@roarkanalytics/sdk-mcp 4.12.0 → 4.12.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [4.12.1](https://github.com/roarkhq/mcp-roark-analytics/compare/v4.12.0...v4.12.1) (2026-09-29)
+
+
+### Bug Fixes
+
+* **mcp:** every execute call failed, the Deno sandbox never started ([#130](https://github.com/roarkhq/mcp-roark-analytics/issues/130)) ([1918fad](https://github.com/roarkhq/mcp-roark-analytics/commit/1918fad06fdf331bfc66b0bb4f4a99c8489bfb18))
+
 ## [4.12.0](https://github.com/roarkhq/mcp-roark-analytics/compare/v4.11.1...v4.12.0) (2026-09-29)
 
 

package/code-tool.d.mts

@@ -18,13 +18,25 @@ export declare function codeTool({ blockedMethods, codeExecutionMode, }: {
     blockedMethods: SdkMethod[] | undefined;
     codeExecutionMode: McpCodeExecutionMode;
 }): McpTool;
+export declare const denoAcceptsUnixAllowNet: (denoPath: string, probe: (command: string, args: string[]) => {
+    status: number | null;
+}) => boolean;
 /**
- * Adds the worker's Unix socket to the existing `--allow-net` allowlist.
+ * Grants the Deno worker its own Unix socket, and nothing else.
  *
- * deno-http-worker generates the socket path itself and passes it to the Deno
- * process, so it can only be read off the spawn arguments. Throws rather than
- * falling back to an unrestricted `--allow-net`, so a change in how the socket is
- * passed fails closed instead of silently widening what the sandbox can reach.
+ * deno-http-worker generates the socket path while it builds the spawn arguments, so
+ * this is the first point at which it can be read at all. Two things happen here:
+ *
+ * - The socket is added to `--allow-net` only on the Deno versions that require it
+ *   (see denoAcceptsUnixAllowNet). Adding it unconditionally is what broke the
+ *   published image, whose Deno rejected the syntax and exited before serving
+ *   anything, surfacing only as the far vaguer "Deno exited before being ready".
+ * - The grant deno-http-worker makes itself, `--allow-read`/`--allow-write` on the
+ *   socket, is asserted rather than assumed, so a future version that stops making
+ *   it fails here instead of at runtime.
+ *
+ * Throws rather than falling back to an unrestricted `--allow-net`, so anything
+ * unexpected fails closed instead of silently widening what the sandbox can reach.
  */
-export declare const scopeAllowNetToWorkerSocket: (spawnArgs: string[]) => string[];
+export declare const scopeAllowNetToWorkerSocket: (spawnArgs: string[], addSocketToAllowNet: boolean) => string[];
 //# sourceMappingURL=code-tool.d.mts.map

package/code-tool.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"code-tool.d.mts","sourceRoot":"","sources":["src/code-tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,OAAO,EAKR,oBAAgB;AAKjB,OAAO,EAAE,SAAS,EAAE,sBAAkB;AACtC,OAAO,EAAE,oBAAoB,EAAE,sBAAkB;AA8BjD;;;;;;;;;;;;GAYG;AACH,wBAAgB,QAAQ,CAAC,EACvB,cAAc,EACd,iBAAiB,GAClB,EAAE;IACD,cAAc,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;IACxC,iBAAiB,EAAE,oBAAoB,CAAC;CACzC,GAAG,OAAO,CAuEV;AAsED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GAAI,WAAW,MAAM,EAAE,KAAG,MAAM,EAUvE,CAAC"}
+{"version":3,"file":"code-tool.d.mts","sourceRoot":"","sources":["src/code-tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,OAAO,EAKR,oBAAgB;AAKjB,OAAO,EAAE,SAAS,EAAE,sBAAkB;AACtC,OAAO,EAAE,oBAAoB,EAAE,sBAAkB;AA8BjD;;;;;;;;;;;;GAYG;AACH,wBAAgB,QAAQ,CAAC,EACvB,cAAc,EACd,iBAAiB,GAClB,EAAE;IACD,cAAc,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;IACxC,iBAAiB,EAAE,oBAAoB,CAAC;CACzC,GAAG,OAAO,CAuEV;AA0FD,eAAO,MAAM,uBAAuB,GAClC,UAAU,MAAM,EAChB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KACpE,OAuBF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,2BAA2B,GAAI,WAAW,MAAM,EAAE,EAAE,qBAAqB,OAAO,KAAG,MAAM,EAuBrG,CAAC"}

package/code-tool.d.ts

@@ -18,13 +18,25 @@ export declare function codeTool({ blockedMethods, codeExecutionMode, }: {
     blockedMethods: SdkMethod[] | undefined;
     codeExecutionMode: McpCodeExecutionMode;
 }): McpTool;
+export declare const denoAcceptsUnixAllowNet: (denoPath: string, probe: (command: string, args: string[]) => {
+    status: number | null;
+}) => boolean;
 /**
- * Adds the worker's Unix socket to the existing `--allow-net` allowlist.
+ * Grants the Deno worker its own Unix socket, and nothing else.
  *
- * deno-http-worker generates the socket path itself and passes it to the Deno
- * process, so it can only be read off the spawn arguments. Throws rather than
- * falling back to an unrestricted `--allow-net`, so a change in how the socket is
- * passed fails closed instead of silently widening what the sandbox can reach.
+ * deno-http-worker generates the socket path while it builds the spawn arguments, so
+ * this is the first point at which it can be read at all. Two things happen here:
+ *
+ * - The socket is added to `--allow-net` only on the Deno versions that require it
+ *   (see denoAcceptsUnixAllowNet). Adding it unconditionally is what broke the
+ *   published image, whose Deno rejected the syntax and exited before serving
+ *   anything, surfacing only as the far vaguer "Deno exited before being ready".
+ * - The grant deno-http-worker makes itself, `--allow-read`/`--allow-write` on the
+ *   socket, is asserted rather than assumed, so a future version that stops making
+ *   it fails here instead of at runtime.
+ *
+ * Throws rather than falling back to an unrestricted `--allow-net`, so anything
+ * unexpected fails closed instead of silently widening what the sandbox can reach.
  */
-export declare const scopeAllowNetToWorkerSocket: (spawnArgs: string[]) => string[];
+export declare const scopeAllowNetToWorkerSocket: (spawnArgs: string[], addSocketToAllowNet: boolean) => string[];
 //# sourceMappingURL=code-tool.d.ts.map

package/code-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-tool.d.ts","sourceRoot":"","sources":["src/code-tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,OAAO,EAKR,mBAAgB;AAKjB,OAAO,EAAE,SAAS,EAAE,qBAAkB;AACtC,OAAO,EAAE,oBAAoB,EAAE,qBAAkB;AA8BjD;;;;;;;;;;;;GAYG;AACH,wBAAgB,QAAQ,CAAC,EACvB,cAAc,EACd,iBAAiB,GAClB,EAAE;IACD,cAAc,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;IACxC,iBAAiB,EAAE,oBAAoB,CAAC;CACzC,GAAG,OAAO,CAuEV;AAsED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GAAI,WAAW,MAAM,EAAE,KAAG,MAAM,EAUvE,CAAC"}
+{"version":3,"file":"code-tool.d.ts","sourceRoot":"","sources":["src/code-tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,OAAO,EAKR,mBAAgB;AAKjB,OAAO,EAAE,SAAS,EAAE,qBAAkB;AACtC,OAAO,EAAE,oBAAoB,EAAE,qBAAkB;AA8BjD;;;;;;;;;;;;GAYG;AACH,wBAAgB,QAAQ,CAAC,EACvB,cAAc,EACd,iBAAiB,GAClB,EAAE;IACD,cAAc,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;IACxC,iBAAiB,EAAE,oBAAoB,CAAC;CACzC,GAAG,OAAO,CAuEV;AA0FD,eAAO,MAAM,uBAAuB,GAClC,UAAU,MAAM,EAChB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KACpE,OAuBF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,2BAA2B,GAAI,WAAW,MAAM,EAAE,EAAE,qBAAqB,OAAO,KAAG,MAAM,EAuBrG,CAAC"}

