@rndmjoker/proton-mcp 0.4.13 → 0.5.1

package/README.md

@@ -6,7 +6,7 @@ An MCP server for Proton Mail. It talks to a locally running Proton Mail Bridge
 >
 > **Largely AI-generated.** Most of the code, tests and documentation in this repository were written by Anthropic's Claude Opus models. I decide what gets built and how, and I note this on every one of my projects that is largely AI-generated.
 
-**Status: under construction.** Reading works and can be used, and so does signing in through the browser. Labels, moving between folders, read state, trash, drafts and sending all work. Every send asks you first, and that question is enforced by the server rather than requested in a prompt. See [Status](#status) for the details.
+**Status: under construction.** Reading works and can be used, and so does signing in through the browser. Labels, moving between folders, read state, trash, drafts and sending all work. By default every send asks you first, and that question is enforced by the server rather than requested in a prompt; you can allow a tool to act on its own, within bounds you choose. See [Status](#status) for the details.
 
 ## Why everything runs locally
 
@@ -37,13 +37,20 @@ This server therefore runs on your machine as well, started by the AI client as
 | `reply_draft` | Prepares a reply as a draft, with the original quoted |
 | `forward_draft` | Prepares a forward as a draft, attachments and all |
 | `list_drafts` | The drafts, newest first |
-| `send_message` | Composes and sends. Asks you first, always |
+| `send_message` | Composes and sends. Asks you first unless you chose otherwise, see [What the assistant may do](#what-the-assistant-may-do) |
 | `send_reply` | Replies and sends, keeping the conversation intact |
 | `send_forward` | Forwards and sends, attachments and all |
 | `send_draft` | Sends a draft that is already written, exactly as it was stored |
-| `open_configuration` | Hands back the address of the local web interface, with the token that opens it |
+| `open_configuration` | Hands back the address of the local web interface, the same for every running server |
 | `check_for_updates` | Asks npm whether a newer version exists. The only thing here that contacts anything but your own machine, and only when called |
-| `manage_filters` | Reads and changes nothing. Filters are out of this server's reach, so it answers with the way through Proton's own settings page, where you agree to each change |
+| `list_filters` | The names of your Proton Mail filters in the order Proton runs them, read through the browser extension [Proton MCP Helper](#the-browser-extension-for-filters). Also what waits in the extension and its last changes |
+| `get_filters` | One or several filters in full: what each does to matching mail and its whole Sieve script |
+| `propose_filter` | A new filter, or a new version of one, as a Sieve script. You agree in a window of the extension, which shows the whole script and, for a change, what changes |
+| `apply_filter` | Runs a saved filter over the mail already there, after you agree in the same kind of window. On a large mailbox Proton takes hours for that |
+| `reorder_filters` | Moves filters in the order Proton runs them, after you agree to the new order |
+| `delete_filter` | Deletes a filter for good, after you agree. Off until you switch it on. The answer keeps the whole script, so the filter can be set up again |
+| `set_filter_status` | Switches a filter on or off, after you agree. Off until you switch it on |
+| `manage_filters` | Reads and changes nothing. Explains the way through Proton's own settings page, for when the extension is not there |
 
 Every tool that composes a message takes either `text` or `html`, never both: Proton drops the plain text half of a message that carries markup, so the half you confirmed would be the half that never arrived.
 
@@ -53,17 +60,18 @@ The server also tells an assistant how it works, so the rules are not something
 
 Underneath: a held IMAP connection that recovers from a Bridge restart, stable identifiers based on the Message-ID, HTML to text conversion, filtering of the public key Proton attaches to every sent message, and a character budget so a single message cannot exhaust a context window.
 
-There is also a **local web interface**, on `127.0.0.1` only, running for as long as the server does. It is divided into sections, reached from a rail on the left:
+There is also a **local web interface**, on `127.0.0.1` only, at one fixed address: `http://127.0.0.1:7345/` unless `PROTON_MCP_WEB_PORT` says otherwise. Every assistant session starts its own server, and all of them share this one interface and its settings: the first one to start serves it, and when that one stops, the next takes over. Right after an update, a server from before 0.5.0 may still run in a session started earlier and hold that address with an interface of its own; the shared one appears as soon as that session ends, and at once if you restart it. It is divided into sections, reached from a rail on the left:
 
 | Section | What is there |
 | :--- | :--- |
-| Overview | Connection, address, where the password is kept, read-only mode, both Bridge ports, uptime and counters. State only: every control lives in the section it acts on |
+| Overview | Connection, address, where the password is kept, read-only mode, both Bridge ports, whether changes need a PIN, uptime and counters, and every running server with its sign-in. State only: every control lives in the section it acts on |
 | Folders and labels | On its own page, only when asked. They belong to the whole account, so a folder named after a bank gives that away on its own |
 | Bridge | The ports, the pinned certificate, and a button that tries the connection. Ports are stored in `~/.config/proton-mcp/settings.json`; an explicit environment variable wins and the form disappears |
-| Credentials | Where the Bridge password is kept, and signing out, which clears it from every store at once |
+| Credentials | Where the Bridge password is kept, and signing out, which clears it from every store at once and signs out every running server |
+| Permissions | What each tool may do, the bounds on sending without asking, a copy of everything sent, and the PIN that every change in this interface asks for once you set one |
 | Activity | What is running and for how long, plus the last 50 finished calls. Tool names and timings only, never arguments |
 
-One more appears only while a message is waiting for you to confirm it, linked from that question: the message rendered as the recipient will see it, every address in full, every alt text, every attachment. It is the one place this interface shows mail, and it carries no confirm button by design.
+One more page appears only while a message is waiting for you to confirm it, linked from that question: the message rendered as the recipient will see it, every address in full, every alt text, every attachment. It is the one place that shows mail, and it carries no confirm button by design. It is served by the server that asked, on a port of its own, because the message is held in that server's memory and nowhere else.
 
