@wascartech/devbot 0.0.0-stage → 2.1.1

package/dist/mcp/volume-files.js

@@ -0,0 +1,187 @@
+// Read a single file out of a run's workspace volume for outbound attachment
+// upload (work item #49). The MCP server runs on the host and the agent's files
+// live in the per-work-item podman volume, so the only way to reach them is a
+// short-lived container — the same pattern as peer-sync.ts.
+//
+// The file is base64-encoded on stdout (text-safe, bounded by the size cap the
+// shell enforces before emitting anything), then decoded host-side. Path
+// validation happens in the shell (realpath under /workspace) so symlink and
+// traversal escapes are caught where the filesystem actually lives.
+import { config } from "../config.js";
+import { log } from "../logger.js";
+import { redact } from "../redact.js";
+import { podman } from "../podman.js";
+import { volumeName, logDriverArgs, volumeSelinuxArgs } from "../git.js";
+import { mimeForFilename } from "../attachments.js";
+import { PROJECT_ROOT, allowShellCasePatterns, denyShellCasePatterns, resolveProjectPath, } from "../path-sandbox.js";
+// Fixed staging dir for agent-produced throwaway files. Git-excluded at run
+// start (see ensureGitExcludes) so it can never be committed by `git add -A`.
+export const OUT_DIR = ".devbot-out";
+export const OUT_DIR_ABS = `/workspace/${OUT_DIR}`;
+// Subdirectory of the staging dir where downloaded work-item attachments land.
+// Inside OUT_DIR so it inherits the git exclude and never lands in the diff.
+export const INCOMING_DIR = `${OUT_DIR}/incoming`;
+export const INCOMING_DIR_ABS = `/workspace/${INCOMING_DIR}`;
+// Prompt block appended to every run. Tells the agent both attachment tools
+// exist, where attachment files live, and that the staging dir is git-excluded.
+export function attachmentPromptSection() {
+    return [
+        "## Attachments",
+        "",
+        `Attachments in the work item or discussion are **not** pre-read for you; their links appear inline. To inspect one, call \`download_work_item_attachment\` with the attachment's markdown link (or bare URL) exactly as it appears. It saves the file under \`${INCOMING_DIR}/\` and returns the local path — read it with your own tools. Image/PDF OCR is available on the downloaded file (\`tesseract\`, \`pdftotext\`, \`pdftoppm\` are installed).`,
+        "",
+        "## Sharing files with the user",
+        "",
+        `You can send screenshots, test logs, command output, or any generated artifact to the work item with the \`upload_work_item_attachment\` tool. It uploads the file and posts it as a comment (with an optional \`caption\`).`,
+        "",
+        `- Write throwaway output (screenshots, logs, reports) to \`${OUT_DIR}/\` at the repository root, then pass its path to the tool (e.g. \`path: "${OUT_DIR}/result.log"\`).`,
+        `- \`${OUT_DIR}/\` is git-excluded, so anything there (including downloaded attachments in \`${INCOMING_DIR}/\`) is never committed. Keep files outside it only when you deliberately want them in the diff.`,
+        "- Prefer sharing a screenshot or a short log extract over dumping large output into your reply.",
+    ].join("\n");
+}
+// Exit codes the read script uses to classify failures host-side.
+export const EXIT_NOT_FOUND = 3;
+export const EXIT_OVERSIZE = 4;
+export const EXIT_UNSAFE_PATH = 5;
+// The write script uses this when the target already exists and overwrite is off.
+export const EXIT_EXISTS = 6;
+/** Raised when a staging write would overwrite an existing file. Callers
+ *  suffix the filename and retry. */
+export class ExistsError extends Error {
+    constructor(path) {
+        super(`already exists: ${path}`);
+        this.name = "ExistsError";
+    }
+}
+function shq(s) {
+    return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+/** Resolve a tool-supplied path to an absolute path inside /workspace, rejecting
+ *  traversal, escapes, and denied segments (`.xdg-*`, `.git`, `.ssh`, `.env`).
+ *  Pure; no IO (the shell re-checks the real path). Delegates to the shared
+ *  policy in src/path-sandbox.ts so the rule set cannot drift. */
+export function resolveVolumePath(p) {
+    return resolveProjectPath(p);
+}
+// `case` patterns applied to the resolved realpath, so a symlink pointing at a
+// denied path is caught even though the lexical check upstream only sees the
+// symlink's own spelling. Allow patterns come first (`.env.example` also
+// matches the `.env.*` deny pattern).
