@remnux/mcp-server 0.1.72 → 0.1.74

package/README.md

@@ -284,6 +284,18 @@ claude mcp add remnux --transport http http://REMNUX_IP:3000/mcp \
 
 **Auto-summarization:** When total tool output exceeds ~32KB, `analyze_file` automatically switches to summary mode to prevent LLM context overflow — key findings per tool, full IOC extraction, and paths to saved full outputs for drill-down via `download_file`.
 
+**Tool status (summary mode):** each tool entry in the summary has a `status`.
+
+| Status | Meaning |
+|---|---|
+| `findings` | The tool's parser resolved at least one finding |
+| `clean` | The tool's parser read the output and resolved nothing. A benign verdict needs other evidence |
+| `not_assessed` | No parser reads this tool's output, so the server did not interpret it. Its `key_lines` are raw excerpts |
+| `error` | The tool exited non-zero or reported its own failure (`tool_reported_error`), or its parser could not read the output (`parse_failed`) |
+| `timeout` | The tool exited non-zero and its output mentions a timeout |
+
+*Compatibility note:* `not_assessed` is new. Tools without a parser used to report `clean`. A client that switches exhaustively over the status values needs a branch for it.
+
 **Preprocessing:** Before analysis, `analyze_file` checks for conditions that prevent effective analysis (encrypted Office docs, bloated PEs, PyInstaller bundles) and applies automatic fixes. Results appear in the `preprocessing` field.
 
 ### Example: run_tool
@@ -342,9 +354,12 @@ All three connection modes (docker, ssh, local) execute commands inside a dispos
 | Archive zip-slip (path traversal in archives) | Analysis session | Post-extraction validation rejects path escape attempts |
 | SSH injection | SSH connection | Proper shell escaping using single quotes |
 | Host-side file read via `upload_from_host` (docker/ssh mode) | Analyst's workstation (outside isolation) | Opt-in `--sandbox` confines the source to `--ingest-root` (realpath-resolved). See the disclosure below. |
+| Host-side command execution via a file transfer (docker mode) | Analyst's workstation (outside isolation) | Every host-side `docker` invocation runs as an argument vector with no shell, so a path can never be parsed as a command. See "The server process is part of the trusted computing base" below. |
 
 **Where `upload_from_host` reads from, and why it matters.** The relevant boundary is **connector mode (`local` vs `docker`/`ssh`), not transport**. In `local` mode (including HTTP transport with the local connector), the AI already has shell-level read on the REMnux box by design: `run_tool` executes arbitrary commands there, so `upload_from_host` reading a file outside the samples directory adds nothing beyond what the model already grants. In `docker`/`ssh` mode, `upload_from_host` is the one tool that reads from the machine where the server runs, the analyst's workstation, via `docker cp` or SFTP. That read happens outside the container/VM isolation that bounds everything else, so a prompt-injected client could stage a host file such as `~/.ssh/id_rsa` or `~/.aws/credentials` into REMnux. Enable `--sandbox` with `--ingest-root=<host staging dir>` to confine that read. In docker/ssh mode, `--ingest-root` is required when `--sandbox` is set, because the samples directory lives inside REMnux rather than on the host.
 
+**The server process is part of the trusted computing base.** Container/VM isolation is the boundary, and in docker/ssh mode this server is the control plane that mediates it: it runs on the analyst's workstation, outside that isolation, and it handles paths and filenames that originate inside REMnux. So the code that invokes `docker` is itself security-relevant, independent of anything the container can or cannot do. Every host-side `docker` call is therefore executed as an argument vector (`execFileSync`, no shell), which is what keeps a filename a filename. Building those calls as shell command strings was [GHSA-qp43-2vqh-w88w](https://github.com/REMnux/remnux-mcp-server/security/advisories/GHSA-qp43-2vqh-w88w): POSIX single-quote escaping is inert under `cmd.exe`, so on a Windows workstation a crafted filename reached by `download_file` became host command execution. The mitigation is removing the shell, not escaping better. Escaping is shell-specific and was silently wrong on one platform, and a filter strict enough to be safe under `cmd.exe` would have to reject characters that are legal in filenames analysts really encounter (`%VAR%` alone is expanded before metacharacters are parsed). Argument-vector execution makes the question moot: a filename stays a filename.
+
 **Other considerations:** A theoretical TOCTOU race exists between path validation and tool execution; container isolation is the primary mitigation (use immutable sample storage for high-security contexts). The `upload_from_host` confinement closes its own check-vs-read race by reading the realpath it validated. Tool description poisoning is mitigated by using build-time constants rather than runtime lookups from external sources.
 
 **What does NOT need protection (container/VM's job):** REMnux filesystem, packages, services, privileges, network config, devices, mounts, and path traversal inside REMnux — all disposable and container-isolated.
@@ -353,7 +368,7 @@ All three connection modes (docker, ssh, local) execute commands inside a dispos
 
 1. **Container/VM isolation**: REMnux runs isolated — the primary security boundary (user responsibility)
 2. **Command guards**: Block null-byte injection and catastrophic session-wipe commands (`mkfs`, `rm -rf /`). Shell metacharacters (`$()`, backticks, `${}`, pipes) are intentionally allowed because container/VM isolation, not in-band filtering, is the boundary
-3. **Shell escaping**: Proper single-quote escaping for SSH commands
+3. **No host-side shell**: Host-side `docker` invocations (including every `docker cp` file transfer) run as argument vectors with no shell, so paths and filenames cannot be parsed as commands on the analyst's workstation. Single-quote escaping applies only to commands sent to the remote POSIX shell inside REMnux, never to host-side execution
 4. **Timeouts**: Long-running processes terminated (default 5 min)
 5. **Output budgets**: Per-tool (40KB default) and total (120KB) limits prevent AI context exhaustion
 6. **Path sandboxing** (opt-in via `--sandbox`): Restricts file operations to samples/output dirs

