users list": Cmd( + "GET", "/domains/{domainId}/test-users", "List the test users of a domain." + ), + "test-users add": Cmd( + "POST", + "/domains/{domainId}/test-users", + "Add a test user to a domain.", + body=_TEST_USER_ADD_BODY, + ), + "test-users update": Cmd( + "PATCH", + "/domains/{domainId}/test-users/{userId}", + "Update a test user.", + body=_TEST_USER_BODY, + ), + "test-users remove": Cmd( + "DELETE", "/domains/{domainId}/test-users/{userId}", "Remove a test user." + ), + "test-users provision-inbox": Cmd( + "POST", + "/domains/{domainId}/test-users/provision-inbox", + ( + "Provision a Strix-managed inbox for email OTP or magic-link MFA. " + "Returns an address; it does not create a test user." + ), + body=(P("label", help="Optional display label for the managed inbox."),), + ), + "test-users inbox": Cmd( + "GET", + "/domains/{domainId}/test-users/{userId}/inbox", + "List the inbox messages of a test user.", + query=(P("limit", "int"),), + ), + "test-users inbox-message": Cmd( + "GET", + "/domains/{domainId}/test-users/{userId}/inbox/{messageId}", + "Get one inbox message of a test user.", + ), + "test-users verify": Cmd( + "POST", + "/domains/{domainId}/test-users/{userId}/verify", + "Verify that the test user credentials work.", + query=(P("force"),), + wait_self=True, + ), + "test-users verify-status": Cmd( + "GET", + "/domains/{domainId}/test-users/{userId}/verify", + "Get the verification status of a test user.", + ), + }, + "repos": { + "list": Cmd( + "GET", + "/repositories", + "List repository assets.", + query=( + P("page", "int", help="Results page (starts at 1)."), + P("limit", "int", help="Results per page (1-100)."), + *_q("search", "business_unit", "tags", "sort_by"), + P("sort_order", help="Sort order: asc or desc."), + ), + ), + "add": Cmd("POST", "/repositories", "Add a repository asset. Use --data for the fields."), + "update": Cmd( + "PATCH", + "/repositories/{repositoryId}", + "Update a repository asset.", + body=( + P("pr_review_enabled", "bool", help="Turn PR reviews on or off."), + P("pr_review_approvals_enabled", "bool", help="Let reviews approve clean PRs."), + P("pr_review_non_blocking", "bool", help="Make review verdicts non-blocking."), + P("pr_review_on_push", "bool", help="Review new pushes to open PRs."), + P("tags", "list", help="Tags for the asset."), + P("business_unit", help="Business unit for the asset."), + ), + ), + "remove": Cmd("DELETE", "/repositories/{repositoryId}", "Remove a repository asset."), + "supply-chain scan": Cmd( + "POST", + "/repositories/{repositoryId}/supply-chain/scan", + "Start a supply-chain scan for a repository.", + ), + "supply-chain summary": Cmd( + "GET", + "/repositories/{repositoryId}/supply-chain/summary", + "Get the supply-chain summary of a repository.", + query=_q("job_id", "snapshot_id"), + ), + "supply-chain findings": Cmd( + "GET", + "/repositories/{repositoryId}/supply-chain/findings", + "List the supply-chain findings of a repository.", + query=_q("job_id", "snapshot_id", "component_id"), + ), + "supply-chain components": Cmd( + "GET", + "/repositories/{repositoryId}/supply-chain/components", + "List the dependency components of a repository.", + query=( + *_q( + "job_id", + "snapshot_id", + "component_id", + "ecosystem", + "status", + "relationship", + "source_file", + "q", + "changed", + ), + P("limit", "int", help="Maximum components to return."), + P("offset", "int", help="Number of components to skip."), + ), + ), + "supply-chain sbom": Cmd( + "GET", + "/repositories/{repositoryId}/supply-chain/sbom", + "Download the SBOM of a repository.", + query=_q("job_id", "snapshot_id", "format"), + binary=True, + ), + "supply-chain policy": Cmd( + "PATCH", + "/repositories/{repositoryId}/supply-chain/policy", + "Update the supply-chain policy of a repository.", + body=( + P("supply_chain_enabled", "bool", help="Turn supply-chain scans on or off."), + P("supply_chain_pr_checks_enabled", "bool", help="Run checks on pull requests."), + P("supply_chain_policy_mode", help="Policy mode for new findings."), + ), + ), + }, + "supply-chain": { + "summary": Cmd( + "GET", "/supply-chain/summary", "Get the organization supply-chain summary." + ), + }, + "schedules": { + "list": Cmd("GET", "/schedules", "List scan schedules."), + "create": Cmd( + "POST", + "/schedules", + "Create a scan schedule. Use --data for the fields.", + idempotent=True, + ), + "get": Cmd("GET", "/schedules/{scheduleId}", "Get one schedule."), + "update": Cmd( + "PATCH", + "/schedules/{scheduleId}", + "Update a schedule. Use --data for fields that have no option.", + body=( + P("action", help="Lifecycle action, for example pause or resume."), + P("cron_expression", help="Cron expression for the schedule."), + P("timezone", help="Time zone for the cron expression."), + P("name", help="Display name of the schedule."), + P( + "max_budget_usd", + "float", + help=( + "Self-hosted only: budget limit per run in USD. " + "Use --data to set null and clear it." + ), + ), + P("scan_tier", help="Scan tier: lite, standard, or ultra."), + ), + ), + "delete": Cmd("DELETE", "/schedules/{scheduleId}", "Delete a schedule."), + "template": Cmd( + "GET", "/schedules/{scheduleId}/template", "Get the schedule configuration template." + ), + "trigger": Cmd( + "POST", + "/schedules/{scheduleId}/trigger", + "Run a schedule now.", + idempotent=True, + ), + }, + "pr-reviews": { + "list": Cmd( + "GET", + "/pr-reviews", + "List PR reviews.", + query=( + P("page", "int", help="Results page (starts at 1)."), + P("limit", "int", help="Results per page (1-100)."), + *_q( + "search", + "status", + "group", + "pr_state", + "repository_full_name", + "date_from", + "date_to", + "sort_by", + "sort_order", + ), + P("include_counts", "bool", help="Include exact disposition counts."), + ), + ), + "get": Cmd("GET", "/pr-reviews/{prReviewId}", "Get one PR review."), + "findings": Cmd( + "GET", + "/pr-reviews/findings", + "List PR review findings.", + query=( + P("page", "int", help="Results page (starts at 1)."), + P("limit", "int", help="Results per page (1-100)."), + *_q("severity", "pr_state", "search", "repository_full_name"), + P("include_stats", "bool", help="Include all-time impact statistics."), + ), + ), + "start": Cmd( + "POST", + "/pr-reviews/start", + "Start a PR review.", + body=( + P("provider", required=True, help="Git provider: github, gitlab, or bitbucket."), + P("installation_id", "int", required=True, help="Provider installation ID."), + P("repository_full_name", required=True, help="Repository full name."), + P("pr_number", "int", required=True, help="Pull request number."), + ), + ), + "settings": Cmd("GET", "/pr-reviews/settings", "Get the PR review settings."), + "settings update": Cmd( + "PATCH", + "/pr-reviews/settings", + "Update the PR review settings. Use --data for fields that have no option.", + body=( + P("review_on_push", "bool", help="Review new pushes to open PRs."), + P("block_on_findings", "bool", help="Block PRs that have findings."), + P("blocking_severities", "list", help="Severities that block a PR."), + P("approve_clean_prs", "bool", help="Approve PRs without findings."), + P("target_branches", "list", help="Branches that get reviews."), + ), + ), + }, + "billing": { + "credits": Cmd("GET", "/billing/credits", "Get the credit balance of the workspace."), + "topup": Cmd( + "POST", + "/billing/topup", + "Buy credits with an agent payment (HTTP 402 flow).", + body=(P("credits", "int", required=True, help="Number of credits to buy."),), + ), + "subscribe": Cmd( + "POST", + "/billing/checkout", + "Create a checkout link for a plan or a credit pack. A person completes the payment.", + body=( + P( + "product", + required=True, + flag="plan", + help="Product to buy: strix_cloud, strix_startup, or strix_top_up.", + ), + P("success_url", help="Page to open after the payment."), + ), + link="checkout_url", + ), + "portal": Cmd( + "POST", + "/billing/portal", + "Create a billing portal link. A person manages the card and the plan there.", + link="portal_url", + ), + "auto-topup": Cmd("GET", "/billing/auto-topup", "Get the automatic top-up settings."), + "auto-topup update": Cmd( + "PUT", + "/billing/auto-topup", + "Update the automatic top-up settings.", + body=( + P("enabled", "bool", required=True, help="Turn automatic top-up on or off."), + P("topup_credits", "int", required=True, help="Credits to buy on each top-up."), + P("monthly_cap_credits", "int", help="Monthly credit cap for automatic top-ups."), + ), + ), + }, + "chat": { + "list": Cmd("GET", "/chat", "List chat sessions."), + "start": Cmd( + "POST", + "/chat", + "Start a chat session.", + body=( + P("message", required=True, help="First message of the session."), + P( + "repos", + "json", + help='JSON array of repository refs: [{"repoId":"...","branch":"main"}].', + ), + P("domain_ids", "list", help="Domain asset IDs for context."), + ), + ), + "get": Cmd("GET", "/chat/{chatId}", "Get one chat session."), + "send": Cmd( + "POST", + "/chat/{chatId}/message", + "Send a message in a chat session.", + body=( + P( + "message", + help="Message text. Required unless --cancel-current or --stop-agent is used.", + ), + P("cancel_current", "bool", help="Cancel the in-flight agent turn first."), + P("stop_agent", "bool", help="Park the target agent and its descendants."), + P( + "repos", + "json", + help='JSON array of repository refs: [{"repoId":"...","branch":"main"}].', + ), + P("agent_id", help="Target one subagent instead of the root agent."), + ), + ), + "findings": Cmd("GET", "/chat/{chatId}/findings", "List the findings of a chat session."), + "finding": Cmd( + "GET", "/chat/{chatId}/findings/{findingId}", "Get one finding of a chat session." + ), + "finding file": Cmd( + "POST", + "/chat/{chatId}/findings/{findingId}/file", + "File a chat finding into the organization issue list.", + ), + "files": Cmd("GET", "/chat/{chatId}/files", "List the files of a chat session."), + "files download": Cmd( + "GET", + "/chat/{chatId}/files/download", + "Download one file of a chat session.", + query=( + P( + "path", + required=True, + help="Relative path in the session, or an absolute path under /workspace.", + ), + ), + binary=True, + ), + "files archive": Cmd( + "GET", + "/chat/{chatId}/files/archive", + "Download all files of a chat session as an archive.", + binary=True, + ), + "credentials": Cmd( + "GET", + "/chat/{chatId}/credentials", + "Get the credentials of a chat session.", + query=_q("scan_ids"), + ), + "credentials set": Cmd( + "POST", + "/chat/{chatId}/credentials", + "Set the credentials of a chat session.", + body=( + P("test_user_ids", "list", help="Test user IDs to attach."), + P("credentials", "json", help="JSON list of credential objects."), + P("scan_ids", "list", help="Scan IDs that use the credentials."), + ), + ), + "credentials clear": Cmd( + "DELETE", "/chat/{chatId}/credentials", "Remove the credentials of a chat session." + ), + "domains set": Cmd( + "PUT", + "/chat/{chatId}/domains", + "Set the domains of a chat session.", + body=(P("domain_ids", "list", help="Domain asset IDs."),), + ), + "terminal": Cmd( + "POST", + "/chat/{chatId}/terminal", + "Run a command in the chat session sandbox.", + body=( + P("command", required=True, help="Shell command to run."), + P("cwd", help="Working directory for the command."), + ), + ), + "share": Cmd("POST", "/chat/{chatId}/share", "Create a share link for a chat session."), + }, + "knowledge": { + "list": Cmd( + "GET", + "/knowledge", + "List knowledge documents.", + query=( + *_q("source_type", "search"), + P("limit", "int", help="Maximum documents to return."), + ), + ), + "add": Cmd( + "POST", + "/knowledge", + "Add a knowledge document.", + body=( + P("title", required=True, help="Document title."), + P("content", required=True, help="Document content."), + P("tags", "list", help="Tags for the document."), + P("metadata", "json", help="JSON metadata for the document."), + ), + ), + "update": Cmd( + "PATCH", + "/knowledge/{documentId}", + "Update a knowledge document.", + body=( + P("title", help="Document title."), + P("content", help="Document content."), + P("tags", "list", help="Tags for the document."), + P("metadata", "json", help="JSON metadata for the document."), + ), + ), + "delete": Cmd("DELETE", "/knowledge/{documentId}", "Delete a knowledge document."), + "policies": Cmd("GET", "/knowledge/policies", "List knowledge policies."), + "policies add": Cmd( + "POST", + "/knowledge/policies", + "Add a knowledge policy.", + body=( + P("policy_key", required=True, flag="key", help="Policy key."), + P("policy_value", required=True, flag="content", help="Policy content."), + P("policy_type", help="Policy type. Defaults to constraint."), + P("is_active", "bool", flag="enabled", help="Turn the policy on or off."), + P("metadata", "json", help="JSON metadata for the policy."), + ), + ), + "policies delete": Cmd( + "DELETE", "/knowledge/policies/{policyKey}", "Delete a knowledge policy." + ), + "repos": Cmd("GET", "/knowledge/repos", "List repositories with knowledge entries."), + "repos entries": Cmd( + "GET", "/knowledge/repos/{repo}/entries", "List the knowledge entries of a repository." + ), + "repos profile": Cmd( + "PATCH", + "/knowledge/repos/{repo}/profile", + "Update the knowledge profile of a repository. Use --data for the fields.", + ), + }, + "org": { + "get": Cmd("GET", "/organization", "Get the organization."), + "update": Cmd( + "PATCH", + "/organization", + "Update the organization.", + body=(P("name", required=True, help="Organization name."),), + ), + "members": Cmd("GET", "/organization/members", "List the organization members."), + "members invite": Cmd( + "POST", + "/organization/members", + "Invite a member to the organization.", + body=( + P("email", required=True, help="Email address of the new member."), + P("role", help="Member role, for example admin, analyst, or viewer."), + P("scopes", "list", help="RBAC scopes for the member."), + ), + ), + "members update": Cmd( + "PATCH", + "/organization/members/{membershipId}", + "Update a member of the organization.", + body=( + P("role", required=True, help="Member role."), + P("scopes", "list", help="RBAC scopes for the member."), + ), + ), + "members remove": Cmd("DELETE", "/organization/members/{membershipId}", "Remove a member."), + "invitations": Cmd("GET", "/organization/invitations", "List open invitations."), + "invitations revoke": Cmd( + "DELETE", "/organization/invitations/{invitationId}", "Revoke an invitation." + ), + }, + "integrations": { + "list": Cmd("GET", "/integrations", "List the connected integrations."), + "connect": Cmd( + "POST", + "/integrations/{provider}/connect", + "Connect a Git provider. The provider is gitlab or bitbucket.", + body=_GIT_TOKEN_BODY, + ), + "validate": Cmd( + "POST", + "/integrations/{provider}/validate", + "Validate a Git provider token. The provider is gitlab or bitbucket.", + body=_GIT_TOKEN_BODY, + ), + "install": Cmd( + "POST", + "/integrations/{provider}/install-url", + "Create an installation link. The provider is github or slack. A person approves it.", + link="url", + ), + "disconnect": Cmd( + "DELETE", + "/integrations/{provider}", + "Disconnect an integration.", + query=( + P( + "installation_id", + "int", + help=( + "Installation ID. Required for github, gitlab, and bitbucket; " + "unsupported for other providers." + ), + ), + ), + ), + }, + "connectors": { + "list": Cmd("GET", "/connectors", "List network connectors."), + "create": Cmd( + "POST", + "/connectors", + "Create a network connector.", + body=(P("name", required=True, help="Connector name."),), + ), + "get": Cmd( + "GET", + "/connectors/{connectorId}", + "Get one network connector.", + query=( + P( + "include_command", + "bool", + help=( + "Include the one-time Docker enrollment command. " + "The command contains sensitive connector credentials." + ), + ), + ), + ), + "status": Cmd( + "GET", "/connectors/{connectorId}/status", "Get the status of a network connector." + ), + "delete": Cmd("DELETE", "/connectors/{connectorId}", "Delete a network connector."), + }, + "webhooks": { + "list": Cmd("GET", "/webhooks", "List webhooks."), + "create": Cmd( + "POST", + "/webhooks", + "Create a webhook.", + body=( + P("url", required=True, help="Delivery URL."), + P("events", "list", required=True, help="Event names to deliver."), + P("business_unit", help="Business unit filter."), + P("is_active", "bool", help="Turn the webhook on or off."), + ), + ), + "get": Cmd("GET", "/webhooks/{webhookId}", "Get one webhook."), + "update": Cmd( + "PATCH", + "/webhooks/{webhookId}", + "Update a webhook.", + body=( + P("url", help="Delivery URL."), + P("events", "list", help="Event names to deliver."), + P("business_unit", help="Business unit filter."), + P("is_active", "bool", help="Turn the webhook on or off."), + P("rotate_secret", "bool", help="Create a new signing secret."), + ), + ), + "delete": Cmd("DELETE", "/webhooks/{webhookId}", "Delete a webhook."), + "deliveries": Cmd( + "GET", + "/webhooks/{webhookId}/deliveries", + "List the deliveries of a webhook.", + query=( + P("page", "int", help="Results page (starts at 1)."), + P("limit", "int", help="Results per page (1-100)."), + ), + ), + }, + "analytics": { + "overview": Cmd( + "GET", + "/analytics/overview", + "Get the analytics overview.", + query=_q("range", "from", "to"), + ), + "stats": Cmd("GET", "/analytics/stats", "Get the analytics statistics."), + "scan-frequency": Cmd( + "GET", "/analytics/scan-frequency", "Get the scan frequency data.", query=_q("tz") + ), + }, + "audit": { + "list": Cmd( + "GET", + "/audit", + "List audit log entries.", + query=( + P("page", "int", help="Results page (starts at 1)."), + P("limit", "int", help="Results per page (1-1000)."), + *_q("action", "resource_type", "actor_id", "date_from", "date_to"), + P( + "format", + help="Output format: json, csv, ndjson, jsonl, snowflake, or splunk.", + ), + P("all", "bool", help="Stream all matches when exporting instead of one page."), + ), + ), + }, + "costs": { + "overview": Cmd( + "GET", + "/llm-costs", + "Self-hosted only: show the LLM cost overview.", + query=_q("range", "from", "to"), + ), + "run": Cmd( + "GET", + "/llm-costs/runs/{runType}/{runId}", + "Self-hosted only: get the LLM costs of one run.", + ), + }, + "llm-settings": { + "get": Cmd("GET", "/llm-settings", "Self-hosted only: get the LLM settings."), + "update": Cmd( + "PUT", + "/llm-settings", + "Self-hosted only: update the LLM settings.", + body=( + P( + "modelConfigs", + "json", + required=True, + flag="model-configs", + help="JSON list of model configurations.", + ), + P("assignments", "json", required=True, help="JSON map of model assignments."), + ), + ), + }, + "settings": { + "notifications": Cmd("GET", "/settings/notifications", "Get the notification settings."), + "notifications update": Cmd( + "PATCH", + "/settings/notifications", + "Update the notification settings.", + body=( + P("sla_reminders_enabled", "bool", help="Turn SLA reminders on or off."), + P("sla_reminder_email", "bool", help="Send SLA reminders by email."), + P("sla_reminder_slack", "bool", help="Send SLA reminders to Slack."), + P("sla_warning_days", "int", help="Days before an SLA warning."), + ), + ), + }, + "license": { + "show": Cmd("GET", "/license", "Get the license information."), + }, + "tokens": { + "list": Cmd("GET", "/tokens", "List API tokens.", query=_q("type")), + "create": Cmd( + "POST", + "/tokens", + "Create an API token.", + body=( + P("type", required=True, help="Token type, personal or service."), + P("name", required=True, help="Token name."), + P("scopes", "list", help="API scopes for the token."), + P( + "rbac_scopes", + "json-list", + help=( + "JSON array of resource restrictions; each item has type " + "target, tag, or business_unit and a value." + ), + ), + P( + "expires_at", + help=( + "Absolute expiration date/time (ISO 8601; mutually exclusive " + "with --expires-in-days)." + ), + ), + P("expires_in_days", "int", help="Days until the token expires."), + ), + ), + "revoke": Cmd("DELETE", "/tokens/{tokenId}", "Revoke an API token."), + }, + "uploads": { + "request": Cmd( + "POST", + "/uploads/request", + "Request an upload URL. To scan local source, prefer `strix cloud scans start " + "--source DIR`, which packs, uploads, and starts the scan in one step.", + body=( + P("file_name", required=True, help="File name."), + P("file_size", "int", required=True, help="File size in bytes."), + P("category", help="Upload category."), + ), + ), + "complete": Cmd( + "POST", + "/uploads/complete", + "Mark an upload as complete.", + body=(P("upload_id", required=True, help="Upload ID."),), + ), + "delete": Cmd("DELETE", "/uploads/{uploadId}", "Delete an upload."), + }, + "workspaces": { + "list": Cmd("GET", "/workspaces", "List the workspaces of your account."), + "create": Cmd( + "POST", + "/workspaces", + "Create a workspace and become its admin.", + body=(P("name", required=True, help="Workspace name."),), + ), + }, +} + + +# Default verbs let a bare group name run its most common read command. +DEFAULT_VERBS: dict[str, str] = { + "scans": "list", + "vulns": "list", + "domains": "list", + "repos": "list", + "workspaces": "list", + "schedules": "list", + "pr-reviews": "list", + "billing": "credits", + "chat": "list", + "knowledge": "list", + "org": "get", + "integrations": "list", + "connectors": "list", + "webhooks": "list", + "analytics": "overview", + "costs": "overview", + "audit": "list", + "llm-settings": "get", + "settings": "notifications", + "license": "show", + "tokens": "list", + "supply-chain": "summary", +} + + +GROUP_HELP: dict[str, str] = { + "scans": "Start, watch, and manage scans", + "vulns": "Triage and remediate vulnerabilities", + "domains": "Manage domain assets and test users", + "repos": "Manage repository assets and supply-chain scans", + "supply-chain": "Organization supply-chain summary", + "schedules": "Manage scan schedules", + "pr-reviews": "Manage pull request reviews", + "billing": "Credits, top-ups, and automatic top-up", + "chat": "Interactive pentest chat sessions", + "knowledge": "Manage the knowledge base", + "org": "Manage the organization and its members", + "integrations": "Connect Git providers and other integrations", + "workspaces": "List, create, and switch workspaces", + "connectors": "Manage network connectors", + "webhooks": "Manage webhooks", + "analytics": "Read analytics data", + "audit": "Read the audit log", + "costs": "Self-hosted only: read LLM cost data", + "llm-settings": "Self-hosted only: manage LLM model settings", + "settings": "Manage notification settings", + "license": "Read license information", + "tokens": "Manage API tokens", + "uploads": "Upload files for scans", +} diff --git a/strix/interface/cloud/workspaces.py b/strix/interface/cloud/workspaces.py new file mode 100644 index 000000000..1d4953575 --- /dev/null +++ b/strix/interface/cloud/workspaces.py @@ -0,0 +1,291 @@ +"""`strix cloud workspaces use` — switch the stored token to another workspace. + +The command lists the workspaces of the account, finds the requested one by +ID or by exact name, asks the platform to rotate that token in place, and +stores the returned workspace metadata. The bearer secret and expiry stay the +same; the account's role in the target workspace limits the granted scopes. +""" + +from __future__ import annotations + +import os +from typing import TYPE_CHECKING, Any, cast + +from rich.console import Console +from rich.markup import escape + +import strix.interface.cloud.http as http # noqa: PLR0402 +from strix.interface.cloud.arguments import CloudArgumentParser +from strix.interface.cloud.render import emit, json_mode +from strix.interface.platform_cli import AUTH_PATH, read_record, save_record +from strix.interface.platform_identity import read_or_create_identity +from strix.interface.terminal_text import sanitize_terminal_text + + +if TYPE_CHECKING: + import argparse + + +def run_workspace_use(argv: list[str]) -> int: + """Entry point for ``strix cloud workspaces use``. Returns an exit code.""" + console = Console() + parser = CloudArgumentParser( + prog="strix cloud workspaces use", + description="Switch the stored API token to another workspace.", + ) + parser.add_argument( + "workspace", + metavar="WORKSPACE", + help="Workspace number from `workspaces list`, ID, or exact name.", + ) + scope_mode = parser.add_mutually_exclusive_group() + scope_mode.add_argument( + "--scopes", + nargs="+", + metavar="SCOPE", + default=None, + help=( + "Use a custom scope set within the login-approved ceiling. " + "Without this option, preserve the server-side scope preference." + ), + ) + scope_mode.add_argument( + "--scope-profile", + choices=("minimal", "recommended", "full"), + default=None, + help="Change to a profile within the authority approved at login.", + ) + parser.add_argument("--show-scopes", action="store_true", help="Print every granted scope.") + parser.add_argument("--json", action="store_true", help="Print the raw JSON response.") + parser.add_argument("--token", default=None, help="API token override.") + parser.add_argument( + "--workspace-id", + default=None, + metavar="ORG_ID", + help="Expected workspace for an override CLI token.", + ) + parser.add_argument("--app-url", default=None, metavar="URL", help="Platform URL override.") + parser.add_argument( + "--timeout", default=None, type=float, metavar="SECONDS", help="Request timeout in seconds." + ) + as_json = json_mode(flag="--json" in argv) + try: + args = parser.parse_args(argv) + except SystemExit as exc: + return exc.code if isinstance(exc.code, int) else 2 + except http.CloudError as exc: + _emit_cloud_error(console, exc, as_json=as_json) + return exc.exit_code + + as_json = json_mode(flag=bool(args.json)) + try: + http.configure( + base_url=args.app_url, + timeout=args.timeout, + token_override=bool(args.token), + workspace_id=args.workspace_id, + ) + return _use(console, args, as_json=as_json) + except http.CloudError as exc: + _emit_cloud_error(console, exc, as_json=as_json) + return exc.exit_code + + +def _use( # noqa: PLR0912, PLR0915 + console: Console, args: argparse.Namespace, *, as_json: bool +) -> int: + workspace = _find_workspace(args.workspace, token=args.token) + stored_record: dict[str, Any] = read_record() or {} + # An override token may belong to a different account. Never mix its new + # workspace state with identity or scope preferences from the stored sign-in. + external_token = args.token is not None or bool(os.environ.get("STRIX_API_TOKEN", "").strip()) + record: dict[str, Any] = {} if external_token else dict(stored_record) + body: dict[str, Any] = {} + if args.scopes: + body["scopes"] = args.scopes + body["scope_profile"] = "custom" + elif args.scope_profile: + body["scope_profile"] = args.scope_profile + if not external_token: + try: + body.update(read_or_create_identity()) + except (OSError, ValueError) as exc: + raise http.CloudError(f"could not load the CLI device identity: {exc}") from exc + switched = _switch_workspace_token( + str(workspace["id"]), + token=args.token, + body=body or None, + ) + if not isinstance(switched, dict): + raise _workspace_switch_unknown("the platform returned an invalid response") + switched_record = cast("dict[str, Any]", switched) + switched_token = switched_record.get("api_token") + if not isinstance(switched_token, str) or not switched_token.strip(): + raise _workspace_switch_unknown("the platform response omitted the token") + switched_scopes = switched_record.get("scopes") + switched_scope_items = cast("list[Any]", cast("Any", switched_scopes)) + if not isinstance(switched_scopes, list) or not all( + isinstance(scope, str) for scope in switched_scope_items + ): + raise _workspace_switch_unknown("the platform response contained invalid scopes") + validated_scopes = cast("list[str]", switched_scope_items) + + record.update( + { + "api_token": switched_token, + "organization_id": switched_record.get("organization_id", workspace["id"]), + "organization_name": switched_record.get( + "organization_name", workspace.get("name", "") + ), + "expires_at": switched_record.get("expires_at") or stored_record.get("expires_at"), + "scopes": validated_scopes, + "requested_scopes": switched_record.get("requested_scopes", validated_scopes), + "scope_ceiling": switched_record.get("scope_ceiling", []), + "scope_profile": switched_record.get("scope_profile", "custom"), + "token_id": switched_record.get("token_id"), + "credential_source": switched_record.get("credential_source", "api"), + "device_name": switched_record.get("device_name"), + "app_url": http.app_url(), + } + ) + if switched_record.get("email"): + record["email"] = switched_record["email"] + if not external_token: + try: + save_record(record) + except OSError as exc: + raise http.CloudError( + "the platform switched the token, but the local workspace metadata could not be " + f"stored in {AUTH_PATH}: {exc}. The bearer is still valid; fix the file and safely " + "rerun the same workspace use command.", + payload={ + "workspace_switched": True, + "local_record_updated": False, + "retry_safe": True, + }, + ) from exc + + result = { + "workspace_id": record["organization_id"], + "workspace_name": record["organization_name"], + "scopes": record["scopes"], + "requested_scopes": record.get("requested_scopes", record["scopes"]), + "scope_ceiling": record.get("scope_ceiling", []), + "scope_profile": record.get("scope_profile", "custom"), + "expires_at": record.get("expires_at"), + "token_id": record.get("token_id"), + "credential_source": record.get("credential_source", "api"), + "device_name": record.get("device_name"), + "stored": not external_token, + } + if as_json: + emit(console, result, as_json=True) + return http.EXIT_OK + workspace_name = escape(sanitize_terminal_text(record["organization_name"])) + console.print(f"[green]✓ Switched to workspace [bold]{workspace_name}[/].[/]") + scopes = record.get("scopes") + if isinstance(scopes, list) and scopes: + scope_items = cast("list[Any]", cast("Any", scopes)) + scope_names = [scope for scope in scope_items if isinstance(scope, str)] + if scope_names and args.show_scopes: + rendered_scopes = escape(sanitize_terminal_text(" ".join(scope_names))) + console.print(f" Scopes: [dim]{rendered_scopes}[/]") + elif scope_names: + profile = str(record.get("scope_profile") or "custom").title() + console.print(f" Access: [dim]{profile} · {len(scope_names)} scopes granted[/]") + if external_token: + console.print(" Token: [dim]override used for this command only; not stored[/]") + else: + console.print(f" Token: stored in [dim]{escape(sanitize_terminal_text(AUTH_PATH))}[/]") + return http.EXIT_OK + + +def _switch_workspace_token( + workspace_id: str, + *, + token: str | None, + body: dict[str, Any] | None, +) -> Any: + """Switch in place, distinguishing definitive rejections from lost outcomes.""" + try: + response = http.request( + "POST", + f"/workspaces/{workspace_id}/token", + token=token, + body=body, + ) + except http.CloudError as exc: + raise _workspace_switch_unknown(str(exc)) from exc + + # Client/auth/conflict responses prove the rotation did not return success. + # A 5xx or malformed success may arrive after the database commit, but the + # server preserves the bearer so replaying this exact command is safe. + if response.status_code in {400, 401, 403, 404, 409, 422}: + return http.check(response) + try: + return http.check(response) + except http.CloudError as exc: + raise _workspace_switch_unknown(str(exc)) from exc + + +def _workspace_switch_unknown(detail: str) -> http.CloudError: + return http.CloudError( + "workspace switch outcome is unknown: " + f"{sanitize_terminal_text(detail)}. The bearer secret is unchanged; safely rerun the " + "same workspace use command, or list workspaces to check the current one.", + payload={ + "switch_outcome_unknown": True, + "retry_safe": True, + }, + ) + + +def _emit_cloud_error(console: Console, error: http.CloudError, *, as_json: bool) -> None: + if as_json: + raw_payload: Any = error.payload + error_payload = cast("dict[str, Any]", raw_payload) + payload = dict(error_payload) if isinstance(raw_payload, dict) else {} + payload["error"] = str(error) + emit(console, payload, as_json=True) + return + console.print(f"[red]Error:[/] {escape(sanitize_terminal_text(error))}") + + +def _find_workspace(selector: str, *, token: str | None) -> dict[str, Any]: + listed = http.check(http.request("GET", "/workspaces", token=token)) + listed_record = cast("dict[str, Any]", listed) if isinstance(listed, dict) else {} + items = listed_record.get("workspaces") + item_values = cast("list[Any]", cast("Any", items)) if isinstance(items, list) else [] + workspaces = [ + cast("dict[str, Any]", cast("Any", item)) for item in item_values if isinstance(item, dict) + ] + if not workspaces: + raise http.CloudError("no workspaces found for this account.") + wanted = selector.strip() + if wanted.isdigit(): + index = int(wanted) + if 1 <= index <= len(workspaces): + return workspaces[index - 1] + raise http.CloudError( + f"workspace number must be between 1 and {len(workspaces)}. " + "Run `strix cloud workspaces` to see the numbered list." + ) + by_id = [w for w in workspaces if w.get("id") == wanted] + if by_id: + return by_id[0] + by_name = [w for w in workspaces if str(w.get("name", "")).casefold() == wanted.casefold()] + if len(by_name) == 1: + return by_name[0] + if len(by_name) > 1: + numbers = ", ".join( + str(index) + for index, workspace in enumerate(workspaces, start=1) + if workspace in by_name + ) + raise http.CloudError( + f"multiple workspaces are named {wanted!r}. Use its list number: {numbers}" + ) + names = ", ".join( + f"{index}: {workspace.get('name')}" for index, workspace in enumerate(workspaces, start=1) + ) + raise http.CloudError(f"no workspace matches {wanted!r}. Your workspaces: {names}") diff --git a/strix/interface/completions.py b/strix/interface/completions.py new file mode 100644 index 000000000..f188fc3e7 --- /dev/null +++ b/strix/interface/completions.py @@ -0,0 +1,373 @@ +"""Shell completion scripts and candidates for the Strix CLI.""" + +from __future__ import annotations + +import sys +from pathlib import Path +from typing import Any + +from strix.interface.cloud.spec import DEFAULT_VERBS, SPEC, Cmd +from strix.interface.terminal_text import has_terminal_control, sanitize_terminal_text + + +_ROOT_COMMANDS = ("cloud", "auth", "view", "completions", "completion") +_SESSION_COMMANDS = ("login", "logout", "whoami", "session", "credits") +_COMMON_FLAGS = ( + "--json", + "--token", + "--workspace-id", + "--app-url", + "--timeout", + "-h", + "--help", +) +_COMMON_VALUE_FLAGS = frozenset({"--token", "--workspace-id", "--app-url", "--timeout"}) +_WORKSPACE_USE_FLAGS = (*_COMMON_FLAGS, "--scopes", "--scope-profile", "--show-scopes") + + +def run_completions(argv: list[str]) -> int: + """Print a shell integration script or hidden completion candidates.""" + if argv and argv[0] == "--candidates": + for candidate in completion_candidates(argv[1:]): + sys.stdout.write(candidate + "\n") + return 0 + if not argv or argv[0] in ("-h", "--help", "help"): + sys.stdout.write( + "Usage: strix completions \n\n" + "Enable tab completion for the current shell:\n" + " zsh: source <(strix completions zsh)\n" + " bash: source <(strix completions bash)\n" + " fish: strix completions fish | source\n" + ) + return 0 + shell = argv[0].lower() + scripts = {"zsh": _zsh_script, "bash": _bash_script, "fish": _fish_script} + generator = scripts.get(shell) + if generator is None: + sys.stderr.write( + f"Unknown shell: {sanitize_terminal_text(shell)}. Choose zsh, bash, or fish.