@wascartech/devbot 0.0.0-stage → 2.1.0

package/dist/mcp/oauth-refresh.js

@@ -0,0 +1,138 @@
+import { discoverOAuthServerInfo, refreshAuthorization } from "@modelcontextprotocol/sdk/client/auth.js";
+import { getMcpAuthEntry, listMcpAuthScopes, upsertMcpAuth } from "../mcp-auth-store.js";
+import { listMcpServers } from "../mcp-config-store.js";
+import { redact } from "../redact.js";
+import { log } from "../logger.js";
+// Host-side OAuth token refresh for remote MCP servers.
+//
+// Why this exists: opencode refreshes tokens inside the run container, but its
+// refreshed/rotated tokens are written only to the container's mcp-auth.json —
+// which the runner overwrites from the DB before every run. A provider that
+// rotates the refresh token therefore leaves DevBot holding a stale one and the
+// next refresh fails silently. Refreshing here and persisting the rotation back
+// to project_mcp_auth closes that loop.
+//
+// One primitive, three triggers: the periodic sweep (src/sweeps.ts), the pre-run
+// safety net (prepareMcpRun), and the manual admin endpoint. None of them throw —
+// a failed refresh logs (redacted) and leaves the stored row untouched.
+const REFRESH_TIMEOUT_MS = 10_000;
+// Serialize refreshes per (scopeId, name): a token provider that rotates on
+// refresh must never have two concurrent refresh calls racing for the same
+// rotating refresh token (the loser would invalidate the winner's token).
+const inflight = new Set();
+function message(e) {
+    return e instanceof Error ? e.message : String(e);
+}
+// Resolve `{env:VAR}` placeholders against the host env (the config values are
+// authored for the container, but the host runs the refresh). Returns null when a
+// placeholder cannot be resolved so the caller skips instead of sending a literal.
+function resolveEnv(value) {
+    const out = value.replace(/\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, name) => process.env[name] ?? `{env:${name}}`);
+    return out.includes("{env:") ? null : out;
+}
+// Client credentials for the token request: pasted clientInfo wins (it is what
+// the provider registered with), else the admin-configured oauth block. The
+// latter may carry {env:VAR} placeholders; an unresolved placeholder means we
+// cannot authenticate and must skip.
+function clientInformation(entry, oauth) {
+    const info = entry.clientInfo;
+    if (info?.clientId) {
+        return { client_id: info.clientId, ...(info.clientSecret ? { client_secret: info.clientSecret } : {}) };
+    }
+    if (oauth && typeof oauth === "object" && "clientId" in oauth) {
+        const o = oauth;
+        const clientId = resolveEnv(o.clientId);
+        if (!clientId)
+            return null;
+        const clientSecret = o.clientSecret ? resolveEnv(o.clientSecret) : undefined;
+        if (o.clientSecret && !clientSecret)
+            return null;
+        return { client_id: clientId, ...(clientSecret ? { client_secret: clientSecret } : {}) };
+    }
+    return null;
+}
+// Refresh one stored entry if it has a refresh token and is due. Never throws.
+export async function refreshMcpAuthEntry(scopeId, name, opts = {}) {
+    const key = `${scopeId}:${name}`;
+    if (inflight.has(key))
+        return { ok: false, skipped: true, reason: "refresh already in flight" };
+    inflight.add(key);
+    try {
+        const entry = getMcpAuthEntry(scopeId, name);
+        if (!entry)
+            return { ok: false, skipped: true, reason: "no stored auth entry" };
+        const refreshToken = entry.tokens.refreshToken;
+        if (!refreshToken)
+            return { ok: false, skipped: true, reason: "no refresh token" };
+        const now = opts.nowSeconds ?? Math.floor(Date.now() / 1000);
+        const horizonSec = Math.floor((opts.horizonMs ?? 0) / 1000);
+        if (!opts.force &&
+            entry.tokens.expiresAt !== undefined &&
+            entry.tokens.expiresAt > now + horizonSec) {
+            return { ok: true, skipped: true, reason: "not due", expiresAt: entry.tokens.expiresAt };
+        }
+        const cfg = listMcpServers(scopeId).find((s) => s.name === name);
+        if (!cfg || cfg.config.type !== "remote") {
+            return { ok: false, skipped: true, reason: "no remote server config" };
+        }
+        const client = clientInformation(entry, cfg.config.oauth);
+        if (!client) {
+            return { ok: false, skipped: true, reason: "no client credentials (clientInfo or oauth.clientId)" };
+        }
+        const fetchFn = opts.fetchFn ?? globalThis.fetch;
+        const timedFetch = (input, init) => fetchFn(input, { ...init, signal: AbortSignal.timeout(REFRESH_TIMEOUT_MS) });
+        const serverInfo = await discoverOAuthServerInfo(cfg.config.url, { fetchFn: timedFetch });
+        const resource = serverInfo.resourceMetadata?.resource
+            ? new URL(serverInfo.resourceMetadata.resource)
+            : undefined;
+        const tokens = await refreshAuthorization(serverInfo.authorizationServerUrl, {
+            ...(serverInfo.authorizationServerMetadata ? { metadata: serverInfo.authorizationServerMetadata } : {}),
+            clientInformation: client,
+            refreshToken,
+            ...(resource ? { resource } : {}),
+            fetchFn: timedFetch,
+        });
+        // Preserve the previous refresh token when the provider did not rotate it
+        // (the SDK guarantees this, but be explicit). Drop a stale expiresAt only when
+        // the provider returns a fresh lifetime; otherwise keep the old value.