package/code-tool.js

@@ -34,7 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.scopeAllowNetToWorkerSocket = void 0;
+exports.scopeAllowNetToWorkerSocket = exports.denoAcceptsUnixAllowNet = void 0;
 exports.codeTool = codeTool;
 const types_1 = require("./types.js");
 const util_1 = require("./util.js");
@@ -181,20 +181,80 @@ const remoteStainlessHandler = async ({ reqContext, args, }) => {
 /** Suffix deno-http-worker gives the Unix socket it creates for each worker. */
 const DENO_WORKER_SOCKET_SUFFIX = '-deno-http.sock';
 /**
- * Adds the worker's Unix socket to the existing `--allow-net` allowlist.
+ * Whether this Deno wants the worker's Unix socket named in `--allow-net`.
  *
- * deno-http-worker generates the socket path itself and passes it to the Deno
- * process, so it can only be read off the spawn arguments. Throws rather than
- * falling back to an unrestricted `--allow-net`, so a change in how the socket is
- * passed fails closed instead of silently widening what the sandbox can reach.
+ * Deno changed its mind about this, and the two behaviors are mutually exclusive:
+ *
+ *   Deno 2.7 and earlier  a Unix socket is a file. Listening on it is covered by
+ *                         --allow-read/--allow-write on its path, and --allow-net
+ *                         parses every entry as `host[:port]`, so a `unix:` entry
+ *                         is a hard parse error: "invalid port in 'unix:/tmp/...'".
+ *   Deno 2.9 and later    listening additionally requires --allow-net=unix:<path>,
+ *                         and without it the worker dies with NotCapable.
+ *
+ * There is therefore no single flag string that works on both, and this package is
+ * published for users to run against whatever Deno they have. So ask the binary
+ * instead of guessing from a version string: run a no-op script with the flag and
+ * see whether it is accepted. The probe binds nothing (the script is `0`), and the
+ * result is cached per executable because the answer cannot change under us.
  */
-const scopeAllowNetToWorkerSocket = (spawnArgs) => {
+const unixAllowNetSupport = new Map();
+const denoAcceptsUnixAllowNet = (denoPath, probe) => {
+    const cached = unixAllowNetSupport.get(denoPath);
+    if (cached !== undefined)
+        return cached;
+    // A path that is never created: --allow-net is parsed before the script runs, which
+    // is the only thing being tested here.
+    const { status } = probe(denoPath, [
+        'run',
+        '--allow-net=unix:/nonexistent-roark-deno-capability-probe.sock',
+        'data:text/javascript,0',
+    ]);
+    // A null status means the probe never ran at all - the binary could not be spawned,
+    // or it was killed by the timeout or a signal - as opposed to running and rejecting
+    // the flag, which is an exit code. Answer conservatively for this call but do NOT
+    // cache it: a single transient failure would otherwise pin the answer to
+    // "unsupported" for the life of the process, and on Deno 2.9+ that means every
+    // later execute call dies with NotCapable.
+    if (status === null)
+        return false;
+    const accepted = status === 0;
+    unixAllowNetSupport.set(denoPath, accepted);
+    return accepted;
+};
+exports.denoAcceptsUnixAllowNet = denoAcceptsUnixAllowNet;
+/**
+ * Grants the Deno worker its own Unix socket, and nothing else.
+ *
+ * deno-http-worker generates the socket path while it builds the spawn arguments, so
+ * this is the first point at which it can be read at all. Two things happen here:
+ *
+ * - The socket is added to `--allow-net` only on the Deno versions that require it
+ *   (see denoAcceptsUnixAllowNet). Adding it unconditionally is what broke the
+ *   published image, whose Deno rejected the syntax and exited before serving
+ *   anything, surfacing only as the far vaguer "Deno exited before being ready".
+ * - The grant deno-http-worker makes itself, `--allow-read`/`--allow-write` on the
+ *   socket, is asserted rather than assumed, so a future version that stops making
+ *   it fails here instead of at runtime.
+ *
+ * Throws rather than falling back to an unrestricted `--allow-net`, so anything
+ * unexpected fails closed instead of silently widening what the sandbox can reach.
+ */
+const scopeAllowNetToWorkerSocket = (spawnArgs, addSocketToAllowNet) => {
     // Skip flags: deno-http-worker also appends the socket to `--allow-read`/`--allow-write`,
     // so match only the bare path it passes through to the bootstrap script.
     const socketPath = spawnArgs.find((arg) => !arg.startsWith('-') && arg.endsWith(DENO_WORKER_SOCKET_SUFFIX));
     if (socketPath === undefined) {
         throw new Error('Could not find the Deno worker socket path in its spawn arguments, so network access could not be scoped to it.');
     }
+    const grants = (flag) => spawnArgs.some((arg) => arg.startsWith(flag) && arg.slice(flag.length).split(',').includes(socketPath));
+    const missing = ['--allow-read=', '--allow-write='].filter((flag) => !grants(flag));
+    if (missing.length > 0) {
+        throw new Error(`deno-http-worker did not grant the worker socket ${socketPath} on ${missing.join(' or ')}, ` +
+            'so the Deno sandbox would not be able to serve requests.');
+    }
+    if (!addSocketToAllowNet)
+        return spawnArgs;
     return spawnArgs.map((arg) => (arg.startsWith('--allow-net=') ? `${arg},unix:${socketPath}` : arg));
 };
 exports.scopeAllowNetToWorkerSocket = scopeAllowNetToWorkerSocket;
@@ -212,7 +272,7 @@ const localDenoHandler = async ({ reqContext, args, }) => {
     const packageRoot = path.resolve(path.dirname(workerPath), '..');
     const packageNodeModulesPath = path.resolve(packageRoot, 'node_modules');
     // Check if deno is in PATH
-    const { execSync, spawn } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
+    const { execSync, spawn, spawnSync } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
     try {
         execSync('command -v deno', { stdio: 'ignore' });
         denoPath = 'deno';
@@ -247,23 +307,32 @@ const localDenoHandler = async ({ reqContext, args, }) => {
         // Ignore if symlink resolution fails
     }
     const allowRead = allowReadPaths.join(',');
+    const addSocketToAllowNet = (0, exports.denoAcceptsUnixAllowNet)(denoPath, (command, probeArgs) => spawnSync(command, probeArgs, {
+        stdio: 'ignore',
+        // spawnSync blocks, so an unbounded probe would hang the server rather than
+        // fail one call. Deno's first run can populate its cache directory, hence
+        // seconds rather than milliseconds, and DENO_NO_UPDATE_CHECK keeps a version
+        // check off that path.
+        timeout: 10_000,
+        env: { ...process.env, DENO_NO_UPDATE_CHECK: '1' },
+    }));
     const worker = await newDenoHTTPWorker(url.pathToFileURL(workerPath), {
         denoExecutable: denoPath,
         runFlags: [
             `--node-modules-dir=manual`,
             `--allow-read=${allowRead}`,
             // Only the Roark API is reachable from the sandbox. The worker's Unix socket
-            // is added to this same allowlist by scopeAllowNetToWorkerSocket below.
+            // is added to this same allowlist by scopeAllowNetToWorkerSocket below, on the
+            // Deno versions that require it.
             `--allow-net=${baseURLHostname}`,
             // Allow environment variables because instantiating the client will try to read from them,
             // even though they are not set.
             '--allow-env',
         ],
         // deno-http-worker picks the worker's Unix socket path while it builds the spawn
-        // arguments, so it is not known when runFlags are constructed above. Deno gates
-        // listening on a Unix socket behind --allow-net, so intercept the spawn to grant
-        // that one socket rather than opening up network access to every host.
-        spawnFunc: (command, spawnArgs, spawnOptions) => spawn(command, (0, exports.scopeAllowNetToWorkerSocket)(spawnArgs), spawnOptions),
+        // arguments, so it is not known when runFlags are constructed above. Intercept the
+        // spawn to grant that one socket rather than opening up network access to every host.
+        spawnFunc: (command, spawnArgs, spawnOptions) => spawn(command, (0, exports.scopeAllowNetToWorkerSocket)(spawnArgs, addSocketToAllowNet), spawnOptions),
         printOutput: true,
         spawnOptions: {
             cwd: path.dirname(workerPath),