\n" + ) + return 2 + sys.stdout.write(generator()) + return 0 + + +def completion_candidates(words: list[str]) -> list[str]: + """Return candidates for words after the ``strix`` executable.""" + prior, current = _split_cursor(words) + if not prior: + candidates = _matching(_ROOT_COMMANDS, current) + elif prior[0] != "cloud": + candidates = [] + else: + candidates = _cloud_candidates(prior[1:], current) + # The line-oriented shell protocol cannot represent these names safely. + # Omitting them is preferable to returning a sanitized path that does not exist. + return [candidate for candidate in candidates if not has_terminal_control(candidate)] + + +def _split_cursor(words: list[str]) -> tuple[list[str], str]: + if not words: + return [], "" + return words[:-1], words[-1] + + +def _cloud_candidates(prior: list[str], current: str) -> list[str]: # noqa: PLR0911 + groups = (*_SESSION_COMMANDS, *SPEC, "workspace") + if not prior: + return _matching(groups, current) + group = "workspaces" if prior[0] == "workspace" else prior[0] + rest = prior[1:] + if group in _SESSION_COMMANDS: + return _session_candidates(group, rest, current) + commands = SPEC.get(group) + if commands is None: + return _matching(groups, current) + default_verb = DEFAULT_VERBS.get(group) + default_is_active = (rest and rest[0].startswith("-")) or (not rest and current.startswith("-")) + if default_verb is not None and default_is_active: + return _command_candidates(commands[default_verb], rest, current) + + command_paths = sorted( + ((verb.split(), cmd) for verb, cmd in commands.items()), + key=lambda item: len(item[0]), + reverse=True, + ) + for path, cmd in command_paths: + if rest[: len(path)] == path: + command_candidates = _command_candidates(cmd, rest[len(path) :], current) + if rest == path: + nested_words = { + candidate_path[len(path)] + for candidate_path, _candidate_cmd in command_paths + if len(candidate_path) > len(path) and candidate_path[: len(path)] == path + } + return sorted({*command_candidates, *_matching(nested_words, current)}) + return command_candidates + if group == "workspaces" and rest[:1] == ["use"]: + return _flag_candidates( + _WORKSPACE_USE_FLAGS, + rest[1:], + current, + value_flags=_COMMON_VALUE_FLAGS | {"--scopes"}, + ) + + verb_paths = [path for path, _cmd in command_paths] + if group == "workspaces": + verb_paths.append(["use"]) + matching_paths = [path for path in verb_paths if path[: len(rest)] == rest] + if not matching_paths: + return [] + next_words = sorted({path[len(rest)] for path in matching_paths if len(path) > len(rest)}) + return _matching(next_words, current) + + +def _session_candidates(group: str, prior: list[str], current: str) -> list[str]: + if group == "session": + if not prior: + return _matching(("show", "scopes", "help", *_COMMON_FLAGS, "--show-scopes"), current) + if prior[:1] == ["scopes"] and len(prior) == 1: + return _matching(("set", *_COMMON_FLAGS, "--show-scopes"), current) + if prior[:2] == ["scopes", "set"]: + return _matching( + ("minimal", "recommended", "full", "--scopes", *_COMMON_FLAGS, "--show-scopes"), + current, + ) + return _flag_candidates( + (*_COMMON_FLAGS, "--show-scopes"), + prior, + current, + value_flags=_COMMON_VALUE_FLAGS | {"--scopes"}, + ) + flags = _session_flags(group) + value_flags: frozenset[str] = frozenset() + if group == "login": + value_flags = frozenset({"--scopes", "--scope-profile", "--workspace", "--device-name"}) + elif group == "credits": + value_flags = _COMMON_VALUE_FLAGS + return _flag_candidates(flags, prior, current, value_flags=value_flags) + + +def _session_flags(group: str) -> tuple[str, ...]: + if group == "login": + return ( + "--no-browser", + "--scopes", + "--scope-profile", + "--workspace", + "--device-name", + "-h", + "--help", + ) + if group == "whoami": + return ("--json", "--show-scopes", "-h", "--help") + if group == "logout": + return ("--json", "--local-only", "-h", "--help") + if group == "credits": + return _COMMON_FLAGS + return ("-h", "--help") + + +def _command_candidates(cmd: Cmd, prior: list[str], current: str) -> list[str]: + filesystem = _filesystem_candidates(cmd, prior, current) + if filesystem is not None: + return filesystem + return _flag_candidates( + _command_flags(cmd), + prior, + current, + value_flags=_command_value_flags(cmd), + ) + + +def _flag_candidates( + flags: tuple[str, ...], + prior: list[str], + current: str, + *, + value_flags: frozenset[str], +) -> list[str]: + if prior and prior[-1] in value_flags and not current.startswith("-"): + return [] + return _matching(flags, current) + + +def _command_flags(cmd: Cmd) -> tuple[str, ...]: + flags: list[str] = list(_COMMON_FLAGS) + for param in cmd.query + cmd.body: + flag = "--" + (param.flag or _kebab(param.name)) + flags.append(flag) + if param.kind == "bool": + flags.append("--no-" + flag.removeprefix("--")) + if cmd.method in ("POST", "PUT", "PATCH"): + flags.append("--data") + if cmd.idempotent: + flags.append("--idempotency-key") + if cmd.binary or cmd.path == "/audit": + flags.extend(("--output", "--force")) + if cmd.link: + flags.append("--no-browser") + if cmd.wait_path or cmd.wait_self: + flags.extend(("--wait", "--wait-timeout")) + if cmd.path == "/billing/topup": + flags.extend(("--yes", "--no-pay", "--payment-method")) + if cmd.path == "/scans" and cmd.method == "POST": + flags.extend( + ( + "--source", + "--approve-sha256", + "--dry-run", + "--yes", + "--show-files", + "--exclude", + "--include-hidden", + "--include-sensitive", + "--include-archives", + ) + ) + if cmd.path == "/billing/auto-topup" and cmd.method == "PUT": + flags.append("--no-monthly-cap") + return tuple(dict.fromkeys(flags)) + + +def _command_value_flags(cmd: Cmd) -> frozenset[str]: + flags = set(_COMMON_VALUE_FLAGS) + for param in cmd.query + cmd.body: + if param.kind != "bool": + flags.add("--" + (param.flag or _kebab(param.name))) + if cmd.method in ("POST", "PUT", "PATCH"): + flags.add("--data") + if cmd.idempotent: + flags.add("--idempotency-key") + if cmd.binary or cmd.path == "/audit": + flags.add("--output") + if cmd.wait_path or cmd.wait_self: + flags.add("--wait-timeout") + if cmd.path == "/billing/topup": + flags.add("--payment-method") + if cmd.path == "/scans" and cmd.method == "POST": + flags.update(("--source", "--approve-sha256", "--exclude")) + return frozenset(flags) + + +def _filesystem_candidates( # noqa: PLR0911 + cmd: Cmd, prior: list[str], current: str +) -> list[str] | None: + inline = ( + ("--source=", True, ""), + ("--output=", False, ""), + ("--data=@", False, "@"), + ) + for option, directories_only, marker in inline: + if current.startswith(option): + value = current.removeprefix(option) + return [ + option + candidate.removeprefix(marker) + for candidate in _path_candidates( + marker + value, + directories_only=directories_only, + marker=marker, + ) + ] + + if not prior or current.startswith("-"): + return None + option = prior[-1] + if option == "--source" and cmd.path == "/scans" and cmd.method == "POST": + return _path_candidates(current, directories_only=True) + if option == "--output" and (cmd.binary or cmd.path == "/audit"): + return _path_candidates(current) + if option == "--data" and cmd.method in ("POST", "PUT", "PATCH"): + if not current: + return ["@"] + if current.startswith("@"): + return _path_candidates(current, marker="@") + return [] + return None + + +def _path_candidates( + value: str, + *, + directories_only: bool = False, + marker: str = "", +) -> list[str]: + raw = value.removeprefix(marker) if marker else value + ends_with_separator = raw.endswith(("/", "\\")) + expanded = Path(raw or ".").expanduser() + directory = expanded if ends_with_separator else expanded.parent + name_prefix = "" if ends_with_separator else expanded.name + raw_base = raw if ends_with_separator else raw[: len(raw) - len(name_prefix)] + try: + entries = directory.iterdir() + matches = [ + entry + for entry in entries + if entry.name.startswith(name_prefix) and (not directories_only or entry.is_dir()) + ] + except OSError: + return [] + + candidates: list[str] = [] + for entry in sorted(matches, key=lambda item: item.name.casefold()): + candidate = marker + raw_base + entry.name + if entry.is_dir(): + candidate += "/" + candidates.append(candidate) + return candidates + + +def _kebab(value: str) -> str: + output: list[str] = [] + for char in value: + if char.isupper(): + output.extend(("-", char.lower())) + else: + output.append("-" if char == "_" else char) + return "".join(output) + + +def _matching(candidates: Any, prefix: str) -> list[str]: + return sorted({str(candidate) for candidate in candidates if str(candidate).startswith(prefix)}) + + +def _zsh_script() -> str: + return r"""#compdef strix +_strix() { + local -a candidates + candidates=("${(@f)$($words[1] completions --candidates "${words[@]:2}")}") + _describe 'strix' candidates +} +compdef _strix strix +""" + + +def _bash_script() -> str: + return r"""_strix_completion() { + local -a candidates + local candidate + while IFS= read -r candidate; do + candidates+=("$candidate") + done < <(strix completions --candidates "${COMP_WORDS[@]:1:$COMP_CWORD}") + COMPREPLY=("${candidates[@]}") + for candidate in "${COMPREPLY[@]}"; do + if [[ $candidate == */ ]]; then + if type compopt >/dev/null 2>&1; then + compopt -o nospace + fi + break + fi + done +} +complete -F _strix_completion strix +""" + + +def _fish_script() -> str: + return r"""function __strix_candidates + set -l words (commandline -opc) + set -e words[1] + command strix completions --candidates $words (commandline -ct) +end +complete -c strix -f -a '(__strix_candidates)' +""" diff --git a/strix/interface/environment.py b/strix/interface/environment.py index 5589a1fe5..522067df8 100644 --- a/strix/interface/environment.py +++ b/strix/interface/environment.py @@ -8,17 +8,29 @@ from rich.console import Console from rich.panel import Panel from rich.text import Text -from strix.config import codex, load_settings +from strix.config import IntegrationSettings, codex, load_settings from strix.interface.utils import ( check_docker_connection, image_exists, process_pull_line, ) +from strix.telemetry import report_error logger = logging.getLogger(__name__) +def _missing_web_search_vars(integrations: IntegrationSettings) -> list[str]: + """Mirror the web_search provider rules: which key(s) the selected provider needs.""" + if integrations.web_search_provider == "exa": + return [] if integrations.exa_api_key else ["EXA_API_KEY"] + if integrations.web_search_provider == "perplexity": + return [] if integrations.perplexity_api_key else ["PERPLEXITY_API_KEY"] + if integrations.exa_api_key or integrations.perplexity_api_key: + return [] + return ["EXA_API_KEY", "PERPLEXITY_API_KEY"] + + def validate_environment() -> None: logger.info("Validating environment") console = Console() @@ -33,6 +45,7 @@ def validate_environment() -> None: f"[red]STRIX_LLM={settings.llm.model} uses your ChatGPT subscription, " "but you're not signed in.[/] Run [cyan]strix auth login chatgpt[/] first." ) + report_error("subscription_not_signed_in") sys.exit(1) logger.info("Environment OK (ChatGPT subscription)") return @@ -46,8 +59,7 @@ def validate_environment() -> None: if not settings.llm.api_base: missing_optional_vars.append("LLM_API_BASE") - if not settings.integrations.perplexity_api_key: - missing_optional_vars.append("PERPLEXITY_API_KEY") + missing_optional_vars.extend(_missing_web_search_vars(settings.integrations)) if missing_required_vars: error_text = Text() @@ -70,7 +82,7 @@ def validate_environment() -> None: error_text.append("• ", style="white") error_text.append("STRIX_LLM", style="bold cyan") error_text.append( - " - Model name to use (e.g., 'openai/gpt-5.4' or " + " - Model name to use (e.g., 'openrouter/z-ai/glm-5.3' or " "'anthropic/claude-opus-4-7')\n", style="white", ) @@ -89,7 +101,14 @@ def validate_environment() -> None: error_text.append("• ", style="white") error_text.append("PERPLEXITY_API_KEY", style="bold cyan") error_text.append( - " - API key for Perplexity AI web search (enables real-time research)\n", + " - API key for Perplexity AI web search (alternative to Exa)\n", + style="white", + ) + elif var == "EXA_API_KEY": + error_text.append("• ", style="white") + error_text.append("EXA_API_KEY", style="bold cyan") + error_text.append( + " - API key for Exa web search (enables real-time research)\n", style="white", ) elif var == "STRIX_REASONING_EFFORT": @@ -102,7 +121,7 @@ def validate_environment() -> None: ) error_text.append("\nExample setup:\n", style="white") - error_text.append("export STRIX_LLM='openai/gpt-5.4'\n", style="dim white") + error_text.append("export STRIX_LLM='openrouter/z-ai/glm-5.3'\n", style="dim white") if missing_optional_vars: for var in missing_optional_vars: @@ -116,6 +135,8 @@ def validate_environment() -> None: error_text.append( "export PERPLEXITY_API_KEY='your-perplexity-key-here'\n", style="dim white" ) + elif var == "EXA_API_KEY": + error_text.append("export EXA_API_KEY='your-exa-key-here'\n", style="dim white") elif var == "STRIX_REASONING_EFFORT": error_text.append( "export STRIX_REASONING_EFFORT='high'\n", @@ -134,6 +155,7 @@ def validate_environment() -> None: console.print("\n") console.print(panel) console.print() + report_error("missing_required_config") sys.exit(1) logger.info( "Environment OK (optional missing: %s)", @@ -161,6 +183,7 @@ def check_docker_installed() -> None: padding=(1, 2), ) console.print("\n", panel, "\n") + report_error("docker_not_installed") sys.exit(1) logger.debug("Docker CLI present") @@ -208,6 +231,7 @@ def pull_docker_image() -> None: padding=(1, 2), ) console.print(panel, "\n") + report_error("image_pull_failed", e) sys.exit(1) logger.info("Docker image %s ready", image) diff --git a/strix/interface/main.py b/strix/interface/main.py index 027780a9d..11e4a757a 100644 --- a/strix/interface/main.py +++ b/strix/interface/main.py @@ -42,7 +42,8 @@ from strix.interface.update_check import ( from strix.interface.utils import ( build_final_stats_text, ) -from strix.telemetry import posthog, scarf +from strix.llm.warmup import start_import_warmup, wait_for_import_warmup +from strix.telemetry import posthog, report_error, scarf, set_scan_phase from strix.telemetry.logging import configure_dependency_logging @@ -63,6 +64,14 @@ import logging # noqa: E402 logger = logging.getLogger(__name__) +_ROOT_SUBCOMMAND_HELP = """ +Additional commands: + strix cloud ... Use the managed Strix platform + strix auth ... Manage model-subscription sign-in + strix view [RUN] View a completed or running scan + strix completions SHELL Generate zsh, bash, or fish tab completion +""" + def _exception_messages(exc: BaseException) -> tuple[str, ...]: messages: list[str] = [] @@ -323,6 +332,11 @@ def display_completion_message(args: argparse.Namespace, results_path: Path) -> "[#60a5fa]docs.strix.ai[/] [dim]·[/] " "[#60a5fa]discord.gg/strix-ai[/]" ) + if not args.non_interactive: + console.print( + "[dim]Run a pentest in Strix Cloud[/] [#60a5fa]app.strix.ai[/] [dim]·[/] " + "[dim]Enterprise[/] [#60a5fa]strix.ai/demo[/]" + ) console.print() if not args.non_interactive: notify_update(console) @@ -382,26 +396,24 @@ def _print_model_connection_error(exc: BaseException, model_name: str) -> None: def _bootstrap_scan(args: argparse.Namespace) -> None: """Warm up the model and prepare the run for a non-interactive scan. - Interactive launches only validate the environment here; the model - preflight and run preparation happen inside the TUI so the interface - paints immediately instead of waiting on a model round trip. + Interactive launches skip this: the model preflight and run preparation + happen inside the TUI so the interface paints immediately instead of + waiting on a model round trip. """ - validate_environment() - if not args.non_interactive: - return + set_scan_phase("preflight") try: asyncio.run(warm_up_llm(show_model_warning=True)) except ModelConnectionError as exc: + report_error("model_connection_failed", exc) _print_model_connection_error(exc, exc.model_name) sys.exit(1) persist_current() try: prepare_run(args) except ValueError as e: + report_error("scan_preparation_failed", e) _print_error_panel(t("cli.scan_preparation_failed"), str(e)) sys.exit(1) - telemetry_start(args) - def main() -> None: configure_dependency_logging() @@ -409,6 +421,13 @@ def main() -> None: if sys.platform == "win32": asyncio.set_event_loop_policy(asyncio.WindowsSelectorEventLoopPolicy()) + if len(sys.argv) == 2 and sys.argv[1] in ("-h", "--help"): + try: + parse_arguments() + except SystemExit as exc: + Console().print(_ROOT_SUBCOMMAND_HELP.strip(), markup=False) + raise SystemExit(exc.code) from None + # `strix view []` is a viewer-only subcommand, dispatched before the # scan argument parser (which requires a target) and before any scan setup. if len(sys.argv) > 1 and sys.argv[1] == "view": @@ -424,7 +443,18 @@ def main() -> None: sys.exit(run_auth(sys.argv[2:])) - from strix.llm.warmup import start_import_warmup + # Generate native shell completion scripts before scan argument parsing. + if len(sys.argv) > 1 and sys.argv[1] in ("completion", "completions"): + from strix.interface.completions import run_completions + + sys.exit(run_completions(sys.argv[2:])) + + # `strix cloud …` drives the managed platform (app.strix.ai) and exits; + # it needs no target, Docker, or scan setup. + if len(sys.argv) > 1 and sys.argv[1] == "cloud": + from strix.interface.cloud import run_cloud + + sys.exit(run_cloud(sys.argv[2:])) start_import_warmup() @@ -438,10 +468,12 @@ def main() -> None: check_docker_installed() pull_docker_image() + validate_environment() - # In setup mode the TUI collects the target, then runs prepare_run(), - # warm-up, and telemetry itself once the user starts the scan. - if not args.needs_setup: + # Everything below imports the scan engine; do not race the warm-up thread. + wait_for_import_warmup() + + if args.non_interactive: _bootstrap_scan(args) from strix.report.state import get_global_report_state @@ -452,18 +484,22 @@ def main() -> None: from strix.interface.cli import run_cli asyncio.run(run_cli(args)) + # Headless runs have no user to quit: the agent either finished + # (already beaconed as finished_by_tool) or stopped on its own. + exit_reason = "agent_stopped" else: asyncio.run(run_tui(args)) except InteractiveSetupUnavailableError as exc: exit_reason = "error" + report_error("interactive_setup_unavailable", exc) _print_error_panel(t("cli.interactive_setup_unavailable"), str(exc)) sys.exit(1) + except KeyboardInterrupt: exit_reason = "interrupted" - except Exception: + except Exception as exc: exit_reason = "error" - posthog.error("unhandled_exception") - scarf.error("unhandled_exception") + report_error("unhandled_exception", exc) raise finally: report_state = get_global_report_state() @@ -482,6 +518,7 @@ def main() -> None: if not args.run_name: # Setup mode where the user quit before starting a scan: nothing ran. + notify_update(Console()) return results_path = run_dir_for(args.run_name) diff --git a/strix/interface/platform_cli.py b/strix/interface/platform_cli.py new file mode 100644 index 000000000..bf57e9cc8 --- /dev/null +++ b/strix/interface/platform_cli.py @@ -0,0 +1,798 @@ +"""`strix cloud login` — managed platform sign-in (app.strix.ai). + +Signing in runs an OAuth 2.0 device authorization flow in the browser, creates +the Strix account and workspace when they do not exist yet, and stores a +personal API token in ``~/.strix/platform-auth.json``. The token drives the +managed REST API (scans, credits, top-ups) without a dashboard visit. +""" + +from __future__ import annotations + +import argparse +import contextlib +import json +import sys +import time +import webbrowser +from pathlib import Path +from typing import Any, NoReturn, cast +from urllib.parse import urlparse, urlsplit, urlunsplit + +import requests +from rich.console import Console +from rich.markup import escape +from rich.panel import Panel +from rich.text import Text + +from strix.config import load_settings +from strix.interface.platform_identity import read_or_create_identity +from strix.interface.terminal_text import sanitize_terminal_text +from strix.interface.url_safety import is_safe_web_url +from strix.utils.secret_files import write_secret_text + + +AUTH_PATH = Path.home() / ".strix" / "platform-auth.json" + +_HTTP_TIMEOUT_S = 30 +_DEFAULT_POLL_INTERVAL_S = 5 +_MAX_POLL_INTERVAL_S = 60 +_MAX_EXPIRES_IN_S = 30 * 60 + +_ROLE_RANK = {"viewer": 0, "analyst": 1, "admin": 2} + + +class PlatformAuthError(Exception): + """Raised when the device authorization flow fails.""" + + +class _SessionUsageError(Exception): + """A session subcommand received invalid arguments.""" + + +class _SessionArgumentParser(argparse.ArgumentParser): + def error(self, message: str) -> NoReturn: + raise _SessionUsageError(f"invalid arguments for {self.prog}: {message}") + + +def _terminal_markup(value: object) -> str: + return escape(sanitize_terminal_text(value)) + + +def _app_url() -> str: + return load_settings().viewer.app_url.rstrip("/") + + +def read_record() -> dict[str, Any] | None: + try: + data = json.loads(AUTH_PATH.read_text(encoding="utf-8")) + except (OSError, json.JSONDecodeError): + return None + if not isinstance(data, dict): + return None + record = cast("dict[str, Any]", data) + if not record.get("api_token"): + return None + return record + + +def save_record(record: dict[str, Any]) -> None: + write_secret_text(AUTH_PATH, json.dumps(record, indent=2)) + + +def logout() -> bool: + try: + AUTH_PATH.unlink() + except FileNotFoundError: + return True + except OSError: + return False + return True + + +def run_login(argv: list[str]) -> int: + """Entry point for ``strix cloud login``. Returns a process exit code.""" + console = Console() + subcommand = argv[0] if argv else None + + if subcommand == "status": + return _status(console, argv[1:]) + if subcommand == "logout": + return _logout(console, argv[1:]) + return _login(console, argv) + + +def _login(console: Console, argv: list[str]) -> int: + parser = argparse.ArgumentParser(prog="strix cloud login", add_help=True) + parser.add_argument( + "--no-browser", + action="store_true", + help="Do not open the browser. Print the verification URL instead.", + ) + scope_mode = parser.add_mutually_exclusive_group() + scope_mode.add_argument( + "--scopes", + nargs="+", + metavar="SCOPE", + default=None, + help=( + "API scopes for the token, for example scans:read billing:write. " + "The server always includes a minimum scope set. " + "Without this option, an interactive picker opens after the browser step." + ), + ) + scope_mode.add_argument( + "--scope-profile", + choices=("minimal", "recommended", "full"), + default=None, + help="Scope profile to approve. Defaults to an interactive choice in a TTY.", + ) + parser.add_argument( + "--device-name", + default=None, + metavar="NAME", + help="Privacy-safe label shown for this CLI session in the dashboard.", + ) + parser.add_argument( + "--workspace", + metavar="WORKSPACE", + default=None, + help=( + "Workspace that receives the token, by ID or by exact name. " + "Without this option, an interactive picker opens when you have " + "more than one workspace." + ), + ) + previous_record = read_record() + try: + args = parser.parse_args(argv) + except SystemExit as exc: # argparse already printed the message + return exc.code if isinstance(exc.code, int) else 2 + + console.print() + host = urlparse(_app_url()).netloc or _app_url() + console.print(f"[bold]Signing in to the Strix platform[/] [dim]({_terminal_markup(host)})[/]") + console.print( + "[dim]This creates your account and workspace when needed, and stores an API token.[/]" + ) + console.print() + + try: + record = _run_device_flow( + console, + open_browser=not args.no_browser, + scopes=args.scopes, + scope_profile=args.scope_profile, + workspace=args.workspace, + device_name=args.device_name, + ) + except PlatformAuthError as exc: + console.print(f"[red]Sign-in failed:[/] {_terminal_markup(exc)}") + return 1 + except KeyboardInterrupt: + console.print("\n[yellow]Sign-in cancelled.[/]") + return 130 + + try: + save_record(record) + except OSError as exc: + console.print( + f"[red]Sign-in succeeded, but the token could not be stored:[/] {_terminal_markup(exc)}" + ) + console.print( + f"[dim]Check that {_terminal_markup(AUTH_PATH.parent)} is writable, " + "then run `strix cloud login` again.[/]" + ) + return 1 + _revoke_replaced_legacy_session(previous_record, record) + _print_success(console, record) + return 0 + + +def _run_device_flow( # noqa: PLR0912, PLR0915 + console: Console, + *, + open_browser: bool, + scopes: list[str] | None = None, + scope_profile: str | None = None, + workspace: str | None = None, + device_name: str | None = None, +) -> dict[str, Any]: + app_url = _app_url() + interactive = workspace is not None or ( + sys.stdin.isatty() and scopes is None and scope_profile is None + ) + try: + identity = read_or_create_identity(device_name=device_name) + except (OSError, ValueError) as exc: + raise PlatformAuthError(f"could not prepare the CLI device identity: {exc}") from exc + + try: + response = requests.post( + f"{app_url}/api/v1/cli/login", + timeout=_HTTP_TIMEOUT_S, + allow_redirects=False, + ) + except requests.RequestException as exc: + raise PlatformAuthError(f"could not reach {app_url}: {exc}") from exc + if not 200 <= response.status_code < 300: + raise PlatformAuthError(_error_detail(response)) + authorization = _json_object(response) + + user_code = str(authorization.get("user_code") or "") + verification_uri = str( + authorization.get("verification_uri_complete") + or authorization.get("verification_uri") + or "" + ) + device_code = str(authorization.get("device_code") or "") + expires_in = _as_positive_int( + authorization.get("expires_in"), default=300, maximum=_MAX_EXPIRES_IN_S + ) + interval = _as_positive_int( + authorization.get("interval"), + default=_DEFAULT_POLL_INTERVAL_S, + maximum=_MAX_POLL_INTERVAL_S, + ) + if not device_code or not verification_uri: + raise PlatformAuthError("the server returned an incomplete device authorization") + if not is_safe_web_url(verification_uri, trusted_origin=app_url): + raise PlatformAuthError("the server returned an invalid verification URL") + + console.print( + Panel.fit( + Text.assemble( + ("Confirmation code: ", "dim"), + (sanitize_terminal_text(user_code), "bold cyan"), + ), + title="Verify this device", + ) + ) + console.print("Open this URL in your browser and confirm the code:") + console.print(sanitize_terminal_text(verification_uri), markup=False, soft_wrap=True) + + if open_browser: + with contextlib.suppress(Exception): + webbrowser.open(verification_uri) + + console.print("[dim]Waiting for browser confirmation…[/]") + + poll_body: dict[str, Any] = {"device_code": device_code, **identity} + if interactive: + poll_body["interactive"] = True + elif scopes: + poll_body["scopes"] = scopes + elif scope_profile: + poll_body["scope_profile"] = scope_profile + + deadline = time.monotonic() + expires_in + while time.monotonic() < deadline: + remaining = deadline - time.monotonic() + if remaining <= 0: + break + time.sleep(min(interval, remaining)) + try: + poll = requests.post( + f"{app_url}/api/v1/cli/login/poll", + json=poll_body, + timeout=_HTTP_TIMEOUT_S, + allow_redirects=False, + ) + except requests.RequestException: + continue + if 200 <= poll.status_code < 300: + return _finish_login( + console, + app_url, + poll, + scopes=scopes, + scope_profile=scope_profile, + workspace=workspace, + ) + delta = _handle_poll_error(poll) + if delta is None: + break + interval = min(interval + delta, _MAX_POLL_INTERVAL_S) + + raise PlatformAuthError("the sign-in request expired. Run `strix cloud login` again.") + + +def _handle_poll_error(poll: requests.Response) -> int | None: + """Return the interval increase, or None when the device code expired.""" + error = "" + with contextlib.suppress(ValueError, AttributeError): + error = str(poll.json().get("error", "")) + if error == "authorization_pending": + return 0 + if error == "slow_down": + return 5 + if error == "access_denied": + raise PlatformAuthError("the sign-in request was denied in the browser") + if error == "expired_token": + return None + raise PlatformAuthError(_error_detail(poll)) + + +def _finish_login( + console: Console, + app_url: str, + poll: requests.Response, + *, + scopes: list[str] | None, + scope_profile: str | None, + workspace: str | None, +) -> dict[str, Any]: + result = _json_object(poll) + if result.get("selection_required"): + return _complete_selection( + console, + app_url, + result, + scopes=scopes, + scope_profile=scope_profile, + workspace=workspace, + ) + return _bind_login_record(_require_api_token(result), app_url) + + +def _signed_in_record( + response: requests.Response, + *, + app_url: str, +) -> dict[str, Any]: + return _bind_login_record( + _require_api_token(_json_object(response)), + app_url, + ) + + +def _require_api_token(record: dict[str, Any]) -> dict[str, Any]: + api_token = record.get("api_token") + if not isinstance(api_token, str) or not api_token.strip(): + raise PlatformAuthError("the server returned a sign-in response without an API token") + return record + + +def _bind_login_record(record: dict[str, Any], app_url: str) -> dict[str, Any]: + """Bind a stored credential to its issuer and preserve its scope preference.""" + parsed = urlsplit(app_url) + if ( + parsed.scheme not in {"http", "https"} + or not parsed.netloc + or parsed.username is not None + or parsed.password is not None + or parsed.query + or parsed.fragment + or "\\" in app_url + or any(character.isspace() for character in app_url) + or "%" in parsed.netloc + ): + raise PlatformAuthError("the configured platform URL is invalid") + bound = dict(record) + bound["app_url"] = urlunsplit( + (parsed.scheme.lower(), parsed.netloc.lower(), parsed.path.rstrip("/"), "", "") + ) + preference: Any = record.get("requested_scopes", record.get("scopes")) + preference_items = cast("list[Any]", preference) + if isinstance(preference, list) and all(isinstance(scope, str) for scope in preference_items): + bound["requested_scopes"] = list(dict.fromkeys(cast("list[str]", preference_items))) + return bound + + +def _complete_selection( + console: Console, + app_url: str, + selection: dict[str, Any], + *, + scopes: list[str] | None, + scope_profile: str | None, + workspace: str | None, +) -> dict[str, Any]: + organizations = _dict_items(selection.get("organizations")) + catalog = _dict_items(selection.get("scopes")) + selection_token = str(selection.get("selection_token") or "") + if not selection_token or not organizations: + raise PlatformAuthError("the server returned an incomplete selection response") + + chosen_org = _choose_workspace(console, organizations, workspace) + role = str(chosen_org.get("role") or "admin") + chosen_scopes = scopes + chosen_profile = scope_profile + if chosen_scopes is None and chosen_profile is None and sys.stdin.isatty(): + chosen_profile, chosen_scopes = _choose_scopes(console, catalog, role) + + body: dict[str, Any] = { + "selection_token": selection_token, + "organization_id": chosen_org.get("id"), + } + if chosen_scopes is not None: + body["scopes"] = chosen_scopes + body["scope_profile"] = "custom" + elif chosen_profile is not None: + body["scope_profile"] = chosen_profile + try: + response = requests.post( + f"{app_url}/api/v1/cli/login/complete", + json=body, + timeout=_HTTP_TIMEOUT_S, + allow_redirects=False, + ) + except requests.RequestException as exc: + raise PlatformAuthError(f"could not reach {app_url}: {exc}") from exc + if not 200 <= response.status_code < 300: + raise PlatformAuthError(_error_detail(response)) + return _signed_in_record( + response, + app_url=app_url, + ) + + +def _dict_items(value: Any) -> list[dict[str, Any]]: + if not isinstance(value, list): + return [] + items = cast("list[Any]", cast("Any", value)) + return [cast("dict[str, Any]", cast("Any", item)) for item in items if isinstance(item, dict)] + + +def _choose_workspace( + console: Console, organizations: list[dict[str, Any]], workspace: str | None +) -> dict[str, Any]: + if workspace is not None: + wanted = workspace.strip().casefold() + by_id = [org for org in organizations if str(org.get("id", "")).casefold() == wanted] + if by_id: + return by_id[0] + by_name = [ + org for org in organizations if str(org.get("name", "")).strip().casefold() == wanted + ] + if len(by_name) == 1: + return by_name[0] + if len(by_name) > 1: + matching_ids = ", ".join(str(org.get("id", "")) for org in by_name) + raise PlatformAuthError( + f"multiple workspaces are named {workspace!r}; use an exact workspace ID: " + f"{matching_ids}" + ) + names = ", ".join(str(org.get("name", "")) for org in organizations) + raise PlatformAuthError(f"no workspace matches {workspace!r}. Your workspaces: {names}") + if len(organizations) == 1: + return organizations[0] + if not sys.stdin.isatty(): + choices = ", ".join(f"{org.get('name', '')} ({org.get('id', '')})" for org in organizations) + raise PlatformAuthError( + "more than one workspace is available; rerun with --workspace NAME_OR_ID. " + f"Available workspaces: {choices}" + ) + + console.print() + console.print("[bold]Select a workspace for the API token:[/]") + for index, org in enumerate(organizations, start=1): + name = _terminal_markup(org.get("name", "")) + org_role = _terminal_markup(org.get("role", "")) + console.print(f" [cyan]{index}[/]. {name} [dim]({org_role})[/]") + while True: + answer = console.input(f"Workspace [1-{len(organizations)}] (1): ").strip() or "1" + if answer.isdigit() and 1 <= int(answer) <= len(organizations): + return organizations[int(answer) - 1] + console.print("[yellow]Enter a number from the list.[/]") + + +def _choose_scopes( + console: Console, catalog: list[dict[str, Any]], role: str +) -> tuple[str, list[str] | None]: + """Prompt for a named scope profile or a custom scope list.""" + rank = _ROLE_RANK.get(role, 2) + allowed = [ + item for item in catalog if _ROLE_RANK.get(str(item.get("min_role", "viewer")), 0) <= rank + ] + if not allowed: + return "recommended", None + + console.print() + console.print("[bold]Select token scopes:[/]") + console.print( + " [cyan]1[/]. Recommended [dim](scans, findings, schedules, assets, uploads, " + "workspace switching, billing/top-ups; no token creation)[/]" + ) + console.print(" [cyan]2[/]. Full access [dim](every scope your role allows)[/]") + console.print(" [cyan]3[/]. Minimal [dim](scan read/write and billing read)[/]") + console.print(" [cyan]4[/]. Custom [dim](pick individual scopes)[/]") + while True: + answer = console.input("Scopes [1-4] (1): ").strip() or "1" + if answer == "1": + return "recommended", None + if answer == "2": + return "full", None + if answer == "3": + return "minimal", None + if answer == "4": + return "custom", _choose_custom_scopes(console, allowed) + console.print("[yellow]Enter a number from 1 to 4.[/]") + + +def _choose_custom_scopes(console: Console, allowed: list[dict[str, Any]]) -> list[str]: + selected = { + str(item["scope"]) + for item in allowed + if item.get("scope") and (item.get("default") or item.get("minimum")) + } + while True: + console.print() + for index, item in enumerate(allowed, start=1): + scope = str(item.get("scope", "")) + mark = "[green]x[/]" if scope in selected else " " + required = " [dim](always included)[/]" if item.get("minimum") else "" + rendered_scope = _terminal_markup(scope) + description = _terminal_markup(item.get("description", "")) + console.print( + f" [{mark}] [cyan]{index:>2}[/]. {rendered_scope}{required}" + f"\n [dim]{description}[/]" + ) + answer = console.input( + "Toggle scopes by number (comma separated), or press Enter to confirm: " + ).strip() + if not answer: + return sorted(selected) + for part in answer.replace(",", " ").split(): + if not part.isdigit() or not 1 <= int(part) <= len(allowed): + console.print( + f"[yellow]Ignored {_terminal_markup(part)!r}: not a number from the list.[/]" + ) + continue + item = allowed[int(part) - 1] + scope = str(item.get("scope", "")) + if item.get("minimum"): + console.print(f"[yellow]{_terminal_markup(scope)} is always included.[/]") + continue + if scope in selected: + selected.discard(scope) + else: + selected.add(scope) + + +def _json_object(response: requests.Response) -> dict[str, Any]: + try: + data = response.json() + except ValueError as exc: + raise PlatformAuthError("the server returned a response that is not JSON") from exc + if not isinstance(data, dict): + raise PlatformAuthError("the server returned an unexpected response shape") + return cast("dict[str, Any]", data) + + +def _as_positive_int(value: Any, *, default: int, maximum: int) -> int: + try: + parsed = int(value) + except (TypeError, ValueError, OverflowError): + return default + if parsed <= 0: + return default + return min(parsed, maximum) + + +def _error_detail(response: requests.Response) -> str: + with contextlib.suppress(ValueError, AttributeError): + detail = response.json().get("detail") + if detail: + return str(detail) + return f"HTTP {response.status_code}" + + +def _session_headers(record: dict[str, Any]) -> dict[str, str]: + headers = {"Authorization": f"Bearer {record['api_token']}"} + workspace_id = record.get("organization_id") + if isinstance(workspace_id, str) and workspace_id: + headers["X-Strix-Workspace"] = workspace_id + return headers + + +def _revoke_stored_session(record: dict[str, Any]) -> tuple[bool, str | None]: + """Revoke one server session; return (definitively_inactive, error).""" + app_url = record.get("app_url") + if not isinstance(app_url, str) or not app_url: + return False, ( + "the stored sign-in has no trusted platform URL; use --local-only to remove it" + ) + try: + response = requests.delete( + f"{app_url.rstrip('/')}/api/v1/cli/session", + headers=_session_headers(record), + timeout=_HTTP_TIMEOUT_S, + allow_redirects=False, + ) + except requests.RequestException as exc: + return False, f"could not revoke the remote CLI session: {exc}" + if response.status_code in {200, 204, 401}: + return True, None + return False, f"could not revoke the remote CLI session: {_error_detail(response)}" + + +def _print_logout_failure(console: Console, message: str, *, as_json: bool) -> int: + if as_json: + sys.stdout.write(json.dumps({"error": message, "removed": False}) + "\n") + else: + console.print(f"[red]Sign-out failed:[/] {_terminal_markup(message)}") + console.print("[dim]The local token was kept so you can safely retry.[/]") + return 1 + + +def _revoke_replaced_legacy_session( + previous: dict[str, Any] | None, current: dict[str, Any] +) -> None: + """Best-effort cleanup when the first device-aware login replaces a legacy token.""" + if not previous or previous.get("api_token") == current.get("api_token"): + return + if previous.get("app_url") != current.get("app_url"): + return + with contextlib.suppress(KeyError, requests.RequestException): + requests.delete( + f"{previous['app_url']}/api/v1/cli/session", + headers=_session_headers(previous), + timeout=_HTTP_TIMEOUT_S, + allow_redirects=False, + ) + + +def _print_success(console: Console, record: dict[str, Any]) -> None: + email = record.get("email", "") + organization = record.get("organization_name") or record.get("organization_id", "") + console.print() + console.print("[green]✓ Signed in to the Strix platform.[/]") + if email: + console.print(f" Account: [bold]{_terminal_markup(email)}[/]") + if organization: + console.print(f" Workspace: [bold]{_terminal_markup(organization)}[/]") + scopes = record.get("scopes") + if isinstance(scopes, list) and scopes: + console.print(f" Access: [dim]{_terminal_markup(_scope_summary(record))}[/]") + console.print(f" Token: stored in [dim]{_terminal_markup(AUTH_PATH)}[/]") + console.print() + console.print( + "[dim]The managed platform is ready. Run `strix cloud` to list the commands. " + "See https://docs.app.strix.ai for the API reference.[/]" + ) + + +def _status(console: Console, argv: list[str]) -> int: # noqa: PLR0912 + parser = _SessionArgumentParser( + prog="strix cloud whoami", + description="Show the stored managed-platform account, workspace, scopes, and expiry.", + ) + parser.add_argument("--json", action="store_true", help="Print the session as JSON.") + parser.add_argument("--show-scopes", action="store_true", help="Print every granted scope.") + as_json = "--json" in argv or not sys.stdout.isatty() + try: + args = parser.parse_args(argv) + except _SessionUsageError as exc: + if as_json: + sys.stdout.write(json.dumps({"error": str(exc)}) + "\n") + else: + console.print(f"[red]Error:[/] {_terminal_markup(exc)}") + return 2 + except SystemExit as exc: + return exc.code if isinstance(exc.code, int) else 2 + + as_json = bool(args.json) or not sys.stdout.isatty() + record = read_record() + if record is None: + if as_json: + sys.stdout.write(json.dumps({"signed_in": False, "error": "Not signed in"}) + "\n") + return 1 + console.print("[yellow]Not signed in.