package/dist/analysis/summarizer.d.ts

@@ -14,6 +14,12 @@ interface ToolRun {
     full_output_length?: number;
     findings?: Finding[];
     metadata?: Record<string, unknown>;
+    /** Output file the server saved for this tool. */
+    saved_output_file?: string;
+    /** The tool's parser could not read its output. */
+    parse_failed?: boolean;
+    /** The tool exited 0 but reported a failure of its own. */
+    tool_reported_error?: boolean;
 }
 interface IOC {
     type: string;
@@ -44,9 +50,21 @@ interface PreprocessResult {
     outputPath?: string;
     error?: string;
 }
+/**
+ * `clean` means the tool's parser read its output and resolved nothing.
+ * `not_assessed` means no parser reads this tool's output, so nothing interpreted it.
+ */
+export type ToolStatus = "findings" | "clean" | "not_assessed" | "error" | "timeout";
 export interface ToolSummary {
     name: string;
-    status: "findings" | "clean" | "error" | "timeout";
+    status: ToolStatus;
+    /** Present when the tool's parser could not read its output; status is then "error". */
+    parse_failed?: true;
+    /**
+     * Present when the tool exited 0 but reported a failure of its own. Status is
+     * "error", or "findings" when the tool also recovered something.
+     */
+    tool_reported_error?: true;
     key_lines: string[];
     finding_count?: number;
     output_size: number;
@@ -120,6 +138,12 @@ export declare function shouldSummarize(toolsRun: ToolRun[]): boolean;
  * - Repetitive lines
  */
 export declare function extractKeyLines(output: string, limit?: number): string[];
+/**
+ * The lines that represent a tool in summary mode. A parsed tool's findings come
+ * first, because the generic scorer can miss them (a YARA match line scores zero),
+ * followed by the scorer's picks from the raw output.
+ */
+export declare function deriveKeyLines(tool: ToolRun): string[];
 /**
  * Generate a summarized analysis response.
  */

package/dist/analysis/summarizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"summarizer.d.ts","sourceRoot":"","sources":["../../src/analysis/summarizer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,UAAU,GAAG;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,eAAe,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;CACtE;AAED,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IACnD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,IAAI,EAAE,SAAS,CAAC;IAChB,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,WAAW,EAAE,UAAU,CAAC;IACxB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kGAAkG;IAClG,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,kBAAkB,GAAG,SAAS,CA4B/F;AAQD;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAG5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,GAAE,MAA+B,GAAG,MAAM,EAAE,CAgEhG;AAgBD;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,UAAU,EAAE,EACzB,YAAY,EAAE,WAAW,EAAE,EAC3B,iBAAiB,EAAE,gBAAgB,EAAE,EACrC,IAAI,EAAE,GAAG,EAAE,EACX,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,EAAE,EACnB,gBAAgB,EAAE,MAAM,EACxB,YAAY,CAAC,EAAE,MAAM,EACrB,UAAU,CAAC,EAAE,cAAc,EAAE,GAC5B,eAAe,CAwDjB"}
+{"version":3,"file":"summarizer.d.ts","sourceRoot":"","sources":["../../src/analysis/summarizer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAGnD,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,UAAU,GAAG;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,eAAe,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;CACtE;AAED,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,OAAO,GAAG,cAAc,GAAG,OAAO,GAAG,SAAS,CAAC;AAErF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,wFAAwF;IACxF,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,IAAI,EAAE,SAAS,CAAC;IAChB,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,WAAW,EAAE,UAAU,CAAC;IACxB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kGAAkG;IAClG,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,kBAAkB,GAAG,SAAS,CA4B/F;AAQD;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAG5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,GAAE,MAA+B,GAAG,MAAM,EAAE,CAgEhG;AAWD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAatD;AAmBD;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,UAAU,EAAE,EACzB,YAAY,EAAE,WAAW,EAAE,EAC3B,iBAAiB,EAAE,gBAAgB,EAAE,EACrC,IAAI,EAAE,GAAG,EAAE,EACX,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,EAAE,EACnB,gBAAgB,EAAE,MAAM,EACxB,YAAY,CAAC,EAAE,MAAM,EACrB,UAAU,CAAC,EAAE,cAAc,EAAE,GAC5B,eAAe,CAmDjB"}

package/dist/analysis/summarizer.js

@@ -4,6 +4,7 @@
  * When total output exceeds the budget, generates a summary with key findings
  * per tool while preserving IOCs and providing paths to full outputs.
  */
+import { hasParser } from "../parsers/index.js";
 /**
  * Separate capability findings (e.g. capa) by the kind of evidence they matched
  * on, using each finding's evidence_types tag. This is a pure reorganization of
@@ -130,6 +131,32 @@ export function extractKeyLines(output, limit = MAX_KEY_LINES_PER_TOOL) {
     scored.sort((a, b) => b.score - a.score);
     return scored.slice(0, limit).map((s) => s.line);
 }
+/** Findings shown as key lines for a parsed tool. Overflow is counted, never silent. */
+const MAX_FINDING_KEY_LINES = 20;
+/** Per-line cap, since a finding description can quote sample text. */
+const MAX_KEY_LINE_CHARS = 300;
+const capLine = (line) => line.length > MAX_KEY_LINE_CHARS ? `${line.slice(0, MAX_KEY_LINE_CHARS)}…` : line;
+/**
+ * The lines that represent a tool in summary mode. A parsed tool's findings come
+ * first, because the generic scorer can miss them (a YARA match line scores zero),
+ * followed by the scorer's picks from the raw output.
+ */
+export function deriveKeyLines(tool) {
+    const findings = tool.findings ?? [];
+    if (findings.length === 0)
+        return extractKeyLines(tool.output);
+    const lines = findings.slice(0, MAX_FINDING_KEY_LINES).map((f) => capLine(f.description));
+    if (findings.length > MAX_FINDING_KEY_LINES) {
+        lines.push(`… and ${findings.length - MAX_FINDING_KEY_LINES} more finding(s)`);
+    }
+    const seen = new Set(lines.map((l) => l.toLowerCase()));
+    for (const line of extractKeyLines(tool.output)) {
+        const capped = capLine(line);
+        if (!seen.has(capped.toLowerCase()))
+            lines.push(capped);
+    }
+    return lines;
+}
 /**
  * Determine the status of a tool run.
  */
@@ -144,6 +171,11 @@ function getToolStatus(tool) {
     }
     if (tool.findings && tool.findings.length > 0)
         return "findings";
+    if (tool.parse_failed || tool.tool_reported_error)
+        return "error";
+    // "clean" would claim a reading of output that nothing interpreted.
+    if (!hasParser(tool.name))
+        return "not_assessed";
     return "clean";
 }
 /**
@@ -154,22 +186,17 @@ export function generateSummary(file, detectedType, category, depth, triageSumma
     const savedFiles = [];
     for (const tool of toolsRun) {
         const status = getToolStatus(tool);
-        const keyLines = extractKeyLines(tool.output);
-        // Track which files were saved for full output retrieval. The marker is
-        // written by analyze_file's truncation path as
-        // "Saved in full as %OUTPUT%/<file> (...)" (legacy form: "Full output: output/<file>").
-        // Only trust the marker when the server actually truncated this tool's
-        // output: sample-derived text could otherwise forge a saved_to entry.
-        const savedMatch = tool.truncated
-            ? (tool.output?.match(/Saved in full as %OUTPUT%\/([^\s\](]+)/) ??
-                tool.output?.match(/Full output: output\/([^\s\]]+)/))
-            : null;
-        const savedTo = savedMatch ? savedMatch[1] : undefined;
+        const keyLines = deriveKeyLines(tool);
+        // Set by analyze_file whenever it saved this tool's output, never read from
+        // tool text, so sample content cannot forge it.
+        const savedTo = tool.saved_output_file;
         if (savedTo)
             savedFiles.push(savedTo);
         toolSummaries.push({
             name: tool.name,
             status,
+            ...(tool.parse_failed && { parse_failed: true }),
+            ...(tool.tool_reported_error && { tool_reported_error: true }),
             key_lines: keyLines,
             ...(tool.findings && tool.findings.length > 0 && { finding_count: tool.findings.length }),
             output_size: tool.output?.length || 0,