+        const nextTokens = {
+            accessToken: tokens.access_token,
+            refreshToken: tokens.refresh_token ?? refreshToken,
+            ...(tokens.expires_in !== undefined
+                ? { expiresAt: now + tokens.expires_in }
+                : entry.tokens.expiresAt !== undefined
+                    ? { expiresAt: entry.tokens.expiresAt }
+                    : {}),
+            ...(tokens.scope ?? entry.tokens.scope ? { scope: tokens.scope ?? entry.tokens.scope } : {}),
+        };
+        upsertMcpAuth(scopeId, name, { ...entry, tokens: nextTokens });
+        log.info("mcp token refreshed", { scopeId, name, expiresAt: nextTokens.expiresAt });
+        return { ok: true, expiresAt: nextTokens.expiresAt };
+    }
+    catch (e) {
+        const reason = redact(message(e));
+        log.warn("mcp token refresh failed", { scopeId, name, reason });
+        return { ok: false, reason };
+    }
+    finally {
+        inflight.delete(key);
+    }
+}
+// Sweep stored auth rows, refreshing those expiring within `horizonMs`.
+// Sequential on purpose: bounded, and refresh endpoints are frequently
+// rate-limited. One row's failure never aborts the sweep. When `scopeIds` is
+// given, only those scopes are swept (the pre-run path limits itself to the
+// global + run project scopes it is about to emit); omitted = every scope.
+export async function refreshDueMcpAuth(horizonMs, scopeIds) {
+    const allowed = scopeIds ? new Set(scopeIds) : null;
+    for (const { scopeId, name } of listMcpAuthScopes()) {
+        if (allowed && !allowed.has(scopeId))
+            continue;
+        await refreshMcpAuthEntry(scopeId, name, { horizonMs });
+    }
+}
+// Test-only: clear the in-flight guard between cases.
+export function resetRefreshInflightForTest() {
+    inflight.clear();
+}
+//# sourceMappingURL=oauth-refresh.js.map

package/dist/mcp/oauth-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh.js","sourceRoot":"","sources":["../../src/mcp/oauth-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAEzG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAGnC,wDAAwD;AACxD,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,gFAAgF;AAChF,wCAAwC;AACxC,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,wEAAwE;AAExE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;AAqBnC,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,+EAA+E;AAC/E,kFAAkF;AAClF,mFAAmF;AACnF,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI,GAAG,CAAC,CAAC;IAC1H,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,qCAAqC;AACrC,SAAS,iBAAiB,CAAC,KAAmB,EAAE,KAAc;IAC5D,MAAM,IAAI,GAAkC,KAAK,CAAC,UAAU,CAAC;IAC7D,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC;QACnB,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1G,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QAC9D,MAAM,CAAC,GAAG,KAAoD,CAAC;QAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,IAAY,EACZ,OAAuB,EAAE;IAEzB,MAAM,GAAG,GAAG,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;IACjC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAChG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAChF,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/C,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAEnF,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,IACE,CAAC,IAAI,CAAC,KAAK;YACX,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;YACpC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,GAAG,UAAU,EACzC,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3F,CAAC;QAED,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QACzE,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;QACtG,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;QACjD,MAAM,UAAU,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC/C,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAE/E,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,UAAU,CAAC,gBAAgB,EAAE,QAAQ;YACpD,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,sBAAsB,EAAE;YAC3E,GAAG,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,iBAAiB,EAAE,MAAM;YACzB,YAAY;YACZ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QAEH,0EAA0E;QAC1E,+EAA+E;QAC/E,uEAAuE;QACvE,MAAM,UAAU,GAA2B;YACzC,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY;YAClD,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;gBACjC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE;gBACxC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;oBACpC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;oBACvC,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7F,CAAC;QACF,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,QAAmB;IAC5E,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACpD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC/C,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,2BAA2B;IACzC,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/mcp/peer-sync.js

@@ -0,0 +1,109 @@
+import { config } from "../config.js";
+import { log } from "../logger.js";
+import { redact } from "../redact.js";
+import { podman } from "../podman.js";
+import { volumeName, gitExtraHeader, envArgs, logDriverArgs, volumeSelinuxArgs } from "../git.js";
+import { PROJECT_ROOT, validateProjectRelativePath } from "../path-sandbox.js";
+// On-demand clone/fetch of an authorized peer project into the run volume.