[/] Run [bold]strix cloud login[/] to sign in.") + return 1 + email = record.get("email", "unknown") + organization = record.get("organization_name") or record.get("organization_id", "") + expires_at = record.get("expires_at", "") + if as_json: + payload = { + "signed_in": True, + "email": email, + "organization_id": record.get("organization_id"), + "organization_name": record.get("organization_name"), + "scopes": record.get("scopes", []), + "expires_at": expires_at or None, + **({"app_url": record["app_url"]} if record.get("app_url") else {}), + } + sys.stdout.write(json.dumps(payload, indent=2, default=str) + "\n") + return 0 + console.print(f"[green]Signed in[/] as [bold]{_terminal_markup(email)}[/]") + if organization: + console.print(f" Workspace: {_terminal_markup(organization)}") + if expires_at: + console.print(f" Token expires: {_terminal_markup(expires_at)}") + if record.get("app_url"): + console.print(f" Platform: {_terminal_markup(record['app_url'])}") + scopes = record.get("scopes") + if isinstance(scopes, list) and scopes: + scope_items = cast("list[Any]", cast("Any", scopes)) + if args.show_scopes: + console.print( + f" Scopes: {_terminal_markup(' '.join(str(scope) for scope in scope_items))}" + ) + else: + console.print(f" Access: {_terminal_markup(_scope_summary(record))}") + return 0 + + +def _scope_summary(record: dict[str, Any]) -> str: + scopes = record.get("scopes") + scope_items = cast("list[Any]", cast("Any", scopes)) if isinstance(scopes, list) else [] + count = len(scope_items) + profile = str(record.get("scope_profile") or "custom").replace("_", " ").title() + return f"{profile} · {count} scope{'s' if count != 1 else ''} granted" + + +def _logout(console: Console, argv: list[str]) -> int: # noqa: PLR0911, PLR0912 + parser = _SessionArgumentParser( + prog="strix cloud logout", + description="Revoke this CLI session and remove its token from this machine.", + ) + parser.add_argument("--json", action="store_true", help="Print the result as JSON.") + parser.add_argument( + "--local-only", + action="store_true", + help="Remove only the local token, leaving the remote session active.", + ) + as_json = "--json" in argv or not sys.stdout.isatty() + try: + args = parser.parse_args(argv) + except _SessionUsageError as exc: + if as_json: + sys.stdout.write(json.dumps({"error": str(exc)}) + "\n") + else: + console.print(f"[red]Error:[/] {_terminal_markup(exc)}") + return 2 + except SystemExit as exc: + return exc.code if isinstance(exc.code, int) else 2 + as_json = bool(args.json) or not sys.stdout.isatty() + if read_record() is None and not AUTH_PATH.exists(): + if as_json: + sys.stdout.write(json.dumps({"signed_in": False, "removed": False}) + "\n") + return 0 + console.print("[yellow]Not signed in.[/]") + return 0 + record = read_record() + remotely_revoked = False + if record is not None and not args.local_only: + remotely_revoked, revoke_error = _revoke_stored_session(record) + if revoke_error: + return _print_logout_failure(console, revoke_error, as_json=as_json) + + if not logout(): + if as_json: + sys.stdout.write( + json.dumps( + { + "error": "Could not remove the stored API token", + "signed_in": True, + "removed": False, + } + ) + + "\n" + ) + return 1 + console.print( + f"[red]Could not remove the stored API token.[/] Delete " + f"{_terminal_markup(AUTH_PATH)} manually." + ) + return 1 + if as_json: + sys.stdout.write( + json.dumps( + { + "signed_in": False, + "removed": True, + "remotely_revoked": remotely_revoked, + "local_only": bool(args.local_only), + } + ) + + "\n" + ) + return 0 + if args.local_only: + console.print( + "[yellow]Local sign-out only.[/] The remote CLI session is still active; " + "revoke it from API Access if needed." + ) + else: + console.print("[green]Signed out.[/] The CLI session was revoked and removed locally.") + return 0 diff --git a/strix/interface/platform_identity.py b/strix/interface/platform_identity.py new file mode 100644 index 000000000..508e7e396 --- /dev/null +++ b/strix/interface/platform_identity.py @@ -0,0 +1,46 @@ +"""Stable, privacy-safe identity for this Strix CLI installation.""" + +from __future__ import annotations + +import json +import platform +from pathlib import Path +from typing import Any, cast +from uuid import uuid4 + +from strix.utils.secret_files import write_secret_text + + +IDENTITY_PATH = Path.home() / ".strix" / "cli-identity.json" + + +def _default_device_name(instance_id: str) -> str: + system = {"Darwin": "macOS", "Windows": "Windows", "Linux": "Linux"}.get( + platform.system(), "Computer" + ) + return f"{system} CLI · {instance_id[:8]}" + + +def read_or_create_identity(*, device_name: str | None = None) -> dict[str, str]: + """Return one installation ID, optionally updating its user-facing label.""" + record: dict[str, Any] = {} + try: + raw = json.loads(IDENTITY_PATH.read_text(encoding="utf-8")) + if isinstance(raw, dict): + record = cast("dict[str, Any]", raw) + except (OSError, json.JSONDecodeError): + pass + + instance_id = record.get("client_instance_id") + if not isinstance(instance_id, str) or len(instance_id) < 8: + instance_id = str(uuid4()) + label = device_name.strip() if device_name is not None else record.get("device_name") + if not isinstance(label, str) or not label.strip(): + label = _default_device_name(instance_id) + label = " ".join(label.split()) + if not 1 <= len(label) <= 80: + raise ValueError("device name must be 1-80 printable characters") + + identity = {"client_instance_id": instance_id, "device_name": label} + write_secret_text(IDENTITY_PATH, json.dumps(identity, indent=2)) + return identity diff --git a/strix/interface/terminal_text.py b/strix/interface/terminal_text.py new file mode 100644 index 000000000..b0cc2b4bb --- /dev/null +++ b/strix/interface/terminal_text.py @@ -0,0 +1,21 @@ +"""Safe rendering of untrusted text in a terminal.""" + +from __future__ import annotations + +import re + + +_TERMINAL_CONTROL = re.compile(r"[\x00-\x1f\x7f-\x9f]") + + +def has_terminal_control(value: object) -> bool: + """Return whether text contains bytes that can alter terminal state/protocols.""" + return _TERMINAL_CONTROL.search(str(value)) is not None + + +def sanitize_terminal_text(value: object) -> str: + """Make C0/C1 control bytes visible so they cannot operate a terminal.""" + return _TERMINAL_CONTROL.sub( + lambda match: f"\\x{ord(match.group()):02x}", + str(value), + ) diff --git a/strix/interface/tui/backend/controller.py b/strix/interface/tui/backend/controller.py index da9ee34f6..b2f1eb750 100644 --- a/strix/interface/tui/backend/controller.py +++ b/strix/interface/tui/backend/controller.py @@ -36,7 +36,8 @@ if TYPE_CHECKING: _STOPPABLE_AGENT_STATUSES = frozenset({"running", "waiting", "budget_paused"}) ChangeCallback = Callable[[], None] -StartCallback = Callable[[bool], Awaitable[None]] +StartCallback = Callable[[], Awaitable[None]] +VerifyCallback = Callable[[], Awaitable[None]] QuitCallback = Callable[[], Awaitable[None]] @@ -51,6 +52,7 @@ class TuiController: coordinator: Any = None, report_state: ReportState | None = None, on_start: StartCallback | None = None, + on_verify: VerifyCallback | None = None, on_quit: QuitCallback | None = None, on_change: ChangeCallback | None = None, ) -> None: @@ -99,7 +101,6 @@ class TuiController: # A target-less launch enters the live view and asks there before # anything is prepared; this holds the directory awaiting that answer. self.pending_workspace_mount: str | None = None - self._pending_verify = True self.messages: list[dict[str, str]] = [] self._next_message_id = 1 self.error: str | None = None @@ -112,6 +113,7 @@ class TuiController: self.viewer_url: str | None = None self._viewer_httpd: Any = None self._on_start = on_start + self._on_verify = on_verify self._on_quit = on_quit self._on_change = on_change @@ -190,7 +192,7 @@ class TuiController: model_warning = "" if model and not is_recommended_or_frontier_model(model): model_warning = ( - f"{model} is not a recommended frontier model; pentest quality could be degraded" + f"{model} is not a recommended frontier model. Pentest quality could be degraded." ) state = { "setup_mode": self.setup_mode, @@ -328,12 +330,6 @@ class TuiController: async def _start(self, payload: dict[str, Any]) -> dict[str, Any]: if self.scan_started or self._start_in_progress: raise RuntimeError("Scan is already starting or running") - # A bare prompt launches optimistically, like a coding agent: it skips - # the network model preflight and surfaces any model error live. A named - # target keeps the preflight so a real scan does not commit blind. - verify = payload.get("verify", True) - if not isinstance(verify, bool): - raise TypeError("verify must be a boolean") # Launching with no target mounts the working directory, so it requires # the user's explicit confirmation rather than happening silently. mount_working_dir = payload.get("mount_working_dir", False) @@ -344,27 +340,44 @@ class TuiController: raise ValueError("No model configured. Set STRIX_LLM first.") if self._on_start is None: raise RuntimeError("Scan start is unavailable") + if not self.targets and not mount_working_dir: + raise ValueError("No target set. Add a target first.") + # The model check runs while still on the start screen, for a bare + # prompt as much as for a named target, so a failure lands in the setup + # log where the user can fix it and retry rather than in a dead run. + await self._verify_model() if not self.targets: - if not mount_working_dir: - raise ValueError("No target set. Add a target first.") # Mounting the working directory needs the user's confirmation, and # that is asked in the live view. Enter it now and prepare nothing # until the answer arrives, so declining leaves no run behind. self.pending_workspace_mount = str(Path.cwd()) - self._pending_verify = verify self.setup_mode = False self.scan_started = True self.scan_state = "preparing" return {"started": True} - await self._begin_scan(verify) + await self._begin_scan() return {"started": True} - async def _begin_scan(self, verify: bool) -> None: + async def _verify_model(self) -> None: + if self._on_verify is None: + return + self._start_in_progress = True + try: + await self._on_verify() + finally: + self._start_in_progress = False + + async def _begin_scan(self) -> None: if self._on_start is None: raise RuntimeError("Scan start is unavailable") self._start_in_progress = True try: - await self._on_start(verify) + await self._on_start() + except Exception as exc: + if not self.setup_mode: + # The live view is already up, so the failure has to show there. + self.fail_preparation(str(exc)) + raise finally: self._start_in_progress = False self.setup_mode = False @@ -384,7 +397,7 @@ class TuiController: # the whole of the input either way; the working directory is only an # extra the agent may look at, so the run goes ahead without one. self.workspace_mount = mount if approved else None - await self._begin_scan(self._pending_verify) + await self._begin_scan() return {"approved": approved} async def _send_message(self, payload: dict[str, Any]) -> dict[str, Any]: diff --git a/strix/interface/tui/internal/app/model_test.go b/strix/interface/tui/internal/app/model_test.go index 59a3ad7c1..92452e2ef 100644 --- a/strix/interface/tui/internal/app/model_test.go +++ b/strix/interface/tui/internal/app/model_test.go @@ -370,6 +370,17 @@ func TestStartedSnapshotTransitionsToLiveView(t *testing.T) { } } +func TestSplashModelWarningRendersTheBackendSentenceOnce(t *testing.T) { + warning := "openai/glm-5.3 is not a recommended frontier model. Pentest quality could be degraded." + got := ansi.Strip(splashModelWarning("openai/glm-5.3", warning)) + if got != "⚠ "+warning { + t.Fatalf("splash warning = %q, want %q", got, "⚠ "+warning) + } + if got := ansi.Strip(splashModelWarning("other/model", warning)); got != "⚠ "+warning { + t.Fatalf("splash warning with unrelated model = %q", got) + } +} + func TestSetupStartScreenFitsNarrowTerminal(t *testing.T) { model := New(nil) model.width, model.height = 40, 18 diff --git a/strix/interface/tui/internal/app/setup.go b/strix/interface/tui/internal/app/setup.go index a7525fbf7..7a02cf34a 100644 --- a/strix/interface/tui/internal/app/setup.go +++ b/strix/interface/tui/internal/app/setup.go @@ -45,23 +45,20 @@ func (m *Model) submitSetupPrompt(value string) (tea.Model, tea.Cmd) { if len(fields) > targets { commands = append(commands, send(m.client, "setup.set_instruction", map[string]any{"instruction": value})) } - // With a target, verify the model connection before the scan commits to it. - // A bare prompt launches optimistically, like a coding agent, and mounts the - // working directory - the backend asks about that from the live view, so the - // prompt is held here in case it is declined. - verify := targets > 0 || len(m.snapshot.Targets) > 0 - payload := map[string]any{"verify": verify} - if verify { - m.setupMsg("Verifying model connection...", render.Col(amber)) - } else { + // The backend verifies the model connection before either kind of launch + // and reports on it through the setup log. A bare prompt mounts the working + // directory - the backend asks about that from the live view, so the prompt + // is held here in case it is declined. + payload := map[string]any{} + if targets == 0 && len(m.snapshot.Targets) == 0 { m.pendingPrompt = value payload["mount_working_dir"] = true } commands = append(commands, send(m.client, "setup.start", payload)) // Ordered, not batched: setup.start leaves setup mode, so it must be the - // last command to reach the backend. Batched sends race, and once the - // preflight is skipped setup.start wins, making the target and instruction - // commands land after the guard closes and fail with a red error. + // last command to reach the backend. Batched sends race, and if setup.start + // wins the target and instruction commands land after the guard closes and + // fail with a red error. return *m, tea.Sequence(commands...) } diff --git a/strix/interface/tui/internal/app/setup_prompt_test.go b/strix/interface/tui/internal/app/setup_prompt_test.go index 63a0170fc..7ac2ed829 100644 --- a/strix/interface/tui/internal/app/setup_prompt_test.go +++ b/strix/interface/tui/internal/app/setup_prompt_test.go @@ -94,25 +94,6 @@ func commandTypes(envelopes []protocol.Envelope) []string { return types } -// startVerify returns the verify flag on the setup.start command, and whether -// a setup.start command was present at all. -func startVerify(t *testing.T, envelopes []protocol.Envelope) (verify, found bool) { - t.Helper() - for _, envelope := range envelopes { - if envelope.Type != "setup.start" { - continue - } - var payload struct { - Verify bool `json:"verify"` - } - if err := json.Unmarshal(envelope.Payload, &payload); err != nil { - t.Fatal(err) - } - return payload.Verify, true - } - return false, false -} - func contains(values []string, want string) bool { for _, value := range values { if value == want { @@ -160,10 +141,6 @@ func TestSetupPromptWithoutTargetLaunchesAndRequestsMount(t *testing.T) { if mount, found := startPayloadFlag(t, envelopes, "mount_working_dir"); !found || !mount { t.Fatalf("mount was not requested: mount_working_dir=%v found=%v", mount, found) } - // A bare prompt launches optimistically: no model preflight. - if verify, found := startVerify(t, envelopes); !found || verify { - t.Fatalf("bare prompt should launch with verify=false, got verify=%v found=%v", verify, found) - } // setup.start leaves setup mode, so it must be the last command sent. if start, instr := firstIndex(types, "setup.start"), lastIndex(types, "setup.set_instruction"); start < instr { t.Fatalf("setup.start (%d) must come after setup.set_instruction (%d): %v", start, instr, types) @@ -273,9 +250,8 @@ func TestSetupPromptWithTargetLaunches(t *testing.T) { t.Fatalf("missing %s in %v", want, types) } } - // A named target keeps the upfront model check. - if verify, found := startVerify(t, envelopes); !found || !verify { - t.Fatalf("targeted prompt should launch with verify=true, got verify=%v found=%v", verify, found) + if _, found := startPayloadFlag(t, envelopes, "mount_working_dir"); found { + t.Fatalf("a targeted prompt must not ask to mount the working directory: %v", types) } // The target and instruction must reach the backend before setup.start // closes the setup guard. diff --git a/strix/interface/tui/internal/app/view.go b/strix/interface/tui/internal/app/view.go index 6e71d0ee9..8588df18d 100644 --- a/strix/interface/tui/internal/app/view.go +++ b/strix/interface/tui/internal/app/view.go @@ -411,7 +411,7 @@ func (m Model) splashView() string { welcome + "\n" + version + "\n" + tagline + "\n\n" + start.String() + "\n\n" + url if warn := m.snapshot.ModelWarning; warn != "" { - content += "\n\n" + splashModelWarning(warn) + content += "\n\n" + splashModelWarning(m.snapshot.Model, warn) } panel := lipgloss.NewStyle().Border(lipgloss.RoundedBorder()).BorderForeground(green).Padding(1, 6).Align(lipgloss.Center).Render(content) // #splash_screen background is solid black. @@ -419,12 +419,16 @@ func (m Model) splashView() string { lipgloss.WithWhitespaceBackground(black)) } -// splashModelWarning ports SplashScreen._build_model_warning_text. -func splashModelWarning(model string) string { +// splashModelWarning renders the backend's full warning sentence, with the +// model name highlighted when the sentence leads with it. +func splashModelWarning(model, warning string) string { yellow := lipgloss.Color("#eab308") - return lipgloss.NewStyle().Bold(true).Foreground(yellow).Render("⚠ ") + - lipgloss.NewStyle().Bold(true).Foreground(render.Cyan).Render(model) + - lipgloss.NewStyle().Foreground(yellow).Render(" is not a recommended frontier model - pentest quality could be degraded") + out := lipgloss.NewStyle().Bold(true).Foreground(yellow).Render("⚠ ") + if model != "" && strings.HasPrefix(warning, model) { + out += lipgloss.NewStyle().Bold(true).Foreground(render.Cyan).Render(model) + warning = strings.TrimPrefix(warning, model) + } + return out + lipgloss.NewStyle().Foreground(yellow).Render(warning) } // chatPaneKey identifies everything the bordered trace depends on. diff --git a/strix/interface/tui/internal/render/coverage_test.go b/strix/interface/tui/internal/render/coverage_test.go index 7994e875a..5f357bccf 100644 --- a/strix/interface/tui/internal/render/coverage_test.go +++ b/strix/interface/tui/internal/render/coverage_test.go @@ -194,3 +194,28 @@ func TestVulnerabilityReportRendersCalibrationFields(t *testing.T) { "Fix Verification", "bypass review reasoned only", ) } + +func TestVulnerabilityReportUpdateRendersReportAndReason(t *testing.T) { + out := ansi.Strip(Tool(tool("update_vulnerability_report", + map[string]any{ + "report_id": "vuln-0009", + "update_reason": "built a working unauthenticated file write against the endpoint", + "poc_script_code": "curl -X PATCH https://target/files/uuid", + }, + map[string]any{ + "success": true, + "action": "updated", + "report_id": "vuln-0009", + "severity": "critical", + "cvss_score": 9.3, + "updated_fields": []any{"poc_script_code"}, + }, + "completed"))) + requireContains(t, out, + "Vulnerability Report Updated", + "vuln-0009", + "built a working unauthenticated file write", + "CRITICAL", + "9.3", + ) +} diff --git a/strix/interface/tui/internal/render/registry.go b/strix/interface/tui/internal/render/registry.go index 75fb23fe0..a7cfc6c79 100644 --- a/strix/interface/tui/internal/render/registry.go +++ b/strix/interface/tui/internal/render/registry.go @@ -84,6 +84,8 @@ func Tool(data map[string]any) string { return renderViewImage(args, result) case "create_vulnerability_report": return renderVulnerabilityReport(args, result) + case "update_vulnerability_report": + return renderVulnerabilityReportUpdate(args, result) case "create_dependency_report": return renderDependencyReport(args, result) case "list_reports": diff --git a/strix/interface/tui/internal/render/report.go b/strix/interface/tui/internal/render/report.go index 9fe2026ad..4640225ad 100644 --- a/strix/interface/tui/internal/render/report.go +++ b/strix/interface/tui/internal/render/report.go @@ -12,15 +12,27 @@ import ( // --------------------------------------------------------------------------- func renderVulnerabilityReport(args map[string]any, result any) string { + return renderReport(args, result, "Vulnerability Report", "Creating report...") +} + +// A revision names the report it changes and carries only the fields it +// replaces, so it renders the same sections with the ones it left alone absent. +func renderVulnerabilityReportUpdate(args map[string]any, result any) string { + return renderReport(args, result, "Vulnerability Report Updated", "Updating report...") +} + +func renderReport(args map[string]any, result any, heading, pending string) string { resultMap, _ := result.(map[string]any) var b strings.Builder - b.WriteString("🐞 " + Bold(ReportHdr).Render("Vulnerability Report")) + b.WriteString("🐞 " + Bold(ReportHdr).Render(heading)) field := func(label, value string) { if value != "" { b.WriteString("\n\n" + Bold(Field).Render(label+": ") + value) } } + reportID := StringValue(args["report_id"]) + field("Report", reportID) title := StringValue(args["title"]) field("Title", title) @@ -59,6 +71,7 @@ func renderVulnerabilityReport(args map[string]any, result any) string { } } + section("Reason", StringValue(args["update_reason"])) section("Description", StringValue(args["description"])) section("Impact", StringValue(args["impact"])) section("Technical Analysis", StringValue(args["technical_analysis"])) @@ -76,8 +89,8 @@ func renderVulnerabilityReport(args map[string]any, result any) string { // was verified belongs next to it rather than in the artifact alone. section("Fix Verification", StringValue(args["fix_verification"])) - if title == "" { - b.WriteString("\n " + Dim().Render("Creating report...")) + if title == "" && reportID == "" { + b.WriteString("\n " + Dim().Render(pending)) } return "\n\n" + b.String() + "\n\n" } diff --git a/strix/interface/tui/runtime.py b/strix/interface/tui/runtime.py index 12b3602f6..d398e5aba 100644 --- a/strix/interface/tui/runtime.py +++ b/strix/interface/tui/runtime.py @@ -37,6 +37,7 @@ from strix.interface.tui.sidecar import ( ) from strix.interface.utils import read_workspace_files from strix.report.state import ReportState, set_global_report_state +from strix.telemetry import report_error, set_scan_phase from strix.utils.resource_paths import get_strix_resource_path @@ -63,11 +64,14 @@ class GoTuiRuntime: self.scan_error: BaseException | None = None self._last_sync_fingerprint = "" self._error_noted_agents: set[str] = set() + self.model_verified = False + self._setup_preflight: asyncio.Task[None] | None = None self.controller = TuiController( args, live_view=self.live_view, coordinator=self.coordinator, on_start=self.start_from_setup, + on_verify=self.ensure_model_verified, on_quit=self.quit, ) self.server = TuiBackendServer(self.controller) @@ -102,9 +106,58 @@ class GoTuiRuntime: self.report_state.vulnerability_found_callback = lambda _report: ( self.controller.notify_changed() ) + self.report_state.vulnerability_updated_callback = lambda _report: ( + self.controller.notify_changed() + ) self.controller.notify_changed() - async def start_from_setup(self, verify: bool = True) -> None: + async def check_setup_model(self) -> None: + """Verify the model route as soon as the start screen is up. + + The same round trip a direct launch makes in prepare_and_start, run in + the background so the screen paints first and the outcome lands in the + setup log before the user has finished typing. + """ + if not (load_settings().llm.model or "").strip(): + return + try: + await self._preflight_model() + except Exception as exc: + logger.exception("Go TUI setup model preflight failed") + self.controller.add_message(f"Model connection failed: {exc}", "error") + return + self.controller.add_message("Model connection verified") + + async def ensure_model_verified(self) -> None: + """Hold a setup launch until the model has answered once.""" + preflight = self._setup_preflight + if preflight is not None and not preflight.done(): + await asyncio.shield(preflight) + if self.model_verified: + return + try: + await self._preflight_model() + except Exception as exc: + logger.exception("Go TUI setup model preflight failed") + report_error("model_connection_failed", exc) + raise RuntimeError(f"Model connection failed: {exc}") from exc + + async def _preflight_model(self) -> None: + model = (load_settings().llm.model or "").strip() + self.controller.add_message("Verifying model connection...") + set_scan_phase("preflight") + await preflight_model_connection(model) + self.model_verified = True + + def _start_preparation(self) -> asyncio.Task[None]: + """Kick off the work that runs behind the freshly painted TUI.""" + if self.controller.setup_mode: + self._setup_preflight = asyncio.create_task(self.check_setup_model()) + return self._setup_preflight + self.controller.begin_preparation() + return asyncio.create_task(self.prepare_and_start()) + + async def start_from_setup(self) -> None: candidate = deepcopy(self.args) candidate.scan_mode = self.controller.scan_mode candidate.instruction = self.controller.instruction @@ -121,16 +174,7 @@ class GoTuiRuntime: if isinstance(target, dict) and target.get("original") ] targets_changed = self.controller.targets != existing_targets - model = (load_settings().llm.model or "").strip() - # A bare prompt launches optimistically: it skips the network preflight - # and lets any model error surface once the agent starts, like a coding - # agent. A named target keeps the upfront check. - if verify: - try: - await preflight_model_connection(model) - except Exception as exc: - logger.exception("Go TUI setup model preflight failed") - raise RuntimeError(f"Model connection failed: {exc}") from exc + persist_current() # A confirmed target-less launch mounts the working directory for the # agent to work in, without making it a scan target. candidate.workspace_mount = self.controller.workspace_mount @@ -140,7 +184,11 @@ class GoTuiRuntime: candidate.target = list(self.controller.targets) candidate.target_list = [] build_targets_info(candidate) - prepare_run(candidate) + try: + prepare_run(candidate) + except Exception as exc: + report_error("scan_preparation_failed", exc) + raise telemetry_start(candidate) vars(self.args).update(vars(candidate)) @@ -154,13 +202,21 @@ class GoTuiRuntime: launch so the interface appears immediately. """ model = (load_settings().llm.model or "").strip() + set_scan_phase("preflight") try: await preflight_model_connection(model) + except Exception as exc: + logger.exception("Go TUI scan preparation failed") + report_error("model_connection_failed", exc) + self.controller.fail_preparation(str(exc)) + return + try: persist_current() prepare_run(self.args) telemetry_start(self.args) except Exception as exc: logger.exception("Go TUI scan preparation failed") + report_error("scan_preparation_failed", exc) self.controller.fail_preparation(str(exc)) return self.controller.scan_state = "running" @@ -199,6 +255,9 @@ class GoTuiRuntime: self.controller.scan_state = "completed" if report_status == "completed" else "stopped" except Exception as exc: logger.exception("Go TUI scan failed") + report_error("unhandled_exception", exc) + if self.report_state is not None and self.report_state.scan_ended_exit_reason is None: + self.report_state.scan_ended_exit_reason = "error" self.scan_error = exc self.controller.error = str(exc) self.controller.scan_state = "failed" @@ -373,9 +432,7 @@ class GoTuiRuntime: ) process, backend_socket = await launch_tui_process(command, env, cwd) await self.server.start(backend_socket) - if not self.controller.setup_mode: - self.controller.begin_preparation() - prepare_task = asyncio.create_task(self.prepare_and_start()) + prepare_task = self._start_preparation() sync_task = asyncio.create_task(self.sync_state()) return_code = await wait_process(process) check_return_code(return_code) diff --git a/strix/interface/url_safety.py b/strix/interface/url_safety.py new file mode 100644 index 000000000..b9a771656 --- /dev/null +++ b/strix/interface/url_safety.py @@ -0,0 +1,85 @@ +"""Validation for URLs printed or opened on behalf of a remote service.""" + +from __future__ import annotations + +import ipaddress +from urllib.parse import SplitResult, urlsplit + +from strix.interface.terminal_text import has_terminal_control + + +def is_safe_web_url( + value: object, + *, + trusted_origin: str | None = None, + require_trusted_origin: bool = False, +) -> bool: + """Accept a strict HTTP(S) URL, optionally only on a pre-trusted origin.""" + parsed = _parse(value) + if parsed is None: + return False + trusted = _parse(trusted_origin) if trusted_origin is not None else None + same_origin = trusted is not None and _origin(parsed) == _origin(trusted) + if require_trusted_origin: + return same_origin + if same_origin: + return True + return _is_safe_external_https(parsed) + + +def _is_safe_external_https(parsed: SplitResult) -> bool: + """Reject local, numeric-looking, or otherwise ambiguous external hosts.""" + hostname = (parsed.hostname or "").lower().rstrip(".") + if ( + parsed.scheme != "https" + or hostname == "localhost" + or hostname.endswith((".localhost", ".local")) + ): + return False + try: + return ipaddress.ip_address(hostname).is_global + except ValueError: + pass + labels = hostname.split(".") + return len(labels) >= 2 and not all(_looks_numeric(label) for label in labels) + + +def _parse(value: object) -> SplitResult | None: + if not isinstance(value, str) or not value or has_terminal_control(value): + return None + if "\\" in value or any(character.isspace() for character in value): + return None + try: + parsed = urlsplit(value) + port = parsed.port + except ValueError: + return None + hostname = parsed.hostname + if ( + parsed.scheme not in {"http", "https"} + or not hostname + or parsed.username is not None + or parsed.password is not None + or parsed.fragment + or "%" in parsed.netloc + ): + return None + try: + hostname.encode("ascii") + except UnicodeEncodeError: + return None + return parsed if port is None or 1 <= port <= 65535 else None + + +def _origin(parsed: SplitResult) -> tuple[str, str, int]: + default_port = 443 if parsed.scheme == "https" else 80 + return parsed.scheme, (parsed.hostname or "").lower().rstrip("."), parsed.port or default_port + + +def _looks_numeric(label: str) -> bool: + lowered = label.lower() + if lowered.startswith("0x"): + return len(lowered) > 2 and all( + character in "0123456789abcdef" for character in lowered[2:] + ) + return bool(lowered) and all(character.isdigit() for character in lowered) diff --git a/strix/interface/utils.py b/strix/interface/utils.py index faab17725..e051a1856 100644 --- a/strix/interface/utils.py +++ b/strix/interface/utils.py @@ -19,6 +19,7 @@ from rich.panel import Panel from rich.text import Text from strix.config import load_settings +from strix.telemetry import report_error from strix.utils.api_spec import detect_spec_format @@ -1602,7 +1603,8 @@ def check_docker_connection() -> Any: try: return docker.from_env() - except DockerException: + except DockerException as exc: + report_error("docker_unavailable", exc) console = Console() error_text = Text() error_text.append("DOCKER NOT AVAILABLE", style="bold red") diff --git a/strix/interface/viewer/cli.py b/strix/interface/viewer/cli.py index eb64b8c8f..59152cf35 100644 --- a/strix/interface/viewer/cli.py +++ b/strix/interface/viewer/cli.py @@ -87,7 +87,7 @@ def run_view(argv: list[str]) -> None: posthog.viewer_opened(source="cli", live=live) - state_label = "[#eab308]live[/]" if live else "[#22c55e]finished[/]" + state_label = _state_label(summary) console.print() console.print(f"Serving [bold white]{run_name}[/] ({state_label}) at:") # Print the URL alone on its own line with soft_wrap so Rich never inserts a @@ -107,6 +107,18 @@ def run_view(argv: list[str]) -> None: httpd.server_close() +def _state_label(summary: dict[str, object]) -> str: + if not summary.get("finished", False): + return "[#eab308]live[/]" + + status = summary.get("status") + if status == "failed": + return "[#ef4444]failed[/]" + if status in {"stopped", "interrupted"}: + return f"[#eab308]{status}[/]" + return "[#22c55e]finished[/]" + + def _resolve_run_dir(run: str | None, console: Console) -> Path: if run: run_dir = run_dir_for(run) diff --git a/strix/interface/viewer/frontend/src/App.tsx b/strix/interface/viewer/frontend/src/App.tsx index 97b22ce74..bbd24f4c7 100644 --- a/strix/interface/viewer/frontend/src/App.tsx +++ b/strix/interface/viewer/frontend/src/App.tsx @@ -8,6 +8,7 @@ import { Radar, Rocket, ArrowUpRight, + Building2, History, } from "lucide-react"; import type { Vulnerability, VulnerabilitySeverity } from "@/types/issues"; @@ -35,7 +36,7 @@ import { type LoadedRun, type RunsPayload, } from "@/data/serverSource"; -import { SIGNUP_URL, ctaUrl, trackCta } from "@/lib/cta"; +import { SIGNUP_URL, DEMO_URL, ctaUrl, trackCta } from "@/lib/cta"; import { runTitle } from "@/lib/target-utils"; import Sidebar from "@/components/Sidebar"; import PastRunsView from "@/components/PastRunsView"; @@ -706,6 +707,31 @@ function OverviewTab({ )} + {finished && ( +
+

Strix Cloud

+

Run your next pentest in Strix Cloud.

+
+ + +
+
+ )} + {sections.length > 0 ? (
{sections.map((s) => ( @@ -789,14 +815,23 @@ function AgentsTab({ run, canSteer }: { run: LoadedRun; canSteer: boolean }) { {/* Re-run always routes to Strix Cloud. */}

Run this pentest with more depth

-

Re-run this pentest on managed infra in the cloud.

+

Run this pentest again in Strix Cloud.

+
diff --git a/strix/interface/viewer/frontend/src/components/ProCta.tsx b/strix/interface/viewer/frontend/src/components/ProCta.tsx index 80fda320f..ba68d4463 100644 --- a/strix/interface/viewer/frontend/src/components/ProCta.tsx +++ b/strix/interface/viewer/frontend/src/components/ProCta.tsx @@ -48,23 +48,40 @@ export function ProInlineCta({ slug, icon: Icon, surface, + href = SIGNUP_URL, + primary = false, }: { label: string; desc: string; slug: string; icon: React.ElementType; surface?: string; + /** Destination before attribution params. Defaults to cloud sign-up. */ + href?: string; + /** Solid white button instead of the outlined default. */ + primary?: boolean; }) { return ( trackCta(slug, surface)} - className="group inline-flex items-center gap-2 rounded-lg border border-[#222] bg-[rgba(255,255,255,0.02)] px-3 py-2 text-sm text-[#aaa] transition-colors hover:border-[#444] hover:text-white" + className={ + primary + ? "group inline-flex items-center gap-2 rounded-lg border border-white bg-white px-3 py-2 text-sm font-semibold text-black transition-colors hover:bg-[#e5e5e5]" + : "group inline-flex items-center gap-2 rounded-lg border border-[#222] bg-[rgba(255,255,255,0.02)] px-3 py-2 text-sm text-[#aaa] transition-colors hover:border-[#444] hover:text-white" + } > - diff --git a/strix/interface/viewer/frontend/src/components/UpgradeModal.tsx b/strix/interface/viewer/frontend/src/components/UpgradeModal.tsx index 1c39b9766..5f9cb9b8f 100644 --- a/strix/interface/viewer/frontend/src/components/UpgradeModal.tsx +++ b/strix/interface/viewer/frontend/src/components/UpgradeModal.tsx @@ -10,7 +10,7 @@ import { WandSparkles, Plug, } from "lucide-react"; -import { SIGNUP_URL, PRICING_URL, ctaUrl, trackCta } from "@/lib/cta"; +import { SIGNUP_URL, PRICING_URL, DEMO_URL, ctaUrl, trackCta } from "@/lib/cta"; /** * Dialog shown when a platform feature is clicked in the sidebar: a short @@ -141,6 +141,19 @@ export function UpgradeModal({
+ +

+ SSO, compliance reports, or a private deployment?{" "} + trackCta("upgrade_book_demo", source)} + className="whitespace-nowrap text-[#aaa] underline underline-offset-2 transition-colors hover:text-white" + > + Try Strix Enterprise + +

diff --git a/strix/interface/viewer/frontend/src/components/live/tool-renderers/index.ts b/strix/interface/viewer/frontend/src/components/live/tool-renderers/index.ts index b075aa36a..dcc568fb9 100644 --- a/strix/interface/viewer/frontend/src/components/live/tool-renderers/index.ts +++ b/strix/interface/viewer/frontend/src/components/live/tool-renderers/index.ts @@ -116,7 +116,7 @@ const CATEGORY_TOOLS: Record = { filesystem: ["apply_patch", "view_image", "str_replace_editor", "list_files", "search_files"], // Caido proxy tools (legacy: send_request) proxy: ["list_requests", "view_request", "repeat_request", "list_sitemap", "view_sitemap_entry", "scope_rules", "send_request"], - reporting: ["create_vulnerability_report", "list_reports", "get_report"], + reporting: ["create_vulnerability_report", "update_vulnerability_report", "list_reports", "get_report"], thinking: ["think"], agents: ["create_agent", "agent_finish", "send_message_to_agent", "wait_for_agents", "view_agent_graph", "stop_agent"], search: ["web_search"], diff --git a/strix/interface/viewer/report_pdf.py b/strix/interface/viewer/report_pdf.py index 951fb6687..b749f2706 100644 --- a/strix/interface/viewer/report_pdf.py +++ b/strix/interface/viewer/report_pdf.py @@ -20,6 +20,7 @@ from datetime import datetime from io import BytesIO from typing import TYPE_CHECKING, Any +from markdown_it import MarkdownIt from pypdf import PdfReader, PdfWriter from reportlab.lib import colors from reportlab.lib.enums import TA_CENTER @@ -49,6 +50,8 @@ from strix.interface.viewer.transcript import ( if TYPE_CHECKING: from pathlib import Path + from markdown_it.token import Token + # Palette lifted from the cloud report theme (styles/base.ts, docx/theme.ts). _INK = colors.HexColor("#000000") @@ -72,11 +75,21 @@ _SANS_BOLD = "Helvetica-Bold" _MONO = "Courier" _PAGE_W, _PAGE_H = A4 +_INLINE_MD = MarkdownIt("commonmark", {"html": False, "linkify": False}).disable( + ["autolink", "image", "link"] +) +_UNSAFE_TEXT_RE = re.compile(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f\ud800-\udfff\ufffe\uffff]") + + +def _normalize_text(value: Any) -> str: + """Normalize characters that ReportLab cannot safely serialize.""" + text = str(value).replace("\r\n", "\n").replace("\r", "\n") + return _UNSAFE_TEXT_RE.sub("\ufffd", text) def _esc(value: Any) -> str: """Escape a value for reportlab's Paragraph markup.""" - return html.escape(str(value)).replace("\n", "