+function deniedRealpathCase() {
+    const allow = allowShellCasePatterns().join("|");
+    const deny = denyShellCasePatterns().join("|");
+    return (`case "$rp" in ${allow}) ;; ` +
+        `${deny}) echo "path is restricted: $rp" >&2; exit ${EXIT_UNSAFE_PATH};; ` +
+        `esac`);
+}
+// Shell script: validate + base64. Distinct exit codes let the host classify the
+// failure. `realpath -e` fails when the path (or its parent) is missing; the
+// resolved path must remain under /workspace (catches symlink escapes) and must
+// not land on a denied hidden/system path.
+export function readFileScript(absPath, maxBytes) {
+    return [
+        "cd /workspace",
+        `p=${shq(absPath)}`,
+        `[ -e "$p" ] || { echo "file not found: $p" >&2; exit ${EXIT_NOT_FOUND}; }`,
+        `[ -f "$p" ] || { echo "not a regular file: $p" >&2; exit ${EXIT_NOT_FOUND}; }`,
+        `rp=$(realpath -e -- "$p" 2>/dev/null) || { echo "file not found: $p" >&2; exit ${EXIT_NOT_FOUND}; }`,
+        `case "$rp" in ${PROJECT_ROOT}/*) ;; *) echo "path escapes ${PROJECT_ROOT}: $rp" >&2; exit ${EXIT_UNSAFE_PATH};; esac`,
+        deniedRealpathCase(),
+        `sz=$(stat -c %s -- "$rp")`,
+        `[ "$sz" -le ${maxBytes} ] || { echo "file is larger than ${maxBytes} bytes ($sz)" >&2; exit ${EXIT_OVERSIZE}; }`,
+        `base64 -w0 -- "$rp"`,
+    ].join(" && ");
+}
+/** Read one file from the work-item volume. Throws a typed, user-readable error
+ *  for a missing/oversized/escaping path or a container failure. */
+export async function readFileFromVolume(workItemId, path, maxBytes, builderImage = config.BUILDER_IMAGE) {
+    const abs = resolveVolumePath(path);
+    const vol = volumeName(workItemId);
+    const r = await podman([
+        "run", "--rm", ...logDriverArgs(), "--name", `devbot-wi-${workItemId}-attachread`,
+        // Share the agent run container's SELinux level: mounting with :Z alone
+        // would relabel the volume to this helper's random pair and revoke the
+        // running agent's access.
+        ...volumeSelinuxArgs(workItemId),
+        "-v", `${vol}:/workspace:Z`,
+        builderImage,
+        "sh", "-c", readFileScript(abs, maxBytes),
+    ], { timeoutMs: 60_000 });
+    if (r.code === EXIT_NOT_FOUND)
+        throw new Error(`attachment not found: ${abs}`);
+    if (r.code === EXIT_OVERSIZE)
+        throw new Error(`attachment is larger than ${maxBytes} bytes`);
+    if (r.code === EXIT_UNSAFE_PATH) {
+        // The shell distinguishes "escapes /workspace" (traversal/absolute) from
+        // "path is restricted" (a symlink resolving onto .env/.git/.xdg-*); surface
+        // its reason so the caller sees which guard fired.
+        const reason = redact(r.stderr.trim().split("\n").pop() ?? "");
+        throw new Error(`attachment path rejected: ${reason || `escapes /workspace: ${abs}`}`);
+    }
+    if (r.code !== 0) {
+        const msg = redact(r.stderr.trim().slice(-300));
+        log.warn("attachment read failed", { workItemId, code: r.code });
+        throw new Error(`failed to read attachment (exit ${r.code})${msg ? `: ${msg}` : ""}`);
+    }
+    const bytes = Buffer.from(r.stdout.trim(), "base64");
+    const filename = abs.split("/").pop() ?? "attachment";
+    return { bytes, filename, contentType: mimeForFilename(filename) };
+}
+// Shell script: decode base64 from stdin and write it under the staging dir.
