@cluesmith/codev 3.3.6 → 3.3.7

package/dist/agent-farm/servers/tower-websocket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tower-websocket.d.ts","sourceRoot":"","sources":["../../../src/agent-farm/servers/tower-websocket.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAKhD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAkBhE;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAmH1H;AAiED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,IAAI,CAAC,MAAM,EACnB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,MAAM,GACX,IAAI,CAyIN"}
+{"version":3,"file":"tower-websocket.d.ts","sourceRoot":"","sources":["../../../src/agent-farm/servers/tower-websocket.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAKhD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAkBhE;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAmH1H;AAiED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,IAAI,CAAC,MAAM,EACnB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,MAAM,GACX,IAAI,CA6IN"}

package/dist/agent-farm/servers/tower-websocket.js

@@ -7,7 +7,7 @@
  */
 import { WebSocket } from 'ws';
 import { WS_CLOSE_SESSION_UNKNOWN, WS_CLOSE_UNAUTHORIZED } from '../lib/reconnect-backoff.js';
-import { isWebSocketAllowed, isForwardAuthorized } from '../utils/server-utils.js';
+import { isWebSocketAllowed, decideForwardAuthorization } from '../utils/server-utils.js';
 import { matchIdePrefix, forwardIdeWebSocket } from './ide-forward.js';
 import { encodeData, encodeControl, decodeFrame } from '../../terminal/ws-protocol.js';
 import { attachWithReplay } from '../../terminal/attach-replay.js';
@@ -207,13 +207,17 @@ export function setupUpgradeHandler(server, wss, port) {
         // IDE prefix WebSocket forward (Issue #1668). Checked BEFORE the generic
         // isWebSocketAllowed gate below, which requires the `codev-key` SUBPROTOCOL
         // that the IDE workbench's vanilla `?reconnectionToken=` sockets never offer.
-        // Authorized instead by isForwardAuthorized (Host guard + the tunnel-stamped
-        // `codev-tower-key` header) — the same whole-boundary key check the HTTP
-        // forward uses, with no per-folder logic (§D2). Then raw-piped to the local
-        // IDE server; Tower never parses the workbench's own protocol.
+        // Authorized instead by the forward seam (Host guard, then the tunnel-stamped
+        // `codev-tower-key` header, then the local browser's `/ide` forward cookie
+        // behind its cross-port Origin guard, Issue #1869) — the same whole-boundary
+        // decision the HTTP forward uses, with no per-folder logic (§D2). Then
+        // raw-piped to the local IDE server; Tower never parses the workbench's own
+        // protocol.
         if (matchIdePrefix(reqUrl.pathname)) {
-            if (!isForwardAuthorized(req)) {
-                logTerminal('WARN', `IDE WS upgrade 401 ${reqUrl.pathname} — disallowed Host or missing/invalid key`);
+            const decision = decideForwardAuthorization(req);
+            if (!decision.allowed) {
+                // Path + reason only: never the Cookie header or any credential value.
+                logTerminal('WARN', `IDE WS upgrade 401 ${reqUrl.pathname} — ${decision.reason}`);
                 rejectUnauthorized(req, socket, head, wss);
                 return;
             }

