@the-open-engine/zeroshot 6.39.0 → 6.39.1

package/src/copy-containment.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CopyContainmentError = exports.CONTAINMENT_ERROR_CODE = void 0;
+exports.isCopyRecord = isCopyRecord;
+exports.copyErrorCode = copyErrorCode;
+exports.validateRelativePath = validateRelativePath;
+exports.resolveSourcePath = resolveSourcePath;
+exports.createCopyBoundary = createCopyBoundary;
+exports.resolveCopyPath = resolveCopyPath;
+exports.isCopyContainmentError = isCopyContainmentError;
+exports.copyErrorFromPayload = copyErrorFromPayload;
+const fs = require("fs");
+const path = require("path");
+exports.CONTAINMENT_ERROR_CODE = 'ERR_COPY_CONTAINMENT';
+class CopyContainmentError extends Error {
+    code = exports.CONTAINMENT_ERROR_CODE;
+    relativePath;
+    constructor(relativePath, reason) {
+        super(`Copy containment violation for ${JSON.stringify(relativePath)}: ${reason}`);
+        this.name = 'CopyContainmentError';
+        this.relativePath = relativePath;
+    }
+}
+exports.CopyContainmentError = CopyContainmentError;
+function isContained(rootPath, targetPath) {
+    const relative = path.relative(rootPath, targetPath);
+    return (relative === '' ||
+        (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`)));
+}
+function containmentError(relativePath, reason, cause) {
+    const error = new CopyContainmentError(relativePath, reason);
+    if (cause !== undefined) {
+        error.cause = cause;
+    }
+    return error;
+}
+function isCopyRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function copyErrorCode(error) {
+    if (isCopyRecord(error) && 'code' in error) {
+        return typeof error.code === 'string' ? error.code : null;
+    }
+    return null;
+}
+function statIdentity(targetPath) {
+    const stats = fs.statSync(targetPath, { bigint: true });
+    return {
+        device: stats.dev.toString(),
+        inode: stats.ino.toString(),
+        directory: stats.isDirectory(),
+    };
+}
+function pinRoot(rootPath, label, expectedRoot) {
+    const requestedPath = path.resolve(rootPath);
+    const canonicalPath = fs.realpathSync.native(requestedPath);
+    const identity = statIdentity(canonicalPath);
+    if (!identity.directory) {
+        throw containmentError('', `${label} root is not a directory`);
+    }
+    const pinnedRoot = {
+        requestedPath,
+        canonicalPath,
+        device: identity.device,
+        inode: identity.inode,
+    };
+    if (expectedRoot &&
+        (expectedRoot.canonicalPath !== pinnedRoot.canonicalPath ||
+            expectedRoot.device !== pinnedRoot.device ||
+            expectedRoot.inode !== pinnedRoot.inode)) {
+        throw containmentError('', `${label} root changed after it was pinned`);
+    }
+    return pinnedRoot;
+}
+function assertPinnedRoot(root, label, relativePath) {
+    let identity;
+    try {
+        identity = statIdentity(root.canonicalPath);
+    }
+    catch (error) {
+        throw containmentError(relativePath, `${label} root can no longer be resolved`, error);
+    }
+    if (identity.device !== root.device || identity.inode !== root.inode || !identity.directory) {
+        throw containmentError(relativePath, `${label} root changed after it was pinned`);
+    }
+}
+function validateRelativePath(relativePath, pathApi = path) {
+    if (typeof relativePath !== 'string' || relativePath.length === 0) {
+        throw containmentError(relativePath, 'path must be a non-empty relative string');
+    }
+    if (relativePath.includes('\0')) {
+        throw containmentError(relativePath, 'path contains a null byte');
+    }
+    if (pathApi.isAbsolute(relativePath) || pathApi.parse(relativePath).root) {
+        throw containmentError(relativePath, 'absolute paths are not allowed');
+    }
+    const components = pathApi.sep === '\\' ? relativePath.split(/[\\/]/) : relativePath.split(pathApi.sep);
+    if (components.some((component) => component === '' || component === '.' || component === '..')) {
+        throw containmentError(relativePath, 'empty, current-directory, and traversal components are not allowed');
+    }