+//
+// Layout: /workspace/.devbot-peers/<path_with_namespace>/ — inside the volume
+// but excluded from git via .git/info/exclude (local-only ignore), so the
+// project's own `git add -A` / `git status` never see it. This is the
+// "out of scope of git but accessible by the agent" requirement: the agent can
+// read/grep the peer tree, but it can't be committed by mistake.
+//
+// The clone runs in a short-lived podman container mounting the work-item
+// volume. The bot's forge token is injected only into that one git invocation
+// via the same http.extraHeader used by the host-side clone/push; it is never
+// written into the peer tree.
+export const PEERS_DIR = ".devbot-peers";
+export function peerPath(projectPath) {
+    // Defense in depth: the forge project path is interpolated into a shell
+    //   command and a clone destination. shellQuote already blocks injection, but
+    //   a `..`/absolute path could still escape the peers dir. Validate first.
+    return `${PROJECT_ROOT}/${PEERS_DIR}/${validateProjectRelativePath(projectPath)}`;
+}
+// Append one or more dir entries (each with a trailing slash) to the repo's
+// local exclude file if absent. Local exclude lives at .git/info/exclude and is
+// never committed, unlike .gitignore. Runs inside a container (the volume is
+// only reachable there). Used for `.devbot-peers/` and the outbound-attachment
+// staging dir `.devbot-out/`.
+export function excludeEntriesScript(entries) {
+    const lines = ["cd /workspace", "mkdir -p .git/info"];
+    for (const e of entries) {
+        lines.push(`grep -qxF '${e}' .git/info/exclude 2>/dev/null || echo '${e}' >> .git/info/exclude`);
+    }
+    return lines.join(" && ");
+}
+// Back-compat single-entry helper for the peer folder.
+export function excludeScript() {
+    return excludeEntriesScript([`${PEERS_DIR}/`]);
+}
+// Compose the shell command that clones or fetches one peer. Pure (given the
+// inputs) so it can be unit-tested without podman. `extraHeader` is the
+// token-bearing git prefix; the URL is the enrolled project's http URL.
+export function peerSyncScript(projectPath, cloneUrl, ref, extraHeader) {
+    const dir = `${PEERS_DIR}/${validateProjectRelativePath(projectPath)}`;
+    const branchFlag = ref ? ` --branch ${shellQuote(ref)}` : "";
+    const checkout = ref ? ` && git -C ${shellQuote(dir)} checkout ${shellQuote(ref)}` : "";
+    // mkdir -p the parent so the path with namespace (group/subgroup/project) nests.
+    const parent = dir.split("/").slice(0, -1).join("/");
+    return [
+        "cd /workspace",
+        excludeScript(),
+        `mkdir -p ${shellQuote(parent)}`,
+        `if [ -d ${shellQuote(dir)}/.git ]; then ` +
+            `git -C ${shellQuote(dir)} fetch --all --prune${checkout}; ` +
+            `else ${extraHeader} clone${branchFlag} ${shellQuote(cloneUrl)} ${shellQuote(dir)}; fi`,
+        `git -C ${shellQuote(dir)} rev-parse --short HEAD`,
+    ].join(" && ");
+}
+function shellQuote(s) {
+    return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+// Write the git-exclude line(s) proactively at run start (when the project has
+// any granted targets) so the peers folder is invisible to git even before the
+// first sync_project call. Idempotent. Best-effort: a failure is logged, not
+// fatal — sync_project writes the exclude again before cloning anyway.
+export async function ensureGitExcludes(workItemId, entries, envVars = [], timeoutMs = 60_000, builderImage = config.BUILDER_IMAGE) {
+    const vol = volumeName(workItemId);
+    const r = await podman([
+        "run", "--rm", ...logDriverArgs(), "--name", `devbot-wi-${workItemId}-gitexclude`,
+        ...volumeSelinuxArgs(workItemId),
+        "-v", `${vol}:/workspace:Z`,
+        ...envArgs(envVars),
+        builderImage,
+        "sh", "-c", excludeEntriesScript(entries),
+    ], { timeoutMs });
+    if (r.code !== 0) {
+        log.warn("git exclude init failed", { workItemId, entries, code: r.code });
+    }
+}
+// Back-compat wrapper: ensure just the peer folder is excluded.
+export async function ensurePeerExclude(workItemId, envVars = [], timeoutMs = 60_000, builderImage = config.BUILDER_IMAGE) {
+    return ensureGitExcludes(workItemId, [`${PEERS_DIR}/`], envVars, timeoutMs, builderImage);
+}
+export async function syncPeerProject(input) {
+    const vol = volumeName(input.workItemId);
+    const script = peerSyncScript(input.projectPath, input.cloneUrl, input.ref, gitExtraHeader());
+    const r = await podman([
+        "run", "--rm", ...logDriverArgs(), "--name", `devbot-wi-${input.workItemId}-peersync`,
+        // Same per-work-item SELinux level as the agent run container; :Z alone
+        // would relabel the volume to this helper's random pair mid-run.
