"#,
+ ))
+ .into_response();
+ }
+
+ let short = &pubkey[..16];
+ let body = format!(
+ r#"
+
Enroll this device?
+
Label{label}
+
Pubkey{short}...
+
+ Confirming adds this X25519 public key to this agent's trust list. A
+ client holding the matching private key can open Noise_IK sessions to this
+ enclave. Revoke with DELETE /api/v1/devices/<pubkey>.
+
+"#,
+ label = html::escape(&label),
+ short = html::escape(short),
+ pubkey_js = serde_json::to_string(&pubkey).unwrap_or_else(|_| "\"\"".into()),
+ label_js = serde_json::to_string(&label).unwrap_or_else(|_| "\"\"".into()),
+ );
+
+ Html(shell("Enroll device", "", &body)).into_response()
+}
+
#[derive(Debug, Deserialize)]
struct AttachQuery {
tail: Option,
diff --git a/src/cf.rs b/src/cf.rs
index ba3d994..a827a59 100644
--- a/src/cf.rs
+++ b/src/cf.rs
@@ -506,7 +506,6 @@ pub async fn delete_cp_access_apps(
[
"/health",
"/api/agents",
- "/api/v1/devices/trusted",
"/api/v1/admin/export",
"/noise/ws",
"/register",
@@ -533,7 +532,7 @@ pub async fn delete_cp_access_apps(
/// - `{agent}.{domain}/owner` — fleet-GH-OIDC-gated in code
/// - `{agent}.{domain}/logs/*` — GH-OIDC-gated in code
/// - `{agent}.{domain}/noise/ws` — Noise_IK-gated in code
-/// against the CP-trusted paired device pubkey set
+/// against the agent-local paired device pubkey set
/// - `{label}.{agent}.{domain}` — workload URL, DD/agent-owned
pub async fn delete_agent_access_apps(
http: &Client,
diff --git a/src/config.rs b/src/config.rs
index 5d49d79..cdb0e4e 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -168,9 +168,6 @@ pub struct Cp {
pub scraper_shard_index: u64,
pub scraper_shard_total: u64,
pub ita: Ita,
- /// Source-of-truth file for the device registry (JSON). Survives
- /// CP restart; mutations fsync through to disk.
- pub devices_path: std::path::PathBuf,
/// Where the Noise gateway persists its X25519 static private key
/// (tmpfs). Fresh per-boot when missing.
pub noise_key_path: std::path::PathBuf,
@@ -207,17 +204,6 @@ impl Cp {
"DD_SCRAPER_SHARD_INDEX ({scraper_shard_index}) must be less than DD_SCRAPER_SHARD_TOTAL ({scraper_shard_total})"
)));
}
- // `/tmp/` (tmpfs) is the only universally-writable path in the
- // EE workload sandbox — the root FS is RO, and `/var/lib/` +
- // `/data/` are both unavailable on the CP VM (no mount-data
- // in the CP boot set; root FS read-only for workloads).
- // Ephemeral across CP restarts is OK: the zero-downtime
- // boot hydrates devices from the predecessor CP via
- // `/api/v1/admin/export` before flipping DNS, so the on-disk
- // copy is a cache, not source of truth.
- let devices_path = std::env::var("DD_CP_DEVICES_PATH")
- .unwrap_or_else(|_| "/tmp/devopsdefender/devices.json".into())
- .into();
let noise_key_path = std::env::var("DD_NOISE_KEY_PATH")
.unwrap_or_else(|_| "/run/devopsdefender/noise.key".into())
.into();
@@ -232,7 +218,6 @@ impl Cp {
scraper_shard_index,
scraper_shard_total,
ita,
- devices_path,
noise_key_path,
})
}
@@ -285,6 +270,9 @@ pub struct Agent {
/// third parties that the code is sealed. Backward-compatible:
/// unset = default (mutation endpoints enabled).
pub confidential: bool,
+ /// Source-of-truth file for paired-device pubkeys enforced by this
+ /// agent's Noise gateway.
+ pub devices_path: std::path::PathBuf,
/// Read-only oracle endpoints baked into the boot workload set.
/// `apps/_infra/local-agents.sh` extracts DD-level `oracle`
/// metadata from workload JSON and injects it here as base64 JSON
@@ -310,6 +298,9 @@ impl Agent {
.unwrap_or_else(|_| "/var/lib/easyenclave/agent.sock".into());
let extra_ingress = parse_extra_ingress()?;
let confidential = parse_truthy("DD_CONFIDENTIAL");
+ let devices_path = std::env::var("DD_AGENT_DEVICES_PATH")
+ .unwrap_or_else(|_| "/var/lib/easyenclave/data/dd-agent/devices.json".into())
+ .into();
let oracles = parse_oracles()?;
let ita = Ita::from_env(&common.env_label)?;
Ok(Self {
@@ -320,6 +311,7 @@ impl Agent {
auth,
extra_ingress,
confidential,
+ devices_path,
oracles,
})
}
diff --git a/src/cp.rs b/src/cp.rs
index f8213e8..a9d70f4 100644
--- a/src/cp.rs
+++ b/src/cp.rs
@@ -14,7 +14,7 @@ use std::time::{Duration, Instant};
use axum::extract::{Path, Query, State};
use axum::http::{HeaderMap, Uri};
-use axum::response::{Html, IntoResponse, Response};
+use axum::response::{Html, IntoResponse, Redirect, Response};
use axum::routing::{get, post};
use axum::{Json, Router};
use serde::Deserialize;
@@ -54,9 +54,6 @@ struct St {
/// GH OIDC verifier for `/api/agents` callers (CI, humans). Same
/// audience as dd-agent, shared owner claim.
gh: Arc,
- /// Paired device pubkeys. Mutations persist to disk and emit a
- /// runtime view for the local ee-proxy workload.
- devices: Arc,
/// TDX-quote + Noise-static-pubkey bundle. Surfaced by `/health`
/// as `{ noise: { quote_b64, pubkey_hex } }` so a bastion-app
/// bootstraps in one fetch (the former standalone `/attest`
@@ -139,9 +136,6 @@ pub async fn run() -> Result<()> {
// hostname at all.
let store: Store = Arc::new(Mutex::new(HashMap::new()));
let trust = noise_gateway::new_trust_handle();
- let devices = crate::devices::Store::load(cfg.devices_path.clone(), trust.clone())
- .await
- .map_err(|e| Error::Internal(format!("devices store load: {e}")))?;
let predecessor_prefix = cf::cp_prefix(&cfg.common.env_label);
let has_predecessor = match cf::list(&http, &cfg.cf).await {
Ok(tunnels) => tunnels.iter().any(|t| {
@@ -159,7 +153,7 @@ pub async fn run() -> Result<()> {
}
};
if has_predecessor {
- hydrate_from_peer(&http, &cfg.hostname, &initial_token, &devices, &store).await;
+ hydrate_from_peer(&http, &cfg.hostname, &initial_token, &store).await;
} else {
eprintln!("cp: no predecessor {predecessor_prefix}* tunnel — skipping hydrate (fresh env)");
}
@@ -336,8 +330,8 @@ pub async fn run() -> Result<()> {
let gh = crate::gh_oidc::Verifier::new(cfg.common.owner.clone(), "dd-agent".into());
- // Noise gateway state. `devices` already loaded in Stage 2 + any
- // inherited records merged in; `trust` is already populated.
+ // CP serves its attested Noise key for management methods, but it does not
+ // own paired-device trust for shell sessions.
let attestor = Arc::new(
noise_gateway::attest::Attestor::load_or_mint(&cfg.noise_key_path)
.await
@@ -365,7 +359,6 @@ pub async fn run() -> Result<()> {
verifier,
cp_ita_token,
gh,
- devices,
attest: attestor,
};
@@ -379,12 +372,6 @@ pub async fn run() -> Result<()> {
.route("/agent/{id}", get(agent_detail))
.route("/agent/{id}/logs/{app}", get(agent_logs))
.route("/api/agents", get(api_agents))
- .route("/api/v1/devices", post(create_device))
- .route("/api/v1/devices/trusted", get(list_trusted_devices))
- .route(
- "/api/v1/devices/{pubkey}",
- axum::routing::delete(revoke_device),
- )
.route("/api/v1/admin/export", get(export_state))
.route("/admin/enroll", get(enroll_page))
.with_state(state)
@@ -436,8 +423,8 @@ fn spawn_cloudflared(token: String) {
});
}
-/// Try to pull devices + agent snapshot from a predecessor CP still
-/// serving at `hostname`. The CNAME hasn't flipped yet when this runs,
+/// Try to pull an agent snapshot from a predecessor CP still serving
+/// at `hostname`. The CNAME hasn't flipped yet when this runs,
/// so any existing DNS record still points at the old CP's tunnel.
/// Failures (first boot, DNS miss, old code, timeout) are logged and
/// swallowed — deploy still proceeds as if fresh.
@@ -445,7 +432,6 @@ async fn hydrate_from_peer(
http: &reqwest::Client,
hostname: &str,
ita_token: &str,
- devices: &crate::devices::Store,
agents: &Store,
) {
let url = format!("https://{hostname}/api/v1/admin/export");
@@ -475,21 +461,6 @@ async fn hydrate_from_peer(
}
};
- let mut imported_devices = 0usize;
- if let Some(arr) = body.get("devices").cloned() {
- match serde_json::from_value::>(arr) {
- Ok(devs) => {
- let n = devs.len();
- if let Err(e) = devices.import_merge(devs).await {
- eprintln!("cp: hydrate devices.import_merge: {e}");
- } else {
- imported_devices = n;
- }
- }
- Err(e) => eprintln!("cp: hydrate devices shape mismatch: {e}"),
- }
- }
-
let mut imported_agents = 0usize;
if let Some(arr) = body.get("agents").cloned() {
match serde_json::from_value::>(arr) {
@@ -504,9 +475,7 @@ async fn hydrate_from_peer(
}
}
- eprintln!(
- "cp: hydrated from {hostname} — {imported_devices} device(s), {imported_agents} agent(s)"
- );
+ eprintln!("cp: hydrated from {hostname} — {imported_agents} agent(s)");
}
// ── Routes ──────────────────────────────────────────────────────────────
@@ -992,20 +961,17 @@ async fn fleet(State(s): State, headers: HeaderMap, uri: Uri) -> Response {
.into_response()
}
-// ── Devices API ─────────────────────────────────────────────────────────
+// ── Enrollment broker ───────────────────────────────────────────────────
//
-// Paired client-device X25519 pubkeys that the local Noise gateway
-// accepts during the handshake. POST + DELETE are behind DD browser
-// auth (admin enrollment); the machine-readable `/trusted` view is
-// gated in-code for cross-VM agent polls.
+// CP keeps enrollment stateless: it authenticates the browser and redirects
+// to a read-write agent. The agent stores and enforces paired-device trust.
/// GET /api/v1/admin/export — full state snapshot for a successor CP
-/// to hydrate from during a zero-downtime deploy. Returns the
-/// device registry (full records, including revoked) and the live
+/// to hydrate from during a zero-downtime deploy. Returns the live
/// agents HashMap. Gated in-code by a valid owner-scoped ITA Bearer
-/// (any attested enclave in the
-/// fleet can authenticate). The new CP calls this against the old
-/// CP's still-pointed DNS before flipping CNAMEs.
+/// (any attested enclave in the fleet can authenticate). The new CP
+/// calls this against the old CP's still-pointed DNS before flipping
+/// CNAMEs.
async fn export_state(
State(s): State,
headers: axum::http::HeaderMap,
@@ -1019,110 +985,16 @@ async fn export_state(
// MRTD list once we stop rotating measurements every dev push.
let _ = s.verifier.verify(bearer).await?;
- let devices = s.devices.export_full().await;
let agents: Vec = s.store.lock().await.values().cloned().collect();
Ok(Json(serde_json::json!({
- "devices": devices,
"agents": agents,
})))
}
-/// GET /api/v1/devices/trusted — minimal, machine-readable view:
-/// `{ "pubkeys": ["", ...] }` with only currently-trusted keys.
-/// Reachable by cross-VM dd-agent callers over the public tunnel;
-/// gated in-code by the same three-way policy as
-/// `/api/agents`. This is the agent's poll target for mirroring the
-/// trust list into its in-memory `TrustHandle`.
-async fn list_trusted_devices(
- State(s): State,
- axum::extract::ConnectInfo(peer): axum::extract::ConnectInfo,
- headers: axum::http::HeaderMap,
-) -> Result> {
- if !agents_auth_ok(&s, peer, &headers).await {
- return Err(Error::Unauthorized);
- }
- let devices = s.devices.list().await;
- let pubkeys: Vec = devices
- .into_iter()
- .filter(|d| d.revoked_at_ms.is_none())
- .map(|d| d.pubkey)
- .collect();
- Ok(Json(serde_json::json!({ "pubkeys": pubkeys })))
-}
-
-#[derive(Debug, Deserialize)]
-struct CreateDeviceReq {
- pubkey: String,
- label: String,
-}
-
-/// POST /api/v1/devices — enroll a device pubkey. Idempotent on
-/// pubkey: re-posting with a new label replaces the record in place.
-async fn create_device(
- State(s): State,
- headers: HeaderMap,
- uri: Uri,
- Json(req): Json,
-) -> Result<(axum::http::StatusCode, Json)> {
- if require_browser_auth(&s, &headers, &uri).is_some() {
- return Err(Error::Unauthorized);
- }
- let pubkey = req.pubkey.to_lowercase();
- crate::devices::validate_hex_pubkey(&pubkey).map_err(|e| Error::BadRequest(e.to_string()))?;
- let label = req.label.trim().to_string();
- if label.is_empty() || label.len() > 128 {
- return Err(Error::BadRequest("label must be 1..=128 chars".into()));
- }
- let device = crate::devices::Device {
- pubkey,
- label,
- created_at_ms: chrono::Utc::now().timestamp_millis(),
- revoked_at_ms: None,
- };
- s.devices
- .upsert(device.clone())
- .await
- .map_err(|e| Error::Internal(format!("devices upsert: {e}")))?;
- Ok((axum::http::StatusCode::CREATED, Json(device)))
-}
-
-/// DELETE /api/v1/devices/{pubkey} — revoke. Returns 404 if the
-/// pubkey isn't known or was already revoked.
-async fn revoke_device(
- State(s): State,
- headers: HeaderMap,
- uri: Uri,
- Path(pubkey): Path,
-) -> Result> {
- if require_browser_auth(&s, &headers, &uri).is_some() {
- return Err(Error::Unauthorized);
- }
- let pubkey = pubkey.to_lowercase();
- let now = chrono::Utc::now().timestamp_millis();
- let ok = s
- .devices
- .revoke(&pubkey, now)
- .await
- .map_err(|e| Error::Internal(format!("devices revoke: {e}")))?;
- if !ok {
- return Err(Error::NotFound);
- }
- Ok(Json(serde_json::json!({
- "revoked": pubkey,
- "at_ms": now,
- })))
-}
-
/// GET /admin/enroll?pubkey=…&label=… — human-facing confirmation
-/// page that a `bastion-app` (CLI or desktop) bounces the operator
-/// to. Behind DD browser auth: by the time this handler renders, the
-/// browser has a valid DD session cookie. The rendered page POSTs to `/api/v1/devices` with the
-/// same cookie via `credentials: "same-origin"`, completing the
-/// enrollment that headless clients can't do themselves.
-///
-/// Intent-over-GET: we deliberately don't enroll on page load —
-/// the user clicks Confirm so a copy-pasted link can't silently
-/// add a pubkey.
+/// broker. CP does not store paired-device trust; it redirects the
+/// authenticated browser to a healthy read-write agent, where the
+/// agent-local enrollment page performs the mutation.
async fn enroll_page(
State(s): State,
headers: HeaderMap,
@@ -1155,61 +1027,26 @@ async fn enroll_page(
.into_response();
}
- let short = &pubkey[..16];
- let body = format!(
- r#"
-
Enroll this device?
-
Label{label}
-
Pubkey{short}…
-
- Confirming adds this X25519 public key to the trust list. Every
- DD agent mirrors that list within 30 s; thereafter, a client
- holding the matching private key can open Noise_IK sessions to
- any enclave in the fleet. Revoke any time with
- DELETE /api/v1/devices/<pubkey>.
-
"#,
+ ))
+ .into_response();
+ };
+ let url = format!(
+ "https://{}/admin/enroll?pubkey={}&label={}",
+ agent.hostname,
+ urlencoding::encode(&pubkey),
+ urlencoding::encode(&label),
);
-
- Html(shell("Enroll device", "", &body)).into_response()
+ Redirect::temporary(&url).into_response()
}
/// GET /api/agents — JSON list of
diff --git a/src/devices.rs b/src/devices.rs
index baa6f27..3b9110a 100644
--- a/src/devices.rs
+++ b/src/devices.rs
@@ -1,11 +1,12 @@
//! Device pubkey registry.
//!
-//! Holds the X25519 pubkeys of paired client devices. Source of truth
-//! lives on the CP's disk at [`Store::path`] (JSON, pretty-printed for
-//! human editability in a pinch). The live set of *non-revoked*
-//! pubkeys is also mirrored into a [`noise_gateway::TrustHandle`] so
-//! the locally-running Noise gateway can read it directly from shared
-//! memory — no on-disk runtime view, no cross-process file contract.
+//! Holds the X25519 pubkeys of paired client devices. The store lives
+//! next to the process that enforces trust, normally `dd-agent`
+//! (JSON, pretty-printed for human editability in a pinch). The live
+//! set of *non-revoked* pubkeys is mirrored into a
+//! [`noise_gateway::TrustHandle`] so the locally-running Noise gateway
+//! can read it directly from shared memory — no on-disk runtime view,
+//! no cross-process file contract.
//!
//! Wire format on disk:
//! ```json
diff --git a/src/noise_gateway/mod.rs b/src/noise_gateway/mod.rs
index fc45976..bfa0c63 100644
--- a/src/noise_gateway/mod.rs
+++ b/src/noise_gateway/mod.rs
@@ -32,8 +32,7 @@ use axum::Router;
use tokio::sync::RwLock;
/// Live set of device pubkeys the local Noise responder will accept.
-/// Mutated by `devices::Store` (on the CP) or by the agent's
-/// `sync_trusted_devices` poll loop.
+/// Mutated by the local `devices::Store` next to the process enforcing trust.
pub type TrustHandle = Arc>>;
pub fn new_trust_handle() -> TrustHandle {
From 35f97504d775414f138e8cc50a5ec2d5a5c3aa83 Mon Sep 17 00:00:00 2001
From: Alex Newman
Date: Sun, 10 May 2026 13:55:36 +0000
Subject: [PATCH 07/13] Remove CP Noise gateway surface
---
docs/sessiond-central-ui-plan.md | 6 ++--
src/cf.rs | 4 +--
src/config.rs | 7 -----
src/cp.rs | 48 ++------------------------------
4 files changed, 5 insertions(+), 60 deletions(-)
diff --git a/docs/sessiond-central-ui-plan.md b/docs/sessiond-central-ui-plan.md
index ce80db3..f6b2e3b 100644
--- a/docs/sessiond-central-ui-plan.md
+++ b/docs/sessiond-central-ui-plan.md
@@ -156,8 +156,8 @@ Implemented first slice:
session into encrypted raw PTY byte streaming to local `dd-sessiond`.
- Native `exec`, `replay`, `resize`, and `close` commands exercise the same
direct Noise path as `shell`.
-- CP Noise endpoints reject shell methods because they have no local sessiond
- adapter; agent Noise endpoints wire the adapter in.
+- CP does not run the client Noise gateway. Agent Noise endpoints wire the
+ sessiond adapter in.
- The native CLI appraises the agent quote with Intel Trust Authority by
default and requires an explicit insecure flag for local preview/dev.
@@ -202,8 +202,6 @@ direct Noise, remove the old shell stack in this order:
Keep these pieces:
- `dd-sessiond` and its local-only API. It is the session owner, not a fallback.
-- `shell_unavailable` on CP Noise endpoints. It is an explicit rejection for a
- process that intentionally has no local sessiond.
- CP route discovery and enrollment brokering. CP stays in the trust/control
path, not the shell data path or shell state path.
diff --git a/src/cf.rs b/src/cf.rs
index a827a59..c0b4ce1 100644
--- a/src/cf.rs
+++ b/src/cf.rs
@@ -484,9 +484,8 @@ async fn delete_access_apps_for_domains(
/// - `{hostname}` — dashboard, app-layer GitHub auth
/// - `{hostname}-shell` — dd-shell, app-layer GitHub auth
/// - `{hostname}/health` — public (read-only fleet health;
-/// also carries the Noise pre-handshake `{quote_b64, pubkey_hex}`)
+/// CP does not expose shell/client Noise)
/// - `{hostname}/api/agents` — read-only agent list
-/// - `{hostname}/noise/ws` — Noise_IK-gated in code
/// - `{hostname}/register` — ITA-gated in code
/// - `{hostname}/ingress/replace` — ITA-gated in code
pub async fn delete_cp_access_apps(
@@ -507,7 +506,6 @@ pub async fn delete_cp_access_apps(
"/health",
"/api/agents",
"/api/v1/admin/export",
- "/noise/ws",
"/register",
"/ingress/replace",
// Legacy route from the old two-step Noise pre-handshake.
diff --git a/src/config.rs b/src/config.rs
index cdb0e4e..8a107cc 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -168,9 +168,6 @@ pub struct Cp {
pub scraper_shard_index: u64,
pub scraper_shard_total: u64,
pub ita: Ita,
- /// Where the Noise gateway persists its X25519 static private key
- /// (tmpfs). Fresh per-boot when missing.
- pub noise_key_path: std::path::PathBuf,
}
impl Cp {
@@ -204,9 +201,6 @@ impl Cp {
"DD_SCRAPER_SHARD_INDEX ({scraper_shard_index}) must be less than DD_SCRAPER_SHARD_TOTAL ({scraper_shard_total})"
)));
}
- let noise_key_path = std::env::var("DD_NOISE_KEY_PATH")
- .unwrap_or_else(|_| "/run/devopsdefender/noise.key".into())
- .into();
let ita = Ita::from_env(&common.env_label)?;
Ok(Self {
common,
@@ -218,7 +212,6 @@ impl Cp {
scraper_shard_index,
scraper_shard_total,
ita,
- noise_key_path,
})
}
}
diff --git a/src/cp.rs b/src/cp.rs
index a9d70f4..52e2143 100644
--- a/src/cp.rs
+++ b/src/cp.rs
@@ -29,7 +29,6 @@ use crate::error::{Error, Result};
use crate::html::{self, shell};
use crate::ita;
use crate::metrics;
-use crate::noise_gateway;
use crate::stonith;
use crate::taint::IntegrityState;
use crate::units::{AgentMode, UnitKind};
@@ -54,13 +53,6 @@ struct St {
/// GH OIDC verifier for `/api/agents` callers (CI, humans). Same
/// audience as dd-agent, shared owner claim.
gh: Arc,
- /// TDX-quote + Noise-static-pubkey bundle. Surfaced by `/health`
- /// as `{ noise: { quote_b64, pubkey_hex } }` so a bastion-app
- /// bootstraps in one fetch (the former standalone `/attest`
- /// endpoint was folded in). Shared `Arc` with the Noise gateway
- /// module's handshake responder — one keypair / one quote per
- /// boot.
- attest: Arc,
}
pub async fn run() -> Result<()> {
@@ -135,7 +127,6 @@ pub async fn run() -> Result<()> {
// safe to run unconditionally — it doesn't touch the poisonable
// hostname at all.
let store: Store = Arc::new(Mutex::new(HashMap::new()));
- let trust = noise_gateway::new_trust_handle();
let predecessor_prefix = cf::cp_prefix(&cfg.common.env_label);
let has_predecessor = match cf::list(&http, &cfg.cf).await {
Ok(tunnels) => tunnels.iter().any(|t| {
@@ -330,26 +321,6 @@ pub async fn run() -> Result<()> {
let gh = crate::gh_oidc::Verifier::new(cfg.common.owner.clone(), "dd-agent".into());
- // CP serves its attested Noise key for management methods, but it does not
- // own paired-device trust for shell sessions.
- let attestor = Arc::new(
- noise_gateway::attest::Attestor::load_or_mint(&cfg.noise_key_path)
- .await
- .map_err(|e| Error::Internal(format!("noise keypair: {e}")))?,
- );
- eprintln!("cp: noise_pubkey={}", hex::encode(attestor.public_key()));
- let ee_token = std::env::var("EE_TOKEN").ok();
- let upstream = Arc::new(noise_gateway::upstream::EeAgent::new(
- std::path::PathBuf::from(noise_gateway::upstream::DEFAULT_EE_AGENT_SOCK),
- ee_token,
- ));
- let ng_state = noise_gateway::State {
- attest: attestor.clone(),
- trust: trust.clone(),
- upstream,
- shell: None,
- };
-
let state = St {
cfg: cfg.clone(),
ee,
@@ -359,7 +330,6 @@ pub async fn run() -> Result<()> {
verifier,
cp_ita_token,
gh,
- attest: attestor,
};
let app = Router::new()
@@ -374,8 +344,7 @@ pub async fn run() -> Result<()> {
.route("/api/agents", get(api_agents))
.route("/api/v1/admin/export", get(export_state))
.route("/admin/enroll", get(enroll_page))
- .with_state(state)
- .merge(noise_gateway::router(ng_state));
+ .with_state(state);
let addr = format!("0.0.0.0:{}", cfg.common.port);
eprintln!("cp: listening on {addr}");
@@ -484,7 +453,6 @@ async fn health(
State(s): State,
Query(q): Query>,
) -> Json {
- use base64::Engine as _;
let agents = s.store.lock().await;
let mut body = serde_json::json!({
"ok": true,
@@ -496,21 +464,9 @@ async fn health(
"agent_count": agents.len(),
"healthy_count": agents.values().filter(|a| a.status == "healthy").count(),
"oracle_count": agents.values().map(|a| a.oracles.len()).sum::(),
- // Pre-Noise-handshake bundle — the former `GET /attest`
- // endpoint folded in here so bastion-app bootstraps in one
- // fetch and keep Cloudflare routing app count lower. Stable
- // per boot; `Arc` clones are effectively free
- // per request. `quote_b64` binds the raw Noise pubkey into
- // TDX `report_data`, self-authenticating via ITA.
- "noise": {
- "quote_b64": base64::engine::general_purpose::STANDARD.encode(s.attest.quote()),
- "pubkey_hex": hex::encode(s.attest.public_key()),
- },
});
// `?verbose=1` folds in the CP's current ITA token so operators
- // can inspect the CP VM's TDX measurement without a second route
- // (the old `/cp/ita` + `/cp/attest` paths were removed; the
- // TDX quote for the Noise pubkey is also above, unconditionally).
+ // can inspect the CP VM's TDX measurement without a second route.
if q.get("verbose").map(|v| v.as_str()) == Some("1") {
if let Some(obj) = body.as_object_mut() {
obj.insert(
From f1d56a6542154a98d10243fa30b10c213b7add4b Mon Sep 17 00:00:00 2001
From: Alex Newman
Date: Sun, 10 May 2026 13:56:58 +0000
Subject: [PATCH 08/13] Require sessiond for Noise shell methods
---
src/agent.rs | 2 +-
src/noise_gateway/mod.rs | 2 +-
src/noise_gateway/noise.rs | 20 ++------------------
3 files changed, 4 insertions(+), 20 deletions(-)
diff --git a/src/agent.rs b/src/agent.rs
index 9f92f5f..a35c87c 100644
--- a/src/agent.rs
+++ b/src/agent.rs
@@ -192,7 +192,7 @@ pub async fn run() -> Result<()> {
attest: attestor.clone(),
trust,
upstream,
- shell: Some(shell),
+ shell,
};
let gh = gh_oidc::Verifier::new(cfg.common.owner.clone(), "dd-agent".into());
diff --git a/src/noise_gateway/mod.rs b/src/noise_gateway/mod.rs
index bfa0c63..6e2f2ae 100644
--- a/src/noise_gateway/mod.rs
+++ b/src/noise_gateway/mod.rs
@@ -44,7 +44,7 @@ pub struct State {
pub attest: Arc,
pub trust: TrustHandle,
pub upstream: Arc,
- pub shell: Option>,
+ pub shell: Arc,
}
pub fn router(state: State) -> Router {
diff --git a/src/noise_gateway/noise.rs b/src/noise_gateway/noise.rs
index 887c1f7..cde4f37 100644
--- a/src/noise_gateway/noise.rs
+++ b/src/noise_gateway/noise.rs
@@ -123,15 +123,7 @@ async fn handle(mut socket: WebSocket, state: AppState) -> anyhow::Result<()> {
}
}
Ok(allowlist::Method::ShellAttachSession) => {
- let Some(shell) = &state.shell else {
- let resp = serde_json::json!({
- "error": "shell_unavailable",
- "detail": "this Noise endpoint is not connected to sessiond",
- });
- send_encrypted_json(&mut transport, &mut socket, &resp).await?;
- continue;
- };
- match shell.attach_stream(request).await {
+ match state.shell.attach_stream(request).await {
Ok((ack, stream)) => {
send_encrypted_json(&mut transport, &mut socket, &ack).await?;
bridge_attach(&mut transport, &mut socket, stream).await?;
@@ -155,15 +147,7 @@ async fn handle(mut socket: WebSocket, state: AppState) -> anyhow::Result<()> {
| allowlist::Method::ShellReplaySession
| allowlist::Method::ShellResizeSession,
) => {
- let Some(shell) = &state.shell else {
- let resp = serde_json::json!({
- "error": "shell_unavailable",
- "detail": "this Noise endpoint is not connected to sessiond",
- });
- send_encrypted_json(&mut transport, &mut socket, &resp).await?;
- continue;
- };
- let response = shell.call(request).await.unwrap_or_else(|e| {
+ let response = state.shell.call(request).await.unwrap_or_else(|e| {
serde_json::json!({
"error": "shell_failed",
"detail": e.to_string(),
From 904f989b63e9207ea348ea13a7d04abd898d633d Mon Sep 17 00:00:00 2001
From: Alex Newman
Date: Sun, 10 May 2026 14:08:43 +0000
Subject: [PATCH 09/13] Drop PWA shell direction
---
README.md | 9 ++-
apps/README.md | 7 +-
docs/sessiond-central-ui-plan.md | 59 +++++++++--------
src/shell.rs | 110 +------------------------------
4 files changed, 39 insertions(+), 146 deletions(-)
diff --git a/README.md b/README.md
index 2988c0c..d5010eb 100644
--- a/README.md
+++ b/README.md
@@ -139,11 +139,10 @@ The CLI uses `DD_ITA_API_KEY` for quote appraisal. `DD_ITA_BASE_URL`,
production endpoints and can be overridden when needed. Local preview/dev runs
without ITA credentials must pass `--insecure-skip-quote-verify` explicitly.
-The web shell should become another client implementation of the same protocol:
-it keeps its own paired device identity, asks CP for current routes, and opens
-Noise directly to the agent. The existing cookie-auth browser shell is
-transitional compatibility only; new shell features should land on the Noise
-client protocol.
+The native CLI is the protocol reference for the future desktop/mobile app. The
+browser remains dashboard and enrollment UI only; the existing cookie-auth
+browser shell is transitional compatibility while the native app takes over
+shell/session workflows.
