@prestyj/cli 5.12.0 → 5.13.0

package/assets/skills/lean/references/playbooks.md

@@ -0,0 +1,107 @@
+# Lean — per-stack playbooks
+
+Load only the sections the profile triggered. Commands assume a POSIX shell unless noted. Claims sourced on the snapshot date (17 August 2026) carry `SNAPSHOT`; tool versions and thresholds decay — re-verify with web access before asserting as current.
+
+## Web frontend
+
+**Targets (official web.dev stable thresholds, measured at p75, mobile and desktop split):**
+
+| Metric | Good | Needs improvement | Poor |
+|---|---|---|---|
+| LCP (Largest Contentful Paint) | ≤ 2.5s | ≤ 4.0s | > 4.0s |
+| INP (Interaction to Next Paint) | ≤ 200ms | ≤ 500ms | > 500ms |
+| CLS (Cumulative Layout Shift) | ≤ 0.1 | ≤ 0.25 | > 0.25 |
+
+SEO blogs circulate claims of a March 2026 tightening of LCP to 2.0s (`SNAPSHOT` — could not be confirmed on web.dev at snapshot time). Treat 2.0s as an aspiration, not a threshold; verify before quoting either number to a user.
+
+**Measure:** Lighthouse (DevTools or `lighthouse https://x --output json` in CI), Chrome DevTools Performance tab for long tasks, Network waterfall for request chains, Coverage tab for shipped-but-unused JS/CSS, `web-vitals` npm package for RUM field data. Lighthouse CI or `size-limit` as the regression gate.
+
+**Symptom → usual cause:**
+
+| Symptom | Usual causes | Fixes |
+|---|---|---|
+| Slow LCP | Oversized hero image, render-blocking CSS/JS, slow TTFB, web-font swap | AVIF/WebP + `srcset`, explicit dimensions, `fetchpriority="high"` on the LCP image, preload the font + `font-display: swap` (subset it), inline critical CSS / defer the rest, fix server TTFB first if > ~400–600ms — no frontend work survives that |
+| Poor INP | Long tasks (>50ms) on the main thread, expensive handlers, layout thrash, hydration weight | Split long tasks (`scheduler.yield()` where available, else task chunking), debounce expensive input handlers, batch DOM reads before writes, animate only `transform`/`opacity`, move heavy compute to a web worker, ship less JS |
+| High CLS | Images/embeds without dimensions, late banners pushing content, font swap | Width/height or `aspect-ratio` on all media, reserve ad/banner slots (`min-height`), `content-visibility` for below-fold, avoid injecting above existing content |
+| Slow nav | Waterfall fetches, client-side everything, no prefetch | Parallelize with `Promise.all`, prefetch likely-next routes, partial/staged rendering, keep-alive connections |
+
+**Sweep list:** code splitting at routes (`React.lazy`/dynamic `import()`), tree-shaking blockers (side-effectful modules, CJS in the graph), image audit (format, dimensions, `loading="lazy"` + `decoding="async"` below fold), font count and subsetting, dependency weight (bundle analyzer: `source-map-explorer`, `rollup-plugin-visualizer`, `webpack-bundle-analyzer`), virtualized long lists, memoization only where the React DevTools Profiler showed a real re-render cost — memo-by-default is perf theater, context split instead of one giant provider, `passive: true` listeners for scroll/touch, debounced resize/search handlers, service worker caching where offline or repeat visits matter.
+
+## Node.js / backend / API
+
+**Measure:** `autocannon` or `k6` for load (watch p99, not the average — the average lies), `clinic doctor` / `clinic flame` / `0x` for CPU and event-loop diagnosis, `--inspect` + Chrome DevTools for heap. DB: slow-query log, `EXPLAIN ANALYZE`.
+
+**Sweep list:**
+
+- **Event-loop blocking:** sync fs/crypto/zlib in request handlers, `JSON.parse` of huge payloads on the hot path, regex backtracking. Move to workers or streams.
+- **N+1 queries:** one join/include/dataloader instead of a loop of queries. The most common backend bottleneck, by far.
+- **Missing indexes:** every frequent filter/sort column; verify with `EXPLAIN ANALYZE` that the plan uses them.
+- **Unpaginated reads:** `SELECT *` on growing tables, `findMany()` without `take`. Cursor pagination for stable ordering.
+- **Connection pools:** sized for the DB's real limit; check for pool exhaustion under load (requests queueing on a connection).
+- **Caching with bounds:** TTL or LRU on expensive derivations; invalidate on write. Cache stampede guard (lock or stale-while-revalidate) when a hot key expires.
+- **Payload:** gzip/brotli on responses, HTTP/2+ or keep-alive, avoid re-serializing the same object per request.