 Before signing in there are two more: the sign-in form, where the address and Bridge password go into the browser rather than into a client configuration or a conversation, with four places to keep the password and the cost of each stated; and the unlock page, which after a restart asks for the master password alone, since the Bridge password is already on disk.
 
@@ -78,9 +86,7 @@ This table says what the server cannot do today. The issue behind each entry say
 | Missing | Tracked in |
 | :--- | :--- |
 | Attachments composed from files on this machine | [#17](https://github.com/RndmJoker/proton-mcp/issues/17) |
-| Choosing per tool what an assistant may do | [#19](https://github.com/RndmJoker/proton-mcp/issues/19) |
 | Choosing in the interface how much markup a message may carry. The levels exist and a caller picks one per message; what is missing is a ceiling the caller cannot raise | [#24](https://github.com/RndmJoker/proton-mcp/issues/24) |
-| A fixed extra recipient the assistant cannot remove | [#18](https://github.com/RndmJoker/proton-mcp/issues/18) |
 
 **Binary attachments** are not returned as text: base64 in the context window would be unusable. `save_attachment` writes one to a directory you name instead, and it is off until you name one, see [Saved attachments](#saved-attachments).
 
@@ -90,7 +96,7 @@ These limits come from the Bridge itself and cannot be worked around:
 
 - **No calendar, no contacts.** Neither flows through the Bridge.
 - **No Proton-specific features.** No message expiration, no password-protected messages to outside recipients.
-- **No access to filters, forwarding rules or account settings.** This is also a deliberate security boundary, see below. An assistant asked about filters gets `manage_filters`, which says so and explains the way through Proton's own settings page.
+- **No forwarding rules and no account settings.** This is also a deliberate security boundary, see below. Filters are within reach through the [browser extension](#filters-through-the-browser-extension), and what a filter may do beyond filing and flags, and deleting or switching one, is yours to allow. Forwarding stays out: Proton does not run it in filters, and its own forwarding setting is out of reach of these tools.
 - **No server-side threading or sorting.** The Bridge supports neither `THREAD` nor `SORT`, so ordering happens in this server, which costs one date read per message before a page can be cut out.
 - **No permanent deletion.** Deleted will mean moved to trash, on purpose.
 
@@ -103,6 +109,8 @@ These limits come from the Bridge itself and cannot be worked around:
 
 ## Installing
 
+Filters additionally need the browser extension, which for now is installed by hand, see [The browser extension for filters](#the-browser-extension-for-filters).
+
 ### Hand it to your assistant
 
