@ni-c/mcp-hub 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- #region changelog -->
 
+## [0.8.0] - 2026-08-18
+
+### Added
+
+- **Secrets hot-reload.** The docker-proxy now watches the sandbox secrets
+  directory: when the content of a referenced `<set>.env` changes, it stops the
+  affected sandbox container (after the same daemon-side ownership check as
+  every other container action), and the hub's supervisor recreates it — the
+  replacement create reads the file fresh. Rotating a token is now an edit, not
+  a hub restart. Content is compared by parsed entries, so a `touch` or a
+  comment-only edit triggers nothing; a broken edit (permissions, symlink,
+  parse error, a key colliding with the entry's `env`) is logged and ignored so
+  it cannot crash-loop a running server. Opt out with
+  `SANDBOX_SECRETS_WATCH=false`. The hub is unchanged and
+  `DOCKER_POLICY_VERSION` stays at 1 — 0.7.0 hubs interoperate.
+
 ## [0.7.0] - 2026-08-18
 
 ### Added

package/README.md

@@ -103,7 +103,8 @@ belongs in its own container — and it does not have to speak HTTP to get there
   a separate `mcp-hub-docker-proxy` container holds it and allows only the
   container operations `mcp.json` describes — nothing privileged, no host
   mounts, no other images. Credentials can live with the proxy (`secretsFrom`)
-  so the hub process never holds them.
+  so the hub process never holds them — and rotating one is just an edit: the
+  proxy watches the file and recreates the sandbox with the new values.
 - `type: "unix"` / `"tcp"` — you start the container, the hub connects to a
   socket. Costs the hub no privileges at all, and a Unix socket reaches a
   sandbox running with `network_mode: none`.

package/dist/docker-proxy/index.js

@@ -4,7 +4,9 @@ import path from 'node:path';
 import { ConfigWatcher, loadConfig, warnMutableDockerImages } from '../config.js';
 import { installFileLogging } from '../logfile.js';
 import { VERSION } from '../version.js';
-import { createDockerProxy } from './server.js';
+import { containerName } from '../sandbox/container-spec.js';
+import { createDockerProxy, recreateSandbox } from './server.js';
+import { SecretsWatcher } from './secrets-watcher.js';
 import { SecretStore, validateConfigSecrets } from './secrets.js';
 /**
  * mcp-hub-docker-proxy: the only component that touches /var/run/docker.sock.
@@ -59,9 +61,34 @@ const watcher = new ConfigWatcher(configPath, config, process.env, 3_000, { expa
 watcher.on('change', (_next, diff) => {
     warnMutableDockerImages(_next, 'mcp-hub-docker-proxy');
     console.log(`mcp-hub-docker-proxy: policy reloaded (added: ${diff.added.join(',') || '-'} removed: ${diff.removed.join(',') || '-'} changed: ${diff.changed.join(',') || '-'})`);
+    secretsWatcher.refresh();
 });
 watcher.on('error', error => console.error(`mcp-hub-docker-proxy: ignoring broken config update: ${error.message}`));
 watcher.start();
+// A secrets edit recreates the affected sandbox: the hub cannot react to it
+// (it never sees these files — that is the point of secretsFrom), and the
+// values are only applied at container create. Without this, a rotated token
+// would sit unused until the next hub restart.
+const secretsWatcher = new SecretsWatcher(secrets, secretsDir, () => watcher.current);
+secretsWatcher.on('change', (set, servers) => {
+    for (const server of servers) {
+        console.log(`mcp-hub-docker-proxy: secrets for "${set}" changed, recreating ${containerName(server)} (the hub restarts it with the new values)`);
+        recreateSandbox({ dockerSocket }, server)
+            .then(result => {
+            if (result === 'absent') {
+                console.log(`mcp-hub-docker-proxy: no running container for "${server}" — the next create picks up the new values`);
+            }
+        })
+            .catch(error => console.error(`mcp-hub-docker-proxy: cannot recreate ${containerName(server)}: ${error.message}`));
+    }
+});
+secretsWatcher.on('error', (error) => console.error(`mcp-hub-docker-proxy: ignoring broken secrets update: ${error.message}`));
+if (env('SANDBOX_SECRETS_WATCH', 'true') !== 'false') {
+    secretsWatcher.start();
+}
+else {
+    console.log('mcp-hub-docker-proxy: SANDBOX_SECRETS_WATCH=false — secrets changes apply on the next container create only');
+}
 const server = createDockerProxy({ dockerSocket, config: () => watcher.current, secretsDir });
 // A leftover socket file from an unclean exit would make listen() fail with
 // EADDRINUSE forever; there is no other writer for this path.
