deepadb 1.1.0 → 1.1.2

package/LICENSE

@@ -1,21 +1,202 @@
-MIT License
-
-Copyright (c) 2025 Jason
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Jason <fullread@github>
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,16 @@
+DeepADB
+Copyright 2026 Jason <fullread@github>
+
+This product includes software developed by Jason (https://github.com/fullread).
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this software except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -2,7 +2,7 @@
 
 MCP (Model Context Protocol) server providing full Android Debug Bridge (ADB) integration for AI agents. Enables MCP clients to directly interact with connected Android devices — inspecting state, running commands, managing apps, capturing logs, controlling device settings, analyzing UI hierarchies, recording screens, managing emulators, running structured test sessions, orchestrating multi-device operations, capturing network traffic, running CI pipelines, auditing accessibility, detecting performance regressions, executing cloud device farm tests, debugging over WiFi, building projects, and managing community plugins.
 
-**180 tools, 4 resources, and 4 prompts across 43 modules** — the most comprehensive ADB MCP server available, with triple transport (stdio + HTTP/SSE + WebSocket), optional GraphQL API, defense-in-depth security, modem firmware analysis, workflow marketplace, AT command interface with multi-chipset support, RIL message interception, device profiling, baseband/modem integration, automated test generation, OTA update monitoring, SELinux auditing, thermal/power profiling, network device discovery, visual regression detection, workflow orchestration, accessibility auditing, and contextual truncation.
+**204 tools, 5 resources, and 4 prompts across 45 modules** — the most comprehensive ADB MCP server available, with triple transport (stdio + HTTP/SSE + WebSocket), optional GraphQL API, defense-in-depth security, modem firmware analysis, workflow marketplace, AT command interface with multi-chipset support, RIL message interception, device profiling, baseband/modem integration, automated test generation, OTA update monitoring, SELinux auditing, thermal/power profiling, network device discovery, visual regression detection, workflow orchestration, accessibility auditing, and contextual truncation.
 
 ## Architecture
 
@@ -16,7 +16,7 @@ MCP (Model Context Protocol) server providing full Android Debug Bridge (ADB) in
 │               DeepADB Server                     │
 │                                                  │
 │  ┌─────────────────────────────────────────────┐ │
-│  │           Tool Modules (43)                 │ │
+│  │           Tool Modules (45)                 │ │
 │  │  device │ shell │ packages │ files │ logs   │ │
 │  │  diagnostics │ ui │ build │ health          │ │
 │  │  wireless │ control │ logcat-watch          │ │
@@ -25,14 +25,15 @@ MCP (Model Context Protocol) server providing full Android Debug Bridge (ADB) in
 │  │  network-capture │ ci │ plugins │ baseband  │ │
 │  │  accessibility │ regression                 │ │
 │  │  device-farm │ registry │ at-commands       │ │
-│  │  screenshot-diff │ workflow                 │ │
+│  │  screenshot-diff │ workflow │ sensors       │ │
 │  │  split-apk │ mirroring │ test-gen           │ │
 │  │  ota-monitor │ ril-intercept                │ │
 │  │  device-profiles │ firmware-analysis        │ │
 │  │  workflow-market │ selinux-audit            │ │
 │  │  thermal-power │ network-discovery          │ │
+│  │  input-gestures │ wireless-firmware         │ │
 │  ├─────────────────────────────────────────────┤ │
-│  │  Resources (4) │ Prompts (4)                │ │
+│  │  Resources (5) │ Prompts (4)                │ │
 │  └───────────────────┬─────────────────────────┘ │
 │                      │                           │
 │  ┌───────────────────▼─────────────────────────┐ │
@@ -78,15 +79,20 @@ DeepADB operates in two modes, auto-detected at startup:
 ```
 AI Agent (PC) ←→ MCP ←→ DeepADB (PC) ←→ ADB (USB) ←→ Android Device
 ```
-Standard mode: DeepADB runs on a PC/Mac/Linux host and communicates with the device over USB via ADB. All 180 tools work through the ADB bridge with automatic retry on transient failures.
+Standard mode: DeepADB runs on a PC/Mac/Linux host and communicates with the device over USB via ADB. All 204 tools work through the ADB bridge with automatic retry on transient failures.
 