## STONITH
diff --git a/apps/README.md b/apps/README.md
index 19795ce..545c0fe 100644
--- a/apps/README.md
+++ b/apps/README.md
@@ -132,7 +132,8 @@ The shell UI treats both as terminal views, but only read-write sessions get
WebSocket input, resize, and close controls. Workloads do not opt into
read-write access by putting metadata in `workload.json`; the boundary is the
session protocol exposed by `dd-agent` over Noise. The current browser shell
-HTTP/WebSocket APIs are compatibility only while web/PWA moves to direct Noise.
+HTTP/WebSocket APIs are compatibility only while the native app takes over
+shell/session workflows.
Internally DD may still call this taint tracking, but the API/UI should speak in
integrity terms: clean for observed-only logs, controlled for interactive PTYs
or other human control paths.
@@ -145,8 +146,8 @@ printf '\033]9;%s\033\\' 'job finished'
printf '\033]777;notify;%s;%s\033\\' 'oracle' 'new result available'
```
-For mobile web, this is the first step toward a PWA-style shell inbox: read-only
-workload cards, read-write Codex/Claude session cards, and push-backed
+The native desktop/mobile app is the target for shell inbox workflows:
+read-only workload cards, read-write Codex/Claude session cards, and
notifications for long-running jobs.
Per-workload ingress is **boot-time only** today. Workloads POSTed later via
diff --git a/docs/sessiond-central-ui-plan.md b/docs/sessiond-central-ui-plan.md
index f6b2e3b..cdd9d21 100644
--- a/docs/sessiond-central-ui-plan.md
+++ b/docs/sessiond-central-ui-plan.md
@@ -1,4 +1,4 @@
-# Sessiond + Central UI Plan
+# Sessiond + Native Client Plan
## Goal
@@ -9,7 +9,7 @@ dogfood VM or killing active Codex/Claude sessions.
## Target Shape
```text
-native/web/mobile client
+native desktop/mobile client or CLI
-> CP route discovery + enrollment broker
-> selected agent /noise/ws
-> dd-sessiond Unix socket on that VM
@@ -28,7 +28,7 @@ Agent VM responsibilities:
Control-plane responsibilities:
- Broker device enrollment and own route discovery.
-- Optionally serve static web/PWA assets.
+- Serve dashboards and enrollment broker pages.
- Never carry shell, log, transcript, or PTY bytes.
Client responsibilities:
@@ -44,8 +44,8 @@ Client responsibilities:
- No fallback in-process PTY mode once `dd-sessiond` is introduced.
- No CRIU/checkpoint work in the first implementation.
- No CP relay or mailbox relay for shell/log/session bytes.
-- No full browser-side Noise handshake in the first implementation; native CLI
- is the first protocol exerciser.
+- No browser/PWA shell client. Browser stays dashboard/enrollment only; the
+ session client is native app/CLI.
## Phase 1: One Disruptive Dogfood Upgrade
@@ -99,33 +99,33 @@ Implementation notes:
- The existing `/api/sessions*` and `/ws/sessions*` browser-shell routes are
transitional compatibility only. Do not add new client features there.
-## Phase 3: Client-Side Fleet UI
+## Phase 3: Native Fleet Client
-Move active shell UI development to clients that use CP only for routes and
-agent/device policy.
+Move active shell UI development to a native client that uses CP only for
+routes and enrollment brokering.
Deliverables:
- Add CP route discovery for agent sessions.
-- UI lists sessions for the selected agent.
-- UI can create, attach, input, resize, close, and replay sessions by opening
- Noise directly to the selected agent.
+- Native app lists sessions for the selected agent.
+- Native app can create, attach, input, resize, close, and replay sessions by
+ opening Noise directly to the selected agent.
- Desktop terminal view remains raw PTY-first.
-- Mobile view can add touch controls, smart sizing, and assistant-style
- rendering without changing agent-side session ownership.
-- The web/PWA interface becomes a client implementation of the same protocol,
- not a server-side shell proxy.
+- Mobile app can add touch controls, smart sizing, notifications, and
+ assistant-style rendering without changing agent-side session ownership.
+- Browser dashboard links users to the native app/CLI enrollment and route
+ discovery flows; it does not become a terminal/PWA client.
Acceptance:
-- Updating static web/PWA assets updates the browser shell/mobile experience.
-- No dogfood agent restart is needed for UI-only changes.
+- Updating the native app updates shell/mobile experience without changing the
+ agent/sessiond data plane.
- Active dogfood Codex sessions survive web/client updates.
Status:
- Not implemented in the first branch slice. The native CLI is present so the
- client-side protocol can be tested before replacing the browser shell proxy.
+ client protocol can be tested before replacing the browser shell proxy.
## Phase 4: Auth, Attestation, And Noise
@@ -140,8 +140,7 @@ Start simple:
Then strengthen:
- Clients verify the agent quote and pin the attested Noise public key.
-- Browser/PWA uses the same direct agent Noise path once the browser crypto or
- WASM client is in place.
+- Native desktop/mobile apps reuse the same direct agent Noise path as the CLI.
- Pairing survives CP redeploys without putting shell/session state in CP. A
paired native/web/mobile client must not need to re-pair just because preview
or production CP was relaunched.
@@ -177,21 +176,22 @@ Now that the durable session owner is `dd-sessiond` and native clients can use
direct Noise, remove the old shell stack in this order:
1. Freeze cookie-auth browser shell APIs. Treat `src/shell.rs` routes
- `/api/sessions*` and `/ws/sessions*` as compatibility only until the web/PWA
- client speaks Noise directly.
+ `/api/sessions*` and `/ws/sessions*` as compatibility only until the native
+ app covers the workflow.
2. Remove old env compatibility names. `DD_SESSIOND_HISTORY_KEY` is the only
transcript-key override; do not continue accepting `DD_SHELL_HISTORY_KEY`.
3. Fix pairing durability without making CP a shell/session state owner. CP can
broker enrollment, but durable paired-device trust must live with the
enforcement point or an explicitly chosen non-CP store.
-4. Move web/PWA to direct Noise. Store a paired device key in browser storage,
- use CP only for enrollment and route discovery, then connect to the selected
- agent `/noise/ws` for session RPCs and PTY bytes.
+4. Extract the native Noise client into a reusable app library. Store paired
+ device keys in OS secure storage, use CP only for enrollment and route
+ discovery, then connect to the selected agent `/noise/ws` for session RPCs
+ and PTY bytes.
5. Delete server-side browser shell proxying. Remove `src/shell.rs` session
- proxy routes and WebSocket attach path once the web/PWA client uses direct
- Noise. Keep only static asset serving if needed.
+ proxy routes and WebSocket attach path once the native app covers
+ create/attach/replay/resize/close.
6. Delete agent HTTP session proxying. Remove `/api/sessions*` from `dd-agent`
- once native and web clients both use Noise for session control.
+ once native clients use Noise for session control.
7. Retire legacy combined shell workloads. Remove `apps/confidential-shell` and
`apps/codex-podman-shell` after deploy templates and docs no longer point at
`DD_MODE=shell` as a PTY owner.
@@ -214,6 +214,7 @@ Keep these pieces:
passing or exec handoff.
- How much of the existing transcript encryption format should move unchanged
into `dd-sessiond`.
-- Browser Noise implementation choice: pure JS library versus small WASM client.
- Where durable paired-device trust should live if CP only brokers enrollment
and route discovery.
+- Native app shell: Tauri/Rust shell versus platform-native UI around the Rust
+ Noise client library.
diff --git a/src/shell.rs b/src/shell.rs
index c799614..4f46a18 100644
--- a/src/shell.rs
+++ b/src/shell.rs
@@ -115,9 +115,6 @@ pub async fn run() -> Result<()> {
let app = Router::new()
.route("/", get(index))
.route("/favicon.ico", get(favicon))
- .route("/manifest.webmanifest", get(manifest))
- .route("/sw.js", get(service_worker))
- .route("/icon.svg", get(icon_svg))
.route("/assets/xterm/xterm.css", get(xterm_css))
.route("/assets/xterm/xterm.js", get(xterm_js))
.route("/assets/xterm/addon-fit.js", get(xterm_fit_js))
@@ -176,82 +173,6 @@ async fn favicon() -> StatusCode {
StatusCode::NO_CONTENT
}
-async fn manifest() -> impl IntoResponse {
- (
- [
- ("content-type", "application/manifest+json; charset=utf-8"),
- ("cache-control", "no-cache"),
- ],
- r##"{
- "name": "DD Shell",
- "short_name": "DD Shell",
- "description": "DevOps Defender confidential shell",
- "start_url": "/",
- "scope": "/",
- "display": "standalone",
- "background_color": "#05070a",
- "theme_color": "#111520",
- "icons": [
- {"src": "/icon.svg", "sizes": "any", "type": "image/svg+xml", "purpose": "any maskable"}
- ]
-}"##,
- )
-}
-
-async fn service_worker() -> impl IntoResponse {
- (
- [
- ("content-type", "application/javascript; charset=utf-8"),
- ("cache-control", "no-cache"),
- ],
- r#"self.addEventListener("install", event => {
- event.waitUntil(self.skipWaiting());
-});
-self.addEventListener("activate", event => {
- event.waitUntil(self.clients.claim());
-});
-self.addEventListener("notificationclick", event => {
- event.notification.close();
- event.waitUntil((async () => {
- const allClients = await self.clients.matchAll({type: "window", includeUncontrolled: true});
- if (allClients.length) {
- await allClients[0].focus();
- return;
- }
- await self.clients.openWindow("/");
- })());
-});
-self.addEventListener("message", event => {
- const data = event.data || {};
- if (data.type !== "notify") return;
- const title = data.title || "DD Shell";
- const body = data.body || "";
- event.waitUntil(self.registration.showNotification(title, {
- body,
- tag: data.tag || "dd-shell",
- renotify: true,
- icon: "/icon.svg",
- badge: "/icon.svg"
- }));
-});
-"#,
- )
-}
-
-async fn icon_svg() -> impl IntoResponse {
- (
- [
- ("content-type", "image/svg+xml; charset=utf-8"),
- ("cache-control", "public, max-age=31536000, immutable"),
- ],
- r##""##,
- )
-}
-
async fn xterm_css() -> impl IntoResponse {
(
[
@@ -886,9 +807,6 @@ let promptRequests = loadPromptHistory();
let promptScanBuffer = "";
let lastPromptKey = "";
const decoder = new TextDecoder();
-let serviceWorkerReady = null;
-installPwaMetadata();
-registerServiceWorker();
async function api(path, opts) {
const res = await fetch(path, opts);
@@ -1021,8 +939,7 @@ function notificationHtml() {
const supported = "Notification" in window;
const permission = supported ? Notification.permission : "unavailable";
const enabled = supported && permission === "granted" && notifyMode !== "off";
- const sw = "serviceWorker" in navigator ? "service worker ready" : "service worker unavailable";
- const detail = supported ? `native ${permission}; ${sw}; in-app history on` : `in-app history on; native unavailable; ${sw}`;
+ const detail = supported ? `native ${permission}; in-app history on` : "in-app history on; native unavailable";
return `
Notifications${enabled ? "native" : "in-app"}
${escapeHtml(detail)}
`;
}
@@ -1173,7 +1090,6 @@ document.getElementById("close").onclick = async () => {
await refresh();
};
document.getElementById("notify").onclick = async () => {
- await registerServiceWorker();
if (!("Notification" in window)) {
document.getElementById("status").textContent = "Notifications unavailable";
return;
@@ -1445,39 +1361,15 @@ function notify(title, body) {
showToast(item);
deliverNativeNotification(item);
}
-function registerServiceWorker() {
- if (!("serviceWorker" in navigator) || !window.isSecureContext) return Promise.resolve(null);
- if (!serviceWorkerReady) {
- serviceWorkerReady = navigator.serviceWorker.register("/sw.js")
- .then(() => navigator.serviceWorker.ready)
- .catch(() => null);
- }
- return serviceWorkerReady;
-}
async function deliverNativeNotification(item) {
if (!("Notification" in window) || Notification.permission !== "granted") return;
if (notifyMode !== "always" && document.hasFocus()) return;
const title = item.title || "DD Shell";
const body = item.body || "";
const tag = current ? `dd-shell-${current}` : "dd-shell";
- const registration = await registerServiceWorker();
- if (registration && "showNotification" in registration) {
- await registration.showNotification(title, {body, tag, renotify: true, icon: "/icon.svg", badge: "/icon.svg"});
- return;
- }
const n = new Notification(title, {body, tag});
n.onclick = () => { window.focus(); term.focus(); n.close(); };
}
-function installPwaMetadata() {
- const manifest = document.createElement("link");
- manifest.rel = "manifest";
- manifest.href = "/manifest.webmanifest";
- document.head.appendChild(manifest);
- const theme = document.createElement("meta");
- theme.name = "theme-color";
- theme.content = "#111520";
- document.head.appendChild(theme);
-}
function loadNotificationHistory() {
try {
const parsed = JSON.parse(localStorage.getItem("dd-shell-notifications") || "[]");
From 8269a61473f11894a07aee078670e900f5715c0a Mon Sep 17 00:00:00 2001
From: Alex Newman
Date: Sun, 10 May 2026 14:53:52 +0000
Subject: [PATCH 10/13] Remove bundled Noise client
---
Cargo.lock | 20 +-
Cargo.toml | 3 +-
README.md | 18 +-
docs/sessiond-central-ui-plan.md | 23 +-
src/lib.rs | 1 -
src/main.rs | 6 +-
src/noise_client.rs | 721 -------------------------------
7 files changed, 19 insertions(+), 773 deletions(-)
delete mode 100644 src/noise_client.rs
diff --git a/Cargo.lock b/Cargo.lock
index 55875bf..865fe94 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -386,7 +386,6 @@ dependencies = [
"tempfile",
"thiserror",
"tokio",
- "tokio-tungstenite",
"urlencoding",
"uuid",
"x25519-dalek",
@@ -756,7 +755,7 @@ dependencies = [
"tokio",
"tokio-rustls",
"tower-service",
- "webpki-roots 1.0.6",
+ "webpki-roots",
]
[[package]]
@@ -1449,7 +1448,7 @@ dependencies = [
"wasm-bindgen",
"wasm-bindgen-futures",
"web-sys",
- "webpki-roots 1.0.6",
+ "webpki-roots",
]
[[package]]
@@ -1909,12 +1908,8 @@ checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
dependencies = [
"futures-util",
"log",
- "rustls",
- "rustls-pki-types",
"tokio",
- "tokio-rustls",
"tungstenite",
- "webpki-roots 0.26.11",
]
[[package]]
@@ -2001,8 +1996,6 @@ dependencies = [
"httparse",
"log",
"rand 0.9.2",
- "rustls",
- "rustls-pki-types",
"sha1",
"thiserror",
"utf-8",
@@ -2235,15 +2228,6 @@ dependencies = [
"wasm-bindgen",
]
-[[package]]
-name = "webpki-roots"
-version = "0.26.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
-dependencies = [
- "webpki-roots 1.0.6",
-]
-
[[package]]
name = "webpki-roots"
version = "1.0.6"
diff --git a/Cargo.toml b/Cargo.toml
index ccb2218..cd7cf19 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -25,8 +25,7 @@ sha2 = "0.10"
snow = { version = "0.9", default-features = false, features = ["default-resolver"] }
sysinfo = { version = "0.33", default-features = false, features = ["system", "disk", "network"] }
thiserror = "2"
-tokio = { version = "1", features = ["macros", "process", "rt-multi-thread", "signal", "time", "fs", "net", "io-util", "io-std", "sync"] }
-tokio-tungstenite = { version = "0.28", features = ["rustls-tls-webpki-roots"] }
+tokio = { version = "1", features = ["macros", "process", "rt-multi-thread", "signal", "time", "fs", "net", "io-util", "sync"] }
urlencoding = "2"
uuid = { version = "1", features = ["v4"] }
x25519-dalek = { version = "2", features = ["static_secrets"] }
diff --git a/README.md b/README.md
index d5010eb..23c6230 100644
--- a/README.md
+++ b/README.md
@@ -126,21 +126,9 @@ inside the Noise transport to the agent and then to local `dd-sessiond`; the CP
is used for enrollment brokering and route discovery, not for shell/log/session
bytes or paired-device trust storage.
-The bundled native CLI exercises that path directly:
-
-```bash
-devopsdefender noise keygen --cp-url https://app.devopsdefender.com --label laptop
-devopsdefender noise recipes --url https://
-devopsdefender noise shell --url https:// --recipe shell
-```
-
-The CLI uses `DD_ITA_API_KEY` for quote appraisal. `DD_ITA_BASE_URL`,
-`DD_ITA_JWKS_URL`, and `DD_ITA_ISSUER` default to Intel Trust Authority's
-production endpoints and can be overridden when needed. Local preview/dev runs
-without ITA credentials must pass `--insecure-skip-quote-verify` explicitly.
-
-The native CLI is the protocol reference for the future desktop/mobile app. The
-browser remains dashboard and enrollment UI only; the existing cookie-auth
+Client implementations live outside this repo, starting with the planned
+`dd-client` repo that will contain the shared client core, CLI, and native app.
+The browser remains dashboard and enrollment UI only; the existing cookie-auth
browser shell is transitional compatibility while the native app takes over
shell/session workflows.
diff --git a/docs/sessiond-central-ui-plan.md b/docs/sessiond-central-ui-plan.md
index cdd9d21..3395b0e 100644
--- a/docs/sessiond-central-ui-plan.md
+++ b/docs/sessiond-central-ui-plan.md
@@ -46,6 +46,8 @@ Client responsibilities:
- No CP relay or mailbox relay for shell/log/session bytes.
- No browser/PWA shell client. Browser stays dashboard/enrollment only; the
session client is native app/CLI.
+- No bundled client CLI in `dd`. Client core, CLI, and native app live in a
+ separate `dd-client` repo.
## Phase 1: One Disruptive Dogfood Upgrade
@@ -134,13 +136,14 @@ Start simple:
- CP brokers enrollment by redirecting to the selected agent and exposes
current routes.
- Agents hold the trusted device set they enforce for direct Noise sessions.
-- Native CLI/desktop/mobile clients use direct `/noise/ws` channels for
+- Native CLI/desktop/mobile clients from `dd-client` use direct `/noise/ws` channels for
session RPCs.
Then strengthen:
- Clients verify the agent quote and pin the attested Noise public key.
-- Native desktop/mobile apps reuse the same direct agent Noise path as the CLI.
+- Native desktop/mobile apps reuse the same direct agent Noise path as the
+ `dd-client` CLI.
- Pairing survives CP redeploys without putting shell/session state in CP. A
paired native/web/mobile client must not need to re-pair just because preview
or production CP was relaunched.
@@ -153,12 +156,8 @@ Implemented first slice:
`shell.close_session` JSON requests over Noise.
- `shell.attach_session` returns one JSON ack, then switches the same Noise
session into encrypted raw PTY byte streaming to local `dd-sessiond`.
-- Native `exec`, `replay`, `resize`, and `close` commands exercise the same
- direct Noise path as `shell`.
- CP does not run the client Noise gateway. Agent Noise endpoints wire the
sessiond adapter in.
-- The native CLI appraises the agent quote with Intel Trust Authority by
- default and requires an explicit insecure flag for local preview/dev.
Design rule:
@@ -183,10 +182,10 @@ direct Noise, remove the old shell stack in this order:
3. Fix pairing durability without making CP a shell/session state owner. CP can
broker enrollment, but durable paired-device trust must live with the
enforcement point or an explicitly chosen non-CP store.
-4. Extract the native Noise client into a reusable app library. Store paired
- device keys in OS secure storage, use CP only for enrollment and route
- discovery, then connect to the selected agent `/noise/ws` for session RPCs
- and PTY bytes.
+4. Create `dd-client` with shared client core, CLI, and native app. Store
+ paired device keys in OS secure storage, use CP only for enrollment and
+ route discovery, then connect to the selected agent `/noise/ws` for session
+ RPCs and PTY bytes.
5. Delete server-side browser shell proxying. Remove `src/shell.rs` session
proxy routes and WebSocket attach path once the native app covers
create/attach/replay/resize/close.
@@ -216,5 +215,5 @@ Keep these pieces:
into `dd-sessiond`.
- Where durable paired-device trust should live if CP only brokers enrollment
and route discovery.
-- Native app shell: Tauri/Rust shell versus platform-native UI around the Rust
- Noise client library.
+- Native app shell: Tauri/Rust shell versus platform-native UI around the
+ `dd-client` Rust core.
diff --git a/src/lib.rs b/src/lib.rs
index c4c8b01..7568ffc 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -11,7 +11,6 @@ pub mod gh_oidc;
pub mod html;
pub mod ita;
pub mod metrics;
-pub mod noise_client;
pub mod noise_gateway;
pub mod oracle;
pub mod sessiond;
diff --git a/src/main.rs b/src/main.rs
index f131a99..9482ab1 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -4,11 +4,10 @@
//! DD_MODE=agent devopsdefender # in-VM agent
//! DD_MODE=shell devopsdefender # shell web service
//! DD_MODE=sessiond devopsdefender # local session supervisor
-//! devopsdefender noise ... # native Noise client
//!
//! (Also accepts `devopsdefender cp` / `devopsdefender agent` for local dev.)
-use devopsdefender::{agent, cp, noise_client, sessiond, shell};
+use devopsdefender::{agent, cp, sessiond, shell};
#[tokio::main]
async fn main() {
@@ -21,9 +20,8 @@ async fn main() {
Some("agent") => agent::run().await.map_err(Into::into),
Some("shell") => shell::run().await.map_err(Into::into),
Some("sessiond") => sessiond::run().await.map_err(Into::into),
- Some("noise") | Some("cli") => noise_client::run_cli().await,
_ => {
- eprintln!("usage: devopsdefender ");
+ eprintln!("usage: devopsdefender ");
eprintln!(" or: DD_MODE= devopsdefender");
std::process::exit(2);
}
diff --git a/src/noise_client.rs b/src/noise_client.rs
deleted file mode 100644
index d8d16ae..0000000
--- a/src/noise_client.rs
+++ /dev/null
@@ -1,721 +0,0 @@
-//! Native Noise client for operator shell sessions.
-//!
-//! This is intentionally small and dependency-light: it speaks the same
-//! Noise_IK-over-WebSocket framing as `noise_gateway`, then sends the
-//! shell/session RPCs that the gateway forwards to local `dd-sessiond`.
-
-use std::path::{Path, PathBuf};
-
-use anyhow::{anyhow, Context};
-use base64::Engine as _;
-use futures_util::{SinkExt, StreamExt};
-use rand::rngs::OsRng;
-use serde_json::Value;
-use snow::{Builder, TransportState};
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::TcpStream;
-use tokio_tungstenite::tungstenite::Message as WsMessage;
-use tokio_tungstenite::{connect_async, MaybeTlsStream, WebSocketStream};
-use x25519_dalek::{PublicKey, StaticSecret};
-
-const NOISE_PATTERN: &str = "Noise_IK_25519_ChaChaPoly_BLAKE2s";
-const MAX_NOISE_MSG: usize = 65535;
-const ATTACH_CHUNK: usize = 4096;
-
-type WsStream = WebSocketStream>;
-type WsSink = futures_util::stream::SplitSink;
-type WsRead = futures_util::stream::SplitStream;
-
-pub async fn run_cli() -> anyhow::Result<()> {
- let mut args: Vec = std::env::args().skip(2).collect();
- if args.is_empty() || args[0] == "-h" || args[0] == "--help" {
- print_usage();
- return Ok(());
- }
-
- let command = args.remove(0);
- match command.as_str() {
- "keygen" => {
- let opts = parse_opts(args)?;
- let key_path = opts.key_path();
- let secret = load_or_create_key(&key_path).await?;
- let pubkey = public_hex(&secret);
- println!("{pubkey}");
- if let Some(cp_url) = opts.cp_url.as_deref() {
- let label = opts.label.unwrap_or_else(default_label);
- println!("{}", enrollment_url(cp_url, &pubkey, &label));
- }
- }
- "pubkey" => {
- let opts = parse_opts(args)?;
- let secret = load_or_create_key(&opts.key_path()).await?;
- println!("{}", public_hex(&secret));
- }
- "recipes" => {
- let opts = parse_opts(args)?;
- let mut conn = connect(&opts).await?;
- print_json(
- conn.call(serde_json::json!({"method": "shell.list_recipes"}))
- .await?,
- )?;
- }
- "sessions" => {
- let opts = parse_opts(args)?;
- let mut conn = connect(&opts).await?;
- print_json(
- conn.call(serde_json::json!({"method": "shell.list_sessions"}))
- .await?,
- )?;
- }
- "create" => {
- let opts = parse_opts(args)?;
- let mut conn = connect(&opts).await?;
- let session = create_session(&mut conn, &opts).await?;
- print_json(session)?;
- }
- "replay" => {
- let opts = parse_opts(args)?;
- let id = opts
- .id
- .as_deref()
- .ok_or_else(|| anyhow!("replay requires --id"))?;
- let mut conn = connect(&opts).await?;
- print_json(
- conn.call(serde_json::json!({
- "method": "shell.replay_session",
- "id": id,
- }))
- .await?,
- )?;
- }
- "resize" => {
- let opts = parse_opts(args)?;
- let id = opts
- .id
- .as_deref()
- .ok_or_else(|| anyhow!("resize requires --id"))?;
- let cols = opts.cols.ok_or_else(|| anyhow!("resize requires --cols"))?;
- let rows = opts.rows.ok_or_else(|| anyhow!("resize requires --rows"))?;
- let mut conn = connect(&opts).await?;
- print_json(
- conn.call(serde_json::json!({
- "method": "shell.resize_session",
- "id": id,
- "cols": cols,
- "rows": rows,
- }))
- .await?,
- )?;
- }
- "close" => {
- let opts = parse_opts(args)?;
- let id = opts
- .id
- .as_deref()
- .ok_or_else(|| anyhow!("close requires --id"))?;
- let mut conn = connect(&opts).await?;
- print_json(
- conn.call(serde_json::json!({
- "method": "shell.close_session",
- "id": id,
- }))
- .await?,
- )?;
- }
- "attach" => {
- let opts = parse_opts(args)?;
- let id = opts
- .id
- .as_deref()
- .ok_or_else(|| anyhow!("attach requires --id"))?;
- let conn = connect(&opts).await?;
- attach_session(conn, id).await?;
- }
- "shell" => {
- let opts = parse_opts(args)?;
- let mut conn = connect(&opts).await?;
- let session = create_session(&mut conn, &opts).await?;
- let id = session_id(&session)?;
- attach_session(conn, &id).await?;
- }
- "exec" => {
- let (opts, cmd) = parse_exec_opts(args)?;
- let mut conn = connect(&opts).await?;
- print_json(
- conn.call(serde_json::json!({
- "method": "exec",
- "cmd": cmd,
- "timeout_secs": opts.timeout_secs.unwrap_or(60),
- }))
- .await?,
- )?;
- }
- other => {
- anyhow::bail!("unknown noise command `{other}`");
- }
- }
- Ok(())
-}
-
-fn print_usage() {
- eprintln!(
- "usage:
- devopsdefender noise keygen [--key PATH] [--cp-url URL] [--label LABEL]
- devopsdefender noise pubkey [--key PATH]
- devopsdefender noise recipes --url AGENT_URL [--key PATH]
- devopsdefender noise sessions --url AGENT_URL [--key PATH]
- devopsdefender noise create --url AGENT_URL [--key PATH] [--recipe ID] [--name NAME] [--command PATH]
- devopsdefender noise replay --url AGENT_URL [--key PATH] --id SESSION_ID
- devopsdefender noise resize --url AGENT_URL [--key PATH] --id SESSION_ID --cols N --rows N
- devopsdefender noise close --url AGENT_URL [--key PATH] --id SESSION_ID
- devopsdefender noise attach --url AGENT_URL [--key PATH] --id SESSION_ID
- devopsdefender noise shell --url AGENT_URL [--key PATH] [--recipe ID] [--name NAME] [--command PATH]
- devopsdefender noise exec --url AGENT_URL [--key PATH] [--timeout SECS] -- CMD [ARG...]
-
-Quote verification is enabled by default and uses DD_ITA_API_KEY plus optional
-DD_ITA_BASE_URL, DD_ITA_JWKS_URL, and DD_ITA_ISSUER. Local dev can pass
---insecure-skip-quote-verify explicitly."
- );
-}
-
-#[derive(Default)]
-struct Opts {
- url: Option,
- key: Option,
- cp_url: Option,
- label: Option,
- recipe: Option,
- name: Option,
- command: Option,
- id: Option,
- cols: Option,
- rows: Option,
- timeout_secs: Option,
- insecure_skip_quote_verify: bool,
- ita_api_key: Option,
- ita_base_url: Option,
- ita_jwks_url: Option,
- ita_issuer: Option,
-}
-
-impl Opts {
- fn key_path(&self) -> PathBuf {
- self.key
- .clone()
- .or_else(|| std::env::var_os("DD_NOISE_CLIENT_KEY").map(PathBuf::from))
- .unwrap_or_else(default_key_path)
- }
-
- fn agent_url(&self) -> anyhow::Result<&str> {
- self.url
- .as_deref()
- .ok_or_else(|| anyhow!("missing --url AGENT_URL"))
- }
-}
-
-fn parse_opts(args: Vec) -> anyhow::Result {
- let mut opts = Opts::default();
- let mut i = 0;
- while i < args.len() {
- let key = args[i].as_str();
- i += 1;
- let mut take = |name: &str| -> anyhow::Result {
- let value = args
- .get(i)
- .cloned()
- .ok_or_else(|| anyhow!("{name} requires a value"))?;
- i += 1;
- Ok(value)
- };
- match key {
- "--url" => opts.url = Some(take("--url")?),
- "--key" => opts.key = Some(PathBuf::from(take("--key")?)),
- "--cp-url" => opts.cp_url = Some(take("--cp-url")?),
- "--label" => opts.label = Some(take("--label")?),
- "--recipe" => opts.recipe = Some(take("--recipe")?),
- "--name" => opts.name = Some(take("--name")?),
- "--command" => opts.command = Some(take("--command")?),
- "--id" => opts.id = Some(take("--id")?),
- "--cols" => opts.cols = Some(parse_u64("--cols", &take("--cols")?)?),
- "--rows" => opts.rows = Some(parse_u64("--rows", &take("--rows")?)?),
- "--timeout" => opts.timeout_secs = Some(parse_u64("--timeout", &take("--timeout")?)?),
- "--ita-api-key" => opts.ita_api_key = Some(take("--ita-api-key")?),
- "--ita-base-url" => opts.ita_base_url = Some(take("--ita-base-url")?),
- "--ita-jwks-url" => opts.ita_jwks_url = Some(take("--ita-jwks-url")?),
- "--ita-issuer" => opts.ita_issuer = Some(take("--ita-issuer")?),
- "--insecure-skip-quote-verify" => opts.insecure_skip_quote_verify = true,
- "-h" | "--help" => {
- print_usage();
- std::process::exit(0);
- }
- other => anyhow::bail!("unknown option `{other}`"),
- }
- }
- Ok(opts)
-}
-
-fn parse_exec_opts(args: Vec) -> anyhow::Result<(Opts, Vec)> {
- let split = args
- .iter()
- .position(|arg| arg == "--")
- .ok_or_else(|| anyhow!("exec requires `-- CMD [ARG...]`"))?;
- let opts = parse_opts(args[..split].to_vec())?;
- let cmd = args[split + 1..].to_vec();
- if cmd.is_empty() {
- anyhow::bail!("exec requires a command after `--`");
- }
- Ok((opts, cmd))
-}
-
-fn parse_u64(name: &str, value: &str) -> anyhow::Result {
- value
- .parse()
- .with_context(|| format!("{name} must be an unsigned integer"))
-}
-
-struct NoiseConnection {
- transport: TransportState,
- sink: WsSink,
- stream: WsRead,
-}
-
-impl NoiseConnection {
- async fn call(&mut self, request: Value) -> anyhow::Result {
- let plain = serde_json::to_vec(&request)?;
- send_encrypted(&mut self.transport, &mut self.sink, &plain).await?;
- let cipher = next_binary(&mut self.stream)
- .await?
