@integsec/agentic-pentest-proxy 0.3.8 → 0.3.9

package/cloudflare/wrangler.jsonc

@@ -10,7 +10,7 @@
   "containers": [
     {
       "class_name": "PentestGatewayContainer",
-      "image": "docker.io/integsec/agentic-pentest-mcp-proxy:0.3.8",
+      "image": "docker.io/integsec/agentic-pentest-mcp-proxy:0.3.9",
       "instance_type": "basic",
       "max_instances": 1
     }

package/dist/bin/integsec-agentic-pentest-bridge.js

@@ -12,9 +12,9 @@ const url = new URL(process.argv[2] ?? process.env.GATEWAY_URL ?? "http://127.0.
 if (!["127.0.0.1", "localhost", "[::1]"].includes(url.hostname) || url.protocol !== "http:") {
     throw new Error("The local bridge only accepts a loopback HTTP gateway URL");
 }
-const upstream = new Client({ name: "agentic-pentest-bridge", version: "0.3.8" });
+const upstream = new Client({ name: "agentic-pentest-bridge", version: "0.3.9" });
 await upstream.connect(new StreamableHTTPClientTransport(url));
-const bridge = new Server({ name: "agentic-pentest-local", version: "0.3.8" }, { capabilities: { tools: {} } });
+const bridge = new Server({ name: "agentic-pentest-local", version: "0.3.9" }, { capabilities: { tools: {} } });
 bridge.setRequestHandler(ListToolsRequestSchema, async (request) => upstream.listTools(request.params));
 bridge.setRequestHandler(CallToolRequestSchema, async (request) => upstream.callTool(request.params));
 await bridge.connect(new StdioServerTransport());

package/dist/bin/integsec-agentic-pentest-scanners-mcp.js

@@ -21,7 +21,7 @@ const tool = mode === "nmap" ? {
             url: { type: "string", description: "One authorized HTTP or HTTPS URL." },
         }, required: ["url"], additionalProperties: false },
 };
-const server = new Server({ name: `integsec-${mode}-mcp`, version: "0.3.8" }, { capabilities: { tools: {} } });
+const server = new Server({ name: `integsec-${mode}-mcp`, version: "0.3.9" }, { capabilities: { tools: {} } });
 server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [tool] }));
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
     if (request.params.name !== tool.name)

package/dist/src/config.js

@@ -50,7 +50,7 @@ export function loadConfig() {
         techniqueMapPath: process.env.TECHNIQUE_MAP_PATH,
         dnsCacheTtl: parseInt(process.env.DNS_CACHE_TTL || "60", 10),
         logLevel: process.env.LOG_LEVEL || "INFO",
-        proxyVersion: process.env.PROXY_VERSION || "0.3.8",
+        proxyVersion: process.env.PROXY_VERSION || "0.3.9",
     };
 }
 //# sourceMappingURL=config.js.map