 ### On-Device Mode — direct local execution
 ```
 AI Agent (Termux) ←→ MCP (stdio/HTTP) ←→ DeepADB (Termux) ←→ sh/su (local)
 ```
-When DeepADB runs directly on the Android device (e.g., inside Termux), it auto-detects the environment and switches to `LocalBridge`. Commands execute directly via `sh`/`su` — no ADB server, no USB, no serialization overhead. All 180 tools work identically, with significantly lower latency.
+When DeepADB runs directly on the Android device (e.g., inside Termux), it auto-detects the environment and switches to `LocalBridge`. Commands execute directly via `sh`/`su` — no ADB server, no USB, no serialization overhead. All 204 tools work identically, with significantly lower latency.
 
-**Validated on hardware:** 257/257 tests pass on Pixel 6a (Android 16, Termux + Magisk + QEMU 10.2.1) in on-device mode with DA_TEST_PIN. Includes QEMU/KVM virtualization tests covering setup detection, disk image lifecycle, resource budget reporting, Alpine Linux VM boot with KVM acceleration, big.LITTLE CPU topology detection, guest ADB connectivity error handling, and clean VM shutdown. In ADB mode: 235 total (230 passed with DA_TEST_PIN, 5 QEMU tests auto-skip).
+**Validated on hardware** (Pixel 6a, Android 16, Termux + Magisk + QEMU 10.2.1) across a four-cell test matrix — host (ADB) and on-device (LocalBridge), each with and without a device PIN — with **0 failures in every cell**. The full suite is 577 tests in the host/ADB configuration and 613 on-device; the difference is the QEMU virtualization and Alpine VM-boot suites, which run only on-device:
+
+- **ADB mode, no PIN:** 556 passed / 0 failed / 21 skipped (577 total). Skips: 5 QEMU (on-device only), 7 gracefulKill unit tests (require POSIX signals, skipped on the Windows host), 3 tcpdump sanitization (tcpdump is root-only and unreachable over a non-root ADB shell), 2 host-shell round-trips (require a POSIX /bin/sh), 4 screen-state (require DA_TEST_PIN).
+- **ADB mode, with PIN:** 560 passed / 0 failed / 17 skipped (577 total). The 4 screen-state tests unlock and run.
+- **On-device mode, no PIN:** 606 passed / 0 failed / 7 skipped (613 total). All QEMU tests run, including Alpine Linux VM boot with KVM acceleration, big.LITTLE CPU topology detection, guest ADB connectivity error handling, and clean VM shutdown; the tcpdump and gracefulKill suites also run here (root + POSIX). Skips: 3 QEMU setup steps that no-op when the Alpine kernel/initrd/disk are already cached, 4 screen-state (require PIN).
+- **On-device mode, with PIN:** 610 passed / 0 failed / 3 skipped (613 total). Every test enabled by the environment runs; the 3 skips are the cached-VM setup steps.
 