package/dist/agent-farm/servers/tower-websocket.js.map

@@ -1 +1 @@
-{"version":3,"file":"tower-websocket.js","sourceRoot":"","sources":["../../../src/agent-farm/servers/tower-websocket.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAmB,SAAS,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEtE,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAa,EAAE,OAAmB,EAAE,GAAyB;IACzG,kFAAkF;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEvF,+CAA+C;IAC/C,gEAAgE;IAChE,4DAA4D;IAC5D,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,CAAC,IAAqB,EAAE,EAAE;YAC9B,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,cAAc,GAAG,kBAAkB,EAAE,CAAC;gBAC/E,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC;IAEF,6EAA6E;IAC7E,IAAI,WAAW,GAA0C,IAAI,CAAC;IAE9D,yDAAyD;IACzD,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAe,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAEhD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,yEAAyE;gBACzE,4EAA4E;gBAC5E,+EAA+E;gBAC/E,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACxD,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACpC,0BAA0B;gBAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;gBAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAc,CAAC;oBACxC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAc,CAAC;oBACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACzD,iFAAiF;wBACjF,mFAAmF;wBACnF,kFAAkF;wBAClF,4DAA4D;wBAC5D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;4BAChC,OAAO,CAAC,IAAI,CACV,yCAAyC,OAAO,CAAC,EAAE,KAAK,IAAI,IAAI,IAAI,eAAe;gCACjF,oEAAoE,CACvE,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC/B,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;wBACrC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,IAAI,CAAC;gBACH,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAClB,IAAI,WAAW;YAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAClB,IAAI,WAAW;YAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/C,QAAQ,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAE9E,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QACrC,oEAAoE;QACpE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACvD,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAChC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,kFAAkF;IAClF,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACrC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC;IACF,OAAO,EAAE,CAAC;IAEV,uEAAuE;IACvE,WAAW,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,oBAAoB,CAC3B,GAAyB,EACzB,MAAkB,EAClB,IAAY,EACZ,GAAoB;IAEpB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC1C,EAAE,CAAC,KAAK,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CACzB,GAAyB,EACzB,MAAkB,EAClB,IAAY,EACZ,GAAoB;IAEpB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC1C,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClD,MAAM,CAAC,OAAO,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAmB,EACnB,GAAoB,EACpB,IAAY;IAEZ,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAyB,EAAE,MAAkB,EAAE,IAAY,EAAE,EAAE;QACzF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;QAEnE,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,6EAA6E;QAC7E,yEAAyE;QACzE,4EAA4E;QAC5E,+DAA+D;QAC/D,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,WAAW,CAAC,MAAM,EAAE,sBAAsB,MAAM,CAAC,QAAQ,2CAA2C,CAAC,CAAC;gBACtG,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,MAAM,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,8EAA8E;QAC9E,2EAA2E;QAC3E,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,MAAM,EAAE,kBAAkB,MAAM,CAAC,QAAQ,2CAA2C,CAAC,CAAC;YAClG,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,mDAAmD;QACnD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACzE,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACpC,0EAA0E;YAC1E,2EAA2E;YAC3E,yEAAyE;YACzE,kFAAkF;YAClF,IAAI,CAAC,yBAAyB,EAAE;gBAAE,MAAM,2BAA2B,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YAED,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,uBAAuB,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACtD,WAAW,CAAC,OAAO,EAAE,kCAAkC,UAAU,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACrF,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,IAAI,MAAM,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;YAEtE,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,aAAa,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;gBAEjC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBAClB,gBAAgB,CAAC,EAAE,CAAC,CAAC;gBACvB,CAAC,CAAC,CAAC;gBAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBAClB,gBAAgB,CAAC,EAAE,CAAC,CAAC;gBACvB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,yDAAyD;QACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7C,iEAAiE;QACjE,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAEjC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,gEAAgE;QAChE,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;YACjD,iDAAiD;YACjD,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;gBACjG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,oFAAoF;YACpF,aAAa,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACrF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9B,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,CAAC,yBAAyB,EAAE;gBAAE,MAAM,2BAA2B,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YAED,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,uBAAuB,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACtD,WAAW,CAAC,OAAO,EAAE,kCAAkC,UAAU,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACrF,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,4BAA4B;QAC5B,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"tower-websocket.js","sourceRoot":"","sources":["../../../src/agent-farm/servers/tower-websocket.