+// The caller has already sanitized `relPath` (no traversal). Defense in depth:
+// resolve the staging dir itself and require it to be exactly INCOMING_DIR_ABS
+// (so a symlinked `.devbot-out/incoming` is refused before any bytes are
+// written), refuse to overwrite (incl. through a dangling symlink), and
+// re-check that the written path resolves inside the staging dir.
+export function writeFileScript(relPath) {
+    return [
+        "umask 002",
+        "cd /workspace",
+        `mkdir -p ${INCOMING_DIR} || { echo "staging dir unavailable" >&2; exit ${EXIT_UNSAFE_PATH}; }`,
+        `dir=$(realpath -e -- ${INCOMING_DIR})`,
+        `[ "$dir" = ${INCOMING_DIR_ABS} ] || { echo "staging dir resolves elsewhere: $dir" >&2; exit ${EXIT_UNSAFE_PATH}; }`,
+        // Best-effort group-write on the staging dirs: the bash tool runs as the
+        // unprivileged `agent` UID (gid devbot), which cannot create files in a
+        // devbot-owned 0755 dir — so OCR output written beside a downloaded
+        // attachment (e.g. `tesseract in.png out`) would fail EACCES. A chmod
+        // EPERM (custom builder image) leaves the previous behavior.
+        `{ chmod 0775 ${OUT_DIR} ${INCOMING_DIR} 2>/dev/null || true; }`,
+        `{ [ ! -e ${shq(relPath)} ] && [ ! -L ${shq(relPath)} ]; } || { echo "already exists: ${shq(relPath)}" >&2; exit ${EXIT_EXISTS}; }`,
+        `base64 -d > ${shq(relPath)}`,
+        `rp=$(realpath -e -- ${shq(relPath)})`,
+        `case "$rp" in ${INCOMING_DIR_ABS}/*) ;; *) echo "wrote outside staging dir: $rp" >&2; exit ${EXIT_UNSAFE_PATH};; esac`,
+    ].join(" && ");
+}
+/** Write bytes into the work-item volume under the git-excluded staging dir.
+ *  `relPath` must be a path inside `OUT_DIR` (the caller sanitizes the
+ *  filename); this mirrors `readFileFromVolume` in reverse — a short-lived
+ *  container with the workspace volume. The bytes travel on stdin (base64), not
+ *  in argv, so a large attachment never hits the OS argument-size limit. Throws
+ *  a typed error on an escaping path or container failure. */
+export async function writeFileToVolume(workItemId, relPath, bytes, builderImage = config.BUILDER_IMAGE) {
+    const abs = resolveVolumePath(relPath);
+    if (abs !== INCOMING_DIR_ABS && !abs.startsWith(`${INCOMING_DIR_ABS}/`)) {
+        throw new Error(`attachment staging path must be inside ${INCOMING_DIR_ABS}: ${abs}`);
+    }
+    const vol = volumeName(workItemId);
+    const r = await podman([
+        "run", "--rm", "-i", ...logDriverArgs(), "--name", `devbot-wi-${workItemId}-attachdl`,
+        ...volumeSelinuxArgs(workItemId),
+        "-v", `${vol}:/workspace:Z`,
+        builderImage,
+        "sh", "-c", writeFileScript(abs),
+    ], { timeoutMs: 60_000, input: bytes.toString("base64") });
+    if (r.code === EXIT_EXISTS) {
+        throw new ExistsError(abs);
+    }
+    if (r.code === EXIT_UNSAFE_PATH) {
+        const reason = redact(r.stderr.trim().split("\n").pop() ?? "");
+        throw new Error(`attachment path rejected: ${reason || `escapes ${INCOMING_DIR_ABS}: ${abs}`}`);
+    }
+    if (r.code !== 0) {
+        const msg = redact(r.stderr.trim().slice(-300));
+        log.warn("attachment write failed", { workItemId, code: r.code });
+        throw new Error(`failed to write attachment (exit ${r.code})${msg ? `: ${msg}` : ""}`);
+    }
+}
+//# sourceMappingURL=volume-files.js.map