package/dist/analysis/summarizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"summarizer.js","sourceRoot":"","sources":["../../src/analysis/summarizer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAqGH;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAmB;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,cAAc,CAAC;YAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrC,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;;gBACpD,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,MAAM,GAAG,GAAG,EAAE,CAAC;IACf,MAAM,MAAM,GAAG,CAAC,CAAc,EAAY,EAAE;QAC1C,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACnB,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3F,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EACF,yGAAyG;YACzG,yGAAyG;YACzG,sDAAsD;YACtD,0GAA0G;YAC1G,sGAAsG;QACxG,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC;QAClC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,4CAA4C;AAC5C,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAmB;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,GAAG,uBAAuB,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,QAAgB,sBAAsB;IACpF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,wDAAwD;IACxD,qEAAqE;IACrE,MAAM,iBAAiB,GAAG;QACxB,uDAAuD;QACvD,mCAAmC;QACnC,wCAAwC;QACxC,6DAA6D;QAC7D,+BAA+B;QAC/B,sBAAsB;QACtB,sCAAsC;KACvC,CAAC;IAEF,iDAAiD;IACjD,MAAM,aAAa,GAAG;QACpB,cAAc;QACd,qCAAqC;QACrC,oBAAoB;QACpB,aAAa;QACb,UAAU;KACX,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,SAAS;QAE5D,kBAAkB;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAErB,kBAAkB;QAClB,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,gEAAgE;QAChE,IAAI,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAEjE,8CAA8C;QAC9C,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAEtE,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACrE,sDAAsD;QACtD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,UAAU,CAAC;QACjE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACjE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,YAAoB,EACpB,QAAgB,EAChB,KAAa,EACb,aAAqB,EACrB,QAAmB,EACnB,WAAyB,EACzB,YAA2B,EAC3B,iBAAqC,EACrC,IAAW,EACX,UAAsB,EACtB,SAAmB,EACnB,gBAAwB,EACxB,YAAqB,EACrB,UAA6B;IAE7B,MAAM,aAAa,GAAkB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE9C,wEAAwE;QACxE,+CAA+C;QAC/C,wFAAwF;QACxF,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS;YAC/B,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,wCAAwC,CAAC;gBAC7D,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACxD,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,IAAI,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEtC,aAAa,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,SAAS,EAAE,QAAQ;YACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzF,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;YACrC,GAAG,CAAC,OAAO,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAEtF,OAAO;QACL,IAAI,EAAE,SAAS;QACf,GAAG,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;QAC3E,IAAI;QACJ,aAAa,EAAE,YAAY;QAC3B,gBAAgB,EAAE,QAAQ;QAC1B,KAAK;QACL,cAAc,EAAE,aAAa;QAC7B,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;QACzE,WAAW,EAAE,QAAQ,CAAC,MAAM;QAC5B,mBAAmB,EAAE,iBAAiB;QACtC,KAAK,EAAE,aAAa;QACpB,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,YAAY;QAC3B,IAAI;QACJ,WAAW,EAAE,UAAU;QACvB,oBAAoB,EAAE,SAAS;QAC/B,gBAAgB,EACd,UAAU,CAAC,MAAM,GAAG,CAAC;YACnB,CAAC,CAAC,oDAAoD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;YACvK,CAAC,CAAC,wDAAwD;QAC9D,iBAAiB,EAAE,gBAAgB;QACnC,GAAG,CAAC,YAAY,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"summarizer.js","sourceRoot":"","sources":["../../src/analysis/summarizer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAsHhD;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAmB;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,cAAc,CAAC;YAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrC,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;;gBACpD,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,MAAM,GAAG,GAAG,EAAE,CAAC;IACf,MAAM,MAAM,GAAG,CAAC,CAAc,EAAY,EAAE;QAC1C,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACnB,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3F,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EACF,yGAAyG;YACzG,yGAAyG;YACzG,sDAAsD;YACtD,0GAA0G;YAC1G,sGAAsG;QACxG,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC;QAClC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,4CAA4C;AAC5C,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAmB;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,GAAG,uBAAuB,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,QAAgB,sBAAsB;IACpF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,wDAAwD;IACxD,qEAAqE;IACrE,MAAM,iBAAiB,GAAG;QACxB,uDAAuD;QACvD,mCAAmC;QACnC,wCAAwC;QACxC,6DAA6D;QAC7D,+BAA+B;QAC/B,sBAAsB;QACtB,sCAAsC;KACvC,CAAC;IAEF,iDAAiD;IACjD,MAAM,aAAa,GAAG;QACpB,cAAc;QACd,qCAAqC;QACrC,oBAAoB;QACpB,aAAa;QACb,UAAU;KACX,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,SAAS;QAE5D,kBAAkB;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAErB,kBAAkB;QAClB,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,gEAAgE;QAChE,IAAI,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAEjE,8CAA8C;QAC9C,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAEtE,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,wFAAwF;AACxF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAC/B,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAEpF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1F,IAAI,QAAQ,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,MAAM,GAAG,qBAAqB,kBAAkB,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACrE,sDAAsD;QACtD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,UAAU,CAAC;QACjE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACjE,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,mBAAmB;QAAE,OAAO,OAAO,CAAC;IAClE,oEAAoE;IACpE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,CAAC;IACjD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,YAAoB,EACpB,QAAgB,EAChB,KAAa,EACb,aAAqB,EACrB,QAAmB,EACnB,WAAyB,EACzB,YAA2B,EAC3B,iBAAqC,EACrC,IAAW,EACX,UAAsB,EACtB,SAAmB,EACnB,gBAAwB,EACxB,YAAqB,EACrB,UAA6B;IAE7B,MAAM,aAAa,GAAkB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAEtC,4EAA4E;QAC5E,gDAAgD;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACvC,IAAI,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEtC,aAAa,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,IAAa,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,EAAE,mBAAmB,EAAE,IAAa,EAAE,CAAC;YACvE,SAAS,EAAE,QAAQ;YACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzF,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;YACrC,GAAG,CAAC,OAAO,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAEtF,OAAO;QACL,IAAI,EAAE,SAAS;QACf,GAAG,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;QAC3E,IAAI;QACJ,aAAa,EAAE,YAAY;QAC3B,gBAAgB,EAAE,QAAQ;QAC1B,KAAK;QACL,cAAc,EAAE,aAAa;QAC7B,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;QACzE,WAAW,EAAE,QAAQ,CAAC,MAAM;QAC5B,mBAAmB,EAAE,iBAAiB;QACtC,KAAK,EAAE,aAAa;QACpB,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,YAAY;QAC3B,IAAI;QACJ,WAAW,EAAE,UAAU;QACvB,oBAAoB,EAAE,SAAS;QAC/B,gBAAgB,EACd,UAAU,CAAC,MAAM,GAAG,CAAC;YACnB,CAAC,CAAC,oDAAoD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;YACvK,CAAC,CAAC,wDAAwD;QAC9D,iBAAiB,EAAE,gBAAgB;QACnC,GAAG,CAAC,YAAY,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/connectors/docker.d.ts