+        ...volumeSelinuxArgs(input.workItemId),
+        "-v", `${vol}:/workspace:Z`,
+        ...envArgs(input.envVars ?? []),
+        input.builderImage ?? config.BUILDER_IMAGE,
+        "sh", "-c", script,
+    ], { timeoutMs: input.timeoutMs ?? 5 * 60_000 });
+    const path = peerPath(input.projectPath);
+    if (r.code !== 0) {
+        const msg = redact(r.stderr.slice(-400));
+        log.warn("peer sync failed", { workItemId: input.workItemId, projectPath: input.projectPath, code: r.code });
+        return { ok: false, path, sha: "", message: `peer sync failed: ${msg}` };
+    }
+    const sha = r.stdout.trim().split("\n").pop()?.trim() ?? "";
+    log.info("peer sync ok", { workItemId: input.workItemId, projectPath: input.projectPath, ref: input.ref ?? "default" });
+    return { ok: true, path, sha, message: `synced ${input.projectPath}` };
+}
+//# sourceMappingURL=peer-sync.js.map

package/dist/mcp/peer-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"peer-sync.js","sourceRoot":"","sources":["../../src/mcp/peer-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAE/E,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,sEAAsE;AACtE,+EAA+E;AAC/E,iEAAiE;AACjE,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAC9E,8BAA8B;AAE9B,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AAEzC,MAAM,UAAU,QAAQ,CAAC,WAAmB;IAC1C,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,OAAO,GAAG,YAAY,IAAI,SAAS,IAAI,2BAA2B,CAAC,WAAW,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,4EAA4E;AAC5E,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,8BAA8B;AAC9B,MAAM,UAAU,oBAAoB,CAAC,OAAiB;IACpD,MAAM,KAAK,GAAG,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,4CAA4C,CAAC,wBAAwB,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa;IAC3B,OAAO,oBAAoB,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,6EAA6E;AAC7E,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,QAAgB,EAAE,GAAuB,EAAE,WAAmB;IAChH,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,2BAA2B,CAAC,WAAW,CAAC,EAAE,CAAC;IACvE,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,UAAU,CAAC,GAAG,CAAC,aAAa,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,iFAAiF;IACjF,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO;QACL,eAAe;QACf,aAAa,EAAE;QACf,YAAY,UAAU,CAAC,MAAM,CAAC,EAAE;QAChC,WAAW,UAAU,CAAC,GAAG,CAAC,gBAAgB;YACxC,UAAU,UAAU,CAAC,GAAG,CAAC,uBAAuB,QAAQ,IAAI;YAC5D,QAAQ,WAAW,SAAS,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM;QACzF,UAAU,UAAU,CAAC,GAAG,CAAC,yBAAyB;KACnD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;AAC9C,CAAC;AASD,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,OAAiB,EACjB,UAAkD,EAAE,EACpD,SAAS,GAAG,MAAM,EAClB,eAAuB,MAAM,CAAC,aAAa;IAE3C,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB;QACE,KAAK,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,EAAE,QAAQ,EAAE,aAAa,UAAU,aAAa;QACjF,GAAG,iBAAiB,CAAC,UAAU,CAAC;QAChC,IAAI,EAAE,GAAG,GAAG,eAAe;QAC3B,GAAG,OAAO,CAAC,OAAO,CAAC;QACnB,YAAY;QACZ,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC;KAC1C,EACD,EAAE,SAAS,EAAE,CACd,CAAC;IACF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,UAAkD,EAAE,EACpD,SAAS,GAAG,MAAM,EAClB,eAAuB,MAAM,CAAC,aAAa;IAE3C,OAAO,iBAAiB,CAAC,UAAU,EAAE,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAQrC;IACC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9F,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB;QACE,KAAK,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,EAAE,QAAQ,EAAE,aAAa,KAAK,CAAC,UAAU,WAAW;QACrF,wEAAwE;QACxE,iEAAiE;QACjE,GAAG,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC;QACtC,IAAI,EAAE,GAAG,GAAG,eAAe;QAC3B,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/B,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,aAAa;QAC1C,IAAI,EAAE,IAAI,EAAE,MAAM;KACnB,EACD,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,EAAE,CAC7C,CAAC;IACF,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,qBAAqB,GAAG,EAAE,EAAE,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC;IACxH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;AACzE,CAAC"}

package/dist/mcp/registry.js

@@ -0,0 +1,54 @@
+import * as issues from "./tools/issues.js";
+import * as mergeRequests from "./tools/merge_requests.js";
+import * as workItems from "./tools/workitems.js";
+import * as discovery from "./tools/discovery.js";
+import * as repository from "./tools/repository.js";
+import * as cicd from "./tools/cicd.js";
+import * as workTracking from "./tools/work_tracking.js";
+import * as metadata from "./tools/metadata.js";
+import * as peerSync from "./tools/peer_sync.js";
+import * as attachments from "./tools/attachments.js";
+// Flat array: adding a tool = create a file under tools/, export a Tool, add
+// it here. tools/list and tools/call dispatch from this array.