package/code-tool.js.map

@@ -1 +1 @@
-{"version":3,"file":"code-tool.js","sourceRoot":"","sources":["src/code-tool.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DtF,4BA6EC;AAtID,sCAQiB;AAEjB,oCAA+C;AAE/C,wCAAqC;AAKrC,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;gGAyBiF,CAAC;AAEjG;;;;;;;;;;;;GAYG;AACH,SAAgB,QAAQ,CAAC,EACvB,cAAc,EACd,iBAAiB,GAIlB;IACC,MAAM,QAAQ,GAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7E,MAAM,IAAI,GAAS;QACjB,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kBAAkB;iBAChC;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,iEAAiE;iBAC/E;aACF;YACD,QAAQ,EAAE,CAAC,MAAM,CAAC;SACnB;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,IAAA,kBAAS,GAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,KAAK,EAAE,EACrB,UAAU,EACV,IAAI,GAIL,EAA2B,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;QACjC,uEAAuE;QACvE,EAAE;QACF,gFAAgF;QAChF,yFAAyF;QACzF,0FAA0F;QAC1F,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACnG,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAA,qBAAa,EAClB,mGAAmG,cAAc;qBAC9G,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;qBAChC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,MAAsB,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,iBAAiB,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACzD,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAC/D,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,CAAC,IAAI,CACT;YACE,iBAAiB;YACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;SACzC,EACD,gCAAgC,CACjC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,sBAAsB,GAAG,KAAK,EAAE,EACpC,UAAU,EACV,IAAI,GAIL,EAA2B,EAAE;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAA4B,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAEjC,MAAM,gBAAgB,GAAG,IAAA,cAAO,EAAC,wBAAwB,CAAC,IAAI,4CAA4C,CAAC;IAE3G,MAAM,eAAe,GAAG;QACtB,sBAAsB,EAAE,IAAA,mBAAY,EAClC,IAAA,cAAO,EAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,WAAW,EACvD,sFAAsF,CACvF;QACD,cAAc,EAAE,IAAA,cAAO,EAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,IAAI,SAAS;KACzE,CAAC;IACF,kGAAkG;IAClG,MAAM,gBAAgB,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAElF,gFAAgF;IAChF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,GAAG,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC;YAChF,cAAc,EAAE,kBAAkB;YAClC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC;SAChE;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,YAAY,EAAE,iBAAiB;YAC/B,IAAI;YACJ,MAAM;YACN,WAAW,EAAE,EAAE;SACM,CAAC;KACzB,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,MAAM,KACX,GAAG,CAAC,UACN,4DAA4D,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAC;IACtF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG;QACb,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;KAC3C,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,IAAA,qBAAa,EAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,IAAA,2BAAmB,EAAC,MAAM,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAEpD;;;;;;;GAOG;AACI,MAAM,2BAA2B,GAAG,CAAC,SAAmB,EAAY,EAAE;IAC3E,0FAA0F;IAC1F,yEAAyE;IACzE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC5G,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACtG,CAAC,CAAC;AAVW,QAAA,2BAA2B,+BAUtC;AAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,EAC9B,UAAU,EACV,IAAI,GAIL,EAA2B,EAAE;IAC5B,MAAM,EAAE,GAAG,wDAAa,SAAS,GAAC,CAAC;IACnC,MAAM,IAAI,GAAG,wDAAa,WAAW,GAAC,CAAC;IACvC,MAAM,GAAG,GAAG,wDAAa,UAAU,GAAC,CAAC;IACrC,MAAM,EAAE,iBAAiB,EAAE,GAAG,wDAAa,2BAA2B,GAAC,CAAC;IACxE,MAAM,EAAE,aAAa,EAAE,GAAG,wDAAa,uBAAuB,GAAC,CAAC;IAChE,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACjC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;IACzD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAwB,CAAC;IAE1C,IAAI,QAAgB,CAAC;IAErB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,sBAAsB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAEzE,2BAA2B;IAC3B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,wDAAa,oBAAoB,GAAC,CAAC;IAC/D,IAAI,CAAC;QACH,QAAQ,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACpF,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjE,QAAQ,GAAG,mBAAmB,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAA,qBAAa,EAClB,yDAAyD;gBACvD,4DAA4D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG;QACrB,sBAAsB;QACtB,GAAG,UAAU,CAAC,OAAO,CAAC,+BAA+B,EAAE,IAAI,CAAC,GAAG;QAC/D,WAAW;KACZ,CAAC;IAEF,oFAAoF;IACpF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,qBAAqB,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;QACpE,cAAc,EAAE,QAAQ;QACxB,QAAQ,EAAE;YACR,2BAA2B;YAC3B,gBAAgB,SAAS,EAAE;YAC3B,6EAA6E;YAC7E,wEAAwE;YACxE,eAAe,eAAe,EAAE;YAChC,2FAA2F;YAC3F,gCAAgC;YAChC,aAAa;SACd;QACD,iFAAiF;QACjF,gFAAgF;QAChF,iFAAiF;QACjF,uEAAuE;QACvE,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAC9C,KAAK,CAAC,OAAO,EAAE,IAAA,mCAA2B,EAAC,SAAS,CAAC,EAAE,YAAY,CAAC;QACtE,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE;YACZ,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7B,uEAAuE;YACvE,gDAAgD;YAChD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,kBAAkB,EAAE;SAC1D;KACF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3D,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC3C,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;YAEH,6EAA6E;YAC7E,yEAAyE;YACzE,EAAE;YACF,sFAAsF;YACtF,sFAAsF;YACtF,sFAAsF;YACtF,0FAA0F;YAC1F,qEAAqE;YACrE,EAAE;YACF,oFAAoF;YACpF,4EAA4E;YAC5E,MAAM,IAAI,GAAG;gBACX,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjF,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7E,cAAc,EAAE;oBACd,iBAAiB,EAAE,MAAM;iBAC1B;aACgD,CAAC;YAEpD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CACxB,kBAAkB,EAClB;gBACE,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,MAAM,EAAE,MAAM;aACf,EACD,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,IAAI,GAAiB,EAAE,CAAC;gBAC9B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACvB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBACxB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBAClB,OAAO,CACL,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;wBAC3C,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,GAAG;wBAC9B,OAAO,EAAE,IAAI,CAAC,OAAc;qBAC7B,CAAC,CACH,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC1B,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;gBACtB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;oBAChB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiB,CAAC;YAC7E,MAAM,YAAY,GAChB,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtB;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACnE,CACF,CAAC;YACJ,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC3B,CAAC;YACN,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC/C,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;aAChF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiB,CAAC;YAC7E,MAAM,aAAa,GACjB,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtB;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACnE,CACF,CAAC;YACJ,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC3B,CAAC;YACN,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC/C,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;gBAChF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,SAAS,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"code-tool.js","sourceRoot":"","sources":["src/code-tool.