+- **Memory ceiling:** `--max-old-space-size` matched to the container limit so GC pressure shows up as errors you chose, not an OOM kill at a random allocation.
+- **Retries:** capped, with backoff and jitter; unbounded retry loops are a self-inflicted outage plus a memory leak (each attempt holds state).
+
+## Electron
+
+Official maintainer guidance (electronjs.org performance tutorial, `SNAPSHOT`): profile, then fix the most resource-hungry thing; repeat. VS Code and Slack got fast exactly this way.
+
+**Sweep list:**
+
+- **Lazy `require`:** Node modules loaded at startup cost startup forever. Require at first use for heavy/rare paths; defer expensive setup with idle-time initialization.
+- **Price modules before adopting:** `node --cpu-prof --heap-prof -e "require('mod')"` — the canonical example is a "simple" connectivity checker that parsed a 100k-line JSON port list at load. Server-oriented modules are often wrong for desktop.
+- **Never block the main process:** UI jank and dead IPC come from main-process busy work. CPU-heavy work goes to utility processes / worker threads; keep main for orchestration.
+- **Bundle renderer code** (bundler or esbuild) instead of hundreds of module loads at window open.
+- **Window hygiene:** lazy-create `BrowserWindow`s, destroy (not just hide) windows whose content is expensive and rarely revisited, `process.getProcessMemoryInfo()` per process to find which side eats.
+- **Tray/menu/global-shortcut listeners** registered once, removed on app quit; background throttling is default — don't defeat it with busy polling (`powerSaveBlocker` only while genuinely needed).
+- **Startup:** `Menu.setApplicationMenu(null)` when no menu is needed; splash/deferred window show to cut time-to-visible; V8 compile cache for large renderer bundles.
+- Security config (`contextIsolation`, sandbox) is bulletproof's lane — but note sandboxing also shrinks renderer memory; do not weaken it for speed.
+
+## Tauri
+
+**Sweep list:**
+
+- **Release profile:** in `Cargo.toml` `[profile.release]` — `lto = true` (or `"thin"`), `codegen-units = 1`, `strip = true`; `panic = "abort"` if acceptable. `opt-level = "s"/"z"` trades speed for size — measure which you need.
+- **IPC cost:** every `invoke` serializes with serde — don't shuttle large blobs or big JSON back and forth per keystroke; chunk, delta, or move the work to the Rust side. Watch for per-frame IPC from frontend animation/monitoring loops.
+- **State:** `tauri::State` with `Mutex` held across `.await` serializes everything behind it; scope locks tightly.
+- **Frontend** follows the web section exactly — the webview is a browser; bundle size and long tasks hit the same.
+- **Assets:** embed vs. fetch per asset class; large binaries should not ship inside the binary if they can be fetched/unpacked on demand.
+- **Plugins:** lazy-init heavy plugins; each one is startup cost on the Rust and JS side both.
+- **Measure:** `cargo bloat` / `cargo tree -d` for binary weight and duplicate deps; standard Rust profilers (`perf`, Instruments, `cargo-flamegraph`) for hot paths.
+
+## Mobile
+
+**Sweep list:** cold-start path (lazy screen registration, defer non-critical SDK init — analytics can wait), list virtualization (`FlatList`/`RecyclerView`/`LazyColumn` — never render 1000 rows), image assets per density via asset catalogs (not runtime-downscaled full images), main-thread discipline (decode/parse off the main thread), memory-warning handling that actually drops caches.
+
+**Measure/leak tools:** Android — Android Studio Profiler, `LeakCanary` for lifecycle leaks, `dumpsys meminfo`; iOS — Instruments Allocations/Leaks, Xcode memory graph debugger. Responding to memory warnings by freeing caches is table stakes on both.
+
+## Native / compiled
+
+- **Rust:** leaks are usually `Rc`/`Arc` cycles (switch one direction to `Weak`), `Box::leak`, unbounded channels, or tasks blocked forever holding state. Blocking calls inside async runtime threads stall the executor — use `spawn_blocking`. Measure: `cargo-flamegraph`, `heaptrack`, `pprof` crate. Children must be `wait()`ed — dropping a `Child` does not reap it (see `references/memory-and-processes.md`).
+- **C/C++:** every `malloc`/`new`/`fopen` has an owner that frees/closes on all paths — RAII or scope guards, not discipline. Measure: valgrind memcheck/massif, AddressSanitizer/LeakSanitizer (`-fsanitize=address,leak`), `heaptrack`.
+- **Go:** goroutine leaks — a goroutine blocked on a channel/ctx that never arrives holds everything it captured forever. `pprof` goroutine + heap profiles tell you both. Set `GOMEMLIMIT` in containers; tune `GOGC` only after measuring.