+    return pathApi.normalize(relativePath);
+}
+function resolveSourcePath(boundary, relativePath) {
+    const normalizedPath = validateRelativePath(relativePath);
+    const root = boundary.sourceRoot;
+    assertPinnedRoot(root, 'source', relativePath);
+    const candidatePath = path.resolve(root.canonicalPath, normalizedPath);
+    if (!isContained(root.canonicalPath, candidatePath)) {
+        throw containmentError(relativePath, 'source path escapes its pinned root');
+    }
+    let canonicalPath;
+    try {
+        canonicalPath = fs.realpathSync.native(candidatePath);
+    }
+    catch (error) {
+        if (copyErrorCode(error) === 'ELOOP') {
+            throw containmentError(relativePath, 'source path contains a symlink cycle', error);
+        }
+        throw error;
+    }
+    if (!isContained(root.canonicalPath, canonicalPath)) {
+        throw containmentError(relativePath, 'resolved source path escapes its pinned root');
+    }
+    return canonicalPath;
+}
+function resolveDestinationPath(boundary, relativePath) {
+    const normalizedPath = validateRelativePath(relativePath);
+    const root = boundary.destinationRoot;
+    assertPinnedRoot(root, 'destination', relativePath);
+    const candidatePath = path.resolve(root.canonicalPath, normalizedPath);
+    if (!isContained(root.canonicalPath, candidatePath)) {
+        throw containmentError(relativePath, 'destination path escapes its pinned root');
+    }
+    let existingPath;
+    try {
+        fs.lstatSync(candidatePath);
+        existingPath = candidatePath;
+    }
+    catch (error) {
+        if (copyErrorCode(error) !== 'ENOENT') {
+            throw error;
+        }
+        // The copy pipeline creates directories parent-first in phase two, so the
+        // immediate parent must exist before any mkdir/copy effect is attempted.
+        existingPath = path.dirname(candidatePath);
+    }
+    let canonicalExistingPath;
+    try {
+        canonicalExistingPath = fs.realpathSync.native(existingPath);
+    }
+    catch (error) {
+        throw containmentError(relativePath, 'destination contains an unresolved symlink', error);
+    }
+    if (!isContained(root.canonicalPath, canonicalExistingPath)) {
+        throw containmentError(relativePath, 'resolved destination path escapes its pinned root');
+    }
+    const unresolvedSuffix = path.relative(existingPath, candidatePath);
+    const resolvedPath = unresolvedSuffix
+        ? path.join(canonicalExistingPath, unresolvedSuffix)
+        : canonicalExistingPath;
+    if (!isContained(root.canonicalPath, resolvedPath)) {
+        throw containmentError(relativePath, 'resolved destination path escapes its pinned root');
+    }
+    return resolvedPath;
+}
+function createCopyBoundary(sourceBase, destinationBase, expectedBoundary) {
+    return {
+        sourceRoot: pinRoot(sourceBase, 'source', expectedBoundary?.sourceRoot),
+        destinationRoot: pinRoot(destinationBase, 'destination', expectedBoundary?.destinationRoot),
+    };
+}
+function resolveCopyPath(boundary, relativePath) {
+    return {
+        sourcePath: resolveSourcePath(boundary, relativePath),
+        destinationPath: resolveDestinationPath(boundary, relativePath),
+    };
+}
+function isCopyContainmentError(error) {
+    return isCopyRecord(error) && error.code === exports.CONTAINMENT_ERROR_CODE;
+}
+function copyErrorFromPayload(payload) {
+    const error = payload.code === exports.CONTAINMENT_ERROR_CODE
+        ? new CopyContainmentError(payload.relativePath, 'worker rejected an unsafe path')
+        : new Error(payload.message);
+    error.name = payload.name || error.name;
+    error.message = payload.message;
+    if (payload.code && !(error instanceof CopyContainmentError)) {
+        Object.assign(error, { code: payload.code });
+    }
+    return error;
+}

package/src/copy-containment.ts

@@ -0,0 +1,259 @@
+import fs = require('fs');
+import path = require('path');
+
+export const CONTAINMENT_ERROR_CODE = 'ERR_COPY_CONTAINMENT';
+
+export interface PinnedCopyRoot {
+  requestedPath: string;
+  canonicalPath: string;
+  device: string;
+  inode: string;
+}
+
+export interface CopyBoundary {