- .ok_or_else(|| anyhow!("Noise websocket closed before response"))?;
- let mut out = vec![0u8; cipher.len()];
- let n = self.transport.read_message(&cipher, &mut out)?;
- out.truncate(n);
- Ok(serde_json::from_slice(&out)?)
- }
-}
-
-async fn connect(opts: &Opts) -> anyhow::Result {
- let base_url = opts.agent_url()?;
- let secret = load_or_create_key(&opts.key_path()).await?;
- let server_pubkey = fetch_and_verify_server_pubkey(base_url, opts).await?;
- let ws_url = noise_ws_url(base_url);
-
- let (ws, _response) = connect_async(&ws_url)
- .await
- .with_context(|| format!("connect {ws_url}"))?;
- let (mut sink, mut stream) = ws.split();
-
- let mut hs = Builder::new(NOISE_PATTERN.parse()?)
- .local_private_key(secret.as_bytes())
- .remote_public_key(&server_pubkey)
- .build_initiator()?;
-
- let mut first = [0u8; MAX_NOISE_MSG];
- let n = hs.write_message(&[], &mut first)?;
- sink.send(WsMessage::Binary(first[..n].to_vec().into()))
- .await?;
-
- let second = next_binary(&mut stream)
- .await?
- .ok_or_else(|| anyhow!("Noise websocket closed during handshake"))?;
- let mut payload = [0u8; MAX_NOISE_MSG];
- hs.read_message(&second, &mut payload)?;
-
- Ok(NoiseConnection {
- transport: hs.into_transport_mode()?,
- sink,
- stream,
- })
-}
-
-async fn fetch_and_verify_server_pubkey(base_url: &str, opts: &Opts) -> anyhow::Result<[u8; 32]> {
- let url = health_url(base_url);
- let body: Value = reqwest::get(&url)
- .await
- .with_context(|| format!("GET {url}"))?
- .error_for_status()
- .with_context(|| format!("GET {url}"))?
- .json()
- .await
- .with_context(|| format!("parse {url}"))?;
- let pubkey_hex = body
- .pointer("/noise/pubkey_hex")
- .and_then(Value::as_str)
- .ok_or_else(|| anyhow!("{url} did not include noise.pubkey_hex"))?;
- let quote_b64 = body
- .pointer("/noise/quote_b64")
- .and_then(Value::as_str)
- .ok_or_else(|| anyhow!("{url} did not include noise.quote_b64"))?;
- let bytes = hex::decode(pubkey_hex).context("decode noise.pubkey_hex")?;
- if bytes.len() != 32 {
- anyhow::bail!(
- "noise.pubkey_hex decoded to {} bytes, expected 32",
- bytes.len()
- );
- }
- let mut out = [0u8; 32];
- out.copy_from_slice(&bytes);
- verify_quote_binding(quote_b64, &out, opts).await?;
- Ok(out)
-}
-
-async fn verify_quote_binding(
- quote_b64: &str,
- pubkey: &[u8; 32],
- opts: &Opts,
-) -> anyhow::Result<()> {
- if opts.insecure_skip_quote_verify {
- eprintln!("warning: skipping agent TDX quote verification by explicit request");
- return Ok(());
- }
-
- let api_key = opt_or_env(opts.ita_api_key.as_deref(), "DD_ITA_API_KEY")
- .ok_or_else(|| anyhow!("DD_ITA_API_KEY required for quote verification"))?;
- let base_url = opt_or_env(opts.ita_base_url.as_deref(), "DD_ITA_BASE_URL")
- .unwrap_or_else(|| "https://api.trustauthority.intel.com".into());
- let jwks_url = opt_or_env(opts.ita_jwks_url.as_deref(), "DD_ITA_JWKS_URL")
- .unwrap_or_else(|| "https://portal.trustauthority.intel.com/certs".into());
- let issuer = opt_or_env(opts.ita_issuer.as_deref(), "DD_ITA_ISSUER")
- .unwrap_or_else(|| "https://portal.trustauthority.intel.com".into());
-
- let token = crate::ita::mint(&base_url, &api_key, quote_b64)
- .await
- .map_err(|e| anyhow!("ITA quote appraisal failed: {e}"))?;
- let verifier = crate::ita::Verifier::new(jwks_url, issuer);
- let claims = verifier
- .verify(&token)
- .await
- .map_err(|e| anyhow!("ITA token verification failed: {e}"))?;
- let report_data = claims
- .report_data
- .as_deref()
- .ok_or_else(|| anyhow!("ITA token missing attester_held_data/report_data"))?;
- verify_report_data(report_data, pubkey)
-}
-
-fn opt_or_env(opt: Option<&str>, env: &str) -> Option {
- opt.map(str::to_owned).or_else(|| {
- std::env::var(env)
- .ok()
- .map(|v| v.trim().to_string())
- .filter(|v| !v.is_empty())
- })
-}
-
-fn verify_report_data(report_data: &str, pubkey: &[u8; 32]) -> anyhow::Result<()> {
- let bytes = decode_report_data(report_data)?;
- match bytes.len() {
- 32 if bytes.as_slice() == pubkey => Ok(()),
- 64 if bytes[..32] == pubkey[..] && bytes[32..].iter().all(|b| *b == 0) => Ok(()),
- 32 | 64 => anyhow::bail!("TDX report_data does not bind expected Noise public key"),
- n => anyhow::bail!("TDX report_data decoded to {n} bytes, expected 32 or 64"),
- }
-}
-
-fn decode_report_data(report_data: &str) -> anyhow::Result> {
- let s = report_data.trim();
- let hexish = s.strip_prefix("0x").unwrap_or(s);
- if hexish.len().is_multiple_of(2) && hexish.bytes().all(|b| b.is_ascii_hexdigit()) {
- return hex::decode(hexish).context("decode ITA report_data hex");
- }
- for engine in [
- &base64::engine::general_purpose::STANDARD,
- &base64::engine::general_purpose::STANDARD_NO_PAD,
- &base64::engine::general_purpose::URL_SAFE,
- &base64::engine::general_purpose::URL_SAFE_NO_PAD,
- ] {
- if let Ok(bytes) = engine.decode(s) {
- return Ok(bytes);
- }
- }
- anyhow::bail!("ITA report_data is neither hex nor base64")
-}
-
-async fn create_session(conn: &mut NoiseConnection, opts: &Opts) -> anyhow::Result {
- let mut request = serde_json::Map::from_iter([(
- "method".to_string(),
- Value::String("shell.create_session".into()),
- )]);
- if let Some(recipe) = opts.recipe.as_deref() {
- request.insert("recipe_id".into(), Value::String(recipe.into()));
- }
- if let Some(name) = opts.name.as_deref() {
- request.insert("name".into(), Value::String(name.into()));
- }
- if let Some(command) = opts.command.as_deref() {
- request.insert("command".into(), Value::String(command.into()));
- }
- conn.call(Value::Object(request)).await
-}
-
-async fn attach_session(mut conn: NoiseConnection, id: &str) -> anyhow::Result<()> {
- let ack = conn
- .call(serde_json::json!({
- "method": "shell.attach_session",
- "id": id,
- "tail": true,
- }))
- .await?;
- if ack.get("error").is_some() {
- anyhow::bail!("attach failed: {}", serde_json::to_string(&ack)?);
- }
-
- let _raw = RawMode::enter()?;
- let mut stdin = tokio::io::stdin();
- let mut stdout = tokio::io::stdout();
- let mut in_buf = [0u8; ATTACH_CHUNK];
-
- loop {
- tokio::select! {
- n = stdin.read(&mut in_buf) => {
- let n = n?;
- if n == 0 {
- break;
- }
- send_encrypted(&mut conn.transport, &mut conn.sink, &in_buf[..n]).await?;
- }
- frame = next_binary(&mut conn.stream) => {
- let Some(cipher) = frame? else {
- break;
- };
- let mut plain = vec![0u8; cipher.len()];
- let n = conn.transport.read_message(&cipher, &mut plain)?;
- stdout.write_all(&plain[..n]).await?;
- stdout.flush().await?;
- }
- }
- }
- Ok(())
-}
-
-async fn send_encrypted(
- transport: &mut TransportState,
- sink: &mut WsSink,
- plain: &[u8],
-) -> anyhow::Result<()> {
- let mut cipher = vec![0u8; plain.len() + 16];
- let n = transport.write_message(plain, &mut cipher)?;
- cipher.truncate(n);
- sink.send(WsMessage::Binary(cipher.into())).await?;
- Ok(())
-}
-
-async fn next_binary(stream: &mut WsRead) -> anyhow::Result>> {
- while let Some(msg) = stream.next().await {
- match msg? {
- WsMessage::Binary(b) => return Ok(Some(b.to_vec())),
- WsMessage::Close(_) => return Ok(None),
- WsMessage::Text(_) | WsMessage::Ping(_) | WsMessage::Pong(_) | WsMessage::Frame(_) => {
- continue
- }
- }
- }
- Ok(None)
-}
-
-fn session_id(value: &Value) -> anyhow::Result {
- if let Some(error) = value.get("error") {
- anyhow::bail!("create failed: {error}");
- }
- value
- .get("id")
- .or_else(|| value.pointer("/session/id"))
- .and_then(Value::as_str)
- .map(ToOwned::to_owned)
- .ok_or_else(|| anyhow!("create response did not include a session id: {value}"))
-}
-
-async fn load_or_create_key(path: &Path) -> anyhow::Result {
- match tokio::fs::read(path).await {
- Ok(bytes) if bytes.len() == 32 => {
- let mut key = [0u8; 32];
- key.copy_from_slice(&bytes);
- Ok(StaticSecret::from(key))
- }
- Ok(bytes) => anyhow::bail!("{} is {} bytes, expected 32", path.display(), bytes.len()),
- Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
- let secret = StaticSecret::random_from_rng(OsRng);
- persist_key(path, secret.as_bytes()).await?;
- Ok(secret)
- }
- Err(e) => Err(e).with_context(|| format!("read {}", path.display())),
- }
-}
-
-async fn persist_key(path: &Path, bytes: &[u8; 32]) -> anyhow::Result<()> {
- if let Some(parent) = path.parent() {
- tokio::fs::create_dir_all(parent).await?;
- }
- let tmp = path.with_extension("key.tmp");
- tokio::fs::write(&tmp, bytes).await?;
- #[cfg(unix)]
- {
- use std::os::unix::fs::PermissionsExt;
- tokio::fs::set_permissions(&tmp, std::fs::Permissions::from_mode(0o600)).await?;
- }
- tokio::fs::rename(&tmp, path).await?;
- Ok(())
-}
-
-fn public_hex(secret: &StaticSecret) -> String {
- hex::encode(PublicKey::from(secret).as_bytes())
-}
-
-fn default_key_path() -> PathBuf {
- if let Some(home) = std::env::var_os("HOME") {
- return PathBuf::from(home)
- .join(".config")
- .join("devopsdefender")
- .join("noise.key");
- }
- PathBuf::from(".devopsdefender-noise.key")
-}
-
-fn default_label() -> String {
- std::env::var("HOSTNAME")
- .ok()
- .filter(|s| !s.is_empty())
- .unwrap_or_else(|| "native-cli".into())
-}
-
-fn enrollment_url(cp_url: &str, pubkey_hex: &str, label: &str) -> String {
- format!(
- "{}/admin/enroll?pubkey={}&label={}",
- normalize_http_base(cp_url),
- pubkey_hex,
- urlencoding::encode(label)
- )
-}
-
-fn health_url(base_url: &str) -> String {
- format!("{}/health", normalize_http_base(base_url))
-}
-
-fn noise_ws_url(base_url: &str) -> String {
- let base = normalize_http_base(base_url);
- let ws_base = if let Some(rest) = base.strip_prefix("https://") {
- format!("wss://{rest}")
- } else if let Some(rest) = base.strip_prefix("http://") {
- format!("ws://{rest}")
- } else {
- base
- };
- format!("{}/noise/ws", ws_base.trim_end_matches('/'))
-}
-
-fn normalize_http_base(base_url: &str) -> String {
- let trimmed = base_url.trim().trim_end_matches('/');
- if trimmed.starts_with("http://") || trimmed.starts_with("https://") {
- trimmed.to_string()
- } else {
- format!("https://{trimmed}")
- }
-}
-
-fn print_json(value: Value) -> anyhow::Result<()> {
- println!("{}", serde_json::to_string_pretty(&value)?);
- Ok(())
-}
-
-struct RawMode {
- #[cfg(unix)]
- original: Option,
-}
-
-impl RawMode {
- fn enter() -> anyhow::Result {
- #[cfg(unix)]
- {
- if unsafe { libc::isatty(libc::STDIN_FILENO) } != 1 {
- return Ok(Self { original: None });
- }
- let mut original = std::mem::MaybeUninit::::uninit();
- if unsafe { libc::tcgetattr(libc::STDIN_FILENO, original.as_mut_ptr()) } != 0 {
- return Err(std::io::Error::last_os_error()).context("tcgetattr");
- }
- let original = unsafe { original.assume_init() };
- let mut raw = original;
- unsafe { libc::cfmakeraw(&mut raw) };
- if unsafe { libc::tcsetattr(libc::STDIN_FILENO, libc::TCSANOW, &raw) } != 0 {
- return Err(std::io::Error::last_os_error()).context("tcsetattr raw");
- }
- Ok(Self {
- original: Some(original),
- })
- }
- #[cfg(not(unix))]
- {
- Ok(Self {})
- }
- }
-}
-
-impl Drop for RawMode {
- fn drop(&mut self) {
- #[cfg(unix)]
- if let Some(original) = &self.original {
- let _ = unsafe { libc::tcsetattr(libc::STDIN_FILENO, libc::TCSANOW, original) };
- }
- }
-}
-
-#[cfg(test)]
-mod tests {
- use super::*;
-
- #[test]
- fn builds_urls_from_bare_host() {
- assert_eq!(
- health_url("agent.example.com/"),
- "https://agent.example.com/health"
- );
- assert_eq!(
- noise_ws_url("agent.example.com/"),
- "wss://agent.example.com/noise/ws"
- );
- }
-
- #[test]
- fn keeps_local_http_scheme() {
- assert_eq!(
- health_url("http://127.0.0.1:8080"),
- "http://127.0.0.1:8080/health"
- );
- assert_eq!(
- noise_ws_url("http://127.0.0.1:8080"),
- "ws://127.0.0.1:8080/noise/ws"
- );
- }
-
- #[test]
- fn enrollment_url_encodes_label() {
- assert_eq!(
- enrollment_url("https://cp.example.com/", "abcd", "me laptop"),
- "https://cp.example.com/admin/enroll?pubkey=abcd&label=me%20laptop"
- );
- }
-
- #[test]
- fn report_data_accepts_64_byte_hex_binding() {
- let mut report = [0u8; 64];
- report[..32].fill(7);
- let pubkey = [7u8; 32];
- verify_report_data(&hex::encode(report), &pubkey).unwrap();
- }
-
- #[test]
- fn report_data_rejects_wrong_key() {
- let mut report = [0u8; 64];
- report[..32].fill(7);
- let pubkey = [8u8; 32];
- assert!(verify_report_data(&hex::encode(report), &pubkey).is_err());
- }
-
- #[test]
- fn report_data_accepts_base64_binding() {
- let mut report = [0u8; 64];
- report[..32].fill(9);
- let pubkey = [9u8; 32];
- let encoded = base64::engine::general_purpose::STANDARD.encode(report);
- verify_report_data(&encoded, &pubkey).unwrap();
- }
-}
From 542b3e9a2bbfaf56adb3cb4385f0e1b5685cdc93 Mon Sep 17 00:00:00 2001
From: Alex Newman
Date: Sun, 10 May 2026 15:12:55 +0000
Subject: [PATCH 11/13] Link dd client repo in docs
---
README.md | 5 +++--
docs/sessiond-central-ui-plan.md | 16 ++++++++--------
2 files changed, 11 insertions(+), 10 deletions(-)
diff --git a/README.md b/README.md
index 23c6230..03e75d1 100644
--- a/README.md
+++ b/README.md
@@ -126,8 +126,9 @@ inside the Noise transport to the agent and then to local `dd-sessiond`; the CP
is used for enrollment brokering and route discovery, not for shell/log/session
bytes or paired-device trust storage.
-Client implementations live outside this repo, starting with the planned
-`dd-client` repo that will contain the shared client core, CLI, and native app.
+Client implementations live outside this repo in
+[`devopsdefender/dd-client`](https://github.com/devopsdefender/dd-client),
+which contains the shared client core, CLI, and native app workspace.
The browser remains dashboard and enrollment UI only; the existing cookie-auth
browser shell is transitional compatibility while the native app takes over
shell/session workflows.
diff --git a/docs/sessiond-central-ui-plan.md b/docs/sessiond-central-ui-plan.md
index 3395b0e..4b7d10f 100644
--- a/docs/sessiond-central-ui-plan.md
+++ b/docs/sessiond-central-ui-plan.md
@@ -46,8 +46,8 @@ Client responsibilities:
- No CP relay or mailbox relay for shell/log/session bytes.
- No browser/PWA shell client. Browser stays dashboard/enrollment only; the
session client is native app/CLI.
-- No bundled client CLI in `dd`. Client core, CLI, and native app live in a
- separate `dd-client` repo.
+- No bundled client CLI in `dd`. Client core, CLI, and native app live in
+ [`devopsdefender/dd-client`](https://github.com/devopsdefender/dd-client).
## Phase 1: One Disruptive Dogfood Upgrade
@@ -136,8 +136,8 @@ Start simple:
- CP brokers enrollment by redirecting to the selected agent and exposes
current routes.
- Agents hold the trusted device set they enforce for direct Noise sessions.
-- Native CLI/desktop/mobile clients from `dd-client` use direct `/noise/ws` channels for
- session RPCs.
+- Native CLI/desktop/mobile clients from `dd-client` use direct `/noise/ws`
+ channels for session RPCs.
Then strengthen:
@@ -182,10 +182,10 @@ direct Noise, remove the old shell stack in this order:
3. Fix pairing durability without making CP a shell/session state owner. CP can
broker enrollment, but durable paired-device trust must live with the
enforcement point or an explicitly chosen non-CP store.
-4. Create `dd-client` with shared client core, CLI, and native app. Store
- paired device keys in OS secure storage, use CP only for enrollment and
- route discovery, then connect to the selected agent `/noise/ws` for session
- RPCs and PTY bytes.
+4. Build out [`devopsdefender/dd-client`](https://github.com/devopsdefender/dd-client)
+ with shared client core, CLI, and native app. Store paired device keys in OS
+ secure storage, use CP only for enrollment and route discovery, then connect
+ to the selected agent `/noise/ws` for session RPCs and PTY bytes.
5. Delete server-side browser shell proxying. Remove `src/shell.rs` session
proxy routes and WebSocket attach path once the native app covers
create/attach/replay/resize/close.
From bf3c19d36b299e48ba20056471502c4a64fcacf1 Mon Sep 17 00:00:00 2001
From: Alex Newman
Date: Sun, 10 May 2026 15:34:33 +0000
Subject: [PATCH 12/13] Slim browser shell to session attach
---
src/shell.rs | 994 +++++----------------------------------------------
1 file changed, 95 insertions(+), 899 deletions(-)
diff --git a/src/shell.rs b/src/shell.rs
index 4f46a18..9e33b22 100644
--- a/src/shell.rs
+++ b/src/shell.rs
@@ -1,10 +1,11 @@
//! Multi-session shell sidecar.
//!
-//! One process per VM, multiple reconnectable PTY sessions, read-only workload
-//! terminals, and encrypted append-only transcripts on disk.
+//! Transitional browser shell proxy.
+//!
+//! Native clients in `devopsdefender/dd-client` are the primary shell/session
+//! workflow. This sidecar keeps only the minimal browser attach surface while
+//! forwarding session state and PTY bytes to local `dd-sessiond`.
-use std::collections::HashMap;
-use std::sync::Arc;
use std::time::Duration;
use axum::extract::ws::{Message, WebSocket, WebSocketUpgrade};
@@ -13,27 +14,20 @@ use axum::http::{HeaderMap, StatusCode, Uri};
use axum::response::{Html, IntoResponse, Response};
use axum::routing::{get, post};
use axum::{Json, Router};
-use base64::Engine as _;
use futures_util::{SinkExt, StreamExt};
use serde::de::DeserializeOwned;
use serde::{Deserialize, Serialize};
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::TcpStream;
-use crate::ee::Ee;
use crate::error::{Error, Result};
use crate::html;
-use crate::oracle::OracleStatus;
-use crate::taint::IntegrityState;
-use crate::units::{self, AgentMode, ManagedUnit, UnitKind};
const DEFAULT_PORT: u16 = 7681;
#[derive(Clone)]
struct App {
- ee: Arc,
http: reqwest::Client,
- agent_api: String,
sessiond_http_url: String,
sessiond_attach_addr: String,
owner: crate::gh_oidc::Principal,
@@ -55,26 +49,6 @@ struct ResizeSession {
rows: u16,
}
-#[derive(Serialize)]
-struct ReplayResponse {
- id: String,
- bytes_b64: String,
-}
-
-#[derive(Serialize)]
-struct SystemProbe {
- ok: bool,
- status: String,
- detail: Option,
- data: Option,
-}
-
-#[derive(Serialize)]
-struct SystemStatus {
- ee: SystemProbe,
- agent: SystemProbe,
-}
-
pub async fn run() -> Result<()> {
let common = crate::config::Common::from_env()?;
let domain = std::env::var("DD_CF_DOMAIN")
@@ -88,23 +62,17 @@ pub async fn run() -> Result<()> {
.ok()
.and_then(|s| s.parse::().ok())
.unwrap_or(DEFAULT_PORT);
- let ee_socket = std::env::var("DD_SHELL_EE_SOCKET")
- .unwrap_or_else(|_| "/var/lib/easyenclave/agent.sock".into());
- let agent_api = std::env::var("DD_SHELL_AGENT_API_URL")
- .unwrap_or_else(|_| format!("http://127.0.0.1:{}", crate::cf::AGENT_API_PORT));
let sessiond_http_url =
std::env::var("DD_SESSIOND_HTTP_URL").unwrap_or_else(|_| "http://127.0.0.1:7683".into());
let sessiond_attach_addr =
std::env::var("DD_SESSIOND_ATTACH_ADDR").unwrap_or_else(|_| "127.0.0.1:7684".into());
let app_state = App {
- ee: Arc::new(Ee::new(ee_socket)),
http: reqwest::Client::builder()
.timeout(Duration::from_secs(3))
.no_hickory_dns()
.build()
.unwrap_or_else(|_| crate::system_http_client()),
- agent_api,
sessiond_http_url,
sessiond_attach_addr,
owner: common.owner,
@@ -123,10 +91,6 @@ pub async fn run() -> Result<()> {
.route("/api/sessions/{id}/replay", get(replay_session))
.route("/api/sessions/{id}/resize", post(resize_session))
.route("/api/sessions/{id}/close", post(close_session))
- .route("/api/system", get(system_status))
- .route("/api/oracles", get(list_oracles))
- .route("/api/workloads", get(list_workloads))
- .route("/api/workloads/{app}/replay", get(replay_workload))
.route("/ws/sessions/{id}", get(attach_session))
.with_state(app_state);
@@ -243,192 +207,6 @@ async fn replay_session(
.map(Json)
}
-async fn list_workloads(
- State(app): State,
- headers: HeaderMap,
- uri: Uri,
-) -> Result>> {
- ensure_shell_auth(&app, &headers, &uri)?;
- if let Ok(units) = agent_get(&app, "/api/units").await {
- return Ok(Json(units));
- }
-
- let oracles = load_oracles(&app).await;
- let mut oracle_by_app: HashMap = oracles
- .into_iter()
- .map(|oracle| (oracle.app_name.clone(), oracle))
- .collect();
- let mut workloads = Vec::new();
-
- match app.ee.list().await {
- Ok(list) => {
- if let Some(deployments) = list["deployments"].as_array() {
- for d in deployments {
- let Some(app_name) = d["app_name"].as_str() else {
- continue;
- };
- let id = d["id"].as_str().unwrap_or(app_name).to_string();
- let oracle = oracle_by_app.remove(app_name);
- let kind = units::kind_for_app(app_name);
- let mut capabilities = units::base_capabilities(kind);
- capabilities.push("logs".into());
- if oracle.is_some() {
- capabilities.push("oracle".into());
- }
- workloads.push(ManagedUnit {
- id: id.clone(),
- app_name: app_name.to_string(),
- title: units::title_for_app(app_name),
- kind,
- agent_mode: AgentMode::ReadWrite,
- agent_integrity_state: IntegrityState::Controlled,
- status: d["status"].as_str().unwrap_or("unknown").to_string(),
- image: non_empty_string(&d["image"]),
- started_at: non_empty_string(&d["started_at"]),
- error_message: non_empty_string(&d["error_message"]),
- source: units::source_for_app(app_name),
- log_line_count: workload_log_line_count(&app.ee, &id).await,
- capabilities,
- refs: fallback_refs(app_name, kind, oracle.as_ref()),
- oracle,
- });
- }
- }
- }
- Err(e) => {
- eprintln!("dd-shell: ee workload probe unavailable: {e}");
- }
- }
-
- workloads.extend(oracle_by_app.into_values().map(|oracle| ManagedUnit {
- id: oracle.app_name.clone(),
- app_name: oracle.app_name.clone(),
- title: oracle.title.clone(),
- kind: UnitKind::Workload,
- agent_mode: AgentMode::ReadWrite,
- agent_integrity_state: IntegrityState::Controlled,
- status: oracle.status.clone(),
- image: None,
- started_at: None,
- error_message: oracle.last_error.clone(),
- source: units::source_for_app(&oracle.app_name),
- log_line_count: 0,
- capabilities: vec!["oracle".into()],
- refs: fallback_refs(&oracle.app_name, UnitKind::Workload, Some(&oracle)),
- oracle: Some(oracle),
- }));
- workloads.sort_by(|a, b| a.app_name.cmp(&b.app_name));
- Ok(Json(workloads))
-}
-
-async fn workload_log_line_count(ee: &Ee, id: &str) -> usize {
- match ee.logs(id).await {
- Ok(logs) => logs["lines"].as_array().map(|a| a.len()).unwrap_or(0),
- Err(e) => {
- eprintln!("dd-shell: workload log probe unavailable for {id}: {e}");
- 0
- }
- }
-}
-
-fn fallback_refs(
- app_name: &str,
- _kind: UnitKind,
- oracle: Option<&OracleStatus>,
-) -> Vec {
- let mut refs = units::source_for_app(app_name)
- .map(|source| vec![units::ref_item("source", "source", source)])
- .unwrap_or_default();
- if let Some(oracle) = oracle {
- if let Some(url) = &oracle.vanity_url {
- refs.push(units::ref_item("url", "oracle", url.clone()));
- }
- refs.push(units::ref_item(
- "url",
- "oracle-local",
- oracle.local_url.clone(),
- ));
- }
- refs
-}
-
-fn non_empty_string(value: &serde_json::Value) -> Option {
- value
- .as_str()
- .map(str::trim)
- .filter(|s| !s.is_empty())
- .map(String::from)
-}
-
-async fn list_oracles(
- State(app): State,
- headers: HeaderMap,
- uri: Uri,
-) -> Result>> {
- ensure_shell_auth(&app, &headers, &uri)?;
- Ok(Json(load_oracles(&app).await))
-}
-
-async fn load_oracles(app: &App) -> Vec {
- match agent_get(app, "/api/oracles").await {
- Ok(oracles) => oracles,
- Err(e) => {
- eprintln!("dd-shell: agent oracle probe unavailable: {e}");
- Vec::new()
- }
- }
-}
-
-async fn system_status(
- State(app): State,
- headers: HeaderMap,
- uri: Uri,
-) -> Result> {
- ensure_shell_auth(&app, &headers, &uri)?;
- let ee = match app.ee.health().await {
- Ok(data) => SystemProbe {
- ok: true,
- status: "healthy".into(),
- detail: None,
- data: Some(data),
- },
- Err(e) => SystemProbe {
- ok: false,
- status: "unavailable".into(),
- detail: Some(e.to_string()),
- data: None,
- },
- };
- let agent = match agent_get(&app, "/health").await {
- Ok(data) => SystemProbe {
- ok: true,
- status: "healthy".into(),
- detail: None,
- data: Some(data),
- },
- Err(e) => SystemProbe {
- ok: false,
- status: "unavailable".into(),
- detail: Some(e.to_string()),
- data: None,
- },
- };
- Ok(Json(SystemStatus { ee, agent }))
-}
-
-async fn agent_get(app: &App, path: &str) -> Result {
- let url = format!("{}{}", app.agent_api.trim_end_matches('/'), path);
- let resp = app.http.get(url).send().await?;
- let status = resp.status();
- if !status.is_success() {
- let body = resp.text().await.unwrap_or_default();
- return Err(Error::Upstream(format!(
- "agent api {path}: HTTP {status}: {body}"
- )));
- }
- Ok(resp.json().await?)
-}
-
async fn sessiond_get(app: &App, path: &str) -> Result {
let url = format!("{}{}", app.sessiond_http_url.trim_end_matches('/'), path);
let resp = app.http.get(url).send().await?;
@@ -486,31 +264,6 @@ async fn decode_sessiond_empty(path: &str, resp: reqwest::Response) -> Result,
- headers: HeaderMap,
- uri: Uri,
- AxPath(name): AxPath,
-) -> Result> {
- ensure_shell_auth(&app, &headers, &uri)?;
- let list = app.ee.list().await?;
- let id = list["deployments"]
- .as_array()
- .and_then(|a| {
- a.iter()
- .find(|d| d["app_name"].as_str() == Some(name.as_str()))
- })
- .and_then(|d| d["id"].as_str())
- .map(String::from)
- .ok_or(Error::NotFound)?;
- let logs = app.ee.logs(&id).await?;
- let bytes = workload_log_bytes(&logs);
- Ok(Json(ReplayResponse {
- id: name,
- bytes_b64: base64::engine::general_purpose::STANDARD.encode(bytes),
- }))
-}
-
async fn close_session(
State(app): State,
headers: HeaderMap,
@@ -521,17 +274,6 @@ async fn close_session(
sessiond_post_empty(&app, &format!("/api/sessions/{id}/close")).await
}
-fn workload_log_bytes(logs: &serde_json::Value) -> Vec {
- let mut out = Vec::new();
- if let Some(lines) = logs["lines"].as_array() {
- for line in lines.iter().filter_map(|v| v.as_str()) {
- out.extend_from_slice(line.as_bytes());
- out.extend_from_slice(b"\r\n");
- }
- }
- out
-}
-
async fn resize_session(
State(app): State,
headers: HeaderMap,
@@ -621,147 +363,65 @@ const SHELL_HTML: &str = r##"
-
+
Shell
-
Observed logs and controlled PTYs
-
-
+
Transitional browser attach. Use dd-client for the native workflow.