package/dist/src/gateway/admin.js

@@ -9,6 +9,44 @@ let editing = null;
 let viewingScopeId = null;
 let dirty = false;
 let bootstrapAdmins = new Set();
+let upstreamStatuses = {};
+const osNames = { windows: 'Windows', macos: 'macOS', linux: 'Linux (Debian/Ubuntu)' };
+const platform = navigator.userAgentData?.platform || navigator.platform || navigator.userAgent || '';
+const detectedOS = /win/i.test(platform) ? 'windows' : /mac/i.test(platform) ? 'macos' : 'linux';
+let selectedOS = localStorage.getItem('gateway-docs-os');
+if (!osNames[selectedOS]) selectedOS = detectedOS;
+const installHelp = {
+  burp: {
+    windows: { command: "Start-Process 'https://portswigger.net/burp/releases'", note: 'Open the official installer, then enable MCP inside Burp.' },
+    macos: { command: "open 'https://portswigger.net/burp/releases'", note: 'Open the official installer, then enable MCP inside Burp.' },
+    linux: { command: "xdg-open 'https://portswigger.net/burp/releases'", note: 'Open the official installer, then enable MCP inside Burp.' },
+  },
+  semgrep: {
+    windows: { command: 'py -m pip install --user semgrep\nsemgrep --version', note: 'Requires Python and pip; confirm the Scripts folder is on PATH.' },
+    macos: { command: 'brew install semgrep\nsemgrep --version', note: 'Requires Homebrew.' },
+    linux: { command: 'pipx install semgrep\nsemgrep --version', note: 'Requires pipx; install it through your distribution first.' },
+  },
+  trivy: {
+    windows: { command: "Start-Process 'https://github.com/aquasecurity/trivy/releases/latest'", note: 'Install the official Windows archive, put trivy on PATH, then run trivy plugin install mcp.' },
+    macos: { command: 'brew install trivy\ntrivy plugin install mcp\ntrivy --version', note: 'Requires Homebrew.' },
+    linux: { command: "sudo apt-get update\nsudo apt-get install -y wget gnupg\nwget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null\necho 'deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main' | sudo tee /etc/apt/sources.list.d/trivy.list\nsudo apt-get update\nsudo apt-get install -y trivy\ntrivy plugin install mcp\ntrivy --version", note: 'Debian and Ubuntu. For other distributions, follow the official Trivy install guide.' },
+  },
+  nmap: {
+    windows: { command: "Start-Process 'https://nmap.org/download.html'", note: 'Run the official Windows installer. The MCP adapter is already in the gateway package.' },
+    macos: { command: "open 'https://nmap.org/download.html'", note: 'Run the official macOS installer. The MCP adapter is already in the gateway package.' },
+    linux: { command: 'sudo apt-get update\nsudo apt-get install nmap\nnmap --version', note: 'Debian and Ubuntu. Other distributions: use the official Nmap download page.' },
+  },
+  nuclei: {
+    windows: { command: 'go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest\nnuclei -version', note: 'Requires Go; add the Go bin folder to PATH. The MCP adapter is in the gateway package.' },
+    macos: { command: 'brew install nuclei\nnuclei -version', note: 'Requires Homebrew. The MCP adapter is in the gateway package.' },
+    linux: { command: 'go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest\nnuclei -version', note: 'Requires Go; add the Go bin folder to PATH. The MCP adapter is in the gateway package.' },
+  },
+  snyk: {
+    windows: { command: 'npm install -g snyk\nsnyk auth', note: 'Requires Node.js and a Snyk account.' },
+    macos: { command: 'npm install -g snyk\nsnyk auth', note: 'Requires Node.js and a Snyk account.' },
+    linux: { command: 'npm install -g snyk\nsnyk auth', note: 'Requires Node.js and a Snyk account.' },
+  },
+};
 const techniques = [
   ['recon', 'Reconnaissance and discovery'], ['web_app', 'Web and API testing'],
   ['exploitation', 'Exploitation'], ['cloud_audit', 'Cloud assessment'],
@@ -16,12 +54,12 @@ const techniques = [
   ['social_engineering', 'Social engineering'],
 ];
 const presets = [
-  { name: 'burp', label: 'Burp Suite', transport: 'sse', url: 'http://127.0.0.1:9876', local: true, source: 'https://github.com/PortSwigger/mcp-server', note: 'Enable the official MCP extension inside the tester’s local Burp.' },
-  { name: 'semgrep', label: 'Semgrep', transport: 'stdio', command: 'semgrep', args: ['mcp'], local: true, source: 'https://github.com/semgrep/semgrep', note: 'Install and configure the official Semgrep CLI first.' },
-  { name: 'trivy', label: 'Trivy', transport: 'stdio', command: 'trivy', args: ['mcp'], local: true, source: 'https://github.com/aquasecurity/trivy-mcp', note: 'Install Trivy and its official MCP plugin first; pin and review your version.' },
-  { name: 'nmap', label: 'Nmap', transport: 'stdio', command: 'integsec-agentic-pentest-scanners-mcp', args: ['nmap'], local: true, source: 'https://nmap.org/book/man.html', note: 'Install Nmap locally first. The bundled MCP adapter offers one-host, rate-limited TCP scans.' },
-  { name: 'nuclei', label: 'Nuclei', transport: 'stdio', command: 'integsec-agentic-pentest-scanners-mcp', args: ['nuclei'], local: true, source: 'https://github.com/projectdiscovery/nuclei', note: 'Install ProjectDiscovery Nuclei locally first. The bundled MCP adapter limits HTTP scans and disables OAST.' },
-  { name: 'snyk', label: 'Snyk', transport: 'stdio', command: 'snyk', args: ['mcp', '-t', 'stdio'], local: true, source: 'https://github.com/snyk/studio-mcp', note: 'Install the Snyk CLI and authenticate locally first.' },