@@ -12,6 +12,10 @@ export declare class DockerConnector implements Connector {
     buildTimeoutWrappedCommand(command: string[], timeoutMs: number): string[];
     buildRootChownArgv(remotePath: string): string[] | null;
     buildEnsureDirsArgvs(): string[][];
+    buildCopyToContainerArgv(hostPath: string, remotePath: string): string[];
+    buildCopyFromContainerArgv(remotePath: string, hostPath: string): string[];
+    private dockerBinary;
+    private resolveDockerBinary;
     private runDocker;
     private ensureBaseDirsOwned;
     private chownToExecUser;

package/dist/connectors/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/connectors/docker.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,WAAW,CAAC;AAI/B,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAKrE,qBAAa,eAAgB,YAAW,SAAS;IAC/C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,eAAe,CAAS;gBAQ9B,aAAa,EAAE,MAAM,EACrB,QAAQ,SAAW,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM;IA8BpB,sBAAsB,CACpB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,GAAE,WAAgB,GACxB,MAAM,CAAC,iBAAiB;IAkB3B,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAQ1E,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI;IAQvD,oBAAoB,IAAI,MAAM,EAAE,EAAE;YAUpB,SAAS;YAQT,mBAAmB;YAenB,eAAe;IAUvB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IAkK1E,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgD7D,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IActE,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IAgB7E,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAGlC"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/connectors/docker.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,WAAW,CAAC;AAI/B,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAMrE,qBAAa,eAAgB,YAAW,SAAS;IAC/C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,eAAe,CAAS;gBAQ9B,aAAa,EAAE,MAAM,EACrB,QAAQ,SAAW,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM;IA8BpB,sBAAsB,CACpB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,GAAE,WAAgB,GACxB,MAAM,CAAC,iBAAiB;IAkB3B,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAQ1E,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI;IAQvD,oBAAoB,IAAI,MAAM,EAAE,EAAE;IAalC,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAMxE,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAO1E,OAAO,CAAC,YAAY,CAAuB;IAW3C,OAAO,CAAC,mBAAmB;YAgCb,SAAS;YAQT,mBAAmB;YAenB,eAAe;IAUvB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IAkK1E,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyC7D,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtE,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IAgB7E,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAGlC"}