package/dist/mcp/volume-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"volume-files.js","sourceRoot":"","sources":["../../src/mcp/volume-files.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,4DAA4D;AAC5D,EAAE;AACF,+EAA+E;AAC/E,yEAAyE;AACzE,6EAA6E;AAC7E,oEAAoE;AAEpE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC;AACrC,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,OAAO,EAAE,CAAC;AAEnD,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,OAAO,WAAW,CAAC;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,YAAY,EAAE,CAAC;AAE7D,4EAA4E;AAC5E,gFAAgF;AAChF,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,gBAAgB;QAChB,EAAE;QACF,iQAAiQ,YAAY,6KAA6K;QAC1b,EAAE;QACF,gCAAgC;QAChC,EAAE;QACF,8NAA8N;QAC9N,EAAE;QACF,8DAA8D,OAAO,6EAA6E,OAAO,kBAAkB;QAC3K,OAAO,OAAO,iFAAiF,YAAY,kGAAkG;QAC7M,iGAAiG;KAClG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAE7B;qCACqC;AACrC,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,IAAY;QACtB,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;AAC9C,CAAC;AAED;;;kEAGkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,sCAAsC;AACtC,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO,CACL,iBAAiB,KAAK,OAAO;QAC7B,GAAG,IAAI,8CAA8C,gBAAgB,KAAK;QAC1E,MAAM,CACP,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,6EAA6E;AAC7E,gFAAgF;AAChF,2CAA2C;AAC3C,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,QAAgB;IAC9D,OAAO;QACL,eAAe;QACf,KAAK,GAAG,CAAC,OAAO,CAAC,EAAE;QACnB,wDAAwD,cAAc,KAAK;QAC3E,4DAA4D,cAAc,KAAK;QAC/E,kFAAkF,cAAc,KAAK;QACrG,iBAAiB,YAAY,gCAAgC,YAAY,oBAAoB,gBAAgB,SAAS;QACtH,kBAAkB,EAAE;QACpB,2BAA2B;QAC3B,eAAe,QAAQ,qCAAqC,QAAQ,2BAA2B,aAAa,KAAK;QACjH,qBAAqB;KACtB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjB,CAAC;AAQD;oEACoE;AACpE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,IAAY,EACZ,QAAgB,EAChB,eAAuB,MAAM,CAAC,aAAa;IAE3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB;QACE,KAAK,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,EAAE,QAAQ,EAAE,aAAa,UAAU,aAAa;QACjF,wEAAwE;QACxE,uEAAuE;QACvE,0BAA0B;QAC1B,GAAG,iBAAiB,CAAC,UAAU,CAAC;QAChC,IAAI,EAAE,GAAG,GAAG,eAAe;QAC3B,YAAY;QACZ,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC;KAC1C,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IAEF,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,QAAQ,CAAC,CAAC;IAC7F,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAChC,yEAAyE;QACzE,4EAA4E;QAC5E,mDAAmD;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,IAAI,uBAAuB,GAAG,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,YAAY,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,yEAAyE;AACzE,wEAAwE;AACxE,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO;QACL,WAAW;QACX,eAAe;QACf,YAAY,YAAY,kDAAkD,gBAAgB,KAAK;QAC/F,wBAAwB,YAAY,GAAG;QACvC,cAAc,gBAAgB,iEAAiE,gBAAgB,KAAK;QACpH,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,sEAAsE;QACtE,6DAA6D;QAC7D,gBAAgB,OAAO,IAAI,YAAY,yBAAyB;QAChE,YAAY,GAAG,CAAC,OAAO,CAAC,gBAAgB,GAAG,CAAC,OAAO,CAAC,oCAAoC,GAAG,CAAC,OAAO,CAAC,eAAe,WAAW,KAAK;QACnI,eAAe,GAAG,CAAC,OAAO,CAAC,EAAE;QAC7B,uBAAuB,GAAG,CAAC,OAAO,CAAC,GAAG;QACtC,iBAAiB,gBAAgB,6DAA6D,gBAAgB,SAAS;KACxH,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjB,CAAC;AAED;;;;;8DAK8D;AAC9D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,OAAe,EACf,KAAa,EACb,eAAuB,MAAM,CAAC,aAAa;IAE3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,0CAA0C,gBAAgB,KAAK,GAAG,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB;QACE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,EAAE,QAAQ,EAAE,aAAa,UAAU,WAAW;QACrF,GAAG,iBAAiB,CAAC,UAAU,CAAC;QAChC,IAAI,EAAE,GAAG,GAAG,eAAe;QAC3B,YAAY;QACZ,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC;KACjC,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CACvD,CAAC;IAEF,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,IAAI,WAAW,gBAAgB,KAAK,GAAG,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}

package/dist/mcp-auth-store.js

@@ -0,0 +1,134 @@
+import { db } from "./db.js";
+import { log } from "./logger.js";
+import { encrypt, decryptOrPlaintext } from "./crypto-util.js";
+import { McpAuthEntrySchema } from "./types/mcp-config.js";
+// Per-project MCP OAuth entries — one row per (project_id, server name).