+  { name: 'burp', label: 'Burp Suite', transport: 'sse', url: 'http://127.0.0.1:9876', local: true, source: 'https://portswigger.net/bappstore/9952290f04ed4f628e624d0aa9dccebc', note: 'Enable the official MCP extension inside the tester’s local Burp.' },
+  { name: 'semgrep', label: 'Semgrep', transport: 'stdio', command: 'semgrep', args: ['mcp'], local: true, source: 'https://semgrep.dev/products/community-edition/', note: 'Install and configure the official Semgrep CLI first.' },
+  { name: 'trivy', label: 'Trivy', transport: 'stdio', command: 'trivy', args: ['mcp'], local: true, source: 'https://github.com/aquasecurity/trivy-mcp/blob/main/docs/quickstart.md', note: 'Install Trivy and its official MCP plugin first; pin and review your version.' },
+  { name: 'nmap', label: 'Nmap', transport: 'stdio', command: 'integsec-agentic-pentest-scanners-mcp', args: ['nmap'], local: true, source: 'https://nmap.org/download.html', note: 'Install Nmap locally first. The bundled MCP adapter offers one-host, rate-limited TCP scans.' },
+  { name: 'nuclei', label: 'Nuclei', transport: 'stdio', command: 'integsec-agentic-pentest-scanners-mcp', args: ['nuclei'], local: true, source: 'https://docs.projectdiscovery.io/opensource/nuclei/install', note: 'Install ProjectDiscovery Nuclei locally first. The bundled MCP adapter limits HTTP scans and disables OAST.' },
+  { name: 'snyk', label: 'Snyk', transport: 'stdio', command: 'snyk', args: ['mcp', '-t', 'stdio'], local: true, source: 'https://docs.snyk.io/developer-tools/snyk-cli/install-the-snyk-cli', note: 'Install the Snyk CLI and authenticate locally first.' },
   { label: 'OWASP ZAP', source: 'https://www.zaproxy.org/docs/desktop/addons/mcp-integration/mcp-options/', note: 'Reference only: its MCP security key needs authenticated upstream support.' },
   { label: 'PortSwigger DAST', source: 'https://portswigger.net/burp/documentation/dast/user-guide/using-ai/mcp-server', note: 'Reference only: its hosted MCP endpoint requires an API key.' },
   { label: 'Prowler Cloud', source: 'https://prowler.com/prowler-cloud', note: 'Reference only: its hosted MCP endpoint requires an API key.' },
@@ -56,6 +94,7 @@ function configureServerUI() {
     : 'Use the command or URL from the MCP server’s own setup instructions. Adding an entry does not install the tool.';
   $('hosted-server-choice').hidden = !hosted;
   $('local-presets').hidden = hosted;
+  $('command-panel').hidden = hosted;
   $('local-setup').hidden = !hosted;
   $('add-server-panel').hidden = hosted;
   if (hosted) chooseServerPath('local');
@@ -84,12 +123,60 @@ localPathInput.id = 'local-paths';
 localPathInput.placeholder = 'Absolute folder path containing authorized source code';
 localPathField.append(localPathInput);
 $('hosts').closest('label').after(localPathField);
+const allLocalLabel = document.createElement('label'); allLocalLabel.style.cssText = 'display:flex;align-items:center;gap:8px';
+const allLocalInput = document.createElement('input'); allLocalInput.type = 'checkbox'; allLocalInput.id = 'all-local-paths';
+allLocalLabel.append(allLocalInput, document.createTextNode('Allow all local code paths (explicit administrator approval; may expose unrelated files)'));
+localPathField.after(allLocalLabel);
+allLocalInput.onchange = () => { localPathInput.disabled = allLocalInput.checked; };
 const make = (tag, value) => { const node = document.createElement(tag); node.textContent = value; return node; };
+const osBar = make('div', ''); osBar.className = 'help'; osBar.style.cssText = 'margin:0;padding:10px 5vw;display:flex;align-items:center;gap:12px;flex-wrap:wrap';
+const osLabel = make('label', 'Install commands for '); osLabel.style.cssText = 'display:flex;align-items:center;gap:8px';
+const osChoice = document.createElement('select'); osChoice.id = 'docs-os'; osChoice.style.cssText = 'width:auto;margin:0';
+for (const [value, label] of Object.entries(osNames)) { const option = make('option', label); option.value = value; osChoice.append(option); }
+osChoice.value = selectedOS; osLabel.append(osChoice); osBar.append(osLabel, make('span', 'Choose the tester’s operating system. The browser picked a starting value.'));
+document.querySelector('header').after(osBar);
+const toolStyles = document.createElement('style');
+toolStyles.textContent = '#upstreams-card{grid-column:1/-1}#presets,#local-tool-guide-items{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:14px;margin-top:12px}#presets .row,#local-tool-guide-items .row{display:block;border:1px solid #294454;border-radius:9px;padding:14px}#presets .row>*:first-child,#local-tool-guide-items .row>*:first-child{min-width:0}#presets pre,#local-tool-guide-items pre{font-size:13px}';
+document.head.append(toolStyles);
+const localGuide = make('section', ''); localGuide.id = 'local-tool-guide'; localGuide.className = 'card wide'; localGuide.hidden = true;
+localGuide.append(make('h2', 'Local MCP tools'), make('p', 'Install these on the tester’s computer, then add and turn them on in that computer’s local gateway. The hosted gateway cannot run laptop tools.'));
+const localGuideItems = make('div', ''); localGuideItems.id = 'local-tool-guide-items'; localGuide.append(localGuideItems);
+$('my-card').after(localGuide);
+function updateInstallOS() {
+  const shell = selectedOS === 'windows' ? 'PowerShell' : 'a terminal';