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAmB,SAAS,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEtE,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAa,EAAE,OAAmB,EAAE,GAAyB;IACzG,kFAAkF;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEvF,+CAA+C;IAC/C,gEAAgE;IAChE,4DAA4D;IAC5D,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,CAAC,IAAqB,EAAE,EAAE;YAC9B,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,cAAc,GAAG,kBAAkB,EAAE,CAAC;gBAC/E,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC;IAEF,6EAA6E;IAC7E,IAAI,WAAW,GAA0C,IAAI,CAAC;IAE9D,yDAAyD;IACzD,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAe,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAEhD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,yEAAyE;gBACzE,4EAA4E;gBAC5E,+EAA+E;gBAC/E,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACxD,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACpC,0BAA0B;gBAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;gBAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAc,CAAC;oBACxC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAc,CAAC;oBACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACzD,iFAAiF;wBACjF,mFAAmF;wBACnF,kFAAkF;wBAClF,4DAA4D;wBAC5D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;4BAChC,OAAO,CAAC,IAAI,CACV,yCAAyC,OAAO,CAAC,EAAE,KAAK,IAAI,IAAI,IAAI,eAAe;gCACjF,oEAAoE,CACvE,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC/B,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;wBACrC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,IAAI,CAAC;gBACH,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAClB,IAAI,WAAW;YAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAClB,IAAI,WAAW;YAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/C,QAAQ,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAE9E,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QACrC,oEAAoE;QACpE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACvD,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAChC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,kFAAkF;IAClF,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACrC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC;IACF,OAAO,EAAE,CAAC;IAEV,uEAAuE;IACvE,WAAW,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,oBAAoB,CAC3B,GAAyB,EACzB,MAAkB,EAClB,IAAY,EACZ,GAAoB;IAEpB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC1C,EAAE,CAAC,KAAK,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CACzB,GAAyB,EACzB,MAAkB,EAClB,IAAY,EACZ,GAAoB;IAEpB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC1C,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClD,MAAM,CAAC,OAAO,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAmB,EACnB,GAAoB,EACpB,IAAY;IAEZ,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAyB,EAAE,MAAkB,EAAE,IAAY,EAAE,EAAE;QACzF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;QAEnE,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E;QAC9E,2EAA2E;QAC3E,6EAA6E;QAC7E,uEAAuE;QACvE,4EAA4E;QAC5E,YAAY;QACZ,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,uEAAuE;gBACvE,WAAW,CAAC,MAAM,EAAE,sBAAsB,MAAM,CAAC,QAAQ,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClF,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,MAAM,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,8EAA8E;QAC9E,2EAA2E;QAC3E,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,MAAM,EAAE,kBAAkB,MAAM,CAAC,QAAQ,2CAA2C,CAAC,CAAC;YAClG,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,mDAAmD;QACnD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACzE,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACpC,0EAA0E;YAC1E,2EAA2E;YAC3E,yEAAyE;YACzE,kFAAkF;YAClF,IAAI,CAAC,yBAAyB,EAAE;gBAAE,MAAM,2BAA2B,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YAED,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,uBAAuB,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACtD,WAAW,CAAC,OAAO,EAAE,kCAAkC,UAAU,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACrF,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,IAAI,MAAM,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;YAEtE,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,aAAa,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;gBAEjC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBAClB,gBAAgB,CAAC,EAAE,CAAC,CAAC;gBACvB,CAAC,CAAC,CAAC;gBAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBAClB,gBAAgB,CAAC,EAAE,CAAC,CAAC;gBACvB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,yDAAyD;QACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7C,iEAAiE;QACjE,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAEjC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,gEAAgE;QAChE,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;YACjD,iDAAiD;YACjD,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;gBACjG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,oFAAoF;YACpF,aAAa,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACrF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9B,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,CAAC,yBAAyB,EAAE;gBAAE,MAAM,2BAA2B,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YAED,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,uBAAuB,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACtD,WAAW,CAAC,OAAO,EAAE,kCAAkC,UAAU,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACrF,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,4BAA4B;QAC5B,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/agent-farm/utils/server-utils.d.ts