package/dist/connectors/docker.js

@@ -2,6 +2,7 @@ import Docker from "dockerode";
 import { writeFileSync, unlinkSync, mkdtempSync } from "fs";
 import { tmpdir } from "os";
 import { join, basename } from "path";
+import { resolveExecutable } from "./resolve-executable.js";
 // Output size limit (10MB)
 const MAX_OUTPUT_SIZE = 10 * 1024 * 1024;
 export class DockerConnector {
@@ -84,11 +85,62 @@ export class DockerConnector {
             ["exec", "-u", "0", this.containerName, "chown", this.execUser, ...this.baseDirs],
         ];
     }
+    // Build the `docker cp` argv that copies a host file INTO the container. Pure and
+    // testable. Each operand is a single argv element, so no character in a path is
+    // ever parsed as SHELL syntax. (Docker still parses its own options and the
+    // `container:path` notation — callers pass absolute host paths, and the
+    // container-side operand is always `name:`-prefixed, so no operand reads as a flag.)
+    buildCopyToContainerArgv(hostPath, remotePath) {
+        return ["cp", hostPath, `${this.containerName}:${remotePath}`];
+    }
+    // Build the `docker cp` argv that copies a container file OUT to the host. Same
+    // guarantee as above, and the direction that reaches the analyst's workstation.
+    buildCopyFromContainerArgv(remotePath, hostPath) {
+        return ["cp", `${this.containerName}:${remotePath}`, hostPath];
+    }
+    // Fully qualified path to the docker CLI, resolved from PATH on first use and
+    // cached for the life of this connector. Lazy rather than eager so constructing
+    // a connector never requires Docker to be installed.
+    dockerBinary = null;
+    // Resolve `docker` to an absolute path, deliberately NOT letting the platform
+    // do it. A bare name handed to execFileSync is resolved by libuv, which on
+    // Windows searches the process's current directory BEFORE PATH (and tries
+    // `.com` before `.exe`) — so a sample unpacked into the analyst's working
+    // directory could plant a `docker.com` that this server would then run on the
+    // host. See resolve-executable.ts for the libuv citation.
+    //
+    // Never falls back to the bare name: that would restore the very search this
+    // avoids. A missing docker is a startup-shaped problem and says so.
+    resolveDockerBinary() {
+        if (this.dockerBinary)
+            return this.dockerBinary;
+        const resolved = resolveExecutable("docker", {
+            pathEnv: process.env.PATH ?? process.env.Path,
+            platform: process.platform,
+        });
+        if (!resolved) {
+            throw new Error("Could not find the 'docker' executable in PATH. Install Docker, or add " +
+                "its directory to PATH using a fully qualified path. Note that the " +
+                "current working directory is intentionally not searched.");
+        }
+        this.dockerBinary = resolved;
+        return resolved;
+    }
     // Run `docker <argv>` via execFileSync — no shell, so values cannot inject commands.
-    // Best-effort: callers swallow failures so ownership repair never blocks analysis.
+    // This is the security boundary for every host-side docker invocation, not a
+    // defense-in-depth nicety: the MCP server process runs on the analyst's workstation,
+    // outside the container isolation the threat model relies on, and it handles paths
+    // derived from container-side data. A shell here (cmd.exe on Windows, where POSIX
+    // single-quote escaping is inert) turns a filename into host command execution —
+    // GHSA-qp43-2vqh-w88w. `shell: false` is execFileSync's default and is passed
+    // explicitly so the invariant is visible and testable.
+    //
+    // Throws on failure. Callers that are best-effort (ownership repair) catch for
+    // themselves; the file-transfer callers deliberately do not, so a failed copy
+    // surfaces to the analyst.
     async runDocker(argv) {
         const { execFileSync } = await import("child_process");
-        execFileSync("docker", argv, { stdio: "pipe" });
+        execFileSync(this.resolveDockerBinary(), argv, { stdio: "pipe", shell: false });
     }
     // Idempotently make the samples/output dirs owned by the exec user. Runs once per
     // connector. Best-effort: the dirs may already be correct, or docker may be
@@ -275,13 +327,9 @@ export class DockerConnector {
         try {
             // Write content to temp file
             writeFileSync(tempPath, content);
-            // Use docker cp to copy into container
-            // docker cp tempPath containerName:remotePath
-            // Escape single quotes in paths for shell safety (defense-in-depth)
-            const escapedTempPath = tempPath.replace(/'/g, "'\\''");
-            const escapedRemotePath = remotePath.replace(/'/g, "'\\''");
-            const { execSync } = await import("child_process");
-            execSync(`docker cp '${escapedTempPath}' '${this.containerName}:${escapedRemotePath}'`, { stdio: "pipe" });
+            // Copy into the container as an argv — no shell, so nothing in either path
+            // can be parsed as a command (see runDocker).
+            await this.runDocker(this.buildCopyToContainerArgv(tempPath, remotePath));
             // docker cp preserves the host file's numeric UID/GID and mode (NOT the exec
             // user), so a file that is not world/group readable on the host would be
             // unreadable by a non-root exec user. Chown the copied path to the exec user so
@@ -302,19 +350,13 @@ export class DockerConnector {
     }
     async writeFileFromPath(remotePath, hostPath) {
         await this.ensureBaseDirsOwned();
-        const escapedRemotePath = remotePath.replace(/'/g, "'\\''");
-        const escapedHostPath = hostPath.replace(/'/g, "'\\''");
-        const { execSync } = await import("child_process");
-        execSync(`docker cp '${escapedHostPath}' '${this.containerName}:${escapedRemotePath}'`, { stdio: "pipe" });
+        await this.runDocker(this.buildCopyToContainerArgv(hostPath, remotePath));
         // docker cp preserves the host uid/mode, which may not grant the non-root exec
         // user access. Chown the copied path to the exec user so tools can read it.
         await this.chownToExecUser(remotePath);
     }
     async readFileToPath(remotePath, hostPath) {
-        const escapedRemotePath = remotePath.replace(/'/g, "'\\''");
-        const escapedHostPath = hostPath.replace(/'/g, "'\\''");
-        const { execSync } = await import("child_process");
-        execSync(`docker cp '${this.containerName}:${escapedRemotePath}' '${escapedHostPath}'`, { stdio: "pipe" });
+        await this.runDocker(this.buildCopyFromContainerArgv(remotePath, hostPath));
     }
     async executeShell(command, options = {}) {
         // Calculate shell timeout (slightly shorter than client timeout to fire first)