+  $('local-command').textContent = 'npm install -g @integsec/agentic-pentest-proxy\nintegsec-gateway start';
+  $('local-command').closest('li').firstChild.textContent = `Copy these commands into ${shell}:`;
+  renderPresets();
+}
+osChoice.onchange = () => { selectedOS = osChoice.value; localStorage.setItem('gateway-docs-os', selectedOS); updateInstallOS(); };
 function button(label, action, style = 'secondary') {
   const node = make('button', label); node.className = style;
   node.addEventListener('click', () => Promise.resolve().then(action).catch((error) => status(error.message, true)));
   return node;
 }
+const commandPanel = make('section', ''); commandPanel.id = 'command-panel'; commandPanel.hidden = true;
+commandPanel.append(make('h3', 'Add a local command as an MCP tool'),
+  make('p', 'Use an installed executable and fixed arguments. Put {target} on one argument line. The AI can supply one approved host or URL; it cannot supply flags. Review the command and its configuration before turning it on.'));
+const commandFields = make('div', ''); commandFields.className = 'grid';
+const commandNameLabel = make('label', 'Short name'); const commandName = document.createElement('input'); commandName.id = 'cli-name'; commandName.placeholder = 'my_scanner'; commandNameLabel.append(commandName);
+const commandExeLabel = make('label', 'Installed executable'); const commandExe = document.createElement('input'); commandExe.id = 'cli-command'; commandExe.placeholder = 'scanner'; commandExeLabel.append(commandExe);
+const commandTargetLabel = make('label', 'Target type'); const commandTarget = document.createElement('select'); commandTarget.id = 'cli-target';
+for (const [value, label] of [['host', 'Hostname or IP'], ['url', 'HTTP or HTTPS URL']]) { const option = make('option', label); option.value = value; commandTarget.append(option); }
+commandTargetLabel.append(commandTarget);
+const commandTechniqueLabel = make('label', 'Technique category'); const commandTechnique = document.createElement('select'); commandTechnique.id = 'cli-technique';
+for (const [value, label] of techniques) { const option = make('option', label); option.value = value; commandTechnique.append(option); }
+commandTechniqueLabel.append(commandTechnique);
+commandFields.append(commandNameLabel, commandExeLabel, commandTargetLabel, commandTechniqueLabel); commandPanel.append(commandFields);
+const commandArgsLabel = make('label', 'Fixed arguments, one per line'); const commandArgs = document.createElement('textarea'); commandArgs.id = 'cli-args'; commandArgs.placeholder = '-u\n{target}\n-json'; commandArgsLabel.append(commandArgs); commandPanel.append(commandArgsLabel);
+commandPanel.append(button('Add command (off)', async () => {
+  const name = commandName.value.trim(); const executable = commandExe.value.trim(); const args = commandArgs.value.split(/\r?\n/).map((arg) => arg.trim()).filter(Boolean);
+  if (!/^[a-z][a-z0-9_-]{0,31}$/.test(name)) throw new Error('Use a short lowercase command name starting with a letter.');
+  if (!executable) throw new Error('Enter the installed executable name or path.');
+  if (args.filter((arg) => arg === '{target}').length !== 1) throw new Error('Put {target} on exactly one argument line.');
+  await api('/api/upstreams', 'POST', { name, enabled: false, transport: 'cli', command: executable, args, targetKind: commandTarget.value, technique: commandTechnique.value });
+  commandName.value = ''; commandExe.value = ''; commandArgs.value = ''; await refresh(); status('Local command saved and off. Review it, then turn it on.');
+}));
+$('local-presets').after(commandPanel);
 function choiceList(container, name) {
   const result = [];
   for (const [value, label] of techniques) {
@@ -111,13 +198,13 @@ function draftFromForm() {
   return { profile: $('profile').value, allowedHosts: lines('hosts'), manifest: {
     engagement_id: $('engagement').value.trim(), client: $('client').value.trim(), operator: $('operator').value.trim(),
     authorized_targets: { ip_ranges: lines('ips'), domains: lines('domains'), urls: lines('urls'), cloud_accounts: lines('cloud') },
-    excluded_targets: lines('excluded-targets'), authorized_local_paths: lines('local-paths'), authorized_techniques: checked(authorizedChoices),
+    excluded_targets: lines('excluded-targets'), authorized_local_paths: allLocalInput.checked ? ['*'] : lines('local-paths'), authorized_techniques: checked(authorizedChoices),
     excluded_techniques: checked(excludedChoices), engagement_window: { start: start.toISOString(), end: end.toISOString() },
   } };
 }
 function summarize(scope) {
   const m = scope.manifest;
-  return `Engagement: ${m.engagement_id || '(missing)'}\nClient: ${m.client || '(missing)'} · Operator: ${m.operator || '(missing)'}\nWindow: ${m.engagement_window.start} → ${m.engagement_window.end}\nProfile: ${scope.profile}\nTargets: ${Object.values(m.authorized_targets).flat().join(', ') || '(none)'}\nExcluded targets: ${m.excluded_targets.join(', ') || '(none)'}\nLocal code folders: ${(m.authorized_local_paths || []).join(', ') || '(none)'}\nAuthorized techniques: ${m.authorized_techniques.join(', ') || '(none)'}\nExcluded techniques: ${m.excluded_techniques.join(', ') || '(none)'}\nAllowed MCP hosts: ${scope.allowedHosts.join(', ') || '(none)'}`;