@@ -89,31 +89,66 @@ export declare function isAllowedHost(hostHeader: string | undefined): boolean;
  * @returns true if the request is authorized
  */
 export declare function isRequestAllowed(req: http.IncomingMessage): boolean;
+/** Name of the forward cookie. Never forwarded to the IDE server. */
+export declare const IDE_FORWARD_COOKIE = "codev-ide-session";
+/**
+ * The forward cookie's expected value: `HMAC-SHA256(localKey, purpose)`, hex.
+ * Derived from `getExpectedKey()` on EVERY call (never cached at module load),
+ * so the `CODEV_TOWER_KEY` override and `resetExpectedKeyCache()` are honoured
+ * and rotating the local key revokes every cookie. That rotation is the only
+ * revocation. The value cannot be inverted to the key, so it never grants
+ * Tower's API routes. Returns null (fail closed) when the key is unavailable.
+ */
+export declare function ideForwardCookieValue(): string | null;
+/** The `Set-Cookie` value `POST /api/ide/session` returns, or null when the key is unavailable. */
+export declare function ideForwardSetCookie(): string | null;
+/**
+ * Read one cookie's value from a `Cookie` header (string or string[] shape), or
+ * null if absent. Exact-name match: `codev-ide-session2` is not `codev-ide-session`.
+ */
+export declare function cookieValue(header: string | string[] | undefined, name: string): string | null;
+/**
+ * Cross-port guard for the forward cookie (Issue #1869). A cookie-authorized
+ * request may proceed only when it is not initiated by another origin:
+ * - `Origin`, if present, must be this request's own origin
+ *   (`http(s)://<Host>`) or an exact `CODEV_TOWER_ALLOWED_ORIGINS` entry;
+ * - `Sec-Fetch-Site`, if present, must be `same-origin` or `none`
+ *   (`same-site` is exactly the other-localhost-port case and is refused).
+ * A request with neither header passes: top-level navigations and same-origin
+ * asset GETs may omit them, while browsers always send `Origin` on WebSocket
+ * upgrades and cross-origin fetches, which is the set this must refuse.
+ * Applied ONLY to the cookie branch; the key-header branch never calls it.
+ */
+export declare function isSameOriginForwardRequest(req: http.IncomingMessage): boolean;
+/** Outcome of the forward authorization decision, with a log-safe reason on refusal. */
+export type ForwardAuthDecision = {
+    allowed: true;
+    via: 'header' | 'cookie';
+} | {
+    allowed: false;
+    reason: string;
+};
 /**
  * Security: decide whether a request may proceed to the IDE prefix forward
- * (Issue #1668). This is the ONE authorization seam for the forward — both the
- * HTTP path (which also passes the general `isRequestAllowed` choke point) and
- * the WebSocket upgrade call it.
+ * (Issue #1668). This is the ONE authorization seam for the forward: the HTTP
+ * path (`isRequestAllowed` delegates every `/ide*` path here) and the WebSocket
+ * upgrade both call it.
  *
- * It reuses the exact primitives the HTTP choke point uses: the Host guard plus
- * a constant-time match of the shared local key from the `codev-tower-key`
- * header. That header is what `TunnelClient.stampLocalHeaders` stamps on every
- * tunnel-borne request (HTTP and WS-CONNECT alike, #1588), so a browser
- * arriving via the cloud proxy authenticates here without offering the WS
- * subprotocol key that the dashboard's `isWebSocketAllowed` requires (the IDE
- * workbench's own WebSockets are vanilla `?reconnectionToken=` connections that
- * offer no subprotocol).
+ * Fixed order:
+ * 1. Host guard (DNS rebinding).
+ * 2. Key header (`codev-tower-key` / legacy `codev-web-key`), constant-time.
+ *    This is what `TunnelClient.stampLocalHeaders` stamps on every tunnel-borne
+ *    request (#1588), so the cloud path authorizes here, with no origin check
+ *    (a cloud browser's `Origin` is the cloud host, never Tower's).
+ * 3. Forward cookie (Issue #1869), constant-time, AND the cross-port guard.
  *
  * There is deliberately NO per-folder logic: the IDE server offers no per-folder
- * isolation — any authenticated connection can open any path its OS user can
- * read (same trust as a terminal) — so authorization is a whole-boundary key +
- * Host decision and nothing finer (Issue #1668 §D2).
- *
- * This function is the swap point for #1589 (per-session remote credential): its
- * body can move from the local-key stamp to a per-session credential without
- * touching the proxying code, which calls it and only then strips/stamps headers.
- * Fails closed when the expected key is unavailable.
+ * isolation, so authorization is a whole-boundary decision (Issue #1668 §D2).
+ * This is the swap point for #1589 (per-session remote credential). Fails closed
+ * when the expected key is unavailable. Reasons never contain credential values.
  */
+export declare function decideForwardAuthorization(req: http.IncomingMessage): ForwardAuthDecision;
+/** Boolean form of `decideForwardAuthorization`. */
 export declare function isForwardAuthorized(req: http.IncomingMessage): boolean;
 /**
  * The subprotocol the server echoes back on a terminal WebSocket handshake:

package/dist/agent-farm/utils/server-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-utils.d.ts","sourceRoot":"","sources":["../../../src/agent-farm/utils/server-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAKvC;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAO9C;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB1F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyBhH;AAsBD;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAS9C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKtE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CA2CvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAWvD;AAwCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CASrE;AAmBD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAsBnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAUtE;AAqBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,KAAK,CAExE;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAUrE;AACD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiCjD"}
+{"version":3,"file":"server-utils.d.ts","sourceRoot":"","sources":["../../../src/agent-farm/utils/server-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAMvC;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAO9C;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB1F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyBhH;AAsBD;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAS9C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKtE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CA2CvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAWvD;AAwCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CASrE;AAmBD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CA0BnE;AAqBD,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAQtD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAIrD;AAED,mGAAmG;AACnG,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAMnD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW9F;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAa7E;AAED,wFAAwF;AACxF,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAAE,GAC3C;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,mBAAmB,CAqBzF;AAED,oDAAoD;AACpD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAEtE;AAqBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,KAAK,CAExE;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAUrE;AACD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiCjD"}

package/dist/agent-farm/utils/server-utils.js

@@ -3,9 +3,10 @@
  * Extracted from tower-server.ts and open-server.ts
  * to eliminate code duplication (Maintenance Run 0004)
  */
-import { timingSafeEqual } from 'node:crypto';
+import { createHmac, timingSafeEqual } from 'node:crypto';
 import { ensureLocalKey } from '@cluesmith/codev-core/auth';
 import { TOWER_KEY_HEADER, LEGACY_WEB_KEY_HEADER, WS_MARKER_PROTOCOL, WS_KEY_PROTOCOL_PREFIX } from '@cluesmith/codev-types';
+import { matchIdePrefix } from '../lib/ide-prefix.js';
 /**
  * HTML-escape a string to prevent XSS
  */
@@ -311,6 +312,10 @@ export function isRequestAllowed(req) {
     catch {
         return false;
     }
+    // The IDE forward has its own seam, which also accepts the header-free
+    // forward cookie (Issue #1869). Every other route stays header-only.
+    if (matchIdePrefix(pathname))
+        return isForwardAuthorized(req);
     if (isPublicRoute(method, pathname))
         return true;
     const expected = getExpectedKey();
@@ -321,41 +326,153 @@ export function isRequestAllowed(req) {
         return false;
     return keysMatch(presented, expected);
 }
+// ============================================================================
+// IDE forward credential (Issue #1869)
+// ============================================================================
+//
+// A browser navigation to `/ide/`, the workbench's asset loads, and its
+// `?reconnectionToken=` WebSockets cannot attach the key header, so a loopback
+// browser gets a header-free credential for the `/ide` prefix: an HttpOnly,
+// SameSite=Strict, Path=/ide cookie minted by the key-gated
+// `POST /api/ide/session`.
+//
+// TRUST: this is a full-trust credential for this machine, scoped by ROUTE, not
+// by capability. `/ide/*` is the whole workbench (terminals, files), so holding
+// the cookie means running commands as the OS user. Treat it like the key.
+//
+// It is the first AMBIENT credential Tower accepts (the browser attaches it, not
+// key-holding script), so the cookie branch carries a cross-port guard: ports
+// are not part of a cookie "site", and any other localhost page could otherwise
+// open a cookie-bearing WebSocket into the workbench (CORS does not apply).
+/** Name of the forward cookie. Never forwarded to the IDE server. */
+export const IDE_FORWARD_COOKIE = 'codev-ide-session';
+/**
+ * Versioned purpose string for the derivation. Bumping the version invalidates
+ * every outstanding cookie without rotating the local key.
+ */
+const IDE_FORWARD_COOKIE_PURPOSE = 'codev-ide-forward/v1';
+/**
+ * The forward cookie's expected value: `HMAC-SHA256(localKey, purpose)`, hex.
+ * Derived from `getExpectedKey()` on EVERY call (never cached at module load),
+ * so the `CODEV_TOWER_KEY` override and `resetExpectedKeyCache()` are honoured
+ * and rotating the local key revokes every cookie. That rotation is the only
+ * revocation. The value cannot be inverted to the key, so it never grants
+ * Tower's API routes. Returns null (fail closed) when the key is unavailable.
+ */
+export function ideForwardCookieValue() {
+    const key = getExpectedKey();
+    if (!key)
+        return null;
+    return createHmac('sha256', key).update(IDE_FORWARD_COOKIE_PURPOSE).digest('hex');
+}
+/** The `Set-Cookie` value `POST /api/ide/session` returns, or null when the key is unavailable. */
+export function ideForwardSetCookie() {
+    const value = ideForwardCookieValue();
+    if (!value)
+        return null;
+    // No `Secure`: loopback is plain HTTP. No `Max-Age`: a browser-session cookie.
+    // `__Host-` is not usable: it forces `Path=/`, which would widen the scope.
+    return `${IDE_FORWARD_COOKIE}=${value}; Path=/ide; HttpOnly; SameSite=Strict`;
+}
+/**