package/dist/connectors/docker.js.map

@@ -1 +1 @@
-{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/connectors/docker.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAGtC,2BAA2B;AAC3B,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzC,MAAM,OAAO,eAAe;IAClB,MAAM,CAAS;IACf,aAAa,CAAS;IACtB,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAW;IACnB,eAAe,GAAG,KAAK,CAAC;IAEhC,iFAAiF;IACjF,oFAAoF;IACpF,+EAA+E;IAC/E,6EAA6E;IAC7E,6BAA6B;IAC7B,YACE,aAAqB,EACrB,QAAQ,GAAG,QAAQ,EACnB,UAAmB,EACnB,SAAkB;QAElB,qEAAqE;QACrE,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,2BAA2B,aAAa,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,gFAAgF;QAChF,6EAA6E;QAC7E,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,QAAQ,CAAC;QACrC,+EAA+E;QAC/E,iFAAiF;QACjF,8EAA8E;QAC9E,gFAAgF;QAChF,kEAAkE;QAClE,IAAI,CAAC,QAAQ;YACX,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;gBAC/C,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAC1C,CAAC,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE;oBAC1B,CAAC,CAAC,GAAG,CAAC;QACZ,6EAA6E;QAC7E,+EAA+E;QAC/E,IAAI,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,sBAAsB,CACpB,OAAiB,EACjB,UAAuB,EAAE;QAEzB,OAAO;YACL,GAAG,EAAE,OAAO;YACZ,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ;YACxC,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,2EAA2E;YAC3E,qEAAqE;YACrE,GAAG,EAAE,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;SAC/B,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,oFAAoF;IACpF,kFAAkF;IAClF,4CAA4C;IAC5C,0BAA0B,CAAC,OAAiB,EAAE,SAAiB;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;IACxE,CAAC;IAED,iFAAiF;IACjF,kFAAkF;IAClF,mFAAmF;IACnF,kBAAkB,CAAC,UAAkB;QACnC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrF,CAAC;IAED,oFAAoF;IACpF,+EAA+E;IAC/E,4EAA4E;IAC5E,oBAAoB;QAClB,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACtE,OAAO;YACL,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;YACxE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;SAClF,CAAC;IACJ,CAAC;IAED,qFAAqF;IACrF,mFAAmF;IAC3E,KAAK,CAAC,SAAS,CAAC,IAAc;QACpC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACvD,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,kFAAkF;IAClF,4EAA4E;IAC5E,+BAA+B;IACvB,KAAK,CAAC,mBAAmB;QAC/B,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO;QACjC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,gFAAgF;IAChF,2CAA2C;IACnC,KAAK,CAAC,eAAe,CAAC,UAAkB;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAiB,EAAE,UAAuB,EAAE;QACxD,sCAAsC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAE/D,wCAAwC;QACxC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,aAAa,kBAAkB,CAAC,CAAC;QACtE,CAAC;QAED,kFAAkF;QAClF,iFAAiF;QACjF,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;QAC1C,kFAAkF;QAClF,8EAA8E;QAC9E,4EAA4E;QAC5E,2EAA2E;QAC3E,+EAA+E;QAC/E,MAAM,cAAc,GAAG,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;QAExF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,8DAA8D;YAC9D,IAAI,YAAY,GAAQ,IAAI,CAAC;YAE7B,8EAA8E;YAC9E,iFAAiF;YACjF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;gBAClC,QAAQ,GAAG,IAAI,CAAC;gBAChB,4CAA4C;gBAC5C,IAAI,YAAY,IAAI,OAAO,YAAY,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC/D,YAAY,CAAC,OAAO,EAAE,CAAC;gBACzB,CAAC;gBACD,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,OAAO,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC;YACzE,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,CAAC;YAEpB,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;gBACzD,IAAI,GAAG,EAAE,CAAC;oBACR,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,CAAC;gBAED,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBAC3D,CAAC;gBAED,6CAA6C;gBAC7C,YAAY,GAAG,MAAM,CAAC;gBAEtB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,eAAe,GAAG,KAAK,CAAC;gBAE5B,wEAAwE;gBACxE,wEAAwE;gBACxE,+BAA+B;gBAC/B,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAE7B,MAAM,aAAa,GAAG,GAAG,EAAE;oBACzB,uCAAuC;oBACvC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;wBAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB;wBACvD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;wBAE3C,kCAAkC;wBAClC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,CAAC;4BACpC,MAAM;wBACR,CAAC;wBAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBAClE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;wBAEvC,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;4BACrB,SAAS;4BACT,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;gCACpC,MAAM,IAAI,OAAO,CAAC;gCAClB,IAAI,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;oCACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;oCAC1C,eAAe,GAAG,IAAI,CAAC;gCACzB,CAAC;4BACH,CAAC;wBACH,CAAC;6BAAM,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;4BAC5B,SAAS;4BACT,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;gCACpC,MAAM,IAAI,OAAO,CAAC;gCAClB,IAAI,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;oCACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;oCAC1C,eAAe,GAAG,IAAI,CAAC;gCACzB,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAClC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;oBACxC,aAAa,EAAE,CAAC;gBAClB,CAAC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;oBAC1B,IAAI,QAAQ;wBAAE,OAAO;oBACrB,YAAY,CAAC,KAAK,CAAC,CAAC;oBAEpB,6BAA6B;oBAC7B,aAAa,EAAE,CAAC;oBAEhB,iEAAiE;oBACjE,kEAAkE;oBAClE,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACxD,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBACjC,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;4BACpC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;4BAC1C,eAAe,GAAG,IAAI,CAAC;wBACzB,CAAC;oBACH,CAAC;oBAED,IAAI,CAAC;wBACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;wBAE3C,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,IAAI,CAAC,CAAC;wBAC7C,2EAA2E;wBAC3E,2EAA2E;wBAC3E,qEAAqE;wBACrE,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;4BACzC,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,OAAO,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC;wBAChF,CAAC;wBAED,IAAI,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;wBAChC,IAAI,eAAe,EAAE,CAAC;4BACpB,WAAW,IAAI,8CAA8C,CAAC;wBAChE,CAAC;wBAED,OAAO,CAAC;4BACN,MAAM,EAAE,WAAW;4BACnB,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;4BACrB,QAAQ;yBACT,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,WAAW,EAAE,CAAC;wBACrB,OAAO,CAAC;4BACN,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;4BACrB,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;4BACrB,QAAQ,EAAE,CAAC,CAAC;yBACb,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,SAAgB,EAAE,EAAE;oBACtC,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,SAAS,CAAC,CAAC;gBACpB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,OAAe;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAE/D,wCAAwC;QACxC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,aAAa,kBAAkB,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAEjC,iCAAiC;QACjC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEzC,IAAI,CAAC;YACH,6BAA6B;YAC7B,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAEjC,uCAAuC;YACvC,8CAA8C;YAC9C,oEAAoE;YACpE,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YACnD,QAAQ,CACN,cAAc,eAAe,MAAM,IAAI,CAAC,aAAa,IAAI,iBAAiB,GAAG,EAC7E,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;YAEF,6EAA6E;YAC7E,yEAAyE;YACzE,gFAAgF;YAChF,uDAAuD;YACvD,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,qBAAqB;YACrB,IAAI,CAAC;gBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB,EAAE,QAAgB;QAC1D,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,QAAQ,CACN,cAAc,eAAe,MAAM,IAAI,CAAC,aAAa,IAAI,iBAAiB,GAAG,EAC7E,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;QACF,+EAA+E;QAC/E,4EAA4E;QAC5E,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAkB,EAAE,QAAgB;QACvD,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,QAAQ,CACN,cAAc,IAAI,CAAC,aAAa,IAAI,iBAAiB,MAAM,eAAe,GAAG,EAC7E,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,UAAuB,EAAE;QAC3D,+EAA+E;QAC/E,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;QAClD,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB;QAEnF,kEAAkE;QAClE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,UAAU,GAAG,0BAA0B,gBAAgB,cAAc,UAAU,GAAG,CAAC;QAEzF,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,UAAU;QACd,wDAAwD;IAC1D,CAAC;CACF"}