") + return html.escape(_normalize_text(value)).replace("\n", "
") class _NumberedCanvas(pdfcanvas.Canvas): # type: ignore[misc] # reportlab base is untyped @@ -253,7 +266,10 @@ def _duration(start: Any, end: Any) -> str: end_dt = _parse_time(end) if not start_dt or not end_dt: return "n/a" - seconds = int((end_dt - start_dt).total_seconds()) + try: + seconds = int((end_dt - start_dt).total_seconds()) + except (OverflowError, TypeError): + return "n/a" if seconds < 0: return "n/a" hours, remainder = divmod(seconds, 3600) @@ -265,10 +281,18 @@ def _duration(start: Any, end: Any) -> str: return f"{secs}s" -def _severity_badge(styles: dict[str, ParagraphStyle], severity: str) -> Table: +def _normalize_severity(value: Any) -> str: + severity = str(value or "").lower().strip() + if severity == "informational": + return "info" + return severity if severity in {*_SEVERITY_COLORS, "info"} else "low" + + +def _severity_badge(styles: dict[str, ParagraphStyle], severity: Any) -> Table: """A colored pill matching .severity-badge in the cloud report.""" + severity = _normalize_severity(severity) color = _SEVERITY_COLORS.get(severity, _MUTED) - cell = Paragraph(severity.upper(), styles["badge"]) + cell = Paragraph(_esc(severity.upper()), styles["badge"]) table = Table([[cell]], colWidths=[len(severity) * 6.5 + 20]) table.setStyle( TableStyle( @@ -406,27 +430,36 @@ def _cover( def _inline_md(text: str) -> str: - """Convert inline markdown (bold, italic, `code`) to reportlab markup. + """Render a safe subset of inline Markdown as ReportLab markup.""" + tokens = _INLINE_MD.parseInline(_normalize_text(text))[0].children or [] + return "".join(_inline_token_markup(token) for token in tokens) - Code spans are stashed as placeholders before bold/italic run, so bold that - wraps a code span (``**`x`**``) works and code contents are never mangled. - """ - codes: list[str] = [] - def _stash(match: re.Match[str]) -> str: - codes.append(match.group(1)) - return f"\x00{len(codes) - 1}\x00" +def _inline_token_markup(token: Token) -> str: + fixed_markup = { + "strong_open": "", + "strong_close": "", + "em_open": "", + "em_close": "", + "hardbreak": "
", + "softbreak": " ", + }.get(token.type) + if fixed_markup is not None: + return fixed_markup + if token.type == "code_inline": + return f'{html.escape(token.content)}' + # Unsupported token content remains escaped so parser extensions cannot + # expose ReportLab tags. + return html.escape(token.content) - seg = html.escape(re.sub(r"`([^`]+)`", _stash, text)) - seg = re.sub(r"\*\*(.+?)\*\*", r"\1", seg) - seg = re.sub(r"__(.+?)__", r"\1", seg) - seg = re.sub(r"\*(.+?)\*", r"\1", seg) - def _restore(match: re.Match[str]) -> str: - inner = html.escape(codes[int(match.group(1))]) - return f'{inner}' - - return re.sub(r"\x00(\d+)\x00", _restore, seg) +def _markdown_paragraph(text: str, style: ParagraphStyle) -> Paragraph: + """Build a Markdown paragraph, falling back to escaped source text.""" + source = _normalize_text(text) + try: + return Paragraph(_inline_md(source), style) + except ValueError: + return Paragraph(_esc(source), style) def _strip_leading_heading(md: str) -> str: @@ -447,12 +480,12 @@ def _markdown_flowables( # noqa: PLR0915 - cohesive block parser, splitting hur def flush_para() -> None: if para: - flow.append(Paragraph(_inline_md(" ".join(para)), styles["body"])) + flow.append(_markdown_paragraph(" ".join(para), styles["body"])) para.clear() def flush_bullets() -> None: for marker, item in bullets: - flow.append(Paragraph(f"{marker} {_inline_md(item)}", styles["bullet"])) + flow.append(_markdown_paragraph(f"{marker}\u00a0{item}", styles["bullet"])) bullets.clear() lines = md.replace("\r\n", "\n").split("\n") @@ -479,7 +512,7 @@ def _markdown_flowables( # noqa: PLR0915 - cohesive block parser, splitting hur if heading: flush_para() flush_bullets() - flow.append(Paragraph(_inline_md(heading.group(2)), styles["md_heading"])) + flow.append(_markdown_paragraph(heading.group(2), styles["md_heading"])) i += 1 continue ordered = re.match(r"^(\d+)\.\s+(.*)$", stripped) @@ -532,7 +565,7 @@ def _finding_flowables( styles: dict[str, ParagraphStyle], index: int, vuln: dict[str, Any] ) -> list[Flowable]: title = vuln.get("title") or "Untitled finding" - severity = str(vuln.get("severity") or "").lower().strip() or "low" + severity = _normalize_severity(vuln.get("severity")) meta_bits = [] if vuln.get("cvss") is not None: diff --git a/strix/interface/viewer/static/assets/index-Bpn8GiSb.js b/strix/interface/viewer/static/assets/index-B94ANU8d.js similarity index 65% rename from strix/interface/viewer/static/assets/index-Bpn8GiSb.js rename to strix/interface/viewer/static/assets/index-B94ANU8d.js index 478501f74..8e12932be 100644 --- a/strix/interface/viewer/static/assets/index-Bpn8GiSb.js +++ b/strix/interface/viewer/static/assets/index-B94ANU8d.js @@ -1,4 +1,4 @@ -(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const s of document.querySelectorAll('link[rel="modulepreload"]'))a(s);new MutationObserver(s=>{for(const o of s)if(o.type==="childList")for(const c of o.addedNodes)c.tagName==="LINK"&&c.rel==="modulepreload"&&a(c)}).observe(document,{childList:!0,subtree:!0});function r(s){const o={};return s.integrity&&(o.integrity=s.integrity),s.referrerPolicy&&(o.referrerPolicy=s.referrerPolicy),s.crossOrigin==="use-credentials"?o.credentials="include":s.crossOrigin==="anonymous"?o.credentials="omit":o.credentials="same-origin",o}function a(s){if(s.ep)return;s.ep=!0;const o=r(s);fetch(s.href,o)}})();function Ao(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}var fh={exports:{}},Xl={};/** +(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const s of document.querySelectorAll('link[rel="modulepreload"]'))a(s);new MutationObserver(s=>{for(const o of s)if(o.type==="childList")for(const c of o.addedNodes)c.tagName==="LINK"&&c.rel==="modulepreload"&&a(c)}).observe(document,{childList:!0,subtree:!0});function r(s){const o={};return s.integrity&&(o.integrity=s.integrity),s.referrerPolicy&&(o.referrerPolicy=s.referrerPolicy),s.crossOrigin==="use-credentials"?o.credentials="include":s.crossOrigin==="anonymous"?o.credentials="omit":o.credentials="same-origin",o}function a(s){if(s.ep)return;s.ep=!0;const o=r(s);fetch(s.href,o)}})();function Mo(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}var hh={exports:{}},Xl={};/** * @license React * react-jsx-runtime.production.js * @@ -6,7 +6,7 @@ * * This source code is licensed under the MIT license found in the * LICENSE file in the root directory of this source tree. - */var Q0;function Mk(){if(Q0)return Xl;Q0=1;var e=Symbol.for("react.transitional.element"),t=Symbol.for("react.fragment");function r(a,s,o){var c=null;if(o!==void 0&&(c=""+o),s.key!==void 0&&(c=""+s.key),"key"in s){o={};for(var d in s)d!=="key"&&(o[d]=s[d])}else o=s;return s=o.ref,{$$typeof:e,type:a,key:c,ref:s!==void 0?s:null,props:o}}return Xl.Fragment=t,Xl.jsx=r,Xl.jsxs=r,Xl}var W0;function Ok(){return W0||(W0=1,fh.exports=Mk()),fh.exports}var m=Ok(),hh={exports:{}},Ve={};/** + */var J0;function jk(){if(J0)return Xl;J0=1;var e=Symbol.for("react.transitional.element"),t=Symbol.for("react.fragment");function r(a,s,o){var c=null;if(o!==void 0&&(c=""+o),s.key!==void 0&&(c=""+s.key),"key"in s){o={};for(var d in s)d!=="key"&&(o[d]=s[d])}else o=s;return s=o.ref,{$$typeof:e,type:a,key:c,ref:s!==void 0?s:null,props:o}}return Xl.Fragment=t,Xl.jsx=r,Xl.jsxs=r,Xl}var ey;function Dk(){return ey||(ey=1,hh.exports=jk()),hh.exports}var m=Dk(),mh={exports:{}},Ve={};/** * @license React * react.production.js * @@ -14,7 +14,7 @@ * * This source code is licensed under the MIT license found in the * LICENSE file in the root directory of this source tree. - */var J0;function Rk(){if(J0)return Ve;J0=1;var e=Symbol.for("react.transitional.element"),t=Symbol.for("react.portal"),r=Symbol.for("react.fragment"),a=Symbol.for("react.strict_mode"),s=Symbol.for("react.profiler"),o=Symbol.for("react.consumer"),c=Symbol.for("react.context"),d=Symbol.for("react.forward_ref"),h=Symbol.for("react.suspense"),f=Symbol.for("react.memo"),p=Symbol.for("react.lazy"),g=Symbol.for("react.activity"),b=Symbol.iterator;function y(L){return L===null||typeof L!="object"?null:(L=b&&L[b]||L["@@iterator"],typeof L=="function"?L:null)}var _={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},N=Object.assign,S={};function w(L,F,D){this.props=L,this.context=F,this.refs=S,this.updater=D||_}w.prototype.isReactComponent={},w.prototype.setState=function(L,F){if(typeof L!="object"&&typeof L!="function"&&L!=null)throw Error("takes an object of state variables to update or a function which returns an object of state variables.");this.updater.enqueueSetState(this,L,F,"setState")},w.prototype.forceUpdate=function(L){this.updater.enqueueForceUpdate(this,L,"forceUpdate")};function C(){}C.prototype=w.prototype;function E(L,F,D){this.props=L,this.context=F,this.refs=S,this.updater=D||_}var A=E.prototype=new C;A.constructor=E,N(A,w.prototype),A.isPureReactComponent=!0;var B=Array.isArray;function R(){}var H={H:null,A:null,T:null,S:null},z=Object.prototype.hasOwnProperty;function Y(L,F,D){var V=D.ref;return{$$typeof:e,type:L,key:F,ref:V!==void 0?V:null,props:D}}function j(L,F){return Y(L.type,F,L.props)}function I(L){return typeof L=="object"&&L!==null&&L.$$typeof===e}function Z(L){var F={"=":"=0",":":"=2"};return"$"+L.replace(/[=:]/g,function(D){return F[D]})}var P=/\/+/g;function k(L,F){return typeof L=="object"&&L!==null&&L.key!=null?Z(""+L.key):F.toString(36)}function $(L){switch(L.status){case"fulfilled":return L.value;case"rejected":throw L.reason;default:switch(typeof L.status=="string"?L.then(R,R):(L.status="pending",L.then(function(F){L.status==="pending"&&(L.status="fulfilled",L.value=F)},function(F){L.status==="pending"&&(L.status="rejected",L.reason=F)})),L.status){case"fulfilled":return L.value;case"rejected":throw L.reason}}throw L}function O(L,F,D,V,q){var Q=typeof L;(Q==="undefined"||Q==="boolean")&&(L=null);var J=!1;if(L===null)J=!0;else switch(Q){case"bigint":case"string":case"number":J=!0;break;case"object":switch(L.$$typeof){case e:case t:J=!0;break;case p:return J=L._init,O(J(L._payload),F,D,V,q)}}if(J)return q=q(L),J=V===""?"."+k(L,0):V,B(q)?(D="",J!=null&&(D=J.replace(P,"$&/")+"/"),O(q,F,D,"",function(oe){return oe})):q!=null&&(I(q)&&(q=j(q,D+(q.key==null||L&&L.key===q.key?"":(""+q.key).replace(P,"$&/")+"/")+J)),F.push(q)),1;J=0;var W=V===""?".":V+":";if(B(L))for(var te=0;te>>1,M=O[X];if(0>>1;Xs(D,K))Vs(q,D)?(O[X]=q,O[V]=K,X=V):(O[X]=D,O[F]=K,X=F);else if(Vs(q,K))O[X]=q,O[V]=K,X=V;else break e}}return U}function s(O,U){var K=O.sortIndex-U.sortIndex;return K!==0?K:O.id-U.id}if(e.unstable_now=void 0,typeof performance=="object"&&typeof performance.now=="function"){var o=performance;e.unstable_now=function(){return o.now()}}else{var c=Date,d=c.now();e.unstable_now=function(){return c.now()-d}}var h=[],f=[],p=1,g=null,b=3,y=!1,_=!1,N=!1,S=!1,w=typeof setTimeout=="function"?setTimeout:null,C=typeof clearTimeout=="function"?clearTimeout:null,E=typeof setImmediate<"u"?setImmediate:null;function A(O){for(var U=r(f);U!==null;){if(U.callback===null)a(f);else if(U.startTime<=O)a(f),U.sortIndex=U.expirationTime,t(h,U);else break;U=r(f)}}function B(O){if(N=!1,A(O),!_)if(r(h)!==null)_=!0,R||(R=!0,Z());else{var U=r(f);U!==null&&$(B,U.startTime-O)}}var R=!1,H=-1,z=5,Y=-1;function j(){return S?!0:!(e.unstable_now()-YO&&j());){var X=g.callback;if(typeof X=="function"){g.callback=null,b=g.priorityLevel;var M=X(g.expirationTime<=O);if(O=e.unstable_now(),typeof M=="function"){g.callback=M,A(O),U=!0;break t}g===r(h)&&a(h),A(O)}else a(h);g=r(h)}if(g!==null)U=!0;else{var L=r(f);L!==null&&$(B,L.startTime-O),U=!1}}break e}finally{g=null,b=K,y=!1}U=void 0}}finally{U?Z():R=!1}}}var Z;if(typeof E=="function")Z=function(){E(I)};else if(typeof MessageChannel<"u"){var P=new MessageChannel,k=P.port2;P.port1.onmessage=I,Z=function(){k.postMessage(null)}}else Z=function(){w(I,0)};function $(O,U){H=w(function(){O(e.unstable_now())},U)}e.unstable_IdlePriority=5,e.unstable_ImmediatePriority=1,e.unstable_LowPriority=4,e.unstable_NormalPriority=3,e.unstable_Profiling=null,e.unstable_UserBlockingPriority=2,e.unstable_cancelCallback=function(O){O.callback=null},e.unstable_forceFrameRate=function(O){0>O||125X?(O.sortIndex=K,t(f,O),r(h)===null&&O===r(f)&&(N?(C(H),H=-1):N=!0,$(B,K-X))):(O.sortIndex=M,t(h,O),_||y||(_=!0,R||(R=!0,Z()))),O},e.unstable_shouldYield=j,e.unstable_wrapCallback=function(O){var U=b;return function(){var K=b;b=U;try{return O.apply(this,arguments)}finally{b=K}}}})(gh)),gh}var ny;function Dk(){return ny||(ny=1,ph.exports=jk()),ph.exports}var xh={exports:{}},Tn={};/** + */var ry;function zk(){return ry||(ry=1,(function(e){function t(O,U){var K=O.length;O.push(U);e:for(;0>>1,M=O[X];if(0>>1;Xs(D,K))Vs(q,D)?(O[X]=q,O[V]=K,X=V):(O[X]=D,O[F]=K,X=F);else if(Vs(q,K))O[X]=q,O[V]=K,X=V;else break e}}return U}function s(O,U){var K=O.sortIndex-U.sortIndex;return K!==0?K:O.id-U.id}if(e.unstable_now=void 0,typeof performance=="object"&&typeof performance.now=="function"){var o=performance;e.unstable_now=function(){return o.now()}}else{var c=Date,d=c.now();e.unstable_now=function(){return c.now()-d}}var h=[],f=[],p=1,g=null,b=3,y=!1,_=!1,N=!1,S=!1,w=typeof setTimeout=="function"?setTimeout:null,C=typeof clearTimeout=="function"?clearTimeout:null,E=typeof setImmediate<"u"?setImmediate:null;function A(O){for(var U=r(f);U!==null;){if(U.callback===null)a(f);else if(U.startTime<=O)a(f),U.sortIndex=U.expirationTime,t(h,U);else break;U=r(f)}}function B(O){if(N=!1,A(O),!_)if(r(h)!==null)_=!0,R||(R=!0,Z());else{var U=r(f);U!==null&&$(B,U.startTime-O)}}var R=!1,H=-1,z=5,Y=-1;function j(){return S?!0:!(e.unstable_now()-YO&&j());){var X=g.callback;if(typeof X=="function"){g.callback=null,b=g.priorityLevel;var M=X(g.expirationTime<=O);if(O=e.unstable_now(),typeof M=="function"){g.callback=M,A(O),U=!0;break t}g===r(h)&&a(h),A(O)}else a(h);g=r(h)}if(g!==null)U=!0;else{var L=r(f);L!==null&&$(B,L.startTime-O),U=!1}}break e}finally{g=null,b=K,y=!1}U=void 0}}finally{U?Z():R=!1}}}var Z;if(typeof E=="function")Z=function(){E(I)};else if(typeof MessageChannel<"u"){var P=new MessageChannel,k=P.port2;P.port1.onmessage=I,Z=function(){k.postMessage(null)}}else Z=function(){w(I,0)};function $(O,U){H=w(function(){O(e.unstable_now())},U)}e.unstable_IdlePriority=5,e.unstable_ImmediatePriority=1,e.unstable_LowPriority=4,e.unstable_NormalPriority=3,e.unstable_Profiling=null,e.unstable_UserBlockingPriority=2,e.unstable_cancelCallback=function(O){O.callback=null},e.unstable_forceFrameRate=function(O){0>O||125X?(O.sortIndex=K,t(f,O),r(h)===null&&O===r(f)&&(N?(C(H),H=-1):N=!0,$(B,K-X))):(O.sortIndex=M,t(h,O),_||y||(_=!0,R||(R=!0,Z()))),O},e.unstable_shouldYield=j,e.unstable_wrapCallback=function(O){var U=b;return function(){var K=b;b=U;try{return O.apply(this,arguments)}finally{b=K}}}})(xh)),xh}var iy;function Ik(){return iy||(iy=1,gh.exports=zk()),gh.exports}var bh={exports:{}},Tn={};/** * @license React * react-dom.production.js * @@ -30,7 +30,7 @@ * * This source code is licensed under the MIT license found in the * LICENSE file in the root directory of this source tree. - */var ry;function Lk(){if(ry)return Tn;ry=1;var e=Mo();function t(h){var f="https://react.dev/errors/"+h;if(1"u"||typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE!="function"))try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(e)}catch(t){console.error(t)}}return e(),xh.exports=Lk(),xh.exports}/** + */var ay;function Bk(){if(ay)return Tn;ay=1;var e=Oo();function t(h){var f="https://react.dev/errors/"+h;if(1"u"||typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE!="function"))try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(e)}catch(t){console.error(t)}}return e(),bh.exports=Bk(),bh.exports}/** * @license React * react-dom-client.production.js * @@ -38,427 +38,432 @@ * * This source code is licensed under the MIT license found in the * LICENSE file in the root directory of this source tree. - */var ay;function zk(){if(ay)return Kl;ay=1;var e=Dk(),t=Mo(),r=D_();function a(n){var i="https://react.dev/errors/"+n;if(1M||(n.current=X[M],X[M]=null,M--)}function D(n,i){M++,X[M]=n.current,n.current=i}var V=L(null),q=L(null),Q=L(null),J=L(null);function W(n,i){switch(D(Q,i),D(q,n),D(V,null),i.nodeType){case 9:case 11:n=(n=i.documentElement)&&(n=n.namespaceURI)?v0(n):0;break;default:if(n=i.tagName,i=i.namespaceURI)i=v0(i),n=_0(i,n);else switch(n){case"svg":n=1;break;case"math":n=2;break;default:n=0}}F(V),D(V,n)}function te(){F(V),F(q),F(Q)}function oe(n){n.memoizedState!==null&&D(J,n);var i=V.current,l=_0(i,n.type);i!==l&&(D(q,n),D(V,l))}function fe(n){q.current===n&&(F(V),F(q)),J.current===n&&(F(J),Fl._currentValue=K)}var xe,we;function Ne(n){if(xe===void 0)try{throw Error()}catch(l){var i=l.stack.trim().match(/\n( *(at )?)/);xe=i&&i[1]||"",we=-1M||(n.current=X[M],X[M]=null,M--)}function D(n,i){M++,X[M]=n.current,n.current=i}var V=L(null),q=L(null),Q=L(null),J=L(null);function W(n,i){switch(D(Q,i),D(q,n),D(V,null),i.nodeType){case 9:case 11:n=(n=i.documentElement)&&(n=n.namespaceURI)?w0(n):0;break;default:if(n=i.tagName,i=i.namespaceURI)i=w0(i),n=E0(i,n);else switch(n){case"svg":n=1;break;case"math":n=2;break;default:n=0}}F(V),D(V,n)}function te(){F(V),F(q),F(Q)}function oe(n){n.memoizedState!==null&&D(J,n);var i=V.current,l=E0(i,n.type);i!==l&&(D(q,n),D(V,l))}function fe(n){q.current===n&&(F(V),F(q)),J.current===n&&(F(J),Fl._currentValue=K)}var xe,we;function Ne(n){if(xe===void 0)try{throw Error()}catch(l){var i=l.stack.trim().match(/\n( *(at )?)/);xe=i&&i[1]||"",we=-1)":-1x||ne[u]!==le[x]){var he=` `+ne[u].replace(" at new "," at ");return n.displayName&&he.includes("")&&(he=he.replace("",n.displayName)),he}while(1<=u&&0<=x);break}}}finally{De=!1,Error.prepareStackTrace=l}return(l=n?n.displayName||n.name:"")?Ne(l):""}function st(n,i){switch(n.tag){case 26:case 27:case 5:return Ne(n.type);case 16:return Ne("Lazy");case 13:return n.child!==i&&i!==null?Ne("Suspense Fallback"):Ne("Suspense");case 19:return Ne("SuspenseList");case 0:case 15:return $e(n.type,!1);case 11:return $e(n.type.render,!1);case 1:return $e(n.type,!0);case 31:return Ne("Activity");default:return""}}function Rt(n){try{var i="",l=null;do i+=st(n,l),l=n,n=n.return;while(n);return i}catch(u){return` Error generating stack: `+u.message+` -`+u.stack}}var Xt=Object.prototype.hasOwnProperty,Pt=e.unstable_scheduleCallback,Kt=e.unstable_cancelCallback,Yn=e.unstable_shouldYield,Nn=e.unstable_requestPaint,ct=e.unstable_now,It=e.unstable_getCurrentPriorityLevel,ue=e.unstable_ImmediatePriority,be=e.unstable_UserBlockingPriority,Oe=e.unstable_NormalPriority,Fe=e.unstable_LowPriority,Ze=e.unstable_IdlePriority,cn=e.log,Sn=e.unstable_setDisableYieldValue,Zt=null,At=null;function Jt(n){if(typeof cn=="function"&&Sn(n),At&&typeof At.setStrictMode=="function")try{At.setStrictMode(Zt,n)}catch{}}var ut=Math.clz32?Math.clz32:Ni,In=Math.log,un=Math.LN2;function Ni(n){return n>>>=0,n===0?32:31-(In(n)/un|0)|0}var nt=256,Xn=262144,On=4194304;function mn(n){var i=n&42;if(i!==0)return i;switch(n&-n){case 1:return 1;case 2:return 2;case 4:return 4;case 8:return 8;case 16:return 16;case 32:return 32;case 64:return 64;case 128:return 128;case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:return n&261888;case 262144:case 524288:case 1048576:case 2097152:return n&3932160;case 4194304:case 8388608:case 16777216:case 33554432:return n&62914560;case 67108864:return 67108864;case 134217728:return 134217728;case 268435456:return 268435456;case 536870912:return 536870912;case 1073741824:return 0;default:return n}}function re(n,i,l){var u=n.pendingLanes;if(u===0)return 0;var x=0,v=n.suspendedLanes,T=n.pingedLanes;n=n.warmLanes;var G=u&134217727;return G!==0?(u=G&~v,u!==0?x=mn(u):(T&=G,T!==0?x=mn(T):l||(l=G&~n,l!==0&&(x=mn(l))))):(G=u&~v,G!==0?x=mn(G):T!==0?x=mn(T):l||(l=u&~n,l!==0&&(x=mn(l)))),x===0?0:i!==0&&i!==x&&(i&v)===0&&(v=x&-x,l=i&-i,v>=l||v===32&&(l&4194048)!==0)?i:x}function me(n,i){return(n.pendingLanes&~(n.suspendedLanes&~n.pingedLanes)&i)===0}function Ee(n,i){switch(n){case 1:case 2:case 4:case 8:case 64:return i+250;case 16:case 32:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:return i+5e3;case 4194304:case 8388608:case 16777216:case 33554432:return-1;case 67108864:case 134217728:case 268435456:case 536870912:case 1073741824:return-1;default:return-1}}function Pe(){var n=On;return On<<=1,(On&62914560)===0&&(On=4194304),n}function St(n){for(var i=[],l=0;31>l;l++)i.push(n);return i}function gt(n,i){n.pendingLanes|=i,i!==268435456&&(n.suspendedLanes=0,n.pingedLanes=0,n.warmLanes=0)}function Me(n,i,l,u,x,v){var T=n.pendingLanes;n.pendingLanes=l,n.suspendedLanes=0,n.pingedLanes=0,n.warmLanes=0,n.expiredLanes&=l,n.entangledLanes&=l,n.errorRecoveryDisabledLanes&=l,n.shellSuspendCounter=0;var G=n.entanglements,ne=n.expirationTimes,le=n.hiddenUpdates;for(l=T&~l;0"u")return null;try{return n.activeElement||n.body}catch{return n.body}}var is=/[\n"\\]/g;function Cn(n){return n.replace(is,function(i){return"\\"+i.charCodeAt(0).toString(16)+" "})}function ba(n,i,l,u,x,v,T,G){n.name="",T!=null&&typeof T!="function"&&typeof T!="symbol"&&typeof T!="boolean"?n.type=T:n.removeAttribute("type"),i!=null?T==="number"?(i===0&&n.value===""||n.value!=i)&&(n.value=""+_t(i)):n.value!==""+_t(i)&&(n.value=""+_t(i)):T!=="submit"&&T!=="reset"||n.removeAttribute("value"),i!=null?Oi(n,T,_t(i)):l!=null?Oi(n,T,_t(l)):u!=null&&n.removeAttribute("value"),x==null&&v!=null&&(n.defaultChecked=!!v),x!=null&&(n.checked=x&&typeof x!="function"&&typeof x!="symbol"),G!=null&&typeof G!="function"&&typeof G!="symbol"&&typeof G!="boolean"?n.name=""+_t(G):n.removeAttribute("name")}function Nr(n,i,l,u,x,v,T,G){if(v!=null&&typeof v!="function"&&typeof v!="symbol"&&typeof v!="boolean"&&(n.type=v),i!=null||l!=null){if(!(v!=="submit"&&v!=="reset"||i!=null)){Ai(n);return}l=l!=null?""+_t(l):"",i=i!=null?""+_t(i):l,G||i===n.value||(n.value=i),n.defaultValue=i}u=u??x,u=typeof u!="function"&&typeof u!="symbol"&&!!u,n.checked=G?n.checked:!!u,n.defaultChecked=!!u,T!=null&&typeof T!="function"&&typeof T!="symbol"&&typeof T!="boolean"&&(n.name=T),Ai(n)}function Oi(n,i,l){i==="number"&&Mi(n.ownerDocument)===n||n.defaultValue===""+l||(n.defaultValue=""+l)}function dn(n,i,l,u){if(n=n.options,i){i={};for(var x=0;x"u"||typeof window.document>"u"||typeof window.document.createElement>"u"),dd=!1;if(ti)try{var ol={};Object.defineProperty(ol,"passive",{get:function(){dd=!0}}),window.addEventListener("test",ol,ol),window.removeEventListener("test",ol,ol)}catch{dd=!1}var Di=null,fd=null,Fo=null;function _g(){if(Fo)return Fo;var n,i=fd,l=i.length,u,x="value"in Di?Di.value:Di.textContent,v=x.length;for(n=0;n=dl),Cg=" ",Tg=!1;function Ag(n,i){switch(n){case"keyup":return W2.indexOf(i.keyCode)!==-1;case"keydown":return i.keyCode!==229;case"keypress":case"mousedown":case"focusout":return!0;default:return!1}}function Mg(n){return n=n.detail,typeof n=="object"&&"data"in n?n.data:null}var ss=!1;function eS(n,i){switch(n){case"compositionend":return Mg(i);case"keypress":return i.which!==32?null:(Tg=!0,Cg);case"textInput":return n=i.data,n===Cg&&Tg?null:n;default:return null}}function tS(n,i){if(ss)return n==="compositionend"||!xd&&Ag(n,i)?(n=_g(),Fo=fd=Di=null,ss=!1,n):null;switch(n){case"paste":return null;case"keypress":if(!(i.ctrlKey||i.altKey||i.metaKey)||i.ctrlKey&&i.altKey){if(i.char&&1=i)return{node:l,offset:i-n};n=u}e:{for(;l;){if(l.nextSibling){l=l.nextSibling;break e}l=l.parentNode}l=void 0}l=Bg(l)}}function Hg(n,i){return n&&i?n===i?!0:n&&n.nodeType===3?!1:i&&i.nodeType===3?Hg(n,i.parentNode):"contains"in n?n.contains(i):n.compareDocumentPosition?!!(n.compareDocumentPosition(i)&16):!1:!1}function $g(n){n=n!=null&&n.ownerDocument!=null&&n.ownerDocument.defaultView!=null?n.ownerDocument.defaultView:window;for(var i=Mi(n.document);i instanceof n.HTMLIFrameElement;){try{var l=typeof i.contentWindow.location.href=="string"}catch{l=!1}if(l)n=i.contentWindow;else break;i=Mi(n.document)}return i}function vd(n){var i=n&&n.nodeName&&n.nodeName.toLowerCase();return i&&(i==="input"&&(n.type==="text"||n.type==="search"||n.type==="tel"||n.type==="url"||n.type==="password")||i==="textarea"||n.contentEditable==="true")}var cS=ti&&"documentMode"in document&&11>=document.documentMode,ls=null,_d=null,pl=null,wd=!1;function qg(n,i,l){var u=l.window===l?l.document:l.nodeType===9?l:l.ownerDocument;wd||ls==null||ls!==Mi(u)||(u=ls,"selectionStart"in u&&vd(u)?u={start:u.selectionStart,end:u.selectionEnd}:(u=(u.ownerDocument&&u.ownerDocument.defaultView||window).getSelection(),u={anchorNode:u.anchorNode,anchorOffset:u.anchorOffset,focusNode:u.focusNode,focusOffset:u.focusOffset}),pl&&ml(pl,u)||(pl=u,u=Ic(_d,"onSelect"),0>=T,x-=T,Hr=1<<32-ut(i)+x|l<Ke?(at=je,je=null):at=je.sibling;var mt=ce(ae,je,se[Ke],pe);if(mt===null){je===null&&(je=at);break}n&&je&&mt.alternate===null&&i(ae,je),ie=v(mt,ie,Ke),ht===null?Ie=mt:ht.sibling=mt,ht=mt,je=at}if(Ke===se.length)return l(ae,je),lt&&ri(ae,Ke),Ie;if(je===null){for(;KeKe?(at=je,je=null):at=je.sibling;var na=ce(ae,je,mt.value,pe);if(na===null){je===null&&(je=at);break}n&&je&&na.alternate===null&&i(ae,je),ie=v(na,ie,Ke),ht===null?Ie=na:ht.sibling=na,ht=na,je=at}if(mt.done)return l(ae,je),lt&&ri(ae,Ke),Ie;if(je===null){for(;!mt.done;Ke++,mt=se.next())mt=ge(ae,mt.value,pe),mt!==null&&(ie=v(mt,ie,Ke),ht===null?Ie=mt:ht.sibling=mt,ht=mt);return lt&&ri(ae,Ke),Ie}for(je=u(je);!mt.done;Ke++,mt=se.next())mt=de(je,ae,Ke,mt.value,pe),mt!==null&&(n&&mt.alternate!==null&&je.delete(mt.key===null?Ke:mt.key),ie=v(mt,ie,Ke),ht===null?Ie=mt:ht.sibling=mt,ht=mt);return n&&je.forEach(function(Ak){return i(ae,Ak)}),lt&&ri(ae,Ke),Ie}function Nt(ae,ie,se,pe){if(typeof se=="object"&&se!==null&&se.type===N&&se.key===null&&(se=se.props.children),typeof se=="object"&&se!==null){switch(se.$$typeof){case y:e:{for(var Ie=se.key;ie!==null;){if(ie.key===Ie){if(Ie=se.type,Ie===N){if(ie.tag===7){l(ae,ie.sibling),pe=x(ie,se.props.children),pe.return=ae,ae=pe;break e}}else if(ie.elementType===Ie||typeof Ie=="object"&&Ie!==null&&Ie.$$typeof===z&&Aa(Ie)===ie.type){l(ae,ie.sibling),pe=x(ie,se.props),_l(pe,se),pe.return=ae,ae=pe;break e}l(ae,ie);break}else i(ae,ie);ie=ie.sibling}se.type===N?(pe=Na(se.props.children,ae.mode,pe,se.key),pe.return=ae,ae=pe):(pe=ec(se.type,se.key,se.props,null,ae.mode,pe),_l(pe,se),pe.return=ae,ae=pe)}return T(ae);case _:e:{for(Ie=se.key;ie!==null;){if(ie.key===Ie)if(ie.tag===4&&ie.stateNode.containerInfo===se.containerInfo&&ie.stateNode.implementation===se.implementation){l(ae,ie.sibling),pe=x(ie,se.children||[]),pe.return=ae,ae=pe;break e}else{l(ae,ie);break}else i(ae,ie);ie=ie.sibling}pe=Ad(se,ae.mode,pe),pe.return=ae,ae=pe}return T(ae);case z:return se=Aa(se),Nt(ae,ie,se,pe)}if($(se))return Ae(ae,ie,se,pe);if(Z(se)){if(Ie=Z(se),typeof Ie!="function")throw Error(a(150));return se=Ie.call(se),He(ae,ie,se,pe)}if(typeof se.then=="function")return Nt(ae,ie,lc(se),pe);if(se.$$typeof===E)return Nt(ae,ie,rc(ae,se),pe);oc(ae,se)}return typeof se=="string"&&se!==""||typeof se=="number"||typeof se=="bigint"?(se=""+se,ie!==null&&ie.tag===6?(l(ae,ie.sibling),pe=x(ie,se),pe.return=ae,ae=pe):(l(ae,ie),pe=Td(se,ae.mode,pe),pe.return=ae,ae=pe),T(ae)):l(ae,ie)}return function(ae,ie,se,pe){try{vl=0;var Ie=Nt(ae,ie,se,pe);return bs=null,Ie}catch(je){if(je===xs||je===ac)throw je;var ht=Zn(29,je,null,ae.mode);return ht.lanes=pe,ht.return=ae,ht}finally{}}}var Oa=dx(!0),fx=dx(!1),Ui=!1;function $d(n){n.updateQueue={baseState:n.memoizedState,firstBaseUpdate:null,lastBaseUpdate:null,shared:{pending:null,lanes:0,hiddenCallbacks:null},callbacks:null}}function qd(n,i){n=n.updateQueue,i.updateQueue===n&&(i.updateQueue={baseState:n.baseState,firstBaseUpdate:n.firstBaseUpdate,lastBaseUpdate:n.lastBaseUpdate,shared:n.shared,callbacks:null})}function Hi(n){return{lane:n,tag:0,payload:null,callback:null,next:null}}function $i(n,i,l){var u=n.updateQueue;if(u===null)return null;if(u=u.shared,(pt&2)!==0){var x=u.pending;return x===null?i.next=i:(i.next=x.next,x.next=i),u.pending=i,i=Jo(n),Kg(n,null,l),i}return Wo(n,u,i,l),Jo(n)}function wl(n,i,l){if(i=i.updateQueue,i!==null&&(i=i.shared,(l&4194048)!==0)){var u=i.lanes;u&=n.pendingLanes,l|=u,i.lanes=l,Ue(n,l)}}function Pd(n,i){var l=n.updateQueue,u=n.alternate;if(u!==null&&(u=u.updateQueue,l===u)){var x=null,v=null;if(l=l.firstBaseUpdate,l!==null){do{var T={lane:l.lane,tag:l.tag,payload:l.payload,callback:null,next:null};v===null?x=v=T:v=v.next=T,l=l.next}while(l!==null);v===null?x=v=i:v=v.next=i}else x=v=i;l={baseState:u.baseState,firstBaseUpdate:x,lastBaseUpdate:v,shared:u.shared,callbacks:u.callbacks},n.updateQueue=l;return}n=l.lastBaseUpdate,n===null?l.firstBaseUpdate=i:n.next=i,l.lastBaseUpdate=i}var Fd=!1;function El(){if(Fd){var n=gs;if(n!==null)throw n}}function Nl(n,i,l,u){Fd=!1;var x=n.updateQueue;Ui=!1;var v=x.firstBaseUpdate,T=x.lastBaseUpdate,G=x.shared.pending;if(G!==null){x.shared.pending=null;var ne=G,le=ne.next;ne.next=null,T===null?v=le:T.next=le,T=ne;var he=n.alternate;he!==null&&(he=he.updateQueue,G=he.lastBaseUpdate,G!==T&&(G===null?he.firstBaseUpdate=le:G.next=le,he.lastBaseUpdate=ne))}if(v!==null){var ge=x.baseState;T=0,he=le=ne=null,G=v;do{var ce=G.lane&-536870913,de=ce!==G.lane;if(de?(it&ce)===ce:(u&ce)===ce){ce!==0&&ce===ps&&(Fd=!0),he!==null&&(he=he.next={lane:0,tag:G.tag,payload:G.payload,callback:null,next:null});e:{var Ae=n,He=G;ce=i;var Nt=l;switch(He.tag){case 1:if(Ae=He.payload,typeof Ae=="function"){ge=Ae.call(Nt,ge,ce);break e}ge=Ae;break e;case 3:Ae.flags=Ae.flags&-65537|128;case 0:if(Ae=He.payload,ce=typeof Ae=="function"?Ae.call(Nt,ge,ce):Ae,ce==null)break e;ge=g({},ge,ce);break e;case 2:Ui=!0}}ce=G.callback,ce!==null&&(n.flags|=64,de&&(n.flags|=8192),de=x.callbacks,de===null?x.callbacks=[ce]:de.push(ce))}else de={lane:ce,tag:G.tag,payload:G.payload,callback:G.callback,next:null},he===null?(le=he=de,ne=ge):he=he.next=de,T|=ce;if(G=G.next,G===null){if(G=x.shared.pending,G===null)break;de=G,G=de.next,de.next=null,x.lastBaseUpdate=de,x.shared.pending=null}}while(!0);he===null&&(ne=ge),x.baseState=ne,x.firstBaseUpdate=le,x.lastBaseUpdate=he,v===null&&(x.shared.lanes=0),Vi|=T,n.lanes=T,n.memoizedState=ge}}function hx(n,i){if(typeof n!="function")throw Error(a(191,n));n.call(i)}function mx(n,i){var l=n.callbacks;if(l!==null)for(n.callbacks=null,n=0;nv?v:8;var T=O.T,G={};O.T=G,uf(n,!1,i,l);try{var ne=x(),le=O.S;if(le!==null&&le(G,ne),ne!==null&&typeof ne=="object"&&typeof ne.then=="function"){var he=bS(ne,u);Cl(n,i,he,tr(n))}else Cl(n,i,u,tr(n))}catch(ge){Cl(n,i,{then:function(){},status:"rejected",reason:ge},tr())}finally{U.p=v,T!==null&&G.types!==null&&(T.types=G.types),O.T=T}}function NS(){}function of(n,i,l,u){if(n.tag!==5)throw Error(a(476));var x=Vx(n).queue;Gx(n,x,i,K,l===null?NS:function(){return Yx(n),l(u)})}function Vx(n){var i=n.memoizedState;if(i!==null)return i;i={memoizedState:K,baseState:K,baseQueue:null,queue:{pending:null,lanes:0,dispatch:null,lastRenderedReducer:li,lastRenderedState:K},next:null};var l={};return i.next={memoizedState:l,baseState:l,baseQueue:null,queue:{pending:null,lanes:0,dispatch:null,lastRenderedReducer:li,lastRenderedState:l},next:null},n.memoizedState=i,n=n.alternate,n!==null&&(n.memoizedState=i),i}function Yx(n){var i=Vx(n);i.next===null&&(i=n.alternate.memoizedState),Cl(n,i.next.queue,{},tr())}function cf(){return vn(Fl)}function Xx(){return Wt().memoizedState}function Kx(){return Wt().memoizedState}function SS(n){for(var i=n.return;i!==null;){switch(i.tag){case 24:case 3:var l=tr();n=Hi(l);var u=$i(i,n,l);u!==null&&(Pn(u,i,l),wl(u,i,l)),i={cache:Id()},n.payload=i;return}i=i.return}}function kS(n,i,l){var u=tr();l={lane:u,revertLane:0,gesture:null,action:l,hasEagerState:!1,eagerState:null,next:null},bc(n)?Qx(i,l):(l=kd(n,i,l,u),l!==null&&(Pn(l,n,u),Wx(l,i,u)))}function Zx(n,i,l){var u=tr();Cl(n,i,l,u)}function Cl(n,i,l,u){var x={lane:u,revertLane:0,gesture:null,action:l,hasEagerState:!1,eagerState:null,next:null};if(bc(n))Qx(i,x);else{var v=n.alternate;if(n.lanes===0&&(v===null||v.lanes===0)&&(v=i.lastRenderedReducer,v!==null))try{var T=i.lastRenderedState,G=v(T,l);if(x.hasEagerState=!0,x.eagerState=G,Kn(G,T))return Wo(n,i,x,0),kt===null&&Qo(),!1}catch{}finally{}if(l=kd(n,i,x,u),l!==null)return Pn(l,n,u),Wx(l,i,u),!0}return!1}function uf(n,i,l,u){if(u={lane:2,revertLane:qf(),gesture:null,action:u,hasEagerState:!1,eagerState:null,next:null},bc(n)){if(i)throw Error(a(479))}else i=kd(n,l,u,2),i!==null&&Pn(i,n,2)}function bc(n){var i=n.alternate;return n===Xe||i!==null&&i===Xe}function Qx(n,i){vs=dc=!0;var l=n.pending;l===null?i.next=i:(i.next=l.next,l.next=i),n.pending=i}function Wx(n,i,l){if((l&4194048)!==0){var u=i.lanes;u&=n.pendingLanes,l|=u,i.lanes=l,Ue(n,l)}}var Tl={readContext:vn,use:mc,useCallback:Gt,useContext:Gt,useEffect:Gt,useImperativeHandle:Gt,useLayoutEffect:Gt,useInsertionEffect:Gt,useMemo:Gt,useReducer:Gt,useRef:Gt,useState:Gt,useDebugValue:Gt,useDeferredValue:Gt,useTransition:Gt,useSyncExternalStore:Gt,useId:Gt,useHostTransitionStatus:Gt,useFormState:Gt,useActionState:Gt,useOptimistic:Gt,useMemoCache:Gt,useCacheRefresh:Gt};Tl.useEffectEvent=Gt;var Jx={readContext:vn,use:mc,useCallback:function(n,i){return Dn().memoizedState=[n,i===void 0?null:i],n},useContext:vn,useEffect:zx,useImperativeHandle:function(n,i,l){l=l!=null?l.concat([n]):null,gc(4194308,4,Hx.bind(null,i,n),l)},useLayoutEffect:function(n,i){return gc(4194308,4,n,i)},useInsertionEffect:function(n,i){gc(4,2,n,i)},useMemo:function(n,i){var l=Dn();i=i===void 0?null:i;var u=n();if(Ra){Jt(!0);try{n()}finally{Jt(!1)}}return l.memoizedState=[u,i],u},useReducer:function(n,i,l){var u=Dn();if(l!==void 0){var x=l(i);if(Ra){Jt(!0);try{l(i)}finally{Jt(!1)}}}else x=i;return u.memoizedState=u.baseState=x,n={pending:null,lanes:0,dispatch:null,lastRenderedReducer:n,lastRenderedState:x},u.queue=n,n=n.dispatch=kS.bind(null,Xe,n),[u.memoizedState,n]},useRef:function(n){var i=Dn();return n={current:n},i.memoizedState=n},useState:function(n){n=nf(n);var i=n.queue,l=Zx.bind(null,Xe,i);return i.dispatch=l,[n.memoizedState,l]},useDebugValue:sf,useDeferredValue:function(n,i){var l=Dn();return lf(l,n,i)},useTransition:function(){var n=nf(!1);return n=Gx.bind(null,Xe,n.queue,!0,!1),Dn().memoizedState=n,[!1,n]},useSyncExternalStore:function(n,i,l){var u=Xe,x=Dn();if(lt){if(l===void 0)throw Error(a(407));l=l()}else{if(l=i(),kt===null)throw Error(a(349));(it&127)!==0||vx(u,i,l)}x.memoizedState=l;var v={value:l,getSnapshot:i};return x.queue=v,zx(wx.bind(null,u,v,n),[n]),u.flags|=2048,ws(9,{destroy:void 0},_x.bind(null,u,v,l,i),null),l},useId:function(){var n=Dn(),i=kt.identifierPrefix;if(lt){var l=$r,u=Hr;l=(u&~(1<<32-ut(u)-1)).toString(32)+l,i="_"+i+"R_"+l,l=fc++,0<\/script>",v=v.removeChild(v.firstChild);break;case"select":v=typeof u.is=="string"?T.createElement("select",{is:u.is}):T.createElement("select"),u.multiple?v.multiple=!0:u.size&&(v.size=u.size);break;default:v=typeof u.is=="string"?T.createElement(x,{is:u.is}):T.createElement(x)}}v[Ut]=i,v[pn]=u;e:for(T=i.child;T!==null;){if(T.tag===5||T.tag===6)v.appendChild(T.stateNode);else if(T.tag!==4&&T.tag!==27&&T.child!==null){T.child.return=T,T=T.child;continue}if(T===i)break e;for(;T.sibling===null;){if(T.return===null||T.return===i)break e;T=T.return}T.sibling.return=T.return,T=T.sibling}i.stateNode=v;e:switch(wn(v,x,u),x){case"button":case"input":case"select":case"textarea":u=!!u.autoFocus;break e;case"img":u=!0;break e;default:u=!1}u&&ci(i)}}return Dt(i),Nf(i,i.type,n===null?null:n.memoizedProps,i.pendingProps,l),null;case 6:if(n&&i.stateNode!=null)n.memoizedProps!==u&&ci(i);else{if(typeof u!="string"&&i.stateNode===null)throw Error(a(166));if(n=Q.current,hs(i)){if(n=i.stateNode,l=i.memoizedProps,u=null,x=yn,x!==null)switch(x.tag){case 27:case 5:u=x.memoizedProps}n[Ut]=i,n=!!(n.nodeValue===l||u!==null&&u.suppressHydrationWarning===!0||b0(n.nodeValue,l)),n||Ii(i,!0)}else n=Bc(n).createTextNode(u),n[Ut]=i,i.stateNode=n}return Dt(i),null;case 31:if(l=i.memoizedState,n===null||n.memoizedState!==null){if(u=hs(i),l!==null){if(n===null){if(!u)throw Error(a(318));if(n=i.memoizedState,n=n!==null?n.dehydrated:null,!n)throw Error(a(557));n[Ut]=i}else Sa(),(i.flags&128)===0&&(i.memoizedState=null),i.flags|=4;Dt(i),n=!1}else l=jd(),n!==null&&n.memoizedState!==null&&(n.memoizedState.hydrationErrors=l),n=!0;if(!n)return i.flags&256?(Wn(i),i):(Wn(i),null);if((i.flags&128)!==0)throw Error(a(558))}return Dt(i),null;case 13:if(u=i.memoizedState,n===null||n.memoizedState!==null&&n.memoizedState.dehydrated!==null){if(x=hs(i),u!==null&&u.dehydrated!==null){if(n===null){if(!x)throw Error(a(318));if(x=i.memoizedState,x=x!==null?x.dehydrated:null,!x)throw Error(a(317));x[Ut]=i}else Sa(),(i.flags&128)===0&&(i.memoizedState=null),i.flags|=4;Dt(i),x=!1}else x=jd(),n!==null&&n.memoizedState!==null&&(n.memoizedState.hydrationErrors=x),x=!0;if(!x)return i.flags&256?(Wn(i),i):(Wn(i),null)}return Wn(i),(i.flags&128)!==0?(i.lanes=l,i):(l=u!==null,n=n!==null&&n.memoizedState!==null,l&&(u=i.child,x=null,u.alternate!==null&&u.alternate.memoizedState!==null&&u.alternate.memoizedState.cachePool!==null&&(x=u.alternate.memoizedState.cachePool.pool),v=null,u.memoizedState!==null&&u.memoizedState.cachePool!==null&&(v=u.memoizedState.cachePool.pool),v!==x&&(u.flags|=2048)),l!==n&&l&&(i.child.flags|=8192),Ec(i,i.updateQueue),Dt(i),null);case 4:return te(),n===null&&Vf(i.stateNode.containerInfo),Dt(i),null;case 10:return ai(i.type),Dt(i),null;case 19:if(F(Qt),u=i.memoizedState,u===null)return Dt(i),null;if(x=(i.flags&128)!