 If you already have an AI assistant with a shell, the shortest route is to let it do the work:
@@ -121,7 +129,7 @@ Or hand over the guide, the same way as for the installation:
 Fetch https://raw.githubusercontent.com/RndmJoker/proton-mcp/main/update.md and follow it
 ```
 
-It works out how you installed it, since the three ways look identical from the outside and are updated differently, and it reminds you that the client has to be restarted. Nothing has to be set up again: credentials, the pinned certificate and the ports all survive.
+It works out how you installed it, since the three ways look identical from the outside and are updated differently, and it reminds you that the client has to be restarted. Nothing has to be set up again: credentials, the pinned certificate and the ports all survive. The browser extension, where you installed it, is the exception and is replaced by hand, see [Updating it](#the-browser-extension-for-filters).
 
 ### From npm
 
@@ -211,6 +219,8 @@ If you pick the encrypted file, every later start shows an unlock page asking fo
 
 **Signing in again replaces what was stored.** The password then lives only where you chose last, and every other place is emptied. **Signing out empties all four.** If one of them cannot be emptied, a file the server may not delete for instance, the page says which and how to remove it by hand, because until then the next start signs in with it again.
 
+**With several sessions running**, a password kept in the system keyring or in a file reaches every one of their servers, which reread it whenever you sign in or out. One kept for this session only, or in an encrypted file opened in the interface, stays with the server that shows the interface, because it lives in that server's memory alone. The overview lists every running server with its sign-in, so this is visible rather than puzzling. A server left out says so when a tool needs the sign-in, and names the two ways out: sign in again with the password kept where every server reads it, or end the session whose server shows the interface, so that the next one shows it and asks for what it needs.
+
 #### Without a browser
 
 Environment variables still work and take precedence over anything stored:
@@ -265,13 +275,44 @@ The `sleep` keeps the input open while the answer is on its way. A client signal
 
 You should see your system mailboxes. If instead you get a message saying the Bridge is probably not running, start and unlock the Bridge and try again. The server explains what to do in its error messages rather than printing error codes.
 
+### The browser extension for filters
+
+Optional. Proton keeps filters behind an interface it has not opened to other programs, and the Bridge does not carry them. The extension **Proton MCP Helper** does the work inside the Proton page you are signed in to in Chrome, and a small connector program, which Chrome starts for it, carries the requests between this server and the extension. This server never holds a Proton session or password for it.
+
+**For now it is installed by hand.** It is not in the Chrome Web Store. Every [release](https://github.com/RndmJoker/proton-mcp/releases) carries it as `proton-mcp-helper-<version>-chrome.zip`. Take the one of the release that matches your server, which for `npx -y @rndmjoker/proton-mcp@latest` is the latest.
+
+1. Set up the connector, once per computer:
+
+   ```bash
+   npx -y @rndmjoker/proton-mcp@latest setup-browser
+   ```
+
+   It writes a secret only you can read, a copy of the connector and a launcher under `~/.config/proton-mcp/browser/`, and the file that tells Chrome which program the extension may start. It prints what it wrote. Run it again after Node moved, for example to another version under another path.
+2. Download the zip from the release and unpack it into a folder of its own, somewhere it can stay. Chrome loads the extension from that folder every time it starts, so moving or deleting the folder removes the extension.
+3. Open `chrome://extensions`, switch on Developer mode, choose **Load unpacked** and pick that folder. Its card has to show the id `nfmconelbflppeoolebhcckbmffiokkd`, the only one the connector lets in.
+4. Reload any open Proton tab once, or open `https://mail.proton.me` and sign in.
+
+The extension's popup says whether the connector runs and what waits; when it does not run, it says why. It also holds the extension's own switches for saving, applying, moving, deleting and switching filters without its window, and what a filter may do beyond filing and flags, all off by default, see [Filters, through the browser extension](#filters-through-the-browser-extension). When the extension cannot be reached, the filter tools say so as well, with the cause where it can be told: no setup, Chrome not running, the extension missing or switched off. To take the connector away again, run the same command with `--remove`, and remove the extension in `chrome://extensions`.
+
+**Updating it.** Chrome never updates an extension loaded by hand, and the connector stays the copy `setup-browser` made. So after the server was updated:
+
+1. Run `setup-browser` again, as above. The secret stays, the copy of the connector is replaced.
+2. Download the zip of the new release, empty the folder Chrome loads the extension from, and unpack the zip into it.
+3. In `chrome://extensions`, click the reload arrow on the extension's card, then reload the Proton tab.
+
+When the connector no longer fits the server, the filter tools say so, with these steps.
+
+**The code.** The source of the extension is in [`extension/`](extension/) in this repository, and its [readme](extension/README.md) says how to build it yourself. The zip attached to a release is built from that release's tagged commit, and GitHub attaches the source of the whole repository to every release as well.
+
+Chrome first. Measured on Linux; the setup for macOS and Windows is written but not measured yet. One Chrome profile at a time can serve the server.
+
 ## Security
 
 The content of someone else's email is text written by strangers, and it is handed to a language model that can call tools. A crafted message may try to instruct the assistant. This server assumes that will happen:
 
 - **Message content is marked as untrusted** in every answer, enclosed in markers and separated from anything the server itself says. The markers carry a label drawn per answer, because a fixed one is written down in this repository: a sender could put the closing marker in the body and have everything after it read as though the server wrote it. A label that changes every time cannot be copied. For the same reason a subject, a display name or an attachment name never breaks across lines, however many line breaks it was sent with; the break is shown, not removed.
 - **Nothing is filtered out of the content** and no attempt is made to detect attacks. Such filters pretend to offer safety they cannot deliver.
-- **Sending always requires your confirmation**, enforced in the server rather than in a system prompt. There is no switch to turn it off, and a client that cannot ask the question cannot send.