@@ -89,6 +116,7 @@ server.listen(listenSocket, () => {
 const shutdown = (signal) => {
     console.log(`mcp-hub-docker-proxy: received ${signal}, shutting down`);
     watcher.stop();
+    secretsWatcher.stop();
     server.close();
     try {
         fs.unlinkSync(listenSocket);

package/dist/docker-proxy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/docker-proxy/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,uBAAuB,EAAkB,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;;;;;;GAUG;AAEH,SAAS,GAAG,CAAC,IAAY,EAAE,QAAgB;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;AAClE,MAAM,UAAU,GAAG,GAAG,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;AAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAElE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACzB,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,IAAI,MAAiB,CAAC;AACtB,IAAI,CAAC;IACH,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,UAAU,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,uEAAuE;AACvE,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;AAC5C,IAAI,CAAC;IACH,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,kDAAmD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,uBAAuB,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AACxD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,SAAS,IAAI,CAAC,MAAM,qBAAqB,KAAK,CAAC,WAAW,MAAM,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3I,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACnC,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CACT,iDAAiD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CACpK,CAAC;AACJ,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wDAAyD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAChI,OAAO,CAAC,KAAK,EAAE,CAAC;AAEhB,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAE9F,4EAA4E;AAC5E,8DAA8D;AAC9D,IAAI,CAAC;IACH,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,QAAQ,EAAE;QAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACvD,CAAC;AAAC,MAAM,CAAC;IACP,2CAA2C;AAC7C,CAAC;AACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE;IAC/B,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,wDAAwD;IACxD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,qCAAqC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC;IAClJ,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,iBAAiB,YAAY,OAAO,YAAY,KAAK,aAAa,qBAAqB,CAAC,CAAC;AACtI,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;IAClC,OAAO,CAAC,GAAG,CAAC,kCAAkC,MAAM,iBAAiB,CAAC,CAAC;IACvE,OAAO,CAAC,IAAI,EAAE,CAAC;IACf,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;AACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE;IACxC,OAAO,CAAC,KAAK,CAAC,8CAA8C,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC7I,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/docker-proxy/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,uBAAuB,EAAkB,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;;;;;;GAUG;AAEH,SAAS,GAAG,CAAC,IAAY,EAAE,QAAgB;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;AAClE,MAAM,UAAU,GAAG,GAAG,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;AAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAElE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACzB,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,IAAI,MAAiB,CAAC;AACtB,IAAI,CAAC;IACH,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,UAAU,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,uEAAuE;AACvE,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;AAC5C,IAAI,CAAC;IACH,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,kDAAmD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,uBAAuB,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AACxD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,SAAS,IAAI,CAAC,MAAM,qBAAqB,KAAK,CAAC,WAAW,MAAM,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3I,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACnC,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CACT,iDAAiD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CACpK,CAAC;IACF,cAAc,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wDAAyD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAChI,OAAO,CAAC,KAAK,EAAE,CAAC;AAEhB,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,+CAA+C;AAC/C,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACtF,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAW,EAAE,OAAiB,EAAE,EAAE;IAC7D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CACT,sCAAsC,GAAG,yBAAyB,aAAa,CAAC,MAAM,CAAC,4CAA4C,CACpI,CAAC;QACF,eAAe,CAAC,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC;aACtC,IAAI,CAAC,MAAM,CAAC,EAAE;YACb,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,mDAAmD,MAAM,6CAA6C,CAAC,CAAC;YACtH,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,yCAAyC,aAAa,CAAC,MAAM,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAClI,CAAC;AACH,CAAC,CAAC,CAAC;AACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,yDAAyD,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACtI,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC;IACrD,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,GAAG,CAAC,6GAA6G,CAAC,CAAC;AAC7H,CAAC;AAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAE9F,4EAA4E;AAC5E,8DAA8D;AAC9D,IAAI,CAAC;IACH,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,QAAQ,EAAE;QAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACvD,CAAC;AAAC,MAAM,CAAC;IACP,2CAA2C;AAC7C,CAAC;AACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE;IAC/B,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,wDAAwD;IACxD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,qCAAqC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC;IAClJ,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,iBAAiB,YAAY,OAAO,YAAY,KAAK,aAAa,qBAAqB,CAAC,CAAC;AACtI,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;IAClC,OAAO,CAAC,GAAG,CAAC,kCAAkC,MAAM,iBAAiB,CAAC,CAAC;IACvE,OAAO,CAAC,IAAI,EAAE,CAAC;IACf,cAAc,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;AACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE;IACxC,OAAO,CAAC,KAAK,CAAC,8CAA8C,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC7I,CAAC,CAAC,CAAC"}

package/dist/docker-proxy/secrets-watcher.js

@@ -0,0 +1,174 @@
+import { EventEmitter } from 'node:events';
+import fs from 'node:fs';
+import path from 'node:path';
+import { SecretError } from './secrets.js';
+/**
+ * Watches the sandbox secrets directory and reports when the *content* of a
+ * referenced set changes.
+ *
+ * Why this lives in the proxy and not the hub: the hub never sees the secret
+ * values (that is the point of `secretsFrom`), so it cannot know when they
+ * change. The proxy can — and it is also the only component allowed to act on
+ * it, by recreating the affected sandbox container so the next create picks up
+ * the new values. The values themselves are never cached here; `policy.ts`
+ * reads them fresh from disk on every create. This watcher only supplies the
+ * missing trigger.
+ *
+ * Watching strategy mirrors ConfigWatcher: fs.watch on the directory for the
+ * common case, plus stat polling per referenced file as the fallback for
+ * bind mounts where host-side inotify events do not cross the mount boundary.
+ */
+const DEBOUNCE_MS = 1_000;
+/** Content identity of a secret set: key order and formatting do not matter. */
+function fingerprint(secrets) {
+    return JSON.stringify(Object.entries(secrets).sort(([a], [b]) => a.localeCompare(b)));
+}
+/** All docker servers that reference a given secret set. */
+function referencingServers(config, set) {
+    const servers = [];
+    for (const [name, entry] of config) {
+        if (entry.kind === 'docker' && entry.secretsFrom === set)
+            servers.push(name);
+    }
+    return servers;
+}
+function referencedSets(config) {
+    const sets = new Set();
+    for (const entry of config.values()) {
+        if (entry.kind === 'docker' && entry.secretsFrom !== undefined)
+            sets.add(entry.secretsFrom);
+    }
+    return sets;
+}
+export class SecretsWatcher extends EventEmitter {
+    store;
+    dir;
+    config;
+    pollIntervalMs;
+    debounceMs;
+    watcher;
+    debounce = new Map();
+    polled = new Map(); // set name -> watched file path
+    fingerprints = new Map();
+    constructor(store, dir, config, pollIntervalMs = 3_000, debounceMs = DEBOUNCE_MS) {
+        super();
+        this.store = store;
+        this.dir = dir;
+        this.config = config;
+        this.pollIntervalMs = pollIntervalMs;
+        this.debounceMs = debounceMs;
+    }
+    start() {
+        // Baseline first: what is on disk right now is the state the running
+        // containers were created from (index.ts validated it at startup), so it
+        // must not count as a change.