+- **JVM:** bound the heap (`-Xmx`) to the container, watch for unbounded caches and listener registries; `jmap -histo`, async-profiler, JFR for allocation sites.
+- **Games/hot loops:** frame budget is 16.6ms @60 (8.3ms @120) including everything. No per-frame allocation (object pools), no per-frame sync I/O, no GC spikes mid-frame; batch draws; time-slice background work.
+
+## Python
+
+Generators/streams instead of list-building for large data; vectorize hot loops (NumPy/pandas — or Polars for large frames) instead of Python-level iteration; never block the asyncio event loop with sync I/O or CPU work (offload to processes); `functools.lru_cache` is bounded — `cached_property` and hand-rolled dict caches are not. Measure: `tracemalloc` for allocation deltas, `memory_profiler` line-level, `py-spy` for live flamegraphs without stopping the process. Watch for reference cycles keeping big objects alive when `gc` is disabled or timing-dependent.
+
+## Data & queries (any stack)
+
+`EXPLAIN (ANALYZE)` the slow ones; indexes on frequent filters/sorts — but every index taxes writes, so measure both sides. Batch writes; avoid N single-row inserts inside a transaction per row. Cursor/keyset pagination over offset for deep pages. Slow-query log threshold low enough to catch regressions in CI-like environments. Cache expensive reads with explicit invalidation, not hope.
+
+## Payload & dead weight (all stacks)
+
+`SNAPSHOT` (17 Aug 2026): **Knip** is the standard JS/TS dead-code finder — unused files, exports, dependencies, and devDependencies across monorepo workspaces; `depcheck` is the older alternative. CSS: PurgeCSS (or the framework's built-in pruning) against real markup — beware class names built dynamically, which purgers cannot see; guard with a safelist. Shipped-code audit: DevTools Coverage for what the browser actually ran.
+
+**Sweep list:** `knip` in CI; duplicate dependencies (`pnpm why <pkg>`, `npm ls <pkg>`) — two versions of one library is double weight; "two of the same job" audit (two icon sets, two date libs, two CSS systems, a utility lib plus hand-rolled copies of its functions); polyfills for browsers no longer supported; debug/symbol payloads shipped in release (strip; source maps to a symbol server, not the bundle); largest-files audit (`du`, bundle analyzer) — the top ten files are usually the whole story; unused assets in repos (images, fonts nobody references).
+
+## Styling consistency (payload view)
+
+The rule: **one way to express one visual decision.** Hunt repeated rule blocks that differ by one value, spacing/color literals that duplicate existing design tokens, the same component styled three ways, utility classes wrapped around handwritten CSS doing the same job, dead rules for removed components. Each duplication is bytes today and divergence tomorrow. Kill the copies, keep the token. If resolving it requires a design *decision* (which of three styles is right), that call belongs to evidence-led-ui — coordinate rather than decide unilaterally.
+
+---
+
+**Provenance:** snapshot 17 August 2026. Sources: web.dev Web Vitals (stable LCP/INP/CLS thresholds), Electron official performance tutorial (module cost, lazy loading, main-process blocking, profiling guidance), Rust std `process::Child` docs (zombie reaping), Knip documentation and 2026 ecosystem coverage (dead-code standard claim — `SNAPSHOT`), Valgrind/LeakCanary/Instruments/pprof public docs for tool usage. Version-specific flags and thresholds decay fastest; re-verify before asserting.

package/dist/app-sidecar-auth-broadcast.test.js

@@ -16,6 +16,7 @@ let tmpHome;
 let tmpProject;
 let daemon;
 let port = 0;
+let token = "";
 const openStreams = [];
 /** Start the daemon on an ephemeral port and wait for its listening handshake. */
 async function startDaemon() {
@@ -35,9 +36,10 @@ async function startDaemon() {
         const timer = setTimeout(() => reject(new Error(`daemon never listened: ${out}`)), 60_000);
         daemon.stdout.on("data", (chunk) => {
             out += chunk;
-            const match = /GG_APP_LISTENING (\d+)/.exec(out);
+            const match = /GG_APP_LISTENING (\d+) (\S+)/.exec(out);
             if (match) {
                 clearTimeout(timer);
+                token = match[2];
                 resolve(Number(match[1]));
             }
         });
@@ -56,6 +58,13 @@ function request(method, urlPath, opts = {}) {
             headers: {
                 ...(payload ? { "content-type": "application/json" } : {}),
                 ...(opts.session ? { "x-ez-session": opts.session } : {}),
+                // Default to the real token; pass token: "" to exercise the 401 path.