+- **Sending requires your confirmation by default**, enforced in the server rather than in a system prompt, and a client that cannot ask the question cannot send. You can allow a sending tool to act on its own; the switch is guarded by the PIN when you set one, the environment can fix it either way, and bounds can limit who it may send to, how often and until when.
 - **There will be no permanent deletion**, and no tool that reads or changes filters, forwarding, account or key settings. A hijacked session must not be able to leave behind lasting access.
 - **HTML is never passed through raw** and external content is never fetched. Tracking pixels stay ineffective.
 - **Your mail is not kept on your disk.** No cache, no index, no copies. Anything this server wrote down would be your mail in plain text, outside the encryption you pay Proton for. The one exception is an attachment you have the assistant save, into a directory you chose, for an hour at most, see [Saved attachments](#saved-attachments).
@@ -307,16 +348,16 @@ One more thing worth knowing about drafts: Proton rewrites the thread headers of
 
 Writes need a moment to settle. A move takes roughly fifteen seconds to reconcile with Proton, and until then the Bridge lists the message in both places, so the tools say so rather than reading back an intermediate state and calling it the result. Flags are the exception: those hold immediately.
 
-### Sending, and the question you cannot switch off
+### Sending, and the question before it
 
 Mail is text written by strangers, handed to a model that can call tools. A message can politely ask to be forwarded somewhere, and other projects answer that with a line in a system prompt. **A system prompt is not a security boundary.** This one lives in the server:
 
-- **Nothing is sent without a person saying yes.** The first call never sends. It returns a question through your client naming the sender, every recipient separated into To, Cc and Bcc, and the subject. Only the second call, carrying your answer, sends.
-- **The question is short, and the message is somewhere with room.** It carries no part of the message itself; it links to a page in the local interface where you can read it as the recipient will see it, with every address in full. That split exists because the question used to grow with the message: 74 lines for a newsletter-shaped one, at which point the confirm button sat below the bottom of the dialog and nothing could be sent at all.
+- **By default, nothing is sent without a person saying yes.** The first call never sends. It returns a question through your client naming the sender, every recipient separated into To, Cc and Bcc, and the subject. Only the second call, carrying your answer, sends.
+- **The question is short, and the message is somewhere with room.** It carries no part of the message itself; it links to a page, served by the server that asks, where you can read it as the recipient will see it, with every address in full. That split exists because the question used to grow with the message: 74 lines for a newsletter-shaped one, at which point the confirm button sat below the bottom of the dialog and nothing could be sent at all.
 - **Recipients are never summarised**, however many there are. Seeing three of eight would mean agreeing to a send to five strangers.
 - **The address you confirm is the address the message goes to.** Every recipient is read back through the code that builds the envelope, and refused if it would come out as another address or as none. An address with a character outside ASCII is refused as well: letters from another script can spell a familiar domain, and the message would go to a different one that anyone can register. A domain that really is written with such letters can be given in its `xn--` form, which is then exactly what you confirm.
-- **The answer goes through your client, never through the browser.** That page has no confirm button and will not get one: the address of the interface reaches your assistant, so a control there could be operated by the thing it is supervising.
-- **There is no setting that turns the question off.** Not an environment variable, not an argument, not a mode.
+- **The answer goes through your client, never through the browser.** That page has no confirm button and will not get one: its address travels with the question and so reaches your assistant, so a control there could be operated by the thing it is supervising.
+- **You can switch the question off, per tool, and nobody else can when a PIN is set.** See [What the assistant may do](#what-the-assistant-may-do) below. Off is the default, and an answer the server already asked for always stands: a "no" given after the level changed is still a no.
 - **A client that cannot ask cannot send.** If your client does not support form elicitation, sending is refused and you are pointed at drafts instead. That is deliberately different from the sign-in prompt, which falls back to text: the worst outcome there is an inconvenience, and here it is a message that cannot be recalled. What counts as "can ask" is the capability your client declares, read from the request when the protocol revision carries it there and from the handshake otherwise.
 - **Your yes covers one specific message.** A fingerprint of the sender, every recipient, the subject and the body is sealed with an HMAC whose key exists only in the running process, and it travels with the question. On the way back the fingerprint is recomputed from what is being asked for now. If a single address was added in between, nothing is sent. A confirmation is also bound to the tool that asked, so one cannot be reused for another.
 - **Blind copies stay blind.** They travel in the envelope and never appear in the headers the recipients see. Verified against a real delivery.
@@ -326,6 +367,68 @@ Replying and forwarding exist as sending tools of their own, not just as drafts.
 
 After a send, nothing checks its own work. The Bridge took about six and a half seconds to accept a message and the message appeared over IMAP about three seconds after that, so an immediate look would describe a state that is not the outcome.
 
+### What the assistant may do
+
+Every tool that can be switched has a level, chosen on the Permissions page of the interface or in the environment, which wins:
+
+| Level | What the tool does |
+| :--- | :--- |
+| `off` | Is taken away from the assistant entirely. It disappears from the list your client sees, and a call that arrives anyway is refused |
+| `ask first` | Runs only after you agree: the sending tools ask through your client, the filter tools that change something in a window of the browser extension. These do it by default, and only these can |
+| `act on its own` | Runs without asking. Every other tool does this by default |
+
+**Nothing changes on an upgrade:** the defaults are the behaviour before levels existed, and `delete_filter` and `set_filter_status`, which came later, are off until you switch them on. `open_configuration` and `check_for_updates` are always there and have no level.
+
+In the environment, three lists take tool names or the groups `reading`, `filing`, `writing`, `sending` and `filters`. A tool named on its own wins over its group, and anything contradictory or unknown stops the server at start rather than letting it run with permissions nobody chose:
+
+```
+PROTON_MCP_OFF=trash_messages,send_forward
+PROTON_MCP_ASK_FIRST=send_draft
+PROTON_MCP_ACT_ON_ITS_OWN=send_reply