+  sourceRoot: PinnedCopyRoot;
+  destinationRoot: PinnedCopyRoot;
+}
+
+interface PathIdentity {
+  device: string;
+  inode: string;
+  directory: boolean;
+}
+
+interface CopyPathApi {
+  isAbsolute(targetPath: string): boolean;
+  normalize(targetPath: string): string;
+  parse(targetPath: string): { root: string };
+  readonly sep: string;
+}
+
+export class CopyContainmentError extends Error {
+  readonly code = CONTAINMENT_ERROR_CODE;
+  readonly relativePath: unknown;
+
+  constructor(relativePath: unknown, reason: string) {
+    super(`Copy containment violation for ${JSON.stringify(relativePath)}: ${reason}`);
+    this.name = 'CopyContainmentError';
+    this.relativePath = relativePath;
+  }
+}
+
+function isContained(rootPath: string, targetPath: string): boolean {
+  const relative = path.relative(rootPath, targetPath);
+  return (
+    relative === '' ||
+    (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`))
+  );
+}
+
+function containmentError(
+  relativePath: unknown,
+  reason: string,
+  cause?: unknown
+): CopyContainmentError {
+  const error = new CopyContainmentError(relativePath, reason);
+  if (cause !== undefined) {
+    error.cause = cause;
+  }
+  return error;
+}
+
+export function isCopyRecord(value: unknown): value is Record<PropertyKey, unknown> {
+  return typeof value === 'object' && value !== null;
+}
+
+export function copyErrorCode(error: unknown): string | null {
+  if (isCopyRecord(error) && 'code' in error) {
+    return typeof error.code === 'string' ? error.code : null;
+  }
+  return null;
+}
+
+function statIdentity(targetPath: string): PathIdentity {
+  const stats = fs.statSync(targetPath, { bigint: true });
+  return {
+    device: stats.dev.toString(),
+    inode: stats.ino.toString(),
+    directory: stats.isDirectory(),
+  };
+}
+
+function pinRoot(rootPath: string, label: string, expectedRoot?: PinnedCopyRoot): PinnedCopyRoot {
+  const requestedPath = path.resolve(rootPath);
+  const canonicalPath = fs.realpathSync.native(requestedPath);
+  const identity = statIdentity(canonicalPath);
+
+  if (!identity.directory) {
+    throw containmentError('', `${label} root is not a directory`);
+  }
+
+  const pinnedRoot = {
+    requestedPath,
+    canonicalPath,
+    device: identity.device,
+    inode: identity.inode,
+  };
+
+  if (
+    expectedRoot &&
+    (expectedRoot.canonicalPath !== pinnedRoot.canonicalPath ||
+      expectedRoot.device !== pinnedRoot.device ||
+      expectedRoot.inode !== pinnedRoot.inode)
+  ) {
+    throw containmentError('', `${label} root changed after it was pinned`);
+  }
+
+  return pinnedRoot;
+}
+
+function assertPinnedRoot(root: PinnedCopyRoot, label: string, relativePath: string): void {
+  let identity: PathIdentity;
+  try {
+    identity = statIdentity(root.canonicalPath);
+  } catch (error: unknown) {
+    throw containmentError(relativePath, `${label} root can no longer be resolved`, error);
+  }
+
+  if (identity.device !== root.device || identity.inode !== root.inode || !identity.directory) {
+    throw containmentError(relativePath, `${label} root changed after it was pinned`);
+  }
+}
+
+export function validateRelativePath(relativePath: unknown, pathApi: CopyPathApi = path): string {
+  if (typeof relativePath !== 'string' || relativePath.length === 0) {
+    throw containmentError(relativePath, 'path must be a non-empty relative string');
+  }
+  if (relativePath.includes('\0')) {
+    throw containmentError(relativePath, 'path contains a null byte');
+  }
+  if (pathApi.isAbsolute(relativePath) || pathApi.parse(relativePath).root) {
+    throw containmentError(relativePath, 'absolute paths are not allowed');
+  }
+
+  const components =
+    pathApi.sep === '\\' ? relativePath.split(/[\\/]/) : relativePath.split(pathApi.sep);
+  if (components.some((component) => component === '' || component === '.' || component === '..')) {
+    throw containmentError(
+      relativePath,
+      'empty, current-directory, and traversal components are not allowed'
+    );
+  }
+
+  return pathApi.normalize(relativePath);
+}
+
+export function resolveSourcePath(boundary: CopyBoundary, relativePath: string): string {