+export const TOOLS = [
+    // Existing, now cross-project-capable.
+    issues.listIssues,
+    issues.getIssue,
+    mergeRequests.listMergeRequests,
+    mergeRequests.getMergeRequestDiscussions,
+    workItems.searchWorkItems,
+    // Discovery.
+    discovery.listAccessibleProjects,
+    discovery.getProject,
+    // Repository.
+    repository.listRepositoryTree,
+    repository.getRepositoryFile,
+    repository.listCommits,
+    repository.getCommit,
+    repository.compareRefs,
+    repository.listBranches,
+    repository.listTags,
+    // CI/CD.
+    cicd.listPipelines,
+    cicd.getPipeline,
+    cicd.listPipelineJobs,
+    cicd.getJobLog,
+    // Work tracking.
+    workTracking.listLabels,
+    workTracking.listMilestones,
+    workTracking.listIssueNotes,
+    workTracking.getMergeRequest,
+    workTracking.listMergeRequestNotes,
+    // Repository metadata.
+    metadata.listMembers,
+    metadata.listReleases,
+    metadata.listWikiPages,
+    metadata.getWikiPage,
+    metadata.searchProject,
+    // Peer code materialization.
+    peerSync.syncProject,
+    // Attachment download (agent reads work-item files) + upload.
+    attachments.downloadWorkItemAttachment,
+    attachments.uploadWorkItemAttachment,
+];
+//# sourceMappingURL=registry.js.map

package/dist/mcp/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/mcp/registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,aAAa,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAC;AAClD,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAC;AAClD,OAAO,KAAK,UAAU,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,IAAI,MAAM,iBAAiB,CAAC;AACxC,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAC;AAChD,OAAO,KAAK,QAAQ,MAAM,sBAAsB,CAAC;AACjD,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAC;AA0BtD,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,CAAC,MAAM,KAAK,GAAW;IAC3B,uCAAuC;IACvC,MAAM,CAAC,UAAU;IACjB,MAAM,CAAC,QAAQ;IACf,aAAa,CAAC,iBAAiB;IAC/B,aAAa,CAAC,0BAA0B;IACxC,SAAS,CAAC,eAAe;IACzB,aAAa;IACb,SAAS,CAAC,sBAAsB;IAChC,SAAS,CAAC,UAAU;IACpB,cAAc;IACd,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,iBAAiB;IAC5B,UAAU,CAAC,WAAW;IACtB,UAAU,CAAC,SAAS;IACpB,UAAU,CAAC,WAAW;IACtB,UAAU,CAAC,YAAY;IACvB,UAAU,CAAC,QAAQ;IACnB,SAAS;IACT,IAAI,CAAC,aAAa;IAClB,IAAI,CAAC,WAAW;IAChB,IAAI,CAAC,gBAAgB;IACrB,IAAI,CAAC,SAAS;IACd,iBAAiB;IACjB,YAAY,CAAC,UAAU;IACvB,YAAY,CAAC,cAAc;IAC3B,YAAY,CAAC,cAAc;IAC3B,YAAY,CAAC,eAAe;IAC5B,YAAY,CAAC,qBAAqB;IAClC,uBAAuB;IACvB,QAAQ,CAAC,WAAW;IACpB,QAAQ,CAAC,YAAY;IACrB,QAAQ,CAAC,aAAa;IACtB,QAAQ,CAAC,WAAW;IACpB,QAAQ,CAAC,aAAa;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,WAAW;IACpB,8DAA8D;IAC9D,WAAW,CAAC,0BAA0B;IACtC,WAAW,CAAC,wBAAwB;CACrC,CAAC"}

package/dist/mcp/runner-bridge.js

@@ -0,0 +1,93 @@
+import { mintMcpToken, deleteMcpToken } from "./auth.js";
+import { mergedMcpServers, effectiveMcpServers } from "./effective-mcp.js";
+import { buildMcpAuthJsonForScopes } from "../mcp-auth-store.js";
+import { refreshDueMcpAuth } from "./oauth-refresh.js";
+import { buildEnvArray } from "../env-config-store.js";
+import { resolveModelForMode, resolveVariantForMode, resolvePlugins, resolveBaseBranches, resolveBuilderImage, resolveBuildWorkflow, resolveMrDescription, resolveLspServers } from "../settings-store.js";
+import { autoFeatureEnabled } from "../work-item-auto-store.js";
+import { enabledProvidersForRun } from "../global-settings-store.js";
+import { config } from "../config.js";
+import { listAccessTargets } from "../access-grant-store.js";
+import { resolveCustomRepos } from "../custom-repos-store.js";
+import { GLOBAL_SCOPE_ID } from "../types/global-settings.js";
+import { log } from "../logger.js";
+export async function prepareMcpRun(projectId, workItemId, workItemNumber, ttlMs) {
+    const { token } = mintMcpToken({ projectId, workItemId, workItemNumber, ttlMs });
+    // MCP merge order: global first, project second (project wins on name
+    // collision). The bundled internal servers are injected later in
+    // buildOpencodeConfig and always win.