+```
+
+`PROTON_MCP_READ_ONLY=true` still works and switches every tool that changes something off, whatever else says otherwise.
+
+**Sending without asking costs something, and the Permissions page says so where you switch it on:** your private mail, text written by strangers and a way out are then together with no person in between. A single message can ask for your mailbox to be forwarded, and nobody would see it happen. Three bounds make that smaller, each one optional, set on the same page or in the environment:
+
+| Bound | Environment | What happens outside it |
+| :--- | :--- | :--- |
+| Permitted recipients, full addresses or domains written as `@example.com` | `PROTON_MCP_SEND_ALLOWED` | The send asks first |
+| A maximum per hour, counted per running server | `PROTON_MCP_SEND_MAX_PER_HOUR` | The send asks first |
+| A last day, written YYYY-MM-DD | `PROTON_MCP_ACT_UNTIL` | Every send asks first again |
+
+A send outside a bound becomes a question, not a failure, and the question says which bound held it back. A send that went out without asking says so in its answer, and the overview of the interface lists every tool whose level departs from the default. **Without a PIN, anything on your machine can change these levels, the assistant included**, so set one before you allow sending without asking, or set the levels in the environment.
+
+### A copy of everything sent
+
+One address can receive a copy of every message any sending tool sends: as a blind copy, for a record the recipients do not see, or as Cc, for a second person who sees every send. Set it on the Permissions page or in the environment, which wins:
+
+```
+PROTON_MCP_COPY_TO=archive@example.com
+PROTON_MCP_COPY_AS=bcc
+```
+
+- **It is added before the question is asked**, so it is part of what you confirm, and the question names it as coming from this setting rather than from the assistant.
+- **Nothing the assistant passes removes it.** An address the assistant named itself is not added a second time.
+- **A send without asking carries it too**, and it does not count against the permitted recipients.
+- **Only an address in plain ASCII is accepted**, for the same reason as every other recipient, and more so: this one receives everything.
+
+A field that quietly adds a recipient to every message is what an attacker would most like to set. So the overview shows it whenever it is on, and once a PIN is set, only someone who knows the PIN can change it.
+
+### Filters, through the browser extension
+
+What an assistant can do with filters, and what keeps that in bounds. Each point is held in this server and again in the extension; neither trusts the other's check.
+
+- **Filing and flags, and anything more only where you allow it.** A proposed script has to start with Proton's spam guard, exactly as Proton writes it, and may file into folders and labels and set or clear the read and star flags. Beyond that, each of these is refused until you allow it, on the Permissions page and again in the popup of the extension: moving mail to Trash or Spam, `discard`, `expire`, `reject`, `vacation` and `stop`. Allowed, the window names what it does and what it costs, and a text that goes to a sender has to be written out, with no variable in it. Deleting a filter and switching one on or off are tools of their own, off until you switch them on. `redirect` is refused whatever you allow: Proton does not run it in filters.
+- **Nothing that reads differently from what it does**, whatever you allow: comments other than Proton's own two, the line above the spam guard and the one its filter editor writes above each rule, `text:` blocks and line breaks inside a string, invisible characters, `:regex` and Proton's own `eval` extension, a folder given as a bare number or named by a variable, and anything this check does not know.
+- **You agree in a window of the extension**, by default, before anything is saved, applied, moved, deleted or switched. It shows the account, what the filter does to matching mail, the whole script, and for a change the difference to the stored version; for a move, the new order and a warning where a filter that does something an assistant may not set up changes place. Each window answers only in the tab it was opened in, and only once. Its buttons are locked for a moment and a half whenever it opens or comes to the front, and the one that refuses comes first, so a click meant for another window or a stray Enter does not agree.
+- **Acting without the window takes two switches, and so does every allowed action.** The tool's level on the Permissions page, like the sending tools, and the extension's own switch for that action in its popup. Likewise each action a filter may do beyond filing and flags: allowed on the Permissions page or with `PROTON_MCP_FILTER_ACTIONS`, and again in the popup. The extension's switches are off by default, and then it shows its window whatever the server sends, and refuses what its popup did not allow.
+- **A browser tool an assistant drives cannot reach that window.** Measured with Claude in Chrome: the window is not among its tabs; on a web page there is no way to message the extension; a jump to the window's address from a web page ends on `chrome-extension://invalid/`; reading, finding and screenshots on an extension page fail.
+- **Orders only from this server.** The extension declares no `externally_connectable`, so no web page can send it anything, and its script in the Proton page listens to the extension alone. The connector accepts connections only on a socket file in a directory only you can open, and only after the connection proves it knows the secret from the setup; the connector proves the same back. Every message is checked against a fixed list of seven kinds. Measured: a connection without the secret is cut off at its first request, and nothing reaches the extension. The limit: a program running as you can read the secret. It then meets the window like the server does, unless you turned on the extension's switches.
+- **The right account.** Before anything is read or changed, the extension checks that the Proton page belongs to the account this server is signed in to, and once more right before each change.
+- **What you agreed to, and nothing that changed since.** A change runs only while the filter, or the order, is still as it was when you agreed. A filter that does something you did not allow is neither replaced, applied nor switched on by an assistant. A change tried again after a lost answer first looks whether the first try already worked, so it does not save a filter twice.
+- **Applying takes time.** Proton runs a filter over the existing mail in the background, which on a large mailbox takes hours, and applies no other filter meanwhile. An application you agreed to then waits in the extension, tried again at growing intervals of up to fifteen minutes, for as long as Chrome stays open; saving and moving go through meanwhile. The popup shows what waits and can cancel it, except while it is being tried. Restarting Chrome or the extension drops what waits, and the popup notes each one.
+
 ### What lands on your disk
 
 Only these, all under `~/.config/proton-mcp/` (on Windows `%USERPROFILE%\.config\proton-mcp\`) and all written readable by your account alone:
@@ -333,13 +436,19 @@ Only these, all under `~/.config/proton-mcp/` (on Windows `%USERPROFILE%\.config
 | File | When | What is in it |
 | :--- | :--- | :--- |
 | `known-certificate.json` | On the first connection | The Bridge's certificate and its fingerprint |
-| `settings.json` | When you change the ports or dismiss the notice in the interface | The two Bridge ports, and whether the notice that this is not an official Proton tool was dismissed |
+| `settings.json` | When you change something in the interface | The two Bridge ports, whether the notice that this is not an official Proton tool was dismissed, the PIN as a salted hash, and a counter that tells every running server to reread the stored credentials |
+| `run/instances/` | While servers run | One small file per running server: process id, version, start time, whether it is signed in and as which address, and whether it serves the interface. No password |
 | `credentials.enc` | Only if you chose the encrypted file | Your Bridge password, encrypted with your master password |
 | `env` | Only if you chose the plain file, or put it there yourself | Your Bridge password in plain text |
 | `saved-attachments/` | While attachments are saved | Which files this server saved, so it can delete exactly those again. No content |
+| `browser/secret` | When you run `setup-browser` | The random secret the server and the connector prove to each other |
+| `browser/host/` | When you run `setup-browser` | A copy of the connector and the launcher Chrome starts |
+| `run/browser.sock` | While Chrome runs the connector | The socket the server reaches the connector through. Where the home path is too long for a socket, under `/tmp/proton-mcp-<your user id>/` instead; on Windows a named pipe |
 
 Choosing the system keyring puts the password where the operating system keeps your other passwords, and nothing of it in a file. Choosing "this session only" writes nothing at all.
 
+`setup-browser` also writes the file that tells Chrome which program the extension may start, where Chrome looks for it: `~/.config/google-chrome/NativeMessagingHosts/com.rndmjoker.proton_mcp.json` on Linux, the same name under `~/Library/Application Support/Google/Chrome/NativeMessagingHosts/` on macOS, and on Windows in `browser/` above, named in a registry key under `HKEY_CURRENT_USER`. The extension keeps its switches, what filters may do, its last fifty changes with the filter names, and what waits for Proton, with the script, in its own storage in your Chrome profile; what waits is gone once it ran, was cancelled or Chrome restarted. A proposal waiting for your decision is kept in memory only.
+
 **No mail, no subjects, no sender addresses, no folder names, no search terms.** The activity list in the interface records tool names and timings, in memory only, and is gone when the server stops.
 
 ### Saved attachments
@@ -376,11 +485,13 @@ The directory has to exist; it is not created for you, so that a mistyped path d
 
 It binds to `127.0.0.1` and there is no option to change that. It is not remote access and cannot be made into it. Four defences, each against a specific attack:
 
-- **A token in the URL**, generated per process and never written down. Any other program on your machine can reach `127.0.0.1`; without the token it can do nothing here.
+- **An optional PIN on every change.** Until 0.4.13 a token in the address kept other programs out, but that address reached the assistant, so it kept out everything except the one party the interface is meant to supervise. Set a PIN on the Permissions page and every change there asks for it: the assistant never sees it, so it can open the page but change nothing. It is stored only as a salted scrypt hash, and five wrong attempts lock changes for a minute. **Without a PIN, anything running on your machine can change the settings, an assistant with a browser tool included**, and the interface says so. Type the PIN only into a tab you are using yourself, since a tab an assistant drives at that moment can read what is typed into it. A forgotten PIN is removed by deleting the line `"pin"` from `settings.json`.
 - **A Host header check.** A page on the internet can point its own domain at `127.0.0.1` and have your browser send requests there, which the browser then treats as same-origin with that domain. Only loopback names are accepted. This is DNS rebinding, and it is the attack local servers most often forget.
 - **An Origin check and a per-action CSRF token** on everything that changes something, so a token for one action cannot be replayed against another.
 - **A strict Content-Security-Policy.** Nothing may be loaded from anywhere and nothing can reach the network. The interface also serves no files from disk at all, which removes path traversal as a category rather than guarding against it.
 
+Reading needs nothing: any program on your machine can open the pages, including the one listing your folder names. On a machine shared with other people, keep that in mind.
+
 It shows no message content, with exactly one exception: a message waiting for you to confirm it. That page renders it as the recipient will see it, and lists every address, alt text and attachment. The message is held in memory only, dropped as soon as you answer either way, and gone after fifteen minutes. Somebody else's markup, which a reply carries as its quote, is rendered in a frame with no permissions at all, and images from the internet are not loaded: a tracking pixel must not tell its author that you looked.
 
 ### What you actually expose
@@ -437,7 +548,9 @@ The tests run without a Bridge, so they work in CI. Real credentials and real ma
 ```
 src/
 ├── bridge/       connection handling, certificate pinning, error translation
+├── browser/      the channel to the browser extension: connector, socket, setup
 ├── credentials/  the four places a password can be kept, and the runtime probe
+├── filters/      the check every proposed Sieve script passes, and moving filters
 ├── mail/         listing, reading, searching, identifiers, attachments
 ├── mime/         parsing, HTML to text, budgeting, the parts of a stored draft
 ├── tools/        the MCP tools and their output formatting
@@ -448,19 +561,23 @@ src/
 ├── session.ts    whether we are signed in, and where from
 ├── settings.ts   the Bridge ports, when changed in the interface
 └── server.ts     entry point and transport
+extension/        the browser extension Proton MCP Helper, built with WXT, not in the npm package
 ```
 
 The web interface has one property worth knowing before touching it: `Referrer-Policy` must not be `no-referrer`. Under that policy browsers send `Origin: null`, which the CSRF defence rightly refuses, and the interface then refuses its own forms. The tests set the Origin header themselves and cannot catch it. There is a comment in `src/web/security.ts` and a test asserting the cause.
 
 ### Checks before a pull request
 
-The CI in `.github/workflows/ci.yml` runs the tests, the type check, the build, an audit of the dependencies and a scan for accidentally committed secrets. All of it runs locally too:
+The CI in `.github/workflows/ci.yml` runs the tests, the type check, the build, an audit of the dependencies and a scan for accidentally committed secrets, and type checks and builds the extension. All of it runs locally too:
 