+  return `Engagement: ${m.engagement_id || '(missing)'}\nClient: ${m.client || '(missing)'} · Operator: ${m.operator || '(missing)'}\nWindow: ${m.engagement_window.start} → ${m.engagement_window.end}\nProfile: ${scope.profile}\nTargets: ${Object.values(m.authorized_targets).flat().join(', ') || '(none)'}\nExcluded targets: ${m.excluded_targets.join(', ') || '(none)'}\nLocal code folders: ${m.authorized_local_paths?.includes('*') ? 'ALL accessible local paths' : (m.authorized_local_paths || []).join(', ') || '(none)'}\nAuthorized techniques: ${m.authorized_techniques.join(', ') || '(none)'}\nExcluded techniques: ${m.excluded_techniques.join(', ') || '(none)'}\nAllowed MCP hosts: ${scope.allowedHosts.join(', ') || '(none)'}`;
 }
 function downloadPolicy(scope) {
   const policy = { ...scope.manifest, gateway: { profile: scope.profile, allowed_hosts: scope.allowedHosts || [] } };
@@ -152,6 +239,7 @@ function reviewForm() {
     if (m.authorized_targets.domains.some((value) => value.includes('example.'))) warnings.push('Replace documentation domains with real authorized domains.');
     if (m.authorized_targets.urls.some((value) => value.includes('example.'))) warnings.push('Replace documentation URLs with real authorized URLs.');
     if (Date.parse(m.engagement_window.end) <= Date.now()) warnings.push('Choose an end time in the future.');
+    if (m.authorized_local_paths.includes('*')) warnings.push('All accessible local paths are allowed for Semgrep and Trivy. Review this broad access before approval.');
     $('scope-review').textContent = `${warnings.length ? `Before approval: ${warnings.join(' ')}\n\n` : ''}${summarize(scope)}`;
   } catch (error) { $('scope-review').textContent = error.message; }
   updateEditorActions();
@@ -181,8 +269,11 @@ async function refresh() {
   $('connection').textContent = `MCP endpoint: ${location.origin}/mcp. ${selected ? `Current engagement: ${selected.manifest.engagement_id}.` : 'Select an engagement before using tools.'}`;
   if (role === 'admin') {
     state = await api('/api/state');
-    renderUsers(); renderUpstreams(); renderPresets(); renderScopes();
+    upstreamStatuses = await api('/api/upstreams/status');
+    renderUsers(); renderUpstreams(); renderScopes();
+    for (const card of document.querySelectorAll('.admin-only')) card.hidden = card.id === 'users-card' && mode !== 'access';
   }
+  renderPresets();
   status('Gateway state loaded.');
 }
 function renderUsers() {
@@ -202,15 +293,20 @@ function renderUpstreams() {
   const container = $('upstreams'); container.replaceChildren();
   for (const item of state.upstreams) {
     const row = make('div', ''); row.className = 'row';
-    row.append(make('span', `${item.name} · ${item.transport} · ${item.enabled ? 'On' : 'Off'} · ${item.transport === 'stdio' ? item.command : item.url}`));
-    row.append(button(item.enabled ? 'Turn off' : 'Turn on', async () => { await api(`/api/upstreams/${item.id}`, 'PATCH', { enabled: !item.enabled }); await refresh(); }));
+    const check = upstreamStatuses[item.id] || { state: item.enabled ? 'not_checked' : 'off' };
+    const connection = check.state === 'connected' ? `Connected · ${check.toolCount} tools found` : check.state === 'error' ? 'Connection failed' : check.state === 'configured' ? 'Runs on demand' : check.state === 'not_checked' ? 'Not checked' : 'Off';
+    row.append(make('span', `${item.name} · ${item.transport === 'cli' ? 'local command' : item.transport} · ${item.enabled ? 'On' : 'Off'} · ${connection} · ${['stdio', 'cli'].includes(item.transport) ? item.command : item.url}`));
+    if (check.detail && item.enabled) row.append(make('span', check.detail));
+    row.append(button(item.enabled ? 'Turn off' : 'Turn on', async () => { await api(`/api/upstreams/${item.id}`, 'PATCH', { enabled: !item.enabled }); await refresh(); status(`${item.name} turned ${item.enabled ? 'off' : 'on'} immediately. Refresh the tool list in a client that caches it.`); }));
+    if (item.enabled && item.transport !== 'cli') row.append(button('Check connection', async () => { await api(`/api/upstreams/${item.id}/check`, 'POST'); await refresh(); }));
     row.append(button('Remove', async () => { if (confirm(`Remove server ${item.name}?`)) { await api(`/api/upstreams/${item.id}`, 'DELETE'); await refresh(); } }, 'danger'));
     container.append(row);
   }
   if (!state.upstreams.length) container.append(make('p', 'No MCP servers added yet. Choose a connection path below.'));
 }
 function renderPresets() {
-  const container = $('presets'); container.replaceChildren();
+  const container = mode === 'access' ? localGuideItems : $('presets'); container.replaceChildren();
+  localGuide.hidden = mode !== 'access';
   const references = $('references'); references.replaceChildren();
   for (const preset of presets) {
     if (!preset.name) {
@@ -219,12 +315,17 @@ function renderPresets() {
       const link = make('a', 'Official information'); link.href = preset.source; link.target = '_blank'; link.rel = 'noopener noreferrer'; row.append(link);
       references.append(row); continue;
     }
-    if (mode === 'access') continue;
     const row = make('div', ''); row.className = 'row'; const detail = make('div', `${preset.label} · ${preset.note} `);
     const link = make('a', 'Official information'); link.href = preset.source; link.target = '_blank'; link.rel = 'noopener noreferrer'; detail.append(link);
+    const install = installHelp[preset.name]?.[selectedOS];