+                ...(opts.token !== undefined
+                    ? opts.token
+                        ? { "x-ez-token": opts.token }
+                        : {}
+                    : { "x-ez-token": token }),
+                ...(opts.host ? { host: opts.host } : {}),
             },
         }, (res) => {
             let raw = "";
@@ -81,7 +90,13 @@ function request(method, urlPath, opts = {}) {
 function openEventStream(session) {
     return new Promise((resolve, reject) => {
         const types = [];
-        const req = http.request({ host: "127.0.0.1", port, path: `/events?session=${session}`, method: "GET" }, (res) => {
+        const req = http.request({
+            host: "127.0.0.1",
+            port,
+            path: `/events?session=${session}`,
+            method: "GET",
+            headers: { "x-ez-token": token },
+        }, (res) => {
             openStreams.push(res);
             let buf = "";
             res.on("data", (chunk) => {
@@ -152,15 +167,35 @@ afterEach(async () => {
     await fs.rm(tmpHome, removeOptions);
     await fs.rm(tmpProject, removeOptions);
 });
+describe("loopback daemon auth", () => {
+    it("rejects requests without the per-launch token", async () => {
+        const res = await request("POST", "/session", {
+            body: { mode: "code", cwd: tmpProject },
+            token: "",
+        });
+        expect(res.status).toBe(401);
+    });
+    it("rejects requests with a wrong token", async () => {
+        const res = await request("GET", "/progress", { token: "not-the-token" });
+        expect(res.status).toBe(401);
+    });
+    it("rejects requests with a non-loopback Host (DNS rebinding)", async () => {
+        const res = await request("GET", "/progress", { host: "attacker.example" });
+        expect(res.status).toBe(403);
+    });
+});
 describe("connecting a provider", () => {
     it("refreshes models in every window, not just the one that connected", async () => {
         const windowA = await createSession();
         const windowB = await createSession();
         const streamA = await openEventStream(windowA);
         const streamB = await openEventStream(windowB);
-        // Logged out: no provider's models are offered yet.
+        // Logged out: no cloud provider's models are offered yet. Local providers
+        // (Ollama, LM Studio) need no auth and may already be running on this
+        // machine, so exclude them — the assertion is about auth-gated models only.
         const before = await request("GET", "/models", { session: windowA });
-        expect(before.json.models).toEqual([]);
+        const beforeCloud = before.json.models.filter((m) => !m.local);
+        expect(beforeCloud).toEqual([]);
         // Connect a provider from window A only.
         const connect = await request("POST", "/auth/apikey", {
             session: windowA,
@@ -173,9 +208,9 @@ describe("connecting a provider", () => {
         await waitFor(() => streamB.types.includes("models_change"));
         // And the refetch each window now performs actually returns the new models.
         const after = await request("GET", "/models", { session: windowB });
-        const models = after.json.models;
-        expect(models.length).toBeGreaterThan(0);
-        expect(models.every((m) => m.provider === "xai")).toBe(true);
+        const cloudModels = after.json.models.filter((m) => !m.local);
+        expect(cloudModels.length).toBeGreaterThan(0);
+        expect(cloudModels.every((m) => m.provider === "xai")).toBe(true);
     }, 90_000);
     it("closes the login modal in every window via auth_done", async () => {
         const windowA = await createSession();

package/dist/app-sidecar-auth-broadcast.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-sidecar-auth-broadcast.test.js","sourceRoot":"","sources":["../src/app-sidecar-auth-broadcast.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAA4B,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE;;;;;GAKG;AACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC5C,IAAI,EACJ,MAAM,EACN,gBAAgB,CACjB,CAAC;AAEF,IAAI,OAAe,CAAC;AACpB,IAAI,UAAkB,CAAC;AAEvB,IAAI,MAA0B,CAAC;AAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;AACb,MAAM,WAAW,GAA2B,EAAE,CAAC;AAE/C,kFAAkF;AAClF,KAAK,UAAU,WAAW;IACxB,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE;QAC1C,GAAG,EAAE,UAAU;QACf,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,OAAO;YACpB,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,GAAG;SACjB;QACD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3F,MAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAClC,GAAG,IAAI,KAAK,CAAC;YACb,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,OAAe,EACf,OAA6C,EAAE;IAE/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB;YACE,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,IAAI,EAAE,OAAO;YACb,MAAM;YACN,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D;SACF,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnB,GAAG,IAAI,CAAC,CAAC;YACX,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,OAAO;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAC9E,CAAC,GAAG,EAAE,EAAE;YACN,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACvB,GAAG,IAAI,KAAK,CAAC;gBACb,IAAI,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAChC,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACpB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;oBAClC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;4BAAE,SAAS;wBACzC,IAAI,CAAC;4BACH,KAAK,CAAC,IAAI,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAsB,CAAC,IAAI,CAAC,CAAC;wBACnE,CAAC;wBAAC,MAAM,CAAC;4BACP,sCAAsC;wBACxC,CAAC;oBACH,CAAC;oBACD,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrB,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE;QAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE;KACxC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,IAAI,CAAC,SAAmB,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,SAAwB,EAAE,SAAS,GAAG,MAAM;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC9E,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC5E,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,EAC/C,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CACvC,CAAC;IACF,MAAM,WAAW,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC7D,MAAM,aAAa,GAAG,MAAM,CAAC;IAC7B,MAAM,GAAG,SAAS,CAAC;IACnB,IAAI,aAAa,IAAI,aAAa,CAAC,QAAQ,KAAK,IAAI,IAAI,aAAa,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC1F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1C,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC/B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACxF,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE/C,oDAAoD;QACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEvC,yCAAyC;QACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE;YACpD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjC,iFAAiF;QACjF,0EAA0E;QAC1E,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAE7D,4EAA4E;QAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAgC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE/C,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE;YACpC,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE;SAC9C,CAAC,CAAC;QAEH,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7D,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,+EAA+E;IAC/E,KAAK,UAAU,gBAAgB,CAAC,OAAe;QAC7C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACzD,OAAO;YACP,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,gEAAgE;QAChE,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAClD,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACxD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhC,kEAAkE;QAClE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACxD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAChE,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhC,wEAAwE;QACxE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACvD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhD,sEAAsE;QACtE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE;YACrD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAE1D,wEAAwE;QACxE,qCAAqC;QACrC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhD,MAAM,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE;YACxC,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAE1D,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACvD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,KAAa;QAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,SAAsC,CAAC;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,KAAM,CAAC;IAChB,CAAC;IAED,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAEjD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAuD,CAAC;QAC7E,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1D,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE;YACpC,OAAO;YACP,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE;SAC/C,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,0EAA0E;QAC1E,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,aAAa,EAAE,CAAC;IAClD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,EAC3C,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;YAChF,WAAW,EAAE;gBACX,WAAW,EAAE,OAAO;gBACpB,YAAY,EAAE,GAAG;gBACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBACjC,OAAO,EAAE,oCAAoC;aAC9C;SACF,CAAC,CACH,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3D,8DAA8D;QAC9D,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAExC,2EAA2E;QAC3E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE;YAChD,OAAO;YACP,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC"}
+{"version":3,"file":"app-sidecar-auth-broadcast.test.js","sourceRoot":"","sources":["../src/app-sidecar-auth-broadcast.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAA4B,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE;;;;;GAKG;AACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC5C,IAAI,EACJ,MAAM,EACN,gBAAgB,CACjB,CAAC;AAEF,IAAI,OAAe,CAAC;AACpB,IAAI,UAAkB,CAAC;AAEvB,IAAI,MAA0B,CAAC;AAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;AACb,IAAI,KAAK,GAAG,EAAE,CAAC;AACf,MAAM,WAAW,GAA2B,EAAE,CAAC;AAE/C,kFAAkF;AAClF,KAAK,UAAU,WAAW;IACxB,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE;QAC1C,GAAG,EAAE,UAAU;QACf,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,OAAO;YACpB,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,GAAG;SACjB;QACD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3F,MAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAClC,GAAG,IAAI,KAAK,CAAC;YACb,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,OAAe,EACf,OAA4E,EAAE;IAE9E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB;YACE,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,IAAI,EAAE,OAAO;YACb,MAAM;YACN,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,sEAAsE;gBACtE,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;oBAC1B,CAAC,CAAC,IAAI,CAAC,KAAK;wBACV,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE;wBAC9B,CAAC,CAAC,EAAE;oBACN,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C;SACF,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnB,GAAG,IAAI,CAAC,CAAC;YACX,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,OAAO;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB;YACE,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,IAAI,EAAE,mBAAmB,OAAO,EAAE;YAClC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE;SACjC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACvB,GAAG,IAAI,KAAK,CAAC;gBACb,IAAI,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAChC,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACpB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;oBAClC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;4BAAE,SAAS;wBACzC,IAAI,CAAC;4BACH,KAAK,CAAC,IAAI,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAsB,CAAC,IAAI,CAAC,CAAC;wBACnE,CAAC;wBAAC,MAAM,CAAC;4BACP,sCAAsC;wBACxC,CAAC;oBACH,CAAC;oBACD,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrB,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE;QAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE;KACxC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,IAAI,CAAC,SAAmB,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,SAAwB,EAAE,SAAS,GAAG,MAAM;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC9E,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC5E,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,EAC/C,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CACvC,CAAC;IACF,MAAM,WAAW,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC7D,MAAM,aAAa,GAAG,MAAM,CAAC;IAC7B,MAAM,GAAG,SAAS,CAAC;IACnB,IAAI,aAAa,IAAI,aAAa,CAAC,QAAQ,KAAK,IAAI,IAAI,aAAa,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC1F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1C,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC/B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACxF,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE;YAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE;YACvC,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE/C,0EAA0E;QAC1E,sEAAsE;QACtE,4EAA4E;QAC5E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,WAAW,GAAI,MAAM,CAAC,IAAI,CAAC,MAAgC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1F,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEhC,yCAAyC;QACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE;YACpD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjC,iFAAiF;QACjF,0EAA0E;QAC1E,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAE7D,4EAA4E;QAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACpE,MAAM,WAAW,GAAI,KAAK,CAAC,IAAI,CAAC,MAAkD,CAAC,MAAM,CACvF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAChB,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE/C,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE;YACpC,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE;SAC9C,CAAC,CAAC;QAEH,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7D,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,+EAA+E;IAC/E,KAAK,UAAU,gBAAgB,CAAC,OAAe;QAC7C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACzD,OAAO;YACP,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,gEAAgE;QAChE,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAClD,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACxD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhC,kEAAkE;QAClE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACxD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAChE,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhC,wEAAwE;QACxE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACvD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhD,sEAAsE;QACtE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE;YACrD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAE1D,wEAAwE;QACxE,qCAAqC;QACrC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhD,MAAM,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE;YACxC,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAE1D,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACvD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,KAAa;QAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,SAAsC,CAAC;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,KAAM,CAAC;IAChB,CAAC;IAED,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAEjD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAuD,CAAC;QAC7E,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1D,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE;YACpC,OAAO;YACP,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE;SAC/C,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,0EAA0E;QAC1E,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,aAAa,EAAE,CAAC;IAClD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,EAC3C,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;YAChF,WAAW,EAAE;gBACX,WAAW,EAAE,OAAO;gBACpB,YAAY,EAAE,GAAG;gBACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBACjC,OAAO,EAAE,oCAAoC;aAC9C;SACF,CAAC,CACH,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3D,8DAA8D;QAC9D,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAExC,2EAA2E;QAC3E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE;YAChD,OAAO;YACP,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC"}

package/dist/app-sidecar.js

@@ -47,7 +47,7 @@ import { loginGemini } from "./core/oauth/gemini.js";
 import { loginKimi } from "./core/oauth/kimi.js";
 import { loginXai } from "./core/oauth/xai.js";
 import { AUTH_PROVIDERS, authPriorityNote, describeAuthMethods, } from "./core/auth-providers.js";
-import { ensureAppDirs, loadSavedSettings } from "./config.js";
+import { ensureAppDirs, loadSavedSettings, projectScopeAllowed } from "./config.js";
 import { SettingsManager } from "./core/settings-manager.js";
 import { installPlugin, listInstalledPlugins, removePlugin, } from "./core/extensions/plugin-bundles.js";
 import { getModel, getDefaultThinkingLevel, getContextWindow, getAllModels, clearRuntimeModels, registerRuntimeModels, } from "./core/model-registry.js";
@@ -388,27 +388,49 @@ function mcpRowSummary(config) {
 }
 /** Load + connect every server, returning one wire row per server. Mirrors the
  *  CLI dashboard's buildRows (connectAllDetailed, then dispose). Empty list
- *  short-circuits before spawning any stdio process / opening any HTTP conn. */
-async function buildMcpRows(cwd) {
+ *  short-circuits before spawning any stdio process / opening any HTTP conn.