 ```bash
+npm ci --prefix extension             # once: the extension's own dependencies, which its tests need
 npm test
 npm run typecheck
 npm run build
 npm audit --omit=dev
+npm run typecheck --prefix extension
+npm run build --prefix extension
 ```
 
 ### Measured behaviour of the Bridge

package/dist/browser/channel.d.ts

@@ -0,0 +1,76 @@
+/**
+ * The wire under the browser channel (#59): how messages are framed, and how
+ * the two ends of the socket recognise each other.
+ *
+ * Chrome talks to the connector over its standard input and output, each message
+ * a four-byte length in the machine's byte order followed by JSON. The connector
+ * and this server talk over a socket file, one JSON message per line.
+ *
+ * Before anything else on the socket, both ends prove that they know the
+ * secret the setup wrote, without sending it. The connector proves it as well,
+ * not only the server: a program that got to the socket name first could
+ * otherwise collect what the server sends, the account address and the
+ * proposed scripts among it.
+ *
+ * Copied next to the connector by the setup, so it imports nothing but Node.
+ */
+/**
+ * The largest message accepted from Chrome, and the longest line on the
+ * socket. Both have to hold the largest answer the extension may give: a
+ * thousand filters of up to 60,000 characters each, as messages.ts allows.
+ */
+export declare const MAX_FROM_CHROME: number;
+/** Chrome refuses anything larger from a native host and closes the channel. */
+export declare const MAX_TO_CHROME: number;
+/** The longest line accepted on the socket: an answer, which can be as large as one from Chrome. */
+export declare const MAX_LINE: number;
+/**
+ * The longest line the connector takes from a program on the socket. A
+ * request carries at most one script of 60,000 characters and fifty moves,
+ * so anything near this is not one, and is not kept in memory before the
+ * secret is even proven.
+ */
+export declare const MAX_REQUEST_LINE: number;
+export declare class FrameError extends Error {
+}
+/** One message for Chrome: the length, then the JSON. */
+export declare function encodeNative(message: unknown): Buffer;
+/** Reads Chrome's framed messages out of a stream, however the chunks fall. */
+export declare class NativeReader {
+    #private;
+    push(chunk: Buffer): unknown[];
+}
+/**
+ * Splits a socket stream into lines, refusing one that never ends.
+ *
+ * Decodes across chunks: a character of more than one byte can be split
+ * between two of them, and decoding each chunk alone turned a letter such as
+ * an umlaut in a filter name into replacement characters, silently, found in
+ * the review of 06.11.2026.
+ */
+export declare class LineReader {
+    #private;
+    readonly max: number;
+    constructor(max?: number);
+    push(chunk: Buffer | string): string[];
+}
+/** Reads one line as a JSON object, or nothing when it is not one. */
+export declare function parseLine(line: string): Record<string, unknown> | undefined;
+export declare function newNonce(): string;
+/** The proof of one end. The role is part of it, so a proof cannot be reflected back. */
+export declare function proof(secret: Buffer, role: 'client' | 'host', nonce: string): string;
+export declare function proofMatches(secret: Buffer, role: 'client' | 'host', nonce: string, presented: unknown): boolean;
+/** True for a nonce as newNonce makes them. */
+export declare function isNonce(value: unknown): value is string;
+/** The secret from its file, or nothing when there is none or it is not one. */
+export declare function readSecret(file: string): Buffer | undefined;
+/** A directory that is not private enough to hold the socket. */
+export declare class UnsafeDirectory extends Error {
+}
+/**
+ * Creates the directory for the socket, readable by the user only, and refuses
+ * one that somebody else owns, that is a symbolic link, or that others can
+ * open. Only meaningful for socket files; on Windows the pipe has its own
+ * permissions.
+ */
+export declare function ensurePrivateDir(dir: string): void;

package/dist/browser/channel.js

@@ -0,0 +1,162 @@
+/**
+ * The wire under the browser channel (#59): how messages are framed, and how
+ * the two ends of the socket recognise each other.
+ *
+ * Chrome talks to the connector over its standard input and output, each message
+ * a four-byte length in the machine's byte order followed by JSON. The connector
+ * and this server talk over a socket file, one JSON message per line.
+ *
+ * Before anything else on the socket, both ends prove that they know the
+ * secret the setup wrote, without sending it. The connector proves it as well,
+ * not only the server: a program that got to the socket name first could
+ * otherwise collect what the server sends, the account address and the
+ * proposed scripts among it.
+ *
+ * Copied next to the connector by the setup, so it imports nothing but Node.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { endianness } from 'node:os';
+import { StringDecoder } from 'node:string_decoder';
+import { lstatSync, mkdirSync, chmodSync, readFileSync } from 'node:fs';
+/**
+ * The largest message accepted from Chrome, and the longest line on the
+ * socket. Both have to hold the largest answer the extension may give: a
+ * thousand filters of up to 60,000 characters each, as messages.ts allows.
+ */
+export const MAX_FROM_CHROME = 64 * 1024 * 1024;
+/** Chrome refuses anything larger from a native host and closes the channel. */
+export const MAX_TO_CHROME = 1024 * 1024;
+/** The longest line accepted on the socket: an answer, which can be as large as one from Chrome. */
+export const MAX_LINE = MAX_FROM_CHROME;
+/**
+ * The longest line the connector takes from a program on the socket. A
+ * request carries at most one script of 60,000 characters and fifty moves,
+ * so anything near this is not one, and is not kept in memory before the
+ * secret is even proven.
+ */
+export const MAX_REQUEST_LINE = 1024 * 1024;
+const LITTLE = endianness() === 'LE';
+export class FrameError extends Error {
+}
+/** One message for Chrome: the length, then the JSON. */
+export function encodeNative(message) {
+    const body = Buffer.from(JSON.stringify(message), 'utf8');
+    if (body.length > MAX_TO_CHROME)
+        throw new FrameError(`A message of ${body.length} bytes is more than Chrome accepts.`);
+    const head = Buffer.alloc(4);
+    if (LITTLE)
+        head.writeUInt32LE(body.length);
+    else
+        head.writeUInt32BE(body.length);
+    return Buffer.concat([head, body]);
+}
+/** Reads Chrome's framed messages out of a stream, however the chunks fall. */
+export class NativeReader {
+    #buffer = Buffer.alloc(0);
+    push(chunk) {
+        this.#buffer = Buffer.concat([this.#buffer, chunk]);
+        const messages = [];
+        for (;;) {
+            if (this.#buffer.length < 4)
+                return messages;