+        this.refresh();
+        try {
+            this.watcher = fs.watch(this.dir, (_event, filename) => {
+                if (filename === null || !filename.endsWith('.env'))
+                    return;
+                this.schedule(filename.slice(0, -'.env'.length));
+            });
+        }
+        catch (error) {
+            // Polling still covers every referenced file; say so rather than dying.
+            this.emit('error', new Error(`cannot watch ${this.dir}, falling back to polling only: ${error.message}`));
+        }
+    }
+    /**
+     * Aligns the polled-file list and baselines with the current config. Called
+     * at start and whenever the config reloads — a set that gained its first
+     * reference starts being watched, one that lost its last stops.
+     */
+    refresh() {
+        const wanted = referencedSets(this.config());
+        for (const [set, file] of this.polled) {
+            if (wanted.has(set))
+                continue;
+            fs.unwatchFile(file);
+            this.polled.delete(set);
+            this.fingerprints.delete(set);
+        }
+        for (const set of wanted) {
+            if (this.polled.has(set))
+                continue;
+            let file;
+            try {
+                file = this.store.pathFor(set);
+            }
+            catch (error) {
+                this.emit('error', error);
+                continue;
+            }
+            fs.watchFile(file, { interval: this.pollIntervalMs }, (curr, prev) => {
+                if (curr.mtimeMs === prev.mtimeMs && curr.size === prev.size)
+                    return;
+                this.schedule(set);
+            });
+            this.polled.set(set, file);
+            // A set that appears without a baseline (new reference after a config
+            // reload) gets one silently: its container, if any, is created after
+            // this point and reads the file fresh anyway.
+            try {
+                this.fingerprints.set(set, fingerprint(this.store.load(set)));
+            }
+            catch {
+                // Leave it without a baseline; the first *valid* read becomes one.
+            }
+        }
+    }
+    schedule(set) {
+        const timer = this.debounce.get(set);
+        if (timer)
+            clearTimeout(timer);
+        // A secrets file is usually edited by hand; a generous debounce keeps a
+        // half-finished save from triggering a container restart per keystroke.
+        this.debounce.set(set, setTimeout(() => {
+            this.debounce.delete(set);
+            this.check(set);
+        }, this.debounceMs));
+    }
+    check(set) {
+        const config = this.config();
+        const servers = referencingServers(config, set);
+        if (servers.length === 0)
+            return; // unreferenced (or no longer referenced): none of our business
+        let secrets;
+        try {
+            secrets = this.store.load(set);
+            // Same collision rule as validateConfigSecrets: a secret must not shadow
+            // a configured env key, whose value the hub already fixed.
+            for (const server of servers) {
+                const entry = config.get(server);
+                if (entry?.kind !== 'docker')
+                    continue;
+                const collision = Object.keys(secrets).find(key => Object.hasOwn(entry.env, key));
+                if (collision)
+                    throw new SecretError(`secret "${collision}" collides with a configured env key of server "${server}"`);
+            }
+        }
+        catch (error) {
+            // Fail safe: a broken edit must not take the running container down —
+            // restarting it now would only produce a create that fails on the same
+            // file. Keep the old baseline so the next valid content still fires.