+// Stores the opencode `mcp-auth.json` entry for a server, scoped to the
+// project so revoking a project drops its tokens. Same DB file (devbot.db,
+// 0600). Secrets (accessToken / clientSecret) live here in plaintext, same
+// posture as project_tokens.signing_token and mcp_thread_tokens.
+export function initMcpAuthTables() {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS project_mcp_auth (
+      project_id  INTEGER NOT NULL,
+      name        TEXT    NOT NULL,
+      entry       TEXT    NOT NULL,
+      created_at  INTEGER NOT NULL,
+      updated_at  INTEGER NOT NULL,
+      PRIMARY KEY (project_id, name)
+    )
+  `);
+}
+export function getMcpAuthEntry(projectId, name) {
+    return getMcpAuth(projectId, name);
+}
+function getMcpAuth(projectId, name) {
+    const row = db
+        .prepare("SELECT entry FROM project_mcp_auth WHERE project_id = ? AND name = ?")
+        .get(projectId, name);
+    if (!row)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(decryptOrPlaintext(row.entry));
+    }
+    catch {
+        log.warn("mcp auth row not JSON, dropping", { projectId, name });
+        deleteMcpAuth(projectId, name);
+        return null;
+    }
+    const v = McpAuthEntrySchema.safeParse(parsed);
+    if (!v.success) {
+        log.warn("mcp auth row failed schema, dropping", { projectId, name });
+        deleteMcpAuth(projectId, name);
+        return null;
+    }
+    return v.data;
+}
+// Stripped shape for the browser — never exposes accessToken / clientSecret.
+export function getMcpAuthSummary(projectId, name) {
+    const e = getMcpAuth(projectId, name);
+    if (!e)
+        return null;
+    return {
+        hasTokens: true,
+        hasRefreshToken: !!e.tokens.refreshToken,
+        expiresAt: e.tokens.expiresAt,
+        scope: e.tokens.scope,
+        hasClientInfo: !!e.clientInfo,
+        serverUrl: e.serverUrl,
+    };
+}
+export function upsertMcpAuth(projectId, name, entry) {
+    const v = McpAuthEntrySchema.safeParse(entry);
+    if (!v.success) {
+        throw new Error("invalid mcp auth entry");
+    }
+    const now = Math.floor(Date.now() / 1000);
+    db.prepare(`INSERT OR REPLACE INTO project_mcp_auth
+       (project_id, name, entry, created_at, updated_at)
+     VALUES (?, ?, ?,
+       COALESCE((SELECT created_at FROM project_mcp_auth WHERE project_id = ? AND name = ?), ?),
+       ?)`).run(projectId, name, encrypt(JSON.stringify(v.data)), projectId, name, now, now);
+}
+export function deleteMcpAuth(projectId, name) {
+    const r = db
+        .prepare("DELETE FROM project_mcp_auth WHERE project_id = ? AND name = ?")
+        .run(projectId, name);
+    return r.changes > 0;
+}
+export function deleteAllMcpAuth(projectId) {
+    db.prepare("DELETE FROM project_mcp_auth WHERE project_id = ?").run(projectId);
+}
+// Every (scope, name) pair that has a stored auth row. Used by the refresh
+// scheduler to sweep global + all project scopes without enumerating projects.
+export function listMcpAuthScopes() {
+    return db
+        .prepare("SELECT project_id AS scopeId, name FROM project_mcp_auth ORDER BY project_id, name")
+        .all();
+}
+// Build the opencode `mcp-auth.json` object for a project: a map of
+// { [name]: entry } for every stored auth row. The runner writes this to
+// /home/devbot/.xdg/data/opencode/mcp-auth.json on the per-work-item xdg
+// volume (outside the cloned repo, so it can never be committed).