-
-
-
System
-
-
Prompt inbox
-
-
Notifications
-
-
-
-
New session
-
-
-
-
-
-
-
-
Read-write sessions
-
-
-
-
Read-only workloads
-
-
+
New session
+
+
+
+
+
Sessions
+
-
+
+
-
-
- 0No session
-
-
-
-
-
-
-
From 4e945e4b1150681ad0d8cb1558630458d73d2a7c Mon Sep 17 00:00:00 2001
From: Alex Newman
Date: Sun, 10 May 2026 15:44:02 +0000
Subject: [PATCH 13/13] Remove browser shell attach surface
---
README.md | 7 +-
apps/README.md | 19 +-
apps/dd-shell/workload.json.tmpl | 4 -
assets/xterm/LICENSE | 21 --
assets/xterm/README.md | 7 -
assets/xterm/addon-fit.js | 2 -
assets/xterm/xterm.css | 218 ------------
assets/xterm/xterm.js | 2 -
docs/sessiond-central-ui-plan.md | 17 +-
src/agent.rs | 3 +-
src/shell.rs | 570 +------------------------------
11 files changed, 36 insertions(+), 834 deletions(-)
delete mode 100644 assets/xterm/LICENSE
delete mode 100644 assets/xterm/README.md
delete mode 100644 assets/xterm/addon-fit.js
delete mode 100644 assets/xterm/xterm.css
delete mode 100644 assets/xterm/xterm.js
diff --git a/README.md b/README.md
index 03e75d1..e52a44c 100644
--- a/README.md
+++ b/README.md
@@ -72,7 +72,7 @@ Zero shared secrets. Cloudflare handles tunnel/DNS routing only; DD owns auth in
| Caller | Endpoint | Auth |
| --- | --- | --- |
-| Human browser | CP `/`, agent `/`, dd-shell terminal | DD GitHub App OAuth broker + signed DD session cookie |
+| Human browser | CP `/`, agent `/` | DD GitHub App OAuth broker + signed DD session cookie |
| Agent → CP | `/register`, `/ingress/replace` | Intel ITA token verified in-code |
| CI → agent | `/deploy`, `/exec`, `/logs/{app}` | GitHub Actions OIDC JWT verified in-code (`repository_owner == DD_OWNER`) |
| Anyone | `/health`, `/cp/attest`, `/api/agents`, workload URLs | Public read-only or self-authenticating content |
@@ -129,9 +129,8 @@ bytes or paired-device trust storage.
Client implementations live outside this repo in
[`devopsdefender/dd-client`](https://github.com/devopsdefender/dd-client),
which contains the shared client core, CLI, and native app workspace.
-The browser remains dashboard and enrollment UI only; the existing cookie-auth
-browser shell is transitional compatibility while the native app takes over
-shell/session workflows.
+The browser remains dashboard and enrollment UI only. Shell/session workflows
+belong in `dd-client`.
## STONITH
diff --git a/apps/README.md b/apps/README.md
index 545c0fe..b25fd6e 100644
--- a/apps/README.md
+++ b/apps/README.md
@@ -128,18 +128,15 @@ DD separates terminal access by capability:
read-write PTY is controlled as soon as it exists because the holder can send
stdin, resize the terminal, and deliver terminal signals.
-The shell UI treats both as terminal views, but only read-write sessions get
-WebSocket input, resize, and close controls. Workloads do not opt into
-read-write access by putting metadata in `workload.json`; the boundary is the
-session protocol exposed by `dd-agent` over Noise. The current browser shell
-HTTP/WebSocket APIs are compatibility only while the native app takes over
-shell/session workflows.
+The native client treats both as terminal views, but only read-write sessions
+get input, resize, and close controls. Workloads do not opt into read-write
+access by putting metadata in `workload.json`; the boundary is the session
+protocol exposed by `dd-agent` over Noise.
Internally DD may still call this taint tracking, but the API/UI should speak in
integrity terms: clean for observed-only logs, controlled for interactive PTYs
or other human control paths.
-The renderer uses vendored xterm assets and recognizes WezTerm-compatible
-notification escapes after the user grants browser notification permission:
+Native clients may recognize WezTerm-compatible notification escapes:
```sh
printf '\033]9;%s\033\\' 'job finished'
@@ -189,9 +186,9 @@ inline in two places so both lifecycle points behave identically:
Additional examples:
- `apps/human-readonly`: tiny preview-only read-only oracle. It emits logs for
- dd-shell's read-only terminal, serves `/oracle.json` on port 8082, gets a
- vanity `oracle.` address, and appears in the dashboards. It
- is a shell workload recipe, not a `devopsdefender` binary subcommand.
+ native clients, serves `/oracle.json` on port 8082, gets a vanity
+ `oracle.` address, and appears in the dashboards. It is a
+ shell workload recipe, not a `devopsdefender` binary subcommand.
- `apps/oracle-readonly`: standalone oracle example with the same scraper and
vanity-address metadata; copy this shape into real oracle app repos.
- `apps/confidential-shell`: legacy standalone shell workload for deployments
diff --git a/apps/dd-shell/workload.json.tmpl b/apps/dd-shell/workload.json.tmpl
index b121077..c657a29 100644
--- a/apps/dd-shell/workload.json.tmpl
+++ b/apps/dd-shell/workload.json.tmpl
@@ -4,10 +4,6 @@
"env": [
"DD_MODE=shell",
"DD_SHELL_PORT=7682",
- "DD_SHELL_DIR=/tmp/dd-shell",
- "DD_SHELL_EE_SOCKET=/var/lib/easyenclave/agent.sock",
- "DD_SESSIOND_HTTP_URL=http://127.0.0.1:7683",
- "DD_SESSIOND_ATTACH_ADDR=127.0.0.1:7684",
"DD_ENV=${DD_ENV}",
"DD_OWNER=${DD_OWNER}",
"DD_OWNER_ID=${DD_OWNER_ID}",
diff --git a/assets/xterm/LICENSE b/assets/xterm/LICENSE
deleted file mode 100644
index 4472336..0000000
--- a/assets/xterm/LICENSE
+++ /dev/null
@@ -1,21 +0,0 @@
-Copyright (c) 2017-2019, The xterm.js authors (https://github.com/xtermjs/xterm.js)
-Copyright (c) 2014-2016, SourceLair Private Company (https://www.sourcelair.com)
-Copyright (c) 2012-2013, Christopher Jeffrey (https://github.com/chjj/)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
diff --git a/assets/xterm/README.md b/assets/xterm/README.md
deleted file mode 100644
index 682ff4f..0000000
--- a/assets/xterm/README.md
+++ /dev/null
@@ -1,7 +0,0 @@
-Vendored xterm browser assets for dd-shell.
-
-- `xterm.js` and `xterm.css`: `@xterm/xterm` 5.5.0
-- `addon-fit.js`: `@xterm/addon-fit` 0.10.0
-
-Source: https://www.npmjs.com/package/@xterm/xterm
-License: MIT, see `LICENSE`.
diff --git a/assets/xterm/addon-fit.js b/assets/xterm/addon-fit.js
deleted file mode 100644
index 0388971..0000000
--- a/assets/xterm/addon-fit.js
+++ /dev/null
@@ -1,2 +0,0 @@
-!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.FitAddon=t():e.FitAddon=t()}(self,(()=>(()=>{"use strict";var e={};return(()=>{var t=e;Object.defineProperty(t,"__esModule",{value:!0}),t.FitAddon=void 0,t.FitAddon=class{activate(e){this._terminal=e}dispose(){}fit(){const e=this.proposeDimensions();if(!e||!this._terminal||isNaN(e.cols)||isNaN(e.rows))return;const t=this._terminal._core;this._terminal.rows===e.rows&&this._terminal.cols===e.cols||(t._renderService.clear(),this._terminal.resize(e.cols,e.rows))}proposeDimensions(){if(!this._terminal)return;if(!this._terminal.element||!this._terminal.element.parentElement)return;const e=this._terminal._core,t=e._renderService.dimensions;if(0===t.css.cell.width||0===t.css.cell.height)return;const r=0===this._terminal.options.scrollback?0:e.viewport.scrollBarWidth,i=window.getComputedStyle(this._terminal.element.parentElement),o=parseInt(i.getPropertyValue("height")),s=Math.max(0,parseInt(i.getPropertyValue("width"))),n=window.getComputedStyle(this._terminal.element),l=o-(parseInt(n.getPropertyValue("padding-top"))+parseInt(n.getPropertyValue("padding-bottom"))),a=s-(parseInt(n.getPropertyValue("padding-right"))+parseInt(n.getPropertyValue("padding-left")))-r;return{cols:Math.max(2,Math.floor(a/t.css.cell.width)),rows:Math.max(1,Math.floor(l/t.css.cell.height))}}}})(),e})()));
-//# sourceMappingURL=addon-fit.js.map
\ No newline at end of file
diff --git a/assets/xterm/xterm.css b/assets/xterm/xterm.css
deleted file mode 100644
index e97b643..0000000
--- a/assets/xterm/xterm.css
+++ /dev/null
@@ -1,218 +0,0 @@
-/**
- * Copyright (c) 2014 The xterm.js authors. All rights reserved.
- * Copyright (c) 2012-2013, Christopher Jeffrey (MIT License)
- * https://github.com/chjj/term.js
- * @license MIT
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- *
- * Originally forked from (with the author's permission):
- * Fabrice Bellard's javascript vt100 for jslinux:
- * http://bellard.org/jslinux/
- * Copyright (c) 2011 Fabrice Bellard
- * The original design remains. The terminal itself
- * has been extended to include xterm CSI codes, among
- * other features.
- */
-
-/**
- * Default styles for xterm.js
- */
-
-.xterm {
- cursor: text;
- position: relative;
- user-select: none;
- -ms-user-select: none;
- -webkit-user-select: none;
-}
-
-.xterm.focus,
-.xterm:focus {
- outline: none;
-}
-
-.xterm .xterm-helpers {
- position: absolute;
- top: 0;
- /**
- * The z-index of the helpers must be higher than the canvases in order for
- * IMEs to appear on top.
- */
- z-index: 5;
-}
-
-.xterm .xterm-helper-textarea {
- padding: 0;
- border: 0;
- margin: 0;
- /* Move textarea out of the screen to the far left, so that the cursor is not visible */
- position: absolute;
- opacity: 0;
- left: -9999em;
- top: 0;
- width: 0;
- height: 0;
- z-index: -5;
- /** Prevent wrapping so the IME appears against the textarea at the correct position */
- white-space: nowrap;
- overflow: hidden;
- resize: none;
-}
-
-.xterm .composition-view {
- /* TODO: Composition position got messed up somewhere */
- background: #000;
- color: #FFF;
- display: none;
- position: absolute;
- white-space: nowrap;
- z-index: 1;
-}
-
-.xterm .composition-view.active {
- display: block;
-}
-
-.xterm .xterm-viewport {
- /* On OS X this is required in order for the scroll bar to appear fully opaque */
- background-color: #000;
- overflow-y: scroll;
- cursor: default;
- position: absolute;
- right: 0;
- left: 0;
- top: 0;
- bottom: 0;
-}
-
-.xterm .xterm-screen {
- position: relative;
-}
-
-.xterm .xterm-screen canvas {
- position: absolute;
- left: 0;
- top: 0;
-}
-
-.xterm .xterm-scroll-area {
- visibility: hidden;
-}
-
-.xterm-char-measure-element {
- display: inline-block;
- visibility: hidden;
- position: absolute;
- top: 0;
- left: -9999em;
- line-height: normal;
-}
-
-.xterm.enable-mouse-events {
- /* When mouse events are enabled (eg. tmux), revert to the standard pointer cursor */
- cursor: default;
-}
-
-.xterm.xterm-cursor-pointer,
-.xterm .xterm-cursor-pointer {
- cursor: pointer;
-}
-
-.xterm.column-select.focus {
- /* Column selection mode */
- cursor: crosshair;
-}
-
-.xterm .xterm-accessibility:not(.debug),
-.xterm .xterm-message {
- position: absolute;
- left: 0;
- top: 0;
- bottom: 0;
- right: 0;
- z-index: 10;
- color: transparent;
- pointer-events: none;
-}
-
-.xterm .xterm-accessibility-tree:not(.debug) *::selection {
- color: transparent;
-}
-
-.xterm .xterm-accessibility-tree {
- user-select: text;
- white-space: pre;
-}
-
-.xterm .live-region {
- position: absolute;
- left: -9999px;
- width: 1px;
- height: 1px;
- overflow: hidden;
-}
-
-.xterm-dim {
- /* Dim should not apply to background, so the opacity of the foreground color is applied
- * explicitly in the generated class and reset to 1 here */
- opacity: 1 !important;
-}
-
-.xterm-underline-1 { text-decoration: underline; }
-.xterm-underline-2 { text-decoration: double underline; }
-.xterm-underline-3 { text-decoration: wavy underline; }
-.xterm-underline-4 { text-decoration: dotted underline; }
-.xterm-underline-5 { text-decoration: dashed underline; }
-
-.xterm-overline {
- text-decoration: overline;
-}
-
-.xterm-overline.xterm-underline-1 { text-decoration: overline underline; }
-.xterm-overline.xterm-underline-2 { text-decoration: overline double underline; }
-.xterm-overline.xterm-underline-3 { text-decoration: overline wavy underline; }
-.xterm-overline.xterm-underline-4 { text-decoration: overline dotted underline; }
-.xterm-overline.xterm-underline-5 { text-decoration: overline dashed underline; }
-
-.xterm-strikethrough {
- text-decoration: line-through;
-}
-
-.xterm-screen .xterm-decoration-container .xterm-decoration {
- z-index: 6;
- position: absolute;
-}
-
-.xterm-screen .xterm-decoration-container .xterm-decoration.xterm-decoration-top-layer {
- z-index: 7;
-}
-
-.xterm-decoration-overview-ruler {
- z-index: 8;
- position: absolute;
- top: 0;
- right: 0;
- pointer-events: none;
-}
-
-.xterm-decoration-top {
- z-index: 2;
- position: relative;
-}
diff --git a/assets/xterm/xterm.js b/assets/xterm/xterm.js
deleted file mode 100644
index 7ca75f8..0000000
--- a/assets/xterm/xterm.js
+++ /dev/null
@@ -1,2 +0,0 @@
-!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var i=t();for(var s in i)("object"==typeof exports?exports:e)[s]=i[s]}}(globalThis,(()=>(()=>{"use strict";var e={4567:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.AccessibilityManager=void 0;const n=i(9042),o=i(9924),a=i(844),h=i(4725),c=i(2585),l=i(3656);let d=t.AccessibilityManager=class extends a.Disposable{constructor(e,t,i,s){super(),this._terminal=e,this._coreBrowserService=i,this._renderService=s,this._rowColumns=new WeakMap,this._liveRegionLineCount=0,this._charsToConsume=[],this._charsToAnnounce="",this._accessibilityContainer=this._coreBrowserService.mainDocument.createElement("div"),this._accessibilityContainer.classList.add("xterm-accessibility"),this._rowContainer=this._coreBrowserService.mainDocument.createElement("div"),this._rowContainer.setAttribute("role","list"),this._rowContainer.classList.add("xterm-accessibility-tree"),this._rowElements=[];for(let e=0;ethis._handleBoundaryFocus(e,0),this._bottomBoundaryFocusListener=e=>this._handleBoundaryFocus(e,1),this._rowElements[0].addEventListener("focus",this._topBoundaryFocusListener),this._rowElements[this._rowElements.length-1].addEventListener("focus",this._bottomBoundaryFocusListener),this._refreshRowsDimensions(),this._accessibilityContainer.appendChild(this._rowContainer),this._liveRegion=this._coreBrowserService.mainDocument.createElement("div"),this._liveRegion.classList.add("live-region"),this._liveRegion.setAttribute("aria-live","assertive"),this._accessibilityContainer.appendChild(this._liveRegion),this._liveRegionDebouncer=this.register(new o.TimeBasedDebouncer(this._renderRows.bind(this))),!this._terminal.element)throw new Error("Cannot enable accessibility before Terminal.open");this._terminal.element.insertAdjacentElement("afterbegin",this._accessibilityContainer),this.register(this._terminal.onResize((e=>this._handleResize(e.rows)))),this.register(this._terminal.onRender((e=>this._refreshRows(e.start,e.end)))),this.register(this._terminal.onScroll((()=>this._refreshRows()))),this.register(this._terminal.onA11yChar((e=>this._handleChar(e)))),this.register(this._terminal.onLineFeed((()=>this._handleChar("\n")))),this.register(this._terminal.onA11yTab((e=>this._handleTab(e)))),this.register(this._terminal.onKey((e=>this._handleKey(e.key)))),this.register(this._terminal.onBlur((()=>this._clearLiveRegion()))),this.register(this._renderService.onDimensionsChange((()=>this._refreshRowsDimensions()))),this.register((0,l.addDisposableDomListener)(document,"selectionchange",(()=>this._handleSelectionChange()))),this.register(this._coreBrowserService.onDprChange((()=>this._refreshRowsDimensions()))),this._refreshRows(),this.register((0,a.toDisposable)((()=>{this._accessibilityContainer.remove(),this._rowElements.length=0})))}_handleTab(e){for(let t=0;t0?this._charsToConsume.shift()!==e&&(this._charsToAnnounce+=e):this._charsToAnnounce+=e,"\n"===e&&(this._liveRegionLineCount++,21===this._liveRegionLineCount&&(this._liveRegion.textContent+=n.tooMuchOutput)))}_clearLiveRegion(){this._liveRegion.textContent="",this._liveRegionLineCount=0}_handleKey(e){this._clearLiveRegion(),/\p{Control}/u.test(e)||this._charsToConsume.push(e)}_refreshRows(e,t){this._liveRegionDebouncer.refresh(e,t,this._terminal.rows)}_renderRows(e,t){const i=this._terminal.buffer,s=i.lines.length.toString();for(let r=e;r<=t;r++){const e=i.lines.get(i.ydisp+r),t=[],n=e?.translateToString(!0,void 0,void 0,t)||"",o=(i.ydisp+r+1).toString(),a=this._rowElements[r];a&&(0===n.length?(a.innerText=" ",this._rowColumns.set(a,[0,1])):(a.textContent=n,this._rowColumns.set(a,t)),a.setAttribute("aria-posinset",o),a.setAttribute("aria-setsize",s))}this._announceCharacters()}_announceCharacters(){0!==this._charsToAnnounce.length&&(this._liveRegion.textContent+=this._charsToAnnounce,this._charsToAnnounce="")}_handleBoundaryFocus(e,t){const i=e.target,s=this._rowElements[0===t?1:this._rowElements.length-2];if(i.getAttribute("aria-posinset")===(0===t?"1":`${this._terminal.buffer.lines.length}`))return;if(e.relatedTarget!==s)return;let r,n;if(0===t?(r=i,n=this._rowElements.pop(),this._rowContainer.removeChild(n)):(r=this._rowElements.shift(),n=i,this._rowContainer.removeChild(r)),r.removeEventListener("focus",this._topBoundaryFocusListener),n.removeEventListener("focus",this._bottomBoundaryFocusListener),0===t){const e=this._createAccessibilityTreeNode();this._rowElements.unshift(e),this._rowContainer.insertAdjacentElement("afterbegin",e)}else{const e=this._createAccessibilityTreeNode();this._rowElements.push(e),this._rowContainer.appendChild(e)}this._rowElements[0].addEventListener("focus",this._topBoundaryFocusListener),this._rowElements[this._rowElements.length-1].addEventListener("focus",this._bottomBoundaryFocusListener),this._terminal.scrollLines(0===t?-1:1),this._rowElements[0===t?1:this._rowElements.length-2].focus(),e.preventDefault(),e.stopImmediatePropagation()}_handleSelectionChange(){if(0===this._rowElements.length)return;const e=document.getSelection();if(!e)return;if(e.isCollapsed)return void(this._rowContainer.contains(e.anchorNode)&&this._terminal.clearSelection());if(!e.anchorNode||!e.focusNode)return void console.error("anchorNode and/or focusNode are null");let t={node:e.anchorNode,offset:e.anchorOffset},i={node:e.focusNode,offset:e.focusOffset};if((t.node.compareDocumentPosition(i.node)&Node.DOCUMENT_POSITION_PRECEDING||t.node===i.node&&t.offset>i.offset)&&([t,i]=[i,t]),t.node.compareDocumentPosition(this._rowElements[0])&(Node.DOCUMENT_POSITION_CONTAINED_BY|Node.DOCUMENT_POSITION_FOLLOWING)&&(t={node:this._rowElements[0].childNodes[0],offset:0}),!this._rowContainer.contains(t.node))return;const s=this._rowElements.slice(-1)[0];if(i.node.compareDocumentPosition(s)&(Node.DOCUMENT_POSITION_CONTAINED_BY|Node.DOCUMENT_POSITION_PRECEDING)&&(i={node:s,offset:s.textContent?.length??0}),!this._rowContainer.contains(i.node))return;const r=({node:e,offset:t})=>{const i=e instanceof Text?e.parentNode:e;let s=parseInt(i?.getAttribute("aria-posinset"),10)-1;if(isNaN(s))return console.warn("row is invalid. Race condition?"),null;const r=this._rowColumns.get(i);if(!r)return console.warn("columns is null. Race condition?"),null;let n=t=this._terminal.cols&&(++s,n=0),{row:s,column:n}},n=r(t),o=r(i);if(n&&o){if(n.row>o.row||n.row===o.row&&n.column>=o.column)throw new Error("invalid range");this._terminal.select(n.column,n.row,(o.row-n.row)*this._terminal.cols-n.column+o.column)}}_handleResize(e){this._rowElements[this._rowElements.length-1].removeEventListener("focus",this._bottomBoundaryFocusListener);for(let e=this._rowContainer.children.length;ee;)this._rowContainer.removeChild(this._rowElements.pop());this._rowElements[this._rowElements.length-1].addEventListener("focus",this._bottomBoundaryFocusListener),this._refreshRowsDimensions()}_createAccessibilityTreeNode(){const e=this._coreBrowserService.mainDocument.createElement("div");return e.setAttribute("role","listitem"),e.tabIndex=-1,this._refreshRowDimensions(e),e}_refreshRowsDimensions(){if(this._renderService.dimensions.css.cell.height){this._accessibilityContainer.style.width=`${this._renderService.dimensions.css.canvas.width}px`,this._rowElements.length!==this._terminal.rows&&this._handleResize(this._terminal.rows);for(let e=0;e{function i(e){return e.replace(/\r?\n/g,"\r")}function s(e,t){return t?"[200~"+e+"[201~":e}function r(e,t,r,n){e=s(e=i(e),r.decPrivateModes.bracketedPasteMode&&!0!==n.rawOptions.ignoreBracketedPasteMode),r.triggerDataEvent(e,!0),t.value=""}function n(e,t,i){const s=i.getBoundingClientRect(),r=e.clientX-s.left-10,n=e.clientY-s.top-10;t.style.width="20px",t.style.height="20px",t.style.left=`${r}px`,t.style.top=`${n}px`,t.style.zIndex="1000",t.focus()}Object.defineProperty(t,"__esModule",{value:!0}),t.rightClickHandler=t.moveTextAreaUnderMouseCursor=t.paste=t.handlePasteEvent=t.copyHandler=t.bracketTextForPaste=t.prepareTextForTerminal=void 0,t.prepareTextForTerminal=i,t.bracketTextForPaste=s,t.copyHandler=function(e,t){e.clipboardData&&e.clipboardData.setData("text/plain",t.selectionText),e.preventDefault()},t.handlePasteEvent=function(e,t,i,s){e.stopPropagation(),e.clipboardData&&r(e.clipboardData.getData("text/plain"),t,i,s)},t.paste=r,t.moveTextAreaUnderMouseCursor=n,t.rightClickHandler=function(e,t,i,s,r){n(e,t,i),r&&s.rightClickSelect(e),t.value=s.selectionText,t.select()}},7239:(e,t,i)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.ColorContrastCache=void 0;const s=i(1505);t.ColorContrastCache=class{constructor(){this._color=new s.TwoKeyMap,this._css=new s.TwoKeyMap}setCss(e,t,i){this._css.set(e,t,i)}getCss(e,t){return this._css.get(e,t)}setColor(e,t,i){this._color.set(e,t,i)}getColor(e,t){return this._color.get(e,t)}clear(){this._color.clear(),this._css.clear()}}},3656:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.addDisposableDomListener=void 0,t.addDisposableDomListener=function(e,t,i,s){e.addEventListener(t,i,s);let r=!1;return{dispose:()=>{r||(r=!0,e.removeEventListener(t,i,s))}}}},3551:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.Linkifier=void 0;const n=i(3656),o=i(8460),a=i(844),h=i(2585),c=i(4725);let l=t.Linkifier=class extends a.Disposable{get currentLink(){return this._currentLink}constructor(e,t,i,s,r){super(),this._element=e,this._mouseService=t,this._renderService=i,this._bufferService=s,this._linkProviderService=r,this._linkCacheDisposables=[],this._isMouseOut=!0,this._wasResized=!1,this._activeLine=-1,this._onShowLinkUnderline=this.register(new o.EventEmitter),this.onShowLinkUnderline=this._onShowLinkUnderline.event,this._onHideLinkUnderline=this.register(new o.EventEmitter),this.onHideLinkUnderline=this._onHideLinkUnderline.event,this.register((0,a.getDisposeArrayDisposable)(this._linkCacheDisposables)),this.register((0,a.toDisposable)((()=>{this._lastMouseEvent=void 0,this._activeProviderReplies?.clear()}))),this.register(this._bufferService.onResize((()=>{this._clearCurrentLink(),this._wasResized=!0}))),this.register((0,n.addDisposableDomListener)(this._element,"mouseleave",(()=>{this._isMouseOut=!0,this._clearCurrentLink()}))),this.register((0,n.addDisposableDomListener)(this._element,"mousemove",this._handleMouseMove.bind(this))),this.register((0,n.addDisposableDomListener)(this._element,"mousedown",this._handleMouseDown.bind(this))),this.register((0,n.addDisposableDomListener)(this._element,"mouseup",this._handleMouseUp.bind(this)))}_handleMouseMove(e){this._lastMouseEvent=e;const t=this._positionFromMouseEvent(e,this._element,this._mouseService);if(!t)return;this._isMouseOut=!1;const i=e.composedPath();for(let e=0;e{e?.forEach((e=>{e.link.dispose&&e.link.dispose()}))})),this._activeProviderReplies=new Map,this._activeLine=e.y);let i=!1;for(const[s,r]of this._linkProviderService.linkProviders.entries())if(t){const t=this._activeProviderReplies?.get(s);t&&(i=this._checkLinkProviderResult(s,e,i))}else r.provideLinks(e.y,(t=>{if(this._isMouseOut)return;const r=t?.map((e=>({link:e})));this._activeProviderReplies?.set(s,r),i=this._checkLinkProviderResult(s,e,i),this._activeProviderReplies?.size===this._linkProviderService.linkProviders.length&&this._removeIntersectingLinks(e.y,this._activeProviderReplies)}))}_removeIntersectingLinks(e,t){const i=new Set;for(let s=0;se?this._bufferService.cols:s.link.range.end.x;for(let e=n;e<=o;e++){if(i.has(e)){r.splice(t--,1);break}i.add(e)}}}}_checkLinkProviderResult(e,t,i){if(!this._activeProviderReplies)return i;const s=this._activeProviderReplies.get(e);let r=!1;for(let t=0;tthis._linkAtPosition(e.link,t)));e&&(i=!0,this._handleNewLink(e))}if(this._activeProviderReplies.size===this._linkProviderService.linkProviders.length&&!i)for(let e=0;ethis._linkAtPosition(e.link,t)));if(s){i=!0,this._handleNewLink(s);break}}return i}_handleMouseDown(){this._mouseDownLink=this._currentLink}_handleMouseUp(e){if(!this._currentLink)return;const t=this._positionFromMouseEvent(e,this._element,this._mouseService);t&&this._mouseDownLink===this._currentLink&&this._linkAtPosition(this._currentLink.link,t)&&this._currentLink.link.activate(e,this._currentLink.link.text)}_clearCurrentLink(e,t){this._currentLink&&this._lastMouseEvent&&(!e||!t||this._currentLink.link.range.start.y>=e&&this._currentLink.link.range.end.y<=t)&&(this._linkLeave(this._element,this._currentLink.link,this._lastMouseEvent),this._currentLink=void 0,(0,a.disposeArray)(this._linkCacheDisposables))}_handleNewLink(e){if(!this._lastMouseEvent)return;const t=this._positionFromMouseEvent(this._lastMouseEvent,this._element,this._mouseService);t&&this._linkAtPosition(e.link,t)&&(this._currentLink=e,this._currentLink.state={decorations:{underline:void 0===e.link.decorations||e.link.decorations.underline,pointerCursor:void 0===e.link.decorations||e.link.decorations.pointerCursor},isHovered:!0},this._linkHover(this._element,e.link,this._lastMouseEvent),e.link.decorations={},Object.defineProperties(e.link.decorations,{pointerCursor:{get:()=>this._currentLink?.state?.decorations.pointerCursor,set:e=>{this._currentLink?.state&&this._currentLink.state.decorations.pointerCursor!==e&&(this._currentLink.state.decorations.pointerCursor=e,this._currentLink.state.isHovered&&this._element.classList.toggle("xterm-cursor-pointer",e))}},underline:{get:()=>this._currentLink?.state?.decorations.underline,set:t=>{this._currentLink?.state&&this._currentLink?.state?.decorations.underline!