==0,v=u.rendering,v===null)if(x)Ml(u,!1);else{if(Vt!==0||n!==null&&(n.flags&128)!==0)for(n=i.child;n!==null;){if(v=uc(n),v!==null){for(i.flags|=128,Ml(u,!1),n=v.updateQueue,i.updateQueue=n,Ec(i,n),i.subtreeFlags=0,n=l,l=i.child;l!==null;)Zg(l,n),l=l.sibling;return D(Qt,Qt.current&1|2),lt&&ri(i,u.treeForkCount),i.child}n=n.sibling}u.tail!==null&&ct()>Tc&&(i.flags|=128,x=!0,Ml(u,!1),i.lanes=4194304)}else{if(!x)if(n=uc(v),n!==null){if(i.flags|=128,x=!0,n=n.updateQueue,i.updateQueue=n,Ec(i,n),Ml(u,!0),u.tail===null&&u.tailMode==="hidden"&&!v.alternate&&!lt)return Dt(i),null}else 2*ct()-u.renderingStartTime>Tc&&l!==536870912&&(i.flags|=128,x=!0,Ml(u,!1),i.lanes=4194304);u.isBackwards?(v.sibling=i.child,i.child=v):(n=u.last,n!==null?n.sibling=v:i.child=v,u.last=v)}return u.tail!==null?(n=u.tail,u.rendering=n,u.tail=n.sibling,u.renderingStartTime=ct(),n.sibling=null,l=Qt.current,D(Qt,x?l&1|2:l&1),lt&&ri(i,u.treeForkCount),n):(Dt(i),null);case 22:case 23:return Wn(i),Vd(),u=i.memoizedState!==null,n!==null?n.memoizedState!==null!==u&&(i.flags|=8192):u&&(i.flags|=8192),u?(l&536870912)!==0&&(i.flags&128)===0&&(Dt(i),i.subtreeFlags&6&&(i.flags|=8192)):Dt(i),l=i.updateQueue,l!==null&&Ec(i,l.retryQueue),l=null,n!==null&&n.memoizedState!==null&&n.memoizedState.cachePool!==null&&(l=n.memoizedState.cachePool.pool),u=null,i.memoizedState!==null&&i.memoizedState.cachePool!==null&&(u=i.memoizedState.cachePool.pool),u!==l&&(i.flags|=2048),n!==null&&F(Ta),null;case 24:return l=null,n!==null&&(l=n.memoizedState.cache),i.memoizedState.cache!==l&&(i.flags|=2048),ai(tn),Dt(i),null;case 25:return null;case 30:return null}throw Error(a(156,i.tag))}function OS(n,i){switch(Od(i),i.tag){case 1:return n=i.flags,n&65536?(i.flags=n&-65537|128,i):null;case 3:return ai(tn),te(),n=i.flags,(n&65536)!==0&&(n&128)===0?(i.flags=n&-65537|128,i):null;case 26:case 27:case 5:return fe(i),null;case 31:if(i.memoizedState!==null){if(Wn(i),i.alternate===null)throw Error(a(340));Sa()}return n=i.flags,n&65536?(i.flags=n&-65537|128,i):null;case 13:if(Wn(i),n=i.memoizedState,n!==null&&n.dehydrated!==null){if(i.alternate===null)throw Error(a(340));Sa()}return n=i.flags,n&65536?(i.flags=n&-65537|128,i):null;case 19:return F(Qt),null;case 4:return te(),null;case 10:return ai(i.type),null;case 22:case 23:return Wn(i),Vd(),n!==null&&F(Ta),n=i.flags,n&65536?(i.flags=n&-65537|128,i):null;case 24:return ai(tn),null;case 25:return null;default:return null}}function Eb(n,i){switch(Od(i),i.tag){case 3:ai(tn),te();break;case 26:case 27:case 5:fe(i);break;case 4:te();break;case 31:i.memoizedState!==null&&Wn(i);break;case 13:Wn(i);break;case 19:F(Qt);break;case 10:ai(i.type);break;case 22:case 23:Wn(i),Vd(),n!==null&&F(Ta);break;case 24:ai(tn)}}function Ol(n,i){try{var l=i.updateQueue,u=l!==null?l.lastEffect:null;if(u!==null){var x=u.next;l=x;do{if((l.tag&n)===n){u=void 0;var v=l.create,T=l.inst;u=v(),T.destroy=u}l=l.next}while(l!==x)}}catch(G){yt(i,i.return,G)}}function Fi(n,i,l){try{var u=i.updateQueue,x=u!==null?u.lastEffect:null;if(x!==null){var v=x.next;u=v;do{if((u.tag&n)===n){var T=u.inst,G=T.destroy;if(G!==void 0){T.destroy=void 0,x=i;var ne=l,le=G;try{le()}catch(he){yt(x,ne,he)}}}u=u.next}while(u!==v)}}catch(he){yt(i,i.return,he)}}function Nb(n){var i=n.updateQueue;if(i!==null){var l=n.stateNode;try{mx(i,l)}catch(u){yt(n,n.return,u)}}}function Sb(n,i,l){l.props=ja(n.type,n.memoizedProps),l.state=n.memoizedState;try{l.componentWillUnmount()}catch(u){yt(n,i,u)}}function Rl(n,i){try{var l=n.ref;if(l!==null){switch(n.tag){case 26:case 27:case 5:var u=n.stateNode;break;case 30:u=n.stateNode;break;default:u=n.stateNode}typeof l=="function"?n.refCleanup=l(u):l.current=u}}catch(x){yt(n,i,x)}}function qr(n,i){var l=n.ref,u=n.refCleanup;if(l!==null)if(typeof u=="function")try{u()}catch(x){yt(n,i,x)}finally{n.refCleanup=null,n=n.alternate,n!=null&&(n.refCleanup=null)}else if(typeof l=="function")try{l(null)}catch(x){yt(n,i,x)}else l.current=null}function kb(n){var i=n.type,l=n.memoizedProps,u=n.stateNode;try{e:switch(i){case"button":case"input":case"select":case"textarea":l.autoFocus&&u.focus();break e;case"img":l.src?u.src=l.src:l.srcSet&&(u.srcset=l.srcSet)}}catch(x){yt(n,n.return,x)}}function Sf(n,i,l){try{var u=n.stateNode;JS(u,n.type,l,i),u[pn]=i}catch(x){yt(n,n.return,x)}}function Cb(n){return n.tag===5||n.tag===3||n.tag===26||n.tag===27&&Qi(n.type)||n.tag===4}function kf(n){e:for(;;){for(;n.sibling===null;){if(n.return===null||Cb(n.return))return null;n=n.return}for(n.sibling.return=n.return,n=n.sibling;n.tag!==5&&n.tag!==6&&n.tag!==18;){if(n.tag===27&&Qi(n.type)||n.flags&2||n.child===null||n.tag===4)continue e;n.child.return=n,n=n.child}if(!(n.flags&2))return n.stateNode}}function Cf(n,i,l){var u=n.tag;if(u===5||u===6)n=n.stateNode,i?(l.nodeType===9?l.body:l.nodeName==="HTML"?l.ownerDocument.body:l).insertBefore(n,i):(i=l.nodeType===9?l.body:l.nodeName==="HTML"?l.ownerDocument.body:l,i.appendChild(n),l=l._reactRootContainer,l!=null||i.onclick!==null||(i.onclick=_e));else if(u!==4&&(u===27&&Qi(n.type)&&(l=n.stateNode,i=null),n=n.child,n!==null))for(Cf(n,i,l),n=n.sibling;n!==null;)Cf(n,i,l),n=n.sibling}function Nc(n,i,l){var u=n.tag;if(u===5||u===6)n=n.stateNode,i?l.insertBefore(n,i):l.appendChild(n);else if(u!==4&&(u===27&&Qi(n.type)&&(l=n.stateNode),n=n.child,n!==null))for(Nc(n,i,l),n=n.sibling;n!==null;)Nc(n,i,l),n=n.sibling}function Tb(n){var i=n.stateNode,l=n.memoizedProps;try{for(var u=n.type,x=i.attributes;x.length;)i.removeAttributeNode(x[0]);wn(i,u,l),i[Ut]=n,i[pn]=l}catch(v){yt(n,n.return,v)}}var ui=!1,an=!1,Tf=!1,Ab=typeof WeakSet=="function"?WeakSet:Set,xn=null;function RS(n,i){if(n=n.containerInfo,Kf=Gc,n=$g(n),vd(n)){if("selectionStart"in n)var l={start:n.selectionStart,end:n.selectionEnd};else e:{l=(l=n.ownerDocument)&&l.defaultView||window;var u=l.getSelection&&l.getSelection();if(u&&u.rangeCount!==0){l=u.anchorNode;var x=u.anchorOffset,v=u.focusNode;u=u.focusOffset;try{l.nodeType,v.nodeType}catch{l=null;break e}var T=0,G=-1,ne=-1,le=0,he=0,ge=n,ce=null;t:for(;;){for(var de;ge!==l||x!==0&&ge.nodeType!==3||(G=T+x),ge!==v||u!==0&&ge.nodeType!==3||(ne=T+u),ge.nodeType===3&&(T+=ge.nodeValue.length),(de=ge.firstChild)!==null;)ce=ge,ge=de;for(;;){if(ge===n)break t;if(ce===l&&++le===x&&(G=T),ce===v&&++he===u&&(ne=T),(de=ge.nextSibling)!==null)break;ge=ce,ce=ge.parentNode}ge=de}l=G===-1||ne===-1?null:{start:G,end:ne}}else l=null}l=l||{start:0,end:0}}else l=null;for(Zf={focusedElem:n,selectionRange:l},Gc=!1,xn=i;xn!==null;)if(i=xn,n=i.child,(i.subtreeFlags&1028)!==0&&n!==null)n.return=i,xn=n;else for(;xn!==null;){switch(i=xn,v=i.alternate,n=i.flags,i.tag){case 0:if((n&4)!==0&&(n=i.updateQueue,n=n!==null?n.events:null,n!==null))for(l=0;l title"))),wn(v,u,l),v[Ut]=n,Ft(v),u=v;break e;case"link":var T=L0("link","href",x).get(u+(l.href||""));if(T){for(var G=0;GNt&&(T=Nt,Nt=He,He=T);var ae=Ug(G,He),ie=Ug(G,Nt);if(ae&&ie&&(de.rangeCount!==1||de.anchorNode!==ae.node||de.anchorOffset!==ae.offset||de.focusNode!==ie.node||de.focusOffset!==ie.offset)){var se=ge.createRange();se.setStart(ae.node,ae.offset),de.removeAllRanges(),He>Nt?(de.addRange(se),de.extend(ie.node,ie.offset)):(se.setEnd(ie.node,ie.offset),de.addRange(se))}}}}for(ge=[],de=G;de=de.parentNode;)de.nodeType===1&&ge.push({element:de,left:de.scrollLeft,top:de.scrollTop});for(typeof G.focus=="function"&&G.focus(),G=0;Gl?32:l,O.T=null,l=Lf,Lf=null;var v=Xi,T=pi;if(fn=0,Cs=Xi=null,pi=0,(pt&6)!==0)throw Error(a(331));var G=pt;if(pt|=4,Hb(v.current),Ib(v,v.current,T,l),pt=G,Bl(0,!1),At&&typeof At.onPostCommitFiberRoot=="function")try{At.onPostCommitFiberRoot(Zt,v)}catch{}return!0}finally{U.p=x,O.T=u,i0(n,i)}}function s0(n,i,l){i=ur(l,i),i=mf(n.stateNode,i,2),n=$i(n,i,2),n!==null&&(gt(n,2),Pr(n))}function yt(n,i,l){if(n.tag===3)s0(n,n,l);else for(;i!==null;){if(i.tag===3){s0(i,n,l);break}else if(i.tag===1){var u=i.stateNode;if(typeof i.type.getDerivedStateFromError=="function"||typeof u.componentDidCatch=="function"&&(Yi===null||!Yi.has(u))){n=ur(l,n),l=lb(2),u=$i(i,l,2),u!==null&&(ob(l,u,i,n),gt(u,2),Pr(u));break}}i=i.return}}function Uf(n,i,l){var u=n.pingCache;if(u===null){u=n.pingCache=new LS;var x=new Set;u.set(i,x)}else x=u.get(i),x===void 0&&(x=new Set,u.set(i,x));x.has(l)||(Of=!0,x.add(l),n=HS.bind(null,n,i,l),i.then(n,n))}function HS(n,i,l){var u=n.pingCache;u!==null&&u.delete(i),n.pingedLanes|=n.suspendedLanes&l,n.warmLanes&=~l,kt===n&&(it&l)===l&&(Vt===4||Vt===3&&(it&62914560)===it&&300>ct()-Cc?(pt&2)===0&&Ts(n,0):Rf|=l,ks===it&&(ks=0)),Pr(n)}function l0(n,i){i===0&&(i=Pe()),n=Ea(n,i),n!==null&&(gt(n,i),Pr(n))}function $S(n){var i=n.memoizedState,l=0;i!==null&&(l=i.retryLane),l0(n,l)}function qS(n,i){var l=0;switch(n.tag){case 31:case 13:var u=n.stateNode,x=n.memoizedState;x!==null&&(l=x.retryLane);break;case 19:u=n.stateNode;break;case 22:u=n.stateNode._retryCache;break;default:throw Error(a(314))}u!==null&&u.delete(i),l0(n,l)}function PS(n,i){return Pt(n,i)}var Dc=null,Ms=null,Hf=!1,Lc=!1,$f=!1,Zi=0;function Pr(n){n!==Ms&&n.next===null&&(Ms===null?Dc=Ms=n:Ms=Ms.next=n),Lc=!0,Hf||(Hf=!0,GS())}function Bl(n,i){if(!$f&&Lc){$f=!0;do for(var l=!1,u=Dc;u!==null;){if(n!==0){var x=u.pendingLanes;if(x===0)var v=0;else{var T=u.suspendedLanes,G=u.pingedLanes;v=(1<<31-ut(42|n)+1)-1,v&=x&~(T&~G),v=v&201326741?v&201326741|1:v?v|2:0}v!==0&&(l=!0,d0(u,v))}else v=it,v=re(u,u===kt?v:0,u.cancelPendingCommit!==null||u.timeoutHandle!==-1),(v&3)===0||me(u,v)||(l=!0,d0(u,v));u=u.next}while(l);$f=!1}}function FS(){o0()}function o0(){Lc=Hf=!1;var n=0;Zi!==0&&tk()&&(n=Zi);for(var i=ct(),l=null,u=Dc;u!==null;){var x=u.next,v=c0(u,i);v===0?(u.next=null,l===null?Dc=x:l.next=x,x===null&&(Ms=l)):(l=u,(n!==0||(v&3)!==0)&&(Lc=!0)),u=x}fn!==0&&fn!==5||Bl(n),Zi!==0&&(Zi=0)}function c0(n,i){for(var l=n.suspendedLanes,u=n.pingedLanes,x=n.expirationTimes,v=n.pendingLanes&-62914561;0G)break;var he=ne.transferSize,ge=ne.initiatorType;he&&y0(ge)&&(ne=ne.responseEnd,T+=he*(ne"u"?null:document;function O0(n,i,l){var u=Os;if(u&&typeof i=="string"&&i){var x=Cn(i);x='link[rel="'+n+'"][href="'+x+'"]',typeof l=="string"&&(x+='[crossorigin="'+l+'"]'),M0.has(x)||(M0.add(x),n={rel:n,crossOrigin:l,href:i},u.querySelector(x)===null&&(i=u.createElement("link"),wn(i,"link",n),Ft(i),u.head.appendChild(i)))}}function uk(n){gi.D(n),O0("dns-prefetch",n,null)}function dk(n,i){gi.C(n,i),O0("preconnect",n,i)}function fk(n,i,l){gi.L(n,i,l);var u=Os;if(u&&n&&i){var x='link[rel="preload"][as="'+Cn(i)+'"]';i==="image"&&l&&l.imageSrcSet?(x+='[imagesrcset="'+Cn(l.imageSrcSet)+'"]',typeof l.imageSizes=="string"&&(x+='[imagesizes="'+Cn(l.imageSizes)+'"]')):x+='[href="'+Cn(n)+'"]';var v=x;switch(i){case"style":v=Rs(n);break;case"script":v=js(n)}gr.has(v)||(n=g({rel:"preload",href:i==="image"&&l&&l.imageSrcSet?void 0:n,as:i},l),gr.set(v,n),u.querySelector(x)!==null||i==="style"&&u.querySelector(ql(v))||i==="script"&&u.querySelector(Pl(v))||(i=u.createElement("link"),wn(i,"link",n),Ft(i),u.head.appendChild(i)))}}function hk(n,i){gi.m(n,i);var l=Os;if(l&&n){var u=i&&typeof i.as=="string"?i.as:"script",x='link[rel="modulepreload"][as="'+Cn(u)+'"][href="'+Cn(n)+'"]',v=x;switch(u){case"audioworklet":case"paintworklet":case"serviceworker":case"sharedworker":case"worker":case"script":v=js(n)}if(!gr.has(v)&&(n=g({rel:"modulepreload",href:n},i),gr.set(v,n),l.querySelector(x)===null)){switch(u){case"audioworklet":case"paintworklet":case"serviceworker":case"sharedworker":case"worker":case"script":if(l.querySelector(Pl(v)))return}u=l.createElement("link"),wn(u,"link",n),Ft(u),l.head.appendChild(u)}}}function mk(n,i,l){gi.S(n,i,l);var u=Os;if(u&&n){var x=Br(u).hoistableStyles,v=Rs(n);i=i||"default";var T=x.get(v);if(!T){var G={loading:0,preload:null};if(T=u.querySelector(ql(v)))G.loading=5;else{n=g({rel:"stylesheet",href:n,"data-precedence":i},l),(l=gr.get(v))&&rh(n,l);var ne=T=u.createElement("link");Ft(ne),wn(ne,"link",n),ne._p=new Promise(function(le,he){ne.onload=le,ne.onerror=he}),ne.addEventListener("load",function(){G.loading|=1}),ne.addEventListener("error",function(){G.loading|=2}),G.loading|=4,Hc(T,i,u)}T={type:"stylesheet",instance:T,count:1,state:G},x.set(v,T)}}}function pk(n,i){gi.X(n,i);var l=Os;if(l&&n){var u=Br(l).hoistableScripts,x=js(n),v=u.get(x);v||(v=l.querySelector(Pl(x)),v||(n=g({src:n,async:!0},i),(i=gr.get(x))&&ih(n,i),v=l.createElement("script"),Ft(v),wn(v,"link",n),l.head.appendChild(v)),v={type:"script",instance:v,count:1,state:null},u.set(x,v))}}function gk(n,i){gi.M(n,i);var l=Os;if(l&&n){var u=Br(l).hoistableScripts,x=js(n),v=u.get(x);v||(v=l.querySelector(Pl(x)),v||(n=g({src:n,async:!0,type:"module"},i),(i=gr.get(x))&&ih(n,i),v=l.createElement("script"),Ft(v),wn(v,"link",n),l.head.appendChild(v)),v={type:"script",instance:v,count:1,state:null},u.set(x,v))}}function R0(n,i,l,u){var x=(x=Q.current)?Uc(x):null;if(!x)throw Error(a(446));switch(n){case"meta":case"title":return null;case"style":return typeof l.precedence=="string"&&typeof l.href=="string"?(i=Rs(l.href),l=Br(x).hoistableStyles,u=l.get(i),u||(u={type:"style",instance:null,count:0,state:null},l.set(i,u)),u):{type:"void",instance:null,count:0,state:null};case"link":if(l.rel==="stylesheet"&&typeof l.href=="string"&&typeof l.precedence=="string"){n=Rs(l.href);var v=Br(x).hoistableStyles,T=v.get(n);if(T||(x=x.ownerDocument||x,T={type:"stylesheet",instance:null,count:0,state:{loading:0,preload:null}},v.set(n,T),(v=x.querySelector(ql(n)))&&!v._p&&(T.instance=v,T.state.loading=5),gr.has(n)||(l={rel:"preload",as:"style",href:l.href,crossOrigin:l.crossOrigin,integrity:l.integrity,media:l.media,hrefLang:l.hrefLang,referrerPolicy:l.referrerPolicy},gr.set(n,l),v||xk(x,n,l,T.state))),i&&u===null)throw Error(a(528,""));return T}if(i&&u!==null)throw Error(a(529,""));return null;case"script":return i=l.async,l=l.src,typeof l=="string"&&i&&typeof i!="function"&&typeof i!="symbol"?(i=js(l),l=Br(x).hoistableScripts,u=l.get(i),u||(u={type:"script",instance:null,count:0,state:null},l.set(i,u)),u):{type:"void",instance:null,count:0,state:null};default:throw Error(a(444,n))}}function Rs(n){return'href="'+Cn(n)+'"'}function ql(n){return'link[rel="stylesheet"]['+n+"]"}function j0(n){return g({},n,{"data-precedence":n.precedence,precedence:null})}function xk(n,i,l,u){n.querySelector('link[rel="preload"][as="style"]['+i+"]")?u.loading=1:(i=n.createElement("link"),u.preload=i,i.addEventListener("load",function(){return u.loading|=1}),i.addEventListener("error",function(){return u.loading|=2}),wn(i,"link",l),Ft(i),n.head.appendChild(i))}function js(n){return'[src="'+Cn(n)+'"]'}function Pl(n){return"script[async]"+n}function D0(n,i,l){if(i.count++,i.instance===null)switch(i.type){case"style":var u=n.querySelector('style[data-href~="'+Cn(l.href)+'"]');if(u)return i.instance=u,Ft(u),u;var x=g({},l,{"data-href":l.href,"data-precedence":l.precedence,href:null,precedence:null});return u=(n.ownerDocument||n).createElement("style"),Ft(u),wn(u,"style",x),Hc(u,l.precedence,n),i.instance=u;case"stylesheet":x=Rs(l.href);var v=n.querySelector(ql(x));if(v)return i.state.loading|=4,i.instance=v,Ft(v),v;u=j0(l),(x=gr.get(x))&&rh(u,x),v=(n.ownerDocument||n).createElement("link"),Ft(v);var T=v;return T._p=new Promise(function(G,ne){T.onload=G,T.onerror=ne}),wn(v,"link",u),i.state.loading|=4,Hc(v,l.precedence,n),i.instance=v;case"script":return v=js(l.src),(x=n.querySelector(Pl(v)))?(i.instance=x,Ft(x),x):(u=l,(x=gr.get(v))&&(u=g({},l),ih(u,x)),n=n.ownerDocument||n,x=n.createElement("script"),Ft(x),wn(x,"link",u),n.head.appendChild(x),i.instance=x);case"void":return null;default:throw Error(a(443,i.type))}else i.type==="stylesheet"&&(i.state.loading&4)===0&&(u=i.instance,i.state.loading|=4,Hc(u,l.precedence,n));return i.instance}function Hc(n,i,l){for(var u=l.querySelectorAll('link[rel="stylesheet"][data-precedence],style[data-precedence]'),x=u.length?u[u.length-1]:null,v=x,T=0;T title"):null)}function bk(n,i,l){if(l===1||i.itemProp!=null)return!1;switch(n){case"meta":case"title":return!0;case"style":if(typeof i.precedence!="string"||typeof i.href!="string"||i.href==="")break;return!0;case"link":if(typeof i.rel!="string"||typeof i.href!="string"||i.href===""||i.onLoad||i.onError)break;switch(i.rel){case"stylesheet":return n=i.disabled,typeof i.precedence=="string"&&n==null;default:return!0}case"script":if(i.async&&typeof i.async!="function"&&typeof i.async!="symbol"&&!i.onLoad&&!i.onError&&i.src&&typeof i.src=="string")return!0}return!1}function I0(n){return!(n.type==="stylesheet"&&(n.state.loading&3)===0)}function yk(n,i,l,u){if(l.type==="stylesheet"&&(typeof u.media!="string"||matchMedia(u.media).matches!==!1)&&(l.state.loading&4)===0){if(l.instance===null){var x=Rs(u.href),v=i.querySelector(ql(x));if(v){i=v._p,i!==null&&typeof i=="object"&&typeof i.then=="function"&&(n.count++,n=qc.bind(n),i.then(n,n)),l.state.loading|=4,l.instance=v,Ft(v);return}v=i.ownerDocument||i,u=j0(u),(x=gr.get(x))&&rh(u,x),v=v.createElement("link"),Ft(v);var T=v;T._p=new Promise(function(G,ne){T.onload=G,T.onerror=ne}),wn(v,"link",u),l.instance=v}n.stylesheets===null&&(n.stylesheets=new Map),n.stylesheets.set(l,i),(i=l.state.preload)&&(l.state.loading&3)===0&&(n.count++,l=qc.bind(n),i.addEventListener("load",l),i.addEventListener("error",l))}}var ah=0;function vk(n,i){return n.stylesheets&&n.count===0&&Fc(n,n.stylesheets),0ah?50:800)+i);return n.unsuspend=l,function(){n.unsuspend=null,clearTimeout(u),clearTimeout(x)}}:null}function qc(){if(this.count--,this.count===0&&(this.imgCount===0||!this.waitingForImages)){if(this.stylesheets)Fc(this,this.stylesheets);else if(this.unsuspend){var n=this.unsuspend;this.unsuspend=null,n()}}}var Pc=null;function Fc(n,i){n.stylesheets=null,n.unsuspend!==null&&(n.count++,Pc=new Map,i.forEach(_k,n),Pc=null,qc.call(n))}function _k(n,i){if(!(i.state.loading&4)){var l=Pc.get(n);if(l)var u=l.get(null);else{l=new Map,Pc.set(n,l);for(var x=n.querySelectorAll("link[data-precedence],style[data-precedence]"),v=0;v"u"||typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE!="function"))try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(e)}catch(t){console.error(t)}}return e(),mh.exports=zk(),mh.exports}var Bk=Ik();/** +`+u.stack}}var Xt=Object.prototype.hasOwnProperty,Pt=e.unstable_scheduleCallback,Kt=e.unstable_cancelCallback,Yn=e.unstable_shouldYield,Nn=e.unstable_requestPaint,ct=e.unstable_now,It=e.unstable_getCurrentPriorityLevel,ue=e.unstable_ImmediatePriority,be=e.unstable_UserBlockingPriority,Oe=e.unstable_NormalPriority,Fe=e.unstable_LowPriority,Ze=e.unstable_IdlePriority,cn=e.log,Sn=e.unstable_setDisableYieldValue,Zt=null,At=null;function Jt(n){if(typeof cn=="function"&&Sn(n),At&&typeof At.setStrictMode=="function")try{At.setStrictMode(Zt,n)}catch{}}var ut=Math.clz32?Math.clz32:Si,In=Math.log,un=Math.LN2;function Si(n){return n>>>=0,n===0?32:31-(In(n)/un|0)|0}var nt=256,Xn=262144,On=4194304;function mn(n){var i=n&42;if(i!==0)return i;switch(n&-n){case 1:return 1;case 2:return 2;case 4:return 4;case 8:return 8;case 16:return 16;case 32:return 32;case 64:return 64;case 128:return 128;case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:return n&261888;case 262144:case 524288:case 1048576:case 2097152:return n&3932160;case 4194304:case 8388608:case 16777216:case 33554432:return n&62914560;case 67108864:return 67108864;case 134217728:return 134217728;case 268435456:return 268435456;case 536870912:return 536870912;case 1073741824:return 0;default:return n}}function re(n,i,l){var u=n.pendingLanes;if(u===0)return 0;var x=0,v=n.suspendedLanes,T=n.pingedLanes;n=n.warmLanes;var G=u&134217727;return G!==0?(u=G&~v,u!==0?x=mn(u):(T&=G,T!==0?x=mn(T):l||(l=G&~n,l!==0&&(x=mn(l))))):(G=u&~v,G!==0?x=mn(G):T!==0?x=mn(T):l||(l=u&~n,l!==0&&(x=mn(l)))),x===0?0:i!==0&&i!==x&&(i&v)===0&&(v=x&-x,l=i&-i,v>=l||v===32&&(l&4194048)!==0)?i:x}function me(n,i){return(n.pendingLanes&~(n.suspendedLanes&~n.pingedLanes)&i)===0}function Ee(n,i){switch(n){case 1:case 2:case 4:case 8:case 64:return i+250;case 16:case 32:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:return i+5e3;case 4194304:case 8388608:case 16777216:case 33554432:return-1;case 67108864:case 134217728:case 268435456:case 536870912:case 1073741824:return-1;default:return-1}}function Pe(){var n=On;return On<<=1,(On&62914560)===0&&(On=4194304),n}function St(n){for(var i=[],l=0;31>l;l++)i.push(n);return i}function gt(n,i){n.pendingLanes|=i,i!==268435456&&(n.suspendedLanes=0,n.pingedLanes=0,n.warmLanes=0)}function Me(n,i,l,u,x,v){var T=n.pendingLanes;n.pendingLanes=l,n.suspendedLanes=0,n.pingedLanes=0,n.warmLanes=0,n.expiredLanes&=l,n.entangledLanes&=l,n.errorRecoveryDisabledLanes&=l,n.shellSuspendCounter=0;var G=n.entanglements,ne=n.expirationTimes,le=n.hiddenUpdates;for(l=T&~l;0"u")return null;try{return n.activeElement||n.body}catch{return n.body}}var is=/[\n"\\]/g;function Cn(n){return n.replace(is,function(i){return"\\"+i.charCodeAt(0).toString(16)+" "})}function ba(n,i,l,u,x,v,T,G){n.name="",T!=null&&typeof T!="function"&&typeof T!="symbol"&&typeof T!="boolean"?n.type=T:n.removeAttribute("type"),i!=null?T==="number"?(i===0&&n.value===""||n.value!=i)&&(n.value=""+_t(i)):n.value!==""+_t(i)&&(n.value=""+_t(i)):T!=="submit"&&T!=="reset"||n.removeAttribute("value"),i!=null?Ri(n,T,_t(i)):l!=null?Ri(n,T,_t(l)):u!=null&&n.removeAttribute("value"),x==null&&v!=null&&(n.defaultChecked=!!v),x!=null&&(n.checked=x&&typeof x!="function"&&typeof x!="symbol"),G!=null&&typeof G!="function"&&typeof G!="symbol"&&typeof G!="boolean"?n.name=""+_t(G):n.removeAttribute("name")}function Sr(n,i,l,u,x,v,T,G){if(v!=null&&typeof v!="function"&&typeof v!="symbol"&&typeof v!="boolean"&&(n.type=v),i!=null||l!=null){if(!(v!=="submit"&&v!=="reset"||i!=null)){Mi(n);return}l=l!=null?""+_t(l):"",i=i!=null?""+_t(i):l,G||i===n.value||(n.value=i),n.defaultValue=i}u=u??x,u=typeof u!="function"&&typeof u!="symbol"&&!!u,n.checked=G?n.checked:!!u,n.defaultChecked=!!u,T!=null&&typeof T!="function"&&typeof T!="symbol"&&typeof T!="boolean"&&(n.name=T),Mi(n)}function Ri(n,i,l){i==="number"&&Oi(n.ownerDocument)===n||n.defaultValue===""+l||(n.defaultValue=""+l)}function dn(n,i,l,u){if(n=n.options,i){i={};for(var x=0;x"u"||typeof window.document>"u"||typeof window.document.createElement>"u"),fd=!1;if(ti)try{var ol={};Object.defineProperty(ol,"passive",{get:function(){fd=!0}}),window.addEventListener("test",ol,ol),window.removeEventListener("test",ol,ol)}catch{fd=!1}var Li=null,hd=null,Go=null;function Eg(){if(Go)return Go;var n,i=hd,l=i.length,u,x="value"in Li?Li.value:Li.textContent,v=x.length;for(n=0;n=dl),Ag=" ",Mg=!1;function Og(n,i){switch(n){case"keyup":return tS.indexOf(i.keyCode)!==-1;case"keydown":return i.keyCode!==229;case"keypress":case"mousedown":case"focusout":return!0;default:return!1}}function Rg(n){return n=n.detail,typeof n=="object"&&"data"in n?n.data:null}var ss=!1;function rS(n,i){switch(n){case"compositionend":return Rg(i);case"keypress":return i.which!==32?null:(Mg=!0,Ag);case"textInput":return n=i.data,n===Ag&&Mg?null:n;default:return null}}function iS(n,i){if(ss)return n==="compositionend"||!bd&&Og(n,i)?(n=Eg(),Go=hd=Li=null,ss=!1,n):null;switch(n){case"paste":return null;case"keypress":if(!(i.ctrlKey||i.altKey||i.metaKey)||i.ctrlKey&&i.altKey){if(i.char&&1=i)return{node:l,offset:i-n};n=u}e:{for(;l;){if(l.nextSibling){l=l.nextSibling;break e}l=l.parentNode}l=void 0}l=Hg(l)}}function qg(n,i){return n&&i?n===i?!0:n&&n.nodeType===3?!1:i&&i.nodeType===3?qg(n,i.parentNode):"contains"in n?n.contains(i):n.compareDocumentPosition?!!(n.compareDocumentPosition(i)&16):!1:!1}function Pg(n){n=n!=null&&n.ownerDocument!=null&&n.ownerDocument.defaultView!=null?n.ownerDocument.defaultView:window;for(var i=Oi(n.document);i instanceof n.HTMLIFrameElement;){try{var l=typeof i.contentWindow.location.href=="string"}catch{l=!1}if(l)n=i.contentWindow;else break;i=Oi(n.document)}return i}function _d(n){var i=n&&n.nodeName&&n.nodeName.toLowerCase();return i&&(i==="input"&&(n.type==="text"||n.type==="search"||n.type==="tel"||n.type==="url"||n.type==="password")||i==="textarea"||n.contentEditable==="true")}var fS=ti&&"documentMode"in document&&11>=document.documentMode,ls=null,wd=null,pl=null,Ed=!1;function Fg(n,i,l){var u=l.window===l?l.document:l.nodeType===9?l:l.ownerDocument;Ed||ls==null||ls!==Oi(u)||(u=ls,"selectionStart"in u&&_d(u)?u={start:u.selectionStart,end:u.selectionEnd}:(u=(u.ownerDocument&&u.ownerDocument.defaultView||window).getSelection(),u={anchorNode:u.anchorNode,anchorOffset:u.anchorOffset,focusNode:u.focusNode,focusOffset:u.focusOffset}),pl&&ml(pl,u)||(pl=u,u=Bc(wd,"onSelect"),0>=T,x-=T,Hr=1<<32-ut(i)+x|l<Ke?(at=je,je=null):at=je.sibling;var mt=ce(ae,je,se[Ke],pe);if(mt===null){je===null&&(je=at);break}n&&je&&mt.alternate===null&&i(ae,je),ie=v(mt,ie,Ke),ht===null?Ie=mt:ht.sibling=mt,ht=mt,je=at}if(Ke===se.length)return l(ae,je),lt&&ri(ae,Ke),Ie;if(je===null){for(;KeKe?(at=je,je=null):at=je.sibling;var ra=ce(ae,je,mt.value,pe);if(ra===null){je===null&&(je=at);break}n&&je&&ra.alternate===null&&i(ae,je),ie=v(ra,ie,Ke),ht===null?Ie=ra:ht.sibling=ra,ht=ra,je=at}if(mt.done)return l(ae,je),lt&&ri(ae,Ke),Ie;if(je===null){for(;!mt.done;Ke++,mt=se.next())mt=ge(ae,mt.value,pe),mt!==null&&(ie=v(mt,ie,Ke),ht===null?Ie=mt:ht.sibling=mt,ht=mt);return lt&&ri(ae,Ke),Ie}for(je=u(je);!mt.done;Ke++,mt=se.next())mt=de(je,ae,Ke,mt.value,pe),mt!==null&&(n&&mt.alternate!==null&&je.delete(mt.key===null?Ke:mt.key),ie=v(mt,ie,Ke),ht===null?Ie=mt:ht.sibling=mt,ht=mt);return n&&je.forEach(function(Rk){return i(ae,Rk)}),lt&&ri(ae,Ke),Ie}function Nt(ae,ie,se,pe){if(typeof se=="object"&&se!==null&&se.type===N&&se.key===null&&(se=se.props.children),typeof se=="object"&&se!==null){switch(se.$$typeof){case y:e:{for(var Ie=se.key;ie!==null;){if(ie.key===Ie){if(Ie=se.type,Ie===N){if(ie.tag===7){l(ae,ie.sibling),pe=x(ie,se.props.children),pe.return=ae,ae=pe;break e}}else if(ie.elementType===Ie||typeof Ie=="object"&&Ie!==null&&Ie.$$typeof===z&&Aa(Ie)===ie.type){l(ae,ie.sibling),pe=x(ie,se.props),_l(pe,se),pe.return=ae,ae=pe;break e}l(ae,ie);break}else i(ae,ie);ie=ie.sibling}se.type===N?(pe=Na(se.props.children,ae.mode,pe,se.key),pe.return=ae,ae=pe):(pe=tc(se.type,se.key,se.props,null,ae.mode,pe),_l(pe,se),pe.return=ae,ae=pe)}return T(ae);case _:e:{for(Ie=se.key;ie!==null;){if(ie.key===Ie)if(ie.tag===4&&ie.stateNode.containerInfo===se.containerInfo&&ie.stateNode.implementation===se.implementation){l(ae,ie.sibling),pe=x(ie,se.children||[]),pe.return=ae,ae=pe;break e}else{l(ae,ie);break}else i(ae,ie);ie=ie.sibling}pe=Md(se,ae.mode,pe),pe.return=ae,ae=pe}return T(ae);case z:return se=Aa(se),Nt(ae,ie,se,pe)}if($(se))return Ae(ae,ie,se,pe);if(Z(se)){if(Ie=Z(se),typeof Ie!="function")throw Error(a(150));return se=Ie.call(se),He(ae,ie,se,pe)}if(typeof se.then=="function")return Nt(ae,ie,oc(se),pe);if(se.$$typeof===E)return Nt(ae,ie,ic(ae,se),pe);cc(ae,se)}return typeof se=="string"&&se!==""||typeof se=="number"||typeof se=="bigint"?(se=""+se,ie!==null&&ie.tag===6?(l(ae,ie.sibling),pe=x(ie,se),pe.return=ae,ae=pe):(l(ae,ie),pe=Ad(se,ae.mode,pe),pe.return=ae,ae=pe),T(ae)):l(ae,ie)}return function(ae,ie,se,pe){try{vl=0;var Ie=Nt(ae,ie,se,pe);return bs=null,Ie}catch(je){if(je===xs||je===sc)throw je;var ht=Zn(29,je,null,ae.mode);return ht.lanes=pe,ht.return=ae,ht}finally{}}}var Oa=hx(!0),mx=hx(!1),Hi=!1;function qd(n){n.updateQueue={baseState:n.memoizedState,firstBaseUpdate:null,lastBaseUpdate:null,shared:{pending:null,lanes:0,hiddenCallbacks:null},callbacks:null}}function Pd(n,i){n=n.updateQueue,i.updateQueue===n&&(i.updateQueue={baseState:n.baseState,firstBaseUpdate:n.firstBaseUpdate,lastBaseUpdate:n.lastBaseUpdate,shared:n.shared,callbacks:null})}function $i(n){return{lane:n,tag:0,payload:null,callback:null,next:null}}function qi(n,i,l){var u=n.updateQueue;if(u===null)return null;if(u=u.shared,(pt&2)!==0){var x=u.pending;return x===null?i.next=i:(i.next=x.next,x.next=i),u.pending=i,i=ec(n),Qg(n,null,l),i}return Jo(n,u,i,l),ec(n)}function wl(n,i,l){if(i=i.updateQueue,i!==null&&(i=i.shared,(l&4194048)!==0)){var u=i.lanes;u&=n.pendingLanes,l|=u,i.lanes=l,Ue(n,l)}}function Fd(n,i){var l=n.updateQueue,u=n.alternate;if(u!==null&&(u=u.updateQueue,l===u)){var x=null,v=null;if(l=l.firstBaseUpdate,l!==null){do{var T={lane:l.lane,tag:l.tag,payload:l.payload,callback:null,next:null};v===null?x=v=T:v=v.next=T,l=l.next}while(l!==null);v===null?x=v=i:v=v.next=i}else x=v=i;l={baseState:u.baseState,firstBaseUpdate:x,lastBaseUpdate:v,shared:u.shared,callbacks:u.callbacks},n.updateQueue=l;return}n=l.lastBaseUpdate,n===null?l.firstBaseUpdate=i:n.next=i,l.lastBaseUpdate=i}var Gd=!1;function El(){if(Gd){var n=gs;if(n!==null)throw n}}function Nl(n,i,l,u){Gd=!1;var x=n.updateQueue;Hi=!1;var v=x.firstBaseUpdate,T=x.lastBaseUpdate,G=x.shared.pending;if(G!==null){x.shared.pending=null;var ne=G,le=ne.next;ne.next=null,T===null?v=le:T.next=le,T=ne;var he=n.alternate;he!==null&&(he=he.updateQueue,G=he.lastBaseUpdate,G!==T&&(G===null?he.firstBaseUpdate=le:G.next=le,he.lastBaseUpdate=ne))}if(v!==null){var ge=x.baseState;T=0,he=le=ne=null,G=v;do{var ce=G.lane&-536870913,de=ce!==G.lane;if(de?(it&ce)===ce:(u&ce)===ce){ce!==0&&ce===ps&&(Gd=!0),he!==null&&(he=he.next={lane:0,tag:G.tag,payload:G.payload,callback:null,next:null});e:{var Ae=n,He=G;ce=i;var Nt=l;switch(He.tag){case 1:if(Ae=He.payload,typeof Ae=="function"){ge=Ae.call(Nt,ge,ce);break e}ge=Ae;break e;case 3:Ae.flags=Ae.flags&-65537|128;case 0:if(Ae=He.payload,ce=typeof Ae=="function"?Ae.call(Nt,ge,ce):Ae,ce==null)break e;ge=g({},ge,ce);break e;case 2:Hi=!0}}ce=G.callback,ce!==null&&(n.flags|=64,de&&(n.flags|=8192),de=x.callbacks,de===null?x.callbacks=[ce]:de.push(ce))}else de={lane:ce,tag:G.tag,payload:G.payload,callback:G.callback,next:null},he===null?(le=he=de,ne=ge):he=he.next=de,T|=ce;if(G=G.next,G===null){if(G=x.shared.pending,G===null)break;de=G,G=de.next,de.next=null,x.lastBaseUpdate=de,x.shared.pending=null}}while(!0);he===null&&(ne=ge),x.baseState=ne,x.firstBaseUpdate=le,x.lastBaseUpdate=he,v===null&&(x.shared.lanes=0),Yi|=T,n.lanes=T,n.memoizedState=ge}}function px(n,i){if(typeof n!="function")throw Error(a(191,n));n.call(i)}function gx(n,i){var l=n.callbacks;if(l!==null)for(n.callbacks=null,n=0;nv?v:8;var T=O.T,G={};O.T=G,df(n,!1,i,l);try{var ne=x(),le=O.S;if(le!==null&&le(G,ne),ne!==null&&typeof ne=="object"&&typeof ne.then=="function"){var he=_S(ne,u);Cl(n,i,he,tr(n))}else Cl(n,i,u,tr(n))}catch(ge){Cl(n,i,{then:function(){},status:"rejected",reason:ge},tr())}finally{U.p=v,T!==null&&G.types!==null&&(T.types=G.types),O.T=T}}function CS(){}function cf(n,i,l,u){if(n.tag!==5)throw Error(a(476));var x=Xx(n).queue;Yx(n,x,i,K,l===null?CS:function(){return Kx(n),l(u)})}function Xx(n){var i=n.memoizedState;if(i!==null)return i;i={memoizedState:K,baseState:K,baseQueue:null,queue:{pending:null,lanes:0,dispatch:null,lastRenderedReducer:li,lastRenderedState:K},next:null};var l={};return i.next={memoizedState:l,baseState:l,baseQueue:null,queue:{pending:null,lanes:0,dispatch:null,lastRenderedReducer:li,lastRenderedState:l},next:null},n.memoizedState=i,n=n.alternate,n!==null&&(n.memoizedState=i),i}function Kx(n){var i=Xx(n);i.next===null&&(i=n.alternate.memoizedState),Cl(n,i.next.queue,{},tr())}function uf(){return vn(Fl)}function Zx(){return Wt().memoizedState}function Qx(){return Wt().memoizedState}function TS(n){for(var i=n.return;i!==null;){switch(i.tag){case 24:case 3:var l=tr();n=$i(l);var u=qi(i,n,l);u!==null&&(Pn(u,i,l),wl(u,i,l)),i={cache:Bd()},n.payload=i;return}i=i.return}}function AS(n,i,l){var u=tr();l={lane:u,revertLane:0,gesture:null,action:l,hasEagerState:!1,eagerState:null,next:null},yc(n)?Jx(i,l):(l=Cd(n,i,l,u),l!==null&&(Pn(l,n,u),eb(l,i,u)))}function Wx(n,i,l){var u=tr();Cl(n,i,l,u)}function Cl(n,i,l,u){var x={lane:u,revertLane:0,gesture:null,action:l,hasEagerState:!1,eagerState:null,next:null};if(yc(n))Jx(i,x);else{var v=n.alternate;if(n.lanes===0&&(v===null||v.lanes===0)&&(v=i.lastRenderedReducer,v!==null))try{var T=i.lastRenderedState,G=v(T,l);if(x.hasEagerState=!0,x.eagerState=G,Kn(G,T))return Jo(n,i,x,0),kt===null&&Wo(),!1}catch{}finally{}if(l=Cd(n,i,x,u),l!==null)return Pn(l,n,u),eb(l,i,u),!0}return!1}function df(n,i,l,u){if(u={lane:2,revertLane:Pf(),gesture:null,action:u,hasEagerState:!1,eagerState:null,next:null},yc(n)){if(i)throw Error(a(479))}else i=Cd(n,l,u,2),i!==null&&Pn(i,n,2)}function yc(n){var i=n.alternate;return n===Xe||i!==null&&i===Xe}function Jx(n,i){vs=fc=!0;var l=n.pending;l===null?i.next=i:(i.next=l.next,l.next=i),n.pending=i}function eb(n,i,l){if((l&4194048)!==0){var u=i.lanes;u&=n.pendingLanes,l|=u,i.lanes=l,Ue(n,l)}}var Tl={readContext:vn,use:pc,useCallback:Gt,useContext:Gt,useEffect:Gt,useImperativeHandle:Gt,useLayoutEffect:Gt,useInsertionEffect:Gt,useMemo:Gt,useReducer:Gt,useRef:Gt,useState:Gt,useDebugValue:Gt,useDeferredValue:Gt,useTransition:Gt,useSyncExternalStore:Gt,useId:Gt,useHostTransitionStatus:Gt,useFormState:Gt,useActionState:Gt,useOptimistic:Gt,useMemoCache:Gt,useCacheRefresh:Gt};Tl.useEffectEvent=Gt;var tb={readContext:vn,use:pc,useCallback:function(n,i){return Dn().memoizedState=[n,i===void 0?null:i],n},useContext:vn,useEffect:Bx,useImperativeHandle:function(n,i,l){l=l!=null?l.concat([n]):null,xc(4194308,4,qx.bind(null,i,n),l)},useLayoutEffect:function(n,i){return xc(4194308,4,n,i)},useInsertionEffect:function(n,i){xc(4,2,n,i)},useMemo:function(n,i){var l=Dn();i=i===void 0?null:i;var u=n();if(Ra){Jt(!0);try{n()}finally{Jt(!1)}}return l.memoizedState=[u,i],u},useReducer:function(n,i,l){var u=Dn();if(l!==void 0){var x=l(i);if(Ra){Jt(!0);try{l(i)}finally{Jt(!1)}}}else x=i;return u.memoizedState=u.baseState=x,n={pending:null,lanes:0,dispatch:null,lastRenderedReducer:n,lastRenderedState:x},u.queue=n,n=n.dispatch=AS.bind(null,Xe,n),[u.memoizedState,n]},useRef:function(n){var i=Dn();return n={current:n},i.memoizedState=n},useState:function(n){n=rf(n);var i=n.queue,l=Wx.bind(null,Xe,i);return i.dispatch=l,[n.memoizedState,l]},useDebugValue:lf,useDeferredValue:function(n,i){var l=Dn();return of(l,n,i)},useTransition:function(){var n=rf(!1);return n=Yx.bind(null,Xe,n.queue,!0,!1),Dn().memoizedState=n,[!1,n]},useSyncExternalStore:function(n,i,l){var u=Xe,x=Dn();if(lt){if(l===void 0)throw Error(a(407));l=l()}else{if(l=i(),kt===null)throw Error(a(349));(it&127)!==0||wx(u,i,l)}x.memoizedState=l;var v={value:l,getSnapshot:i};return x.queue=v,Bx(Nx.bind(null,u,v,n),[n]),u.flags|=2048,ws(9,{destroy:void 0},Ex.bind(null,u,v,l,i),null),l},useId:function(){var n=Dn(),i=kt.identifierPrefix;if(lt){var l=$r,u=Hr;l=(u&~(1<<32-ut(u)-1)).toString(32)+l,i="_"+i+"R_"+l,l=hc++,0<\/script>",v=v.removeChild(v.firstChild);break;case"select":v=typeof u.is=="string"?T.createElement("select",{is:u.is}):T.createElement("select"),u.multiple?v.multiple=!0:u.size&&(v.size=u.size);break;default:v=typeof u.is=="string"?T.createElement(x,{is:u.is}):T.createElement(x)}}v[Ut]=i,v[pn]=u;e:for(T=i.child;T!==null;){if(T.tag===5||T.tag===6)v.appendChild(T.stateNode);else if(T.tag!==4&&T.tag!==27&&T.child!==null){T.child.return=T,T=T.child;continue}if(T===i)break e;for(;T.sibling===null;){if(T.return===null||T.return===i)break e;T=T.return}T.sibling.return=T.return,T=T.sibling}i.stateNode=v;e:switch(wn(v,x,u),x){case"button":case"input":case"select":case"textarea":u=!!u.autoFocus;break e;case"img":u=!0;break e;default:u=!1}u&&ci(i)}}return Dt(i),Sf(i,i.type,n===null?null:n.memoizedProps,i.pendingProps,l),null;case 6:if(n&&i.stateNode!=null)n.memoizedProps!==u&&ci(i);else{if(typeof u!="string"&&i.stateNode===null)throw Error(a(166));if(n=Q.current,hs(i)){if(n=i.stateNode,l=i.memoizedProps,u=null,x=yn,x!==null)switch(x.tag){case 27:case 5:u=x.memoizedProps}n[Ut]=i,n=!!(n.nodeValue===l||u!==null&&u.suppressHydrationWarning===!0||v0(n.nodeValue,l)),n||Bi(i,!0)}else n=Uc(n).createTextNode(u),n[Ut]=i,i.stateNode=n}return Dt(i),null;case 31:if(l=i.memoizedState,n===null||n.memoizedState!==null){if(u=hs(i),l!==null){if(n===null){if(!u)throw Error(a(318));if(n=i.memoizedState,n=n!==null?n.dehydrated:null,!n)throw Error(a(557));n[Ut]=i}else Sa(),(i.flags&128)===0&&(i.memoizedState=null),i.flags|=4;Dt(i),n=!1}else l=Dd(),n!==null&&n.memoizedState!==null&&(n.memoizedState.hydrationErrors=l),n=!0;if(!n)return i.flags&256?(Wn(i),i):(Wn(i),null);if((i.flags&128)!==0)throw Error(a(558))}return Dt(i),null;case 13:if(u=i.memoizedState,n===null||n.memoizedState!==null&&n.memoizedState.dehydrated!==null){if(x=hs(i),u!==null&&u.dehydrated!==null){if(n===null){if(!x)throw Error(a(318));if(x=i.memoizedState,x=x!==null?x.dehydrated:null,!x)throw Error(a(317));x[Ut]=i}else Sa(),(i.flags&128)===0&&(i.memoizedState=null),i.flags|=4;Dt(i),x=!1}else x=Dd(),n!==null&&n.memoizedState!==null&&(n.memoizedState.hydrationErrors=x),x=!0;if(!x)return i.flags&256?(Wn(i),i):(Wn(i),null)}return Wn(i),(i.flags&128)!==0?(i.lanes=l,i):(l=u!==null,n=n!==null&&n.memoizedState!==null,l&&(u=i.child,x=null,u.alternate!==null&&u.alternate.memoizedState!==null&&u.alternate.memoizedState.cachePool!==null&&(x=u.alternate.memoizedState.cachePool.pool),v=null,u.memoizedState!==null&&u.memoizedState.cachePool!==null&&(v=u.memoizedState.cachePool.pool),v!==x&&(u.flags|=2048)),l!==n&&l&&(i.child.flags|=8192),Nc(i,i.updateQueue),Dt(i),null);case 4:return te(),n===null&&Yf(i.stateNode.containerInfo),Dt(i),null;case 10:return ai(i.type),Dt(i),null;case 19:if(F(Qt),u=i.memoizedState,u===null)return Dt(i),null;if(x=(i.flags&128)!==0,v=u.rendering,v===null)if(x)Ml(u,!1);else{if(Vt!==0||n!==null&&(n.flags&128)!==0)for(n=i.child;n!==null;){if(v=dc(n),v!==null){for(i.flags|=128,Ml(u,!1),n=v.updateQueue,i.updateQueue=n,Nc(i,n),i.subtreeFlags=0,n=l,l=i.child;l!==null;)Wg(l,n),l=l.sibling;return D(Qt,Qt.current&1|2),lt&&ri(i,u.treeForkCount),i.child}n=n.sibling}u.tail!==null&&ct()>Ac&&(i.flags|=128,x=!0,Ml(u,!1),i.lanes=4194304)}else{if(!x)if(n=dc(v),n!==null){if(i.flags|=128,x=!0,n=n.updateQueue,i.updateQueue=n,Nc(i,n),Ml(u,!0),u.tail===null&&u.tailMode==="hidden"&&!v.alternate&&!lt)return Dt(i),null}else 2*ct()-u.renderingStartTime>Ac&&l!==536870912&&(i.flags|=128,x=!0,Ml(u,!1),i.lanes=4194304);u.isBackwards?