+ * Read one cookie's value from a `Cookie` header (string or string[] shape), or
+ * null if absent. Exact-name match: `codev-ide-session2` is not `codev-ide-session`.
+ */
+export function cookieValue(header, name) {
+    if (header === undefined)
+        return null;
+    const joined = Array.isArray(header) ? header.join('; ') : header;
+    for (const pair of joined.split(';')) {
+        const eq = pair.indexOf('=');
+        if (eq < 0)
+            continue;
+        if (pair.slice(0, eq).trim() !== name)
+            continue;
+        const value = pair.slice(eq + 1).trim();
+        if (value.length > 0)
+            return value;
+    }
+    return null;
+}
+/** True if `origin` is exactly an entry of `CODEV_TOWER_ALLOWED_ORIGINS`. */
+function isConfiguredOrigin(origin) {
+    const configured = process.env.CODEV_TOWER_ALLOWED_ORIGINS;
+    if (!configured)
+        return false;
+    for (const allowed of configured.split(',')) {
+        if (allowed.trim() === origin)
+            return true;
+    }
+    return false;
+}
+/**
+ * Cross-port guard for the forward cookie (Issue #1869). A cookie-authorized
+ * request may proceed only when it is not initiated by another origin:
+ * - `Origin`, if present, must be this request's own origin
+ *   (`http(s)://<Host>`) or an exact `CODEV_TOWER_ALLOWED_ORIGINS` entry;
+ * - `Sec-Fetch-Site`, if present, must be `same-origin` or `none`
+ *   (`same-site` is exactly the other-localhost-port case and is refused).
+ * A request with neither header passes: top-level navigations and same-origin
+ * asset GETs may omit them, while browsers always send `Origin` on WebSocket
+ * upgrades and cross-origin fetches, which is the set this must refuse.
+ * Applied ONLY to the cookie branch; the key-header branch never calls it.
+ */
+export function isSameOriginForwardRequest(req) {
+    const origin = headerValue(req.headers.origin);
+    if (origin !== null) {
+        const host = (req.headers.host ?? '').trim().toLowerCase();
+        const lowered = origin.toLowerCase();
+        const ownOrigin = host.length > 0 && (lowered === `http://${host}` || lowered === `https://${host}`);
+        if (!ownOrigin && !isConfiguredOrigin(origin))
+            return false;
+    }
+    const fetchSite = headerValue(req.headers['sec-fetch-site']);
+    if (fetchSite !== null && fetchSite !== 'same-origin' && fetchSite !== 'none')
+        return false;
+    return true;
+}
 /**
  * Security: decide whether a request may proceed to the IDE prefix forward
- * (Issue #1668). This is the ONE authorization seam for the forward — both the
- * HTTP path (which also passes the general `isRequestAllowed` choke point) and
- * the WebSocket upgrade call it.
+ * (Issue #1668). This is the ONE authorization seam for the forward: the HTTP
+ * path (`isRequestAllowed` delegates every `/ide*` path here) and the WebSocket
+ * upgrade both call it.
  *
- * It reuses the exact primitives the HTTP choke point uses: the Host guard plus
- * a constant-time match of the shared local key from the `codev-tower-key`
- * header. That header is what `TunnelClient.stampLocalHeaders` stamps on every
- * tunnel-borne request (HTTP and WS-CONNECT alike, #1588), so a browser
- * arriving via the cloud proxy authenticates here without offering the WS
- * subprotocol key that the dashboard's `isWebSocketAllowed` requires (the IDE
- * workbench's own WebSockets are vanilla `?reconnectionToken=` connections that
- * offer no subprotocol).
+ * Fixed order:
+ * 1. Host guard (DNS rebinding).
+ * 2. Key header (`codev-tower-key` / legacy `codev-web-key`), constant-time.
+ *    This is what `TunnelClient.stampLocalHeaders` stamps on every tunnel-borne
+ *    request (#1588), so the cloud path authorizes here, with no origin check
+ *    (a cloud browser's `Origin` is the cloud host, never Tower's).
+ * 3. Forward cookie (Issue #1869), constant-time, AND the cross-port guard.
  *
  * There is deliberately NO per-folder logic: the IDE server offers no per-folder
- * isolation — any authenticated connection can open any path its OS user can
- * read (same trust as a terminal) — so authorization is a whole-boundary key +
- * Host decision and nothing finer (Issue #1668 §D2).
- *
- * This function is the swap point for #1589 (per-session remote credential): its
- * body can move from the local-key stamp to a per-session credential without
- * touching the proxying code, which calls it and only then strips/stamps headers.
- * Fails closed when the expected key is unavailable.
+ * isolation, so authorization is a whole-boundary decision (Issue #1668 §D2).
+ * This is the swap point for #1589 (per-session remote credential). Fails closed
+ * when the expected key is unavailable. Reasons never contain credential values.
  */
-export function isForwardAuthorized(req) {
-    if (!isAllowedHost(req.headers.host))
-        return false;
+export function decideForwardAuthorization(req) {
+    if (!isAllowedHost(req.headers.host)) {
+        return { allowed: false, reason: `disallowed Host "${req.headers.host ?? ''}"` };
+    }
     const expected = getExpectedKey();
     if (!expected)
-        return false;
+        return { allowed: false, reason: 'local key unavailable' };
     const presented = presentedHttpKey(req);
-    if (!presented)
-        return false;
-    return keysMatch(presented, expected);
+    if (presented && keysMatch(presented, expected))
+        return { allowed: true, via: 'header' };
+    const expectedCookie = ideForwardCookieValue();
+    const presentedCookie = cookieValue(req.headers.cookie, IDE_FORWARD_COOKIE);
+    if (expectedCookie && presentedCookie && keysMatch(presentedCookie, expectedCookie)) {
+        if (!isSameOriginForwardRequest(req)) {
+            return { allowed: false, reason: 'forward cookie refused: cross-origin request' };
+        }
+        return { allowed: true, via: 'cookie' };
+    }
+    return { allowed: false, reason: 'missing or invalid credential' };
+}
+/** Boolean form of `decideForwardAuthorization`. */
+export function isForwardAuthorized(req) {
+    return decideForwardAuthorization(req).allowed;
 }
 /**
  * Extract the presented key from a WebSocket upgrade's `Sec-WebSocket-Protocol`