+    if (install) {
+      detail.append(make('p', install.note));
+      const code = make('code', install.command); const pre = make('pre', ''); pre.append(code); detail.append(pre);
+      detail.append(button('Copy command', async () => { await navigator.clipboard.writeText(install.command); status(`${preset.label} ${osNames[selectedOS]} command copied.`); }));
+    }
     row.append(detail);
-    if (state.upstreams.some((item) => item.name === preset.name)) row.append(make('span', 'Added'));
-    else row.append(button('Add server (off)', async () => { await api('/api/upstreams', 'POST', { name: preset.name, enabled: false, transport: preset.transport, command: preset.command, args: preset.args || [], url: preset.url }); await refresh(); status(`${preset.label} added and off. Turn it on when ready.`); }));
+    if (mode !== 'access' && state?.upstreams.some((item) => item.name === preset.name)) row.append(make('span', 'Added'));
+    else if (mode !== 'access') row.append(button('Add server (off)', async () => { await api('/api/upstreams', 'POST', { name: preset.name, enabled: false, transport: preset.transport, command: preset.command, args: preset.args || [], url: preset.url }); await refresh(); status(`${preset.label} added and off. Turn it on when ready.`); }));
     container.append(row);
   }
 }
@@ -258,9 +359,11 @@ function loadScope(scope) {
   $('starts').value = localDate(m.engagement_window.start); $('ends').value = localDate(m.engagement_window.end);
   $('profile').value = scope.profile; setLines('ips', m.authorized_targets.ip_ranges); setLines('domains', m.authorized_targets.domains);
   setLines('urls', m.authorized_targets.urls); setLines('cloud', m.authorized_targets.cloud_accounts);
-  setLines('excluded-targets', m.excluded_targets); setLines('hosts', scope.allowedHosts); setLines('local-paths', m.authorized_local_paths || []);
+  setLines('excluded-targets', m.excluded_targets); setLines('hosts', scope.allowedHosts); setLines('local-paths', (m.authorized_local_paths || []).filter((path) => path !== '*'));
+  allLocalInput.checked = m.authorized_local_paths?.includes('*') || false;
   setChecked(authorizedChoices, m.authorized_techniques); setChecked(excludedChoices, m.excluded_techniques);
   for (const field of $('editor-card').querySelectorAll('input,select,textarea')) field.disabled = scope.status !== 'draft';
+  localPathInput.disabled = allLocalInput.checked || scope.status !== 'draft';
   $('save-scope').disabled = scope.status !== 'draft';
   $('editor-help').textContent = scope.status === 'draft' ? 'Editing a saved scope. Replace any example details and choose a future end date before approval.' : 'Viewing an immutable scope. Choose Duplicate to create an editable scope.';
   reviewForm(); $('editor-card').scrollIntoView({ behavior: 'smooth' });
@@ -268,6 +371,7 @@ function loadScope(scope) {
 function clearEditor() {
   editing = null; viewingScopeId = null; dirty = false;
   for (const id of ['engagement', 'client', 'operator', 'starts', 'ends', 'ips', 'domains', 'urls', 'cloud', 'excluded-targets', 'hosts', 'local-paths']) $(id).value = '';
+  allLocalInput.checked = false;
   $('profile').value = mode === 'access' ? 'connected' : 'isolated'; setChecked(authorizedChoices, []); setChecked(excludedChoices, []);
   for (const field of $('editor-card').querySelectorAll('input,select,textarea')) field.disabled = false;
   $('save-scope').disabled = false; $('editor-help').textContent = 'New scope. Enter the client, exact authorized targets, window and techniques, then Save.'; reviewForm();
@@ -303,7 +407,7 @@ $('clear-selection').onclick = () => api('/api/my-scope', 'POST', { scopeId: nul
 $('choose-local').onclick = () => chooseServerPath('local');
 $('choose-remote').onclick = () => chooseServerPath('remote');
 $('copy-local-command').onclick = async () => { try {
-  await navigator.clipboard.writeText($('local-command').textContent.trim()); status('Local setup commands copied. Paste them into PowerShell on the tester’s computer.');
+  await navigator.clipboard.writeText($('local-command').textContent.trim()); status(`Local setup commands copied. Paste them into ${selectedOS === 'windows' ? 'PowerShell' : 'a terminal'} on the tester’s computer.`);
 } catch { status('Copy failed. Select the commands above and copy them manually.', true); } };
 $('up-transport').onchange = updateTransportFields;
 $('add-user').onclick = async () => { try { await api('/api/users', 'POST', { email: $('user-email').value.trim(), role: $('user-role').value }); $('user-email').value = ''; await refresh(); } catch (error) { status(error.message, true); } };
@@ -347,8 +451,10 @@ async function initialize() {
   bootstrapAdmins = new Set(session.bootstrapAdminEmails || []);
   $('identity').textContent = email ? `${email} · ${role}` : 'Local gateway';
   $('token-card').hidden = mode !== 'token';
-  for (const card of document.querySelectorAll('.admin-only')) card.hidden = role !== 'admin' || (card.id === 'users-card' && mode !== 'access');
+  for (const card of document.querySelectorAll('.admin-only')) card.hidden = true;
   configureServerUI();
+  $('token-card').querySelector('p').textContent = 'Paste the admin token printed when the gateway started. It stays in this browser tab only.';
+  updateInstallOS();
   clearEditor();
   if (mode === 'access' || token.value) await refresh();
   reviewForm();