(v.sibling=i.child,i.child=v):(n=u.last,n!==null?n.sibling=v:i.child=v,u.last=v)}return u.tail!==null?(n=u.tail,u.rendering=n,u.tail=n.sibling,u.renderingStartTime=ct(),n.sibling=null,l=Qt.current,D(Qt,x?l&1|2:l&1),lt&&ri(i,u.treeForkCount),n):(Dt(i),null);case 22:case 23:return Wn(i),Yd(),u=i.memoizedState!==null,n!==null?n.memoizedState!==null!==u&&(i.flags|=8192):u&&(i.flags|=8192),u?(l&536870912)!==0&&(i.flags&128)===0&&(Dt(i),i.subtreeFlags&6&&(i.flags|=8192)):Dt(i),l=i.updateQueue,l!==null&&Nc(i,l.retryQueue),l=null,n!==null&&n.memoizedState!==null&&n.memoizedState.cachePool!==null&&(l=n.memoizedState.cachePool.pool),u=null,i.memoizedState!==null&&i.memoizedState.cachePool!==null&&(u=i.memoizedState.cachePool.pool),u!==l&&(i.flags|=2048),n!==null&&F(Ta),null;case 24:return l=null,n!==null&&(l=n.memoizedState.cache),i.memoizedState.cache!==l&&(i.flags|=2048),ai(tn),Dt(i),null;case 25:return null;case 30:return null}throw Error(a(156,i.tag))}function DS(n,i){switch(Rd(i),i.tag){case 1:return n=i.flags,n&65536?(i.flags=n&-65537|128,i):null;case 3:return ai(tn),te(),n=i.flags,(n&65536)!==0&&(n&128)===0?(i.flags=n&-65537|128,i):null;case 26:case 27:case 5:return fe(i),null;case 31:if(i.memoizedState!==null){if(Wn(i),i.alternate===null)throw Error(a(340));Sa()}return n=i.flags,n&65536?(i.flags=n&-65537|128,i):null;case 13:if(Wn(i),n=i.memoizedState,n!==null&&n.dehydrated!==null){if(i.alternate===null)throw Error(a(340));Sa()}return n=i.flags,n&65536?(i.flags=n&-65537|128,i):null;case 19:return F(Qt),null;case 4:return te(),null;case 10:return ai(i.type),null;case 22:case 23:return Wn(i),Yd(),n!==null&&F(Ta),n=i.flags,n&65536?(i.flags=n&-65537|128,i):null;case 24:return ai(tn),null;case 25:return null;default:return null}}function Sb(n,i){switch(Rd(i),i.tag){case 3:ai(tn),te();break;case 26:case 27:case 5:fe(i);break;case 4:te();break;case 31:i.memoizedState!==null&&Wn(i);break;case 13:Wn(i);break;case 19:F(Qt);break;case 10:ai(i.type);break;case 22:case 23:Wn(i),Yd(),n!==null&&F(Ta);break;case 24:ai(tn)}}function Ol(n,i){try{var l=i.updateQueue,u=l!==null?l.lastEffect:null;if(u!==null){var x=u.next;l=x;do{if((l.tag&n)===n){u=void 0;var v=l.create,T=l.inst;u=v(),T.destroy=u}l=l.next}while(l!==x)}}catch(G){yt(i,i.return,G)}}function Gi(n,i,l){try{var u=i.updateQueue,x=u!==null?u.lastEffect:null;if(x!==null){var v=x.next;u=v;do{if((u.tag&n)===n){var T=u.inst,G=T.destroy;if(G!==void 0){T.destroy=void 0,x=i;var ne=l,le=G;try{le()}catch(he){yt(x,ne,he)}}}u=u.next}while(u!==v)}}catch(he){yt(i,i.return,he)}}function kb(n){var i=n.updateQueue;if(i!==null){var l=n.stateNode;try{gx(i,l)}catch(u){yt(n,n.return,u)}}}function Cb(n,i,l){l.props=ja(n.type,n.memoizedProps),l.state=n.memoizedState;try{l.componentWillUnmount()}catch(u){yt(n,i,u)}}function Rl(n,i){try{var l=n.ref;if(l!==null){switch(n.tag){case 26:case 27:case 5:var u=n.stateNode;break;case 30:u=n.stateNode;break;default:u=n.stateNode}typeof l=="function"?n.refCleanup=l(u):l.current=u}}catch(x){yt(n,i,x)}}function qr(n,i){var l=n.ref,u=n.refCleanup;if(l!==null)if(typeof u=="function")try{u()}catch(x){yt(n,i,x)}finally{n.refCleanup=null,n=n.alternate,n!=null&&(n.refCleanup=null)}else if(typeof l=="function")try{l(null)}catch(x){yt(n,i,x)}else l.current=null}function Tb(n){var i=n.type,l=n.memoizedProps,u=n.stateNode;try{e:switch(i){case"button":case"input":case"select":case"textarea":l.autoFocus&&u.focus();break e;case"img":l.src?u.src=l.src:l.srcSet&&(u.srcset=l.srcSet)}}catch(x){yt(n,n.return,x)}}function kf(n,i,l){try{var u=n.stateNode;nk(u,n.type,l,i),u[pn]=i}catch(x){yt(n,n.return,x)}}function Ab(n){return n.tag===5||n.tag===3||n.tag===26||n.tag===27&&Wi(n.type)||n.tag===4}function Cf(n){e:for(;;){for(;n.sibling===null;){if(n.return===null||Ab(n.return))return null;n=n.return}for(n.sibling.return=n.return,n=n.sibling;n.tag!==5&&n.tag!==6&&n.tag!==18;){if(n.tag===27&&Wi(n.type)||n.flags&2||n.child===null||n.tag===4)continue e;n.child.return=n,n=n.child}if(!(n.flags&2))return n.stateNode}}function Tf(n,i,l){var u=n.tag;if(u===5||u===6)n=n.stateNode,i?(l.nodeType===9?l.body:l.nodeName==="HTML"?l.ownerDocument.body:l).insertBefore(n,i):(i=l.nodeType===9?l.body:l.nodeName==="HTML"?l.ownerDocument.body:l,i.appendChild(n),l=l._reactRootContainer,l!=null||i.onclick!==null||(i.onclick=_e));else if(u!==4&&(u===27&&Wi(n.type)&&(l=n.stateNode,i=null),n=n.child,n!==null))for(Tf(n,i,l),n=n.sibling;n!==null;)Tf(n,i,l),n=n.sibling}function Sc(n,i,l){var u=n.tag;if(u===5||u===6)n=n.stateNode,i?l.insertBefore(n,i):l.appendChild(n);else if(u!==4&&(u===27&&Wi(n.type)&&(l=n.stateNode),n=n.child,n!==null))for(Sc(n,i,l),n=n.sibling;n!==null;)Sc(n,i,l),n=n.sibling}function Mb(n){var i=n.stateNode,l=n.memoizedProps;try{for(var u=n.type,x=i.attributes;x.length;)i.removeAttributeNode(x[0]);wn(i,u,l),i[Ut]=n,i[pn]=l}catch(v){yt(n,n.return,v)}}var ui=!1,an=!1,Af=!1,Ob=typeof WeakSet=="function"?WeakSet:Set,xn=null;function LS(n,i){if(n=n.containerInfo,Zf=Vc,n=Pg(n),_d(n)){if("selectionStart"in n)var l={start:n.selectionStart,end:n.selectionEnd};else e:{l=(l=n.ownerDocument)&&l.defaultView||window;var u=l.getSelection&&l.getSelection();if(u&&u.rangeCount!==0){l=u.anchorNode;var x=u.anchorOffset,v=u.focusNode;u=u.focusOffset;try{l.nodeType,v.nodeType}catch{l=null;break e}var T=0,G=-1,ne=-1,le=0,he=0,ge=n,ce=null;t:for(;;){for(var de;ge!==l||x!==0&&ge.nodeType!==3||(G=T+x),ge!==v||u!==0&&ge.nodeType!==3||(ne=T+u),ge.nodeType===3&&(T+=ge.nodeValue.length),(de=ge.firstChild)!==null;)ce=ge,ge=de;for(;;){if(ge===n)break t;if(ce===l&&++le===x&&(G=T),ce===v&&++he===u&&(ne=T),(de=ge.nextSibling)!==null)break;ge=ce,ce=ge.parentNode}ge=de}l=G===-1||ne===-1?null:{start:G,end:ne}}else l=null}l=l||{start:0,end:0}}else l=null;for(Qf={focusedElem:n,selectionRange:l},Vc=!1,xn=i;xn!==null;)if(i=xn,n=i.child,(i.subtreeFlags&1028)!==0&&n!==null)n.return=i,xn=n;else for(;xn!==null;){switch(i=xn,v=i.alternate,n=i.flags,i.tag){case 0:if((n&4)!==0&&(n=i.updateQueue,n=n!==null?n.events:null,n!==null))for(l=0;l title"))),wn(v,u,l),v[Ut]=n,Ft(v),u=v;break e;case"link":var T=I0("link","href",x).get(u+(l.href||""));if(T){for(var G=0;GNt&&(T=Nt,Nt=He,He=T);var ae=$g(G,He),ie=$g(G,Nt);if(ae&&ie&&(de.rangeCount!==1||de.anchorNode!==ae.node||de.anchorOffset!==ae.offset||de.focusNode!==ie.node||de.focusOffset!==ie.offset)){var se=ge.createRange();se.setStart(ae.node,ae.offset),de.removeAllRanges(),He>Nt?(de.addRange(se),de.extend(ie.node,ie.offset)):(se.setEnd(ie.node,ie.offset),de.addRange(se))}}}}for(ge=[],de=G;de=de.parentNode;)de.nodeType===1&&ge.push({element:de,left:de.scrollLeft,top:de.scrollTop});for(typeof G.focus=="function"&&G.focus(),G=0;Gl?32:l,O.T=null,l=zf,zf=null;var v=Ki,T=pi;if(fn=0,Cs=Ki=null,pi=0,(pt&6)!==0)throw Error(a(331));var G=pt;if(pt|=4,qb(v.current),Ub(v,v.current,T,l),pt=G,Bl(0,!1),At&&typeof At.onPostCommitFiberRoot=="function")try{At.onPostCommitFiberRoot(Zt,v)}catch{}return!0}finally{U.p=x,O.T=u,s0(n,i)}}function o0(n,i,l){i=ur(l,i),i=pf(n.stateNode,i,2),n=qi(n,i,2),n!==null&&(gt(n,2),Pr(n))}function yt(n,i,l){if(n.tag===3)o0(n,n,l);else for(;i!==null;){if(i.tag===3){o0(i,n,l);break}else if(i.tag===1){var u=i.stateNode;if(typeof i.type.getDerivedStateFromError=="function"||typeof u.componentDidCatch=="function"&&(Xi===null||!Xi.has(u))){n=ur(l,n),l=cb(2),u=qi(i,l,2),u!==null&&(ub(l,u,i,n),gt(u,2),Pr(u));break}}i=i.return}}function Hf(n,i,l){var u=n.pingCache;if(u===null){u=n.pingCache=new BS;var x=new Set;u.set(i,x)}else x=u.get(i),x===void 0&&(x=new Set,u.set(i,x));x.has(l)||(Rf=!0,x.add(l),n=PS.bind(null,n,i,l),i.then(n,n))}function PS(n,i,l){var u=n.pingCache;u!==null&&u.delete(i),n.pingedLanes|=n.suspendedLanes&l,n.warmLanes&=~l,kt===n&&(it&l)===l&&(Vt===4||Vt===3&&(it&62914560)===it&&300>ct()-Tc?(pt&2)===0&&Ts(n,0):jf|=l,ks===it&&(ks=0)),Pr(n)}function c0(n,i){i===0&&(i=Pe()),n=Ea(n,i),n!==null&&(gt(n,i),Pr(n))}function FS(n){var i=n.memoizedState,l=0;i!==null&&(l=i.retryLane),c0(n,l)}function GS(n,i){var l=0;switch(n.tag){case 31:case 13:var u=n.stateNode,x=n.memoizedState;x!==null&&(l=x.retryLane);break;case 19:u=n.stateNode;break;case 22:u=n.stateNode._retryCache;break;default:throw Error(a(314))}u!==null&&u.delete(i),c0(n,l)}function VS(n,i){return Pt(n,i)}var Lc=null,Ms=null,$f=!1,zc=!1,qf=!1,Qi=0;function Pr(n){n!==Ms&&n.next===null&&(Ms===null?Lc=Ms=n:Ms=Ms.next=n),zc=!0,$f||($f=!0,XS())}function Bl(n,i){if(!qf&&zc){qf=!0;do for(var l=!1,u=Lc;u!==null;){if(n!==0){var x=u.pendingLanes;if(x===0)var v=0;else{var T=u.suspendedLanes,G=u.pingedLanes;v=(1<<31-ut(42|n)+1)-1,v&=x&~(T&~G),v=v&201326741?v&201326741|1:v?v|2:0}v!==0&&(l=!0,h0(u,v))}else v=it,v=re(u,u===kt?v:0,u.cancelPendingCommit!==null||u.timeoutHandle!==-1),(v&3)===0||me(u,v)||(l=!0,h0(u,v));u=u.next}while(l);qf=!1}}function YS(){u0()}function u0(){zc=$f=!1;var n=0;Qi!==0&&ik()&&(n=Qi);for(var i=ct(),l=null,u=Lc;u!==null;){var x=u.next,v=d0(u,i);v===0?(u.next=null,l===null?Lc=x:l.next=x,x===null&&(Ms=l)):(l=u,(n!==0||(v&3)!==0)&&(zc=!0)),u=x}fn!==0&&fn!==5||Bl(n),Qi!==0&&(Qi=0)}function d0(n,i){for(var l=n.suspendedLanes,u=n.pingedLanes,x=n.expirationTimes,v=n.pendingLanes&-62914561;0G)break;var he=ne.transferSize,ge=ne.initiatorType;he&&_0(ge)&&(ne=ne.responseEnd,T+=he*(ne"u"?null:document;function j0(n,i,l){var u=Os;if(u&&typeof i=="string"&&i){var x=Cn(i);x='link[rel="'+n+'"][href="'+x+'"]',typeof l=="string"&&(x+='[crossorigin="'+l+'"]'),R0.has(x)||(R0.add(x),n={rel:n,crossOrigin:l,href:i},u.querySelector(x)===null&&(i=u.createElement("link"),wn(i,"link",n),Ft(i),u.head.appendChild(i)))}}function hk(n){gi.D(n),j0("dns-prefetch",n,null)}function mk(n,i){gi.C(n,i),j0("preconnect",n,i)}function pk(n,i,l){gi.L(n,i,l);var u=Os;if(u&&n&&i){var x='link[rel="preload"][as="'+Cn(i)+'"]';i==="image"&&l&&l.imageSrcSet?(x+='[imagesrcset="'+Cn(l.imageSrcSet)+'"]',typeof l.imageSizes=="string"&&(x+='[imagesizes="'+Cn(l.imageSizes)+'"]')):x+='[href="'+Cn(n)+'"]';var v=x;switch(i){case"style":v=Rs(n);break;case"script":v=js(n)}gr.has(v)||(n=g({rel:"preload",href:i==="image"&&l&&l.imageSrcSet?void 0:n,as:i},l),gr.set(v,n),u.querySelector(x)!==null||i==="style"&&u.querySelector(ql(v))||i==="script"&&u.querySelector(Pl(v))||(i=u.createElement("link"),wn(i,"link",n),Ft(i),u.head.appendChild(i)))}}function gk(n,i){gi.m(n,i);var l=Os;if(l&&n){var u=i&&typeof i.as=="string"?i.as:"script",x='link[rel="modulepreload"][as="'+Cn(u)+'"][href="'+Cn(n)+'"]',v=x;switch(u){case"audioworklet":case"paintworklet":case"serviceworker":case"sharedworker":case"worker":case"script":v=js(n)}if(!gr.has(v)&&(n=g({rel:"modulepreload",href:n},i),gr.set(v,n),l.querySelector(x)===null)){switch(u){case"audioworklet":case"paintworklet":case"serviceworker":case"sharedworker":case"worker":case"script":if(l.querySelector(Pl(v)))return}u=l.createElement("link"),wn(u,"link",n),Ft(u),l.head.appendChild(u)}}}function xk(n,i,l){gi.S(n,i,l);var u=Os;if(u&&n){var x=Br(u).hoistableStyles,v=Rs(n);i=i||"default";var T=x.get(v);if(!T){var G={loading:0,preload:null};if(T=u.querySelector(ql(v)))G.loading=5;else{n=g({rel:"stylesheet",href:n,"data-precedence":i},l),(l=gr.get(v))&&ih(n,l);var ne=T=u.createElement("link");Ft(ne),wn(ne,"link",n),ne._p=new Promise(function(le,he){ne.onload=le,ne.onerror=he}),ne.addEventListener("load",function(){G.loading|=1}),ne.addEventListener("error",function(){G.loading|=2}),G.loading|=4,$c(T,i,u)}T={type:"stylesheet",instance:T,count:1,state:G},x.set(v,T)}}}function bk(n,i){gi.X(n,i);var l=Os;if(l&&n){var u=Br(l).hoistableScripts,x=js(n),v=u.get(x);v||(v=l.querySelector(Pl(x)),v||(n=g({src:n,async:!0},i),(i=gr.get(x))&&ah(n,i),v=l.createElement("script"),Ft(v),wn(v,"link",n),l.head.appendChild(v)),v={type:"script",instance:v,count:1,state:null},u.set(x,v))}}function yk(n,i){gi.M(n,i);var l=Os;if(l&&n){var u=Br(l).hoistableScripts,x=js(n),v=u.get(x);v||(v=l.querySelector(Pl(x)),v||(n=g({src:n,async:!0,type:"module"},i),(i=gr.get(x))&&ah(n,i),v=l.createElement("script"),Ft(v),wn(v,"link",n),l.head.appendChild(v)),v={type:"script",instance:v,count:1,state:null},u.set(x,v))}}function D0(n,i,l,u){var x=(x=Q.current)?Hc(x):null;if(!x)throw Error(a(446));switch(n){case"meta":case"title":return null;case"style":return typeof l.precedence=="string"&&typeof l.href=="string"?(i=Rs(l.href),l=Br(x).hoistableStyles,u=l.get(i),u||(u={type:"style",instance:null,count:0,state:null},l.set(i,u)),u):{type:"void",instance:null,count:0,state:null};case"link":if(l.rel==="stylesheet"&&typeof l.href=="string"&&typeof l.precedence=="string"){n=Rs(l.href);var v=Br(x).hoistableStyles,T=v.get(n);if(T||(x=x.ownerDocument||x,T={type:"stylesheet",instance:null,count:0,state:{loading:0,preload:null}},v.set(n,T),(v=x.querySelector(ql(n)))&&!v._p&&(T.instance=v,T.state.loading=5),gr.has(n)||(l={rel:"preload",as:"style",href:l.href,crossOrigin:l.crossOrigin,integrity:l.integrity,media:l.media,hrefLang:l.hrefLang,referrerPolicy:l.referrerPolicy},gr.set(n,l),v||vk(x,n,l,T.state))),i&&u===null)throw Error(a(528,""));return T}if(i&&u!==null)throw Error(a(529,""));return null;case"script":return i=l.async,l=l.src,typeof l=="string"&&i&&typeof i!="function"&&typeof i!="symbol"?(i=js(l),l=Br(x).hoistableScripts,u=l.get(i),u||(u={type:"script",instance:null,count:0,state:null},l.set(i,u)),u):{type:"void",instance:null,count:0,state:null};default:throw Error(a(444,n))}}function Rs(n){return'href="'+Cn(n)+'"'}function ql(n){return'link[rel="stylesheet"]['+n+"]"}function L0(n){return g({},n,{"data-precedence":n.precedence,precedence:null})}function vk(n,i,l,u){n.querySelector('link[rel="preload"][as="style"]['+i+"]")?u.loading=1:(i=n.createElement("link"),u.preload=i,i.addEventListener("load",function(){return u.loading|=1}),i.addEventListener("error",function(){return u.loading|=2}),wn(i,"link",l),Ft(i),n.head.appendChild(i))}function js(n){return'[src="'+Cn(n)+'"]'}function Pl(n){return"script[async]"+n}function z0(n,i,l){if(i.count++,i.instance===null)switch(i.type){case"style":var u=n.querySelector('style[data-href~="'+Cn(l.href)+'"]');if(u)return i.instance=u,Ft(u),u;var x=g({},l,{"data-href":l.href,"data-precedence":l.precedence,href:null,precedence:null});return u=(n.ownerDocument||n).createElement("style"),Ft(u),wn(u,"style",x),$c(u,l.precedence,n),i.instance=u;case"stylesheet":x=Rs(l.href);var v=n.querySelector(ql(x));if(v)return i.state.loading|=4,i.instance=v,Ft(v),v;u=L0(l),(x=gr.get(x))&&ih(u,x),v=(n.ownerDocument||n).createElement("link"),Ft(v);var T=v;return T._p=new Promise(function(G,ne){T.onload=G,T.onerror=ne}),wn(v,"link",u),i.state.loading|=4,$c(v,l.precedence,n),i.instance=v;case"script":return v=js(l.src),(x=n.querySelector(Pl(v)))?(i.instance=x,Ft(x),x):(u=l,(x=gr.get(v))&&(u=g({},l),ah(u,x)),n=n.ownerDocument||n,x=n.createElement("script"),Ft(x),wn(x,"link",u),n.head.appendChild(x),i.instance=x);case"void":return null;default:throw Error(a(443,i.type))}else i.type==="stylesheet"&&(i.state.loading&4)===0&&(u=i.instance,i.state.loading|=4,$c(u,l.precedence,n));return i.instance}function $c(n,i,l){for(var u=l.querySelectorAll('link[rel="stylesheet"][data-precedence],style[data-precedence]'),x=u.length?u[u.length-1]:null,v=x,T=0;T title"):null)}function _k(n,i,l){if(l===1||i.itemProp!=null)return!1;switch(n){case"meta":case"title":return!0;case"style":if(typeof i.precedence!="string"||typeof i.href!="string"||i.href==="")break;return!0;case"link":if(typeof i.rel!="string"||typeof i.href!="string"||i.href===""||i.onLoad||i.onError)break;switch(i.rel){case"stylesheet":return n=i.disabled,typeof i.precedence=="string"&&n==null;default:return!0}case"script":if(i.async&&typeof i.async!="function"&&typeof i.async!="symbol"&&!i.onLoad&&!i.onError&&i.src&&typeof i.src=="string")return!0}return!1}function U0(n){return!(n.type==="stylesheet"&&(n.state.loading&3)===0)}function wk(n,i,l,u){if(l.type==="stylesheet"&&(typeof u.media!="string"||matchMedia(u.media).matches!==!1)&&(l.state.loading&4)===0){if(l.instance===null){var x=Rs(u.href),v=i.querySelector(ql(x));if(v){i=v._p,i!==null&&typeof i=="object"&&typeof i.then=="function"&&(n.count++,n=Pc.bind(n),i.then(n,n)),l.state.loading|=4,l.instance=v,Ft(v);return}v=i.ownerDocument||i,u=L0(u),(x=gr.get(x))&&ih(u,x),v=v.createElement("link"),Ft(v);var T=v;T._p=new Promise(function(G,ne){T.onload=G,T.onerror=ne}),wn(v,"link",u),l.instance=v}n.stylesheets===null&&(n.stylesheets=new Map),n.stylesheets.set(l,i),(i=l.state.preload)&&(l.state.loading&3)===0&&(n.count++,l=Pc.bind(n),i.addEventListener("load",l),i.addEventListener("error",l))}}var sh=0;function Ek(n,i){return n.stylesheets&&n.count===0&&Gc(n,n.stylesheets),0sh?50:800)+i);return n.unsuspend=l,function(){n.unsuspend=null,clearTimeout(u),clearTimeout(x)}}:null}function Pc(){if(this.count--,this.count===0&&(this.imgCount===0||!this.waitingForImages)){if(this.stylesheets)Gc(this,this.stylesheets);else if(this.unsuspend){var n=this.unsuspend;this.unsuspend=null,n()}}}var Fc=null;function Gc(n,i){n.stylesheets=null,n.unsuspend!==null&&(n.count++,Fc=new Map,i.forEach(Nk,n),Fc=null,Pc.call(n))}function Nk(n,i){if(!(i.state.loading&4)){var l=Fc.get(n);if(l)var u=l.get(null);else{l=new Map,Fc.set(n,l);for(var x=n.querySelectorAll("link[data-precedence],style[data-precedence]"),v=0;v"u"||typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE!="function"))try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(e)}catch(t){console.error(t)}}return e(),ph.exports=Uk(),ph.exports}var $k=Hk();/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const L_=(...e)=>e.filter((t,r,a)=>!!t&&t.trim()!==""&&a.indexOf(t)===r).join(" ").trim();/** + */const I_=(...e)=>e.filter((t,r,a)=>!!t&&t.trim()!==""&&a.indexOf(t)===r).join(" ").trim();/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const Uk=e=>e.replace(/([a-z0-9])([A-Z])/g,"$1-$2").toLowerCase();/** + */const qk=e=>e.replace(/([a-z0-9])([A-Z])/g,"$1-$2").toLowerCase();/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const Hk=e=>e.replace(/^([A-Z])|[\s-_]+(\w)/g,(t,r,a)=>a?a.toUpperCase():r.toLowerCase());/** + */const Pk=e=>e.replace(/^([A-Z])|[\s-_]+(\w)/g,(t,r,a)=>a?a.toUpperCase():r.toLowerCase());/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const ly=e=>{const t=Hk(e);return t.charAt(0).toUpperCase()+t.slice(1)};/** + */const cy=e=>{const t=Pk(e);return t.charAt(0).toUpperCase()+t.slice(1)};/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */var $k={xmlns:"http://www.w3.org/2000/svg",width:24,height:24,viewBox:"0 0 24 24",fill:"none",stroke:"currentColor",strokeWidth:2,strokeLinecap:"round",strokeLinejoin:"round"};/** + */var Fk={xmlns:"http://www.w3.org/2000/svg",width:24,height:24,viewBox:"0 0 24 24",fill:"none",stroke:"currentColor",strokeWidth:2,strokeLinecap:"round",strokeLinejoin:"round"};/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const qk=e=>{for(const t in e)if(t.startsWith("aria-")||t==="role"||t==="title")return!0;return!1};/** + */const Gk=e=>{for(const t in e)if(t.startsWith("aria-")||t==="role"||t==="title")return!0;return!1};/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const Pk=ee.forwardRef(({color:e="currentColor",size:t=24,strokeWidth:r=2,absoluteStrokeWidth:a,className:s="",children:o,iconNode:c,...d},h)=>ee.createElement("svg",{ref:h,...$k,width:t,height:t,stroke:e,strokeWidth:a?Number(r)*24/Number(t):r,className:L_("lucide",s),...!o&&!qk(d)&&{"aria-hidden":"true"},...d},[...c.map(([f,p])=>ee.createElement(f,p)),...Array.isArray(o)?o:[o]]));/** + */const Vk=ee.forwardRef(({color:e="currentColor",size:t=24,strokeWidth:r=2,absoluteStrokeWidth:a,className:s="",children:o,iconNode:c,...d},h)=>ee.createElement("svg",{ref:h,...Fk,width:t,height:t,stroke:e,strokeWidth:a?Number(r)*24/Number(t):r,className:I_("lucide",s),...!o&&!Gk(d)&&{"aria-hidden":"true"},...d},[...c.map(([f,p])=>ee.createElement(f,p)),...Array.isArray(o)?o:[o]]));/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const Te=(e,t)=>{const r=ee.forwardRef(({className:a,...s},o)=>ee.createElement(Pk,{ref:o,iconNode:t,className:L_(`lucide-${Uk(ly(e))}`,`lucide-${e}`,a),...s}));return r.displayName=ly(e),r};/** + */const Ce=(e,t)=>{const r=ee.forwardRef(({className:a,...s},o)=>ee.createElement(Vk,{ref:o,iconNode:t,className:I_(`lucide-${qk(cy(e))}`,`lucide-${e}`,a),...s}));return r.displayName=cy(e),r};/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const Fk=[["path",{d:"m12 19-7-7 7-7",key:"1l729n"}],["path",{d:"M19 12H5",key:"x3x0zl"}]],wp=Te("arrow-left",Fk);/** + */const Yk=[["path",{d:"m12 19-7-7 7-7",key:"1l729n"}],["path",{d:"M19 12H5",key:"x3x0zl"}]],Ep=Ce("arrow-left",Yk);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const Gk=[["path",{d:"M7 7h10v10",key:"1tivn9"}],["path",{d:"M7 17 17 7",key:"1vkiza"}]],z_=Te("arrow-up-right",Gk);/** + */const Xk=[["path",{d:"M7 7h10v10",key:"1tivn9"}],["path",{d:"M7 17 17 7",key:"1vkiza"}]],B_=Ce("arrow-up-right",Xk);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const Vk=[["path",{d:"m5 12 7-7 7 7",key:"hav0vg"}],["path",{d:"M12 19V5",key:"x0mq9r"}]],Yk=Te("arrow-up",Vk);/** + */const Kk=[["path",{d:"m5 12 7-7 7 7",key:"hav0vg"}],["path",{d:"M12 19V5",key:"x0mq9r"}]],Zk=Ce("arrow-up",Kk);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const Xk=[["path",{d:"M4.929 4.929 19.07 19.071",key:"196cmz"}],["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}]],I_=Te("ban",Xk);/** + */const Qk=[["path",{d:"M4.929 4.929 19.07 19.071",key:"196cmz"}],["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}]],U_=Ce("ban",Qk);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const Kk=[["path",{d:"M10.268 21a2 2 0 0 0 3.464 0",key:"vwvbt9"}],["path",{d:"M17 17H4a1 1 0 0 1-.74-1.673C4.59 13.956 6 12.499 6 8a6 6 0 0 1 .258-1.742",key:"178tsu"}],["path",{d:"m2 2 20 20",key:"1ooewy"}],["path",{d:"M8.668 3.01A6 6 0 0 1 18 8c0 2.687.77 4.653 1.707 6.05",key:"1hqiys"}]],Zk=Te("bell-off",Kk);/** + */const Wk=[["path",{d:"M10.268 21a2 2 0 0 0 3.464 0",key:"vwvbt9"}],["path",{d:"M17 17H4a1 1 0 0 1-.74-1.673C4.59 13.956 6 12.499 6 8a6 6 0 0 1 .258-1.742",key:"178tsu"}],["path",{d:"m2 2 20 20",key:"1ooewy"}],["path",{d:"M8.668 3.01A6 6 0 0 1 18 8c0 2.687.77 4.653 1.707 6.05",key:"1hqiys"}]],Jk=Ce("bell-off",Wk);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const Qk=[["path",{d:"M12 8V4H8",key:"hb8ula"}],["rect",{width:"16",height:"12",x:"4",y:"8",rx:"2",key:"enze0r"}],["path",{d:"M2 14h2",key:"vft8re"}],["path",{d:"M20 14h2",key:"4cs60a"}],["path",{d:"M15 13v2",key:"1xurst"}],["path",{d:"M9 13v2",key:"rq6x2g"}]],Oo=Te("bot",Qk);/** + */const eC=[["path",{d:"M12 8V4H8",key:"hb8ula"}],["rect",{width:"16",height:"12",x:"4",y:"8",rx:"2",key:"enze0r"}],["path",{d:"M2 14h2",key:"vft8re"}],["path",{d:"M20 14h2",key:"4cs60a"}],["path",{d:"M15 13v2",key:"1xurst"}],["path",{d:"M9 13v2",key:"rq6x2g"}]],Ro=Ce("bot",eC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const Wk=[["path",{d:"M12 18V5",key:"adv99a"}],["path",{d:"M15 13a4.17 4.17 0 0 1-3-4 4.17 4.17 0 0 1-3 4",key:"1e3is1"}],["path",{d:"M17.598 6.5A3 3 0 1 0 12 5a3 3 0 1 0-5.598 1.5",key:"1gqd8o"}],["path",{d:"M17.997 5.125a4 4 0 0 1 2.526 5.77",key:"iwvgf7"}],["path",{d:"M18 18a4 4 0 0 0 2-7.464",key:"efp6ie"}],["path",{d:"M19.967 17.483A4 4 0 1 1 12 18a4 4 0 1 1-7.967-.517",key:"1gq6am"}],["path",{d:"M6 18a4 4 0 0 1-2-7.464",key:"k1g0md"}],["path",{d:"M6.003 5.125a4 4 0 0 0-2.526 5.77",key:"q97ue3"}]],B_=Te("brain",Wk);/** + */const tC=[["path",{d:"M12 18V5",key:"adv99a"}],["path",{d:"M15 13a4.17 4.17 0 0 1-3-4 4.17 4.17 0 0 1-3 4",key:"1e3is1"}],["path",{d:"M17.598 6.5A3 3 0 1 0 12 5a3 3 0 1 0-5.598 1.5",key:"1gqd8o"}],["path",{d:"M17.997 5.125a4 4 0 0 1 2.526 5.77",key:"iwvgf7"}],["path",{d:"M18 18a4 4 0 0 0 2-7.464",key:"efp6ie"}],["path",{d:"M19.967 17.483A4 4 0 1 1 12 18a4 4 0 1 1-7.967-.517",key:"1gq6am"}],["path",{d:"M6 18a4 4 0 0 1-2-7.464",key:"k1g0md"}],["path",{d:"M6.003 5.125a4 4 0 0 0-2.526 5.77",key:"q97ue3"}]],H_=Ce("brain",tC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const Jk=[["path",{d:"M16 14v2.2l1.6 1",key:"fo4ql5"}],["path",{d:"M16 2v4",key:"4m81vk"}],["path",{d:"M21 7.5V6a2 2 0 0 0-2-2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h3.5",key:"1osxxc"}],["path",{d:"M3 10h5",key:"r794hk"}],["path",{d:"M8 2v4",key:"1cmpym"}],["circle",{cx:"16",cy:"16",r:"6",key:"qoo3c4"}]],eC=Te("calendar-clock",Jk);/** + */const nC=[["path",{d:"M10 12h4",key:"a56b0p"}],["path",{d:"M10 8h4",key:"1sr2af"}],["path",{d:"M14 21v-3a2 2 0 0 0-4 0v3",key:"1rgiei"}],["path",{d:"M6 10H4a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-2",key:"secmi2"}],["path",{d:"M6 21V5a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v16",key:"16ra0t"}]],$_=Ce("building-2",nC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const tC=[["path",{d:"M18 6 7 17l-5-5",key:"116fxf"}],["path",{d:"m22 10-7.5 7.5L13 16",key:"ke71qq"}]],nC=Te("check-check",tC);/** + */const rC=[["path",{d:"M16 14v2.2l1.6 1",key:"fo4ql5"}],["path",{d:"M16 2v4",key:"4m81vk"}],["path",{d:"M21 7.5V6a2 2 0 0 0-2-2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h3.5",key:"1osxxc"}],["path",{d:"M3 10h5",key:"r794hk"}],["path",{d:"M8 2v4",key:"1cmpym"}],["circle",{cx:"16",cy:"16",r:"6",key:"qoo3c4"}]],iC=Ce("calendar-clock",rC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const rC=[["path",{d:"M20 6 9 17l-5-5",key:"1gmf2c"}]],Vs=Te("check",rC);/** + */const aC=[["path",{d:"M18 6 7 17l-5-5",key:"116fxf"}],["path",{d:"m22 10-7.5 7.5L13 16",key:"ke71qq"}]],sC=Ce("check-check",aC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const iC=[["path",{d:"m6 9 6 6 6-6",key:"qrunsl"}]],po=Te("chevron-down",iC);/** + */const lC=[["path",{d:"M20 6 9 17l-5-5",key:"1gmf2c"}]],Vs=Ce("check",lC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const aC=[["path",{d:"m9 18 6-6-6-6",key:"mthhwq"}]],sC=Te("chevron-right",aC);/** + */const oC=[["path",{d:"m6 9 6 6 6-6",key:"qrunsl"}]],po=Ce("chevron-down",oC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const lC=[["path",{d:"m18 15-6-6-6 6",key:"153udz"}]],U_=Te("chevron-up",lC);/** + */const cC=[["path",{d:"m9 18 6-6-6-6",key:"mthhwq"}]],uC=Ce("chevron-right",cC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const oC=[["path",{d:"m7 15 5 5 5-5",key:"1hf1tw"}],["path",{d:"m7 9 5-5 5 5",key:"sgt6xg"}]],cC=Te("chevrons-up-down",oC);/** + */const dC=[["path",{d:"m18 15-6-6-6 6",key:"153udz"}]],q_=Ce("chevron-up",dC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const uC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["line",{x1:"12",x2:"12",y1:"8",y2:"12",key:"1pkeuh"}],["line",{x1:"12",x2:"12.01",y1:"16",y2:"16",key:"4dfq90"}]],Fu=Te("circle-alert",uC);/** + */const fC=[["path",{d:"m7 15 5 5 5-5",key:"1hf1tw"}],["path",{d:"m7 9 5-5 5 5",key:"sgt6xg"}]],hC=Ce("chevrons-up-down",fC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const dC=[["path",{d:"M21.801 10A10 10 0 1 1 17 3.335",key:"yps3ct"}],["path",{d:"m9 11 3 3L22 4",key:"1pflzl"}]],H_=Te("circle-check-big",dC);/** + */const mC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["line",{x1:"12",x2:"12",y1:"8",y2:"12",key:"1pkeuh"}],["line",{x1:"12",x2:"12.01",y1:"16",y2:"16",key:"4dfq90"}]],Gu=Ce("circle-alert",mC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const fC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["path",{d:"m9 12 2 2 4-4",key:"dzmm74"}]],Eu=Te("circle-check",fC);/** + */const pC=[["path",{d:"M21.801 10A10 10 0 1 1 17 3.335",key:"yps3ct"}],["path",{d:"m9 11 3 3L22 4",key:"1pflzl"}]],P_=Ce("circle-check-big",pC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const hC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["circle",{cx:"12",cy:"12",r:"1",key:"41hilf"}]],mC=Te("circle-dot",hC);/** + */const gC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["path",{d:"m9 12 2 2 4-4",key:"dzmm74"}]],Nu=Ce("circle-check",gC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const pC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["path",{d:"M9.09 9a3 3 0 0 1 5.83 1c0 2-3 3-3 3",key:"1u773s"}],["path",{d:"M12 17h.01",key:"p32p05"}]],gC=Te("circle-question-mark",pC);/** + */const xC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["circle",{cx:"12",cy:"12",r:"1",key:"41hilf"}]],bC=Ce("circle-dot",xC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const xC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["line",{x1:"9",x2:"15",y1:"15",y2:"9",key:"1dfufj"}]],bC=Te("circle-slash",xC);/** + */const yC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["path",{d:"M9.09 9a3 3 0 0 1 5.83 1c0 2-3 3-3 3",key:"1u773s"}],["path",{d:"M12 17h.01",key:"p32p05"}]],vC=Ce("circle-question-mark",yC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const yC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}]],$_=Te("circle",yC);/** + */const _C=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["line",{x1:"9",x2:"15",y1:"15",y2:"9",key:"1dfufj"}]],wC=Ce("circle-slash",_C);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const vC=[["rect",{width:"8",height:"4",x:"8",y:"2",rx:"1",ry:"1",key:"tgr4d6"}],["path",{d:"M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2",key:"116196"}],["path",{d:"M12 11h4",key:"1jrz19"}],["path",{d:"M12 16h4",key:"n85exb"}],["path",{d:"M8 11h.01",key:"1dfujw"}],["path",{d:"M8 16h.01",key:"18s6g9"}]],q_=Te("clipboard-list",vC);/** + */const EC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}]],F_=Ce("circle",EC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const _C=[["path",{d:"M12 6v6l4 2",key:"mmk7yg"}],["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}]],P_=Te("clock",_C);/** + */const NC=[["rect",{width:"8",height:"4",x:"8",y:"2",rx:"1",ry:"1",key:"tgr4d6"}],["path",{d:"M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2",key:"116196"}],["path",{d:"M12 11h4",key:"1jrz19"}],["path",{d:"M12 16h4",key:"n85exb"}],["path",{d:"M8 11h.01",key:"1dfujw"}],["path",{d:"M8 16h.01",key:"18s6g9"}]],G_=Ce("clipboard-list",NC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const wC=[["path",{d:"m16 18 6-6-6-6",key:"eg8j8"}],["path",{d:"m8 6-6 6 6 6",key:"ppft3o"}]],EC=Te("code",wC);/** + */const SC=[["path",{d:"M12 6v6l4 2",key:"mmk7yg"}],["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}]],V_=Ce("clock",SC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const NC=[["rect",{width:"14",height:"14",x:"8",y:"8",rx:"2",ry:"2",key:"17jyea"}],["path",{d:"M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2",key:"zix9uf"}]],go=Te("copy",NC);/** + */const kC=[["path",{d:"m16 18 6-6-6-6",key:"eg8j8"}],["path",{d:"m8 6-6 6 6 6",key:"ppft3o"}]],CC=Ce("code",kC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const SC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["line",{x1:"22",x2:"18",y1:"12",y2:"12",key:"l9bcsi"}],["line",{x1:"6",x2:"2",y1:"12",y2:"12",key:"13hhkx"}],["line",{x1:"12",x2:"12",y1:"6",y2:"2",key:"10w3f3"}],["line",{x1:"12",x2:"12",y1:"22",y2:"18",key:"15g9kq"}]],Gu=Te("crosshair",SC);/** + */const TC=[["rect",{width:"14",height:"14",x:"8",y:"8",rx:"2",ry:"2",key:"17jyea"}],["path",{d:"M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2",key:"zix9uf"}]],go=Ce("copy",TC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const kC=[["path",{d:"M15 3h6v6",key:"1q9fwt"}],["path",{d:"M10 14 21 3",key:"gplh6r"}],["path",{d:"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6",key:"a6xqqp"}]],oy=Te("external-link",kC);/** + */const AC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["line",{x1:"22",x2:"18",y1:"12",y2:"12",key:"l9bcsi"}],["line",{x1:"6",x2:"2",y1:"12",y2:"12",key:"13hhkx"}],["line",{x1:"12",x2:"12",y1:"6",y2:"2",key:"10w3f3"}],["line",{x1:"12",x2:"12",y1:"22",y2:"18",key:"15g9kq"}]],Vu=Ce("crosshair",AC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const CC=[["path",{d:"M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0",key:"1nclc0"}],["circle",{cx:"12",cy:"12",r:"3",key:"1v7zrd"}]],TC=Te("eye",CC);/** + */const MC=[["path",{d:"M15 3h6v6",key:"1q9fwt"}],["path",{d:"M10 14 21 3",key:"gplh6r"}],["path",{d:"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6",key:"a6xqqp"}]],uy=Ce("external-link",MC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const AC=[["path",{d:"M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z",key:"1oefj6"}],["path",{d:"M14 2v5a1 1 0 0 0 1 1h5",key:"wfsgrz"}],["path",{d:"M10 9H8",key:"b1mrlr"}],["path",{d:"M16 13H8",key:"t4e002"}],["path",{d:"M16 17H8",key:"z1uh3a"}]],MC=Te("file-text",AC);/** + */const OC=[["path",{d:"M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0",key:"1nclc0"}],["circle",{cx:"12",cy:"12",r:"3",key:"1v7zrd"}]],RC=Ce("eye",OC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const OC=[["path",{d:"M4 22V4a1 1 0 0 1 .4-.8A6 6 0 0 1 8 2c3 0 5 2 7.333 2q2 0 3.067-.8A1 1 0 0 1 20 4v10a1 1 0 0 1-.4.8A6 6 0 0 1 16 16c-3 0-5-2-8-2a6 6 0 0 0-4 1.528",key:"1jaruq"}]],F_=Te("flag",OC);/** + */const jC=[["path",{d:"M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z",key:"1oefj6"}],["path",{d:"M14 2v5a1 1 0 0 0 1 1h5",key:"wfsgrz"}],["path",{d:"M10 9H8",key:"b1mrlr"}],["path",{d:"M16 13H8",key:"t4e002"}],["path",{d:"M16 17H8",key:"z1uh3a"}]],DC=Ce("file-text",jC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const RC=[["circle",{cx:"18",cy:"18",r:"3",key:"1xkwt0"}],["circle",{cx:"6",cy:"6",r:"3",key:"1lh9wr"}],["path",{d:"M6 21V9a9 9 0 0 0 9 9",key:"7kw0sc"}]],jC=Te("git-merge",RC);/** + */const LC=[["path",{d:"M4 22V4a1 1 0 0 1 .4-.8A6 6 0 0 1 8 2c3 0 5 2 7.333 2q2 0 3.067-.8A1 1 0 0 1 20 4v10a1 1 0 0 1-.4.8A6 6 0 0 1 16 16c-3 0-5-2-8-2a6 6 0 0 0-4 1.528",key:"1jaruq"}]],Y_=Ce("flag",LC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const DC=[["circle",{cx:"18",cy:"18",r:"3",key:"1xkwt0"}],["circle",{cx:"6",cy:"6",r:"3",key:"1lh9wr"}],["path",{d:"M13 6h3a2 2 0 0 1 2 2v7",key:"1yeb86"}],["line",{x1:"6",x2:"6",y1:"9",y2:"21",key:"rroup"}]],LC=Te("git-pull-request",DC);/** + */const zC=[["circle",{cx:"18",cy:"18",r:"3",key:"1xkwt0"}],["circle",{cx:"6",cy:"6",r:"3",key:"1lh9wr"}],["path",{d:"M6 21V9a9 9 0 0 0 9 9",key:"7kw0sc"}]],IC=Ce("git-merge",zC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const zC=[["path",{d:"M15 22v-4a4.8 4.8 0 0 0-1-3.5c3 0 6-2 6-5.5.08-1.25-.27-2.48-1-3.5.28-1.15.28-2.35 0-3.5 0 0-1 0-3 1.5-2.64-.5-5.36-.5-8 0C6 2 5 2 5 2c-.3 1.15-.3 2.35 0 3.5A5.403 5.403 0 0 0 4 9c0 3.5 3 5.5 6 5.5-.39.49-.68 1.05-.85 1.65-.17.6-.22 1.23-.15 1.85v4",key:"tonef"}],["path",{d:"M9 18c-4.51 2-5-2-7-2",key:"9comsn"}]],IC=Te("github",zC);/** + */const BC=[["circle",{cx:"18",cy:"18",r:"3",key:"1xkwt0"}],["circle",{cx:"6",cy:"6",r:"3",key:"1lh9wr"}],["path",{d:"M13 6h3a2 2 0 0 1 2 2v7",key:"1yeb86"}],["line",{x1:"6",x2:"6",y1:"9",y2:"21",key:"rroup"}]],UC=Ce("git-pull-request",BC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const BC=[["path",{d:"m22 13.29-3.33-10a.42.42 0 0 0-.14-.18.38.38 0 0 0-.22-.11.39.39 0 0 0-.23.07.42.42 0 0 0-.14.18l-2.26 6.67H8.32L6.1 3.26a.42.42 0 0 0-.1-.18.38.38 0 0 0-.26-.08.39.39 0 0 0-.23.07.42.42 0 0 0-.14.18L2 13.29a.74.74 0 0 0 .27.83L12 21l9.69-6.88a.71.71 0 0 0 .31-.83Z",key:"148pdi"}]],UC=Te("gitlab",BC);/** + */const HC=[["path",{d:"M15 22v-4a4.8 4.8 0 0 0-1-3.5c3 0 6-2 6-5.5.08-1.25-.27-2.48-1-3.5.28-1.15.28-2.35 0-3.5 0 0-1 0-3 1.5-2.64-.5-5.36-.5-8 0C6 2 5 2 5 2c-.3 1.15-.3 2.35 0 3.5A5.403 5.403 0 0 0 4 9c0 3.5 3 5.5 6 5.5-.39.49-.68 1.05-.85 1.65-.17.6-.22 1.23-.15 1.85v4",key:"tonef"}],["path",{d:"M9 18c-4.51 2-5-2-7-2",key:"9comsn"}]],$C=Ce("github",HC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const HC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["path",{d:"M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20",key:"13o1zl"}],["path",{d:"M2 12h20",key:"9i4pu4"}]],G_=Te("globe",HC);/** + */const qC=[["path",{d:"m22 13.29-3.33-10a.42.42 0 0 0-.14-.18.38.38 0 0 0-.22-.11.39.39 0 0 0-.23.07.42.42 0 0 0-.14.18l-2.26 6.67H8.32L6.1 3.26a.42.42 0 0 0-.1-.18.38.38 0 0 0-.26-.08.39.39 0 0 0-.23.07.42.42 0 0 0-.14.18L2 13.29a.74.74 0 0 0 .27.83L12 21l9.69-6.88a.71.71 0 0 0 .31-.83Z",key:"148pdi"}]],PC=Ce("gitlab",qC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const $C=[["path",{d:"M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8",key:"1357e3"}],["path",{d:"M3 3v5h5",key:"1xhq8a"}],["path",{d:"M12 7v5l4 2",key:"1fdv2h"}]],Ys=Te("history",$C);/** + */const FC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["path",{d:"M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20",key:"13o1zl"}],["path",{d:"M2 12h20",key:"9i4pu4"}]],X_=Ce("globe",FC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const qC=[["rect",{width:"18",height:"18",x:"3",y:"3",rx:"2",ry:"2",key:"1m3agn"}],["circle",{cx:"9",cy:"9",r:"2",key:"af1f0g"}],["path",{d:"m21 15-3.086-3.086a2 2 0 0 0-2.828 0L6 21",key:"1xmnt7"}]],PC=Te("image",qC);/** + */const GC=[["path",{d:"M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8",key:"1357e3"}],["path",{d:"M3 3v5h5",key:"1xhq8a"}],["path",{d:"M12 7v5l4 2",key:"1fdv2h"}]],Ys=Ce("history",GC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const FC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["path",{d:"M12 16v-4",key:"1dtifu"}],["path",{d:"M12 8h.01",key:"e9boi3"}]],GC=Te("info",FC);/** + */const VC=[["rect",{width:"18",height:"18",x:"3",y:"3",rx:"2",ry:"2",key:"1m3agn"}],["circle",{cx:"9",cy:"9",r:"2",key:"af1f0g"}],["path",{d:"m21 15-3.086-3.086a2 2 0 0 0-2.828 0L6 21",key:"1xmnt7"}]],YC=Ce("image",VC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const VC=[["path",{d:"M13 5h8",key:"a7qcls"}],["path",{d:"M13 12h8",key:"h98zly"}],["path",{d:"M13 19h8",key:"c3s6r1"}],["path",{d:"m3 17 2 2 4-4",key:"1jhpwq"}],["rect",{x:"3",y:"4",width:"6",height:"6",rx:"1",key:"cif1o7"}]],YC=Te("list-todo",VC);/** + */const XC=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["path",{d:"M12 16v-4",key:"1dtifu"}],["path",{d:"M12 8h.01",key:"e9boi3"}]],KC=Ce("info",XC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const XC=[["path",{d:"M21 12a9 9 0 1 1-6.219-8.56",key:"13zald"}]],Ps=Te("loader-circle",XC);/** + */const ZC=[["path",{d:"M13 5h8",key:"a7qcls"}],["path",{d:"M13 12h8",key:"h98zly"}],["path",{d:"M13 19h8",key:"c3s6r1"}],["path",{d:"m3 17 2 2 4-4",key:"1jhpwq"}],["rect",{x:"3",y:"4",width:"6",height:"6",rx:"1",key:"cif1o7"}]],QC=Ce("list-todo",ZC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const