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DtF,4BA6EC;AAtID,sCAQiB;AAEjB,oCAA+C;AAE/C,wCAAqC;AAKrC,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;gGAyBiF,CAAC;AAEjG;;;;;;;;;;;;GAYG;AACH,SAAgB,QAAQ,CAAC,EACvB,cAAc,EACd,iBAAiB,GAIlB;IACC,MAAM,QAAQ,GAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7E,MAAM,IAAI,GAAS;QACjB,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kBAAkB;iBAChC;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,iEAAiE;iBAC/E;aACF;YACD,QAAQ,EAAE,CAAC,MAAM,CAAC;SACnB;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,IAAA,kBAAS,GAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,KAAK,EAAE,EACrB,UAAU,EACV,IAAI,GAIL,EAA2B,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;QACjC,uEAAuE;QACvE,EAAE;QACF,gFAAgF;QAChF,yFAAyF;QACzF,0FAA0F;QAC1F,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACnG,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAA,qBAAa,EAClB,mGAAmG,cAAc;qBAC9G,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;qBAChC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,MAAsB,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,iBAAiB,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACzD,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAC/D,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,CAAC,IAAI,CACT;YACE,iBAAiB;YACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;SACzC,EACD,gCAAgC,CACjC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,sBAAsB,GAAG,KAAK,EAAE,EACpC,UAAU,EACV,IAAI,GAIL,EAA2B,EAAE;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAA4B,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAEjC,MAAM,gBAAgB,GAAG,IAAA,cAAO,EAAC,wBAAwB,CAAC,IAAI,4CAA4C,CAAC;IAE3G,MAAM,eAAe,GAAG;QACtB,sBAAsB,EAAE,IAAA,mBAAY,EAClC,IAAA,cAAO,EAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,WAAW,EACvD,sFAAsF,CACvF;QACD,cAAc,EAAE,IAAA,cAAO,EAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,IAAI,SAAS;KACzE,CAAC;IACF,kGAAkG;IAClG,MAAM,gBAAgB,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAElF,gFAAgF;IAChF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,GAAG,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC;YAChF,cAAc,EAAE,kBAAkB;YAClC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC;SAChE;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,YAAY,EAAE,iBAAiB;YAC/B,IAAI;YACJ,MAAM;YACN,WAAW,EAAE,EAAE;SACM,CAAC;KACzB,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,MAAM,KACX,GAAG,CAAC,UACN,4DAA4D,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAC;IACtF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG;QACb,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;KAC3C,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,IAAA,qBAAa,EAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,IAAA,2BAAmB,EAAC,MAAM,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAEpD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAmB,CAAC;AAEhD,MAAM,uBAAuB,GAAG,CACrC,QAAgB,EAChB,KAAqE,EAC5D,EAAE;IACX,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,oFAAoF;IACpF,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE;QACjC,KAAK;QACL,gEAAgE;QAChE,wBAAwB;KACzB,CAAC,CAAC;IAEH,oFAAoF;IACpF,oFAAoF;IACpF,kFAAkF;IAClF,yEAAyE;IACzE,+EAA+E;IAC/E,2CAA2C;IAC3C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC;IAC9B,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AA1BW,QAAA,uBAAuB,2BA0BlC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACI,MAAM,2BAA2B,GAAG,CAAC,SAAmB,EAAE,mBAA4B,EAAY,EAAE;IACzG,0FAA0F;IAC1F,yEAAyE;IACzE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC5G,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAC9B,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAE1G,MAAM,OAAO,GAAG,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,oDAAoD,UAAU,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;YAC3F,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACtG,CAAC,CAAC;AAvBW,QAAA,2BAA2B,+BAuBtC;AAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,EAC9B,UAAU,EACV,IAAI,GAIL,EAA2B,EAAE;IAC5B,MAAM,EAAE,GAAG,wDAAa,SAAS,GAAC,CAAC;IACnC,MAAM,IAAI,GAAG,wDAAa,WAAW,GAAC,CAAC;IACvC,MAAM,GAAG,GAAG,wDAAa,UAAU,GAAC,CAAC;IACrC,MAAM,EAAE,iBAAiB,EAAE,GAAG,wDAAa,2BAA2B,GAAC,CAAC;IACxE,MAAM,EAAE,aAAa,EAAE,GAAG,wDAAa,uBAAuB,GAAC,CAAC;IAChE,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACjC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;IACzD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAwB,CAAC;IAE1C,IAAI,QAAgB,CAAC;IAErB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,sBAAsB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAEzE,2BAA2B;IAC3B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,wDAAa,oBAAoB,GAAC,CAAC;IAC1E,IAAI,CAAC;QACH,QAAQ,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACpF,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjE,QAAQ,GAAG,mBAAmB,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAA,qBAAa,EAClB,yDAAyD;gBACvD,4DAA4D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG;QACrB,sBAAsB;QACtB,GAAG,UAAU,CAAC,OAAO,CAAC,+BAA+B,EAAE,IAAI,CAAC,GAAG;QAC/D,WAAW;KACZ,CAAC;IAEF,oFAAoF;IACpF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,qBAAqB,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,mBAAmB,GAAG,IAAA,+BAAuB,EAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CACnF,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE;QAC5B,KAAK,EAAE,QAAQ;QACf,4EAA4E;QAC5E,0EAA0E;QAC1E,6EAA6E;QAC7E,uBAAuB;QACvB,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE;KACnD,CAAC,CACH,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;QACpE,cAAc,EAAE,QAAQ;QACxB,QAAQ,EAAE;YACR,2BAA2B;YAC3B,gBAAgB,SAAS,EAAE;YAC3B,6EAA6E;YAC7E,+EAA+E;YAC/E,iCAAiC;YACjC,eAAe,eAAe,EAAE;YAChC,2FAA2F;YAC3F,gCAAgC;YAChC,aAAa;SACd;QACD,iFAAiF;QACjF,mFAAmF;QACnF,sFAAsF;QACtF,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAC9C,KAAK,CAAC,OAAO,EAAE,IAAA,mCAA2B,EAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,YAAY,CAAC;QAC3F,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE;YACZ,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7B,uEAAuE;YACvE,gDAAgD;YAChD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,kBAAkB,EAAE;SAC1D;KACF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3D,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC3C,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;YAEH,6EAA6E;YAC7E,yEAAyE;YACzE,EAAE;YACF,sFAAsF;YACtF,sFAAsF;YACtF,sFAAsF;YACtF,0FAA0F;YAC1F,qEAAqE;YACrE,EAAE;YACF,oFAAoF;YACpF,4EAA4E;YAC5E,MAAM,IAAI,GAAG;gBACX,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjF,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7E,cAAc,EAAE;oBACd,iBAAiB,EAAE,MAAM;iBAC1B;aACgD,CAAC;YAEpD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CACxB,kBAAkB,EAClB;gBACE,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,MAAM,EAAE,MAAM;aACf,EACD,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,IAAI,GAAiB,EAAE,CAAC;gBAC9B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACvB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBACxB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBAClB,OAAO,CACL,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;wBAC3C,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,GAAG;wBAC9B,OAAO,EAAE,IAAI,CAAC,OAAc;qBAC7B,CAAC,CACH,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC1B,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;gBACtB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;oBAChB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiB,CAAC;YAC7E,MAAM,YAAY,GAChB,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtB;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACnE,CACF,CAAC;YACJ,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC3B,CAAC;YACN,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC/C,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;aAChF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiB,CAAC;YAC7E,MAAM,aAAa,GACjB,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtB;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACnE,CACF,CAAC;YACJ,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC3B,CAAC;YACN,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC/C,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;gBAChF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,SAAS,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC"}