package/dist/src/gateway/command.d.ts

@@ -0,0 +1,20 @@
+import type { Upstream } from "./state.js";
+export declare const commandToolName = "run_local_command";
+export declare function commandTool(upstream: Upstream): {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {
+            target: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+        additionalProperties: boolean;
+    };
+};
+export declare function commandTarget(upstream: Upstream, input: Record<string, unknown>): string;
+export declare function runCommand(upstream: Upstream, target: string, signal?: AbortSignal): Promise<string>;
+//# sourceMappingURL=command.d.ts.map

package/dist/src/gateway/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../src/gateway/command.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAK3C,eAAO,MAAM,eAAe,sBAAsB,CAAC;AAEnD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ;;;;;;;;;;;;;;EAQ7C;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAmBxF;AAED,wBAAsB,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAiC1G"}

package/dist/src/gateway/command.js

@@ -0,0 +1,80 @@
+import { spawn } from "node:child_process";
+import { isIP } from "node:net";
+const MAX_OUTPUT = 64 * 1024;
+const MAX_DURATION = 120_000;
+export const commandToolName = "run_local_command";
+export function commandTool(upstream) {
+    return {
+        name: `${upstream.name}__${commandToolName}`,
+        description: `Run the administrator-configured ${upstream.name} command against one approved ${upstream.targetKind === "url" ? "HTTP URL" : "host or IP"}. Fixed arguments only; two-minute limit.`,
+        inputSchema: { type: "object", properties: {
+                target: { type: "string", description: upstream.targetKind === "url" ? "One authorized HTTP or HTTPS URL." : "One authorized hostname or IP address." },
+            }, required: ["target"], additionalProperties: false },
+    };
+}
+export function commandTarget(upstream, input) {
+    if (Object.keys(input).length !== 1 || typeof input.target !== "string" || !input.target ||
+        input.target !== input.target.trim() || input.target.length > 2048 || /[\x00-\x20\x7f]/.test(input.target))
+        throw new Error("Enter one target; extra options and control characters are not accepted.");
+    const target = input.target;
+    if (upstream.targetKind === "host") {
+        if (isIP(target))
+            return target;
+        if (!/^(?=.{1,253}$)(?:[a-z\d](?:[a-z\d-]{0,61}[a-z\d])?\.)+[a-z](?:[a-z\d-]{0,61}[a-z\d])?$/i.test(target))
+            throw new Error("Enter one hostname or IP without a URL, range, or command options.");
+        return target;
+    }
+    if (upstream.targetKind === "url") {
+        let url;
+        try {
+            url = new URL(target);
+        }
+        catch {
+            throw new Error("Enter one HTTP or HTTPS URL.");
+        }
+        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash || !url.hostname)
+            throw new Error("URL must be HTTP or HTTPS without credentials, a query, or a fragment.");
+        return url.href;
+    }
+    throw new Error("Command target type is missing.");
+}
+export async function runCommand(upstream, target, signal) {
+    if (upstream.transport !== "cli" || !upstream.command || upstream.args.filter((arg) => arg === "{target}").length !== 1)
+        throw new Error("Invalid command configuration.");
+    const args = upstream.args.map((arg) => arg === "{target}" ? target : arg);
+    return new Promise((resolve, reject) => {
+        const child = spawn(upstream.command, args, { shell: false, windowsHide: true, stdio: ["ignore", "pipe", "pipe"], signal });
+        let output = "";
+        let size = 0;
+        let finished = false;
+        const fail = (message) => {
+            if (finished)
+                return;
+            finished = true;
+            clearTimeout(timer);
+            child.kill();
+            reject(new Error(message));
+        };
+        const timer = setTimeout(() => fail("Command exceeded the two-minute limit."), MAX_DURATION);
+        const collect = (chunk) => {
+            size += chunk.length;
+            if (size > MAX_OUTPUT)
+                return fail("Command output exceeded 64 KiB; narrow the request.");
+            output += chunk.toString("utf8");
+        };
+        child.stdout.on("data", collect);
+        child.stderr.on("data", collect);
+        child.on("error", () => fail(signal?.aborted ? "Command stopped because its server was turned off." : "Command could not start. Check the executable name and PATH on the local gateway computer."));
+        child.on("close", (code) => {
+            if (finished)
+                return;
+            finished = true;
+            clearTimeout(timer);
+            if (code !== 0)
+                reject(new Error(`Command exited with code ${code}. ${output.slice(0, 2000)}`));
+            else
+                resolve(output || "Command completed with no output.");
+        });
+    });
+}
+//# sourceMappingURL=command.js.map