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/connectors/docker.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,2BAA2B;AAC3B,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzC,MAAM,OAAO,eAAe;IAClB,MAAM,CAAS;IACf,aAAa,CAAS;IACtB,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAW;IACnB,eAAe,GAAG,KAAK,CAAC;IAEhC,iFAAiF;IACjF,oFAAoF;IACpF,+EAA+E;IAC/E,6EAA6E;IAC7E,6BAA6B;IAC7B,YACE,aAAqB,EACrB,QAAQ,GAAG,QAAQ,EACnB,UAAmB,EACnB,SAAkB;QAElB,qEAAqE;QACrE,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,2BAA2B,aAAa,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,gFAAgF;QAChF,6EAA6E;QAC7E,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,QAAQ,CAAC;QACrC,+EAA+E;QAC/E,iFAAiF;QACjF,8EAA8E;QAC9E,gFAAgF;QAChF,kEAAkE;QAClE,IAAI,CAAC,QAAQ;YACX,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;gBAC/C,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAC1C,CAAC,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE;oBAC1B,CAAC,CAAC,GAAG,CAAC;QACZ,6EAA6E;QAC7E,+EAA+E;QAC/E,IAAI,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,sBAAsB,CACpB,OAAiB,EACjB,UAAuB,EAAE;QAEzB,OAAO;YACL,GAAG,EAAE,OAAO;YACZ,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ;YACxC,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,2EAA2E;YAC3E,qEAAqE;YACrE,GAAG,EAAE,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;SAC/B,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,oFAAoF;IACpF,kFAAkF;IAClF,4CAA4C;IAC5C,0BAA0B,CAAC,OAAiB,EAAE,SAAiB;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;IACxE,CAAC;IAED,iFAAiF;IACjF,kFAAkF;IAClF,mFAAmF;IACnF,kBAAkB,CAAC,UAAkB;QACnC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrF,CAAC;IAED,oFAAoF;IACpF,+EAA+E;IAC/E,4EAA4E;IAC5E,oBAAoB;QAClB,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACtE,OAAO;YACL,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;YACxE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;SAClF,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,gFAAgF;IAChF,4EAA4E;IAC5E,wEAAwE;IACxE,qFAAqF;IACrF,wBAAwB,CAAC,QAAgB,EAAE,UAAkB;QAC3D,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,aAAa,IAAI,UAAU,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,0BAA0B,CAAC,UAAkB,EAAE,QAAgB;QAC7D,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,IAAI,UAAU,EAAE,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IAED,8EAA8E;IAC9E,gFAAgF;IAChF,qDAAqD;IAC7C,YAAY,GAAkB,IAAI,CAAC;IAE3C,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,0DAA0D;IAC1D,EAAE;IACF,6EAA6E;IAC7E,oEAAoE;IAC5D,mBAAmB;QACzB,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAEhD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE;YAC3C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI;YAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,oEAAoE;gBACpE,0DAA0D,CAC7D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC7B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,qFAAqF;IACrF,6EAA6E;IAC7E,qFAAqF;IACrF,mFAAmF;IACnF,kFAAkF;IAClF,iFAAiF;IACjF,8EAA8E;IAC9E,uDAAuD;IACvD,EAAE;IACF,+EAA+E;IAC/E,8EAA8E;IAC9E,2BAA2B;IACnB,KAAK,CAAC,SAAS,CAAC,IAAc;QACpC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACvD,YAAY,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,kFAAkF;IAClF,4EAA4E;IAC5E,+BAA+B;IACvB,KAAK,CAAC,mBAAmB;QAC/B,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO;QACjC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,gFAAgF;IAChF,2CAA2C;IACnC,KAAK,CAAC,eAAe,CAAC,UAAkB;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAiB,EAAE,UAAuB,EAAE;QACxD,sCAAsC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAE/D,wCAAwC;QACxC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,aAAa,kBAAkB,CAAC,CAAC;QACtE,CAAC;QAED,kFAAkF;QAClF,iFAAiF;QACjF,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;QAC1C,kFAAkF;QAClF,8EAA8E;QAC9E,4EAA4E;QAC5E,2EAA2E;QAC3E,+EAA+E;QAC/E,MAAM,cAAc,GAAG,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;QAExF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,8DAA8D;YAC9D,IAAI,YAAY,GAAQ,IAAI,CAAC;YAE7B,8EAA8E;YAC9E,iFAAiF;YACjF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;gBAClC,QAAQ,GAAG,IAAI,CAAC;gBAChB,4CAA4C;gBAC5C,IAAI,YAAY,IAAI,OAAO,YAAY,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC/D,YAAY,CAAC,OAAO,EAAE,CAAC;gBACzB,CAAC;gBACD,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,OAAO,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC;YACzE,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,CAAC;YAEpB,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;gBACzD,IAAI,GAAG,EAAE,CAAC;oBACR,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,CAAC;gBAED,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBAC3D,CAAC;gBAED,6CAA6C;gBAC7C,YAAY,GAAG,MAAM,CAAC;gBAEtB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,eAAe,GAAG,KAAK,CAAC;gBAE5B,wEAAwE;gBACxE,wEAAwE;gBACxE,+BAA+B;gBAC/B,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAE7B,MAAM,aAAa,GAAG,GAAG,EAAE;oBACzB,uCAAuC;oBACvC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;wBAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB;wBACvD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;wBAE3C,kCAAkC;wBAClC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,CAAC;4BACpC,MAAM;wBACR,CAAC;wBAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBAClE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;wBAEvC,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;4BACrB,SAAS;4BACT,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;gCACpC,MAAM,IAAI,OAAO,CAAC;gCAClB,IAAI,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;oCACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;oCAC1C,eAAe,GAAG,IAAI,CAAC;gCACzB,CAAC;4BACH,CAAC;wBACH,CAAC;6BAAM,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;4BAC5B,SAAS;4BACT,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;gCACpC,MAAM,IAAI,OAAO,CAAC;gCAClB,IAAI,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;oCACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;oCAC1C,eAAe,GAAG,IAAI,CAAC;gCACzB,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAClC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;oBACxC,aAAa,EAAE,CAAC;gBAClB,CAAC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;oBAC1B,IAAI,QAAQ;wBAAE,OAAO;oBACrB,YAAY,CAAC,KAAK,CAAC,CAAC;oBAEpB,6BAA6B;oBAC7B,aAAa,EAAE,CAAC;oBAEhB,iEAAiE;oBACjE,kEAAkE;oBAClE,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACxD,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBACjC,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;4BACpC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;4BAC1C,eAAe,GAAG,IAAI,CAAC;wBACzB,CAAC;oBACH,CAAC;oBAED,IAAI,CAAC;wBACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;wBAE3C,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,IAAI,CAAC,CAAC;wBAC7C,2EAA2E;wBAC3E,2EAA2E;wBAC3E,qEAAqE;wBACrE,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;4BACzC,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,OAAO,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC;wBAChF,CAAC;wBAED,IAAI,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;wBAChC,IAAI,eAAe,EAAE,CAAC;4BACpB,WAAW,IAAI,8CAA8C,CAAC;wBAChE,CAAC;wBAED,OAAO,CAAC;4BACN,MAAM,EAAE,WAAW;4BACnB,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;4BACrB,QAAQ;yBACT,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,WAAW,EAAE,CAAC;wBACrB,OAAO,CAAC;4BACN,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;4BACrB,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;4BACrB,QAAQ,EAAE,CAAC,CAAC;yBACb,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,SAAgB,EAAE,EAAE;oBACtC,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,SAAS,CAAC,CAAC;gBACpB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,OAAe;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAE/D,wCAAwC;QACxC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,aAAa,kBAAkB,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAEjC,iCAAiC;QACjC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEzC,IAAI,CAAC;YACH,6BAA6B;YAC7B,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAEjC,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;YAE1E,6EAA6E;YAC7E,yEAAyE;YACzE,gFAAgF;YAChF,uDAAuD;YACvD,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,qBAAqB;YACrB,IAAI,CAAC;gBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB,EAAE,QAAgB;QAC1D,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1E,+EAA+E;QAC/E,4EAA4E;QAC5E,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAkB,EAAE,QAAgB;QACvD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,UAAuB,EAAE;QAC3D,+EAA+E;QAC/E,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;QAClD,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB;QAEnF,kEAAkE;QAClE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,UAAU,GAAG,0BAA0B,gBAAgB,cAAc,UAAU,GAAG,CAAC;QAEzF,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,UAAU;QACd,wDAAwD;IAC1D,CAAC;CACF"}