+    const mcpServers = mergedMcpServers(projectId);
+    const effective = effectiveMcpServers(projectId);
+    const configs = new Map();
+    for (const e of effective) {
+        if (e.config.type === "remote")
+            configs.set(e.name, { url: e.config.url });
+    }
+    // Observable per-run record of which external servers a run receives and
+    // where each came from, so "did the global apply?" is answerable from logs.
+    // Names/state only — never secrets or header values.
+    log.info("mcp run servers", {
+        projectId,
+        workItemId,
+        servers: effective.map((e) => ({
+            name: e.name,
+            origin: e.origin,
+            enabled: e.enabled,
+            hasAuth: configs.has(e.name),
+            overriddenByProject: e.overriddenByProject,
+        })),
+    });
+    // Pre-run OAuth refresh safety net (always on, independent of the scheduler
+    // toggle): tokens expiring within this run's TTL are renewed host-side so
+    // opencode never has to refresh in-container (and lose the rotation). Never
+    // throws — a failed refresh leaves the stored row and the run proceeds.
+    await refreshDueMcpAuth(ttlMs, [GLOBAL_SCOPE_ID, projectId]);
+    const mcpAuthJson = JSON.stringify(buildMcpAuthJsonForScopes([GLOBAL_SCOPE_ID, projectId], configs), null, 2);
+    const envVars = buildEnvArray(projectId);
+    const models = {
+        plan: { model: resolveModelForMode(projectId, "plan"), variant: resolveVariantForMode(projectId, "plan") },
+        build: { model: resolveModelForMode(projectId, "build"), variant: resolveVariantForMode(projectId, "build") },
+    };
+    const plugins = resolvePlugins(projectId);
+    const baseBranches = resolveBaseBranches(projectId);
+    const builderImage = resolveBuilderImage(projectId) || config.BUILDER_IMAGE;
+    const buildWorkflow = resolveBuildWorkflow(projectId);
+    const mrDescription = resolveMrDescription(projectId);
+    const autoPush = autoFeatureEnabled(projectId, workItemId, "autoPush");
+    const autoMr = autoFeatureEnabled(projectId, workItemId, "autoMr");
+    const autoResolveConflicts = autoFeatureEnabled(projectId, workItemId, "autoResolveConflicts");
+    const lspServers = resolveLspServers(projectId);
+    const providers = enabledProvidersForRun();
+    const peerProjects = listAccessTargets(projectId).filter((t) => t.projectId !== projectId);
+    const customRepos = {
+        skills: resolveCustomRepos(projectId, "skills"),
+        agents: resolveCustomRepos(projectId, "agents"),
+    };
+    return { mcpToken: token, mcpServers, mcpAuthJson, envVars, models, plugins, baseBranches, builderImage, buildWorkflow, mrDescription, autoPush, autoMr, autoResolveConflicts, lspServers, providers, peerProjects, customRepos };
+}
+export function cleanupMcpRun(token) {
+    deleteMcpToken(token);
+}
+// Per-project env vars for a push-only run (standalone /force-push), which has
+// no MCP context. Kept here so runner.ts stays free of direct store imports.
+export function projectEnvVars(projectId) {
+    return buildEnvArray(projectId);
+}
+// Resolved builder image for a push-only run (standalone /force-push), which has
+// no MCP context. Kept here so runner.ts stays free of direct store imports.
+export function projectBuilderImage(projectId) {
+    return resolveBuilderImage(projectId) || config.BUILDER_IMAGE;
+}
+// Resolved base-branch walk for a push/MR-only run (standalone /push, /mr),
+// which has no MCP context and so cannot read `mcpCtx.baseBranches`. Kept here
+// so runner.ts stays free of direct store imports.
+export function projectBaseBranches(projectId) {
+    return resolveBaseBranches(projectId);
+}
+// Resolved conflict auto-fix switch for the standalone /mr path, which has no
+// MCP context. Kept here so runner.ts stays free of direct store imports.
+// Work-item override aware (work item #58).