package/dist/src/gateway/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../src/gateway/command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAGhC,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7B,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAEnD,MAAM,UAAU,WAAW,CAAC,QAAkB;IAC5C,OAAO;QACL,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,eAAe,EAAE;QAC5C,WAAW,EAAE,oCAAoC,QAAQ,CAAC,IAAI,iCAAiC,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,2CAA2C;QACnM,WAAW,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,UAAU,EAAE;gBAClD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,wCAAwC,EAAE;aACxJ,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAkB,EAAE,KAA8B;IAC9E,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM;QACpF,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QAChC,IAAI,CAAC,yFAAyF,CAAC,IAAI,CAAC,MAAM,CAAC;YACzG,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QAClC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;QACzF,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ;YACxH,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,MAAc,EAAE,MAAoB;IACvF,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QACrH,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7H,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE;YAC/B,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,wCAAwC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE;YAChC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,UAAU;gBAAE,OAAO,IAAI,CAAC,qDAAqD,CAAC,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC,CAAC,4FAA4F,CAAC,CAAC,CAAC;QACrM,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;;gBAC3F,OAAO,CAAC,MAAM,IAAI,mCAAmC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/gateway/runtime.d.ts

@@ -9,8 +9,17 @@ export declare class GatewayRuntime {
     private clients;
     private pending;
     private proxies;
+    private statuses;
+    private runningCommands;
     constructor(store: GatewayStore, hosted: boolean, requiredAuditSink?: ((entry: AuditEntry) => Promise<void>) | undefined, isActorAllowed?: ((email?: string) => boolean) | undefined);
     sync(): Promise<void>;
+    upstreamStatuses(): Record<string, {
+        state: "off" | "not_checked" | "connected" | "error" | "configured";
+        toolCount?: number;
+        checkedAt?: string;
+        detail?: string;
+    }>;
+    checkUpstream(id: string): Promise<void>;
     private scopeProxy;
     private clientFor;
     private available;

package/dist/src/gateway/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/gateway/runtime.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAiE,MAAM,YAAY,CAAC;AAUzG,qBAAa,cAAc;IAKb,QAAQ,CAAC,KAAK,EAAE,YAAY;IAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAW,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAAwC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAJvL,OAAO,CAAC,OAAO,CAA4D;IAC3E,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,OAAO,CAA4C;gBAEtC,KAAK,EAAE,YAAY,EAAmB,MAAM,EAAE,OAAO,EAAmB,iBAAiB,CAAC,GAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,aAAA,EAAmB,cAAc,CAAC,GAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,aAAA;IAE9M,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAY3B,OAAO,CAAC,UAAU;YAWJ,SAAS;IA2BvB,OAAO,CAAC,SAAS;IAOjB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IA8G9C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/gateway/runtime.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAiE,MAAM,YAAY,CAAC;AAWzG,qBAAa,cAAc;IAOb,QAAQ,CAAC,KAAK,EAAE,YAAY;IAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAW,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAAwC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IANvL,OAAO,CAAC,OAAO,CAA4D;IAC3E,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,OAAO,CAA4C;IAC3D,OAAO,CAAC,QAAQ,CAA+G;IAC/H,OAAO,CAAC,eAAe,CAA8E;gBAEhF,KAAK,EAAE,YAAY,EAAmB,MAAM,EAAE,OAAO,EAAmB,iBAAiB,CAAC,GAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,aAAA,EAAmB,cAAc,CAAC,GAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,aAAA;IAE9M,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB3B,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,KAAK,GAAG,aAAa,GAAG,WAAW,GAAG,OAAO,GAAG,YAAY,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAK9J,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB9C,OAAO,CAAC,UAAU;YAYJ,SAAS;IA2BvB,OAAO,CAAC,SAAS;IAOjB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IA6I9C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK7B"}