+  const normalizedPath = validateRelativePath(relativePath);
+  const root = boundary.sourceRoot;
+  assertPinnedRoot(root, 'source', relativePath);
+
+  const candidatePath = path.resolve(root.canonicalPath, normalizedPath);
+  if (!isContained(root.canonicalPath, candidatePath)) {
+    throw containmentError(relativePath, 'source path escapes its pinned root');
+  }
+
+  let canonicalPath: string;
+  try {
+    canonicalPath = fs.realpathSync.native(candidatePath);
+  } catch (error: unknown) {
+    if (copyErrorCode(error) === 'ELOOP') {
+      throw containmentError(relativePath, 'source path contains a symlink cycle', error);
+    }
+    throw error;
+  }
+
+  if (!isContained(root.canonicalPath, canonicalPath)) {
+    throw containmentError(relativePath, 'resolved source path escapes its pinned root');
+  }
+  return canonicalPath;
+}
+
+function resolveDestinationPath(boundary: CopyBoundary, relativePath: string): string {
+  const normalizedPath = validateRelativePath(relativePath);
+  const root = boundary.destinationRoot;
+  assertPinnedRoot(root, 'destination', relativePath);
+
+  const candidatePath = path.resolve(root.canonicalPath, normalizedPath);
+  if (!isContained(root.canonicalPath, candidatePath)) {
+    throw containmentError(relativePath, 'destination path escapes its pinned root');
+  }
+
+  let existingPath: string;
+  try {
+    fs.lstatSync(candidatePath);
+    existingPath = candidatePath;
+  } catch (error: unknown) {
+    if (copyErrorCode(error) !== 'ENOENT') {
+      throw error;
+    }
+    // The copy pipeline creates directories parent-first in phase two, so the
+    // immediate parent must exist before any mkdir/copy effect is attempted.
+    existingPath = path.dirname(candidatePath);
+  }
+
+  let canonicalExistingPath: string;
+  try {
+    canonicalExistingPath = fs.realpathSync.native(existingPath);
+  } catch (error: unknown) {
+    throw containmentError(relativePath, 'destination contains an unresolved symlink', error);
+  }
+
+  if (!isContained(root.canonicalPath, canonicalExistingPath)) {
+    throw containmentError(relativePath, 'resolved destination path escapes its pinned root');
+  }
+
+  const unresolvedSuffix = path.relative(existingPath, candidatePath);
+  const resolvedPath = unresolvedSuffix
+    ? path.join(canonicalExistingPath, unresolvedSuffix)
+    : canonicalExistingPath;
+  if (!isContained(root.canonicalPath, resolvedPath)) {
+    throw containmentError(relativePath, 'resolved destination path escapes its pinned root');
+  }
+  return resolvedPath;
+}
+
+export function createCopyBoundary(
+  sourceBase: string,
+  destinationBase: string,
+  expectedBoundary?: CopyBoundary
+): CopyBoundary {
+  return {
+    sourceRoot: pinRoot(sourceBase, 'source', expectedBoundary?.sourceRoot),
+    destinationRoot: pinRoot(destinationBase, 'destination', expectedBoundary?.destinationRoot),
+  };
+}
+
+export function resolveCopyPath(
+  boundary: CopyBoundary,
+  relativePath: string
+): { sourcePath: string; destinationPath: string } {
+  return {
+    sourcePath: resolveSourcePath(boundary, relativePath),
+    destinationPath: resolveDestinationPath(boundary, relativePath),
+  };
+}
+
+export function isCopyContainmentError(error: unknown): boolean {
+  return isCopyRecord(error) && error.code === CONTAINMENT_ERROR_CODE;
+}
+
+interface CopyErrorPayload {
+  code?: string | null;
+  relativePath?: unknown;
+  name?: string;
+  message: string;
+}
+
+export function copyErrorFromPayload(payload: CopyErrorPayload): Error {
+  const error =
+    payload.code === CONTAINMENT_ERROR_CODE
+      ? new CopyContainmentError(payload.relativePath, 'worker rejected an unsafe path')
+      : new Error(payload.message);
+  error.name = payload.name || error.name;
+  error.message = payload.message;
+  if (payload.code && !(error instanceof CopyContainmentError)) {
+    Object.assign(error, { code: payload.code });
+  }
+  return error;
+}

package/src/copy-worker.js

@@ -7,24 +7,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
  * Used by IsolationManager._copyDirExcluding() for parallel copying.