+export function projectAutoResolveConflicts(projectId, workItemId) {
+    return autoFeatureEnabled(projectId, workItemId, "autoResolveConflicts");
+}
+//# sourceMappingURL=runner-bridge.js.map

package/dist/mcp/runner-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-bridge.js","sourceRoot":"","sources":["../../src/mcp/runner-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,cAAc,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC3M,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAqB,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAmB,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAuB,MAAM,6BAA6B,CAAC;AAEnF,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AA4CnC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAkB,EAAE,cAAsB,EAAE,KAAa;IAC9G,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,sEAAsE;IACtE,iEAAiE;IACjE,sCAAsC;IACtC,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,yEAAyE;IACzE,4EAA4E;IAC5E,qDAAqD;IACrD,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE;QAC1B,SAAS;QACT,UAAU;QACV,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5B,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;SAC3C,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,iBAAiB,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAChC,yBAAyB,CAAC,CAAC,eAAe,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,EAChE,IAAI,EACJ,CAAC,CACF,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE;QAC1G,KAAK,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE;KAC9G,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC;IAC5E,MAAM,aAAa,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,SAAS,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC3F,MAAM,WAAW,GAAG;QAClB,MAAM,EAAE,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC;QAC/C,MAAM,EAAE,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC;KAChD,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;AACpO,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,cAAc,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,iFAAiF;AACjF,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC;AAChE,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,mBAAmB,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,4CAA4C;AAC5C,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,UAAkB;IAC/E,OAAO,kBAAkB,CAAC,SAAS,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;AAC3E,CAAC"}

package/dist/mcp/server.js

@@ -0,0 +1,173 @@
+import { Router } from "express";
+import { randomUUID } from "node:crypto";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { hostHeaderValidation } from "@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js";
+import { log } from "../logger.js";
+import { verifyMcpToken } from "./auth.js";
+import { TOOLS } from "./registry.js";
+// ---- Bearer auth ----------------------------------------------------------
+// Every /mcp request must carry a per-thread bearer. The token is looked up in
+// mcp_thread_tokens; its project_id is injected into the per-session McpContext
+// used by every tool handler. Tools never read a project_id from the client.
+function extractBearer(req) {
+    const h = req.headers["authorization"];
+    if (typeof h !== "string")
+        return null;
+    if (!h.toLowerCase().startsWith("bearer "))
+        return null;
+    return h.slice(7).trim();
+}
+const sessions = new Map();
+// ponytail: no idle-session reaper. Sessions live for the duration of an
+//   opencode run (minutes, not hours); the runner deletes the token on run
+//   end, after which auth fails and the session is inert. Add a sweep if a
+//   leaked session ever shows up in metrics.
+const SESSION_TIMEOUT_MS = 60 * 60 * 1000;
+function registerToolsOn(server, ctx) {
+    for (const tool of TOOLS) {
+        server.registerTool(tool.name, { description: tool.description, inputSchema: tool.inputSchema }, async (args) => tool.handler(ctx, args ?? {}));
+    }
+}
+async function createSession(ctx) {
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: () => randomUUID(),
+        onsessioninitialized: (sessionId) => {
+            // sessionId is assigned by the transport during initialize handling
+            // (webStandardStreamableHttp.js:433), then this callback fires. Register
+            // here — NOT by reading transport.sessionId before handleRequest (that's
+            // always undefined at that point, and the old guard threw on every run).
+            if (sessions.has(sessionId))
+                return;
+            sessions.set(sessionId, { transport, server, ctx, lastSeen: Date.now() });
+        },
+    });
+    const server = new McpServer({ name: "devbot-forge", version: "1.0.0" }, { capabilities: { tools: {} } });
+    registerToolsOn(server, ctx);
+    // ponytail: cast through `as Transport` — the SDK's StreamableHTTPServerTransport
+    //   declares optional callbacks as `?: () => void` (no `| undefined`) while
+    //   our tsconfig has `exactOptionalPropertyTypes: true`, which makes the
+    //   implementation's `(() => void) | undefined` form incompatible with the
+    //   interface's stricter signature. The runtime shape is identical; this is
+    //   a type-only mismatch in the SDK's own declarations. Drop the cast if the
+    //   SDK ever ships `| undefined` on its Transport callbacks.
+    await server.connect(transport);
+    transport.onclose = () => {
+        const sid = transport.sessionId;
+        if (sid)
+            sessions.delete(sid);
+    };
+    // Returned before handleRequest runs; onsessioninitialized registers the
+    // session during the initialize request the caller is about to send.
+    return { transport, server };
+}
+// ---- Router ---------------------------------------------------------------
+export function mcpRouter() {
+    const router = Router();
+    // Host-header gate: defense-in-depth against DNS rebinding on top of the
+    // separate port (127.0.0.1 bind) + bearer auth. Allows host.containers.internal
+    // (the default MCP_BASE_URL the container uses via --add-host) alongside the
+    // localhost variants.
+    router.use(hostHeaderValidation(["localhost", "127.0.0.1", "[::1]", "host.containers.internal"]));
+    // Bearer auth runs before session routing — every request (initialize or
+    // subsequent) must present a valid token. The McpContext is stashed on the
+    // request for the session-creation path.
+    router.use((req, res, next) => {
+        const token = extractBearer(req);
+        if (!token) {
+            log.warn("mcp auth: missing bearer");
+            res.status(401).json({ error: "unauthorized" });
+            return;
+        }
+        const ctx = verifyMcpToken(token);
+        if (!ctx) {
+            log.warn("mcp auth: invalid or expired token");
+            res.status(401).json({ error: "unauthorized" });
+            return;
+        }
+        req.mcpCtx = ctx;
+        next();
+    });
+    const handle = async (req, res) => {
+        try {
+            const ctx = req.mcpCtx;
+            const sessionId = req.headers["mcp-session-id"];
+            // Existing session: validate id + token still maps to the same project.