+            const length = LITTLE ? this.#buffer.readUInt32LE(0) : this.#buffer.readUInt32BE(0);
+            if (length > MAX_FROM_CHROME)
+                throw new FrameError(`A message of ${length} bytes is more than the connector accepts.`);
+            if (this.#buffer.length < 4 + length)
+                return messages;
+            const body = this.#buffer.subarray(4, 4 + length).toString('utf8');
+            this.#buffer = this.#buffer.subarray(4 + length);
+            try {
+                messages.push(JSON.parse(body));
+            }
+            catch {
+                throw new FrameError('A message from Chrome was not JSON.');
+            }
+        }
+    }
+}
+/**
+ * Splits a socket stream into lines, refusing one that never ends.
+ *
+ * Decodes across chunks: a character of more than one byte can be split
+ * between two of them, and decoding each chunk alone turned a letter such as
+ * an umlaut in a filter name into replacement characters, silently, found in
+ * the review of 06.11.2026.
+ */
+export class LineReader {
+    max;
+    #pending = '';
+    #decoder = new StringDecoder('utf8');
+    constructor(max = MAX_LINE) {
+        this.max = max;
+    }
+    push(chunk) {
+        this.#pending += typeof chunk === 'string' ? chunk : this.#decoder.write(chunk);
+        const lines = this.#pending.split('\n');
+        this.#pending = lines.pop() ?? '';
+        if (this.#pending.length > this.max)
+            throw new FrameError('A line on the socket is longer than accepted.');
+        return lines.filter((line) => line.trim().length > 0);
+    }
+}
+/** Reads one line as a JSON object, or nothing when it is not one. */
+export function parseLine(line) {
+    try {
+        const value = JSON.parse(line);
+        return typeof value === 'object' && value !== null && !Array.isArray(value)
+            ? value
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function newNonce() {
+    return randomBytes(32).toString('hex');
+}
+/** The proof of one end. The role is part of it, so a proof cannot be reflected back. */
+export function proof(secret, role, nonce) {
+    return createHmac('sha256', secret).update(`proton-mcp-browser:${role}:${nonce}`).digest('hex');
+}
+export function proofMatches(secret, role, nonce, presented) {
+    if (typeof presented !== 'string' || !/^[0-9a-f]{64}$/.test(presented))
+        return false;
+    return timingSafeEqual(Buffer.from(proof(secret, role, nonce), 'hex'), Buffer.from(presented, 'hex'));
+}
+/** True for a nonce as newNonce makes them. */
+export function isNonce(value) {
+    return typeof value === 'string' && /^[0-9a-f]{64}$/.test(value);
+}
+/** The secret from its file, or nothing when there is none or it is not one. */
+export function readSecret(file) {
+    try {
+        const text = readFileSync(file, 'utf8').trim();
+        return /^[0-9a-f]{64}$/.test(text) ? Buffer.from(text, 'hex') : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A directory that is not private enough to hold the socket. */
+export class UnsafeDirectory extends Error {
+}
+/**
+ * Creates the directory for the socket, readable by the user only, and refuses
+ * one that somebody else owns, that is a symbolic link, or that others can
+ * open. Only meaningful for socket files; on Windows the pipe has its own
+ * permissions.
+ */
+export function ensurePrivateDir(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(dir);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new UnsafeDirectory(`${dir} is not a plain directory, so the socket is not placed there.`);
+    }
+    const uid = process.getuid?.();
+    if (uid !== undefined && stat.uid !== uid) {
+        throw new UnsafeDirectory(`${dir} belongs to another user, so the socket is not placed there.`);
+    }
+    if ((stat.mode & 0o077) !== 0)
+        chmodSync(dir, 0o700);
+}
+//# sourceMappingURL=channel.js.map

package/dist/browser/channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.js","sourceRoot":"","sources":["../../src/browser/channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAE/C,gFAAgF;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,CAAA;AAExC,oGAAoG;AACpG,MAAM,CAAC,MAAM,QAAQ,GAAG,eAAe,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAA;AAE3C,MAAM,MAAM,GAAG,UAAU,EAAE,KAAK,IAAI,CAAA;AAEpC,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AAExC,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa;QAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,IAAI,CAAC,MAAM,qCAAqC,CAAC,CAAA;IACvH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5B,IAAI,MAAM;QAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;;QACtC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AACpC,CAAC;AAED,+EAA+E;AAC/E,MAAM,OAAO,YAAY;IACvB,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEzB,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAc,EAAE,CAAA;QAC9B,SAAS,CAAC;YACR,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,QAAQ,CAAA;YAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;YACnF,IAAI,MAAM,GAAG,eAAe;gBAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,MAAM,4CAA4C,CAAC,CAAA;YACtH,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM;gBAAE,OAAO,QAAQ,CAAA;YACrD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAClE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,CAAA;YAChD,IAAI,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,UAAU,CAAC,qCAAqC,CAAC,CAAA;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,UAAU;IAIA,GAAG;IAHxB,QAAQ,GAAG,EAAE,CAAA;IACJ,QAAQ,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;IAE7C,YAAqB,GAAG,GAAW,QAAQ;mBAAtB,GAAG;IAAsB,CAAC;IAE/C,IAAI,CAAC,KAAsB;QACzB,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACvC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAA;QACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,UAAU,CAAC,+CAA+C,CAAC,CAAA;QAC1G,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACvD,CAAC;CACF;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACzE,CAAC,CAAE,KAAiC;YACpC,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,IAAuB,EAAE,KAAa;IAC1E,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,sBAAsB,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjG,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAuB,EAAE,KAAa,EAAE,SAAkB;IACrG,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IACpF,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAA;AACvG,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAClE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QAC9C,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,OAAO,eAAgB,SAAQ,KAAK;CAAG;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,eAAe,CAAC,GAAG,GAAG,+DAA+D,CAAC,CAAA;IAClG,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAA;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,GAAG,GAAG,8DAA8D,CAAC,CAAA;IACjG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AACtD,CAAC"}