==t&&(this._currentLink.state.decorations.underline=t,this._currentLink.state.isHovered&&this._fireUnderlineEvent(e.link,t))}}}),this._linkCacheDisposables.push(this._renderService.onRenderedViewportChange((e=>{if(!this._currentLink)return;const t=0===e.start?0:e.start+1+this._bufferService.buffer.ydisp,i=this._bufferService.buffer.ydisp+1+e.end;if(this._currentLink.link.range.start.y>=t&&this._currentLink.link.range.end.y<=i&&(this._clearCurrentLink(t,i),this._lastMouseEvent)){const e=this._positionFromMouseEvent(this._lastMouseEvent,this._element,this._mouseService);e&&this._askForLink(e,!1)}}))))}_linkHover(e,t,i){this._currentLink?.state&&(this._currentLink.state.isHovered=!0,this._currentLink.state.decorations.underline&&this._fireUnderlineEvent(t,!0),this._currentLink.state.decorations.pointerCursor&&e.classList.add("xterm-cursor-pointer")),t.hover&&t.hover(i,t.text)}_fireUnderlineEvent(e,t){const i=e.range,s=this._bufferService.buffer.ydisp,r=this._createLinkUnderlineEvent(i.start.x-1,i.start.y-s-1,i.end.x,i.end.y-s-1,void 0);(t?this._onShowLinkUnderline:this._onHideLinkUnderline).fire(r)}_linkLeave(e,t,i){this._currentLink?.state&&(this._currentLink.state.isHovered=!1,this._currentLink.state.decorations.underline&&this._fireUnderlineEvent(t,!1),this._currentLink.state.decorations.pointerCursor&&e.classList.remove("xterm-cursor-pointer")),t.leave&&t.leave(i,t.text)}_linkAtPosition(e,t){const i=e.range.start.y*this._bufferService.cols+e.range.start.x,s=e.range.end.y*this._bufferService.cols+e.range.end.x,r=t.y*this._bufferService.cols+t.x;return i<=r&&r<=s}_positionFromMouseEvent(e,t,i){const s=i.getCoords(e,t,this._bufferService.cols,this._bufferService.rows);if(s)return{x:s[0],y:s[1]+this._bufferService.buffer.ydisp}}_createLinkUnderlineEvent(e,t,i,s,r){return{x1:e,y1:t,x2:i,y2:s,cols:this._bufferService.cols,fg:r}}};t.Linkifier=l=s([r(1,c.IMouseService),r(2,c.IRenderService),r(3,h.IBufferService),r(4,c.ILinkProviderService)],l)},9042:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.tooMuchOutput=t.promptLabel=void 0,t.promptLabel="Terminal input",t.tooMuchOutput="Too much output to announce, navigate to rows manually to read"},3730:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.OscLinkProvider=void 0;const n=i(511),o=i(2585);let a=t.OscLinkProvider=class{constructor(e,t,i){this._bufferService=e,this._optionsService=t,this._oscLinkService=i}provideLinks(e,t){const i=this._bufferService.buffer.lines.get(e-1);if(!i)return void t(void 0);const s=[],r=this._optionsService.rawOptions.linkHandler,o=new n.CellData,a=i.getTrimmedLength();let c=-1,l=-1,d=!1;for(let t=0;tr?r.activate(e,t,n):h(0,t),hover:(e,t)=>r?.hover?.(e,t,n),leave:(e,t)=>r?.leave?.(e,t,n)})}d=!1,o.hasExtendedAttrs()&&o.extended.urlId?(l=t,c=o.extended.urlId):(l=-1,c=-1)}}t(s)}};function h(e,t){if(confirm(`Do you want to navigate to ${t}?\n\nWARNING: This link could potentially be dangerous`)){const e=window.open();if(e){try{e.opener=null}catch{}e.location.href=t}else console.warn("Opening link blocked as opener could not be cleared")}}t.OscLinkProvider=a=s([r(0,o.IBufferService),r(1,o.IOptionsService),r(2,o.IOscLinkService)],a)},6193:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.RenderDebouncer=void 0,t.RenderDebouncer=class{constructor(e,t){this._renderCallback=e,this._coreBrowserService=t,this._refreshCallbacks=[]}dispose(){this._animationFrame&&(this._coreBrowserService.window.cancelAnimationFrame(this._animationFrame),this._animationFrame=void 0)}addRefreshCallback(e){return this._refreshCallbacks.push(e),this._animationFrame||(this._animationFrame=this._coreBrowserService.window.requestAnimationFrame((()=>this._innerRefresh()))),this._animationFrame}refresh(e,t,i){this._rowCount=i,e=void 0!==e?e:0,t=void 0!==t?t:this._rowCount-1,this._rowStart=void 0!==this._rowStart?Math.min(this._rowStart,e):e,this._rowEnd=void 0!==this._rowEnd?Math.max(this._rowEnd,t):t,this._animationFrame||(this._animationFrame=this._coreBrowserService.window.requestAnimationFrame((()=>this._innerRefresh())))}_innerRefresh(){if(this._animationFrame=void 0,void 0===this._rowStart||void 0===this._rowEnd||void 0===this._rowCount)return void this._runRefreshCallbacks();const e=Math.max(this._rowStart,0),t=Math.min(this._rowEnd,this._rowCount-1);this._rowStart=void 0,this._rowEnd=void 0,this._renderCallback(e,t),this._runRefreshCallbacks()}_runRefreshCallbacks(){for(const e of this._refreshCallbacks)e(0);this._refreshCallbacks=[]}}},3236:(e,t,i)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.Terminal=void 0;const s=i(3614),r=i(3656),n=i(3551),o=i(9042),a=i(3730),h=i(1680),c=i(3107),l=i(5744),d=i(2950),_=i(1296),u=i(428),f=i(4269),v=i(5114),p=i(8934),g=i(3230),m=i(9312),S=i(4725),C=i(6731),b=i(8055),w=i(8969),y=i(8460),E=i(844),k=i(6114),L=i(8437),D=i(2584),R=i(7399),x=i(5941),A=i(9074),B=i(2585),T=i(5435),M=i(4567),O=i(779);class P extends w.CoreTerminal{get onFocus(){return this._onFocus.event}get onBlur(){return this._onBlur.event}get onA11yChar(){return this._onA11yCharEmitter.event}get onA11yTab(){return this._onA11yTabEmitter.event}get onWillOpen(){return this._onWillOpen.event}constructor(e={}){super(e),this.browser=k,this._keyDownHandled=!1,this._keyDownSeen=!1,this._keyPressHandled=!1,this._unprocessedDeadKey=!1,this._accessibilityManager=this.register(new E.MutableDisposable),this._onCursorMove=this.register(new y.EventEmitter),this.onCursorMove=this._onCursorMove.event,this._onKey=this.register(new y.EventEmitter),this.onKey=this._onKey.event,this._onRender=this.register(new y.EventEmitter),this.onRender=this._onRender.event,this._onSelectionChange=this.register(new y.EventEmitter),this.onSelectionChange=this._onSelectionChange.event,this._onTitleChange=this.register(new y.EventEmitter),this.onTitleChange=this._onTitleChange.event,this._onBell=this.register(new y.EventEmitter),this.onBell=this._onBell.event,this._onFocus=this.register(new y.EventEmitter),this._onBlur=this.register(new y.EventEmitter),this._onA11yCharEmitter=this.register(new y.EventEmitter),this._onA11yTabEmitter=this.register(new y.EventEmitter),this._onWillOpen=this.register(new y.EventEmitter),this._setup(),this._decorationService=this._instantiationService.createInstance(A.DecorationService),this._instantiationService.setService(B.IDecorationService,this._decorationService),this._linkProviderService=this._instantiationService.createInstance(O.LinkProviderService),this._instantiationService.setService(S.ILinkProviderService,this._linkProviderService),this._linkProviderService.registerLinkProvider(this._instantiationService.createInstance(a.OscLinkProvider)),this.register(this._inputHandler.onRequestBell((()=>this._onBell.fire()))),this.register(this._inputHandler.onRequestRefreshRows(((e,t)=>this.refresh(e,t)))),this.register(this._inputHandler.onRequestSendFocus((()=>this._reportFocus()))),this.register(this._inputHandler.onRequestReset((()=>this.reset()))),this.register(this._inputHandler.onRequestWindowsOptionsReport((e=>this._reportWindowsOptions(e)))),this.register(this._inputHandler.onColor((e=>this._handleColorEvent(e)))),this.register((0,y.forwardEvent)(this._inputHandler.onCursorMove,this._onCursorMove)),this.register((0,y.forwardEvent)(this._inputHandler.onTitleChange,this._onTitleChange)),this.register((0,y.forwardEvent)(this._inputHandler.onA11yChar,this._onA11yCharEmitter)),this.register((0,y.forwardEvent)(this._inputHandler.onA11yTab,this._onA11yTabEmitter)),this.register(this._bufferService.onResize((e=>this._afterResize(e.cols,e.rows)))),this.register((0,E.toDisposable)((()=>{this._customKeyEventHandler=void 0,this.element?.parentNode?.removeChild(this.element)})))}_handleColorEvent(e){if(this._themeService)for(const t of e){let e,i="";switch(t.index){case 256:e="foreground",i="10";break;case 257:e="background",i="11";break;case 258:e="cursor",i="12";break;default:e="ansi",i="4;"+t.index}switch(t.type){case 0:const s=b.color.toColorRGB("ansi"===e?this._themeService.colors.ansi[t.index]:this._themeService.colors[e]);this.coreService.triggerDataEvent(`${D.C0.ESC}]${i};${(0,x.toRgbString)(s)}${D.C1_ESCAPED.ST}`);break;case 1:if("ansi"===e)this._themeService.modifyColors((e=>e.ansi[t.index]=b.channels.toColor(...t.color)));else{const i=e;this._themeService.modifyColors((e=>e[i]=b.channels.toColor(...t.color)))}break;case 2:this._themeService.restoreColor(t.index)}}}_setup(){super._setup(),this._customKeyEventHandler=void 0}get buffer(){return this.buffers.active}focus(){this.textarea&&this.textarea.focus({preventScroll:!0})}_handleScreenReaderModeOptionChange(e){e?!this._accessibilityManager.value&&this._renderService&&(this._accessibilityManager.value=this._instantiationService.createInstance(M.AccessibilityManager,this)):this._accessibilityManager.clear()}_handleTextAreaFocus(e){this.coreService.decPrivateModes.sendFocus&&this.coreService.triggerDataEvent(D.C0.ESC+"[I"),this.element.classList.add("focus"),this._showCursor(),this._onFocus.fire()}blur(){return this.textarea?.blur()}_handleTextAreaBlur(){this.textarea.value="",this.refresh(this.buffer.y,this.buffer.y),this.coreService.decPrivateModes.sendFocus&&this.coreService.triggerDataEvent(D.C0.ESC+"[O"),this.element.classList.remove("focus"),this._onBlur.fire()}_syncTextArea(){if(!this.textarea||!this.buffer.isCursorInViewport||this._compositionHelper.isComposing||!this._renderService)return;const e=this.buffer.ybase+this.buffer.y,t=this.buffer.lines.get(e);if(!t)return;const i=Math.min(this.buffer.x,this.cols-1),s=this._renderService.dimensions.css.cell.height,r=t.getWidth(i),n=this._renderService.dimensions.css.cell.width*r,o=this.buffer.y*this._renderService.dimensions.css.cell.height,a=i*this._renderService.dimensions.css.cell.width;this.textarea.style.left=a+"px",this.textarea.style.top=o+"px",this.textarea.style.width=n+"px",this.textarea.style.height=s+"px",this.textarea.style.lineHeight=s+"px",this.textarea.style.zIndex="-5"}_initGlobal(){this._bindKeys(),this.register((0,r.addDisposableDomListener)(this.element,"copy",(e=>{this.hasSelection()&&(0,s.copyHandler)(e,this._selectionService)})));const e=e=>(0,s.handlePasteEvent)(e,this.textarea,this.coreService,this.optionsService);this.register((0,r.addDisposableDomListener)(this.textarea,"paste",e)),this.register((0,r.addDisposableDomListener)(this.element,"paste",e)),k.isFirefox?this.register((0,r.addDisposableDomListener)(this.element,"mousedown",(e=>{2===e.button&&(0,s.rightClickHandler)(e,this.textarea,this.screenElement,this._selectionService,this.options.rightClickSelectsWord)}))):this.register((0,r.addDisposableDomListener)(this.element,"contextmenu",(e=>{(0,s.rightClickHandler)(e,this.textarea,this.screenElement,this._selectionService,this.options.rightClickSelectsWord)}))),k.isLinux&&this.register((0,r.addDisposableDomListener)(this.element,"auxclick",(e=>{1===e.button&&(0,s.moveTextAreaUnderMouseCursor)(e,this.textarea,this.screenElement)})))}_bindKeys(){this.register((0,r.addDisposableDomListener)(this.textarea,"keyup",(e=>this._keyUp(e)),!0)),this.register((0,r.addDisposableDomListener)(this.textarea,"keydown",(e=>this._keyDown(e)),!0)),this.register((0,r.addDisposableDomListener)(this.textarea,"keypress",(e=>this._keyPress(e)),!0)),this.register((0,r.addDisposableDomListener)(this.textarea,"compositionstart",(()=>this._compositionHelper.compositionstart()))),this.register((0,r.addDisposableDomListener)(this.textarea,"compositionupdate",(e=>this._compositionHelper.compositionupdate(e)))),this.register((0,r.addDisposableDomListener)(this.textarea,"compositionend",(()=>this._compositionHelper.compositionend()))),this.register((0,r.addDisposableDomListener)(this.textarea,"input",(e=>this._inputEvent(e)),!0)),this.register(this.onRender((()=>this._compositionHelper.updateCompositionElements())))}open(e){if(!e)throw new Error("Terminal requires a parent element.");if(e.isConnected||this._logService.debug("Terminal.open was called on an element that was not attached to the DOM"),this.element?.ownerDocument.defaultView&&this._coreBrowserService)return void(this.element.ownerDocument.defaultView!==this._coreBrowserService.window&&(this._coreBrowserService.window=this.element.ownerDocument.defaultView));this._document=e.ownerDocument,this.options.documentOverride&&this.options.documentOverride instanceof Document&&(this._document=this.optionsService.rawOptions.documentOverride),this.element=this._document.createElement("div"),this.element.dir="ltr",this.element.classList.add("terminal"),this.element.classList.add("xterm"),e.appendChild(this.element);const t=this._document.createDocumentFragment();this._viewportElement=this._document.createElement("div"),this._viewportElement.classList.add("xterm-viewport"),t.appendChild(this._viewportElement),this._viewportScrollArea=this._document.createElement("div"),this._viewportScrollArea.classList.add("xterm-scroll-area"),this._viewportElement.appendChild(this._viewportScrollArea),this.screenElement=this._document.createElement("div"),this.screenElement.classList.add("xterm-screen"),this.register((0,r.addDisposableDomListener)(this.screenElement,"mousemove",(e=>this.updateCursorStyle(e)))),this._helperContainer=this._document.createElement("div"),this._helperContainer.classList.add("xterm-helpers"),this.screenElement.appendChild(this._helperContainer),t.appendChild(this.screenElement),this.textarea=this._document.createElement("textarea"),this.textarea.classList.add("xterm-helper-textarea"),this.textarea.setAttribute("aria-label",o.promptLabel),k.isChromeOS||this.textarea.setAttribute("aria-multiline","false"),this.textarea.setAttribute("autocorrect","off"),this.textarea.setAttribute("autocapitalize","off"),this.textarea.setAttribute("spellcheck","false"),this.textarea.tabIndex=0,this._coreBrowserService=this.register(this._instantiationService.createInstance(v.CoreBrowserService,this.textarea,e.ownerDocument.defaultView??window,this._document??"undefined"!=typeof window?window.document:null)),this._instantiationService.setService(S.ICoreBrowserService,this._coreBrowserService),this.register((0,r.addDisposableDomListener)(this.textarea,"focus",(e=>this._handleTextAreaFocus(e)))),this.register((0,r.addDisposableDomListener)(this.textarea,"blur",(()=>this._handleTextAreaBlur()))),this._helperContainer.appendChild(this.textarea),this._charSizeService=this._instantiationService.createInstance(u.CharSizeService,this._document,this._helperContainer),this._instantiationService.setService(S.ICharSizeService,this._charSizeService),this._themeService=this._instantiationService.createInstance(C.ThemeService),this._instantiationService.setService(S.IThemeService,this._themeService),this._characterJoinerService=this._instantiationService.createInstance(f.CharacterJoinerService),this._instantiationService.setService(S.ICharacterJoinerService,this._characterJoinerService),this._renderService=this.register(this._instantiationService.createInstance(g.RenderService,this.rows,this.screenElement)),this._instantiationService.setService(S.IRenderService,this._renderService),this.register(this._renderService.onRenderedViewportChange((e=>this._onRender.fire(e)))),this.onResize((e=>this._renderService.resize(e.cols,e.rows))),this._compositionView=this._document.createElement("div"),this._compositionView.classList.add("composition-view"),this._compositionHelper=this._instantiationService.createInstance(d.CompositionHelper,this.textarea,this._compositionView),this._helperContainer.appendChild(this._compositionView),this._mouseService=this._instantiationService.createInstance(p.MouseService),this._instantiationService.setService(S.IMouseService,this._mouseService),this.linkifier=this.register(this._instantiationService.createInstance(n.Linkifier,this.screenElement)),this.element.appendChild(t);try{this._onWillOpen.fire(this.element)}catch{}this._renderService.hasRenderer()||this._renderService.setRenderer(this._createRenderer()),this.viewport=this._instantiationService.createInstance(h.Viewport,this._viewportElement,this._viewportScrollArea),this.viewport.onRequestScrollLines((e=>this.scrollLines(e.amount,e.suppressScrollEvent,1))),this.register(this._inputHandler.onRequestSyncScrollBar((()=>this.viewport.syncScrollArea()))),this.register(this.viewport),this.register(this.onCursorMove((()=>{this._renderService.handleCursorMove(),this._syncTextArea()}))),this.register(this.onResize((()=>this._renderService.handleResize(this.cols,this.rows)))),this.register(this.onBlur((()=>this._renderService.handleBlur()))),this.register(this.onFocus((()=>this._renderService.handleFocus()))),this.register(this._renderService.onDimensionsChange((()=>this.viewport.syncScrollArea()))),this._selectionService=this.register(this._instantiationService.createInstance(m.SelectionService,this.element,this.screenElement,this.linkifier)),this._instantiationService.setService(S.ISelectionService,this._selectionService),this.register(this._selectionService.onRequestScrollLines((e=>this.scrollLines(e.amount,e.suppressScrollEvent)))),this.register(this._selectionService.onSelectionChange((()=>this._onSelectionChange.fire()))),this.register(this._selectionService.onRequestRedraw((e=>this._renderService.handleSelectionChanged(e.start,e.end,e.columnSelectMode)))),this.register(this._selectionService.onLinuxMouseSelection((e=>{this.textarea.value=e,this.textarea.focus(),this.textarea.select()}))),this.register(this._onScroll.event((e=>{this.viewport.syncScrollArea(),this._selectionService.refresh()}))),this.register((0,r.addDisposableDomListener)(this._viewportElement,"scroll",(()=>this._selectionService.refresh()))),this.register(this._instantiationService.createInstance(c.BufferDecorationRenderer,this.screenElement)),this.register((0,r.addDisposableDomListener)(this.element,"mousedown",(e=>this._selectionService.handleMouseDown(e)))),this.coreMouseService.areMouseEventsActive?(this._selectionService.disable(),this.element.classList.add("enable-mouse-events")):this._selectionService.enable(),this.options.screenReaderMode&&(this._accessibilityManager.value=this._instantiationService.createInstance(M.AccessibilityManager,this)),this.register(this.optionsService.onSpecificOptionChange("screenReaderMode",(e=>this._handleScreenReaderModeOptionChange(e)))),this.options.overviewRulerWidth&&(this._overviewRulerRenderer=this.register(this._instantiationService.createInstance(l.OverviewRulerRenderer,this._viewportElement,this.screenElement))),this.optionsService.onSpecificOptionChange("overviewRulerWidth",(e=>{!this._overviewRulerRenderer&&e&&this._viewportElement&&this.screenElement&&(this._overviewRulerRenderer=this.register(this._instantiationService.createInstance(l.OverviewRulerRenderer,this._viewportElement,this.screenElement)))})),this._charSizeService.measure(),this.refresh(0,this.rows-1),this._initGlobal(),this.bindMouse()}_createRenderer(){return this._instantiationService.createInstance(_.DomRenderer,this,this._document,this.element,this.screenElement,this._viewportElement,this._helperContainer,this.linkifier)}bindMouse(){const e=this,t=this.element;function i(t){const i=e._mouseService.getMouseReportCoords(t,e.screenElement);if(!i)return!1;let s,r;switch(t.overrideType||t.type){case"mousemove":r=32,void 0===t.buttons?(s=3,void 0!==t.button&&(s=t.button<3?t.button:3)):s=1&t.buttons?0:4&t.buttons?1:2&t.buttons?2:3;break;case"mouseup":r=0,s=t.button<3?t.button:3;break;case"mousedown":r=1,s=t.button<3?t.button:3;break;case"wheel":if(e._customWheelEventHandler&&!1===e._customWheelEventHandler(t))return!1;if(0===e.viewport.getLinesScrolled(t))return!1;r=t.deltaY<0?0:1,s=4;break;default:return!1}return!(void 0===r||void 0===s||s>4)&&e.coreMouseService.triggerMouseEvent({col:i.col,row:i.row,x:i.x,y:i.y,button:s,action:r,ctrl:t.ctrlKey,alt:t.altKey,shift:t.shiftKey})}const s={mouseup:null,wheel:null,mousedrag:null,mousemove:null},n={mouseup:e=>(i(e),e.buttons||(this._document.removeEventListener("mouseup",s.mouseup),s.mousedrag&&this._document.removeEventListener("mousemove",s.mousedrag)),this.cancel(e)),wheel:e=>(i(e),this.cancel(e,!0)),mousedrag:e=>{e.buttons&&i(e)},mousemove:e=>{e.buttons||i(e)}};this.register(this.coreMouseService.onProtocolChange((e=>{e?("debug"===this.optionsService.rawOptions.logLevel&&this._logService.debug("Binding to mouse events:",this.coreMouseService.explainEvents(e)),this.element.classList.add("enable-mouse-events"),this._selectionService.disable()):(this._logService.debug("Unbinding from mouse events."),this.element.classList.remove("enable-mouse-events"),this._selectionService.enable()),8&e?s.mousemove||(t.addEventListener("mousemove",n.mousemove),s.mousemove=n.mousemove):(t.removeEventListener("mousemove",s.mousemove),s.mousemove=null),16&e?s.wheel||(t.addEventListener("wheel",n.wheel,{passive:!1}),s.wheel=n.wheel):(t.removeEventListener("wheel",s.wheel),s.wheel=null),2&e?s.mouseup||(s.mouseup=n.mouseup):(this._document.removeEventListener("mouseup",s.mouseup),s.mouseup=null),4&e?s.mousedrag||(s.mousedrag=n.mousedrag):(this._document.removeEventListener("mousemove",s.mousedrag),s.mousedrag=null)}))),this.coreMouseService.activeProtocol=this.coreMouseService.activeProtocol,this.register((0,r.addDisposableDomListener)(t,"mousedown",(e=>{if(e.preventDefault(),this.focus(),this.coreMouseService.areMouseEventsActive&&!this._selectionService.shouldForceSelection(e))return i(e),s.mouseup&&this._document.addEventListener("mouseup",s.mouseup),s.mousedrag&&this._document.addEventListener("mousemove",s.mousedrag),this.cancel(e)}))),this.register((0,r.addDisposableDomListener)(t,"wheel",(e=>{if(!s.wheel){if(this._customWheelEventHandler&&!1===this._customWheelEventHandler(e))return!1;if(!this.buffer.hasScrollback){const t=this.viewport.getLinesScrolled(e);if(0===t)return;const i=D.C0.ESC+(this.coreService.decPrivateModes.applicationCursorKeys?"O":"[")+(e.deltaY<0?"A":"B");let s="";for(let e=0;e{if(!this.coreMouseService.areMouseEventsActive)return this.viewport.handleTouchStart(e),this.cancel(e)}),{passive:!0})),this.register((0,r.addDisposableDomListener)(t,"touchmove",(e=>{if(!this.coreMouseService.areMouseEventsActive)return this.viewport.handleTouchMove(e)?void 0:this.cancel(e)}),{passive:!1}))}refresh(e,t){this._renderService?.refreshRows(e,t)}updateCursorStyle(e){this._selectionService?.shouldColumnSelect(e)?this.element.classList.add("column-select"):this.element.classList.remove("column-select")}_showCursor(){this.coreService.isCursorInitialized||(this.coreService.isCursorInitialized=!0,this.refresh(this.buffer.y,this.buffer.y))}scrollLines(e,t,i=0){1===i?(super.scrollLines(e,t,i),this.refresh(0,this.rows-1)):this.viewport?.scrollLines(e)}paste(e){(0,s.paste)(e,this.textarea,this.coreService,this.optionsService)}attachCustomKeyEventHandler(e){this._customKeyEventHandler=e}attachCustomWheelEventHandler(e){this._customWheelEventHandler=e}registerLinkProvider(e){return this._linkProviderService.registerLinkProvider(e)}registerCharacterJoiner(e){if(!this._characterJoinerService)throw new Error("Terminal must be opened first");const t=this._characterJoinerService.register(e);return this.refresh(0,this.rows-1),t}deregisterCharacterJoiner(e){if(!this._characterJoinerService)throw new Error("Terminal must be opened first");this._characterJoinerService.deregister(e)&&this.refresh(0,this.rows-1)}get markers(){return this.buffer.markers}registerMarker(e){return this.buffer.addMarker(this.buffer.ybase+this.buffer.y+e)}registerDecoration(e){return this._decorationService.registerDecoration(e)}hasSelection(){return!!this._selectionService&&this._selectionService.hasSelection}select(e,t,i){this._selectionService.setSelection(e,t,i)}getSelection(){return this._selectionService?this._selectionService.selectionText:""}getSelectionPosition(){if(this._selectionService&&this._selectionService.hasSelection)return{start:{x:this._selectionService.selectionStart[0],y:this._selectionService.selectionStart[1]},end:{x:this._selectionService.selectionEnd[0],y:this._selectionService.selectionEnd[1]}}}clearSelection(){this._selectionService?.clearSelection()}selectAll(){this._selectionService?.selectAll()}selectLines(e,t){this._selectionService?.selectLines(e,t)}_keyDown(e){if(this._keyDownHandled=!1,this._keyDownSeen=!0,this._customKeyEventHandler&&!1===this._customKeyEventHandler(e))return!1;const t=this.browser.isMac&&this.options.macOptionIsMeta&&e.altKey;if(!t&&!this._compositionHelper.keydown(e))return this.options.scrollOnUserInput&&this.buffer.ybase!==this.buffer.ydisp&&this.scrollToBottom(),!1;t||"Dead"!==e.key&&"AltGraph"!==e.key||(this._unprocessedDeadKey=!0);const i=(0,R.evaluateKeyboardEvent)(e,this.coreService.decPrivateModes.applicationCursorKeys,this.browser.isMac,this.options.macOptionIsMeta);if(this.updateCursorStyle(e),3===i.type||2===i.type){const t=this.rows-1;return this.scrollLines(2===i.type?-t:t),this.cancel(e,!0)}return 1===i.type&&this.selectAll(),!!this._isThirdLevelShift(this.browser,e)||(i.cancel&&this.cancel(e,!0),!i.key||!!(e.key&&!e.ctrlKey&&!e.altKey&&!e.metaKey&&1===e.key.length&&e.key.charCodeAt(0)>=65&&e.key.charCodeAt(0)<=90)||(this._unprocessedDeadKey?(this._unprocessedDeadKey=!1,!0):(i.key!==D.C0.ETX&&i.key!==D.C0.CR||(this.textarea.value=""),this._onKey.fire({key:i.key,domEvent:e}),this._showCursor(),this.coreService.triggerDataEvent(i.key,!0),!this.optionsService.rawOptions.screenReaderMode||e.altKey||e.ctrlKey?this.cancel(e,!0):void(this._keyDownHandled=!0))))}_isThirdLevelShift(e,t){const i=e.isMac&&!this.options.macOptionIsMeta&&t.altKey&&!t.ctrlKey&&!t.metaKey||e.isWindows&&t.altKey&&t.ctrlKey&&!t.metaKey||e.isWindows&&t.getModifierState("AltGraph");return"keypress"===t.type?i:i&&(!t.keyCode||t.keyCode>47)}_keyUp(e){this._keyDownSeen=!1,this._customKeyEventHandler&&!1===this._customKeyEventHandler(e)||(function(e){return 16===e.keyCode||17===e.keyCode||18===e.keyCode}(e)||this.focus(),this.updateCursorStyle(e),this._keyPressHandled=!1)}_keyPress(e){let t;if(this._keyPressHandled=!1,this._keyDownHandled)return!1;if(this._customKeyEventHandler&&!1===this._customKeyEventHandler(e))return!1;if(this.cancel(e),e.charCode)t=e.charCode;else if(null===e.which||void 0===e.which)t=e.keyCode;else{if(0===e.which||0===e.charCode)return!1;t=e.which}return!(!t||(e.altKey||e.ctrlKey||e.metaKey)&&!this._isThirdLevelShift(this.browser,e)||(t=String.fromCharCode(t),this._onKey.fire({key:t,domEvent:e}),this._showCursor(),this.coreService.triggerDataEvent(t,!0),this._keyPressHandled=!0,this._unprocessedDeadKey=!1,0))}_inputEvent(e){if(e.data&&"insertText"===e.inputType&&(!e.composed||!this._keyDownSeen)&&!this.optionsService.rawOptions.screenReaderMode){if(this._keyPressHandled)return!1;this._unprocessedDeadKey=!1;const t=e.data;return this.coreService.triggerDataEvent(t,!0),this.cancel(e),!0}return!1}resize(e,t){e!==this.cols||t!==this.rows?super.resize(e,t):this._charSizeService&&!this._charSizeService.hasValidSize&&this._charSizeService.measure()}_afterResize(e,t){this._charSizeService?.measure(),this.viewport?.syncScrollArea(!0)}clear(){if(0!==this.buffer.ybase||0!==this.buffer.y){this.buffer.clearAllMarkers(),this.buffer.lines.set(0,this.buffer.lines.get(this.buffer.ybase+this.buffer.y)),this.buffer.lines.length=1,this.buffer.ydisp=0,this.buffer.ybase=0,this.buffer.y=0;for(let e=1;e{Object.defineProperty(t,"__esModule",{value:!0}),t.TimeBasedDebouncer=void 0,t.TimeBasedDebouncer=class{constructor(e,t=1e3){this._renderCallback=e,this._debounceThresholdMS=t,this._lastRefreshMs=0,this._additionalRefreshRequested=!1}dispose(){this._refreshTimeoutID&&clearTimeout(this._refreshTimeoutID)}refresh(e,t,i){this._rowCount=i,e=void 0!