+// Re-validates each row; invalid rows are skipped (never crash a run over
+// one hand-edited DB row). `serverUrl` is force-overwritten with the matching
+// config's url before emit — opencode's getForUrl() silently ignores tokens
+// whose serverUrl doesn't match the config url, so this rewrite is required.
+export function buildMcpAuthJson(projectId, configs) {
+    const rows = db
+        .prepare("SELECT name, entry FROM project_mcp_auth WHERE project_id = ?")
+        .all(projectId);
+    const out = {};
+    for (const r of rows) {
+        let parsed;
+        try {
+            parsed = JSON.parse(decryptOrPlaintext(r.entry));
+        }
+        catch {
+            log.warn("mcp auth row not JSON, skipping", { projectId, name: r.name });
+            continue;
+        }
+        const v = McpAuthEntrySchema.safeParse(parsed);
+        if (!v.success) {
+            log.warn("mcp auth row failed schema, skipping", { projectId, name: r.name });
+            continue;
+        }
+        const cfg = configs.get(r.name);
+        const entry = { ...v.data };
+        if (cfg?.url)
+            entry.serverUrl = cfg.url;
+        out[r.name] = entry;
+    }
+    return out;
+}
+// Merge auth entries across scopes in order; later scopes win on name collision
+// (project overrides global). Same serverUrl rewrite as buildMcpAuthJson.
+export function buildMcpAuthJsonForScopes(scopeIds, configs) {
+    const out = {};
+    for (const scope of scopeIds) {
+        Object.assign(out, buildMcpAuthJson(scope, configs));
+    }
+    return out;
+}
+//# sourceMappingURL=mcp-auth-store.js.map

package/dist/mcp-auth-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth-store.js","sourceRoot":"","sources":["../src/mcp-auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAA0C,MAAM,uBAAuB,CAAC;AAEnG,yEAAyE;AACzE,wEAAwE;AACxE,2EAA2E;AAC3E,2EAA2E;AAC3E,iEAAiE;AAEjE,MAAM,UAAU,iBAAiB;IAC/B,EAAE,CAAC,IAAI,CAAC;;;;;;;;;GASP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,IAAY;IAC7D,OAAO,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB,EAAE,IAAY;IACjD,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,sEAAsE,CAAC;SAC/E,GAAG,CAAC,SAAS,EAAE,IAAI,CAAkC,CAAC;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,IAAY;IAC/D,MAAM,CAAC,GAAG,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO;QACL,SAAS,EAAE,IAAI;QACf,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY;QACxC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;QAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK;QACrB,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU;QAC7B,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,IAAY,EAAE,KAAmB;IAChF,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,EAAE,CAAC,OAAO,CACR;;;;UAIM,CACP,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,IAAY;IAC3D,MAAM,CAAC,GAAG,EAAE;SACT,OAAO,CAAC,gEAAgE,CAAC;SACzE,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACjF,CAAC;AAED,2EAA2E;AAC3E,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB;IAC/B,OAAO,EAAE;SACN,OAAO,CAAC,oFAAoF,CAAC;SAC7F,GAAG,EAA8C,CAAC;AACvD,CAAC;AAED,oEAAoE;AACpE,yEAAyE;AACzE,yEAAyE;AACzE,kEAAkE;AAClE,0EAA0E;AAC1E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,OAAsC;IAEtC,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,+DAA+D,CAAC;SACxE,GAAG,CAAC,SAAS,CAA2C,CAAC;IAC5D,MAAM,GAAG,GAAiC,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,KAAK,GAAiB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,GAAG,EAAE,GAAG;YAAE,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC;QACxC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CACvC,QAAkB,EAClB,OAAsC;IAEtC,MAAM,GAAG,GAAiC,EAAE,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/mcp-config-store.js

@@ -0,0 +1,83 @@
+import { db } from "./db.js";
+import { log } from "./logger.js";
+import { McpServerConfigSchema } from "./types/mcp-config.js";
+import { GLOBAL_SCOPE_ID } from "./types/global-settings.js";
+// Per-project external MCP server configs. Same DB file as project_tokens and
+// mcp_thread_tokens (devbot.db, 0600). Keyed by (project_id, name); the config
+// JSON is validated by McpServerConfigSchema on write and re-validated on read
+// (the runner is the trust boundary for what opencode actually receives).