package/dist/agent-farm/utils/server-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-utils.js","sourceRoot":"","sources":["../../../src/agent-farm/utils/server-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAE7H;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAyB,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI;IACvE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAyB,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI;IAC5E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,IAAI,GAAG,CAAC,CAAC;QAEb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,wDAAwD;AACxD,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,oCAAoC;AAEpC,kFAAkF;AAClF,4DAA4D;AAE5D;;;;GAIG;AACH,IAAI,iBAA4C,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,iBAAiB,GAAG,cAAc,EAAE,IAAI,IAAI,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,iBAAiB,GAAG,SAAS,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,QAAgB;IAC3D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,QAAgB;IAC5D,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAEnC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,QAAQ,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhE,sEAAsE;IACtE,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,QAAQ,KAAK,8BAA8B;QAAE,OAAO,IAAI,CAAC;IAE7D,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAExC,sEAAsE;QACtE,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACpE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,OAAO,WAAW,KAAK,EAAE,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,OAAO,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC3D,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iEAAiE;AACjE,SAAS,UAAU,CAAC,UAAkB;IACpC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,OAAO;IAClE,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,uCAAuC;AACxE,CAAC;AAED,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC3D,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,aAAa,CAAC,UAA8B;IAC1D,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAEtD,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5F,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,SAAS,WAAW,CAAC,GAAkC;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAyB;IACjD,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAyB;IACxD,gFAAgF;IAChF,+DAA+D;IAC/D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,IAAI,QAAQ,GAAG,GAAG,CAAC;IACnB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,OAAO,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAyB;IAC3D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,OAAO,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAyB;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;SACvD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAoB;IACtD,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAyB;IAC1D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,OAAO,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AACD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,wBAAwB;YACtB,4DAA4D;YAC5D,+BAA+B,CAClC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAEtB,wBAAwB;IACxB,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0BAA0B;IAC1B,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,KAAK,CACb,sBAAsB,CAAC,KAAK;QAC1B,4DAA4D;QAC5D,+BAA+B,CAClC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"server-utils.js","sourceRoot":"","sources":["../../../src/agent-farm/utils/server-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAyB,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI;IACvE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAyB,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI;IAC5E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,IAAI,GAAG,CAAC,CAAC;QAEb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,wDAAwD;AACxD,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,oCAAoC;AAEpC,kFAAkF;AAClF,4DAA4D;AAE5D;;;;GAIG;AACH,IAAI,iBAA4C,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,iBAAiB,GAAG,cAAc,EAAE,IAAI,IAAI,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,iBAAiB,GAAG,SAAS,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,QAAgB;IAC3D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,QAAgB;IAC5D,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAEnC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,QAAQ,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhE,sEAAsE;IACtE,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,QAAQ,KAAK,8BAA8B;QAAE,OAAO,IAAI,CAAC;IAE7D,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAExC,sEAAsE;QACtE,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACpE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,OAAO,WAAW,KAAK,EAAE,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,OAAO,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC3D,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iEAAiE;AACjE,SAAS,UAAU,CAAC,UAAkB;IACpC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,OAAO;IAClE,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,uCAAuC;AACxE,CAAC;AAED,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC3D,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,aAAa,CAAC,UAA8B;IAC1D,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAEtD,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5F,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,SAAS,WAAW,CAAC,GAAkC;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAyB;IACjD,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAyB;IACxD,gFAAgF;IAChF,+DAA+D;IAC/D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,IAAI,QAAQ,GAAG,GAAG,CAAC;IACnB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAE9D,IAAI,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,OAAO,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,+EAA+E;AAC/E,uCAAuC;AACvC,+EAA+E;AAC/E,EAAE;AACF,wEAAwE;AACxE,+EAA+E;AAC/E,4EAA4E;AAC5E,4DAA4D;AAC5D,2BAA2B;AAC3B,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,4EAA4E;AAE5E,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD;;;GAGG;AACH,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,+EAA+E;IAC/E,4EAA4E;IAC5E,OAAO,GAAG,kBAAkB,IAAI,KAAK,wCAAwC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAqC,EAAE,IAAY;IAC7E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAClE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC3D,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAyB;IAClE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,IAAI,EAAE,IAAI,OAAO,KAAK,WAAW,IAAI,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,SAAS,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC7D,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAE5F,OAAO,IAAI,CAAC;AACd,CAAC;AAOD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAyB;IAClE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC;IACnF,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAE1E,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAEzF,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAC/C,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC5E,IAAI,cAAc,IAAI,eAAe,IAAI,SAAS,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,CAAC;QACpF,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;AACrE,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,mBAAmB,CAAC,GAAyB;IAC3D,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAyB;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;SACvD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAoB;IACtD,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAyB;IAC1D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,OAAO,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AACD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,wBAAwB;YACtB,4DAA4D;YAC5D,+BAA+B,CAClC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAEtB,wBAAwB;IACxB,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0BAA0B;IAC1B,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,KAAK,CACb,sBAAsB,CAAC,KAAK;QAC1B,4DAA4D;QAC5D,+BAA+B,CAClC,CAAC;AACJ,CAAC"}