==e?e:0,t=void 0!==t?t:this._rowCount-1,this._rowStart=void 0!==this._rowStart?Math.min(this._rowStart,e):e,this._rowEnd=void 0!==this._rowEnd?Math.max(this._rowEnd,t):t;const s=Date.now();if(s-this._lastRefreshMs>=this._debounceThresholdMS)this._lastRefreshMs=s,this._innerRefresh();else if(!this._additionalRefreshRequested){const e=s-this._lastRefreshMs,t=this._debounceThresholdMS-e;this._additionalRefreshRequested=!0,this._refreshTimeoutID=window.setTimeout((()=>{this._lastRefreshMs=Date.now(),this._innerRefresh(),this._additionalRefreshRequested=!1,this._refreshTimeoutID=void 0}),t)}}_innerRefresh(){if(void 0===this._rowStart||void 0===this._rowEnd||void 0===this._rowCount)return;const e=Math.max(this._rowStart,0),t=Math.min(this._rowEnd,this._rowCount-1);this._rowStart=void 0,this._rowEnd=void 0,this._renderCallback(e,t)}}},1680:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.Viewport=void 0;const n=i(3656),o=i(4725),a=i(8460),h=i(844),c=i(2585);let l=t.Viewport=class extends h.Disposable{constructor(e,t,i,s,r,o,h,c){super(),this._viewportElement=e,this._scrollArea=t,this._bufferService=i,this._optionsService=s,this._charSizeService=r,this._renderService=o,this._coreBrowserService=h,this.scrollBarWidth=0,this._currentRowHeight=0,this._currentDeviceCellHeight=0,this._lastRecordedBufferLength=0,this._lastRecordedViewportHeight=0,this._lastRecordedBufferHeight=0,this._lastTouchY=0,this._lastScrollTop=0,this._wheelPartialScroll=0,this._refreshAnimationFrame=null,this._ignoreNextScrollEvent=!1,this._smoothScrollState={startTime:0,origin:-1,target:-1},this._onRequestScrollLines=this.register(new a.EventEmitter),this.onRequestScrollLines=this._onRequestScrollLines.event,this.scrollBarWidth=this._viewportElement.offsetWidth-this._scrollArea.offsetWidth||15,this.register((0,n.addDisposableDomListener)(this._viewportElement,"scroll",this._handleScroll.bind(this))),this._activeBuffer=this._bufferService.buffer,this.register(this._bufferService.buffers.onBufferActivate((e=>this._activeBuffer=e.activeBuffer))),this._renderDimensions=this._renderService.dimensions,this.register(this._renderService.onDimensionsChange((e=>this._renderDimensions=e))),this._handleThemeChange(c.colors),this.register(c.onChangeColors((e=>this._handleThemeChange(e)))),this.register(this._optionsService.onSpecificOptionChange("scrollback",(()=>this.syncScrollArea()))),setTimeout((()=>this.syncScrollArea()))}_handleThemeChange(e){this._viewportElement.style.backgroundColor=e.background.css}reset(){this._currentRowHeight=0,this._currentDeviceCellHeight=0,this._lastRecordedBufferLength=0,this._lastRecordedViewportHeight=0,this._lastRecordedBufferHeight=0,this._lastTouchY=0,this._lastScrollTop=0,this._coreBrowserService.window.requestAnimationFrame((()=>this.syncScrollArea()))}_refresh(e){if(e)return this._innerRefresh(),void(null!==this._refreshAnimationFrame&&this._coreBrowserService.window.cancelAnimationFrame(this._refreshAnimationFrame));null===this._refreshAnimationFrame&&(this._refreshAnimationFrame=this._coreBrowserService.window.requestAnimationFrame((()=>this._innerRefresh())))}_innerRefresh(){if(this._charSizeService.height>0){this._currentRowHeight=this._renderDimensions.device.cell.height/this._coreBrowserService.dpr,this._currentDeviceCellHeight=this._renderDimensions.device.cell.height,this._lastRecordedViewportHeight=this._viewportElement.offsetHeight;const e=Math.round(this._currentRowHeight*this._lastRecordedBufferLength)+(this._lastRecordedViewportHeight-this._renderDimensions.css.canvas.height);this._lastRecordedBufferHeight!==e&&(this._lastRecordedBufferHeight=e,this._scrollArea.style.height=this._lastRecordedBufferHeight+"px")}const e=this._bufferService.buffer.ydisp*this._currentRowHeight;this._viewportElement.scrollTop!==e&&(this._ignoreNextScrollEvent=!0,this._viewportElement.scrollTop=e),this._refreshAnimationFrame=null}syncScrollArea(e=!1){if(this._lastRecordedBufferLength!==this._bufferService.buffer.lines.length)return this._lastRecordedBufferLength=this._bufferService.buffer.lines.length,void this._refresh(e);this._lastRecordedViewportHeight===this._renderService.dimensions.css.canvas.height&&this._lastScrollTop===this._activeBuffer.ydisp*this._currentRowHeight&&this._renderDimensions.device.cell.height===this._currentDeviceCellHeight||this._refresh(e)}_handleScroll(e){if(this._lastScrollTop=this._viewportElement.scrollTop,!this._viewportElement.offsetParent)return;if(this._ignoreNextScrollEvent)return this._ignoreNextScrollEvent=!1,void this._onRequestScrollLines.fire({amount:0,suppressScrollEvent:!0});const t=Math.round(this._lastScrollTop/this._currentRowHeight)-this._bufferService.buffer.ydisp;this._onRequestScrollLines.fire({amount:t,suppressScrollEvent:!0})}_smoothScroll(){if(this._isDisposed||-1===this._smoothScrollState.origin||-1===this._smoothScrollState.target)return;const e=this._smoothScrollPercent();this._viewportElement.scrollTop=this._smoothScrollState.origin+Math.round(e*(this._smoothScrollState.target-this._smoothScrollState.origin)),e<1?this._coreBrowserService.window.requestAnimationFrame((()=>this._smoothScroll())):this._clearSmoothScrollState()}_smoothScrollPercent(){return this._optionsService.rawOptions.smoothScrollDuration&&this._smoothScrollState.startTime?Math.max(Math.min((Date.now()-this._smoothScrollState.startTime)/this._optionsService.rawOptions.smoothScrollDuration,1),0):1}_clearSmoothScrollState(){this._smoothScrollState.startTime=0,this._smoothScrollState.origin=-1,this._smoothScrollState.target=-1}_bubbleScroll(e,t){const i=this._viewportElement.scrollTop+this._lastRecordedViewportHeight;return!(t<0&&0!==this._viewportElement.scrollTop||t>0&&i0&&(i=e),s=""}}return{bufferElements:r,cursorElement:i}}getLinesScrolled(e){if(0===e.deltaY||e.shiftKey)return 0;let t=this._applyScrollModifier(e.deltaY,e);return e.deltaMode===WheelEvent.DOM_DELTA_PIXEL?(t/=this._currentRowHeight+0,this._wheelPartialScroll+=t,t=Math.floor(Math.abs(this._wheelPartialScroll))*(this._wheelPartialScroll>0?1:-1),this._wheelPartialScroll%=1):e.deltaMode===WheelEvent.DOM_DELTA_PAGE&&(t*=this._bufferService.rows),t}_applyScrollModifier(e,t){const i=this._optionsService.rawOptions.fastScrollModifier;return"alt"===i&&t.altKey||"ctrl"===i&&t.ctrlKey||"shift"===i&&t.shiftKey?e*this._optionsService.rawOptions.fastScrollSensitivity*this._optionsService.rawOptions.scrollSensitivity:e*this._optionsService.rawOptions.scrollSensitivity}handleTouchStart(e){this._lastTouchY=e.touches[0].pageY}handleTouchMove(e){const t=this._lastTouchY-e.touches[0].pageY;return this._lastTouchY=e.touches[0].pageY,0!==t&&(this._viewportElement.scrollTop+=t,this._bubbleScroll(e,t))}};t.Viewport=l=s([r(2,c.IBufferService),r(3,c.IOptionsService),r(4,o.ICharSizeService),r(5,o.IRenderService),r(6,o.ICoreBrowserService),r(7,o.IThemeService)],l)},3107:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.BufferDecorationRenderer=void 0;const n=i(4725),o=i(844),a=i(2585);let h=t.BufferDecorationRenderer=class extends o.Disposable{constructor(e,t,i,s,r){super(),this._screenElement=e,this._bufferService=t,this._coreBrowserService=i,this._decorationService=s,this._renderService=r,this._decorationElements=new Map,this._altBufferIsActive=!1,this._dimensionsChanged=!1,this._container=document.createElement("div"),this._container.classList.add("xterm-decoration-container"),this._screenElement.appendChild(this._container),this.register(this._renderService.onRenderedViewportChange((()=>this._doRefreshDecorations()))),this.register(this._renderService.onDimensionsChange((()=>{this._dimensionsChanged=!0,this._queueRefresh()}))),this.register(this._coreBrowserService.onDprChange((()=>this._queueRefresh()))),this.register(this._bufferService.buffers.onBufferActivate((()=>{this._altBufferIsActive=this._bufferService.buffer===this._bufferService.buffers.alt}))),this.register(this._decorationService.onDecorationRegistered((()=>this._queueRefresh()))),this.register(this._decorationService.onDecorationRemoved((e=>this._removeDecoration(e)))),this.register((0,o.toDisposable)((()=>{this._container.remove(),this._decorationElements.clear()})))}_queueRefresh(){void 0===this._animationFrame&&(this._animationFrame=this._renderService.addRefreshCallback((()=>{this._doRefreshDecorations(),this._animationFrame=void 0})))}_doRefreshDecorations(){for(const e of this._decorationService.decorations)this._renderDecoration(e);this._dimensionsChanged=!1}_renderDecoration(e){this._refreshStyle(e),this._dimensionsChanged&&this._refreshXPosition(e)}_createElement(e){const t=this._coreBrowserService.mainDocument.createElement("div");t.classList.add("xterm-decoration"),t.classList.toggle("xterm-decoration-top-layer","top"===e?.options?.layer),t.style.width=`${Math.round((e.options.width||1)*this._renderService.dimensions.css.cell.width)}px`,t.style.height=(e.options.height||1)*this._renderService.dimensions.css.cell.height+"px",t.style.top=(e.marker.line-this._bufferService.buffers.active.ydisp)*this._renderService.dimensions.css.cell.height+"px",t.style.lineHeight=`${this._renderService.dimensions.css.cell.height}px`;const i=e.options.x??0;return i&&i>this._bufferService.cols&&(t.style.display="none"),this._refreshXPosition(e,t),t}_refreshStyle(e){const t=e.marker.line-this._bufferService.buffers.active.ydisp;if(t<0||t>=this._bufferService.rows)e.element&&(e.element.style.display="none",e.onRenderEmitter.fire(e.element));else{let i=this._decorationElements.get(e);i||(i=this._createElement(e),e.element=i,this._decorationElements.set(e,i),this._container.appendChild(i),e.onDispose((()=>{this._decorationElements.delete(e),i.remove()}))),i.style.top=t*this._renderService.dimensions.css.cell.height+"px",i.style.display=this._altBufferIsActive?"none":"block",e.onRenderEmitter.fire(i)}}_refreshXPosition(e,t=e.element){if(!t)return;const i=e.options.x??0;"right"===(e.options.anchor||"left")?t.style.right=i?i*this._renderService.dimensions.css.cell.width+"px":"":t.style.left=i?i*this._renderService.dimensions.css.cell.width+"px":""}_removeDecoration(e){this._decorationElements.get(e)?.remove(),this._decorationElements.delete(e),e.dispose()}};t.BufferDecorationRenderer=h=s([r(1,a.IBufferService),r(2,n.ICoreBrowserService),r(3,a.IDecorationService),r(4,n.IRenderService)],h)},5871:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.ColorZoneStore=void 0,t.ColorZoneStore=class{constructor(){this._zones=[],this._zonePool=[],this._zonePoolIndex=0,this._linePadding={full:0,left:0,center:0,right:0}}get zones(){return this._zonePool.length=Math.min(this._zonePool.length,this._zones.length),this._zones}clear(){this._zones.length=0,this._zonePoolIndex=0}addDecoration(e){if(e.options.overviewRulerOptions){for(const t of this._zones)if(t.color===e.options.overviewRulerOptions.color&&t.position===e.options.overviewRulerOptions.position){if(this._lineIntersectsZone(t,e.marker.line))return;if(this._lineAdjacentToZone(t,e.marker.line,e.options.overviewRulerOptions.position))return void this._addLineToZone(t,e.marker.line)}if(this._zonePoolIndex=e.startBufferLine&&t<=e.endBufferLine}_lineAdjacentToZone(e,t,i){return t>=e.startBufferLine-this._linePadding[i||"full"]&&t<=e.endBufferLine+this._linePadding[i||"full"]}_addLineToZone(e,t){e.startBufferLine=Math.min(e.startBufferLine,t),e.endBufferLine=Math.max(e.endBufferLine,t)}}},5744:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.OverviewRulerRenderer=void 0;const n=i(5871),o=i(4725),a=i(844),h=i(2585),c={full:0,left:0,center:0,right:0},l={full:0,left:0,center:0,right:0},d={full:0,left:0,center:0,right:0};let _=t.OverviewRulerRenderer=class extends a.Disposable{get _width(){return this._optionsService.options.overviewRulerWidth||0}constructor(e,t,i,s,r,o,h){super(),this._viewportElement=e,this._screenElement=t,this._bufferService=i,this._decorationService=s,this._renderService=r,this._optionsService=o,this._coreBrowserService=h,this._colorZoneStore=new n.ColorZoneStore,this._shouldUpdateDimensions=!0,this._shouldUpdateAnchor=!0,this._lastKnownBufferLength=0,this._canvas=this._coreBrowserService.mainDocument.createElement("canvas"),this._canvas.classList.add("xterm-decoration-overview-ruler"),this._refreshCanvasDimensions(),this._viewportElement.parentElement?.insertBefore(this._canvas,this._viewportElement);const c=this._canvas.getContext("2d");if(!c)throw new Error("Ctx cannot be null");this._ctx=c,this._registerDecorationListeners(),this._registerBufferChangeListeners(),this._registerDimensionChangeListeners(),this.register((0,a.toDisposable)((()=>{this._canvas?.remove()})))}_registerDecorationListeners(){this.register(this._decorationService.onDecorationRegistered((()=>this._queueRefresh(void 0,!0)))),this.register(this._decorationService.onDecorationRemoved((()=>this._queueRefresh(void 0,!0))))}_registerBufferChangeListeners(){this.register(this._renderService.onRenderedViewportChange((()=>this._queueRefresh()))),this.register(this._bufferService.buffers.onBufferActivate((()=>{this._canvas.style.display=this._bufferService.buffer===this._bufferService.buffers.alt?"none":"block"}))),this.register(this._bufferService.onScroll((()=>{this._lastKnownBufferLength!==this._bufferService.buffers.normal.lines.length&&(this._refreshDrawHeightConstants(),this._refreshColorZonePadding())})))}_registerDimensionChangeListeners(){this.register(this._renderService.onRender((()=>{this._containerHeight&&this._containerHeight===this._screenElement.clientHeight||(this._queueRefresh(!0),this._containerHeight=this._screenElement.clientHeight)}))),this.register(this._optionsService.onSpecificOptionChange("overviewRulerWidth",(()=>this._queueRefresh(!0)))),this.register(this._coreBrowserService.onDprChange((()=>this._queueRefresh(!0)))),this._queueRefresh(!0)}_refreshDrawConstants(){const e=Math.floor(this._canvas.width/3),t=Math.ceil(this._canvas.width/3);l.full=this._canvas.width,l.left=e,l.center=t,l.right=e,this._refreshDrawHeightConstants(),d.full=0,d.left=0,d.center=l.left,d.right=l.left+l.center}_refreshDrawHeightConstants(){c.full=Math.round(2*this._coreBrowserService.dpr);const e=this._canvas.height/this._bufferService.buffer.lines.length,t=Math.round(Math.max(Math.min(e,12),6)*this._coreBrowserService.dpr);c.left=t,c.center=t,c.right=t}_refreshColorZonePadding(){this._colorZoneStore.setPadding({full:Math.floor(this._bufferService.buffers.active.lines.length/(this._canvas.height-1)*c.full),left:Math.floor(this._bufferService.buffers.active.lines.length/(this._canvas.height-1)*c.left),center:Math.floor(this._bufferService.buffers.active.lines.length/(this._canvas.height-1)*c.center),right:Math.floor(this._bufferService.buffers.active.lines.length/(this._canvas.height-1)*c.right)}),this._lastKnownBufferLength=this._bufferService.buffers.normal.lines.length}_refreshCanvasDimensions(){this._canvas.style.width=`${this._width}px`,this._canvas.width=Math.round(this._width*this._coreBrowserService.dpr),this._canvas.style.height=`${this._screenElement.clientHeight}px`,this._canvas.height=Math.round(this._screenElement.clientHeight*this._coreBrowserService.dpr),this._refreshDrawConstants(),this._refreshColorZonePadding()}_refreshDecorations(){this._shouldUpdateDimensions&&this._refreshCanvasDimensions(),this._ctx.clearRect(0,0,this._canvas.width,this._canvas.height),this._colorZoneStore.clear();for(const e of this._decorationService.decorations)this._colorZoneStore.addDecoration(e);this._ctx.lineWidth=1;const e=this._colorZoneStore.zones;for(const t of e)"full"!==t.position&&this._renderColorZone(t);for(const t of e)"full"===t.position&&this._renderColorZone(t);this._shouldUpdateDimensions=!1,this._shouldUpdateAnchor=!1}_renderColorZone(e){this._ctx.fillStyle=e.color,this._ctx.fillRect(d[e.position||"full"],Math.round((this._canvas.height-1)*(e.startBufferLine/this._bufferService.buffers.active.lines.length)-c[e.position||"full"]/2),l[e.position||"full"],Math.round((this._canvas.height-1)*((e.endBufferLine-e.startBufferLine)/this._bufferService.buffers.active.lines.length)+c[e.position||"full"]))}_queueRefresh(e,t){this._shouldUpdateDimensions=e||this._shouldUpdateDimensions,this._shouldUpdateAnchor=t||this._shouldUpdateAnchor,void 0===this._animationFrame&&(this._animationFrame=this._coreBrowserService.window.requestAnimationFrame((()=>{this._refreshDecorations(),this._animationFrame=void 0})))}};t.OverviewRulerRenderer=_=s([r(2,h.IBufferService),r(3,h.IDecorationService),r(4,o.IRenderService),r(5,h.IOptionsService),r(6,o.ICoreBrowserService)],_)},2950:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.CompositionHelper=void 0;const n=i(4725),o=i(2585),a=i(2584);let h=t.CompositionHelper=class{get isComposing(){return this._isComposing}constructor(e,t,i,s,r,n){this._textarea=e,this._compositionView=t,this._bufferService=i,this._optionsService=s,this._coreService=r,this._renderService=n,this._isComposing=!1,this._isSendingComposition=!1,this._compositionPosition={start:0,end:0},this._dataAlreadySent=""}compositionstart(){this._isComposing=!0,this._compositionPosition.start=this._textarea.value.length,this._compositionView.textContent="",this._dataAlreadySent="",this._compositionView.classList.add("active")}compositionupdate(e){this._compositionView.textContent=e.data,this.updateCompositionElements(),setTimeout((()=>{this._compositionPosition.end=this._textarea.value.length}),0)}compositionend(){this._finalizeComposition(!0)}keydown(e){if(this._isComposing||this._isSendingComposition){if(229===e.keyCode)return!1;if(16===e.keyCode||17===e.keyCode||18===e.keyCode)return!1;this._finalizeComposition(!1)}return 229!==e.keyCode||(this._handleAnyTextareaChanges(),!1)}_finalizeComposition(e){if(this._compositionView.classList.remove("active"),this._isComposing=!1,e){const e={start:this._compositionPosition.start,end:this._compositionPosition.end};this._isSendingComposition=!0,setTimeout((()=>{if(this._isSendingComposition){let t;this._isSendingComposition=!1,e.start+=this._dataAlreadySent.length,t=this._isComposing?this._textarea.value.substring(e.start,e.end):this._textarea.value.substring(e.start),t.length>0&&this._coreService.triggerDataEvent(t,!0)}}),0)}else{this._isSendingComposition=!1;const e=this._textarea.value.substring(this._compositionPosition.start,this._compositionPosition.end);this._coreService.triggerDataEvent(e,!0)}}_handleAnyTextareaChanges(){const e=this._textarea.value;setTimeout((()=>{if(!this._isComposing){const t=this._textarea.value,i=t.replace(e,"");this._dataAlreadySent=i,t.length>e.length?this._coreService.triggerDataEvent(i,!0):t.lengththis.updateCompositionElements(!0)),0)}}};t.CompositionHelper=h=s([r(2,o.IBufferService),r(3,o.IOptionsService),r(4,o.ICoreService),r(5,n.IRenderService)],h)},9806:(e,t)=>{function i(e,t,i){const s=i.getBoundingClientRect(),r=e.getComputedStyle(i),n=parseInt(r.getPropertyValue("padding-left")),o=parseInt(r.getPropertyValue("padding-top"));return[t.clientX-s.left-n,t.clientY-s.top-o]}Object.defineProperty(t,"__esModule",{value:!0}),t.getCoords=t.getCoordsRelativeToElement=void 0,t.getCoordsRelativeToElement=i,t.getCoords=function(e,t,s,r,n,o,a,h,c){if(!o)return;const l=i(e,t,s);return l?(l[0]=Math.ceil((l[0]+(c?a/2:0))/a),l[1]=Math.ceil(l[1]/h),l[0]=Math.min(Math.max(l[0],1),r+(c?1:0)),l[1]=Math.min(Math.max(l[1],1),n),l):void 0}},9504:(e,t,i)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.moveToCellSequence=void 0;const s=i(2584);function r(e,t,i,s){const r=e-n(e,i),a=t-n(t,i),l=Math.abs(r-a)-function(e,t,i){let s=0;const r=e-n(e,i),a=t-n(t,i);for(let n=0;n=0&&et?"A":"B"}function a(e,t,i,s,r,n){let o=e,a=t,h="";for(;o!==i||a!==s;)o+=r?1:-1,r&&o>n.cols-1?(h+=n.buffer.translateBufferLineToString(a,!1,e,o),o=0,e=0,a++):!r&&o<0&&(h+=n.buffer.translateBufferLineToString(a,!1,0,e+1),o=n.cols-1,e=o,a--);return h+n.buffer.translateBufferLineToString(a,!1,e,o)}function h(e,t){const i=t?"O":"[";return s.C0.ESC+i+e}function c(e,t){e=Math.floor(e);let i="";for(let s=0;s0?s-n(s,o):t;const _=s,u=function(e,t,i,s,o,a){let h;return h=r(i,s,o,a).length>0?s-n(s,o):t,e=i&&he?"D":"C",c(Math.abs(o-e),h(d,s));d=l>t?"D":"C";const _=Math.abs(l-t);return c(function(e,t){return t.cols-e}(l>t?e:o,i)+(_-1)*i.cols+1+((l>t?o:e)-1),h(d,s))}},1296:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.DomRenderer=void 0;const n=i(3787),o=i(2550),a=i(2223),h=i(6171),c=i(6052),l=i(4725),d=i(8055),_=i(8460),u=i(844),f=i(2585),v="xterm-dom-renderer-owner-",p="xterm-rows",g="xterm-fg-",m="xterm-bg-",S="xterm-focus",C="xterm-selection";let b=1,w=t.DomRenderer=class extends u.Disposable{constructor(e,t,i,s,r,a,l,d,f,g,m,S,w){super(),this._terminal=e,this._document=t,this._element=i,this._screenElement=s,this._viewportElement=r,this._helperContainer=a,this._linkifier2=l,this._charSizeService=f,this._optionsService=g,this._bufferService=m,this._coreBrowserService=S,this._themeService=w,this._terminalClass=b++,this._rowElements=[],this._selectionRenderModel=(0,c.createSelectionRenderModel)(),this.onRequestRedraw=this.register(new _.EventEmitter).event,this._rowContainer=this._document.createElement("div"),this._rowContainer.classList.add(p),this._rowContainer.style.lineHeight="normal",this._rowContainer.setAttribute("aria-hidden","true"),this._refreshRowElements(this._bufferService.cols,this._bufferService.rows),this._selectionContainer=this._document.createElement("div"),this._selectionContainer.classList.add(C),this._selectionContainer.setAttribute("aria-hidden","true"),this.dimensions=(0,h.createRenderDimensions)(),this._updateDimensions(),this.register(this._optionsService.onOptionChange((()=>this._handleOptionsChanged()))),this.register(this._themeService.onChangeColors((e=>this._injectCss(e)))),this._injectCss(this._themeService.colors),this._rowFactory=d.createInstance(n.DomRendererRowFactory,document),this._element.classList.add(v+this._terminalClass),this._screenElement.appendChild(this._rowContainer),this._screenElement.appendChild(this._selectionContainer),this.register(this._linkifier2.onShowLinkUnderline((e=>this._handleLinkHover(e)))),this.register(this._linkifier2.onHideLinkUnderline((e=>this._handleLinkLeave(e)))),this.register((0,u.toDisposable)((()=>{this._element.classList.remove(v+this._terminalClass),this._rowContainer.remove(),this._selectionContainer.remove(),this._widthCache.dispose(),this._themeStyleElement.remove(),this._dimensionsStyleElement.remove()}))),this._widthCache=new o.WidthCache(this._document,this._helperContainer),this._widthCache.setFont(this._optionsService.rawOptions.fontFamily,this._optionsService.rawOptions.fontSize,this._optionsService.rawOptions.fontWeight,this._optionsService.rawOptions.fontWeightBold),this._setDefaultSpacing()}_updateDimensions(){const e=this._coreBrowserService.dpr;this.dimensions.device.char.width=this._charSizeService.width*e,this.dimensions.device.char.height=Math.ceil(this._charSizeService.height*e),this.dimensions.device.cell.width=this.dimensions.device.char.width+Math.round(this._optionsService.rawOptions.letterSpacing),this.dimensions.device.cell.height=Math.floor(this.dimensions.device.char.height*this._optionsService.rawOptions.lineHeight),this.dimensions.device.char.left=0,this.dimensions.device.char.top=0,this.dimensions.device.canvas.width=this.dimensions.device.cell.width*this._bufferService.cols,this.dimensions.device.canvas.height=this.dimensions.device.cell.height*this._bufferService.rows,this.dimensions.css.canvas.width=Math.round(this.dimensions.device.canvas.width/e),this.dimensions.css.canvas.height=Math.round(this.dimensions.device.canvas.height/e),this.dimensions.css.cell.width=this.dimensions.css.canvas.width/this._bufferService.cols,this.dimensions.css.cell.height=this.dimensions.css.canvas.height/this._bufferService.rows;for(const e of this._rowElements)e.style.width=`${this.dimensions.css.canvas.width}px`,e.style.height=`${this.dimensions.css.cell.height}px`,e.style.lineHeight=`${this.dimensions.css.cell.height}px`,e.style.overflow="hidden";this._dimensionsStyleElement||(this._dimensionsStyleElement=this._document.createElement("style"),this._screenElement.appendChild(this._dimensionsStyleElement));const t=`${this._terminalSelector} .${p} span { display: inline-block; height: 100%; vertical-align: top;}`;this._dimensionsStyleElement.textContent=t,this._selectionContainer.style.height=this._viewportElement.style.height,this._screenElement.style.width=`${this.dimensions.css.canvas.width}px`,this._screenElement.style.height=`${this.dimensions.css.canvas.height}px`}_injectCss(e){this._themeStyleElement||(this._themeStyleElement=this._document.createElement("style"),this._screenElement.appendChild(this._themeStyleElement));let t=`${this._terminalSelector} .${p} { color: ${e.foreground.css}; font-family: ${this._optionsService.rawOptions.fontFamily}; font-size: ${this._optionsService.rawOptions.fontSize}px; font-kerning: none; white-space: pre}`;t+=`${this._terminalSelector} .${p} .xterm-dim { color: ${d.color.multiplyOpacity(e.foreground,.5).css};}`,t+=`${this._terminalSelector} span:not(.xterm-bold) { font-weight: ${this._optionsService.rawOptions.fontWeight};}${this._terminalSelector} span.xterm-bold { font-weight: ${this._optionsService.rawOptions.fontWeightBold};}${this._terminalSelector} span.xterm-italic { font-style: italic;}`;const i=`blink_underline_${this._terminalClass}`,s=`blink_bar_${this._terminalClass}`,r=`blink_block_${this._terminalClass}`;t+=`@keyframes ${i} { 50% { border-bottom-style: hidden; }}`,t+=`@keyframes ${s} { 50% { box-shadow: none; }}`,t+=`@keyframes ${r} { 0% { background-color: ${e.cursor.css}; color: ${e.cursorAccent.css}; } 50% { background-color: inherit; color: ${e.cursor.css}; }}`,t+=`${this._terminalSelector} .${p}.${S} .xterm-cursor.xterm-cursor-blink.xterm-cursor-underline { animation: ${i} 1s step-end infinite;}${this._terminalSelector} .${p}.${S} .xterm-cursor.xterm-cursor-blink.xterm-cursor-bar { animation: ${s} 1s step-end infinite;}${this._terminalSelector} .${p}.${S} .xterm-cursor.xterm-cursor-blink.xterm-cursor-block { animation: ${r} 1s step-end infinite;}${this._terminalSelector} .${p} .xterm-cursor.xterm-cursor-block { background-color: ${e.cursor.css}; color: ${e.cursorAccent.css};}${this._terminalSelector} .${p} .xterm-cursor.xterm-cursor-block:not(.xterm-cursor-blink) { background-color: ${e.cursor.css} !important; color: ${e.cursorAccent.css} !important;}${this._terminalSelector} .