+ *  Project-scope servers run repo-controlled commands, so unless the user
+ *  trusts them (trustProjectMcpServers) they are reported blocked WITHOUT
+ *  being connected — even a status probe would spawn the process. */
+async function buildMcpRows(cwd, settingsFile) {
     const scoped = await loadServers(cwd);
     if (scoped.length === 0)
         return [];
+    const settings = loadSavedSettings(settingsFile);
+    const allowProject = projectScopeAllowed(settings.trustProjectMcpServers, settings.trustedProjects, cwd);
+    const connectable = scoped.filter((s) => allowProject || s.scope !== "project");
+    const blocked = scoped.filter((s) => !allowProject && s.scope === "project");
     const manager = new MCPClientManager();
     try {
-        const results = await manager.connectAllDetailed(scoped.map((s) => s.config));
-        return scoped.map((s) => {
-            const result = results.find((r) => r.name === s.config.name);
-            return {
+        const results = connectable.length > 0
+            ? await manager.connectAllDetailed(connectable.map((s) => s.config))
+            : [];
+        return [
+            ...connectable.map((s) => {
+                const result = results.find((r) => r.name === s.config.name);
+                return {
+                    name: s.config.name,
+                    scope: s.scope,
+                    ok: result?.ok ?? false,
+                    toolCount: result?.toolCount ?? 0,
+                    error: result?.error,
+                    kind: s.config.url ? "http" : "stdio",
+                    summary: mcpRowSummary(s.config),
+                    requiresAuth: result?.requiresAuth,
+                };
+            }),
+            ...blocked.map((s) => ({
                 name: s.config.name,
                 scope: s.scope,
-                ok: result?.ok ?? false,
-                toolCount: result?.toolCount ?? 0,
-                error: result?.error,
-                kind: s.config.url ? "http" : "stdio",
+                ok: false,
+                toolCount: 0,
+                error: "Project-scope server not connected — this repo's .ezcoder/mcp.json runs " +
+                    "repo-controlled commands. Add or re-add a server in this project via " +
+                    "the MCP modal to trust it.",
+                kind: (s.config.url ? "http" : "stdio"),
                 summary: mcpRowSummary(s.config),
-                requiresAuth: result?.requiresAuth,
-            };
-        });
+            })),
+        ];
     }
     finally {
         await manager.dispose();
@@ -510,9 +532,10 @@ function daemonReadBody(req, res) {
     return readCappedBody(req, res);
 }
 function daemonJson(res, status, body) {
+    // No CORS headers: only the Rust proxy (no Origin) should call this daemon.
+    // Granting origins would let any web page read responses from loopback.
     res.writeHead(status, {
         "content-type": "application/json",
-        "access-control-allow-origin": "*",
     });
     res.end(JSON.stringify(body));
 }
@@ -530,6 +553,13 @@ async function main() {
     // GG_APP_LISTENING handshake and consumed by the shell.
     const port = Number(process.env.GG_APP_PORT ?? 0);
     const host = "127.0.0.1";
+    // Per-launch bearer token. The Rust shell generates one and passes it via
+    // GG_APP_TOKEN; spawned any other way (dev, tests, smoke) we mint our own
+    // and report it on the GG_APP_LISTENING line. Every request must carry it
+    // as x-ez-token: this daemon creates sessions for arbitrary cwds, runs
+    // prompts, and installs plugins, so an unauthenticated loopback port lets
+    // any local process drive the agent as the user.
+    const authToken = process.env.GG_APP_TOKEN ?? randomUUID();
     const paths = await ensureAppDirs();
     // Own log file so the app sidecar never clobbers the interactive CLI's
     // ~/.ezcoder/debug.log (initLogger truncates on each start).
@@ -780,16 +810,26 @@ async function main() {
     const server = http.createServer(wrapSidecarHandler((req, res) => {
         const url = req.url ?? "/";
         const method = req.method ?? "GET";
-        // CORS preflight — the webview origin differs from 127.0.0.1.
+        // Answer preflights with a bare 204 but grant NO origins — the webview
+        // reaches the daemon through the Rust proxy, never cross-origin, so any
+        // browser page's preflight must fail here.
         if (method === "OPTIONS") {
-            res.writeHead(204, {
-                "access-control-allow-origin": "*",
-                "access-control-allow-methods": "GET, POST, DELETE, OPTIONS",
-                "access-control-allow-headers": "content-type, x-ez-session",
-            });
+            res.writeHead(204);
             res.end();
             return;
         }
+        // Host allowlist. The daemon binds 127.0.0.1 only; rejecting any other
+        // Host blocks DNS rebinding, where a web page's request arrives with
+        // the attacker's hostname (browsers cannot spoof Host).
+        const reqHost = req.headers.host ?? "";
+        if (!/^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/i.test(reqHost)) {
+            daemonJson(res, 403, { error: "forbidden host" });
+            return;
+        }
+        if (req.headers["x-ez-token"] !== authToken) {
+            daemonJson(res, 401, { error: "unauthorized" });
+            return;
+        }
         // ── Daemon-level routes (session lifecycle) ──────────────────────────
         // Create a session for a window: { mode?, cwd, sessionPath? } → { sessionId }.
         if (method === "POST" && url === "/session") {
@@ -887,8 +927,9 @@ async function main() {
     }, "app-sidecar.http"));
     server.listen(port, host, () => {
         const addr = server.address();
-        // The Rust shell reads this line to learn the daemon port.
-        process.stdout.write(`GG_APP_LISTENING ${addr.port}\n`);
+        // The Rust shell reads this line to learn the daemon port (it already
+        // knows the token — it set GG_APP_TOKEN; the field serves other spawners).