  */
 const fs = require("fs");
-const path = require("path");
 const worker_threads_1 = require("worker_threads");
+const copy_containment_1 = require("./copy-containment");
 function isCopyWorkerData(value) {
-    return (typeof value === 'object' &&
-        value !== null &&
-        'files' in value &&
-        Array.isArray(value.files) &&
+    if (!(0, copy_containment_1.isCopyRecord)(value)) {
+        return false;
+    }
+    return (Array.isArray(value.files) &&
         value.files.every((entry) => typeof entry === 'string') &&
-        'sourceBase' in value &&
         typeof value.sourceBase === 'string' &&
-        'destBase' in value &&
-        typeof value.destBase === 'string');
-}
-function errorCode(error) {
-    if (typeof error === 'object' && error !== null && 'code' in error) {
-        return typeof error.code === 'string' ? error.code : null;
-    }
-    return null;
+        typeof value.destBase === 'string' &&
+        (0, copy_containment_1.isCopyRecord)(value.expectedBoundary));
 }
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
@@ -33,35 +26,41 @@ const rawWorkerData = worker_threads_1.workerData;
 if (!isCopyWorkerData(rawWorkerData)) {
     throw new TypeError('copy worker requires files, sourceBase, and destBase');
 }
-const { files, sourceBase, destBase } = rawWorkerData;
+const { files, sourceBase, destBase, expectedBoundary } = rawWorkerData;
+const copyBoundary = (0, copy_containment_1.createCopyBoundary)(sourceBase, destBase, expectedBoundary);
 let copied = 0;
 let skipped = 0;
-const errors = [];
+let error = null;
 for (const relativePath of files) {
-    const srcPath = path.join(sourceBase, relativePath);
-    const destPath = path.join(destBase, relativePath);
     try {
-        // Ensure parent directory exists
-        const destDir = path.dirname(destPath);
-        if (!fs.existsSync(destDir)) {
-            fs.mkdirSync(destDir, { recursive: true });
-        }
-        // Copy the file
-        fs.copyFileSync(srcPath, destPath);
+        // Phase two creates every parent directory. Re-resolve the source and
+        // destination immediately before the only worker filesystem effect.
+        const { sourcePath, destinationPath } = (0, copy_containment_1.resolveCopyPath)(copyBoundary, relativePath);
+        fs.copyFileSync(sourcePath, destinationPath);
         copied++;
     }
-    catch (error) {
+    catch (caughtError) {
         // Skip files we can't copy (permission denied, broken symlinks, etc.)
-        const code = errorCode(error);
-        if (code === 'EACCES' || code === 'EPERM' || code === 'ENOENT') {
+        const code = (0, copy_containment_1.copyErrorCode)(caughtError);
+        if (!(0, copy_containment_1.isCopyContainmentError)(caughtError) &&
+            (code === 'EACCES' || code === 'EPERM' || code === 'ENOENT')) {
             skipped++;
             continue;
         }
-        errors.push({ file: relativePath, error: errorMessage(error) });
+        error = {
+            file: relativePath,
+            name: caughtError instanceof Error ? caughtError.name : 'Error',
+            code,
+            message: errorMessage(caughtError),
+            relativePath: (0, copy_containment_1.isCopyRecord)(caughtError) && 'relativePath' in caughtError
+                ? caughtError.relativePath
+                : relativePath,
+        };
+        break;
     }
 }
 // Report results back to main thread
 if (!worker_threads_1.parentPort) {
     throw new Error('copy worker requires a parent port');
 }
-worker_threads_1.parentPort.postMessage({ copied, skipped, errors });
+worker_threads_1.parentPort.postMessage({ copied, skipped, error });

package/src/copy-worker.ts

@@ -5,36 +5,40 @@
  * Used by IsolationManager._copyDirExcluding() for parallel copying.