${p} .xterm-cursor.xterm-cursor-outline { outline: 1px solid ${e.cursor.css}; outline-offset: -1px;}${this._terminalSelector} .${p} .xterm-cursor.xterm-cursor-bar { box-shadow: ${this._optionsService.rawOptions.cursorWidth}px 0 0 ${e.cursor.css} inset;}${this._terminalSelector} .${p} .xterm-cursor.xterm-cursor-underline { border-bottom: 1px ${e.cursor.css}; border-bottom-style: solid; height: calc(100% - 1px);}`,t+=`${this._terminalSelector} .${C} { position: absolute; top: 0; left: 0; z-index: 1; pointer-events: none;}${this._terminalSelector}.focus .${C} div { position: absolute; background-color: ${e.selectionBackgroundOpaque.css};}${this._terminalSelector} .${C} div { position: absolute; background-color: ${e.selectionInactiveBackgroundOpaque.css};}`;for(const[i,s]of e.ansi.entries())t+=`${this._terminalSelector} .${g}${i} { color: ${s.css}; }${this._terminalSelector} .${g}${i}.xterm-dim { color: ${d.color.multiplyOpacity(s,.5).css}; }${this._terminalSelector} .${m}${i} { background-color: ${s.css}; }`;t+=`${this._terminalSelector} .${g}${a.INVERTED_DEFAULT_COLOR} { color: ${d.color.opaque(e.background).css}; }${this._terminalSelector} .${g}${a.INVERTED_DEFAULT_COLOR}.xterm-dim { color: ${d.color.multiplyOpacity(d.color.opaque(e.background),.5).css}; }${this._terminalSelector} .${m}${a.INVERTED_DEFAULT_COLOR} { background-color: ${e.foreground.css}; }`,this._themeStyleElement.textContent=t}_setDefaultSpacing(){const e=this.dimensions.css.cell.width-this._widthCache.get("W",!1,!1);this._rowContainer.style.letterSpacing=`${e}px`,this._rowFactory.defaultSpacing=e}handleDevicePixelRatioChange(){this._updateDimensions(),this._widthCache.clear(),this._setDefaultSpacing()}_refreshRowElements(e,t){for(let e=this._rowElements.length;e<=t;e++){const e=this._document.createElement("div");this._rowContainer.appendChild(e),this._rowElements.push(e)}for(;this._rowElements.length>t;)this._rowContainer.removeChild(this._rowElements.pop())}handleResize(e,t){this._refreshRowElements(e,t),this._updateDimensions(),this.handleSelectionChanged(this._selectionRenderModel.selectionStart,this._selectionRenderModel.selectionEnd,this._selectionRenderModel.columnSelectMode)}handleCharSizeChanged(){this._updateDimensions(),this._widthCache.clear(),this._setDefaultSpacing()}handleBlur(){this._rowContainer.classList.remove(S),this.renderRows(0,this._bufferService.rows-1)}handleFocus(){this._rowContainer.classList.add(S),this.renderRows(this._bufferService.buffer.y,this._bufferService.buffer.y)}handleSelectionChanged(e,t,i){if(this._selectionContainer.replaceChildren(),this._rowFactory.handleSelectionChanged(e,t,i),this.renderRows(0,this._bufferService.rows-1),!e||!t)return;this._selectionRenderModel.update(this._terminal,e,t,i);const s=this._selectionRenderModel.viewportStartRow,r=this._selectionRenderModel.viewportEndRow,n=this._selectionRenderModel.viewportCappedStartRow,o=this._selectionRenderModel.viewportCappedEndRow;if(n>=this._bufferService.rows||o<0)return;const a=this._document.createDocumentFragment();if(i){const i=e[0]>t[0];a.appendChild(this._createSelectionElement(n,i?t[0]:e[0],i?e[0]:t[0],o-n+1))}else{const i=s===n?e[0]:0,h=n===r?t[0]:this._bufferService.cols;a.appendChild(this._createSelectionElement(n,i,h));const c=o-n-1;if(a.appendChild(this._createSelectionElement(n+1,0,this._bufferService.cols,c)),n!==o){const e=r===o?t[0]:this._bufferService.cols;a.appendChild(this._createSelectionElement(o,0,e))}}this._selectionContainer.appendChild(a)}_createSelectionElement(e,t,i,s=1){const r=this._document.createElement("div"),n=t*this.dimensions.css.cell.width;let o=this.dimensions.css.cell.width*(i-t);return n+o>this.dimensions.css.canvas.width&&(o=this.dimensions.css.canvas.width-n),r.style.height=s*this.dimensions.css.cell.height+"px",r.style.top=e*this.dimensions.css.cell.height+"px",r.style.left=`${n}px`,r.style.width=`${o}px`,r}handleCursorMove(){}_handleOptionsChanged(){this._updateDimensions(),this._injectCss(this._themeService.colors),this._widthCache.setFont(this._optionsService.rawOptions.fontFamily,this._optionsService.rawOptions.fontSize,this._optionsService.rawOptions.fontWeight,this._optionsService.rawOptions.fontWeightBold),this._setDefaultSpacing()}clear(){for(const e of this._rowElements)e.replaceChildren()}renderRows(e,t){const i=this._bufferService.buffer,s=i.ybase+i.y,r=Math.min(i.x,this._bufferService.cols-1),n=this._optionsService.rawOptions.cursorBlink,o=this._optionsService.rawOptions.cursorStyle,a=this._optionsService.rawOptions.cursorInactiveStyle;for(let h=e;h<=t;h++){const e=h+i.ydisp,t=this._rowElements[h],c=i.lines.get(e);if(!t||!c)break;t.replaceChildren(...this._rowFactory.createRow(c,e,e===s,o,a,r,n,this.dimensions.css.cell.width,this._widthCache,-1,-1))}}get _terminalSelector(){return`.${v}${this._terminalClass}`}_handleLinkHover(e){this._setCellUnderline(e.x1,e.x2,e.y1,e.y2,e.cols,!0)}_handleLinkLeave(e){this._setCellUnderline(e.x1,e.x2,e.y1,e.y2,e.cols,!1)}_setCellUnderline(e,t,i,s,r,n){i<0&&(e=0),s<0&&(t=0);const o=this._bufferService.rows-1;i=Math.max(Math.min(i,o),0),s=Math.max(Math.min(s,o),0),r=Math.min(r,this._bufferService.cols);const a=this._bufferService.buffer,h=a.ybase+a.y,c=Math.min(a.x,r-1),l=this._optionsService.rawOptions.cursorBlink,d=this._optionsService.rawOptions.cursorStyle,_=this._optionsService.rawOptions.cursorInactiveStyle;for(let o=i;o<=s;++o){const u=o+a.ydisp,f=this._rowElements[o],v=a.lines.get(u);if(!f||!v)break;f.replaceChildren(...this._rowFactory.createRow(v,u,u===h,d,_,c,l,this.dimensions.css.cell.width,this._widthCache,n?o===i?e:0:-1,n?(o===s?t:r)-1:-1))}}};t.DomRenderer=w=s([r(7,f.IInstantiationService),r(8,l.ICharSizeService),r(9,f.IOptionsService),r(10,f.IBufferService),r(11,l.ICoreBrowserService),r(12,l.IThemeService)],w)},3787:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.DomRendererRowFactory=void 0;const n=i(2223),o=i(643),a=i(511),h=i(2585),c=i(8055),l=i(4725),d=i(4269),_=i(6171),u=i(3734);let f=t.DomRendererRowFactory=class{constructor(e,t,i,s,r,n,o){this._document=e,this._characterJoinerService=t,this._optionsService=i,this._coreBrowserService=s,this._coreService=r,this._decorationService=n,this._themeService=o,this._workCell=new a.CellData,this._columnSelectMode=!1,this.defaultSpacing=0}handleSelectionChanged(e,t,i){this._selectionStart=e,this._selectionEnd=t,this._columnSelectMode=i}createRow(e,t,i,s,r,a,h,l,_,f,p){const g=[],m=this._characterJoinerService.getJoinedCharacters(t),S=this._themeService.colors;let C,b=e.getNoBgTrimmedLength();i&&b0&&M===m[0][0]){O=!0;const t=m.shift();I=new d.JoinedCellData(this._workCell,e.translateToString(!0,t[0],t[1]),t[1]-t[0]),P=t[1]-1,b=I.getWidth()}const H=this._isCellInSelection(M,t),F=i&&M===a,W=T&&M>=f&&M<=p;let U=!1;this._decorationService.forEachDecorationAtCell(M,t,void 0,(e=>{U=!0}));let N=I.getChars()||o.WHITESPACE_CELL_CHAR;if(" "===N&&(I.isUnderline()||I.isOverline())&&(N=" "),A=b*l-_.get(N,I.isBold(),I.isItalic()),C){if(w&&(H&&x||!H&&!x&&I.bg===E)&&(H&&x&&S.selectionForeground||I.fg===k)&&I.extended.ext===L&&W===D&&A===R&&!F&&!O&&!U){I.isInvisible()?y+=o.WHITESPACE_CELL_CHAR:y+=N,w++;continue}w&&(C.textContent=y),C=this._document.createElement("span"),w=0,y=""}else C=this._document.createElement("span");if(E=I.bg,k=I.fg,L=I.extended.ext,D=W,R=A,x=H,O&&a>=M&&a<=P&&(a=M),!this._coreService.isCursorHidden&&F&&this._coreService.isCursorInitialized)if(B.push("xterm-cursor"),this._coreBrowserService.isFocused)h&&B.push("xterm-cursor-blink"),B.push("bar"===s?"xterm-cursor-bar":"underline"===s?"xterm-cursor-underline":"xterm-cursor-block");else if(r)switch(r){case"outline":B.push("xterm-cursor-outline");break;case"block":B.push("xterm-cursor-block");break;case"bar":B.push("xterm-cursor-bar");break;case"underline":B.push("xterm-cursor-underline")}if(I.isBold()&&B.push("xterm-bold"),I.isItalic()&&B.push("xterm-italic"),I.isDim()&&B.push("xterm-dim"),y=I.isInvisible()?o.WHITESPACE_CELL_CHAR:I.getChars()||o.WHITESPACE_CELL_CHAR,I.isUnderline()&&(B.push(`xterm-underline-${I.extended.underlineStyle}`)," "===y&&(y=" "),!I.isUnderlineColorDefault()))if(I.isUnderlineColorRGB())C.style.textDecorationColor=`rgb(${u.AttributeData.toColorRGB(I.getUnderlineColor()).join(",")})`;else{let e=I.getUnderlineColor();this._optionsService.rawOptions.drawBoldTextInBrightColors&&I.isBold()&&e<8&&(e+=8),C.style.textDecorationColor=S.ansi[e].css}I.isOverline()&&(B.push("xterm-overline")," "===y&&(y=" ")),I.isStrikethrough()&&B.push("xterm-strikethrough"),W&&(C.style.textDecoration="underline");let $=I.getFgColor(),j=I.getFgColorMode(),z=I.getBgColor(),K=I.getBgColorMode();const q=!!I.isInverse();if(q){const e=$;$=z,z=e;const t=j;j=K,K=t}let V,G,X,J=!1;switch(this._decorationService.forEachDecorationAtCell(M,t,void 0,(e=>{"top"!==e.options.layer&&J||(e.backgroundColorRGB&&(K=50331648,z=e.backgroundColorRGB.rgba>>8&16777215,V=e.backgroundColorRGB),e.foregroundColorRGB&&(j=50331648,$=e.foregroundColorRGB.rgba>>8&16777215,G=e.foregroundColorRGB),J="top"===e.options.layer)})),!J&&H&&(V=this._coreBrowserService.isFocused?S.selectionBackgroundOpaque:S.selectionInactiveBackgroundOpaque,z=V.rgba>>8&16777215,K=50331648,J=!0,S.selectionForeground&&(j=50331648,$=S.selectionForeground.rgba>>8&16777215,G=S.selectionForeground)),J&&B.push("xterm-decoration-top"),K){case 16777216:case 33554432:X=S.ansi[z],B.push(`xterm-bg-${z}`);break;case 50331648:X=c.channels.toColor(z>>16,z>>8&255,255&z),this._addStyle(C,`background-color:#${v((z>>>0).toString(16),"0",6)}`);break;default:q?(X=S.foreground,B.push(`xterm-bg-${n.INVERTED_DEFAULT_COLOR}`)):X=S.background}switch(V||I.isDim()&&(V=c.color.multiplyOpacity(X,.5)),j){case 16777216:case 33554432:I.isBold()&&$<8&&this._optionsService.rawOptions.drawBoldTextInBrightColors&&($+=8),this._applyMinimumContrast(C,X,S.ansi[$],I,V,void 0)||B.push(`xterm-fg-${$}`);break;case 50331648:const e=c.channels.toColor($>>16&255,$>>8&255,255&$);this._applyMinimumContrast(C,X,e,I,V,G)||this._addStyle(C,`color:#${v($.toString(16),"0",6)}`);break;default:this._applyMinimumContrast(C,X,S.foreground,I,V,G)||q&&B.push(`xterm-fg-${n.INVERTED_DEFAULT_COLOR}`)}B.length&&(C.className=B.join(" "),B.length=0),F||O||U?C.textContent=y:w++,A!==this.defaultSpacing&&(C.style.letterSpacing=`${A}px`),g.push(C),M=P}return C&&w&&(C.textContent=y),g}_applyMinimumContrast(e,t,i,s,r,n){if(1===this._optionsService.rawOptions.minimumContrastRatio||(0,_.treatGlyphAsBackgroundColor)(s.getCode()))return!1;const o=this._getContrastCache(s);let a;if(r||n||(a=o.getColor(t.rgba,i.rgba)),void 0===a){const e=this._optionsService.rawOptions.minimumContrastRatio/(s.isDim()?2:1);a=c.color.ensureContrastRatio(r||t,n||i,e),o.setColor((r||t).rgba,(n||i).rgba,a??null)}return!!a&&(this._addStyle(e,`color:${a.css}`),!0)}_getContrastCache(e){return e.isDim()?this._themeService.colors.halfContrastCache:this._themeService.colors.contrastCache}_addStyle(e,t){e.setAttribute("style",`${e.getAttribute("style")||""}${t};`)}_isCellInSelection(e,t){const i=this._selectionStart,s=this._selectionEnd;return!(!i||!s)&&(this._columnSelectMode?i[0]<=s[0]?e>=i[0]&&t>=i[1]&&e=i[1]&&e>=s[0]&&t<=s[1]:t>i[1]&&t=i[0]&&e=i[0])}};function v(e,t,i){for(;e.length{Object.defineProperty(t,"__esModule",{value:!0}),t.WidthCache=void 0,t.WidthCache=class{constructor(e,t){this._flat=new Float32Array(256),this._font="",this._fontSize=0,this._weight="normal",this._weightBold="bold",this._measureElements=[],this._container=e.createElement("div"),this._container.classList.add("xterm-width-cache-measure-container"),this._container.setAttribute("aria-hidden","true"),this._container.style.whiteSpace="pre",this._container.style.fontKerning="none";const i=e.createElement("span");i.classList.add("xterm-char-measure-element");const s=e.createElement("span");s.classList.add("xterm-char-measure-element"),s.style.fontWeight="bold";const r=e.createElement("span");r.classList.add("xterm-char-measure-element"),r.style.fontStyle="italic";const n=e.createElement("span");n.classList.add("xterm-char-measure-element"),n.style.fontWeight="bold",n.style.fontStyle="italic",this._measureElements=[i,s,r,n],this._container.appendChild(i),this._container.appendChild(s),this._container.appendChild(r),this._container.appendChild(n),t.appendChild(this._container),this.clear()}dispose(){this._container.remove(),this._measureElements.length=0,this._holey=void 0}clear(){this._flat.fill(-9999),this._holey=new Map}setFont(e,t,i,s){e===this._font&&t===this._fontSize&&i===this._weight&&s===this._weightBold||(this._font=e,this._fontSize=t,this._weight=i,this._weightBold=s,this._container.style.fontFamily=this._font,this._container.style.fontSize=`${this._fontSize}px`,this._measureElements[0].style.fontWeight=`${i}`,this._measureElements[1].style.fontWeight=`${s}`,this._measureElements[2].style.fontWeight=`${i}`,this._measureElements[3].style.fontWeight=`${s}`,this.clear())}get(e,t,i){let s=0;if(!t&&!i&&1===e.length&&(s=e.charCodeAt(0))<256){if(-9999!==this._flat[s])return this._flat[s];const t=this._measure(e,0);return t>0&&(this._flat[s]=t),t}let r=e;t&&(r+="B"),i&&(r+="I");let n=this._holey.get(r);if(void 0===n){let s=0;t&&(s|=1),i&&(s|=2),n=this._measure(e,s),n>0&&this._holey.set(r,n)}return n}_measure(e,t){const i=this._measureElements[t];return i.textContent=e.repeat(32),i.offsetWidth/32}}},2223:(e,t,i)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.TEXT_BASELINE=t.DIM_OPACITY=t.INVERTED_DEFAULT_COLOR=void 0;const s=i(6114);t.INVERTED_DEFAULT_COLOR=257,t.DIM_OPACITY=.5,t.TEXT_BASELINE=s.isFirefox||s.isLegacyEdge?"bottom":"ideographic"},6171:(e,t)=>{function i(e){return 57508<=e&&e<=57558}function s(e){return e>=128512&&e<=128591||e>=127744&&e<=128511||e>=128640&&e<=128767||e>=9728&&e<=9983||e>=9984&&e<=10175||e>=65024&&e<=65039||e>=129280&&e<=129535||e>=127462&&e<=127487}Object.defineProperty(t,"__esModule",{value:!0}),t.computeNextVariantOffset=t.createRenderDimensions=t.treatGlyphAsBackgroundColor=t.allowRescaling=t.isEmoji=t.isRestrictedPowerlineGlyph=t.isPowerlineGlyph=t.throwIfFalsy=void 0,t.throwIfFalsy=function(e){if(!e)throw new Error("value must not be falsy");return e},t.isPowerlineGlyph=i,t.isRestrictedPowerlineGlyph=function(e){return 57520<=e&&e<=57527},t.isEmoji=s,t.allowRescaling=function(e,t,r,n){return 1===t&&r>Math.ceil(1.5*n)&&void 0!==e&&e>255&&!s(e)&&!i(e)&&!function(e){return 57344<=e&&e<=63743}(e)},t.treatGlyphAsBackgroundColor=function(e){return i(e)||function(e){return 9472<=e&&e<=9631}(e)},t.createRenderDimensions=function(){return{css:{canvas:{width:0,height:0},cell:{width:0,height:0}},device:{canvas:{width:0,height:0},cell:{width:0,height:0},char:{width:0,height:0,left:0,top:0}}}},t.computeNextVariantOffset=function(e,t,i=0){return(e-(2*Math.round(t)-i))%(2*Math.round(t))}},6052:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.createSelectionRenderModel=void 0;class i{constructor(){this.clear()}clear(){this.hasSelection=!1,this.columnSelectMode=!1,this.viewportStartRow=0,this.viewportEndRow=0,this.viewportCappedStartRow=0,this.viewportCappedEndRow=0,this.startCol=0,this.endCol=0,this.selectionStart=void 0,this.selectionEnd=void 0}update(e,t,i,s=!1){if(this.selectionStart=t,this.selectionEnd=i,!t||!i||t[0]===i[0]&&t[1]===i[1])return void this.clear();const r=e.buffers.active.ydisp,n=t[1]-r,o=i[1]-r,a=Math.max(n,0),h=Math.min(o,e.rows-1);a>=e.rows||h<0?this.clear():(this.hasSelection=!0,this.columnSelectMode=s,this.viewportStartRow=n,this.viewportEndRow=o,this.viewportCappedStartRow=a,this.viewportCappedEndRow=h,this.startCol=t[0],this.endCol=i[0])}isCellSelected(e,t,i){return!!this.hasSelection&&(i-=e.buffer.active.viewportY,this.columnSelectMode?this.startCol<=this.endCol?t>=this.startCol&&i>=this.viewportCappedStartRow&&t=this.viewportCappedStartRow&&t>=this.endCol&&i<=this.viewportCappedEndRow:i>this.viewportStartRow&&i=this.startCol&&t=this.startCol)}}t.createSelectionRenderModel=function(){return new i}},456:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.SelectionModel=void 0,t.SelectionModel=class{constructor(e){this._bufferService=e,this.isSelectAllActive=!1,this.selectionStartLength=0}clearSelection(){this.selectionStart=void 0,this.selectionEnd=void 0,this.isSelectAllActive=!1,this.selectionStartLength=0}get finalSelectionStart(){return this.isSelectAllActive?[0,0]:this.selectionEnd&&this.selectionStart&&this.areSelectionValuesReversed()?this.selectionEnd:this.selectionStart}get finalSelectionEnd(){if(this.isSelectAllActive)return[this._bufferService.cols,this._bufferService.buffer.ybase+this._bufferService.rows-1];if(this.selectionStart){if(!this.selectionEnd||this.areSelectionValuesReversed()){const e=this.selectionStart[0]+this.selectionStartLength;return e>this._bufferService.cols?e%this._bufferService.cols==0?[this._bufferService.cols,this.selectionStart[1]+Math.floor(e/this._bufferService.cols)-1]:[e%this._bufferService.cols,this.selectionStart[1]+Math.floor(e/this._bufferService.cols)]:[e,this.selectionStart[1]]}if(this.selectionStartLength&&this.selectionEnd[1]===this.selectionStart[1]){const e=this.selectionStart[0]+this.selectionStartLength;return e>this._bufferService.cols?[e%this._bufferService.cols,this.selectionStart[1]+Math.floor(e/this._bufferService.cols)]:[Math.max(e,this.selectionEnd[0]),this.selectionEnd[1]]}return this.selectionEnd}}areSelectionValuesReversed(){const e=this.selectionStart,t=this.selectionEnd;return!(!e||!t)&&(e[1]>t[1]||e[1]===t[1]&&e[0]>t[0])}handleTrim(e){return this.selectionStart&&(this.selectionStart[1]-=e),this.selectionEnd&&(this.selectionEnd[1]-=e),this.selectionEnd&&this.selectionEnd[1]<0?(this.clearSelection(),!0):(this.selectionStart&&this.selectionStart[1]<0&&(this.selectionStart[1]=0),!1)}}},428:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.CharSizeService=void 0;const n=i(2585),o=i(8460),a=i(844);let h=t.CharSizeService=class extends a.Disposable{get hasValidSize(){return this.width>0&&this.height>0}constructor(e,t,i){super(),this._optionsService=i,this.width=0,this.height=0,this._onCharSizeChange=this.register(new o.EventEmitter),this.onCharSizeChange=this._onCharSizeChange.event;try{this._measureStrategy=this.register(new d(this._optionsService))}catch{this._measureStrategy=this.register(new l(e,t,this._optionsService))}this.register(this._optionsService.onMultipleOptionChange(["fontFamily","fontSize"],(()=>this.measure())))}measure(){const e=this._measureStrategy.measure();e.width===this.width&&e.height===this.height||(this.width=e.width,this.height=e.height,this._onCharSizeChange.fire())}};t.CharSizeService=h=s([r(2,n.IOptionsService)],h);class c extends a.Disposable{constructor(){super(...arguments),this._result={width:0,height:0}}_validateAndSet(e,t){void 0!==e&&e>0&&void 0!==t&&t>0&&(this._result.width=e,this._result.height=t)}}class l extends c{constructor(e,t,i){super(),this._document=e,this._parentElement=t,this._optionsService=i,this._measureElement=this._document.createElement("span"),this._measureElement.classList.add("xterm-char-measure-element"),this._measureElement.textContent="W".repeat(32),this._measureElement.setAttribute("aria-hidden","true"),this._measureElement.style.whiteSpace="pre",this._measureElement.style.fontKerning="none",this._parentElement.appendChild(this._measureElement)}measure(){return this._measureElement.style.fontFamily=this._optionsService.rawOptions.fontFamily,this._measureElement.style.fontSize=`${this._optionsService.rawOptions.fontSize}px`,this._validateAndSet(Number(this._measureElement.offsetWidth)/32,Number(this._measureElement.offsetHeight)),this._result}}class d extends c{constructor(e){super(),this._optionsService=e,this._canvas=new OffscreenCanvas(100,100),this._ctx=this._canvas.getContext("2d");const t=this._ctx.measureText("W");if(!("width"in t&&"fontBoundingBoxAscent"in t&&"fontBoundingBoxDescent"in t))throw new Error("Required font metrics not supported")}measure(){this._ctx.font=`${this._optionsService.rawOptions.fontSize}px ${this._optionsService.rawOptions.fontFamily}`;const e=this._ctx.measureText("W");return this._validateAndSet(e.width,e.fontBoundingBoxAscent+e.fontBoundingBoxDescent),this._result}}},4269:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.CharacterJoinerService=t.JoinedCellData=void 0;const n=i(3734),o=i(643),a=i(511),h=i(2585);class c extends n.AttributeData{constructor(e,t,i){super(),this.content=0,this.combinedData="",this.fg=e.fg,this.bg=e.bg,this.combinedData=t,this._width=i}isCombined(){return 2097152}getWidth(){return this._width}getChars(){return this.combinedData}getCode(){return 2097151}setFromCharData(e){throw new Error("not implemented")}getAsCharData(){return[this.fg,this.getChars(),this.getWidth(),this.getCode()]}}t.JoinedCellData=c;let l=t.CharacterJoinerService=class e{constructor(e){this._bufferService=e,this._characterJoiners=[],this._nextCharacterJoinerId=0,this._workCell=new a.CellData}register(e){const t={id:this._nextCharacterJoinerId++,handler:e};return this._characterJoiners.push(t),t.id}deregister(e){for(let t=0;t1){const e=this._getJoinedRanges(s,a,n,t,r);for(let t=0;t1){const e=this._getJoinedRanges(s,a,n,t,r);for(let t=0;t{Object.defineProperty(t,"__esModule",{value:!0}),t.CoreBrowserService=void 0;const s=i(844),r=i(8460),n=i(3656);class o extends s.Disposable{constructor(e,t,i){super(),this._textarea=e,this._window=t,this.mainDocument=i,this._isFocused=!1,this._cachedIsFocused=void 0,this._screenDprMonitor=new a(this._window),this._onDprChange=this.register(new r.EventEmitter),this.onDprChange=this._onDprChange.event,this._onWindowChange=this.register(new r.EventEmitter),this.onWindowChange=this._onWindowChange.event,this.register(this.onWindowChange((e=>this._screenDprMonitor.setWindow(e)))),this.register((0,r.forwardEvent)(this._screenDprMonitor.onDprChange,this._onDprChange)),this._textarea.addEventListener("focus",(()=>this._isFocused=!0)),this._textarea.addEventListener("blur",(()=>this._isFocused=!1))}get window(){return this._window}set window(e){this._window!==e&&(this._window=e,this._onWindowChange.fire(this._window))}get dpr(){return this.window.devicePixelRatio}get isFocused(){return void 0===this._cachedIsFocused&&(this._cachedIsFocused=this._isFocused&&this._textarea.ownerDocument.hasFocus(),queueMicrotask((()=>this._cachedIsFocused=void 0))),this._cachedIsFocused}}t.CoreBrowserService=o;class a extends s.Disposable{constructor(e){super(),this._parentWindow=e,this._windowResizeListener=this.register(new s.MutableDisposable),this._onDprChange=this.register(new r.EventEmitter),this.onDprChange=this._onDprChange.event,this._outerListener=()=>this._setDprAndFireIfDiffers(),this._currentDevicePixelRatio=this._parentWindow.devicePixelRatio,this._updateDpr(),this._setWindowResizeListener(),this.register((0,s.toDisposable)((()=>this.clearListener())))}setWindow(e){this._parentWindow=e,this._setWindowResizeListener(),this._setDprAndFireIfDiffers()}_setWindowResizeListener(){this._windowResizeListener.value=(0,n.addDisposableDomListener)(this._parentWindow,"resize",(()=>this._setDprAndFireIfDiffers()))}_setDprAndFireIfDiffers(){this._parentWindow.devicePixelRatio!==this._currentDevicePixelRatio&&this._onDprChange.fire(this._parentWindow.devicePixelRatio),this._updateDpr()}_updateDpr(){this._outerListener&&(this._resolutionMediaMatchList?.removeListener(this._outerListener),this._currentDevicePixelRatio=this._parentWindow.devicePixelRatio,this._resolutionMediaMatchList=this._parentWindow.matchMedia(`screen and (resolution: ${this._parentWindow.devicePixelRatio}dppx)`),this._resolutionMediaMatchList.addListener(this._outerListener))}clearListener(){this._resolutionMediaMatchList&&this._outerListener&&(this._resolutionMediaMatchList.removeListener(this._outerListener),this._resolutionMediaMatchList=void 0,this._outerListener=void 0)}}},779:(e,t,i)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.LinkProviderService=void 0;const s=i(844);class r extends s.Disposable{constructor(){super(),this.linkProviders=[],this.register((0,s.toDisposable)((()=>this.linkProviders.length=0)))}registerLinkProvider(e){return this.linkProviders.push(e),{dispose:()=>{const t=this.linkProviders.indexOf(e);-1!