+            this.emit('error', new Error(`${path.basename(this.polled.get(set) ?? set)}: ${error.message}`));
+            return;
+        }
+        const next = fingerprint(secrets);
+        const previous = this.fingerprints.get(set);
+        this.fingerprints.set(set, next);
+        if (previous === undefined || previous === next)
+            return; // baseline, touch, or comment-only edit
+        this.emit('change', set, servers);
+    }
+    stop() {
+        for (const timer of this.debounce.values())
+            clearTimeout(timer);
+        this.debounce.clear();
+        this.watcher?.close();
+        for (const file of this.polled.values())
+            fs.unwatchFile(file);
+        this.polled.clear();
+    }
+}
+//# sourceMappingURL=secrets-watcher.js.map

package/dist/docker-proxy/secrets-watcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-watcher.js","sourceRoot":"","sources":["../../src/docker-proxy/secrets-watcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAe,MAAM,cAAc,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B,gFAAgF;AAChF,SAAS,WAAW,CAAC,OAA+B;IAClD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,4DAA4D;AAC5D,SAAS,kBAAkB,CAAC,MAAiB,EAAE,GAAW;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,YAAY;IAO3B,KAAK;IACL,GAAG;IACH,MAAM;IACN,cAAc;IACd,UAAU;IAVrB,OAAO,CAAgB;IACd,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC7C,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,gCAAgC;IACpE,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1D,YACmB,KAAkB,EAClB,GAAW,EACX,MAAuB,EACvB,cAAc,GAAG,KAAK,EACtB,UAAU,GAAG,WAAW;QAEzC,KAAK,EAAE,CAAC;qBANS,KAAK;mBACL,GAAG;sBACH,MAAM;8BACN,cAAc;0BACd,UAAU;IAG7B,CAAC;IAED,KAAK;QACH,qEAAqE;QACrE,yEAAyE;QACzE,8BAA8B;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;gBACrD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAC5D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,GAAG,mCAAoC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,OAAO;QACL,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC9B,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACnC,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAc,CAAC,CAAC;gBACnC,SAAS;YACX,CAAC;YACD,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;gBACnE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;oBAAE,OAAO;gBACrE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,sEAAsE;YACtE,qEAAqE;YACrE,8CAA8C;YAC9C,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,GAAW;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,QAAQ,CAAC,GAAG,CACf,GAAG,EACH,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CACpB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,GAAW;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,+DAA+D;QAEjG,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/B,yEAAyE;YACzE,2DAA2D;YAC3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,KAAK,EAAE,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBACvC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;gBAClF,IAAI,SAAS;oBAAE,MAAM,IAAI,WAAW,CAAC,WAAW,SAAS,mDAAmD,MAAM,GAAG,CAAC,CAAC;YACzH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,CAAC,wCAAwC;QACjG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,IAAI;QACF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/docker-proxy/server.js

@@ -1,7 +1,7 @@
 import http from 'node:http';
 import { authorize } from './policy.js';
 import { SecretStore } from './secrets.js';
-import { OWNER_LABEL, OWNER_VALUE, SERVER_LABEL } from '../sandbox/container-spec.js';
+import { containerName, OWNER_LABEL, OWNER_VALUE, SERVER_LABEL } from '../sandbox/container-spec.js';
 import { DOCKER_POLICY_NAME, DOCKER_POLICY_PATH, DOCKER_POLICY_VERSION } from '../sandbox/policy-protocol.js';
 const MAX_BODY_BYTES = 1024 * 1024;
 const UPSTREAM_TIMEOUT_MS = 15 * 60_000;
@@ -70,6 +70,21 @@ async function policyHandshake(options) {
     }
     return { name: DOCKER_POLICY_NAME, policyVersion: DOCKER_POLICY_VERSION, daemon: 'ok' };
 }
+/** Daemon-side truth about who a container belongs to, from its inspect body. */
+function ownershipFromInspect(body, id, server) {
+    let labels;
+    try {
+        const parsed = JSON.parse(body.toString('utf8'));
+        labels = parsed.Config?.Labels;
+    }
+    catch {
+        return { ok: false, reason: `inspect response for container "${id}" is not valid JSON` };
+    }
+    if (labels?.[OWNER_LABEL] !== OWNER_VALUE || labels?.[SERVER_LABEL] !== server) {
+        return { ok: false, reason: `container "${id}" does not have the exact mcp-hub owner and server labels` };
+    }
+    return { ok: true };
+}
 async function verifyContainer(options, decision) {
     if (!decision.container)
         return undefined;
@@ -81,19 +96,38 @@ async function verifyContainer(options, decision) {
             reason: `cannot inspect container "${decision.container.id}" (status ${inspected.status})`
         };
     }
-    let labels;
-    try {
-        const parsed = JSON.parse(inspected.body.toString('utf8'));
-        labels = parsed.Config?.Labels;
-    }
-    catch {
-        return { status: 403, reason: `inspect response for container "${decision.container.id}" is not valid JSON` };
-    }
-    if (labels?.[OWNER_LABEL] !== OWNER_VALUE || labels?.[SERVER_LABEL] !== decision.container.server) {
-        return { status: 403, reason: `container "${decision.container.id}" does not have the exact mcp-hub owner and server labels` };
-    }
+    const ownership = ownershipFromInspect(inspected.body, decision.container.id, decision.container.server);
+    if (!ownership.ok)
+        return { status: 403, reason: ownership.reason };
     return undefined;
 }
+/**
+ * Stops a sandbox container so the hub's supervisor recreates it — the way a
+ * secrets change reaches a running server. The values are not pushed anywhere:
+ * the replacement create simply reads the file fresh, like every create does.