package/code-tool.mjs

@@ -144,20 +144,79 @@ const remoteStainlessHandler = async ({ reqContext, args, }) => {
 /** Suffix deno-http-worker gives the Unix socket it creates for each worker. */
 const DENO_WORKER_SOCKET_SUFFIX = '-deno-http.sock';
 /**
- * Adds the worker's Unix socket to the existing `--allow-net` allowlist.
+ * Whether this Deno wants the worker's Unix socket named in `--allow-net`.
  *
- * deno-http-worker generates the socket path itself and passes it to the Deno
- * process, so it can only be read off the spawn arguments. Throws rather than
- * falling back to an unrestricted `--allow-net`, so a change in how the socket is
- * passed fails closed instead of silently widening what the sandbox can reach.
+ * Deno changed its mind about this, and the two behaviors are mutually exclusive:
+ *
+ *   Deno 2.7 and earlier  a Unix socket is a file. Listening on it is covered by
+ *                         --allow-read/--allow-write on its path, and --allow-net
+ *                         parses every entry as `host[:port]`, so a `unix:` entry
+ *                         is a hard parse error: "invalid port in 'unix:/tmp/...'".
+ *   Deno 2.9 and later    listening additionally requires --allow-net=unix:<path>,
+ *                         and without it the worker dies with NotCapable.
+ *
+ * There is therefore no single flag string that works on both, and this package is
+ * published for users to run against whatever Deno they have. So ask the binary
+ * instead of guessing from a version string: run a no-op script with the flag and
+ * see whether it is accepted. The probe binds nothing (the script is `0`), and the
+ * result is cached per executable because the answer cannot change under us.
  */
-export const scopeAllowNetToWorkerSocket = (spawnArgs) => {
+const unixAllowNetSupport = new Map();
+export const denoAcceptsUnixAllowNet = (denoPath, probe) => {
+    const cached = unixAllowNetSupport.get(denoPath);
+    if (cached !== undefined)
+        return cached;
+    // A path that is never created: --allow-net is parsed before the script runs, which
+    // is the only thing being tested here.
+    const { status } = probe(denoPath, [
+        'run',
+        '--allow-net=unix:/nonexistent-roark-deno-capability-probe.sock',
+        'data:text/javascript,0',
+    ]);
+    // A null status means the probe never ran at all - the binary could not be spawned,
+    // or it was killed by the timeout or a signal - as opposed to running and rejecting
+    // the flag, which is an exit code. Answer conservatively for this call but do NOT
+    // cache it: a single transient failure would otherwise pin the answer to
+    // "unsupported" for the life of the process, and on Deno 2.9+ that means every
+    // later execute call dies with NotCapable.
+    if (status === null)
+        return false;
+    const accepted = status === 0;
+    unixAllowNetSupport.set(denoPath, accepted);
+    return accepted;
+};
+/**
+ * Grants the Deno worker its own Unix socket, and nothing else.
+ *
+ * deno-http-worker generates the socket path while it builds the spawn arguments, so
+ * this is the first point at which it can be read at all. Two things happen here:
+ *
+ * - The socket is added to `--allow-net` only on the Deno versions that require it
+ *   (see denoAcceptsUnixAllowNet). Adding it unconditionally is what broke the
+ *   published image, whose Deno rejected the syntax and exited before serving
+ *   anything, surfacing only as the far vaguer "Deno exited before being ready".
+ * - The grant deno-http-worker makes itself, `--allow-read`/`--allow-write` on the
+ *   socket, is asserted rather than assumed, so a future version that stops making
+ *   it fails here instead of at runtime.
+ *
+ * Throws rather than falling back to an unrestricted `--allow-net`, so anything
+ * unexpected fails closed instead of silently widening what the sandbox can reach.
+ */
+export const scopeAllowNetToWorkerSocket = (spawnArgs, addSocketToAllowNet) => {
     // Skip flags: deno-http-worker also appends the socket to `--allow-read`/`--allow-write`,
     // so match only the bare path it passes through to the bootstrap script.
     const socketPath = spawnArgs.find((arg) => !arg.startsWith('-') && arg.endsWith(DENO_WORKER_SOCKET_SUFFIX));
     if (socketPath === undefined) {
         throw new Error('Could not find the Deno worker socket path in its spawn arguments, so network access could not be scoped to it.');
     }
+    const grants = (flag) => spawnArgs.some((arg) => arg.startsWith(flag) && arg.slice(flag.length).split(',').includes(socketPath));
+    const missing = ['--allow-read=', '--allow-write='].filter((flag) => !grants(flag));
+    if (missing.length > 0) {
+        throw new Error(`deno-http-worker did not grant the worker socket ${socketPath} on ${missing.join(' or ')}, ` +
+            'so the Deno sandbox would not be able to serve requests.');
+    }
+    if (!addSocketToAllowNet)
+        return spawnArgs;
     return spawnArgs.map((arg) => (arg.startsWith('--allow-net=') ? `${arg},unix:${socketPath}` : arg));
 };
 const localDenoHandler = async ({ reqContext, args, }) => {
@@ -174,7 +233,7 @@ const localDenoHandler = async ({ reqContext, args, }) => {
     const packageRoot = path.resolve(path.dirname(workerPath), '..');
     const packageNodeModulesPath = path.resolve(packageRoot, 'node_modules');
     // Check if deno is in PATH
-    const { execSync, spawn } = await import('node:child_process');
+    const { execSync, spawn, spawnSync } = await import('node:child_process');
     try {
         execSync('command -v deno', { stdio: 'ignore' });
         denoPath = 'deno';
@@ -209,23 +268,32 @@ const localDenoHandler = async ({ reqContext, args, }) => {
         // Ignore if symlink resolution fails
     }
     const allowRead = allowReadPaths.join(',');
+    const addSocketToAllowNet = denoAcceptsUnixAllowNet(denoPath, (command, probeArgs) => spawnSync(command, probeArgs, {
+        stdio: 'ignore',
+        // spawnSync blocks, so an unbounded probe would hang the server rather than
+        // fail one call. Deno's first run can populate its cache directory, hence
+        // seconds rather than milliseconds, and DENO_NO_UPDATE_CHECK keeps a version
+        // check off that path.
+        timeout: 10_000,
+        env: { ...process.env, DENO_NO_UPDATE_CHECK: '1' },
+    }));
     const worker = await newDenoHTTPWorker(url.pathToFileURL(workerPath), {
         denoExecutable: denoPath,
         runFlags: [
             `--node-modules-dir=manual`,
             `--allow-read=${allowRead}`,
             // Only the Roark API is reachable from the sandbox. The worker's Unix socket
-            // is added to this same allowlist by scopeAllowNetToWorkerSocket below.
+            // is added to this same allowlist by scopeAllowNetToWorkerSocket below, on the
+            // Deno versions that require it.
             `--allow-net=${baseURLHostname}`,
             // Allow environment variables because instantiating the client will try to read from them,
             // even though they are not set.
             '--allow-env',
         ],
         // deno-http-worker picks the worker's Unix socket path while it builds the spawn
-        // arguments, so it is not known when runFlags are constructed above. Deno gates
-        // listening on a Unix socket behind --allow-net, so intercept the spawn to grant
-        // that one socket rather than opening up network access to every host.
-        spawnFunc: (command, spawnArgs, spawnOptions) => spawn(command, scopeAllowNetToWorkerSocket(spawnArgs), spawnOptions),
+        // arguments, so it is not known when runFlags are constructed above. Intercept the
+        // spawn to grant that one socket rather than opening up network access to every host.
+        spawnFunc: (command, spawnArgs, spawnOptions) => spawn(command, scopeAllowNetToWorkerSocket(spawnArgs, addSocketToAllowNet), spawnOptions),
         printOutput: true,
         spawnOptions: {
             cwd: path.dirname(workerPath),