+export function initMcpConfigTables() {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS project_mcp_servers (
+      project_id  INTEGER NOT NULL,
+      name        TEXT    NOT NULL,
+      config      TEXT    NOT NULL,
+      created_at  INTEGER NOT NULL,
+      updated_at  INTEGER NOT NULL,
+      PRIMARY KEY (project_id, name)
+    )
+  `);
+}
+export function listMcpServers(projectId) {
+    const rows = db
+        .prepare("SELECT name, config FROM project_mcp_servers WHERE project_id = ? ORDER BY name")
+        .all(projectId);
+    const out = [];
+    for (const r of rows) {
+        let parsed;
+        try {
+            parsed = JSON.parse(r.config);
+        }
+        catch {
+            log.warn("mcp config row not JSON, skipping", { projectId, name: r.name });
+            continue;
+        }
+        const v = McpServerConfigSchema.safeParse(parsed);
+        if (!v.success) {
+            log.warn("mcp config row failed schema, skipping", { projectId, name: r.name });
+            continue;
+        }
+        out.push({ name: r.name, config: v.data });
+    }
+    return out;
+}
+export function upsertMcpServer(projectId, name, config) {
+    // Re-validate at the store boundary — the API layer validates too, but this
+    // is the trust boundary for the runner.
+    const v = McpServerConfigSchema.safeParse(config);
+    if (!v.success) {
+        throw new Error("invalid mcp server config");
+    }
+    const now = Math.floor(Date.now() / 1000);
+    // COALESCE preserves created_at across re-PUTs; updated_at always bumps.
+    db.prepare(`INSERT OR REPLACE INTO project_mcp_servers
+       (project_id, name, config, created_at, updated_at)
+     VALUES (?, ?, ?,
+       COALESCE((SELECT created_at FROM project_mcp_servers WHERE project_id = ? AND name = ?), ?),
+       ?)`).run(projectId, name, JSON.stringify(v.data), projectId, name, now, now);
+}
+export function deleteMcpServer(projectId, name) {
+    const r = db
+        .prepare("DELETE FROM project_mcp_servers WHERE project_id = ? AND name = ?")
+        .run(projectId, name);
+    return r.changes > 0;
+}
+export function deleteAllMcpServers(projectId) {
+    db.prepare("DELETE FROM project_mcp_servers WHERE project_id = ?").run(projectId);
+}
+// ---- Global scope (project_id = GLOBAL_SCOPE_ID) ---------------------------
+// Global MCP servers reuse the per-project table with the sentinel scope id.
+// The runner merges global → project (project wins on name collision).
+export function listGlobalMcpServers() {
+    return listMcpServers(GLOBAL_SCOPE_ID);
+}
+export function upsertGlobalMcpServer(name, config) {
+    upsertMcpServer(GLOBAL_SCOPE_ID, name, config);
+}
+export function deleteGlobalMcpServer(name) {
+    return deleteMcpServer(GLOBAL_SCOPE_ID, name);
+}
+export function deleteAllGlobalMcpServers() {
+    deleteAllMcpServers(GLOBAL_SCOPE_ID);
+}
+//# sourceMappingURL=mcp-config-store.js.map

package/dist/mcp-config-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config-store.js","sourceRoot":"","sources":["../src/mcp-config-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAwB,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAE1E,MAAM,UAAU,mBAAmB;IACjC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;GASP,CAAC,CAAC;AACL,CAAC;AAOD,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,iFAAiF,CAAC;SAC1F,GAAG,CAAC,SAAS,CAA4C,CAAC;IAC7D,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAChF,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,IAAY,EAAE,MAAuB;IACtF,4EAA4E;IAC5E,wCAAwC;IACxC,MAAM,CAAC,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,yEAAyE;IACzE,EAAE,CAAC,OAAO,CACR;;;;UAIM,CACP,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,IAAY;IAC7D,MAAM,CAAC,GAAG,EAAE;SACT,OAAO,CAAC,mEAAmE,CAAC;SAC5E,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,EAAE,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACpF,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,uEAAuE;AAEvE,MAAM,UAAU,oBAAoB;IAClC,OAAO,cAAc,CAAC,eAAe,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,MAAuB;IACzE,eAAe,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,mBAAmB,CAAC,eAAe,CAAC,CAAC;AACvC,CAAC"}