+ *
+ * Ownership is verified daemon-side first, exactly like every other container
+ * action this proxy performs. `AutoRemove` disposes of the stopped container.
+ */
+export async function recreateSandbox(options, server) {
+    const name = containerName(server);
+    const inspected = await daemonRequest(options, 'GET', `/containers/${encodeURIComponent(name)}/json`, MAX_INSPECT_BYTES, POLICY_CHECK_TIMEOUT_MS);
+    if (inspected.status === 404)
+        return 'absent';
+    if (inspected.status !== 200)
+        throw new Error(`cannot inspect container "${name}" (status ${inspected.status})`);
+    const ownership = ownershipFromInspect(inspected.body, name, server);
+    if (!ownership.ok)
+        throw new Error(ownership.reason);
+    // t=5 mirrors the hub's own teardown grace period; the timeout adds room for it.
+    const stopped = await daemonRequest(options, 'POST', `/containers/${encodeURIComponent(name)}/stop?t=5`, 1024, 30_000);
+    if (stopped.status === 404)
+        return 'absent';
+    if (stopped.status !== 204 && stopped.status !== 304) {
+        throw new Error(`cannot stop container "${name}" (status ${stopped.status})`);
+    }
+    return 'stopped';
+}
 /**
  * A Docker socket proxy that enforces mcp-hub's sandbox policy.
  *

package/dist/docker-proxy/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/docker-proxy/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,SAAS,EAAqC,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAA8B,MAAM,+BAA+B,CAAC;AAE1I,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AACxC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAUtC,SAAS,MAAM,CAAC,QAA6B,EAAE,MAAc,EAAE,MAAc,EAAE,eAAe,GAAG,KAAK;IACpG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,yBAAyB,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;QACzB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;QACzC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,QAAQ,CAAC,OAA6B;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAkC,EAAE,EAAE;YACpD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACnC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC1B,qEAAqE;gBACrE,sEAAsE;gBACtE,+DAA+D;gBAC/D,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,OAAqB,EAAE,MAAc,EAAE,IAAY,EAAE,QAAgB,EAAE,SAAiB;IAC7G,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE;YACvH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACpC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;oBACpB,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,2BAA2B,QAAQ,QAAQ,CAAC,CAAC,CAAC;oBACzE,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAqB;IAClD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC1F,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1F,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAqB,EACrB,QAA4C;IAE5C,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,OAAO,EACP,KAAK,EACL,GAAG,OAAO,eAAe,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EACzE,iBAAiB,EACjB,uBAAuB,CACxB,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,SAAS,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YAC5C,MAAM,EAAE,6BAA6B,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,SAAS,CAAC,MAAM,GAAG;SAC3F,CAAC;IACJ,CAAC;IACD,IAAI,MAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsD,CAAC;QAChH,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,mCAAmC,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAChH,CAAC;IACD,IAAI,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,WAAW,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAClG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,SAAS,CAAC,EAAE,2DAA2D,EAAE,CAAC;IACjI,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAqB;IACrD,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,GAAkB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,IAAa,EAAY,EAAE;QACtE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,mEAAmE;QACnE,sEAAsE;QACtE,kCAAkC;QAClC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,MAAM,IAAI,OAAO,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;;YAC5F,OAAO,CAAC,GAAG,CAAC,uBAAuB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;gBACtB,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,wBAAwB,cAAc,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5E,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,IAAa,CAAC;YAClB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;oBACxD,OAAO;gBACT,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,KAAK,kBAAkB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvF,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;oBACtF,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC5G,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,4CAA6C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChG,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7G,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B;gBACE,UAAU,EAAE,OAAO,CAAC,YAAY;gBAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;iBAC/C;aACF,EACD,gBAAgB,CAAC,EAAE;gBACjB,QAAQ,CAAC,SAAS,CAAC,gBAAgB,CAAC,UAAU,IAAI,GAAG,EAAE;oBACrD,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB;iBAC/E,CAAC,CAAC;gBACH,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC,CACF,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YACzF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;gBAC3B,OAAO,CAAC,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClH,IAAI,CAAC,QAAQ,CAAC,WAAW;oBAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,8BAA+B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;;oBACtG,QAAQ,CAAC,GAAG,EAAE,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,IAAI,OAAO;gBAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACjB,OAAO,CAAC,KAAK,CAAC,iCAAkC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,QAAQ,CAAC,WAAW;gBAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,YAAoB,EAAE,IAAY,EAAE,EAAE;QACnE,KAAK,CAAC,KAAK,IAAI,EAAE;YACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,SAAS,CAAC,CAAC;YAChF,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,EAAE,CAChD,YAAY,CAAC,GAAG,CAAC,YAAY,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,4CAA4C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,MAAM,EAAE,EAAE,GAAG,EAAE,CAChL,YAAY,CAAC,OAAO,EAAE,CACvB,CAAC;YACJ,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC7H,OAAO;YACT,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC5B,UAAU,EAAE,OAAO,CAAC,YAAY;gBAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;aACvG,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE;gBACjE,YAAY,CAAC,KAAK,CAAC,yHAAyH,CAAC,CAAC;gBAC9I,IAAI,YAAY,EAAE,MAAM;oBAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC3D,IAAI,IAAI,EAAE,MAAM;oBAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC7C,sEAAsE;gBACtE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC5B,YAAiE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnF,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAClC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAClC,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,uEAAuE;gBACvE,+DAA+D;gBAC/D,MAAM,IAAI,GAAG,GAAG,EAAE;oBAChB,YAAY,CAAC,OAAO,EAAE,CAAC;oBACvB,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC3B,CAAC,CAAC;gBACF,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;oBAC9C,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBAC7B,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,EAAE;gBACzC,gBAAgB,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,EAAE,0BAA0B,gBAAgB,CAAC,UAAU,uBAAuB,CAAC,CAAC;YAC5F,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;gBAC3B,OAAO,CAAC,KAAK,CAAC,2CAA4C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrF,MAAM,CAAC,GAAG,EAAE,8BAA+B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACjB,OAAO,CAAC,KAAK,CAAC,8CAA+C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACxF,YAAY,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/docker-proxy/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,SAAS,EAAqC,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAA8B,MAAM,+BAA+B,CAAC;AAE1I,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AACxC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAUtC,SAAS,MAAM,CAAC,QAA6B,EAAE,MAAc,EAAE,MAAc,EAAE,eAAe,GAAG,KAAK;IACpG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,yBAAyB,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;QACzB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;QACzC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,QAAQ,CAAC,OAA6B;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAkC,EAAE,EAAE;YACpD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACnC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC1B,qEAAqE;gBACrE,sEAAsE;gBACtE,+DAA+D;gBAC/D,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,OAA2C,EAC3C,MAAc,EACd,IAAY,EACZ,QAAgB,EAChB,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE;YACvH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACpC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;oBACpB,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,2BAA2B,QAAQ,QAAQ,CAAC,CAAC,CAAC;oBACzE,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAqB;IAClD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC1F,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1F,CAAC;AAED,iFAAiF;AACjF,SAAS,oBAAoB,CAAC,IAAY,EAAE,EAAU,EAAE,MAAc;IACpE,IAAI,MAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsD,CAAC;QACtG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,qBAAqB,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,WAAW,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,2DAA2D,EAAE,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAqB,EACrB,QAA4C;IAE5C,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,OAAO,EACP,KAAK,EACL,GAAG,OAAO,eAAe,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EACzE,iBAAiB,EACjB,uBAAuB,CACxB,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,SAAS,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YAC5C,MAAM,EAAE,6BAA6B,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,SAAS,CAAC,MAAM,GAAG;SAC3F,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzG,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IACpE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA2C,EAAE,MAAc;IAC/F,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,eAAe,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IAClJ,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,aAAa,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IACjH,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,iFAAiF;IACjF,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvH,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,aAAa,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAqB;IACrD,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,GAAkB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,IAAa,EAAY,EAAE;QACtE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,mEAAmE;QACnE,sEAAsE;QACtE,kCAAkC;QAClC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,MAAM,IAAI,OAAO,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;;YAC5F,OAAO,CAAC,GAAG,CAAC,uBAAuB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;gBACtB,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,wBAAwB,cAAc,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5E,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,IAAa,CAAC;YAClB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;oBACxD,OAAO;gBACT,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,KAAK,kBAAkB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvF,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;oBACtF,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC5G,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,4CAA6C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChG,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7G,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B;gBACE,UAAU,EAAE,OAAO,CAAC,YAAY;gBAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;iBAC/C;aACF,EACD,gBAAgB,CAAC,EAAE;gBACjB,QAAQ,CAAC,SAAS,CAAC,gBAAgB,CAAC,UAAU,IAAI,GAAG,EAAE;oBACrD,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB;iBAC/E,CAAC,CAAC;gBACH,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC,CACF,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YACzF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;gBAC3B,OAAO,CAAC,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClH,IAAI,CAAC,QAAQ,CAAC,WAAW;oBAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,8BAA+B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;;oBACtG,QAAQ,CAAC,GAAG,EAAE,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,IAAI,OAAO;gBAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACjB,OAAO,CAAC,KAAK,CAAC,iCAAkC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,QAAQ,CAAC,WAAW;gBAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,YAAoB,EAAE,IAAY,EAAE,EAAE;QACnE,KAAK,CAAC,KAAK,IAAI,EAAE;YACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,SAAS,CAAC,CAAC;YAChF,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,EAAE,CAChD,YAAY,CAAC,GAAG,CAAC,YAAY,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,4CAA4C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,MAAM,EAAE,EAAE,GAAG,EAAE,CAChL,YAAY,CAAC,OAAO,EAAE,CACvB,CAAC;YACJ,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC7H,OAAO;YACT,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC5B,UAAU,EAAE,OAAO,CAAC,YAAY;gBAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;aACvG,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE;gBACjE,YAAY,CAAC,KAAK,CAAC,yHAAyH,CAAC,CAAC;gBAC9I,IAAI,YAAY,EAAE,MAAM;oBAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC3D,IAAI,IAAI,EAAE,MAAM;oBAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC7C,sEAAsE;gBACtE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC5B,YAAiE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnF,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAClC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAClC,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,uEAAuE;gBACvE,+DAA+D;gBAC/D,MAAM,IAAI,GAAG,GAAG,EAAE;oBAChB,YAAY,CAAC,OAAO,EAAE,CAAC;oBACvB,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC3B,CAAC,CAAC;gBACF,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;oBAC9C,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBAC7B,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,EAAE;gBACzC,gBAAgB,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,EAAE,0BAA0B,gBAAgB,CAAC,UAAU,uBAAuB,CAAC,CAAC;YAC5F,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;gBAC3B,OAAO,CAAC,KAAK,CAAC,2CAA4C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrF,MAAM,CAAC,GAAG,EAAE,8BAA+B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACjB,OAAO,CAAC,KAAK,CAAC,8CAA+C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACxF,YAAY,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ni-c/mcp-hub",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Serve multiple stdio MCP servers from one container: Claude-Code-style mcpServers config, path-based routing, hub meta-tools, and OAuth 2.1 + API tokens for ChatGPT, Claude and any Streamable-HTTP MCP client.",
   "keywords": [
     "mcp",