package/dist/connectors/resolve-executable.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Shell-free executable resolution that never consults the current directory.
+ *
+ * WHY THIS EXISTS
+ *
+ * Handing a bare program name to child_process.execFile/spawn is not neutral on
+ * Windows. libuv's uv_spawn resolves it with its own search, and from
+ * libuv/src/win/process.c:
+ *
+ *   "- If there's really only a filename, check the current directory for file,
+ *      then search all path directories."
+ *
+ *   if (NeedCurrentDirectoryForExePathW(L"")) {
+ *     // The file is really only a name; look in cwd first, then scan path
+ *
+ * That branch is taken unless the NoDefaultCurrentDirectoryInExePath environment
+ * variable is set, which it is not by default. libuv also appends ".com" before
+ * ".exe" (path_search_walk_ext), so a planted `docker.com` wins over a genuine
+ * `docker.exe` sitting on PATH.
+ *
+ * This matters here specifically: an analyst plausibly runs their AI client from
+ * a directory where a malware sample was unpacked, which makes the process cwd
+ * attacker-influenced. A sample that drops `docker.com` next to itself would then
+ * be executed by this server, on the host, outside the container isolation the
+ * threat model depends on.
+ *
+ * Passing a FULLY QUALIFIED path removes the search entirely. libuv takes its
+ * `file_has_dir` branch (which consults neither cwd nor PATH), and
+ * search_path_join_test zeroes the cwd for an absolute path with a drive letter.
+ *
+ * The resolution below is therefore deliberately stricter than the platform's:
+ * only fully qualified PATH directories are considered, so no candidate can ever
+ * depend on where the process happens to be running.
+ *
+ * SCOPE. This removes cwd-dependent DISCOVERY of the executable. It does not
+ * establish that the resolved binary is trustworthy: a PATH directory writable by
+ * the attacker is still a PATH directory, and DLL search order for the resolved
+ * executable is the Windows loader's business, not ours.
+ */
+export interface ResolveExecutableOptions {
+    /** Raw PATH value. Undefined or empty means "do not guess" — resolution fails. */
+    pathEnv: string | undefined;
+    platform: NodeJS.Platform;
+    /**
+     * Existence/executability probe. Injectable so both platform branches can be
+     * exercised on any runner; defaults to a real filesystem check.
+     */
+    isExecutableFile?: (candidate: string) => boolean;
+}
+/**
+ * True only for a path that resolves identically regardless of the process's
+ * current directory AND current drive.
+ *
+ * `path.win32.isAbsolute()` is NOT usable for this: it returns true for "\tools"
+ * and "/tools", which libuv resolves against the current drive
+ * (search_path_join_test sets cwd_len = 2 for them), leaving cwd in play.
+ */
+export declare function isFullyQualified(entry: string, platform: NodeJS.Platform): boolean;
+/**
+ * Split a raw PATH value into entries.
+ *
+ * Windows PATH entries may be quoted, and a quoted entry may itself contain the
+ * ';' delimiter — a naive split corrupts those. Empty entries are dropped: on
+ * both platforms an empty entry means "the current directory".
+ */
+export declare function splitPathEnv(pathEnv: string | undefined, platform: NodeJS.Platform): string[];
+/**
+ * Candidate filenames to try inside each directory, in libuv's order.
+ *
+ * From path_search_walk_ext: the literal name is tried first ONLY when it
+ * already carries a non-empty extension, then ".com" is appended, then ".exe".
+ * A bare "docker" is therefore never tried as an extensionless file, because
+ * CreateProcess cannot run one.
+ */
+export declare function candidateNames(name: string, platform: NodeJS.Platform): string[];
+/**
+ * Resolve a bare executable name to a fully qualified path using PATH only.
+ *
+ * Returns null when nothing is found. Callers MUST NOT fall back to the bare
+ * name on null: that hands resolution straight back to the cwd-first search
+ * this function exists to bypass.
+ */
+export declare function resolveExecutable(name: string, options: ResolveExecutableOptions): string | null;
+//# sourceMappingURL=resolve-executable.d.ts.map

package/dist/connectors/resolve-executable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-executable.d.ts","sourceRoot":"","sources":["../../src/connectors/resolve-executable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAIH,MAAM,WAAW,wBAAwB;IACvC,kFAAkF;IAClF,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAgBlF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ,GACxB,MAAM,EAAE,CA2CV;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,EAAE,CAgBhF;AAkBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,wBAAwB,GAChC,MAAM,GAAG,IAAI,CAyBf"}