package/code-tool.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"code-tool.mjs","sourceRoot":"","sources":["src/code-tool.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAML,aAAa,EACb,mBAAmB,GACpB,oBAAgB;AAEjB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,mBAAe;AAE/C,OAAO,EAAE,SAAS,EAAE,qBAAiB;AAKrC,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;gGAyBiF,CAAC;AAEjG;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CAAC,EACvB,cAAc,EACd,iBAAiB,GAIlB;IACC,MAAM,QAAQ,GAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7E,MAAM,IAAI,GAAS;QACjB,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kBAAkB;iBAChC;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,iEAAiE;iBAC/E;aACF;YACD,QAAQ,EAAE,CAAC,MAAM,CAAC;SACnB;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,KAAK,EAAE,EACrB,UAAU,EACV,IAAI,GAIL,EAA2B,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;QACjC,uEAAuE;QACvE,EAAE;QACF,gFAAgF;QAChF,yFAAyF;QACzF,0FAA0F;QAC1F,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACnG,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,aAAa,CAClB,mGAAmG,cAAc;qBAC9G,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;qBAChC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,MAAsB,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,iBAAiB,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACzD,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAC/D,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,CAAC,IAAI,CACT;YACE,iBAAiB;YACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;SACzC,EACD,gCAAgC,CACjC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,sBAAsB,GAAG,KAAK,EAAE,EACpC,UAAU,EACV,IAAI,GAIL,EAA2B,EAAE;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAA4B,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAEjC,MAAM,gBAAgB,GAAG,OAAO,CAAC,wBAAwB,CAAC,IAAI,4CAA4C,CAAC;IAE3G,MAAM,eAAe,GAAG;QACtB,sBAAsB,EAAE,YAAY,CAClC,OAAO,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,WAAW,EACvD,sFAAsF,CACvF;QACD,cAAc,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,IAAI,SAAS;KACzE,CAAC;IACF,kGAAkG;IAClG,MAAM,gBAAgB,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAElF,gFAAgF;IAChF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,GAAG,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC;YAChF,cAAc,EAAE,kBAAkB;YAClC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC;SAChE;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,YAAY,EAAE,iBAAiB;YAC/B,IAAI;YACJ,MAAM;YACN,WAAW,EAAE,EAAE;SACM,CAAC;KACzB,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,MAAM,KACX,GAAG,CAAC,UACN,4DAA4D,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAC;IACtF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG;QACb,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;KAC3C,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,SAAmB,EAAY,EAAE;IAC3E,0FAA0F;IAC1F,yEAAyE;IACzE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC5G,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACtG,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,EAC9B,UAAU,EACV,IAAI,GAIL,EAA2B,EAAE;IAC5B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACxE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACjC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;IACzD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAwB,CAAC;IAE1C,IAAI,QAAgB,CAAC;IAErB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,sBAAsB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAEzE,2BAA2B;IAC3B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,QAAQ,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACpF,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjE,QAAQ,GAAG,mBAAmB,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAClB,yDAAyD;gBACvD,4DAA4D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG;QACrB,sBAAsB;QACtB,GAAG,UAAU,CAAC,OAAO,CAAC,+BAA+B,EAAE,IAAI,CAAC,GAAG;QAC/D,WAAW;KACZ,CAAC;IAEF,oFAAoF;IACpF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,qBAAqB,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;QACpE,cAAc,EAAE,QAAQ;QACxB,QAAQ,EAAE;YACR,2BAA2B;YAC3B,gBAAgB,SAAS,EAAE;YAC3B,6EAA6E;YAC7E,wEAAwE;YACxE,eAAe,eAAe,EAAE;YAChC,2FAA2F;YAC3F,gCAAgC;YAChC,aAAa;SACd;QACD,iFAAiF;QACjF,gFAAgF;QAChF,iFAAiF;QACjF,uEAAuE;QACvE,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAC9C,KAAK,CAAC,OAAO,EAAE,2BAA2B,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC;QACtE,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE;YACZ,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7B,uEAAuE;YACvE,gDAAgD;YAChD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,kBAAkB,EAAE;SAC1D;KACF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3D,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC3C,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;YAEH,6EAA6E;YAC7E,yEAAyE;YACzE,EAAE;YACF,sFAAsF;YACtF,sFAAsF;YACtF,sFAAsF;YACtF,0FAA0F;YAC1F,qEAAqE;YACrE,EAAE;YACF,oFAAoF;YACpF,4EAA4E;YAC5E,MAAM,IAAI,GAAG;gBACX,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjF,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7E,cAAc,EAAE;oBACd,iBAAiB,EAAE,MAAM;iBAC1B;aACgD,CAAC;YAEpD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CACxB,kBAAkB,EAClB;gBACE,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,MAAM,EAAE,MAAM;aACf,EACD,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,IAAI,GAAiB,EAAE,CAAC;gBAC9B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACvB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBACxB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBAClB,OAAO,CACL,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;wBAC3C,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,GAAG;wBAC9B,OAAO,EAAE,IAAI,CAAC,OAAc;qBAC7B,CAAC,CACH,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC1B,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;gBACtB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;oBAChB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiB,CAAC;YAC7E,MAAM,YAAY,GAChB,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtB;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACnE,CACF,CAAC;YACJ,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC3B,CAAC;YACN,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC/C,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;aAChF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiB,CAAC;YAC7E,MAAM,aAAa,GACjB,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtB;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACnE,CACF,CAAC;YACJ,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC3B,CAAC;YACN,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC/C,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;gBAChF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,SAAS,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"code-tool.mjs","sourceRoot":"","sources":["src/code-tool.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAML,aAAa,EACb,mBAAmB,GACpB,oBAAgB;AAEjB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,mBAAe;AAE/C,OAAO,EAAE,SAAS,EAAE,qBAAiB;AAKrC,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;gGAyBiF,CAAC;AAEjG;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CAAC,EACvB,cAAc,EACd,iBAAiB,GAIlB;IACC,MAAM,QAAQ,GAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7E,MAAM,IAAI,GAAS;QACjB,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kBAAkB;iBAChC;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,iEAAiE;iBAC/E;aACF;YACD,QAAQ,EAAE,CAAC,MAAM,CAAC;SACnB;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,KAAK,EAAE,EACrB,UAAU,EACV,IAAI,GAIL,EAA2B,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;QACjC,uEAAuE;QACvE,EAAE;QACF,gFAAgF;QAChF,yFAAyF;QACzF,0FAA0F;QAC1F,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACnG,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,aAAa,CAClB,mGAAmG,cAAc;qBAC9G,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;qBAChC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,MAAsB,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,iBAAiB,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACzD,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAC/D,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,CAAC,IAAI,CACT;YACE,iBAAiB;YACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;SACzC,EACD,gCAAgC,CACjC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,sBAAsB,GAAG,KAAK,EAAE,EACpC,UAAU,EACV,IAAI,GAIL,EAA2B,EAAE;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAA4B,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAEjC,MAAM,gBAAgB,GAAG,OAAO,CAAC,wBAAwB,CAAC,IAAI,4CAA4C,CAAC;IAE3G,MAAM,eAAe,GAAG;QACtB,sBAAsB,EAAE,YAAY,CAClC,OAAO,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,WAAW,EACvD,sFAAsF,CACvF;QACD,cAAc,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,IAAI,SAAS;KACzE,CAAC;IACF,kGAAkG;IAClG,MAAM,gBAAgB,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAElF,gFAAgF;IAChF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,GAAG,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC;YAChF,cAAc,EAAE,kBAAkB;YAClC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC;SAChE;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,YAAY,EAAE,iBAAiB;YAC/B,IAAI;YACJ,MAAM;YACN,WAAW,EAAE,EAAE;SACM,CAAC;KACzB,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,MAAM,KACX,GAAG,CAAC,UACN,4DAA4D,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAC;IACtF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG;QACb,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;KAC3C,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAEpD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAmB,CAAC;AAEvD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,QAAgB,EAChB,KAAqE,EAC5D,EAAE;IACX,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,oFAAoF;IACpF,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE;QACjC,KAAK;QACL,gEAAgE;QAChE,wBAAwB;KACzB,CAAC,CAAC;IAEH,oFAAoF;IACpF,oFAAoF;IACpF,kFAAkF;IAClF,yEAAyE;IACzE,+EAA+E;IAC/E,2CAA2C;IAC3C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC;IAC9B,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,SAAmB,EAAE,mBAA4B,EAAY,EAAE;IACzG,0FAA0F;IAC1F,yEAAyE;IACzE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC5G,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAC9B,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAE1G,MAAM,OAAO,GAAG,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,oDAAoD,UAAU,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;YAC3F,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACtG,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,EAC9B,UAAU,EACV,IAAI,GAIL,EAA2B,EAAE;IAC5B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACxE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACjC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;IACzD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAwB,CAAC;IAE1C,IAAI,QAAgB,CAAC;IAErB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,sBAAsB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAEzE,2BAA2B;IAC3B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,QAAQ,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACpF,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjE,QAAQ,GAAG,mBAAmB,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAClB,yDAAyD;gBACvD,4DAA4D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG;QACrB,sBAAsB;QACtB,GAAG,UAAU,CAAC,OAAO,CAAC,+BAA+B,EAAE,IAAI,CAAC,GAAG;QAC/D,WAAW;KACZ,CAAC;IAEF,oFAAoF;IACpF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,qBAAqB,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CACnF,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE;QAC5B,KAAK,EAAE,QAAQ;QACf,4EAA4E;QAC5E,0EAA0E;QAC1E,6EAA6E;QAC7E,uBAAuB;QACvB,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE;KACnD,CAAC,CACH,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;QACpE,cAAc,EAAE,QAAQ;QACxB,QAAQ,EAAE;YACR,2BAA2B;YAC3B,gBAAgB,SAAS,EAAE;YAC3B,6EAA6E;YAC7E,+EAA+E;YAC/E,iCAAiC;YACjC,eAAe,eAAe,EAAE;YAChC,2FAA2F;YAC3F,gCAAgC;YAChC,aAAa;SACd;QACD,iFAAiF;QACjF,mFAAmF;QACnF,sFAAsF;QACtF,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAC9C,KAAK,CAAC,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,YAAY,CAAC;QAC3F,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE;YACZ,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7B,uEAAuE;YACvE,gDAAgD;YAChD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,kBAAkB,EAAE;SAC1D;KACF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3D,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC3C,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;YAEH,6EAA6E;YAC7E,yEAAyE;YACzE,EAAE;YACF,sFAAsF;YACtF,sFAAsF;YACtF,sFAAsF;YACtF,0FAA0F;YAC1F,qEAAqE;YACrE,EAAE;YACF,oFAAoF;YACpF,4EAA4E;YAC5E,MAAM,IAAI,GAAG;gBACX,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjF,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7E,cAAc,EAAE;oBACd,iBAAiB,EAAE,MAAM;iBAC1B;aACgD,CAAC;YAEpD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CACxB,kBAAkB,EAClB;gBACE,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,MAAM,EAAE,MAAM;aACf,EACD,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,IAAI,GAAiB,EAAE,CAAC;gBAC9B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACvB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBACxB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBAClB,OAAO,CACL,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;wBAC3C,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,GAAG;wBAC9B,OAAO,EAAE,IAAI,CAAC,OAAc;qBAC7B,CAAC,CACH,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC1B,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;gBACtB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;oBAChB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiB,CAAC;YAC7E,MAAM,YAAY,GAChB,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtB;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACnE,CACF,CAAC;YACJ,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC3B,CAAC;YACN,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC/C,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;aAChF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiB,CAAC;YAC7E,MAAM,aAAa,GACjB,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtB;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACnE,CACF,CAAC;YACJ,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC3B,CAAC;YACN,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBACtB,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC/C,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;gBAChF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,SAAS,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@roarkanalytics/sdk-mcp",
-  "version": "4.12.0",
+  "version": "4.12.1",
   "description": "The official MCP Server for the Roark API",
   "author": "Roark <james@roark.ai>",
   "types": "./index.d.ts",