+        process.stdout.write(`GG_APP_LISTENING ${addr.port} ${authToken}\n`);
         log("INFO", "app-sidecar", "daemon listening", { port: String(addr.port), host });
     });
     const shellPid = process.ppid;
@@ -1605,6 +1646,12 @@ async function createSession(deps, opts) {
             durationMs: String(d.durationMs),
             isError: String(d.isError),
             ...(d.isError ? { result: d.result.slice(0, 500) } : {}),
+            // Consecutive-failure count for schema rejections. Attempt 1 followed by
+            // a success means the model self-corrected; reaching 3 means it looped
+            // and the turn was ended. Grep this to tell the two apart.
+            ...(d.invalidArgAttempt === undefined
+                ? {}
+                : { invalidArgAttempt: String(d.invalidArgAttempt) }),
         });
         broadcast("tool_call_end", d);
         // The agent can add/done/remove project tasks via the `tasks` tool during a
@@ -1628,12 +1675,25 @@ async function createSession(deps, opts) {
     session.eventBus.on("agent_done", (d) => broadcast("agent_done", d));
     // Non-clean stop (max_tokens/refusal/provider error) — info-style frame so
     // the webview can warn instead of presenting truncated output as complete.
-    session.eventBus.on("truncated", (d) => broadcast("truncated", d));
+    // empty_response is a hard failure (no output at all): route it through
+    // broadcastError so the app renders an error row — the webview does not
+    // render bare "truncated" frames.
+    session.eventBus.on("truncated", (d) => {
+        if (d.reason === "empty_response") {
+            broadcastError("error", "empty response", new Error("The model returned an empty response after retries — try sending again."));
+            return;
+        }
+        broadcast("truncated", d);
+    });
     session.eventBus.on("error", (d) => {
         broadcastError("error", "agent error", d.error);
     });
     session.eventBus.on("model_change", (d) => broadcast("model_change", d));
     session.eventBus.on("hook", (d) => broadcast("hook", d));
+    // Fires BEFORE the candidate final answer streams. The webview holds assistant
+    // text back while armed, so an Ideal review supersedes a draft that was never
+    // painted instead of deleting one the user already started reading.
+    session.eventBus.on("hook_armed", (d) => broadcast("hook_armed", d));
     session.eventBus.on("subagent_state", (d) => broadcast("subagent_state", d));
     session.eventBus.on("compaction_start", (d) => broadcast("compaction_start", d));
     session.eventBus.on("compaction_end", (d) => broadcast("compaction_end", d));
@@ -2508,7 +2568,6 @@ async function createSession(deps, opts) {
         const payload = JSON.stringify(redactValue(body, { secrets: environmentSecrets(process.env) }));
         res.writeHead(status, {
             "content-type": "application/json",
-            "access-control-allow-origin": "*",
         });
         res.end(payload);
     }
@@ -2593,7 +2652,6 @@ async function createSession(deps, opts) {
                 "content-type": "text/event-stream",
                 "cache-control": "no-cache",
                 connection: "keep-alive",
-                "access-control-allow-origin": "*",
             });
             res.write(`retry: 1000\n\n`);
             const client = { id: ++clientSeq, res };
@@ -3359,7 +3417,7 @@ async function createSession(deps, opts) {
                 });
                 // After the user's run settles, kick off Nolan's auto-review loop — but
                 // only when the turn is actually reviewable (shouldStartAutopilotCycle):
-                // workflow commands (/compare, /bullet-proof, …) end with reports or
+                // workflow commands (/compare, /expand, …) end with reports or
                 // A/B/C choices reserved for the USER; registry commands (/help) and
                 // failed runs add no assistant work to judge; a turn that ended in plan
                 // mode has a pending Accept/Reject modal Nolan must not preempt. This is
@@ -4541,7 +4599,7 @@ async function createSession(deps, opts) {
         // scope ignores it (always ~/.ezcoder/mcp.json).
         if (method === "GET" && (url === "/mcp" || url.startsWith("/mcp?"))) {
             const targetCwd = new URL(url, `http://${host}`).searchParams.get("cwd") ?? cwd;
-            void buildMcpRows(targetCwd)
+            void buildMcpRows(targetCwd, paths.settingsFile)
                 .then((servers) => json(res, 200, { servers }))
                 .catch((err) => {
                 captureSidecarError(err, "app-sidecar.mcp.list");
@@ -4593,6 +4651,12 @@ async function createSession(deps, opts) {
                         json(res, 400, { error: saved.error });
                         return;
                     }
+                    // Adding a project-scope server is an explicit trust signal — the
+                    // user chose to put a server in this repo's .ezcoder/mcp.json. Auto-trust
+                    // the project so all project-scope servers connect on next load.
+                    if (scope === "project") {
+                        await session.trustProject(targetCwd);
+                    }
                     json(res, 200, {
                         ok: true,
                         name: config.name,