 **Privilege escalation:** In ADB mode, all shell commands run as uid=2000 (the `shell` user) which has system-level permissions. In Termux, commands run as a regular app user. LocalBridge automatically elevates privileged commands through `su` when root (Magisk) is available:
 - **Command allowlist:** 16 system commands (`settings`, `dumpsys`, `am`, `input`, `screencap`, `screenrecord`, `uiautomator`, `app_process`, `getenforce`, `setenforce`, `cmd`, `pm`, `wm`, `svc`, `ip`, `ifconfig`) are routed through `su -c` to match ADB-mode behavior.
@@ -136,7 +142,7 @@ DA_GRAPHQL_PORT=4000 npm start
 }
 ```
 
-## Available Tools (180)
+## Available Tools (204)
 
 ### Health (1 tool)
 - `adb_health_check` — Comprehensive toolchain validation: ADB binary, server, device connection, authorization, root access, and storage writability
@@ -164,11 +170,25 @@ DA_GRAPHQL_PORT=4000 npm start
 - `adb_restart_app` — Force-stop then re-launch in one call (configurable delay)
 - `adb_resolve_intents` — Discover registered activities, services, and receivers with intent filters
 
-### Files (4 tools)
-- `adb_push` — Push local file to device
+### Files (18 tools)
+- `adb_push` — Push local file to device (hard-blocked kernel paths, fs-type awareness, storage reporting)
 - `adb_pull` — Pull file from device to local filesystem
 - `adb_ls` — List device directory contents (simple or detailed)
 - `adb_cat` — Read text file from device with optional line limit
+- `adb_file_write` — Create or overwrite text files via heredoc (buffer limit warning, fs-aware, post-verify)
+- `adb_find` — Search for files by name/pattern with depth control and result capping
+- `adb_file_stat` — File metadata: size, permissions, timestamps, ownership, SELinux context
+- `adb_file_checksum` — SHA-256/SHA-1/MD5 hash with size-based timeout estimation
+- `adb_mkdir` — Create directories with parent creation (-p), hard-blocked kernel paths
+- `adb_rm` — Delete files/directories with depth-based recursive protection and symlink resolution
+- `adb_file_move` — Move/rename with source depth protection and post-verify
+- `adb_file_copy` — Copy with pre-flight size+space check and post-verify size match
+- `adb_file_chmod` — Change permissions (Zod-validated octal mode, depth-based recursive protection)
+- `adb_file_touch` — Create empty files or update timestamps (explicit timestamp support)
+- `adb_file_fsinfo` — Filesystem report: type, mount, capacity, capabilities, SELinux, limitations
+- `adb_file_chown` — Change ownership (root required, depth-based recursive protection)
+- `adb_grep` — Search file contents with fixed-string default, recursive depth control, result capping
+- `adb_file_replace` — Find/replace text in files (sed-backed, proper escaping, backup option)
 
 ### Logs — Snapshots (3 tools)
 - `adb_logcat` — Filtered logcat snapshot with tag, priority, grep, and buffer selection
@@ -221,10 +241,15 @@ DA_GRAPHQL_PORT=4000 npm start
 - `adb_disconnect` — Disconnect wireless device(s)
 - `adb_tcpip` — Switch USB device to TCP/IP mode (auto-detects device IP)
 
-### Port Forwarding (3 tools)
+### Port Forwarding (8 tools)
 - `adb_forward` — Forward a local port to a device port (host → device)
 - `adb_reverse` — Reverse-forward a device port to the host (device → host)
 - `adb_forward_list` — List all active forward and reverse port mappings
+- `adb_forward_remove` — Remove a port forward or all forwards
+- `adb_reverse_remove` — Remove a reverse forward or all reverse forwards
+- `adb_tunnel_open` — Open a managed tunnel with opaque ID. Auto-picks a free host port for forward direction when omitted; registers cleanup so the tunnel is removed on server exit
+- `adb_tunnel_list` — List active managed tunnels (those opened via adb_tunnel_open). Optional device filter; shows ID, direction, endpoints, and age
+- `adb_tunnel_close` — Close a managed tunnel by ID, or close all at once with id="all"
 
 ### Emulator Management (3 tools)
 - `adb_avd_list` — List available AVDs (PC mode) or detect KVM/QEMU virtualization capabilities (on-device mode)
@@ -404,7 +429,16 @@ DA_GRAPHQL_PORT=4000 npm start
 - `adb_network_device_ip` — Get the WiFi IP of a connected device via multiple methods. Shows ADB TCP status and wireless connection instructions
 - `adb_network_auto_connect` — One-step discover + connect: scans for ADB devices and automatically runs adb connect on each found listener
 
-## MCP Resources (4)
+### Hardware Sensor Access (2 tools)
+- `adb_sensor_read` — Read current hardware sensor values via dumpsys sensorservice. Enumerates all sensors with vendor, type, mode, rate range, and wake capability. Returns last-known readings with timestamps and axis-labeled formatting. Category filter (13 categories) and listOnly discovery mode. No root required
+- `adb_iio_read` — Read raw hardware data from the Linux IIO subsystem. Auto-discovers IIO devices, classifies by kernel driver. On Tensor/Exynos: exposes per-rail ODPM power monitors showing real-time power consumption per SoC subsystem. Generic IIO path handles raw channels with calibrated scale+offset. Root required
+
+### Result Handles (3 tools)
+- `adb_result_list` — List active result handles in the tempdir-backed cache. Shows tool, name, size, age, and remaining TTL for each handle
+- `adb_result_get` — Retrieve the content of a stored handle by tool + name. Returns the original content blocks as the source tool produced them; updates last-accessed time. For URI-based retrieval, use the `result://{tool}/{name}` MCP Resource instead