package/server.js

@@ -19,7 +19,7 @@ const instructions_1 = require("./instructions.js");
 const methods_1 = require("./methods.js");
 const newMcpServer = async ({ stainlessApiKey, customInstructionsPath, }) => new mcp_js_1.McpServer({
     name: 'roarkanalytics_sdk_api',
-    version: '4.12.0', // x-release-please-version
+    version: '4.12.1', // x-release-please-version
 }, {
     instructions: await (0, instructions_1.getInstructions)({ stainlessApiKey, customInstructionsPath }),
     capabilities: { tools: {}, logging: {} },

package/server.mjs

@@ -10,7 +10,7 @@ import { getInstructions } from "./instructions.mjs";
 import { blockedMethodsForCodeTool } from "./methods.mjs";
 export const newMcpServer = async ({ stainlessApiKey, customInstructionsPath, }) => new McpServer({
     name: 'roarkanalytics_sdk_api',
-    version: '4.12.0', // x-release-please-version
+    version: '4.12.1', // x-release-please-version
 }, {
     instructions: await getInstructions({ stainlessApiKey, customInstructionsPath }),
     capabilities: { tools: {}, logging: {} },

package/src/code-tool.ts

@@ -205,14 +205,71 @@ const remoteStainlessHandler = async ({
 const DENO_WORKER_SOCKET_SUFFIX = '-deno-http.sock';
 