+            if (sessionId) {
+                const state = sessions.get(sessionId);
+                if (!state) {
+                    res.status(404).json({ error: "session not found" });
+                    return;
+                }
+                if (state.ctx.projectId !== ctx.projectId ||
+                    state.ctx.workItemId !== ctx.workItemId ||
+                    state.ctx.workItemNumber !== ctx.workItemNumber) {
+                    // Token swapped mid-session — reject, don't silently rebind.
+                    log.warn("mcp session token mismatch", { sessionId });
+                    res.status(401).json({ error: "unauthorized" });
+                    return;
+                }
+                state.lastSeen = Date.now();
+                await state.transport.handleRequest(req, res, req.body);
+                return;
+            }
+            // No session id: this must be an initialize. Parse the body to confirm.
+            const body = req.body;
+            const method = body?.method;
+            if (method !== "initialize") {
+                res.status(400).json({ error: "missing Mcp-Session-Id header" });
+                return;
+            }
+            const { transport } = await createSession(ctx);
+            await transport.handleRequest(req, res, req.body);
+        }
+        catch (e) {
+            log.warn("mcp POST handler error", { err: e instanceof Error ? e.message : String(e) });
+            if (!res.headersSent)
+                res.status(500).json({ error: "internal error" });
+        }
+    };
+    router.post("/", handle);
+    router.get("/", (req, res) => {
+        // SSE stream for server-initiated notifications. Requires an existing
+        // session (the client opens this after initialize). Stateless clients
+        // that don't use notifications get a 405.
+        const sessionId = req.headers["mcp-session-id"];
+        const state = sessionId ? sessions.get(sessionId) : undefined;
+        if (!state) {
+            res.status(404).json({ error: "session not found" });
+            return;
+        }
+        state.transport.handleRequest(req, res).catch((e) => {
+            log.warn("mcp GET handler error", { err: e instanceof Error ? e.message : String(e) });
+            if (!res.headersSent)
+                res.status(500).json({ error: "internal error" });
+        });
+    });
+    router.delete("/", (req, res) => {
+        const sessionId = req.headers["mcp-session-id"];
+        if (sessionId) {
+            const state = sessions.get(sessionId);
+            if (state) {
+                state.transport.close().catch(() => { });
+                sessions.delete(sessionId);
+            }
+        }
+        res.status(204).end();
+    });
+    // ponytail: one-shot idle sweep on each new session creation, not a timer.
+    //   Cheap (Map iteration over a handful of live sessions) and avoids a
+    //   long-lived setInterval keeping the process awake.
+    setInterval(() => {
+        const now = Date.now();
+        for (const [id, state] of sessions) {
+            if (now - state.lastSeen > SESSION_TIMEOUT_MS) {
+                log.debug("mcp session idle timeout", { sessionId: id });
+                state.transport.close().catch(() => { });
+                sessions.delete(id);
+            }
+        }
+    }, 15 * 60 * 1000).unref();
+    return router;
+}
+//# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,qEAAqE,CAAC;AAC3G,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAmB,MAAM,eAAe,CAAC;AAEvD,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,SAAS,aAAa,CAAC,GAA+D;IACpF,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAsBD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEjD,yEAAyE;AACzE,2EAA2E;AAC3E,2EAA2E;AAC3E,6CAA6C;AAC7C,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,SAAS,eAAe,CAAC,MAAiB,EAAE,GAAe;IACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAChE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAe;IAC1C,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;QACtC,oBAAoB,EAAE,CAAC,SAAS,EAAE,EAAE;YAClC,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAO;YACpC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IACF,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,kFAAkF;IAClF,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAsB,CAAC,CAAC;IAE7C,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;QACvB,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC;QAChC,IAAI,GAAG;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,yEAAyE;IACzE,qEAAqE;IACrE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS;IACvB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,yEAAyE;IACzE,gFAAgF;IAChF,6EAA6E;IAC7E,sBAAsB;IACtB,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC,CAAC,CAAC;IAElG,yEAAyE;IACzE,2EAA2E;IAC3E,yCAAyC;IACzC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACA,GAAW,CAAC,MAAM,GAAG,GAAG,CAAC;QAC1B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAe,GAAG,CAAC,MAAM,CAAC;YACnC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;YAEtE,wEAAwE;YACxE,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACtC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBACrD,OAAO;gBACT,CAAC;gBACD,IACE,KAAK,CAAC,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;oBACrC,KAAK,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU;oBACvC,KAAK,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC,cAAc,EAC/C,CAAC;oBACD,6DAA6D;oBAC7D,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;oBACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAChD,OAAO;gBACT,CAAC;gBACD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,wEAAwE;YACxE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;YAC5B,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,GAAG,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3B,sEAAsE;QACtE,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QACtE,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YAClD,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvF,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QACtE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACxC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,uEAAuE;IACvE,sDAAsD;IACtD,WAAW,CAAC,GAAG,EAAE;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACnC,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,kBAAkB,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;gBACzD,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAE3B,OAAO,MAAM,CAAC;AAChB,CAAC"}