KC=[["rect",{width:"18",height:"11",x:"3",y:"11",rx:"2",ry:"2",key:"1w4ew1"}],["path",{d:"M7 11V7a5 5 0 0 1 10 0v4",key:"fwvmzm"}]],ZC=Te("lock",KC);/** + */const WC=[["path",{d:"M21 12a9 9 0 1 1-6.219-8.56",key:"13zald"}]],Ps=Ce("loader-circle",WC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const QC=[["path",{d:"m16 17 5-5-5-5",key:"1bji2h"}],["path",{d:"M21 12H9",key:"dn1m92"}],["path",{d:"M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4",key:"1uf3rs"}]],WC=Te("log-out",QC);/** + */const JC=[["rect",{width:"18",height:"11",x:"3",y:"11",rx:"2",ry:"2",key:"1w4ew1"}],["path",{d:"M7 11V7a5 5 0 0 1 10 0v4",key:"fwvmzm"}]],eT=Ce("lock",JC);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const JC=[["path",{d:"m22 7-8.991 5.727a2 2 0 0 1-2.009 0L2 7",key:"132q7q"}],["rect",{x:"2",y:"4",width:"20",height:"16",rx:"2",key:"izxlao"}]],Ep=Te("mail",JC);/** + */const tT=[["path",{d:"m16 17 5-5-5-5",key:"1bji2h"}],["path",{d:"M21 12H9",key:"dn1m92"}],["path",{d:"M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4",key:"1uf3rs"}]],nT=Ce("log-out",tT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const eT=[["path",{d:"M2.992 16.342a2 2 0 0 1 .094 1.167l-1.065 3.29a1 1 0 0 0 1.236 1.168l3.413-.998a2 2 0 0 1 1.099.092 10 10 0 1 0-4.777-4.719",key:"1sd12s"}]],bh=Te("message-circle",eT);/** + */const rT=[["path",{d:"m22 7-8.991 5.727a2 2 0 0 1-2.009 0L2 7",key:"132q7q"}],["rect",{x:"2",y:"4",width:"20",height:"16",rx:"2",key:"izxlao"}]],Np=Ce("mail",rT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const tT=[["path",{d:"M21.174 6.812a1 1 0 0 0-3.986-3.987L3.842 16.174a2 2 0 0 0-.5.83l-1.321 4.352a.5.5 0 0 0 .623.622l4.353-1.32a2 2 0 0 0 .83-.497z",key:"1a8usu"}],["path",{d:"m15 5 4 4",key:"1mk7zo"}]],nT=Te("pencil",tT);/** + */const iT=[["path",{d:"M2.992 16.342a2 2 0 0 1 .094 1.167l-1.065 3.29a1 1 0 0 0 1.236 1.168l3.413-.998a2 2 0 0 1 1.099.092 10 10 0 1 0-4.777-4.719",key:"1sd12s"}]],yh=Ce("message-circle",iT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const rT=[["path",{d:"M12 22v-5",key:"1ega77"}],["path",{d:"M15 8V2",key:"18g5xt"}],["path",{d:"M17 8a1 1 0 0 1 1 1v4a4 4 0 0 1-4 4h-4a4 4 0 0 1-4-4V9a1 1 0 0 1 1-1z",key:"1xoxul"}],["path",{d:"M9 8V2",key:"14iosj"}]],V_=Te("plug",rT);/** + */const aT=[["path",{d:"M21.174 6.812a1 1 0 0 0-3.986-3.987L3.842 16.174a2 2 0 0 0-.5.83l-1.321 4.352a.5.5 0 0 0 .623.622l4.353-1.32a2 2 0 0 0 .83-.497z",key:"1a8usu"}],["path",{d:"m15 5 4 4",key:"1mk7zo"}]],sT=Ce("pencil",aT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const iT=[["path",{d:"M5 12h14",key:"1ays0h"}],["path",{d:"M12 5v14",key:"s699le"}]],Y_=Te("plus",iT);/** + */const lT=[["path",{d:"M12 22v-5",key:"1ega77"}],["path",{d:"M15 8V2",key:"18g5xt"}],["path",{d:"M17 8a1 1 0 0 1 1 1v4a4 4 0 0 1-4 4h-4a4 4 0 0 1-4-4V9a1 1 0 0 1 1-1z",key:"1xoxul"}],["path",{d:"M9 8V2",key:"14iosj"}]],K_=Ce("plug",lT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const aT=[["path",{d:"M19.07 4.93A10 10 0 0 0 6.99 3.34",key:"z3du51"}],["path",{d:"M4 6h.01",key:"oypzma"}],["path",{d:"M2.29 9.62A10 10 0 1 0 21.31 8.35",key:"qzzz0"}],["path",{d:"M16.24 7.76A6 6 0 1 0 8.23 16.67",key:"1yjesh"}],["path",{d:"M12 18h.01",key:"mhygvu"}],["path",{d:"M17.99 11.66A6 6 0 0 1 15.77 16.67",key:"1u2y91"}],["circle",{cx:"12",cy:"12",r:"2",key:"1c9p78"}],["path",{d:"m13.41 10.59 5.66-5.66",key:"mhq4k0"}]],sT=Te("radar",aT);/** + */const oT=[["path",{d:"M5 12h14",key:"1ays0h"}],["path",{d:"M12 5v14",key:"s699le"}]],Z_=Ce("plus",oT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const lT=[["path",{d:"M3 12a9 9 0 0 1 9-9 9.75 9.75 0 0 1 6.74 2.74L21 8",key:"v9h5vc"}],["path",{d:"M21 3v5h-5",key:"1q7to0"}],["path",{d:"M21 12a9 9 0 0 1-9 9 9.75 9.75 0 0 1-6.74-2.74L3 16",key:"3uifl3"}],["path",{d:"M8 16H3v5",key:"1cv678"}]],oT=Te("refresh-cw",lT);/** + */const cT=[["path",{d:"M19.07 4.93A10 10 0 0 0 6.99 3.34",key:"z3du51"}],["path",{d:"M4 6h.01",key:"oypzma"}],["path",{d:"M2.29 9.62A10 10 0 1 0 21.31 8.35",key:"qzzz0"}],["path",{d:"M16.24 7.76A6 6 0 1 0 8.23 16.67",key:"1yjesh"}],["path",{d:"M12 18h.01",key:"mhygvu"}],["path",{d:"M17.99 11.66A6 6 0 0 1 15.77 16.67",key:"1u2y91"}],["circle",{cx:"12",cy:"12",r:"2",key:"1c9p78"}],["path",{d:"m13.41 10.59 5.66-5.66",key:"mhq4k0"}]],uT=Ce("radar",cT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const cT=[["path",{d:"M4.5 16.5c-1.5 1.26-2 5-2 5s3.74-.5 5-2c.71-.84.7-2.13-.09-2.91a2.18 2.18 0 0 0-2.91-.09z",key:"m3kijz"}],["path",{d:"m12 15-3-3a22 22 0 0 1 2-3.95A12.88 12.88 0 0 1 22 2c0 2.72-.78 7.5-6 11a22.35 22.35 0 0 1-4 2z",key:"1fmvmk"}],["path",{d:"M9 12H4s.55-3.03 2-4c1.62-1.08 5 0 5 0",key:"1f8sc4"}],["path",{d:"M12 15v5s3.03-.55 4-2c1.08-1.62 0-5 0-5",key:"qeys4"}]],uT=Te("rocket",cT);/** + */const dT=[["path",{d:"M3 12a9 9 0 0 1 9-9 9.75 9.75 0 0 1 6.74 2.74L21 8",key:"v9h5vc"}],["path",{d:"M21 3v5h-5",key:"1q7to0"}],["path",{d:"M21 12a9 9 0 0 1-9 9 9.75 9.75 0 0 1-6.74-2.74L3 16",key:"3uifl3"}],["path",{d:"M8 16H3v5",key:"1cv678"}]],fT=Ce("refresh-cw",dT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const dT=[["path",{d:"M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8",key:"1357e3"}],["path",{d:"M3 3v5h5",key:"1xhq8a"}]],fT=Te("rotate-ccw",dT);/** + */const hT=[["path",{d:"M4.5 16.5c-1.5 1.26-2 5-2 5s3.74-.5 5-2c.71-.84.7-2.13-.09-2.91a2.18 2.18 0 0 0-2.91-.09z",key:"m3kijz"}],["path",{d:"m12 15-3-3a22 22 0 0 1 2-3.95A12.88 12.88 0 0 1 22 2c0 2.72-.78 7.5-6 11a22.35 22.35 0 0 1-4 2z",key:"1fmvmk"}],["path",{d:"M9 12H4s.55-3.03 2-4c1.62-1.08 5 0 5 0",key:"1f8sc4"}],["path",{d:"M12 15v5s3.03-.55 4-2c1.08-1.62 0-5 0-5",key:"qeys4"}]],Q_=Ce("rocket",hT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const hT=[["path",{d:"M15.2 3a2 2 0 0 1 1.4.6l3.8 3.8a2 2 0 0 1 .6 1.4V19a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2z",key:"1c8476"}],["path",{d:"M17 21v-7a1 1 0 0 0-1-1H8a1 1 0 0 0-1 1v7",key:"1ydtos"}],["path",{d:"M7 3v4a1 1 0 0 0 1 1h7",key:"t51u73"}]],mT=Te("save",hT);/** + */const mT=[["path",{d:"M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8",key:"1357e3"}],["path",{d:"M3 3v5h5",key:"1xhq8a"}]],pT=Ce("rotate-ccw",mT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const pT=[["path",{d:"m21 21-4.34-4.34",key:"14j7rj"}],["circle",{cx:"11",cy:"11",r:"8",key:"4ej97u"}]],gT=Te("search",pT);/** + */const gT=[["path",{d:"M15.2 3a2 2 0 0 1 1.4.6l3.8 3.8a2 2 0 0 1 .6 1.4V19a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2z",key:"1c8476"}],["path",{d:"M17 21v-7a1 1 0 0 0-1-1H8a1 1 0 0 0-1 1v7",key:"1ydtos"}],["path",{d:"M7 3v4a1 1 0 0 0 1 1h7",key:"t51u73"}]],xT=Ce("save",gT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const xT=[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"M12 8v4",key:"1got3b"}],["path",{d:"M12 16h.01",key:"1drbdi"}]],bT=Te("shield-alert",xT);/** + */const bT=[["path",{d:"m21 21-4.34-4.34",key:"14j7rj"}],["circle",{cx:"11",cy:"11",r:"8",key:"4ej97u"}]],yT=Ce("search",bT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const yT=[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"m9 12 2 2 4-4",key:"dzmm74"}]],X_=Te("shield-check",yT);/** + */const vT=[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"M12 8v4",key:"1got3b"}],["path",{d:"M12 16h.01",key:"1drbdi"}]],_T=Ce("shield-alert",vT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const vT=[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}]],_T=Te("shield",vT);/** + */const wT=[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"m9 12 2 2 4-4",key:"dzmm74"}]],W_=Ce("shield-check",wT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const wT=[["path",{d:"M11.017 2.814a1 1 0 0 1 1.966 0l1.051 5.558a2 2 0 0 0 1.594 1.594l5.558 1.051a1 1 0 0 1 0 1.966l-5.558 1.051a2 2 0 0 0-1.594 1.594l-1.051 5.558a1 1 0 0 1-1.966 0l-1.051-5.558a2 2 0 0 0-1.594-1.594l-5.558-1.051a1 1 0 0 1 0-1.966l5.558-1.051a2 2 0 0 0 1.594-1.594z",key:"1s2grr"}],["path",{d:"M20 2v4",key:"1rf3ol"}],["path",{d:"M22 4h-4",key:"gwowj6"}],["circle",{cx:"4",cy:"20",r:"2",key:"6kqj1y"}]],Pm=Te("sparkles",wT);/** + */const ET=[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}]],NT=Ce("shield",ET);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const ET=[["path",{d:"M21 9a2.4 2.4 0 0 0-.706-1.706l-3.588-3.588A2.4 2.4 0 0 0 15 3H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2z",key:"1dfntj"}],["path",{d:"M15 3v5a1 1 0 0 0 1 1h5",key:"6s6qgf"}]],NT=Te("sticky-note",ET);/** + */const ST=[["path",{d:"M11.017 2.814a1 1 0 0 1 1.966 0l1.051 5.558a2 2 0 0 0 1.594 1.594l5.558 1.051a1 1 0 0 1 0 1.966l-5.558 1.051a2 2 0 0 0-1.594 1.594l-1.051 5.558a1 1 0 0 1-1.966 0l-1.051-5.558a2 2 0 0 0-1.594-1.594l-5.558-1.051a1 1 0 0 1 0-1.966l5.558-1.051a2 2 0 0 0 1.594-1.594z",key:"1s2grr"}],["path",{d:"M20 2v4",key:"1rf3ol"}],["path",{d:"M22 4h-4",key:"gwowj6"}],["circle",{cx:"4",cy:"20",r:"2",key:"6kqj1y"}]],Fm=Ce("sparkles",ST);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const ST=[["path",{d:"M12 19h8",key:"baeox8"}],["path",{d:"m4 17 6-6-6-6",key:"1yngyt"}]],K_=Te("terminal",ST);/** + */const kT=[["path",{d:"M21 9a2.4 2.4 0 0 0-.706-1.706l-3.588-3.588A2.4 2.4 0 0 0 15 3H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2z",key:"1dfntj"}],["path",{d:"M15 3v5a1 1 0 0 0 1 1h5",key:"6s6qgf"}]],CT=Ce("sticky-note",kT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const kT=[["path",{d:"M10 11v6",key:"nco0om"}],["path",{d:"M14 11v6",key:"outv1u"}],["path",{d:"M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6",key:"miytrc"}],["path",{d:"M3 6h18",key:"d0wm0j"}],["path",{d:"M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2",key:"e791ji"}]],CT=Te("trash-2",kT);/** + */const TT=[["path",{d:"M12 19h8",key:"baeox8"}],["path",{d:"m4 17 6-6-6-6",key:"1yngyt"}]],J_=Ce("terminal",TT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const TT=[["path",{d:"m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3",key:"wmoenq"}],["path",{d:"M12 9v4",key:"juzpu7"}],["path",{d:"M12 17h.01",key:"p32p05"}]],Np=Te("triangle-alert",TT);/** + */const AT=[["path",{d:"M10 11v6",key:"nco0om"}],["path",{d:"M14 11v6",key:"outv1u"}],["path",{d:"M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6",key:"miytrc"}],["path",{d:"M3 6h18",key:"d0wm0j"}],["path",{d:"M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2",key:"e791ji"}]],MT=Ce("trash-2",AT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const AT=[["path",{d:"M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2",key:"1yyitq"}],["path",{d:"M16 3.128a4 4 0 0 1 0 7.744",key:"16gr8j"}],["path",{d:"M22 21v-2a4 4 0 0 0-3-3.87",key:"kshegd"}],["circle",{cx:"9",cy:"7",r:"4",key:"nufk8"}]],MT=Te("users",AT);/** + */const OT=[["path",{d:"m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3",key:"wmoenq"}],["path",{d:"M12 9v4",key:"juzpu7"}],["path",{d:"M12 17h.01",key:"p32p05"}]],Sp=Ce("triangle-alert",OT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const OT=[["path",{d:"m21.64 3.64-1.28-1.28a1.21 1.21 0 0 0-1.72 0L2.36 18.64a1.21 1.21 0 0 0 0 1.72l1.28 1.28a1.2 1.2 0 0 0 1.72 0L21.64 5.36a1.2 1.2 0 0 0 0-1.72",key:"ul74o6"}],["path",{d:"m14 7 3 3",key:"1r5n42"}],["path",{d:"M5 6v4",key:"ilb8ba"}],["path",{d:"M19 14v4",key:"blhpug"}],["path",{d:"M10 2v2",key:"7u0qdc"}],["path",{d:"M7 8H3",key:"zfb6yr"}],["path",{d:"M21 16h-4",key:"1cnmox"}],["path",{d:"M11 3H9",key:"1obp7u"}]],RT=Te("wand-sparkles",OT);/** + */const RT=[["path",{d:"M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2",key:"1yyitq"}],["path",{d:"M16 3.128a4 4 0 0 1 0 7.744",key:"16gr8j"}],["path",{d:"M22 21v-2a4 4 0 0 0-3-3.87",key:"kshegd"}],["circle",{cx:"9",cy:"7",r:"4",key:"nufk8"}]],jT=Ce("users",RT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const jT=[["path",{d:"M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.106-3.105c.32-.322.863-.22.983.218a6 6 0 0 1-8.259 7.057l-7.91 7.91a1 1 0 0 1-2.999-3l7.91-7.91a6 6 0 0 1 7.057-8.259c.438.12.54.662.219.984z",key:"1ngwbx"}]],Fm=Te("wrench",jT);/** + */const DT=[["path",{d:"m21.64 3.64-1.28-1.28a1.21 1.21 0 0 0-1.72 0L2.36 18.64a1.21 1.21 0 0 0 0 1.72l1.28 1.28a1.2 1.2 0 0 0 1.72 0L21.64 5.36a1.2 1.2 0 0 0 0-1.72",key:"ul74o6"}],["path",{d:"m14 7 3 3",key:"1r5n42"}],["path",{d:"M5 6v4",key:"ilb8ba"}],["path",{d:"M19 14v4",key:"blhpug"}],["path",{d:"M10 2v2",key:"7u0qdc"}],["path",{d:"M7 8H3",key:"zfb6yr"}],["path",{d:"M21 16h-4",key:"1cnmox"}],["path",{d:"M11 3H9",key:"1obp7u"}]],LT=Ce("wand-sparkles",DT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const DT=[["path",{d:"M18 6 6 18",key:"1bl5f8"}],["path",{d:"m6 6 12 12",key:"d8bk6v"}]],Sp=Te("x",DT);/** + */const zT=[["path",{d:"M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.106-3.105c.32-.322.863-.22.983.218a6 6 0 0 1-8.259 7.057l-7.91 7.91a1 1 0 0 1-2.999-3l7.91-7.91a6 6 0 0 1 7.057-8.259c.438.12.54.662.219.984z",key:"1ngwbx"}]],Gm=Ce("wrench",zT);/** * @license lucide-react v0.563.0 - ISC * * This source code is licensed under the ISC license. * See the LICENSE file in the root directory of this source tree. - */const LT=[["path",{d:"M4 14a1 1 0 0 1-.78-1.63l9.9-10.2a.5.5 0 0 1 .86.46l-1.92 6.02A1 1 0 0 0 13 10h7a1 1 0 0 1 .78 1.63l-9.9 10.2a.5.5 0 0 1-.86-.46l1.92-6.02A1 1 0 0 0 11 14z",key:"1xq2db"}]],zT=Te("zap",LT),IT={open:{label:"Open",color:"bg-red-500/10 text-red-400 border-red-500/20",dotColor:"bg-red-500",description:"Newly discovered, awaiting triage"},in_progress:{label:"In Progress",color:"bg-blue-500/10 text-blue-400 border-blue-500/20",dotColor:"bg-blue-500",description:"Someone is working on this"},snoozed:{label:"Snoozed",color:"bg-purple-500/10 text-purple-400 border-purple-500/20",dotColor:"bg-purple-500",description:"Temporarily hidden until a follow-up date"},fixed:{label:"Fixed",color:"bg-emerald-500/10 text-emerald-400 border-emerald-500/20",dotColor:"bg-emerald-500",description:"This vulnerability has been fixed"},ignored:{label:"Ignored",color:"bg-gray-500/10 text-gray-400 border-gray-500/20",dotColor:"bg-gray-500",description:"Acknowledged but accepted"}},BT={trivial:{label:"Trivial",color:"bg-emerald-500/10 text-emerald-400 border-emerald-500/20"},low:{label:"Low",color:"bg-blue-500/10 text-blue-400 border-blue-500/20"},medium:{label:"Medium",color:"bg-yellow-500/10 text-yellow-400 border-yellow-500/20"},high:{label:"High",color:"bg-orange-500/10 text-orange-400 border-orange-500/20"}},Z_={critical:"bg-red-500/20 text-red-500 border-red-500/30",high:"bg-orange-500/20 text-orange-500 border-orange-500/30",medium:"bg-yellow-500/20 text-yellow-500 border-yellow-500/30",low:"bg-blue-500/20 text-blue-500 border-blue-500/30"};function Wc(e){return e.original_severity!=null&&e.original_severity!==e.severity}const UT={js:"javascript",ts:"typescript",tsx:"typescript",jsx:"javascript",py:"python",rb:"ruby",go:"go",rs:"rust",java:"java",php:"php",cs:"csharp",cpp:"cpp",c:"c",sh:"bash",bash:"bash",sql:"sql",html:"html",css:"css",json:"json",yaml:"yaml",yml:"yaml",xml:"xml"};function HT(e){var r;if(!e)return null;const t=(r=e.split(".").pop())==null?void 0:r.toLowerCase();return t&&UT[t]||null}function kp(e){switch(e){case"critical":return"bg-red-500";case"high":return"bg-orange-500";case"medium":return"bg-yellow-500";default:return"bg-blue-500"}}async function Cp(e){try{await navigator.clipboard.writeText(e)}catch{const t=document.createElement("textarea");t.value=e,t.style.position="absolute",t.style.left="-9999px",document.body.appendChild(t),t.select(),document.execCommand("copy"),document.body.removeChild(t)}}const Vu="https://app.strix.ai/api/auth/signup",$T="https://strix.ai/pricing",qT="ref=oss_viewer&utm_source=oss_viewer&utm_medium=local_viewer&utm_campaign=oss_viewer";function ha(e,t){const r=e.includes("?")?"&":"?";return`${e}${r}${qT}&utm_content=${encodeURIComponent(t)}`}function Ar(e,t={}){try{const r={event:e};for(const[s,o]of Object.entries(t))o!==void 0&&(r[s]=o);const a=JSON.stringify(r);typeof navigator<"u"&&navigator.sendBeacon?navigator.sendBeacon("/api/event",a):fetch("/api/event",{method:"POST",body:a,keepalive:!0})}catch{}}function jr(e,t){Ar("cta_clicked",{cta:e,surface:t})}function Q_(e){var t,r,a="";if(typeof e=="string"||typeof e=="number")a+=e;else if(typeof e=="object")if(Array.isArray(e)){var s=e.length;for(t=0;t{const r=new Array(e.length+t.length);for(let a=0;a({classGroupId:e,validator:t}),W_=(e=new Map,t=null,r)=>({nextPart:e,validators:t,classGroupId:r}),Nu="-",cy=[],VT="arbitrary..",YT=e=>{const t=KT(e),{conflictingClassGroups:r,conflictingClassGroupModifiers:a}=e;return{getClassGroupId:c=>{if(c.startsWith("[")&&c.endsWith("]"))return XT(c);const d=c.split(Nu),h=d[0]===""&&d.length>1?1:0;return J_(d,h,t)},getConflictingClassGroupIds:(c,d)=>{if(d){const h=a[c],f=r[c];return h?f?FT(f,h):h:f||cy}return r[c]||cy}}},J_=(e,t,r)=>{if(e.length-t===0)return r.classGroupId;const s=e[t],o=r.nextPart.get(s);if(o){const f=J_(e,t+1,o);if(f)return f}const c=r.validators;if(c===null)return;const d=t===0?e.join(Nu):e.slice(t).join(Nu),h=c.length;for(let f=0;fe.slice(1,-1).indexOf(":")===-1?void 0:(()=>{const t=e.slice(1,-1),r=t.indexOf(":"),a=t.slice(0,r);return a?VT+a:void 0})(),KT=e=>{const{theme:t,classGroups:r}=e;return ZT(r,t)},ZT=(e,t)=>{const r=W_();for(const a in e){const s=e[a];Tp(s,r,a,t)}return r},Tp=(e,t,r,a)=>{const s=e.length;for(let o=0;o{if(typeof e=="string"){WT(e,t,r);return}if(typeof e=="function"){JT(e,t,r,a);return}eA(e,t,r,a)},WT=(e,t,r)=>{const a=e===""?t:ew(t,e);a.classGroupId=r},JT=(e,t,r,a)=>{if(tA(e)){Tp(e(a),t,r,a);return}t.validators===null&&(t.validators=[]),t.validators.push(GT(r,e))},eA=(e,t,r,a)=>{const s=Object.entries(e),o=s.length;for(let c=0;c{let r=e;const a=t.split(Nu),s=a.length;for(let o=0;o"isThemeGetter"in e&&e.isThemeGetter===!0,nA=e=>{if(e<1)return{get:()=>{},set:()=>{}};let t=0,r=Object.create(null),a=Object.create(null);const s=(o,c)=>{r[o]=c,t++,t>e&&(t=0,a=r,r=Object.create(null))};return{get(o){let c=r[o];if(c!==void 0)return c;if((c=a[o])!==void 0)return s(o,c),c},set(o,c){o in r?r[o]=c:s(o,c)}}},Gm="!",uy=":",rA=[],dy=(e,t,r,a,s)=>({modifiers:e,hasImportantModifier:t,baseClassName:r,maybePostfixModifierPosition:a,isExternal:s}),iA=e=>{const{prefix:t,experimentalParseClassName:r}=e;let a=s=>{const o=[];let c=0,d=0,h=0,f;const p=s.length;for(let N=0;Nh?f-h:void 0;return dy(o,y,b,_)};if(t){const s=t+uy,o=a;a=c=>c.startsWith(s)?o(c.slice(s.length)):dy(rA,!1,c,void 0,!0)}if(r){const s=a;a=o=>r({className:o,parseClassName:s})}return a},aA=e=>{const t=new Map;return e.orderSensitiveModifiers.forEach((r,a)=>{t.set(r,1e6+a)}),r=>{const a=[];let s=[];for(let o=0;o0&&(s.sort(),a.push(...s),s=[]),a.push(c)):s.push(c)}return s.length>0&&(s.sort(),a.push(...s)),a}},sA=e=>({cache:nA(e.cacheSize),parseClassName:iA(e),sortModifiers:aA(e),postfixLookupClassGroupIds:lA(e),...YT(e)}),lA=e=>{const t=Object.create(null),r=e.postfixLookupClassGroups;if(r)for(let a=0;a{const{parseClassName:r,getClassGroupId:a,getConflictingClassGroupIds:s,sortModifiers:o,postfixLookupClassGroupIds:c}=t,d=[],h=e.trim().split(oA);let f="";for(let p=h.length-1;p>=0;p-=1){const g=h[p],{isExternal:b,modifiers:y,hasImportantModifier:_,baseClassName:N,maybePostfixModifierPosition:S}=r(g);if(b){f=g+(f.length>0?" "+f:f);continue}let w=!!S,C;if(w){const H=N.substring(0,S);C=a(H);const z=C&&c[C]?a(N):void 0;z&&z!==C&&(C=z,w=!1)}else C=a(N);if(!C){if(!w){f=g+(f.length>0?" "+f:f);continue}if(C=a(N),!C){f=g+(f.length>0?" "+f:f);continue}w=!1}const E=y.length===0?"":y.length===1?y[0]:o(y).join(":"),A=_?E+Gm:E,B=A+C;if(d.indexOf(B)>-1)continue;d.push(B);const R=s(C,w);for(let H=0;H0?" "+f:f)}return f},uA=(...e)=>{let t=0,r,a,s="";for(;t{if(typeof e=="string")return e;let t,r="";for(let a=0;a{let r,a,s,o;const c=h=>{const f=t.reduce((p,g)=>g(p),e());return r=sA(f),a=r.cache.get,s=r.cache.set,o=d,d(h)},d=h=>{const f=a(h);if(f)return f;const p=cA(h,r);return s(h,p),p};return o=c,(...h)=>o(uA(...h))},fA=[],hn=e=>{const t=r=>r[e]||fA;return t.isThemeGetter=!0,t},nw=/^\[(?:(\w[\w-]*):)?(.+)\]$/i,rw=/^\((?:(\w[\w-]*):)?(.+)\)$/i,hA=/^\d+(?:\.\d+)?\/\d+(?:\.\d+)?$/,mA=/^(\d+(\.\d+)?)?(xs|sm|md|lg|xl)$/,pA=/\d+(%|px|r?em|[sdl]?v([hwib]|min|max)|pt|pc|in|cm|mm|cap|ch|ex|r?lh|cq(w|h|i|b|min|max))|\b(calc|min|max|clamp)\(.+\)|^0$/,gA=/^(rgba?|hsla?|hwb|(ok)?(lab|lch)|color-mix)\(.+\)$/,xA=/^(inset_)?-?((\d+)?\.?(\d+)[a-z]+|0)_-?((\d+)?\.?(\d+)[a-z]+|0)/,bA=/^(url|image|image-set|cross-fade|element|(repeating-)?(linear|radial|conic)-gradient)\(.+\)$/,ra=e=>hA.test(e),We=e=>!!e&&!Number.isNaN(Number(e)),Fr=e=>!!e&&Number.isInteger(Number(e)),yh=e=>e.endsWith("%")&&We(e.slice(0,-1)),xi=e=>mA.test(e),iw=()=>!0,yA=e=>pA.test(e)&&!gA.test(e),Ap=()=>!1,vA=e=>xA.test(e),_A=e=>bA.test(e),wA=e=>!ke(e)&&!Ce(e),EA=e=>e.startsWith("@container")&&(e[10]==="/"&&e[11]!==void 0||e[11]==="s"&&e[16]!==void 0&&e.startsWith("-size/",10)||e[11]==="n"&&e[18]!==void 0&&e.startsWith("-normal/",10)),NA=e=>ma(e,lw,Ap),ke=e=>nw.test(e),za=e=>ma(e,ow,yA),fy=e=>ma(e,RA,We),SA=e=>ma(e,uw,iw),kA=e=>ma(e,cw,Ap),hy=e=>ma(e,aw,Ap),CA=e=>ma(e,sw,_A),Jc=e=>ma(e,dw,vA),Ce=e=>rw.test(e),Zl=e=>Wa(e,ow),TA=e=>Wa(e,cw),my=e=>Wa(e,aw),AA=e=>Wa(e,lw),MA=e=>Wa(e,sw),eu=e=>Wa(e,dw,!0),OA=e=>Wa(e,uw,!0),ma=(e,t,r)=>{const a=nw.exec(e);return a?a[1]?t(a[1]):r(a[2]):!1},Wa=(e,t,r=!1)=>{const a=rw.exec(e);return a?a[1]?t(a[1]):r:!1},aw=e=>e==="position"||e==="percentage",sw=e=>e==="image"||e==="url",lw=e=>e==="length"||e==="size"||e==="bg-size",ow=e=>e==="length",RA=e=>e==="number",cw=e=>e==="family-name",uw=e=>e==="number"||e==="weight",dw=e=>e==="shadow",jA=()=>{const e=hn("color"),t=hn("font"),r=hn("text"),a=hn("font-weight"),s=hn("tracking"),o=hn("leading"),c=hn("breakpoint"),d=hn("container"),h=hn("spacing"),f=hn("radius"),p=hn("shadow"),g=hn("inset-shadow"),b=hn("text-shadow"),y=hn("drop-shadow"),_=hn("blur"),N=hn("perspective"),S=hn("aspect"),w=hn("ease"),C=hn("animate"),E=()=>["auto","avoid","all","avoid-page","page","left","right","column"],A=()=>["center","top","bottom","left","right","top-left","left-top","top-right","right-top","bottom-right","right-bottom","bottom-left","left-bottom"],B=()=>[...A(),Ce,ke],R=()=>["auto","hidden","clip","visible","scroll"],H=()=>["auto","contain","none"],z=()=>[Ce,ke,h],Y=()=>[ra,"full","auto",...z()],j=()=>[Fr,"none","subgrid",Ce,ke],I=()=>["auto",{span:["full",Fr,Ce,ke]},Fr,Ce,ke],Z=()=>[Fr,"auto",Ce,ke],P=()=>["auto","min","max","fr",Ce,ke],k=()=>["start","end","center","between","around","evenly","stretch","baseline","center-safe","end-safe"],$=()=>["start","end","center","stretch","center-safe","end-safe"],O=()=>["auto",...z()],U=()=>[ra,"auto","full","dvw","dvh","lvw","lvh","svw","svh","min","max","fit",...z()],K=()=>[ra,"screen","full","dvw","lvw","svw","min","max","fit",...z()],X=()=>[ra,"screen","full","lh","dvh","lvh","svh","min","max","fit",...z()],M=()=>[e,Ce,ke],L=()=>[...A(),my,hy,{position:[Ce,ke]}],F=()=>["no-repeat",{repeat:["","x","y","space","round"]}],D=()=>["auto","cover","contain",AA,NA,{size:[Ce,ke]}],V=()=>[yh,Zl,za],q=()=>["","none","full",f,Ce,ke],Q=()=>["",We,Zl,za],J=()=>["solid","dashed","dotted","double"],W=()=>["normal","multiply","screen","overlay","darken","lighten","color-dodge","color-burn","hard-light","soft-light","difference","exclusion","hue","saturation","color","luminosity"],te=()=>[We,yh,my,hy],oe=()=>["","none",_,Ce,ke],fe=()=>["none",We,Ce,ke],xe=()=>["none",We,Ce,ke],we=()=>[We,Ce,ke],Ne=()=>[ra,"full",...z()];return{cacheSize:500,theme:{animate:["spin","ping","pulse","bounce"],aspect:["video"],blur:[xi],breakpoint:[xi],color:[iw],container:[xi],"drop-shadow":[xi],ease:["in","out","in-out"],font:[wA],"font-weight":["thin","extralight","light","normal","medium","semibold","bold","extrabold","black"],"inset-shadow":[xi],leading:["none","tight","snug","normal","relaxed","loose"],perspective:["dramatic","near","normal","midrange","distant","none"],radius:[xi],shadow:[xi],spacing:["px",We],text:[xi],"text-shadow":[xi],tracking:["tighter","tight","normal","wide","wider","widest"]},classGroups:{aspect:[{aspect:["auto","square",ra,ke,Ce,S]}],container:["container"],"container-type":[{"@container":["","normal","size",Ce,ke]}],"container-named":[EA],columns:[{columns:[We,ke,Ce,d]}],"break-after":[{"break-after":E()}],"break-before":[{"break-before":E()}],"break-inside":[{"break-inside":["auto","avoid","avoid-page","avoid-column"]}],"box-decoration":[{"box-decoration":["slice","clone"]}],box:[{box:["border","content"]}],display:["block","inline-block","inline","flex","inline-flex","table","inline-table","table-caption","table-cell","table-column","table-column-group","table-footer-group","table-header-group","table-row-group","table-row","flow-root","grid","inline-grid","contents","list-item","hidden"],sr:["sr-only","not-sr-only"],float:[{float:["right","left","none","start","end"]}],clear:[{clear:["left","right","both","none","start","end"]}],isolation:["isolate","isolation-auto"],"object-fit":[{object:["contain","cover","fill","none","scale-down"]}],"object-position":[{object:B()}],overflow:[{overflow:R()}],"overflow-x":[{"overflow-x":R()}],"overflow-y":[{"overflow-y":R()}],overscroll:[{overscroll:H()}],"overscroll-x":[{"overscroll-x":H()}],"overscroll-y":[{"overscroll-y":H()}],position:["static","fixed","absolute","relative","sticky"],inset:[{inset:Y()}],"inset-x":[{"inset-x":Y()}],"inset-y":[{"inset-y":Y()}],start:[{"inset-s":Y(),start:Y()}],end:[{"inset-e":Y(),end:Y()}],"inset-bs":[{"inset-bs":Y()}],"inset-be":[{"inset-be":Y()}],top:[{top:Y()}],right:[{right:Y()}],bottom:[{bottom:Y()}],left:[{left:Y()}],visibility:["visible","invisible","collapse"],z:[{z:[Fr,"auto",Ce,ke]}],basis:[{basis:[ra,"full","auto",d,...z()]}],"flex-direction":[{flex:["row","row-reverse","col","col-reverse"]}],"flex-wrap":[{flex:["nowrap","wrap","wrap-reverse"]}],flex:[{flex:[We,ra,"auto","initial","none",ke]}],grow:[{grow:["",We,Ce,ke]}],shrink:[{shrink:["",We,Ce,ke]}],order:[{order:[Fr,"first","last","none",Ce,ke]}],"grid-cols":[{"grid-cols":j()}],"col-start-end":[{col:I()}],"col-start":[{"col-start":Z()}],"col-end":[{"col-end":Z()}],"grid-rows":[{"grid-rows":j()}],"row-start-end":[{row:I()}],"row-start":[{"row-start":Z()}],"row-end":[{"row-end":Z()}],"grid-flow":[{"grid-flow":["row","col","dense","row-dense","col-dense"]}],"auto-cols":[{"auto-cols":P()}],"auto-rows":[{"auto-rows":P()}],gap:[{gap:z()}],"gap-x":[{"gap-x":z()}],"gap-y":[{"gap-y":z()}],"justify-content":[{justify:[...k(),"normal"]}],"justify-items":[{"justify-items":[...$(),"normal"]}],"justify-self":[{"justify-self":["auto",...$()]}],"align-content":[{content:["normal",...k()]}],"align-items":[{items:[...$(),{baseline:["","last"]}]}],"align-self":[{self:["auto",...$(),{baseline:["","last"]}]}],"place-content":[{"place-content":k()}],"place-items":[{"place-items":[...$(),"baseline"]}],"place-self":[{"place-self":["auto",...$()]}],p:[{p:z()}],px:[{px:z()}],py:[{py:z()}],ps:[{ps:z()}],pe:[{pe:z()}],pbs:[{pbs:z()}],pbe:[{pbe:z()}],pt:[{pt:z()}],pr:[{pr:z()}],pb:[{pb:z()}],pl:[{pl:z()}],m:[{m:O()}],mx:[{mx:O()}],my:[{my:O()}],ms:[{ms:O()}],me:[{me:O()}],mbs:[{mbs:O()}],mbe:[{mbe:O()}],mt:[{mt:O()}],mr:[{mr:O()}],mb:[{mb:O()}],ml:[{ml:O()}],"space-x":[{"space-x":z()}],"space-x-reverse":["space-x-reverse"],"space-y":[{"space-y":z()}],"space-y-reverse":["space-y-reverse"],size:[{size:U()}],"inline-size":[{inline:["auto",...K()]}],"min-inline-size":[{"min-inline":["auto",...K()]}],"max-inline-size":[{"max-inline":["none",...K()]}],"block-size":[{block:["auto",...X()]}],"min-block-size":[{"min-block":["auto",...X()]}],"max-block-size":[{"max-block":["none",...X()]}],w:[{w:[d,"screen",...U()]}],"min-w":[{"min-w":[d,"screen","none",...U()]}],"max-w":[{"max-w":[d,"screen","none","prose",{screen:[c]},...U()]}],h:[{h:["screen","lh",...U()]}],"min-h":[{"min-h":["screen","lh","none",...U()]}],"max-h":[{"max-h":["screen","lh",...U()]}],"font-size":[{text:["base",r,Zl,za]}],"font-smoothing":["antialiased","subpixel-antialiased"],"font-style":["italic","not-italic"],"font-weight":[{font:[a,OA,SA]}],"font-stretch":[{"font-stretch":["ultra-condensed","extra-condensed","condensed","semi-condensed","normal","semi-expanded","expanded","extra-expanded","ultra-expanded",yh,ke]}],"font-family":[{font:[TA,kA,t]}],"font-features":[{"font-features":[ke]}],"fvn-normal":["normal-nums"],"fvn-ordinal":["ordinal"],"fvn-slashed-zero":["slashed-zero"],"fvn-figure":["lining-nums","oldstyle-nums"],"fvn-spacing":["proportional-nums","tabular-nums"],"fvn-fraction":["diagonal-fractions","stacked-fractions"],tracking:[{tracking:[s,Ce,ke]}],"line-clamp":[{"line-clamp":[We,"none",Ce,fy]}],leading:[{leading:[o,...z()]}],"list-image":[{"list-image":["none",Ce,ke]}],"list-style-position":[{list:["inside","outside"]}],"list-style-type":[{list:["disc","decimal","none",Ce,ke]}],"text-alignment":[{text:["left","center","right","justify","start","end"]}],"placeholder-color":[{placeholder:M()}],"text-color":[{text:M()}],"text-decoration":["underline","overline","line-through","no-underline"],"text-decoration-style":[{decoration:[...J(),"wavy"]}],"text-decoration-thickness":[{decoration:[We,"from-font","auto",Ce,za]}],"text-decoration-color":[{decoration:M()}],"underline-offset":[{"underline-offset":[We,"auto",Ce,ke]}],"text-transform":["uppercase","lowercase","capitalize","normal-case"],"text-overflow":["truncate","text-ellipsis","text-clip"],"text-wrap":[{text:["wrap","nowrap","balance","pretty"]}],indent:[{indent:z()}],"tab-size":[{tab:[Fr,Ce,ke]}],"vertical-align":[{align:["baseline","top","middle","bottom","text-top","text-bottom","sub","super",Ce,ke]}],whitespace:[{whitespace:["normal","nowrap","pre","pre-line","pre-wrap","break-spaces"]}],break:[{break:["normal","words","all","keep"]}],wrap:[{wrap:["break-word","anywhere","normal"]}],hyphens:[{hyphens:["none","manual","auto"]}],content:[{content:["none",Ce,ke]}],"bg-attachment":[{bg:["fixed","local","scroll"]}],"bg-clip":[{"bg-clip":["border","padding","content","text"]}],"bg-origin":[{"bg-origin":["border","padding","content"]}],"bg-position":[{bg:L()}],"bg-repeat":[{bg:F()}],"bg-size":[{bg:D()}],"bg-image":[{bg:["none",{linear:[{to:["t","tr","r","br","b","bl","l","tl"]},Fr,Ce,ke],radial:["",Ce,ke],conic:[Fr,Ce,ke]},MA,CA]}],"bg-color":[{bg:M()}],"gradient-from-pos":[{from:V()}],"gradient-via-pos":[{via:V()}],"gradient-to-pos":[{to:V()}],"gradient-from":[{from:M()}],"gradient-via":[{via:M()}],"gradient-to":[{to:M()}],rounded:[{rounded:q()}],"rounded-s":[{"rounded-s":q()}],"rounded-e":[{"rounded-e":q()}],"rounded-t":[{"rounded-t":q()}],"rounded-r":[{"rounded-r":q()}],"rounded-b":[{"rounded-b":q()}],"rounded-l":[{"rounded-l":q()}],"rounded-ss":[{"rounded-ss":q()}],"rounded-se":[{"rounded-se":q()}],"rounded-ee":[{"rounded-ee":q()}],"rounded-es":[{"rounded-es":q()}],"rounded-tl":[{"rounded-tl":q()}],"rounded-tr":[{"rounded-tr":q()}],"rounded-br":[{"rounded-br":q()}],"rounded-bl":[{"rounded-bl":q()}],"border-w":[{border:Q()}],"border-w-x":[{"border-x":Q()}],"border-w-y":[{"border-y":Q()}],"border-w-s":[{"border-s":Q()}],"border-w-e":[{"border-e":Q()}],"border-w-bs":[{"border-bs":Q()}],"border-w-be":[{"border-be":Q()}],"border-w-t":[{"border-t":Q()}],"border-w-r":[{"border-r":Q()}],"border-w-b":[{"border-b":Q()}],"border-w-l":[{"border-l":Q()}],"divide-x":[{"divide-x":Q()}],"divide-x-reverse":["divide-x-reverse"],"divide-y":[{"divide-y":Q()}],"divide-y-reverse":["divide-y-reverse"],"border-style":[{border:[...J(),"hidden","none"]}],"divide-style":[{divide:[...J(),"hidden","none"]}],"border-color":[{border:M()}],"border-color-x":[{"border-x":M()}],"border-color-y":[{"border-y":M()}],"border-color-s":[{"border-s":M()}],"border-color-e":[{"border-e":M()}],"border-color-bs":[{"border-bs":M()}],"border-color-be":[{"border-be":M()}],"border-color-t":[{"border-t":M()}],"border-color-r":[{"border-r":M()}],"border-color-b":[{"border-b":M()}],"border-color-l":[{"border-l":M()}],"divide-color":[{divide:M()}],"outline-style":[{outline:[...J(),"none","hidden"]}],"outline-offset":[{"outline-offset":[We,Ce,ke]}],"outline-w":[{outline:["",We,Zl,za]}],"outline-color":[{outline:M()}],shadow:[{shadow:["","none",p,eu,Jc]}],"shadow-color":[{shadow:M()}],"inset-shadow":[{"inset-shadow":["none",g,eu,Jc]}],"inset-shadow-color":[{"inset-shadow":M()}],"ring-w":[{ring:Q()}],"ring-w-inset":["ring-inset"],"ring-color":[{ring:M()}],"ring-offset-w":[{"ring-offset":[We,za]}],"ring-offset-color":[{"ring-offset":M()}],"inset-ring-w":[{"inset-ring":Q()}],"inset-ring-color":[{"inset-ring":M()}],"text-shadow":[{"text-shadow":["none",b,eu,Jc]}],"text-shadow-color":[{"text-shadow":M()}],opacity:[{opacity:[We,Ce,ke]}],"mix-blend":[{"mix-blend":[...W(),"plus-darker","plus-lighter"]}],"bg-blend":[{"bg-blend":W()}],"mask-clip":[{"mask-clip":["border","padding","content","fill","stroke","view"]},"mask-no-clip"],"mask-composite":[{mask:["add","subtract","intersect","exclude"]}],"mask-image-linear-pos":[{"mask-linear":[We]}],"mask-image-linear-from-pos":[{"mask-linear-from":te()}],"mask-image-linear-to-pos":[{"mask-linear-to":te()}],"mask-image-linear-from-color":[{"mask-linear-from":M()}],"mask-image-linear-to-color":[{"mask-linear-to":M()}],"mask-image-t-from-pos":[{"mask-t-from":te()}],"mask-image-t-to-pos":[{"mask-t-to":te()}],"mask-image-t-from-color":[{"mask-t-from":M()}],"mask-image-t-to-color":[{"mask-t-to":M()}],"mask-image-r-from-pos":[{"mask-r-from":te()}],"mask-image-r-to-pos":[{"mask-r-to":te()}],"mask-image-r-from-color":[{"mask-r-from":M()}],"mask-image-r-to-color":[{"mask-r-to":M()}],"mask-image-b-from-pos":[{"mask-b-from":te()}],"mask-image-b-to-pos":[{"mask-b-to":te()}],"mask-image-b-from-color":[{"mask-b-from":M()}],"mask-image-b-to-color":[{"mask-b-to":M()}],"mask-image-l-from-pos":[{"mask-l-from":te()}],"mask-image-l-to-pos":[{"mask-l-to":te()}],"mask-image-l-from-color":[{"mask-l-from":M()}],"mask-image-l-to-color":[{"mask-l-to":M()}],"mask-image-x-from-pos":[{"mask-x-from":te()}],"mask-image-x-to-pos":[{"mask-x-to":te()}],"mask-image-x-from-color":[{"mask-x-from":M()}],"mask-image-x-to-color":[{"mask-x-to":M()}],"mask-image-y-from-pos":[{"mask-y-from":te()}],"mask-image-y-to-pos":[{"mask-y-to":te()}],"mask-image-y-from-color":[{"mask-y-from":M()}],"mask-image-y-to-color":[{"mask-y-to":M()}],"mask-image-radial":[{"mask-radial":[Ce,ke]}],"mask-image-radial-from-pos":[{"mask-radial-from":te()}],"mask-image-radial-to-pos":[{"mask-radial-to":te()}],"mask-image-radial-from-color":[{"mask-radial-from":M()}],"mask-image-radial-to-color":[{"mask-radial-to":M()}],"mask-image-radial-shape":[{"mask-radial":["circle","ellipse"]}],"mask-image-radial-size":[{"mask-radial":[{closest:["side","corner"],farthest:["side","corner"]}]}],"mask-image-radial-pos":[{"mask-radial-at":A()}],"mask-image-conic-pos":[{"mask-conic":[We]}],"mask-image-conic-from-pos":[{"mask-conic-from":te()}],"mask-image-conic-to-pos":[{"mask-conic-to":te()}],"mask-image-conic-from-color":[{"mask-conic-from":M()}],"mask-image-conic-to-color":[{"mask-conic-to":M()}],"mask-mode":[{mask:["alpha","luminance","match"]}],"mask-origin":[{"mask-origin":["border","padding","content","fill","stroke","view"]}],"mask-position":[{mask:L()}],"mask-repeat":[{mask:F()}],"mask-size":[{mask:D()}],"mask-type":[{"mask-type":["alpha","luminance"]}],"mask-image":[{mask:["none",Ce,ke]}],filter:[{filter:["","none",Ce,ke]}],blur:[{blur:oe()}],brightness:[{brightness:[We,Ce,ke]}],contrast:[{contrast:[We,Ce,ke]}],"drop-shadow":[{"drop-shadow":["","none",y,eu,Jc]}],"drop-shadow-color":[{"drop-shadow":M()}],grayscale:[{grayscale:["",We,Ce,ke]}],"hue-rotate":[{"hue-rotate":[We,Ce,ke]}],invert:[{invert:["",We,Ce,ke]}],saturate:[{saturate:[We,Ce,ke]}],sepia:[{sepia:["",We,Ce,ke]}],"backdrop-filter":[{"backdrop-filter":["","none",Ce,ke]}],"backdrop-blur":[{"backdrop-blur":oe()}],"backdrop-brightness":[{"backdrop-brightness":[We,Ce,ke]}],"backdrop-contrast":[{"backdrop-contrast":[We,Ce,ke]}],"backdrop-grayscale":[{"backdrop-grayscale":["",We,Ce,ke]}],"backdrop-hue-rotate":[{"backdrop-hue-rotate":[We,Ce,ke]}],"backdrop-invert":[{"backdrop-invert":["",We,Ce,ke]}],"backdrop-opacity":[{"backdrop-opacity":[We,Ce,ke]}],"backdrop-saturate":[{"backdrop-saturate":[We,Ce,ke]}],"backdrop-sepia":[{"backdrop-sepia":["",We,Ce,ke]}],"border-collapse":[{border:["collapse","separate"]}],"border-spacing":[{"border-spacing":z()}],"border-spacing-x":[{"border-spacing-x":z()}],"border-spacing-y":[{"border-spacing-y":z()}],"table-layout":[{table:["auto","fixed"]}],caption:[{caption:["top","bottom"]}],transition:[{transition:["","all","colors","opacity","shadow","transform","none",Ce,ke]}],"transition-behavior":[{transition:["normal","discrete"]}],duration:[{duration:[We,"initial",Ce,ke]}],ease:[{ease:["linear","initial",w,Ce,ke]}],delay:[{delay:[We,Ce,ke]}],animate:[{animate:["none",C,Ce,ke]}],backface:[{backface:["hidden","visible"]}],perspective:[{perspective:[N,Ce,ke]}],"perspective-origin":[{"perspective-origin":B()}],rotate:[{rotate:fe()}],"rotate-x":[{"rotate-x":fe()}],"rotate-y":[{"rotate-y":fe()}],"rotate-z":[{"rotate-z":fe()}],scale:[{scale:xe()}],"scale-x":[{"scale-x":xe()}],"scale-y":[{"scale-y":xe()}],"scale-z":[{"scale-z":xe()}],"scale-3d":["scale-3d"],skew:[{skew:we()}],"skew-x":[{"skew-x":we()}],"skew-y":[{"skew-y":we()}],transform:[{transform:[Ce,ke,"","none","gpu","cpu"]}],"transform-origin":[{origin:B()}],"transform-style":[{transform:["3d","flat"]}],translate:[{translate:Ne()}],"translate-x":[{"translate-x":Ne()}],"translate-y":[{"translate-y":Ne()}],"translate-z":[{"translate-z":Ne()}],"translate-none":["translate-none"],zoom:[{zoom:[Fr,Ce,ke]}],accent:[{accent:M()}],appearance:[{appearance:["none","auto"]}],"caret-color":[{caret:M()}],"color-scheme":[{scheme:["normal","dark","light","light-dark","only-dark","only-light"]}],cursor:[{cursor:["auto","default","pointer","wait","text","move","help","not-allowed","none","context-menu","progress","cell","crosshair","vertical-text","alias","copy","no-drop","grab","grabbing","all-scroll","col-resize","row-resize","n-resize","e-resize","s-resize","w-resize","ne-resize","nw-resize","se-resize","sw-resize","ew-resize","ns-resize","nesw-resize","nwse-resize","zoom-in","zoom-out",Ce,ke]}],"field-sizing":[{"field-sizing":["fixed","content"]}],"pointer-events":[{"pointer-events":["auto","none"]}],resize:[{resize:["none","","y","x"]}],"scroll-behavior":[{scroll:["auto","smooth"]}],"scrollbar-thumb-color":[{"scrollbar-thumb":M()}],"scrollbar-track-color":[{"scrollbar-track":M()}],"scrollbar-gutter":[{"scrollbar-gutter":["auto","stable","both"]}],"scrollbar-w":[{scrollbar:["auto","thin","none"]}],"scroll-m":[{"scroll-m":z()}],"scroll-mx":[{"scroll-mx":z()}],"scroll-my":[{"scroll-my":z()}],"scroll-ms":[{"scroll-ms":z()}],"scroll-me":[{"scroll-me":z()}],"scroll-mbs":[{"scroll-mbs":z()}],"scroll-mbe":[{"scroll-mbe":z()}],"scroll-mt":[{"scroll-mt":z()}],"scroll-mr":[{"scroll-mr":z()}],"scroll-mb":[{"scroll-mb":z()}],"scroll-ml":[{"scroll-ml":z()}],"scroll-p":[{"scroll-p":z()}],"scroll-px":[{"scroll-px":z()}],"scroll-py":[{"scroll-py":z()}],"scroll-ps":[{"scroll-ps":z()}],"scroll-pe":[{"scroll-pe":z()}],"scroll-pbs":[{"scroll-pbs":z()}],"scroll-pbe":[{"scroll-pbe":z()}],"scroll-pt":[{"scroll-pt":z()}],"scroll-pr":[{"scroll-pr":z()}],"scroll-pb":[{"scroll-pb":z()}],"scroll-pl":[{"scroll-pl":z()}],"snap-align":[{snap:["start","end","center","align-none"]}],"snap-stop":[{snap:["normal","always"]}],"snap-type":[{snap:["none","x","y","both"]}],"snap-strictness":[{snap:["mandatory","proximity"]}],touch:[{touch:["auto","none","manipulation"]}],"touch-x":[{"touch-pan":["x","left","right"]}],"touch-y":[{"touch-pan":["y","up","down"]}],"touch-pz":["touch-pinch-zoom"],select:[{select:["none","text","all","auto"]}],"will-change":[{"will-change":["auto","scroll","contents","transform",Ce,ke]}],fill:[{fill:["none",...M()]}],"stroke-w":[{stroke:[We,Zl,za,fy]}],stroke:[{stroke:["none",...M()]}],"forced-color-adjust":[{"forced-color-adjust":["auto","none"]}]},conflictingClassGroups:{"container-named":["container-type"],overflow:["overflow-x","overflow-y"],overscroll:["overscroll-x","overscroll-y"],inset:["inset-x","inset-y","inset-bs","inset-be","start","end","top","right","bottom","left"],"inset-x":["right","left"],"inset-y":["top","bottom"],flex:["basis","grow","shrink"],gap:["gap-x","gap-y"],p:["px","py","ps","pe","pbs","pbe","pt","pr","pb","pl"],px:["pr","pl"],py:["pt","pb"],m:["mx","my","ms","me","mbs","mbe","mt","mr","mb","ml"],mx:["mr","ml"],my:["mt","mb"],size:["w","h"],"font-size":["leading"],"fvn-normal":["fvn-ordinal","fvn-slashed-zero","fvn-figure","fvn-spacing","fvn-fraction"],"fvn-ordinal":["fvn-normal"],"fvn-slashed-zero":["fvn-normal"],"fvn-figure":["fvn-normal"],"fvn-spacing":["fvn-normal"],"fvn-fraction":["fvn-normal"],"line-clamp":["display","overflow"],rounded:["rounded-s","rounded-e","rounded-t","rounded-r","rounded-b","rounded-l","rounded-ss","rounded-se","rounded-ee","rounded-es","rounded-tl","rounded-tr","rounded-br","rounded-bl"],"rounded-s":["rounded-ss","rounded-es"],"rounded-e":["rounded-se","rounded-ee"],"rounded-t":["rounded-tl","rounded-tr"],"rounded-r":["rounded-tr","rounded-br"],"rounded-b":["rounded-br","rounded-bl"],"rounded-l":["rounded-tl","rounded-bl"],"border-spacing":["border-spacing-x","border-spacing-y"],"border-w":["border-w-x","border-w-y","border-w-s","border-w-e","border-w-bs","border-w-be","border-w-t","border-w-r","border-w-b","border-w-l"],"border-w-x":["border-w-r","border-w-l"],"border-w-y":["border-w-t","border-w-b"],"border-color":["border-color-x","border-color-y","border-color-s","border-color-e","border-color-bs","border-color-be","border-color-t","border-color-r","border-color-b","border-color-l"],"border-color-x":["border-color-r","border-color-l"],"border-color-y":["border-color-t","border-color-b"],translate:["translate-x","translate-y","translate-none"],"translate-none":["translate","translate-x","translate-y","translate-z"],"scroll-m":["scroll-mx","scroll-my","scroll-ms","scroll-me","scroll-mbs","scroll-mbe","scroll-mt","scroll-mr","scroll-mb","scroll-ml"],"scroll-mx":["scroll-mr","scroll-ml"],"scroll-my":["scroll-mt","scroll-mb"],"scroll-p":["scroll-px","scroll-py","scroll-ps","scroll-pe","scroll-pbs","scroll-pbe","scroll-pt","scroll-pr","scroll-pb","scroll-pl"],"scroll-px":["scroll-pr","scroll-pl"],"scroll-py":["scroll-pt","scroll-pb"],touch:["touch-x","touch-y","touch-pz"],"touch-x":["touch"],"touch-y":["touch"],"touch-pz":["touch"]},conflictingClassGroupModifiers:{"font-size":["leading"]},postfixLookupClassGroups:["container-type"],orderSensitiveModifiers:["*","**","after","backdrop","before","details-content","file","first-letter","first-line","marker","placeholder","selection"]}},DA=dA(jA);function br(...e){return DA(PT(e))}function LA(e){return new Date(e).toLocaleDateString("en-US",{year:"numeric",month:"short",day:"numeric"})}function Vm(e){const t=new Date(e),a=Math.floor((new Date().getTime()-t.getTime())/1e3);return a<60?"just now":a<3600?