 /**
- * Adds the worker's Unix socket to the existing `--allow-net` allowlist.
+ * Whether this Deno wants the worker's Unix socket named in `--allow-net`.
  *
- * deno-http-worker generates the socket path itself and passes it to the Deno
- * process, so it can only be read off the spawn arguments. Throws rather than
- * falling back to an unrestricted `--allow-net`, so a change in how the socket is
- * passed fails closed instead of silently widening what the sandbox can reach.
+ * Deno changed its mind about this, and the two behaviors are mutually exclusive:
+ *
+ *   Deno 2.7 and earlier  a Unix socket is a file. Listening on it is covered by
+ *                         --allow-read/--allow-write on its path, and --allow-net
+ *                         parses every entry as `host[:port]`, so a `unix:` entry
+ *                         is a hard parse error: "invalid port in 'unix:/tmp/...'".
+ *   Deno 2.9 and later    listening additionally requires --allow-net=unix:<path>,
+ *                         and without it the worker dies with NotCapable.
+ *
+ * There is therefore no single flag string that works on both, and this package is
+ * published for users to run against whatever Deno they have. So ask the binary
+ * instead of guessing from a version string: run a no-op script with the flag and
+ * see whether it is accepted. The probe binds nothing (the script is `0`), and the
+ * result is cached per executable because the answer cannot change under us.
+ */
+const unixAllowNetSupport = new Map<string, boolean>();
+
+export const denoAcceptsUnixAllowNet = (
+  denoPath: string,
+  probe: (command: string, args: string[]) => { status: number | null },
+): boolean => {
+  const cached = unixAllowNetSupport.get(denoPath);
+  if (cached !== undefined) return cached;
+
+  // A path that is never created: --allow-net is parsed before the script runs, which
+  // is the only thing being tested here.
+  const { status } = probe(denoPath, [
+    'run',
+    '--allow-net=unix:/nonexistent-roark-deno-capability-probe.sock',
+    'data:text/javascript,0',
+  ]);
+
+  // A null status means the probe never ran at all - the binary could not be spawned,
+  // or it was killed by the timeout or a signal - as opposed to running and rejecting
+  // the flag, which is an exit code. Answer conservatively for this call but do NOT
+  // cache it: a single transient failure would otherwise pin the answer to
+  // "unsupported" for the life of the process, and on Deno 2.9+ that means every
+  // later execute call dies with NotCapable.
+  if (status === null) return false;
+
+  const accepted = status === 0;
+  unixAllowNetSupport.set(denoPath, accepted);
+  return accepted;
+};
+
+/**
+ * Grants the Deno worker its own Unix socket, and nothing else.
+ *
+ * deno-http-worker generates the socket path while it builds the spawn arguments, so
+ * this is the first point at which it can be read at all. Two things happen here:
+ *
+ * - The socket is added to `--allow-net` only on the Deno versions that require it
+ *   (see denoAcceptsUnixAllowNet). Adding it unconditionally is what broke the
+ *   published image, whose Deno rejected the syntax and exited before serving
+ *   anything, surfacing only as the far vaguer "Deno exited before being ready".
+ * - The grant deno-http-worker makes itself, `--allow-read`/`--allow-write` on the
+ *   socket, is asserted rather than assumed, so a future version that stops making
+ *   it fails here instead of at runtime.
+ *
+ * Throws rather than falling back to an unrestricted `--allow-net`, so anything
+ * unexpected fails closed instead of silently widening what the sandbox can reach.
  */
-export const scopeAllowNetToWorkerSocket = (spawnArgs: string[]): string[] => {
+export const scopeAllowNetToWorkerSocket = (spawnArgs: string[], addSocketToAllowNet: boolean): string[] => {
   // Skip flags: deno-http-worker also appends the socket to `--allow-read`/`--allow-write`,
   // so match only the bare path it passes through to the bootstrap script.
   const socketPath = spawnArgs.find((arg) => !arg.startsWith('-') && arg.endsWith(DENO_WORKER_SOCKET_SUFFIX));
@@ -221,6 +278,19 @@ export const scopeAllowNetToWorkerSocket = (spawnArgs: string[]): string[] => {
       'Could not find the Deno worker socket path in its spawn arguments, so network access could not be scoped to it.',
     );
   }
+
+  const grants = (flag: string) =>
+    spawnArgs.some((arg) => arg.startsWith(flag) && arg.slice(flag.length).split(',').includes(socketPath));
+
+  const missing = ['--allow-read=', '--allow-write='].filter((flag) => !grants(flag));
+  if (missing.length > 0) {
+    throw new Error(
+      `deno-http-worker did not grant the worker socket ${socketPath} on ${missing.join(' or ')}, ` +
+        'so the Deno sandbox would not be able to serve requests.',
+    );
+  }
+
+  if (!addSocketToAllowNet) return spawnArgs;
   return spawnArgs.map((arg) => (arg.startsWith('--allow-net=') ? `${arg},unix:${socketPath}` : arg));
 };
 
@@ -248,7 +318,7 @@ const localDenoHandler = async ({
   const packageNodeModulesPath = path.resolve(packageRoot, 'node_modules');
 
   // Check if deno is in PATH
-  const { execSync, spawn } = await import('node:child_process');
+  const { execSync, spawn, spawnSync } = await import('node:child_process');
   try {
     execSync('command -v deno', { stdio: 'ignore' });
     denoPath = 'deno';
@@ -286,24 +356,36 @@ const localDenoHandler = async ({
 
   const allowRead = allowReadPaths.join(',');
 
+  const addSocketToAllowNet = denoAcceptsUnixAllowNet(denoPath, (command, probeArgs) =>
+    spawnSync(command, probeArgs, {
+      stdio: 'ignore',
+      // spawnSync blocks, so an unbounded probe would hang the server rather than
+      // fail one call. Deno's first run can populate its cache directory, hence
+      // seconds rather than milliseconds, and DENO_NO_UPDATE_CHECK keeps a version
+      // check off that path.
+      timeout: 10_000,
+      env: { ...process.env, DENO_NO_UPDATE_CHECK: '1' },
+    }),
+  );
+
   const worker = await newDenoHTTPWorker(url.pathToFileURL(workerPath), {
     denoExecutable: denoPath,
     runFlags: [
       `--node-modules-dir=manual`,
       `--allow-read=${allowRead}`,
       // Only the Roark API is reachable from the sandbox. The worker's Unix socket
-      // is added to this same allowlist by scopeAllowNetToWorkerSocket below.
+      // is added to this same allowlist by scopeAllowNetToWorkerSocket below, on the
+      // Deno versions that require it.
       `--allow-net=${baseURLHostname}`,
       // Allow environment variables because instantiating the client will try to read from them,
       // even though they are not set.
       '--allow-env',
     ],
     // deno-http-worker picks the worker's Unix socket path while it builds the spawn
-    // arguments, so it is not known when runFlags are constructed above. Deno gates
-    // listening on a Unix socket behind --allow-net, so intercept the spawn to grant
-    // that one socket rather than opening up network access to every host.
+    // arguments, so it is not known when runFlags are constructed above. Intercept the
+    // spawn to grant that one socket rather than opening up network access to every host.
     spawnFunc: (command, spawnArgs, spawnOptions) =>
-      spawn(command, scopeAllowNetToWorkerSocket(spawnArgs), spawnOptions),
+      spawn(command, scopeAllowNetToWorkerSocket(spawnArgs, addSocketToAllowNet), spawnOptions),
     printOutput: true,
     spawnOptions: {
       cwd: path.dirname(workerPath),

package/src/server.ts

@@ -28,7 +28,7 @@ export const newMcpServer = async ({
   new McpServer(
     {
       name: 'roarkanalytics_sdk_api',
-      version: '4.12.0', // x-release-please-version
+      version: '4.12.1', // x-release-please-version
     },
     {
       instructions: await getInstructions({ stainlessApiKey, customInstructionsPath }),