package/ide-extension/manifest.json

@@ -1,6 +1,6 @@
 {
   "id": "cluesmith.codev-vscode",
-  "version": "3.3.6",
+  "version": "3.3.7",
   "engines": {
     "vscode": "^1.128.0"
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cluesmith/codev",
-  "version": "3.3.6",
+  "version": "3.3.7",
   "description": "Codev CLI - AI-assisted software development framework",
   "type": "module",
   "bin": {
@@ -36,9 +36,9 @@
     "open": "^10.1.0",
     "tree-kill": "^1.2.2",
     "ws": "^8.18.0",
-    "@cluesmith/codev-core": "3.3.6",
-    "@cluesmith/codev-sdk": "3.3.6",
-    "@cluesmith/codev-types": "3.3.6"
+    "@cluesmith/codev-core": "3.3.7",
+    "@cluesmith/codev-sdk": "3.3.7",
+    "@cluesmith/codev-types": "3.3.7"
   },
   "devDependencies": {
     "@playwright/test": "^1.58.0",

package/skeleton/resources/commands/agent-farm.md

@@ -788,9 +788,36 @@ afx tower status [options]
 ### afx ide
 
 Manage the Codev IDE server: a Codev-branded VS Code server-web build that Tower spawns, owns,
-and forwards at the `/ide/` prefix. One server serves any folder; open a workspace at
-`http://localhost:4100/ide/?folder=<absolute path>`. These commands drive Tower's local-only
-`/api/ide` endpoint, so Tower must be running.
+and forwards at the `/ide/` prefix. One server serves any folder. These commands drive Tower's
+local-only `/api/ide` endpoint, so Tower must be running.
+
+**Opening the IDE locally:** on the Tower dashboard (`http://localhost:4100/`), each running
+workspace card shows an **IDE** row first, with an **Open IDE** link, once an IDE server is
+recorded (`afx ide start`). It opens the workbench for that workspace, with the Codev sidebar, in a new tab
+at `http://localhost:4100/ide/?folder=<absolute path>`. No Codev Cloud session or hand-built URL
+is needed. The link sets a browser-session cookie scoped to `/ide`, so after the first click that
+browser can also open or reload `http://localhost:4100/ide/?folder=<absolute path>` directly. A
+browser that has not used the link gets `401` there. Use the same host the dashboard is on: a
+cookie set on `localhost` is not sent to `127.0.0.1`.
+
+**Trust notes for the `/ide` session cookie:**
+- It is a **full-trust credential for this machine**, scoped by route, not by capability: the
+  workbench it opens has terminals and file access. Treat it like the Tower key.
+- Only a page that already holds the Tower key can get one (`POST /api/ide/session` requires the
+  key header and is blocked over the cloud tunnel). Tower accepts it only under `/ide`, refuses it
+  on requests initiated by another origin (including other `localhost` ports), and never forwards
+  it to the IDE server, which still requires its own connection token.
+- Revocation is rotating the local key (delete `~/.agent-farm/local-key` and restart Tower, or
+  change `CODEV_TOWER_KEY`); every keyed client re-keys. There is no finer revocation.
+- Never build a `?tkn=` URL by hand (for example `http://127.0.0.1:8200/ide/?tkn=…`): it puts the
+  IDE server's own token in the browser's cookie jar for 7 days, for every `localhost` port,
+  and the IDE server does no Origin check on it. Use the Open IDE link; Tower hands the
+  workbench its token without a cookie, replaces any stale browser copy, and issues a fresh
+  token every time it starts the IDE server.
+- Tower's loopback trust boundary is the single-user machine; on a multi-user host another local
+  user can reach Tower's listener and, via the `/ide` session cookie, can collect and replay this
+  machine's IDE credential if you browse to their localhost port under `/ide`. Do not use the Open
+  IDE path on shared hosts.
 
 **Install:** `npm i -g @cluesmith/codev @cluesmith/codev-ide` (or `afx ide install` for the
 second package). `@cluesmith/codev` carries the Codev sidebar extension; `@cluesmith/codev-ide`
@@ -874,7 +901,7 @@ show `unknown` for the version and extensions fields.
 **Files:**
 - `~/.agent-farm/ide-server.json` - Tower's record of the running server
 - `~/.agent-farm/ide-extensions/` - Tower-owned extensions directory (mode 0700)
-- `~/.agent-farm/ide-connection-token` - Token guarding direct access to the server port
+- `~/.agent-farm/ide-connection-token` - Token guarding direct access to the server port (regenerated on every IDE server start)
 
 ---