`${Math.floor(a/60)}m ago`:a<86400?`${Math.floor(a/3600)}h ago`:a<604800?`${Math.floor(a/86400)}d ago`:LA(e)}function zA(e){return`STRIX-${e}`}function Ls(e){return new Intl.NumberFormat("en-US").format(e)}function IA(e,t){const r={};return(e[e.length-1]===""?[...e,""]:e).join((r.padRight?" ":"")+","+(r.padLeft===!1?"":" ")).trim()}const BA=/^[$_\p{ID_Start}][$_\u{200C}\u{200D}\p{ID_Continue}]*$/u,UA=/^[$_\p{ID_Start}][-$_\u{200C}\u{200D}\p{ID_Continue}]*$/u,HA={};function py(e,t){return(HA.jsx?UA:BA).test(e)}const $A=/[ \t\n\f\r]/g;function qA(e){return typeof e=="object"?e.type==="text"?gy(e.value):!1:gy(e)}function gy(e){return e.replace($A,"")===""}class Ro{constructor(t,r,a){this.normal=r,this.property=t,a&&(this.space=a)}}Ro.prototype.normal={};Ro.prototype.property={};Ro.prototype.space=void 0;function fw(e,t){const r={},a={};for(const s of e)Object.assign(r,s.property),Object.assign(a,s.normal);return new Ro(r,a,t)}function Ym(e){return e.toLowerCase()}class Vn{constructor(t,r){this.attribute=r,this.property=t}}Vn.prototype.attribute="";Vn.prototype.booleanish=!1;Vn.prototype.boolean=!1;Vn.prototype.commaOrSpaceSeparated=!1;Vn.prototype.commaSeparated=!1;Vn.prototype.defined=!1;Vn.prototype.mustUseProperty=!1;Vn.prototype.number=!1;Vn.prototype.overloadedBoolean=!1;Vn.prototype.property="";Vn.prototype.spaceSeparated=!1;Vn.prototype.space=void 0;let PA=0;const Ge=Ja(),sn=Ja(),Xm=Ja(),ve=Ja(),Ct=Ja(),qa=Ja(),rr=Ja();function Ja(){return 2**++PA}const Km=Object.freeze(Object.defineProperty({__proto__:null,boolean:Ge,booleanish:sn,commaOrSpaceSeparated:rr,commaSeparated:qa,number:ve,overloadedBoolean:Xm,spaceSeparated:Ct},Symbol.toStringTag,{value:"Module"})),vh=Object.keys(Km);class Mp extends Vn{constructor(t,r,a,s){let o=-1;if(super(t,r),xy(this,"space",s),typeof a=="number")for(;++o4&&r.slice(0,4)==="data"&&XA.test(t)){if(t.charAt(4)==="-"){const o=t.slice(5).replace(by,QA);a="data"+o.charAt(0).toUpperCase()+o.slice(1)}else{const o=t.slice(4);if(!by.test(o)){let c=o.replace(YA,ZA);c.charAt(0)!=="-"&&(c="-"+c),t="data"+c}}s=Mp}return new s(a,t)}function ZA(e){return"-"+e.toLowerCase()}function QA(e){return e.charAt(1).toUpperCase()}const WA=fw([hw,FA,gw,xw,bw],"html"),Op=fw([hw,GA,gw,xw,bw],"svg");function JA(e){return e.join(" ").trim()}var zs={},_h,yy;function eM(){if(yy)return _h;yy=1;var e=/\/\*[^*]*\*+([^/*][^*]*\*+)*\//g,t=/\n/g,r=/^\s*/,a=/^(\*?[-#/*\\\w]+(\[[0-9a-z_-]+\])?)\s*/,s=/^:\s*/,o=/^((?:'(?:\\'|.)*?'|"(?:\\"|.)*?"|\([^)]*?\)|[^};])+)/,c=/^[;\s]*/,d=/^\s+|\s+$/g,h=` -`,f="/",p="*",g="",b="comment",y="declaration";function _(S,w){if(typeof S!="string")throw new TypeError("First argument must be a string");if(!S)return[];w=w||{};var C=1,E=1;function A(k){var $=k.match(t);$&&(C+=$.length);var O=k.lastIndexOf(h);E=~O?k.length-O:E+k.length}function B(){var k={line:C,column:E};return function($){return $.position=new R(k),Y(),$}}function R(k){this.start=k,this.end={line:C,column:E},this.source=w.source}R.prototype.content=S;function H(k){var $=new Error(w.source+":"+C+":"+E+": "+k);if($.reason=k,$.filename=w.source,$.line=C,$.column=E,$.source=S,!w.silent)throw $}function z(k){var $=k.exec(S);if($){var O=$[0];return A(O),S=S.slice(O.length),$}}function Y(){z(r)}function j(k){var $;for(k=k||[];$=I();)$!==!1&&k.push($);return k}function I(){var k=B();if(!(f!=S.charAt(0)||p!=S.charAt(1))){for(var $=2;g!=S.charAt($)&&(p!=S.charAt($)||f!=S.charAt($+1));)++$;if($+=2,g===S.charAt($-1))return H("End of comment missing");var O=S.slice(2,$-2);return E+=2,A(O),S=S.slice($),E+=2,k({type:b,comment:O})}}function Z(){var k=B(),$=z(a);if($){if(I(),!z(s))return H("property missing ':'");var O=z(o),U=k({type:y,property:N($[0].replace(e,g)),value:O?N(O[0].replace(e,g)):g});return z(c),U}}function P(){var k=[];j(k);for(var $;$=Z();)$!==!1&&(k.push($),j(k));return k}return Y(),P()}function N(S){return S?S.replace(d,g):g}return _h=_,_h}var vy;function tM(){if(vy)return zs;vy=1;var e=zs&&zs.__importDefault||function(a){return a&&a.__esModule?a:{default:a}};Object.defineProperty(zs,"__esModule",{value:!0}),zs.default=r;const t=e(eM());function r(a,s){let o=null;if(!a||typeof a!="string")return o;const c=(0,t.default)(a),d=typeof s=="function";return c.forEach(h=>{if(h.type!=="declaration")return;const{property:f,value:p}=h;d?s(f,p,h):p&&(o=o||{},o[f]=p)}),o}return zs}var Ql={},_y;function nM(){if(_y)return Ql;_y=1,Object.defineProperty(Ql,"__esModule",{value:!0}),Ql.camelCase=void 0;var e=/^--[a-zA-Z0-9_-]+$/,t=/-([a-z])/g,r=/^[^-]+$/,a=/^-(webkit|moz|ms|o|khtml)-/,s=/^-(ms)-/,o=function(f){return!f||r.test(f)||e.test(f)},c=function(f,p){return p.toUpperCase()},d=function(f,p){return"".concat(p,"-")},h=function(f,p){return p===void 0&&(p={}),o(f)?f:(f=f.toLowerCase(),p.reactCompat?f=f.replace(s,d):f=f.replace(a,d),f.replace(t,c))};return Ql.camelCase=h,Ql}var Wl,wy;function rM(){if(wy)return Wl;wy=1;var e=Wl&&Wl.__importDefault||function(s){return s&&s.__esModule?s:{default:s}},t=e(tM()),r=nM();function a(s,o){var c={};return!s||typeof s!="string"||(0,t.default)(s,function(d,h){d&&h&&(c[(0,r.camelCase)(d,o)]=h)}),c}return a.default=a,Wl=a,Wl}var iM=rM();const aM=Ao(iM),yw=vw("end"),Rp=vw("start");function vw(e){return t;function t(r){const a=r&&r.position&&r.position[e]||{};if(typeof a.line=="number"&&a.line>0&&typeof a.column=="number"&&a.column>0)return{line:a.line,column:a.column,offset:typeof a.offset=="number"&&a.offset>-1?a.offset:void 0}}}function sM(e){const t=Rp(e),r=yw(e);if(t&&r)return{start:t,end:r}}function oo(e){return!e||typeof e!="object"?"":"position"in e||"type"in e?Ey(e.position):"start"in e||"end"in e?Ey(e):"line"in e||"column"in e?Zm(e):""}function Zm(e){return Ny(e&&e.line)+":"+Ny(e&&e.column)}function Ey(e){return Zm(e&&e.start)+"-"+Zm(e&&e.end)}function Ny(e){return e&&typeof e=="number"?e:1}class Mn extends Error{constructor(t,r,a){super(),typeof r=="string"&&(a=r,r=void 0);let s="",o={},c=!1;if(r&&("line"in r&&"column"in r?o={place:r}:"start"in r&&"end"in r?o={place:r}:"type"in r?o={ancestors:[r],place:r.position}:o={...r}),typeof t=="string"?s=t:!o.cause&&t&&(c=!0,s=t.message,o.cause=t),!o.ruleId&&!o.source&&typeof a=="string"){const h=a.indexOf(":");h===-1?o.ruleId=a:(o.source=a.slice(0,h),o.ruleId=a.slice(h+1))}if(!o.place&&o.ancestors&&o.ancestors){const h=o.ancestors[o.ancestors.length-1];h&&(o.place=h.position)}const d=o.place&&"start"in o.place?o.place.start:o.place;this.ancestors=o.ancestors||void 0,this.cause=o.cause||void 0,this.column=d?d.column:void 0,this.fatal=void 0,this.file="",this.message=s,this.line=d?d.line:void 0,this.name=oo(o.place)||"1:1",this.place=o.place||void 0,this.reason=this.message,this.ruleId=o.ruleId||void 0,this.source=o.source||void 0,this.stack=c&&o.cause&&typeof o.cause.stack=="string"?o.cause.stack:"",this.actual=void 0,this.expected=void 0,this.note=void 0,this.url=void 0}}Mn.prototype.file="";Mn.prototype.name="";Mn.prototype.reason="";Mn.prototype.message="";Mn.prototype.stack="";Mn.prototype.column=void 0;Mn.prototype.line=void 0;Mn.prototype.ancestors=void 0;Mn.prototype.cause=void 0;Mn.prototype.fatal=void 0;Mn.prototype.place=void 0;Mn.prototype.ruleId=void 0;Mn.prototype.source=void 0;const jp={}.hasOwnProperty,lM=new Map,oM=/[A-Z]/g,cM=new Set(["table","tbody","thead","tfoot","tr"]),uM=new Set(["td","th"]),_w="https://github.com/syntax-tree/hast-util-to-jsx-runtime";function dM(e,t){if(!t||t.Fragment===void 0)throw new TypeError("Expected `Fragment` in options");const r=t.filePath||void 0;let a;if(t.development){if(typeof t.jsxDEV!="function")throw new TypeError("Expected `jsxDEV` in options when `development: true`");a=yM(r,t.jsxDEV)}else{if(typeof t.jsx!="function")throw new TypeError("Expected `jsx` in production options");if(typeof t.jsxs!="function")throw new TypeError("Expected `jsxs` in production options");a=bM(r,t.jsx,t.jsxs)}const s={Fragment:t.Fragment,ancestors:[],components:t.components||{},create:a,elementAttributeNameCase:t.elementAttributeNameCase||"react",evaluater:t.createEvaluater?t.createEvaluater():void 0,filePath:r,ignoreInvalidStyle:t.ignoreInvalidStyle||!1,passKeys:t.passKeys!==!1,passNode:t.passNode||!1,schema:t.space==="svg"?Op:WA,stylePropertyNameCase:t.stylePropertyNameCase||"dom",tableCellAlignToStyle:t.tableCellAlignToStyle!==!1},o=ww(s,e,void 0);return o&&typeof o!="string"?o:s.create(e,s.Fragment,{children:o||void 0},void 0)}function ww(e,t,r){if(t.type==="element")return fM(e,t,r);if(t.type==="mdxFlowExpression"||t.type==="mdxTextExpression")return hM(e,t);if(t.type==="mdxJsxFlowElement"||t.type==="mdxJsxTextElement")return pM(e,t,r);if(t.type==="mdxjsEsm")return mM(e,t);if(t.type==="root")return gM(e,t,r);if(t.type==="text")return xM(e,t)}function fM(e,t,r){const a=e.schema;let s=a;t.tagName.toLowerCase()==="svg"&&a.space==="html"&&(s=Op,e.schema=s),e.ancestors.push(t);const o=Nw(e,t.tagName,!1),c=vM(e,t);let d=Lp(e,t);return cM.has(t.tagName)&&(d=d.filter(function(h){return typeof h=="string"?!qA(h):!0})),Ew(e,c,o,t),Dp(c,d),e.ancestors.pop(),e.schema=a,e.create(t,o,c,r)}function hM(e,t){if(t.data&&t.data.estree&&e.evaluater){const a=t.data.estree.body[0];return a.type,e.evaluater.evaluateExpression(a.expression)}xo(e,t.position)}function mM(e,t){if(t.data&&t.data.estree&&e.evaluater)return e.evaluater.evaluateProgram(t.data.estree);xo(e,t.position)}function pM(e,t,r){const a=e.schema;let s=a;t.name==="svg"&&a.space==="html"&&(s=Op,e.schema=s),e.ancestors.push(t);const o=t.name===null?e.Fragment:Nw(e,t.name,!0),c=_M(e,t),d=Lp(e,t);return Ew(e,c,o,t),Dp(c,d),e.ancestors.pop(),e.schema=a,e.create(t,o,c,r)}function gM(e,t,r){const a={};return Dp(a,Lp(e,t)),e.create(t,e.Fragment,a,r)}function xM(e,t){return t.value}function Ew(e,t,r,a){typeof r!="string"&&r!==e.Fragment&&e.passNode&&(t.node=a)}function Dp(e,t){if(t.length>0){const r=t.length>1?t:t[0];r&&(e.children=r)}}function bM(e,t,r){return a;function a(s,o,c,d){const f=Array.isArray(c.children)?r:t;return d?f(o,c,d):f(o,c)}}function yM(e,t){return r;function r(a,s,o,c){const d=Array.isArray(o.children),h=Rp(a);return t(s,o,c,d,{columnNumber:h?h.column-1:void 0,fileName:e,lineNumber:h?h.line:void 0},void 0)}}function vM(e,t){const r={};let a,s;for(s in t.properties)if(s!=="children"&&jp.call(t.properties,s)){const o=wM(e,s,t.properties[s]);if(o){const[c,d]=o;e.tableCellAlignToStyle&&c==="align"&&typeof d=="string"&&uM.has(t.tagName)?a=d:r[c]=d}}if(a){const o=r.style||(r.style={});o[e.stylePropertyNameCase==="css"?"text-align":"textAlign"]=a}return r}function _M(e,t){const r={};for(const a of t.attributes)if(a.type==="mdxJsxExpressionAttribute")if(a.data&&a.data.estree&&e.evaluater){const o=a.data.estree.body[0];o.type;const c=o.expression;c.type;const d=c.properties[0];d.type,Object.assign(r,e.evaluater.evaluateExpression(d.argument))}else xo(e,t.position);else{const s=a.name;let o;if(a.value&&typeof a.value=="object")if(a.value.data&&a.value.data.estree&&e.evaluater){const d=a.value.data.estree.body[0];d.type,o=e.evaluater.evaluateExpression(d.expression)}else xo(e,t.position);else o=a.value===null?!0:a.value;r[s]=o}return r}function Lp(e,t){const r=[];let a=-1;const s=e.passKeys?new Map:lM;for(;++as?0:s+t:t=t>s?s:t,r=r>0?r:0,a.length<1e4)c=Array.from(a),c.unshift(t,r),e.splice(...c);else for(r&&e.splice(t,r);o0?(ar(e,e.length,0,t),e):t}const Cy={}.hasOwnProperty;function kw(e){const t={};let r=-1;for(;++r13&&r<32||r>126&&r<160||r>55295&&r<57344||r>64975&&r<65008||(r&65535)===65535||(r&65535)===65534||r>1114111?"�":String.fromCodePoint(r)}function Dr(e){return e.replace(/[\t\n\r ]+/g," ").replace(/^ | $/g,"").toLowerCase().toUpperCase()}const Ln=pa(/[A-Za-z]/),An=pa(/[\dA-Za-z]/),OM=pa(/[#-'*+\--9=?A-Z^-~]/);function Su(e){return e!==null&&(e<32||e===127)}const Qm=pa(/\d/),RM=pa(/[\dA-Fa-f]/),jM=pa(/[!-/:-@[-`{-~]/);function Be(e){return e!==null&&e<-2}function Tt(e){return e!==null&&(e<0||e===32)}function tt(e){return e===-2||e===-1||e===32}const Yu=pa(new RegExp("\\p{P}|\\p{S}","u")),Va=pa(/\s/);function pa(e){return t;function t(r){return r!==null&&r>-1&&e.test(String.fromCharCode(r))}}function rl(e){const t=[];let r=-1,a=0,s=0;for(;++r55295&&o<57344){const d=e.charCodeAt(r+1);o<56320&&d>56319&&d<57344?(c=String.fromCharCode(o,d),s=1):c="�"}else c=String.fromCharCode(o);c&&(t.push(e.slice(a,r),encodeURIComponent(c)),a=r+s+1,c=""),s&&(r+=s,s=0)}return t.join("")+e.slice(a)}function ot(e,t,r,a){const s=a?a-1:Number.POSITIVE_INFINITY;let o=0;return c;function c(h){return tt(h)?(e.enter(r),d(h)):t(h)}function d(h){return tt(h)&&o++c))return;const H=t.events.length;let z=H,Y,j;for(;z--;)if(t.events[z][0]==="exit"&&t.events[z][1].type==="chunkFlow"){if(Y){j=t.events[z][1].end;break}Y=!0}for(w(a),R=H;RE;){const B=r[A];t.containerState=B[1],B[0].exit.call(t,e)}r.length=E}function C(){s.write([null]),o=void 0,s=void 0,t.containerState._closeFlow=void 0}}function BM(e,t,r){return ot(e,e.attempt(this.parser.constructs.document,t,r),"linePrefix",this.parser.constructs.disable.null.includes("codeIndented")?void 0:4)}function Xs(e){if(e===null||Tt(e)||Va(e))return 1;if(Yu(e))return 2}function Xu(e,t,r){const a=[];let s=-1;for(;++s1&&e[r][1].end.offset-e[r][1].start.offset>1?2:1;const g={...e[a][1].end},b={...e[r][1].start};Ay(g,-h),Ay(b,h),c={type:h>1?"strongSequence":"emphasisSequence",start:g,end:{...e[a][1].end}},d={type:h>1?"strongSequence":"emphasisSequence",start:{...e[r][1].start},end:b},o={type:h>1?"strongText":"emphasisText",start:{...e[a][1].end},end:{...e[r][1].start}},s={type:h>1?"strong":"emphasis",start:{...c.start},end:{...d.end}},e[a][1].end={...c.start},e[r][1].start={...d.end},f=[],e[a][1].end.offset-e[a][1].start.offset&&(f=xr(f,[["enter",e[a][1],t],["exit",e[a][1],t]])),f=xr(f,[["enter",s,t],["enter",c,t],["exit",c,t],["enter",o,t]]),f=xr(f,Xu(t.parser.constructs.insideSpan.null,e.slice(a+1,r),t)),f=xr(f,[["exit",o,t],["enter",d,t],["exit",d,t],["exit",s,t]]),e[r][1].end.offset-e[r][1].start.offset?(p=2,f=xr(f,[["enter",e[r][1],t],["exit",e[r][1],t]])):p=0,ar(e,a-1,r-a+3,f),r=a+f.length-p-2;break}}for(r=-1;++r0&&tt(R)?ot(e,C,"linePrefix",o+1)(R):C(R)}function C(R){return R===null||Be(R)?e.check(My,N,A)(R):(e.enter("codeFlowValue"),E(R))}function E(R){return R===null||Be(R)?(e.exit("codeFlowValue"),C(R)):(e.consume(R),E)}function A(R){return e.exit("codeFenced"),t(R)}function B(R,H,z){let Y=0;return j;function j($){return R.enter("lineEnding"),R.consume($),R.exit("lineEnding"),I}function I($){return R.enter("codeFencedFence"),tt($)?ot(R,Z,"linePrefix",a.parser.constructs.disable.null.includes("codeIndented")?void 0:4)($):Z($)}function Z($){return $===d?(R.enter("codeFencedFenceSequence"),P($)):z($)}function P($){return $===d?(Y++,R.consume($),P):Y>=c?(R.exit("codeFencedFenceSequence"),tt($)?ot(R,k,"whitespace")($):k($)):z($)}function k($){return $===null||Be($)?(R.exit("codeFencedFence"),H($)):z($)}}}function ZM(e,t,r){const a=this;return s;function s(c){return c===null?r(c):(e.enter("lineEnding"),e.consume(c),e.exit("lineEnding"),o)}function o(c){return a.parser.lazy[a.now().line]?r(c):t(c)}}const Eh={name:"codeIndented",tokenize:WM},QM={partial:!0,tokenize:JM};function WM(e,t,r){const a=this;return s;function s(f){return e.enter("codeIndented"),ot(e,o,"linePrefix",5)(f)}function o(f){const p=a.events[a.events.length-1];return p&&p[1].type==="linePrefix"&&p[2].sliceSerialize(p[1],!0).length>=4?c(f):r(f)}function c(f){return f===null?h(f):Be(f)?e.attempt(QM,c,h)(f):(e.enter("codeFlowValue"),d(f))}function d(f){return f===null||Be(f)?(e.exit("codeFlowValue"),c(f)):(e.consume(f),d)}function h(f){return e.exit("codeIndented"),t(f)}}function JM(e,t,r){const a=this;return s;function s(c){return a.parser.lazy[a.now().line]?r(c):Be(c)?(e.enter("lineEnding"),e.consume(c),e.exit("lineEnding"),s):ot(e,o,"linePrefix",5)(c)}function o(c){const d=a.events[a.events.length-1];return d&&d[1].type==="linePrefix"&&d[2].sliceSerialize(d[1],!0).length>=4?t(c):Be(c)?s(c):r(c)}}const e5={name:"codeText",previous:n5,resolve:t5,tokenize:r5};function t5(e){let t=e.length-4,r=3,a,s;if((e[r][1].type==="lineEnding"||e[r][1].type==="space")&&(e[t][1].type==="lineEnding"||e[t][1].type==="space")){for(a=r;++a=this.left.length+this.right.length)throw new RangeError("Cannot access index `"+t+"` in a splice buffer of size `"+(this.left.length+this.right.length)+"`");return tthis.left.length?this.right.slice(this.right.length-a+this.left.length,this.right.length-t+this.left.length).reverse():this.left.slice(t).concat(this.right.slice(this.right.length-a+this.left.length).reverse())}splice(t,r,a){const s=r||0;this.setCursor(Math.trunc(t));const o=this.right.splice(this.right.length-s,Number.POSITIVE_INFINITY);return a&&Jl(this.left,a),o.reverse()}pop(){return this.setCursor(Number.POSITIVE_INFINITY),this.left.pop()}push(t){this.setCursor(Number.POSITIVE_INFINITY),this.left.push(t)}pushMany(t){this.setCursor(Number.POSITIVE_INFINITY),Jl(this.left,t)}unshift(t){this.setCursor(0),this.right.push(t)}unshiftMany(t){this.setCursor(0),Jl(this.right,t.reverse())}setCursor(t){if(!(t===this.left.length||t>this.left.length&&this.right.length===0||t<0&&this.left.length===0))if(t=4?t(c):e.interrupt(a.parser.constructs.flow,r,t)(c)}}function Rw(e,t,r,a,s,o,c,d,h){const f=h||Number.POSITIVE_INFINITY;let p=0;return g;function g(w){return w===60?(e.enter(a),e.enter(s),e.enter(o),e.consume(w),e.exit(o),b):w===null||w===32||w===41||Su(w)?r(w):(e.enter(a),e.enter(c),e.enter(d),e.enter("chunkString",{contentType:"string"}),N(w))}function b(w){return w===62?(e.enter(o),e.consume(w),e.exit(o),e.exit(s),e.exit(a),t):(e.enter(d),e.enter("chunkString",{contentType:"string"}),y(w))}function y(w){return w===62?(e.exit("chunkString"),e.exit(d),b(w)):w===null||w===60||Be(w)?r(w):(e.consume(w),w===92?_:y)}function _(w){return w===60||w===62||w===92?(e.consume(w),y):y(w)}function N(w){return!p&&(w===null||w===41||Tt(w))?(e.exit("chunkString"),e.exit(d),e.exit(c),e.exit(a),t(w)):p999||y===null||y===91||y===93&&!h||y===94&&!d&&"_hiddenFootnoteSupport"in c.parser.constructs?r(y):y===93?(e.exit(o),e.enter(s),e.consume(y),e.exit(s),e.exit(a),t):Be(y)?(e.enter("lineEnding"),e.consume(y),e.exit("lineEnding"),p):(e.enter("chunkString",{contentType:"string"}),g(y))}function g(y){return y===null||y===91||y===93||Be(y)||d++>999?(e.exit("chunkString"),p(y)):(e.consume(y),h||(h=!tt(y)),y===92?b:g)}function b(y){return y===91||y===92||y===93?(e.consume(y),d++,g):g(y)}}function Dw(e,t,r,a,s,o){let c;return d;function d(b){return b===34||b===39||b===40?(e.enter(a),e.enter(s),e.consume(b),e.exit(s),c=b===40?41:b,h):r(b)}function h(b){return b===c?(e.enter(s),e.consume(b),e.exit(s),e.exit(a),t):(e.enter(o),f(b))}function f(b){return b===c?(e.exit(o),h(c)):b===null?r(b):Be(b)?(e.enter("lineEnding"),e.consume(b),e.exit("lineEnding"),ot(e,f,"linePrefix")):(e.enter("chunkString",{contentType:"string"}),p(b))}function p(b){return b===c||b===null||Be(b)?(e.exit("chunkString"),f(b)):(e.consume(b),b===92?g:p)}function g(b){return b===c||b===92?(e.consume(b),p):p(b)}}function co(e,t){let r;return a;function a(s){return Be(s)?(e.enter("lineEnding"),e.consume(s),e.exit("lineEnding"),r=!0,a):tt(s)?ot(e,a,r?"linePrefix":"lineSuffix")(s):t(s)}}const d5={name:"definition",tokenize:h5},f5={partial:!0,tokenize:m5};function h5(e,t,r){const a=this;let s;return o;function o(y){return e.enter("definition"),c(y)}function c(y){return jw.call(a,e,d,r,"definitionLabel","definitionLabelMarker","definitionLabelString")(y)}function d(y){return s=Dr(a.sliceSerialize(a.events[a.events.length-1][1]).slice(1,-1)),y===58?(e.enter("definitionMarker"),e.consume(y),e.exit("definitionMarker"),h):r(y)}function h(y){return Tt(y)?co(e,f)(y):f(y)}function f(y){return Rw(e,p,r,"definitionDestination","definitionDestinationLiteral","definitionDestinationLiteralMarker","definitionDestinationRaw","definitionDestinationString")(y)}function p(y){return e.attempt(f5,g,g)(y)}function g(y){return tt(y)?ot(e,b,"whitespace")(y):b(y)}function b(y){return y===null||Be(y)?(e.exit("definition"),a.parser.defined.push(s),t(y)):r(y)}}function m5(e,t,r){return a;function a(d){return Tt(d)?co(e,s)(d):r(d)}function s(d){return Dw(e,o,r,"definitionTitle","definitionTitleMarker","definitionTitleString")(d)}function o(d){return tt(d)?ot(e,c,"whitespace")(d):c(d)}function c(d){return d===null||Be(d)?t(d):r(d)}}const p5={name:"hardBreakEscape",tokenize:g5};function g5(e,t,r){return a;function a(o){return e.enter("hardBreakEscape"),e.consume(o),s}function s(o){return Be(o)?(e.exit("hardBreakEscape"),t(o)):r(o)}}const x5={name:"headingAtx",resolve:b5,tokenize:y5};function b5(e,t){let r=e.length-2,a=3,s,o;return e[a][1].type==="whitespace"&&(a+=2),r-2>a&&e[r][1].type==="whitespace"&&(r-=2),e[r][1].type==="atxHeadingSequence"&&(a===r-1||r-4>a&&e[r-2][1].type==="whitespace")&&(r-=a+1===r?2:4),r>a&&(s={type:"atxHeadingText",start:e[a][1].start,end:e[r][1].end},o={type:"chunkText",start:e[a][1].start,end:e[r][1].end,contentType:"text"},ar(e,a,r-a+1,[["enter",s,t],["enter",o,t],["exit",o,t],["exit",s,t]])),e}function y5(e,t,r){let a=0;return s;function s(p){return e.enter("atxHeading"),o(p)}function o(p){return e.enter("atxHeadingSequence"),c(p)}function c(p){return p===35&&a++<6?(e.consume(p),c):p===null||Tt(p)?(e.exit("atxHeadingSequence"),d(p)):r(p)}function d(p){return p===35?(e.enter("atxHeadingSequence"),h(p)):p===null||Be(p)?(e.exit("atxHeading"),t(p)):tt(p)?ot(e,d,"whitespace")(p):(e.enter("atxHeadingText"),f(p))}function h(p){return p===35?(e.consume(p),h):(e.exit("atxHeadingSequence"),d(p))}function f(p){return p===null||p===35||Tt(p)?(e.exit("atxHeadingText"),d(p)):(e.consume(p),f)}}const v5=["address","article","aside","base","basefont","blockquote","body","caption","center","col","colgroup","dd","details","dialog","dir","div","dl","dt","fieldset","figcaption","figure","footer","form","frame","frameset","h1","h2","h3","h4","h5","h6","head","header","hr","html","iframe","legend","li","link","main","menu","menuitem","nav","noframes","ol","optgroup","option","p","param","search","section","summary","table","tbody","td","tfoot","th","thead","title","tr","track","ul"],Ry=["pre","script","style","textarea"],_5={concrete:!0,name:"htmlFlow",resolveTo:N5,tokenize:S5},w5={partial:!0,tokenize:C5},E5={partial:!0,tokenize:k5};function N5(e){let t=e.length;for(;t--&&!(e[t][0]==="enter"&&e[t][1].type==="htmlFlow"););return t>1&&e[t-2][1].type==="linePrefix"&&(e[t][1].start=e[t-2][1].start,e[t+1][1].start=e[t-2][1].start,e.splice(t-2,2)),e}function S5(e,t,r){const a=this;let s,o,c,d,h;return f;function f(D){return p(D)}function p(D){return e.enter("htmlFlow"),e.enter("htmlFlowData"),e.consume(D),g}function g(D){return D===33?(e.consume(D),b):D===47?(e.consume(D),o=!0,N):D===63?(e.consume(D),s=3,a.interrupt?t:M):Ln(D)?(e.consume(D),c=String.fromCharCode(D),S):r(D)}function b(D){return D===45?(e.consume(D),s=2,y):D===91?(e.consume(D),s=5,d=0,_):Ln(D)?(e.consume(D),s=4,a.interrupt?t:M):r(D)}function y(D){return D===45?(e.consume(D),a.interrupt?t:M):r(D)}function _(D){const V="CDATA[";return D===V.charCodeAt(d++)?(e.consume(D),d===V.length?a.interrupt?t:Z:_):r(D)}function N(D){return Ln(D)?(e.consume(D),c=String.fromCharCode(D),S):r(D)}function S(D){if(D===null||D===47||D===62||Tt(D)){const V=D===47,q=c.toLowerCase();return!V&&!o&&Ry.includes(q)?(s=1,a.interrupt?t(D):Z(D)):v5.includes(c.toLowerCase())?(s=6,V?(e.consume(D),w):a.interrupt?t(D):Z(D)):(s=7,a.interrupt&&!a.parser.lazy[a.now().line]?r(D):o?C(D):E(D))}return D===45||An(D)?(e.consume(D),c+=String.fromCharCode(D),S):r(D)}function w(D){return D===62?(e.consume(D),a.interrupt?t:Z):r(D)}function C(D){return tt(D)?(e.consume(D),C):j(D)}function E(D){return D===47?(e.consume(D),j):D===58||D===95||Ln(D)?(e.consume(D),A):tt(D)?(e.consume(D),E):j(D)}function A(D){return D===45||D===46||D===58||D===95||An(D)?(e.consume(D),A):B(D)}function B(D){return D===61?(e.consume(D),R):tt(D)?(e.consume(D),B):E(D)}function R(D){return D===null||D===60||D===61||D===62||D===96?r(D):D===34||D===39?(e.consume(D),h=D,H):tt(D)?(e.consume(D),R):z(D)}function H(D){return D===h?(e.consume(D),h=null,Y):D===null||Be(D)?r(D):(e.consume(D),H)}function z(D){return D===null||D===34||D===39||D===47||D===60||D===61||D===62||D===96||Tt(D)?B(D):(e.consume(D),z)}function Y(D){return D===47||D===62||tt(D)?E(D):r(D)}function j(D){return D===62?(e.consume(D),I):r(D)}function I(D){return D===null||Be(D)?Z(D):tt(D)?(e.consume(D),I):r(D)}function Z(D){return D===45&&s===2?(e.consume(D),O):D===60&&s===1?(e.consume(D),U):D===62&&s===4?(e.consume(D),L):D===63&&s===3?(e.consume(D),M):D===93&&s===5?(e.consume(D),X):Be(D)&&(s===6||s===7)?(e.exit("htmlFlowData"),e.check(w5,F,P)(D)):D===null||Be(D)?(e.exit("htmlFlowData"),P(D)):(e.consume(D),Z)}function P(D){return e.check(E5,k,F)(D)}function k(D){return e.enter("lineEnding"),e.consume(D),e.exit("lineEnding"),$}function $(D){return D===null||Be(D)?P(D):(e.enter("htmlFlowData"),Z(D))}function O(D){return D===45?(e.consume(D),M):Z(D)}function U(D){return D===47?(e.consume(D),c="",K):Z(D)}function K(D){if(D===62){const V=c.toLowerCase();return Ry.includes(V)?(e.consume(D),L):Z(D)}return Ln(D)&&c.length<8?(e.consume(D),c+=String.fromCharCode(D),K):Z(D)}function X(D){return D===93?(e.consume(D),M):Z(D)}function M(D){return D===62?(e.consume(D),L):D===45&&s===2?(e.consume(D),M):Z(D)}function L(D){return D===null||Be(D)?(e.exit("htmlFlowData"),F(D)):(e.consume(D),L)}function F(D){return e.exit("htmlFlow"),t(D)}}function k5(e,t,r){const a=this;return s;function s(c){return Be(c)?(e.enter("lineEnding"),e.consume(c),e.exit("lineEnding"),o):r(c)}function o(c){return a.parser.lazy[a.now().line]?r(c):t(c)}}function C5(e,t,r){return a;function a(s){return e.enter("lineEnding"),e.consume(s),e.exit("lineEnding"),e.attempt(jo,t,r)}}const T5={name:"htmlText",tokenize:A5};function A5(e,t,r){const a=this;let s,o,c;return d;function d(M){return e.enter("htmlText"),e.enter("htmlTextData"),e.consume(M),h}function h(M){return M===33?(e.consume(M),f):M===47?(e.consume(M),B):M===63?(e.consume(M),E):Ln(M)?(e.consume(M),z):r(M)}function f(M){return M===45?(e.consume(M),p):M===91?(e.consume(M),o=0,_):Ln(M)?(e.consume(M),C):r(M)}function p(M){return M===45?(e.consume(M),y):r(M)}function g(M){return M===null?r(M):M===45?(e.consume(M),b):Be(M)?(c=g,U(M)):(e.consume(M),g)}function b(M){return M===45?(e.consume(M),y):g(M)}function y(M){return M===62?O(M):M===45?b(M):g(M)}function _(M){const L="CDATA[";return M===L.charCodeAt(o++)?(e.consume(M),o===L.length?N:_):r(M)}function N(M){return M===null?r(M):M===93?(e.consume(M),S):Be(M)?(c=N,U(M)):(e.consume(M),N)}function S(M){return M===93?(e.consume(M),w):N(M)}function w(M){return M===62?O(M):M===93?(e.consume(M),w):N(M)}function C(M){return M===null||M===62?O(M):Be(M)?(c=C,U(M)):(e.consume(M),C)}function E(M){return M===null?r(M):M===63?(e.consume(M),A):Be(M)?(c=E,U(M)):(e.consume(M),E)}function A(M){return M===62?O(M):E(M)}function B(M){return Ln(M)?(e.consume(M),R):r(M)}function R(M){return M===45||An(M)?(e.consume(M),R):H(M)}function H(M){return Be(M)?(c=H,U(M)):tt(M)?(e.consume(M),H):O(M)}function z(M){return M===45||An(M)?(e.consume(M),z):M===47||M===62||Tt(M)?Y(M):r(M)}function Y(M){return M===47?(e.consume(M),O):M===58||M===95||Ln(M)?(e.consume(M),j):Be(M)?(c=Y,U(M)):tt(M)?(e.consume(M),Y):O(M)}function j(M){return M===45||M===46||M===58||M===95||An(M)?(e.consume(M),j):I(M)}function I(M){return M===61?(e.consume(M),Z):Be(M)?(c=I,U(M)):tt(M)?(e.consume(M),I):Y(M)}function Z(M){return M===null||M===60||M===61||M===62||M===96?r(M):M===34||M===39?(e.consume(M),s=M,P):Be(M)?(c=Z,U(M)):tt(M)?(e.consume(M),Z):(e.consume(M),k)}function P(M){return M===s?(e.consume(M),s=void 0,$):M===null?r(M):Be(M)?(c=P,U(M)):(e.consume(M),P)}function k(M){return M===null||M===34||M===39||M===60||M===61||M===96?r(M):M===47||M===62||Tt(M)?Y(M):(e.consume(M),k)}function $(M){return M===47||M===62||Tt(M)?Y(M):r(M)}function O(M){return M===62?(e.consume(M),e.exit("htmlTextData"),e.exit("htmlText"),t):r(M)}function U(M){return e.exit("htmlTextData"),e.enter("lineEnding"),e.consume(M),e.exit("lineEnding"),K}function K(M){return tt(M)?ot(e,X,"linePrefix",a.parser.constructs.disable.null.includes("codeIndented")?void 0:4)(M):X(M)}function X(M){return e.enter("htmlTextData"),c(M)}}const Bp={name:"labelEnd",resolveAll:j5,resolveTo:D5,tokenize:L5},M5={tokenize:z5},O5={tokenize:I5},R5={tokenize:B5};function j5(e){let t=-1;const r=[];for(;++t=3&&(f===null||Be(f))?(e.exit("thematicBreak"),t(f)):r(f)}function h(f){return f===s?(e.consume(f),a++,h):(e.exit("thematicBreakSequence"),tt(f)?ot(e,d,"whitespace")(f):d(f))}}const Fn={continuation:{tokenize:X5},exit:Z5,name:"list",tokenize:Y5},G5={partial:!0,tokenize:Q5},V5={partial:!0,tokenize:K5};function Y5(e,t,r){const a=this,s=a.events[a.events.length-1];let o=s&&s[1].type==="linePrefix"?s[2].sliceSerialize(s[1],!0).length:0,c=0;return d;function d(y){const _=a.containerState.type||(y===42||y===43||y===45?"listUnordered":"listOrdered");if(_==="listUnordered"?!a.containerState.marker||y===a.containerState.marker:Qm(y)){if(a.containerState.type||(a.containerState.type=_,e.enter(_,{_container:!0})),_==="listUnordered")return e.enter("listItemPrefix"),y===42||y===45?e.check(xu,r,f)(y):f(y);if(!a.interrupt||y===49)return e.enter("listItemPrefix"),e.enter("listItemValue"),h(y)}return r(y)}function h(y){return Qm(y)&&++c<10?(e.consume(y),h):(!a.interrupt||c<2)&&(a.containerState.marker?y===a.containerState.marker:y===41||y===46)?(e.exit("listItemValue"),f(y)):r(y)}function f(y){return e.enter("listItemMarker"),e.consume(y),e.exit("listItemMarker"),a.containerState.marker=a.containerState.marker||y,e.check(jo,a.interrupt?r:p,e.attempt(G5,b,g))}function p(y){return a.containerState.initialBlankLine=!0,o++,b(y)}function g(y){return tt(y)?(e.enter("listItemPrefixWhitespace"),e.consume(y),e.exit("listItemPrefixWhitespace"),b):r(y)}function b(y){return a.containerState.size=o+a.sliceSerialize(e.exit("listItemPrefix"),!0).length,t(y)}}function X5(e,t,r){const a=this;return a.containerState._closeFlow=void 0,e.check(jo,s,o);function s(d){return a.containerState.furtherBlankLines=a.containerState.furtherBlankLines||a.containerState.initialBlankLine,ot(e,t,"listItemIndent",a.containerState.size+1)(d)}function o(d){return a.containerState.furtherBlankLines||!tt(d)?(a.containerState.furtherBlankLines=void 0,a.containerState.initialBlankLine=void 0,c(d)):(a.containerState.furtherBlankLines=void 0,a.containerState.initialBlankLine=void 0,e.attempt(V5,t,c)(d))}function c(d){return a.containerState._closeFlow=!0,a.interrupt=void 0,ot(e,e.attempt(Fn,t,r),"linePrefix",a.parser.constructs.disable.null.includes("codeIndented")?void 0:4)(d)}}function K5(e,t,r){const a=this;return ot(e,s,"listItemIndent",a.containerState.size+1);function s(o){const c=a.events[a.events.length-1];return c&&c[1].type==="listItemIndent"&&c[2].sliceSerialize(c[1],!0).length===a.containerState.size?t(o):r(o)}}function Z5(e){e.exit(this.containerState.type)}function Q5(e,t,r){const a=this;return ot(e,s,"listItemPrefixWhitespace",a.parser.constructs.disable.null.includes("codeIndented")?void 0:5);function s(o){const c=a.events[a.events.length-1];return!tt(o)&&c&&c[1].type==="listItemPrefixWhitespace"?t(o):r(o)}}const jy={name:"setextUnderline",resolveTo:W5,tokenize:J5};function W5(e,t){let r=e.length,a,s,o;for(;r--;)if(e[r][0]==="enter"){if(e[r][1].type==="content"){a=r;break}e[r][1].type==="paragraph"&&(s=r)}else e[r][1].type==="content"&&e.splice(r,1),!o&&e[r][1].type==="definition"&&(o=r);const c={type:"setextHeading",start:{...e[a][1].start},end:{...e[e.length-1][1].end}};return e[s][1].type="setextHeadingText",o?(e.splice(s,0,["enter",c,t]),e.splice(o+1,0,["exit",e[a][1],t]),e[a][1].end={...e[o][1].end}):e[a][1]=c,e.push(["exit",c,t]),e}function J5(e,t,r){const a=this;let s;return o;function o(f){let p=a.events.length,g;for(;p--;)if(a.events[p][1].type!=="lineEnding"&&a.events[p][1].type!=="linePrefix"&&a.events[p][1].type!=="content"){g=a.events[p][1].type==="paragraph";break}return!a.parser.lazy[a.now().line]&&(a.interrupt||g)?(e.enter("setextHeadingLine"),s=f,c(f)):r(f)}function c(f){return e.enter("setextHeadingLineSequence"),d(f)}function d(f){return f===s?(e.consume(f),d):(e.exit("setextHeadingLineSequence"),tt(f)?ot(e,h,"lineSuffix")(f):h(f))}function h(f){return f===null||Be(f)?(e.exit("setextHeadingLine"),t(f)):r(f)}}const eO={tokenize:tO};function tO(e){const t=this,r=e.attempt(jo,a,e.attempt(this.parser.constructs.flowInitial,s,ot(e,e.attempt(this.parser.constructs.flow,s,e.attempt(s5,s)),"linePrefix")));return r;function a(o){if(o===null){e.consume(o);return}return e.enter("lineEndingBlank"),e.consume(o),e.exit("lineEndingBlank"),t.currentConstruct=void 0,r}function s(o){if(o===null){e.consume(o);return}return e.enter("lineEnding"),e.consume(o),e.exit("lineEnding"),t.currentConstruct=void 0,r}}const nO={resolveAll:zw()},rO=Lw("string"),iO=Lw("text");function Lw(e){return{resolveAll:zw(e==="text"?aO:void 0),tokenize:t};function t(r){const a=this,s=this.parser.constructs[e],o=r.attempt(s,c,d);return c;function c(p){return f(p)?o(p):d(p)}function d(p){if(p===null){r.consume(p);return}return r.enter("data"),r.consume(p),h}function h(p){return f(p)?(r.exit("data"),o(p)):(r.consume(p),h)}function f(p){if(p===null)return!0;const g=s[p];let b=-1;if(g)for(;++b-1){const d=c[0];typeof d=="string"?c[0]=d.slice(a):c.shift()}o>0&&c.push(e[s].slice(0,o))}return c}function bO(e,t){let r=-1;const a=[];let s;for(;++r