==t&&this.linkProviders.splice(t,1)}}}}t.LinkProviderService=r},8934:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.MouseService=void 0;const n=i(4725),o=i(9806);let a=t.MouseService=class{constructor(e,t){this._renderService=e,this._charSizeService=t}getCoords(e,t,i,s,r){return(0,o.getCoords)(window,e,t,i,s,this._charSizeService.hasValidSize,this._renderService.dimensions.css.cell.width,this._renderService.dimensions.css.cell.height,r)}getMouseReportCoords(e,t){const i=(0,o.getCoordsRelativeToElement)(window,e,t);if(this._charSizeService.hasValidSize)return i[0]=Math.min(Math.max(i[0],0),this._renderService.dimensions.css.canvas.width-1),i[1]=Math.min(Math.max(i[1],0),this._renderService.dimensions.css.canvas.height-1),{col:Math.floor(i[0]/this._renderService.dimensions.css.cell.width),row:Math.floor(i[1]/this._renderService.dimensions.css.cell.height),x:Math.floor(i[0]),y:Math.floor(i[1])}}};t.MouseService=a=s([r(0,n.IRenderService),r(1,n.ICharSizeService)],a)},3230:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.RenderService=void 0;const n=i(6193),o=i(4725),a=i(8460),h=i(844),c=i(7226),l=i(2585);let d=t.RenderService=class extends h.Disposable{get dimensions(){return this._renderer.value.dimensions}constructor(e,t,i,s,r,o,l,d){super(),this._rowCount=e,this._charSizeService=s,this._renderer=this.register(new h.MutableDisposable),this._pausedResizeTask=new c.DebouncedIdleTask,this._observerDisposable=this.register(new h.MutableDisposable),this._isPaused=!1,this._needsFullRefresh=!1,this._isNextRenderRedrawOnly=!0,this._needsSelectionRefresh=!1,this._canvasWidth=0,this._canvasHeight=0,this._selectionState={start:void 0,end:void 0,columnSelectMode:!1},this._onDimensionsChange=this.register(new a.EventEmitter),this.onDimensionsChange=this._onDimensionsChange.event,this._onRenderedViewportChange=this.register(new a.EventEmitter),this.onRenderedViewportChange=this._onRenderedViewportChange.event,this._onRender=this.register(new a.EventEmitter),this.onRender=this._onRender.event,this._onRefreshRequest=this.register(new a.EventEmitter),this.onRefreshRequest=this._onRefreshRequest.event,this._renderDebouncer=new n.RenderDebouncer(((e,t)=>this._renderRows(e,t)),l),this.register(this._renderDebouncer),this.register(l.onDprChange((()=>this.handleDevicePixelRatioChange()))),this.register(o.onResize((()=>this._fullRefresh()))),this.register(o.buffers.onBufferActivate((()=>this._renderer.value?.clear()))),this.register(i.onOptionChange((()=>this._handleOptionsChanged()))),this.register(this._charSizeService.onCharSizeChange((()=>this.handleCharSizeChanged()))),this.register(r.onDecorationRegistered((()=>this._fullRefresh()))),this.register(r.onDecorationRemoved((()=>this._fullRefresh()))),this.register(i.onMultipleOptionChange(["customGlyphs","drawBoldTextInBrightColors","letterSpacing","lineHeight","fontFamily","fontSize","fontWeight","fontWeightBold","minimumContrastRatio","rescaleOverlappingGlyphs"],(()=>{this.clear(),this.handleResize(o.cols,o.rows),this._fullRefresh()}))),this.register(i.onMultipleOptionChange(["cursorBlink","cursorStyle"],(()=>this.refreshRows(o.buffer.y,o.buffer.y,!0)))),this.register(d.onChangeColors((()=>this._fullRefresh()))),this._registerIntersectionObserver(l.window,t),this.register(l.onWindowChange((e=>this._registerIntersectionObserver(e,t))))}_registerIntersectionObserver(e,t){if("IntersectionObserver"in e){const i=new e.IntersectionObserver((e=>this._handleIntersectionChange(e[e.length-1])),{threshold:0});i.observe(t),this._observerDisposable.value=(0,h.toDisposable)((()=>i.disconnect()))}}_handleIntersectionChange(e){this._isPaused=void 0===e.isIntersecting?0===e.intersectionRatio:!e.isIntersecting,this._isPaused||this._charSizeService.hasValidSize||this._charSizeService.measure(),!this._isPaused&&this._needsFullRefresh&&(this._pausedResizeTask.flush(),this.refreshRows(0,this._rowCount-1),this._needsFullRefresh=!1)}refreshRows(e,t,i=!1){this._isPaused?this._needsFullRefresh=!0:(i||(this._isNextRenderRedrawOnly=!1),this._renderDebouncer.refresh(e,t,this._rowCount))}_renderRows(e,t){this._renderer.value&&(e=Math.min(e,this._rowCount-1),t=Math.min(t,this._rowCount-1),this._renderer.value.renderRows(e,t),this._needsSelectionRefresh&&(this._renderer.value.handleSelectionChanged(this._selectionState.start,this._selectionState.end,this._selectionState.columnSelectMode),this._needsSelectionRefresh=!1),this._isNextRenderRedrawOnly||this._onRenderedViewportChange.fire({start:e,end:t}),this._onRender.fire({start:e,end:t}),this._isNextRenderRedrawOnly=!0)}resize(e,t){this._rowCount=t,this._fireOnCanvasResize()}_handleOptionsChanged(){this._renderer.value&&(this.refreshRows(0,this._rowCount-1),this._fireOnCanvasResize())}_fireOnCanvasResize(){this._renderer.value&&(this._renderer.value.dimensions.css.canvas.width===this._canvasWidth&&this._renderer.value.dimensions.css.canvas.height===this._canvasHeight||this._onDimensionsChange.fire(this._renderer.value.dimensions))}hasRenderer(){return!!this._renderer.value}setRenderer(e){this._renderer.value=e,this._renderer.value&&(this._renderer.value.onRequestRedraw((e=>this.refreshRows(e.start,e.end,!0))),this._needsSelectionRefresh=!0,this._fullRefresh())}addRefreshCallback(e){return this._renderDebouncer.addRefreshCallback(e)}_fullRefresh(){this._isPaused?this._needsFullRefresh=!0:this.refreshRows(0,this._rowCount-1)}clearTextureAtlas(){this._renderer.value&&(this._renderer.value.clearTextureAtlas?.(),this._fullRefresh())}handleDevicePixelRatioChange(){this._charSizeService.measure(),this._renderer.value&&(this._renderer.value.handleDevicePixelRatioChange(),this.refreshRows(0,this._rowCount-1))}handleResize(e,t){this._renderer.value&&(this._isPaused?this._pausedResizeTask.set((()=>this._renderer.value?.handleResize(e,t))):this._renderer.value.handleResize(e,t),this._fullRefresh())}handleCharSizeChanged(){this._renderer.value?.handleCharSizeChanged()}handleBlur(){this._renderer.value?.handleBlur()}handleFocus(){this._renderer.value?.handleFocus()}handleSelectionChanged(e,t,i){this._selectionState.start=e,this._selectionState.end=t,this._selectionState.columnSelectMode=i,this._renderer.value?.handleSelectionChanged(e,t,i)}handleCursorMove(){this._renderer.value?.handleCursorMove()}clear(){this._renderer.value?.clear()}};t.RenderService=d=s([r(2,l.IOptionsService),r(3,o.ICharSizeService),r(4,l.IDecorationService),r(5,l.IBufferService),r(6,o.ICoreBrowserService),r(7,o.IThemeService)],d)},9312:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.SelectionService=void 0;const n=i(9806),o=i(9504),a=i(456),h=i(4725),c=i(8460),l=i(844),d=i(6114),_=i(4841),u=i(511),f=i(2585),v=String.fromCharCode(160),p=new RegExp(v,"g");let g=t.SelectionService=class extends l.Disposable{constructor(e,t,i,s,r,n,o,h,d){super(),this._element=e,this._screenElement=t,this._linkifier=i,this._bufferService=s,this._coreService=r,this._mouseService=n,this._optionsService=o,this._renderService=h,this._coreBrowserService=d,this._dragScrollAmount=0,this._enabled=!0,this._workCell=new u.CellData,this._mouseDownTimeStamp=0,this._oldHasSelection=!1,this._oldSelectionStart=void 0,this._oldSelectionEnd=void 0,this._onLinuxMouseSelection=this.register(new c.EventEmitter),this.onLinuxMouseSelection=this._onLinuxMouseSelection.event,this._onRedrawRequest=this.register(new c.EventEmitter),this.onRequestRedraw=this._onRedrawRequest.event,this._onSelectionChange=this.register(new c.EventEmitter),this.onSelectionChange=this._onSelectionChange.event,this._onRequestScrollLines=this.register(new c.EventEmitter),this.onRequestScrollLines=this._onRequestScrollLines.event,this._mouseMoveListener=e=>this._handleMouseMove(e),this._mouseUpListener=e=>this._handleMouseUp(e),this._coreService.onUserInput((()=>{this.hasSelection&&this.clearSelection()})),this._trimListener=this._bufferService.buffer.lines.onTrim((e=>this._handleTrim(e))),this.register(this._bufferService.buffers.onBufferActivate((e=>this._handleBufferActivate(e)))),this.enable(),this._model=new a.SelectionModel(this._bufferService),this._activeSelectionMode=0,this.register((0,l.toDisposable)((()=>{this._removeMouseDownListeners()})))}reset(){this.clearSelection()}disable(){this.clearSelection(),this._enabled=!1}enable(){this._enabled=!0}get selectionStart(){return this._model.finalSelectionStart}get selectionEnd(){return this._model.finalSelectionEnd}get hasSelection(){const e=this._model.finalSelectionStart,t=this._model.finalSelectionEnd;return!(!e||!t||e[0]===t[0]&&e[1]===t[1])}get selectionText(){const e=this._model.finalSelectionStart,t=this._model.finalSelectionEnd;if(!e||!t)return"";const i=this._bufferService.buffer,s=[];if(3===this._activeSelectionMode){if(e[0]===t[0])return"";const r=e[0]e.replace(p," "))).join(d.isWindows?"\r\n":"\n")}clearSelection(){this._model.clearSelection(),this._removeMouseDownListeners(),this.refresh(),this._onSelectionChange.fire()}refresh(e){this._refreshAnimationFrame||(this._refreshAnimationFrame=this._coreBrowserService.window.requestAnimationFrame((()=>this._refresh()))),d.isLinux&&e&&this.selectionText.length&&this._onLinuxMouseSelection.fire(this.selectionText)}_refresh(){this._refreshAnimationFrame=void 0,this._onRedrawRequest.fire({start:this._model.finalSelectionStart,end:this._model.finalSelectionEnd,columnSelectMode:3===this._activeSelectionMode})}_isClickInSelection(e){const t=this._getMouseBufferCoords(e),i=this._model.finalSelectionStart,s=this._model.finalSelectionEnd;return!!(i&&s&&t)&&this._areCoordsInSelection(t,i,s)}isCellInSelection(e,t){const i=this._model.finalSelectionStart,s=this._model.finalSelectionEnd;return!(!i||!s)&&this._areCoordsInSelection([e,t],i,s)}_areCoordsInSelection(e,t,i){return e[1]>t[1]&&e[1]=t[0]&&e[0]=t[0]}_selectWordAtCursor(e,t){const i=this._linkifier.currentLink?.link?.range;if(i)return this._model.selectionStart=[i.start.x-1,i.start.y-1],this._model.selectionStartLength=(0,_.getRangeLength)(i,this._bufferService.cols),this._model.selectionEnd=void 0,!0;const s=this._getMouseBufferCoords(e);return!!s&&(this._selectWordAt(s,t),this._model.selectionEnd=void 0,!0)}selectAll(){this._model.isSelectAllActive=!0,this.refresh(),this._onSelectionChange.fire()}selectLines(e,t){this._model.clearSelection(),e=Math.max(e,0),t=Math.min(t,this._bufferService.buffer.lines.length-1),this._model.selectionStart=[0,e],this._model.selectionEnd=[this._bufferService.cols,t],this.refresh(),this._onSelectionChange.fire()}_handleTrim(e){this._model.handleTrim(e)&&this.refresh()}_getMouseBufferCoords(e){const t=this._mouseService.getCoords(e,this._screenElement,this._bufferService.cols,this._bufferService.rows,!0);if(t)return t[0]--,t[1]--,t[1]+=this._bufferService.buffer.ydisp,t}_getMouseEventScrollAmount(e){let t=(0,n.getCoordsRelativeToElement)(this._coreBrowserService.window,e,this._screenElement)[1];const i=this._renderService.dimensions.css.canvas.height;return t>=0&&t<=i?0:(t>i&&(t-=i),t=Math.min(Math.max(t,-50),50),t/=50,t/Math.abs(t)+Math.round(14*t))}shouldForceSelection(e){return d.isMac?e.altKey&&this._optionsService.rawOptions.macOptionClickForcesSelection:e.shiftKey}handleMouseDown(e){if(this._mouseDownTimeStamp=e.timeStamp,(2!==e.button||!this.hasSelection)&&0===e.button){if(!this._enabled){if(!this.shouldForceSelection(e))return;e.stopPropagation()}e.preventDefault(),this._dragScrollAmount=0,this._enabled&&e.shiftKey?this._handleIncrementalClick(e):1===e.detail?this._handleSingleClick(e):2===e.detail?this._handleDoubleClick(e):3===e.detail&&this._handleTripleClick(e),this._addMouseDownListeners(),this.refresh(!0)}}_addMouseDownListeners(){this._screenElement.ownerDocument&&(this._screenElement.ownerDocument.addEventListener("mousemove",this._mouseMoveListener),this._screenElement.ownerDocument.addEventListener("mouseup",this._mouseUpListener)),this._dragScrollIntervalTimer=this._coreBrowserService.window.setInterval((()=>this._dragScroll()),50)}_removeMouseDownListeners(){this._screenElement.ownerDocument&&(this._screenElement.ownerDocument.removeEventListener("mousemove",this._mouseMoveListener),this._screenElement.ownerDocument.removeEventListener("mouseup",this._mouseUpListener)),this._coreBrowserService.window.clearInterval(this._dragScrollIntervalTimer),this._dragScrollIntervalTimer=void 0}_handleIncrementalClick(e){this._model.selectionStart&&(this._model.selectionEnd=this._getMouseBufferCoords(e))}_handleSingleClick(e){if(this._model.selectionStartLength=0,this._model.isSelectAllActive=!1,this._activeSelectionMode=this.shouldColumnSelect(e)?3:0,this._model.selectionStart=this._getMouseBufferCoords(e),!this._model.selectionStart)return;this._model.selectionEnd=void 0;const t=this._bufferService.buffer.lines.get(this._model.selectionStart[1]);t&&t.length!==this._model.selectionStart[0]&&0===t.hasWidth(this._model.selectionStart[0])&&this._model.selectionStart[0]++}_handleDoubleClick(e){this._selectWordAtCursor(e,!0)&&(this._activeSelectionMode=1)}_handleTripleClick(e){const t=this._getMouseBufferCoords(e);t&&(this._activeSelectionMode=2,this._selectLineAt(t[1]))}shouldColumnSelect(e){return e.altKey&&!(d.isMac&&this._optionsService.rawOptions.macOptionClickForcesSelection)}_handleMouseMove(e){if(e.stopImmediatePropagation(),!this._model.selectionStart)return;const t=this._model.selectionEnd?[this._model.selectionEnd[0],this._model.selectionEnd[1]]:null;if(this._model.selectionEnd=this._getMouseBufferCoords(e),!this._model.selectionEnd)return void this.refresh(!0);2===this._activeSelectionMode?this._model.selectionEnd[1]0?this._model.selectionEnd[0]=this._bufferService.cols:this._dragScrollAmount<0&&(this._model.selectionEnd[0]=0));const i=this._bufferService.buffer;if(this._model.selectionEnd[1]0?(3!==this._activeSelectionMode&&(this._model.selectionEnd[0]=this._bufferService.cols),this._model.selectionEnd[1]=Math.min(e.ydisp+this._bufferService.rows,e.lines.length-1)):(3!==this._activeSelectionMode&&(this._model.selectionEnd[0]=0),this._model.selectionEnd[1]=e.ydisp),this.refresh()}}_handleMouseUp(e){const t=e.timeStamp-this._mouseDownTimeStamp;if(this._removeMouseDownListeners(),this.selectionText.length<=1&&t<500&&e.altKey&&this._optionsService.rawOptions.altClickMovesCursor){if(this._bufferService.buffer.ybase===this._bufferService.buffer.ydisp){const t=this._mouseService.getCoords(e,this._element,this._bufferService.cols,this._bufferService.rows,!1);if(t&&void 0!==t[0]&&void 0!==t[1]){const e=(0,o.moveToCellSequence)(t[0]-1,t[1]-1,this._bufferService,this._coreService.decPrivateModes.applicationCursorKeys);this._coreService.triggerDataEvent(e,!0)}}}else this._fireEventIfSelectionChanged()}_fireEventIfSelectionChanged(){const e=this._model.finalSelectionStart,t=this._model.finalSelectionEnd,i=!(!e||!t||e[0]===t[0]&&e[1]===t[1]);i?e&&t&&(this._oldSelectionStart&&this._oldSelectionEnd&&e[0]===this._oldSelectionStart[0]&&e[1]===this._oldSelectionStart[1]&&t[0]===this._oldSelectionEnd[0]&&t[1]===this._oldSelectionEnd[1]||this._fireOnSelectionChange(e,t,i)):this._oldHasSelection&&this._fireOnSelectionChange(e,t,i)}_fireOnSelectionChange(e,t,i){this._oldSelectionStart=e,this._oldSelectionEnd=t,this._oldHasSelection=i,this._onSelectionChange.fire()}_handleBufferActivate(e){this.clearSelection(),this._trimListener.dispose(),this._trimListener=e.activeBuffer.lines.onTrim((e=>this._handleTrim(e)))}_convertViewportColToCharacterIndex(e,t){let i=t;for(let s=0;t>=s;s++){const r=e.loadCell(s,this._workCell).getChars().length;0===this._workCell.getWidth()?i--:r>1&&t!==s&&(i+=r-1)}return i}setSelection(e,t,i){this._model.clearSelection(),this._removeMouseDownListeners(),this._model.selectionStart=[e,t],this._model.selectionStartLength=i,this.refresh(),this._fireEventIfSelectionChanged()}rightClickSelect(e){this._isClickInSelection(e)||(this._selectWordAtCursor(e,!1)&&this.refresh(!0),this._fireEventIfSelectionChanged())}_getWordAt(e,t,i=!0,s=!0){if(e[0]>=this._bufferService.cols)return;const r=this._bufferService.buffer,n=r.lines.get(e[1]);if(!n)return;const o=r.translateBufferLineToString(e[1],!1);let a=this._convertViewportColToCharacterIndex(n,e[0]),h=a;const c=e[0]-a;let l=0,d=0,_=0,u=0;if(" "===o.charAt(a)){for(;a>0&&" "===o.charAt(a-1);)a--;for(;h1&&(u+=s-1,h+=s-1);t>0&&a>0&&!this._isCharWordSeparator(n.loadCell(t-1,this._workCell));){n.loadCell(t-1,this._workCell);const e=this._workCell.getChars().length;0===this._workCell.getWidth()?(l++,t--):e>1&&(_+=e-1,a-=e-1),a--,t--}for(;i1&&(u+=e-1,h+=e-1),h++,i++}}h++;let f=a+c-l+_,v=Math.min(this._bufferService.cols,h-a+l+d-_-u);if(t||""!==o.slice(a,h).trim()){if(i&&0===f&&32!==n.getCodePoint(0)){const t=r.lines.get(e[1]-1);if(t&&n.isWrapped&&32!==t.getCodePoint(this._bufferService.cols-1)){const t=this._getWordAt([this._bufferService.cols-1,e[1]-1],!1,!0,!1);if(t){const e=this._bufferService.cols-t.start;f-=e,v+=e}}}if(s&&f+v===this._bufferService.cols&&32!==n.getCodePoint(this._bufferService.cols-1)){const t=r.lines.get(e[1]+1);if(t?.isWrapped&&32!==t.getCodePoint(0)){const t=this._getWordAt([0,e[1]+1],!1,!1,!0);t&&(v+=t.length)}}return{start:f,length:v}}}_selectWordAt(e,t){const i=this._getWordAt(e,t);if(i){for(;i.start<0;)i.start+=this._bufferService.cols,e[1]--;this._model.selectionStart=[i.start,e[1]],this._model.selectionStartLength=i.length}}_selectToWordAt(e){const t=this._getWordAt(e,!0);if(t){let i=e[1];for(;t.start<0;)t.start+=this._bufferService.cols,i--;if(!this._model.areSelectionValuesReversed())for(;t.start+t.length>this._bufferService.cols;)t.length-=this._bufferService.cols,i++;this._model.selectionEnd=[this._model.areSelectionValuesReversed()?t.start:t.start+t.length,i]}}_isCharWordSeparator(e){return 0!==e.getWidth()&&this._optionsService.rawOptions.wordSeparator.indexOf(e.getChars())>=0}_selectLineAt(e){const t=this._bufferService.buffer.getWrappedRangeForLine(e),i={start:{x:0,y:t.first},end:{x:this._bufferService.cols-1,y:t.last}};this._model.selectionStart=[0,t.first],this._model.selectionEnd=void 0,this._model.selectionStartLength=(0,_.getRangeLength)(i,this._bufferService.cols)}};t.SelectionService=g=s([r(3,f.IBufferService),r(4,f.ICoreService),r(5,h.IMouseService),r(6,f.IOptionsService),r(7,h.IRenderService),r(8,h.ICoreBrowserService)],g)},4725:(e,t,i)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.ILinkProviderService=t.IThemeService=t.ICharacterJoinerService=t.ISelectionService=t.IRenderService=t.IMouseService=t.ICoreBrowserService=t.ICharSizeService=void 0;const s=i(8343);t.ICharSizeService=(0,s.createDecorator)("CharSizeService"),t.ICoreBrowserService=(0,s.createDecorator)("CoreBrowserService"),t.IMouseService=(0,s.createDecorator)("MouseService"),t.IRenderService=(0,s.createDecorator)("RenderService"),t.ISelectionService=(0,s.createDecorator)("SelectionService"),t.ICharacterJoinerService=(0,s.createDecorator)("CharacterJoinerService"),t.IThemeService=(0,s.createDecorator)("ThemeService"),t.ILinkProviderService=(0,s.createDecorator)("LinkProviderService")},6731:function(e,t,i){var s=this&&this.__decorate||function(e,t,i,s){var r,n=arguments.length,o=n<3?t:null===s?s=Object.getOwnPropertyDescriptor(t,i):s;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,s);else for(var a=e.length-1;a>=0;a--)(r=e[a])&&(o=(n<3?r(o):n>3?r(t,i,o):r(t,i))||o);return n>3&&o&&Object.defineProperty(t,i,o),o},r=this&&this.__param||function(e,t){return function(i,s){t(i,s,e)}};Object.defineProperty(t,"__esModule",{value:!0}),t.ThemeService=t.DEFAULT_ANSI_COLORS=void 0;const n=i(7239),o=i(8055),a=i(8460),h=i(844),c=i(2585),l=o.css.toColor("#ffffff"),d=o.css.toColor("#000000"),_=o.css.toColor("#ffffff"),u=o.css.toColor("#000000"),f={css:"rgba(255, 255, 255, 0.3)",rgba:4294967117};t.DEFAULT_ANSI_COLORS=Object.freeze((()=>{const e=[o.css.toColor("#2e3436"),o.css.toColor("#cc0000"),o.css.toColor("#4e9a06"),o.css.toColor("#c4a000"),o.css.toColor("#3465a4"),o.css.toColor("#75507b"),o.css.toColor("#06989a"),o.css.toColor("#d3d7cf"),o.css.toColor("#555753"),o.css.toColor("#ef2929"),o.css.toColor("#8ae234"),o.css.toColor("#fce94f"),o.css.toColor("#729fcf"),o.css.toColor("#ad7fa8"),o.css.toColor("#34e2e2"),o.css.toColor("#eeeeec")],t=[0,95,135,175,215,255];for(let i=0;i<216;i++){const s=t[i/36%6|0],r=t[i/6%6|0],n=t[i%6];e.push({css:o.channels.toCss(s,r,n),rgba:o.channels.toRgba(s,r,n)})}for(let t=0;t<24;t++){const i=8+10*t;e.push({css:o.channels.toCss(i,i,i),rgba:o.channels.toRgba(i,i,i)})}return e})());let v=t.ThemeService=class extends h.Disposable{get colors(){return this._colors}constructor(e){super(),this._optionsService=e,this._contrastCache=new n.ColorContrastCache,this._halfContrastCache=new n.ColorContrastCache,this._onChangeColors=this.register(new a.EventEmitter),this.onChangeColors=this._onChangeColors.event,this._colors={foreground:l,background:d,cursor:_,cursorAccent:u,selectionForeground:void 0,selectionBackgroundTransparent:f,selectionBackgroundOpaque:o.color.blend(d,f),selectionInactiveBackgroundTransparent:f,selectionInactiveBackgroundOpaque:o.color.blend(d,f),ansi:t.DEFAULT_ANSI_COLORS.slice(),contrastCache:this._contrastCache,halfContrastCache:this._halfContrastCache},this._updateRestoreColors(),this._setTheme(this._optionsService.rawOptions.theme),this.register(this._optionsService.onSpecificOptionChange("minimumContrastRatio",(()=>this._contrastCache.clear()))),this.register(this._optionsService.onSpecificOptionChange("theme",(()=>this._setTheme(this._optionsService.rawOptions.theme))))}_setTheme(e={}){const i=this._colors;if(i.foreground=p(e.foreground,l),i.background=p(e.background,d),i.cursor=p(e.cursor,_),i.cursorAccent=p(e.cursorAccent,u),i.selectionBackgroundTransparent=p(e.selectionBackground,f),i.selectionBackgroundOpaque=o.color.blend(i.background,i.selectionBackgroundTransparent),i.selectionInactiveBackgroundTransparent=p(e.selectionInactiveBackground,i.selectionBackgroundTransparent),i.selectionInactiveBackgroundOpaque=o.color.blend(i.background,i.selectionInactiveBackgroundTransparent),i.selectionForeground=e.selectionForeground?p(e.selectionForeground,o.NULL_COLOR):void 0,i.selectionForeground===o.NULL_COLOR&&(i.selectionForeground=void 0),o.color.isOpaque(i.selectionBackgroundTransparent)){const e=.3;i.selectionBackgroundTransparent=o.color.opacity(i.selectionBackgroundTransparent,e)}if(o.color.isOpaque(i.selectionInactiveBackgroundTransparent)){const e=.3;i.selectionInactiveBackgroundTransparent=o.color.opacity(i.selectionInactiveBackgroundTransparent,e)}if(i.ansi=t.DEFAULT_ANSI_COLORS.slice(),i.ansi[0]=p(e.black,t.DEFAULT_ANSI_COLORS[0]),i.ansi[1]=p(e.red,t.DEFAULT_ANSI_COLORS[1]),i.ansi[2]=p(e.green,t.DEFAULT_ANSI_COLORS[2]),i.ansi[3]=p(e.yellow,t.DEFAULT_ANSI_COLORS[3]),i.ansi[4]=p(e.blue,t.DEFAULT_ANSI_COLORS[4]),i.ansi[5]=p(e.magenta,t.DEFAULT_ANSI_COLORS[5]),i.ansi[6]=p(e.cyan,t.DEFAULT_ANSI_COLORS[6]),i.ansi[7]=p(e.white,t.DEFAULT_ANSI_COLORS[7]),i.ansi[8]=p(e.brightBlack,t.DEFAULT_ANSI_COLORS[8]),i.ansi[9]=p(e.brightRed,t.DEFAULT_ANSI_COLORS[9]),i.ansi[10]=p(e.brightGreen,t.DEFAULT_ANSI_COLORS[10]),i.ansi[11]=p(e.brightYellow,t.DEFAULT_ANSI_COLORS[11]),i.ansi[12]=p(e.brightBlue,t.DEFAULT_ANSI_COLORS[12]),i.ansi[13]=p(e.brightMagenta,t.DEFAULT_ANSI_COLORS[13]),i.ansi[14]=p(e.brightCyan,t.DEFAULT_ANSI_COLORS[14]),i.ansi[15]=p(e.brightWhite,t.DEFAULT_ANSI_COLORS[15]),e.extendedAnsi){const s=Math.min(i.ansi.length-16,e.extendedAnsi.length);for(let r=0;r{Object.defineProperty(t,"__esModule",{value:!0}),t.CircularList=void 0;const s=i(8460),r=i(844);class n extends r.Disposable{constructor(e){super(),this._maxLength=e,this.onDeleteEmitter=this.register(new s.EventEmitter),this.onDelete=this.onDeleteEmitter.event,this.onInsertEmitter=this.register(new s.EventEmitter),this.onInsert=this.onInsertEmitter.event,this.onTrimEmitter=this.register(new s.EventEmitter),this.onTrim=this.onTrimEmitter.event,this._array=new Array(this._maxLength),this._startIndex=0,this._length=0}get maxLength(){return this._maxLength}set maxLength(e){if(this._maxLength===e)return;const t=new Array(e);for(let i=0;ithis._length)for(let t=this._length;t=e;t--)this._array[this._getCyclicIndex(t+i.length)]=this._array[this._getCyclicIndex(t)];for(let t=0;tthis._maxLength){const e=this._length+i.length-this._maxLength;this._startIndex+=e,this._length=this._maxLength,this.onTrimEmitter.fire(e)}else this._length+=i.length}trimStart(e){e>this._length&&(e=this._length),this._startIndex+=e,this._length-=e,this.onTrimEmitter.fire(e)}shiftElements(e,t,i){if(!(t<=0)){if(e<0||e>=this._length)throw new Error("start argument out of range");if(e+i<0)throw new Error("Cannot shift elements in list beyond index 0");if(i>0){for(let s=t-1;s>=0;s--)this.set(e+s+i,this.get(e+s));const s=e+t+i-this._length;if(s>0)for(this._length+=s;this._length>this._maxLength;)this._length--,this._startIndex++,this.onTrimEmitter.fire(1)}else for(let s=0;s{Object.defineProperty(t,"__esModule",{value:!0}),t.clone=void 0,t.clone=function e(t,i=5){if("object"!=typeof t)return t;const s=Array.isArray(t)?[]:{};for(const r in t)s[r]=i<=1?t[r]:t[r]&&e(t[r],i-1);return s}},8055:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.contrastRatio=t.toPaddedHex=t.rgba=t.rgb=t.css=t.color=t.channels=t.NULL_COLOR=void 0;let i=0,s=0,r=0,n=0;var o,a,h,c,l;function d(e){const t=e.toString(16);return t.length<2?"0"+t:t}function _(e,t){return e>>0},e.toColor=function(t,i,s,r){return{css:e.toCss(t,i,s,r),rgba:e.toRgba(t,i,s,r)}}}(o||(t.channels=o={})),function(e){function t(e,t){return n=Math.round(255*t),[i,s,r]=l.toChannels(e.rgba),{css:o.toCss(i,s,r,n),rgba:o.toRgba(i,s,r,n)}}e.blend=function(e,t){if(n=(255&t.rgba)/255,1===n)return{css:t.css,rgba:t.rgba};const a=t.rgba>>24&255,h=t.rgba>>16&255,c=t.rgba>>8&255,l=e.rgba>>24&255,d=e.rgba>>16&255,_=e.rgba>>8&255;return i=l+Math.round((a-l)*n),s=d+Math.round((h-d)*n),r=_+Math.round((c-_)*n),{css:o.toCss(i,s,r),rgba:o.toRgba(i,s,r)}},e.isOpaque=function(e){return 255==(255&e.rgba)},e.ensureContrastRatio=function(e,t,i){const s=l.ensureContrastRatio(e.rgba,t.rgba,i);if(s)return o.toColor(s>>24&255,s>>16&255,s>>8&255)},e.opaque=function(e){const t=(255|e.rgba)>>>0;return[i,s,r]=l.toChannels(t),{css:o.toCss(i,s,r),rgba:t}},e.opacity=t,e.multiplyOpacity=function(e,i){return n=255&e.rgba,t(e,n*i/255)},e.toColorRGB=function(e){return[e.rgba>>24&255,e.rgba>>16&255,e.rgba>>8&255]}}(a||(t.color=a={})),function(e){let t,a;try{const e=document.createElement("canvas");e.width=1,e.height=1;const i=e.getContext("2d",{willReadFrequently:!0});i&&(t=i,t.globalCompositeOperation="copy",a=t.createLinearGradient(0,0,1,1))}catch{}e.toColor=function(e){if(e.match(/#[\da-f]{3,8}/i))switch(e.length){case 4:return i=parseInt(e.slice(1,2).repeat(2),16),s=parseInt(e.slice(2,3).repeat(2),16),r=parseInt(e.slice(3,4).repeat(2),16),o.toColor(i,s,r);case 5:return i=parseInt(e.slice(1,2).repeat(2),16),s=parseInt(e.slice(2,3).repeat(2),16),r=parseInt(e.slice(3,4).repeat(2),16),n=parseInt(e.slice(4,5).repeat(2),16),o.toColor(i,s,r,n);case 7:return{css:e,rgba:(parseInt(e.slice(1),16)<<8|255)>>>0};case 9:return{css:e,rgba:parseInt(e.slice(1),16)>>>0}}const h=e.match(/rgba?\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*(,\s*(0|1|\d?\.(\d+))\s*)?\)/);if(h)return i=parseInt(h[1]),s=parseInt(h[2]),r=parseInt(h[3]),n=Math.round(255*(void 0===h[5]?1:parseFloat(h[5]))),o.toColor(i,s,r,n);if(!t||!a)throw new Error("css.toColor: Unsupported css format");if(t.fillStyle=a,t.fillStyle=e,"string"!=typeof t.fillStyle)throw new Error("css.toColor: Unsupported css format");if(t.fillRect(0,0,1,1),[i,s,r,n]=t.getImageData(0,0,1,1).data,255!==n)throw new Error("css.toColor: Unsupported css format");return{rgba:o.toRgba(i,s,r,n),css:e}}}(h||(t.css=h={})),function(e){function t(e,t,i){const s=e/255,r=t/255,n=i/255;return.2126*(s<=.03928?s/12.92:Math.pow((s+.055)/1.055,2.4))+.7152*(r<=.03928?r/12.92:Math.pow((r+.055)/1.055,2.4))+.0722*(n<=.03928?n/12.92:Math.pow((n+.055)/1.055,2.4))}e.relativeLuminance=function(e){return t(e>>16&255,e>>8&255,255&e)},e.relativeLuminance2=t}(c||(t.rgb=c={})),function(e){function t(e,t,i){const s=e>>24&255,r=e>>16&255,n=e>>8&255;let o=t>>24&255,a=t>>16&255,h=t>>8&255,l=_(c.relativeLuminance2(o,a,h),c.relativeLuminance2(s,r,n));for(;l0||a>0||h>0);)o-=Math.max(0,Math.ceil(.1*o)),a-=Math.max(0,Math.ceil(.1*a)),h-=Math.max(0,Math.ceil(.1*h)),l=_(c.relativeLuminance2(o,a,h),c.relativeLuminance2(s,r,n));return(o<<24|a<<16|h<<8|255)>>>0}function a(e,t,i){const s=e>>24&255,r=e>>16&255,n=e>>8&255;let o=t>>24&255,a=t>>16&255,h=t>>8&255,l=_(c.relativeLuminance2(o,a,h),c.relativeLuminance2(s,r,n));for(;l>>0}e.blend=function(e,t){if(n=(255&t)/255,1===n)return t;const a=t>>24&255,h=t>>16&255,c=t>>8&255,l=e>>24&255,d=e>>16&255,_=e>>8&255;return i=l+Math.round((a-l)*n),s=d+Math.round((h-d)*n),r=_+Math.round((c-_)*n),o.toRgba(i,s,r)},e.ensureContrastRatio=function(e,i,s){const r=c.relativeLuminance(e>>8),n=c.relativeLuminance(i>>8);if(_(r,n)>8));if(o_(r,c.relativeLuminance(t>>8))?n:t}return n}const o=a(e,i,s),h=_(r,c.relativeLuminance(o>>8));if(h