  */
 import fs = require('fs');
-import path = require('path');
 import { parentPort, workerData } from 'worker_threads';
+import {
+  copyErrorCode,
+  createCopyBoundary,
+  isCopyContainmentError,
+  isCopyRecord,
+  resolveCopyPath,
+} from './copy-containment';
+import type { CopyBoundary } from './copy-containment';
 interface CopyWorkerData {
   files: string[];
   sourceBase: string;
   destBase: string;
+  expectedBoundary: CopyBoundary;
 }
 interface CopyError {
   file: string;
-  error: string;
+  name: string;
+  code: string | null;
+  message: string;
+  relativePath: unknown;
 }
 function isCopyWorkerData(value: unknown): value is CopyWorkerData {
+  if (!isCopyRecord(value)) {
+    return false;
+  }
   return (
-    typeof value === 'object' &&
-    value !== null &&
-    'files' in value &&
     Array.isArray(value.files) &&
     value.files.every((entry: unknown) => typeof entry === 'string') &&
-    'sourceBase' in value &&
     typeof value.sourceBase === 'string' &&
-    'destBase' in value &&
-    typeof value.destBase === 'string'
+    typeof value.destBase === 'string' &&
+    isCopyRecord(value.expectedBoundary)
   );
 }
-function errorCode(error: unknown): string | null {
-  if (typeof error === 'object' && error !== null && 'code' in error) {
-    return typeof error.code === 'string' ? error.code : null;
-  }
-  return null;
-}
 function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
@@ -42,34 +46,43 @@ const rawWorkerData: unknown = workerData;
 if (!isCopyWorkerData(rawWorkerData)) {
   throw new TypeError('copy worker requires files, sourceBase, and destBase');
 }
-const { files, sourceBase, destBase } = rawWorkerData;
+const { files, sourceBase, destBase, expectedBoundary } = rawWorkerData;
+const copyBoundary = createCopyBoundary(sourceBase, destBase, expectedBoundary);
 let copied = 0;
 let skipped = 0;
-const errors: CopyError[] = [];
+let error: CopyError | null = null;
 for (const relativePath of files) {
-  const srcPath = path.join(sourceBase, relativePath);
-  const destPath = path.join(destBase, relativePath);
   try {
-    // Ensure parent directory exists
-    const destDir = path.dirname(destPath);
-    if (!fs.existsSync(destDir)) {
-      fs.mkdirSync(destDir, { recursive: true });
-    }
-    // Copy the file
-    fs.copyFileSync(srcPath, destPath);
+    // Phase two creates every parent directory. Re-resolve the source and
+    // destination immediately before the only worker filesystem effect.
+    const { sourcePath, destinationPath } = resolveCopyPath(copyBoundary, relativePath);
+    fs.copyFileSync(sourcePath, destinationPath);
     copied++;
-  } catch (error: unknown) {
+  } catch (caughtError: unknown) {
     // Skip files we can't copy (permission denied, broken symlinks, etc.)
-    const code = errorCode(error);
-    if (code === 'EACCES' || code === 'EPERM' || code === 'ENOENT') {
+    const code = copyErrorCode(caughtError);
+    if (
+      !isCopyContainmentError(caughtError) &&
+      (code === 'EACCES' || code === 'EPERM' || code === 'ENOENT')
+    ) {
       skipped++;
       continue;
     }
-    errors.push({ file: relativePath, error: errorMessage(error) });
+    error = {
+      file: relativePath,
+      name: caughtError instanceof Error ? caughtError.name : 'Error',
+      code,
+      message: errorMessage(caughtError),
+      relativePath:
+        isCopyRecord(caughtError) && 'relativePath' in caughtError
+          ? caughtError.relativePath
+          : relativePath,
+    };
+    break;
   }
 }
 // Report results back to main thread
 if (!parentPort) {
   throw new Error('copy worker requires a parent port');
 }
-parentPort.postMessage({ copied, skipped, errors });
+parentPort.postMessage({ copied, skipped, error });