+- `adb_result_drop` — Delete a stored result handle, or clear all handles in the current namespace. Pass both `tool` and `name` to drop one specific handle, or `all: true` to drop everything. Useful before changing DA_AUTH_TOKEN (which would otherwise leave orphans under the old token-hash directory)
+
+## MCP Resources (5)
 
 Read-only device state surfaces accessible by MCP clients:
 
@@ -412,6 +446,7 @@ Read-only device state surfaces accessible by MCP clients:
 - `device://info/{serial}` — Device properties (model, OS, build, ABI)
 - `device://battery/{serial}` — Parsed battery status (level, charging, temperature, voltage)
 - `device://telephony/{serial}` — Telephony registry state for cellular analysis
+- `result://{tool}/{name}` — Stored tool result handle. Resolve by URI; created by tools that opt into result-handle storage via the `result_handle` parameter. Listed by adb_result_list
 
 ## MCP Prompts (4)
 
@@ -443,7 +478,7 @@ Full view tree capture via `uiautomator dump` with parsed XML extraction. Return
 Multi-layered security activated via `DA_SECURITY=true`. Provides command blocklist/allowlist filtering, rate limiting (commands per minute), and audit logging with automatic credential redaction. Security checks are integrated into `adb_shell`, `adb_root_shell`, `adb_multi_shell`, `adb_multi_compare`, `adb_input`, `adb_batch_actions`, and `adb_start_activity`. Configurable via environment variables for different deployment scenarios.
 
 ### Input Sanitization
-All tools that interpolate user-supplied parameters into shell command strings validate inputs against shell metacharacters before execution. Package names, property keys, service names, setting keys, test identifiers, network interface names, and tcpdump filters are all validated through a centralized `validateShellArg()` function that rejects `;`, `|`, `&`, `$`, backticks, parentheses, and other injection vectors. File paths use single-quoted shell escaping to prevent `$()` command substitution. The `adb_input` tool applies type-specific validation: `tap`/`swipe` accept only numeric coordinates, `keyevent` accepts only alphanumeric keycodes, and `text` is shell-escaped for literal delivery. The `adb_batch_actions` tool enforces the same per-action-type validation (digits-only for coordinates, alphanumeric for keycodes, shell-escape for text) and routes every assembled command through the security middleware. Deserialized JSON from snapshot files is validated before shell interpolation. Every `z.number()` parameter across all 180 tools has explicit `.min()/.max()` Zod bounds to prevent resource exhaustion from extreme values. The LocalBridge has explicit handlers for every ADB subcommand used by tool modules, preventing unquoted fallthrough to the default shell handler. In on-device mode, privilege escalation uses a frozen 16-command allowlist and restricted-path regex — the elevation set is `ReadonlySet` + `Object.freeze`, not configurable at runtime. The HTTP/SSE transport denies cross-origin requests by default (configurable via `DA_HTTP_CORS_ORIGIN`), the plugin registry verifies SHA-256 integrity hashes and prevents path traversal via directory containment checks, and the workflow engine enforces step count (200), sleep duration (5 min), and repeat iteration (100) limits. Fetch helpers enforce a 5 MB response body limit. Getprop output parsing handles Windows `\r\n` line endings via `.trim()` before regex matching, and dual SIM slot counts are capped at 4 to prevent resource exhaustion from corrupted device properties.
+All tools that interpolate user-supplied parameters into shell command strings validate inputs against shell metacharacters before execution. Package names, property keys, service names, setting keys, test identifiers, network interface names, and tcpdump filters are all validated through a centralized `validateShellArg()` function that rejects `;`, `|`, `&`, `$`, backticks, parentheses, and other injection vectors. File paths use single-quoted shell escaping to prevent `$()` command substitution. The `adb_input` tool applies type-specific validation: `tap`/`swipe` accept only numeric coordinates, `keyevent` accepts only alphanumeric keycodes, and `text` is shell-escaped for literal delivery. The `adb_batch_actions` tool enforces the same per-action-type validation (digits-only for coordinates, alphanumeric for keycodes, shell-escape for text) and routes every assembled command through the security middleware. Deserialized JSON from snapshot files is validated before shell interpolation. Every `z.number()` parameter across all 204 tools has explicit `.min()/.max()` Zod bounds to prevent resource exhaustion from extreme values. The LocalBridge has explicit handlers for every ADB subcommand used by tool modules, preventing unquoted fallthrough to the default shell handler. In on-device mode, privilege escalation uses a frozen 16-command allowlist and restricted-path regex — the elevation set is `ReadonlySet` + `Object.freeze`, not configurable at runtime. The HTTP/SSE transport denies cross-origin requests by default (configurable via `DA_HTTP_CORS_ORIGIN`), the plugin registry verifies SHA-256 integrity hashes and prevents path traversal via directory containment checks, and the workflow engine enforces step count (200), sleep duration (5 min), and repeat iteration (100) limits. Fetch helpers enforce a 5 MB response body limit. Getprop output parsing handles Windows `\r\n` line endings via `.trim()` before regex matching, and dual SIM slot counts are capped at 4 to prevent resource exhaustion from corrupted device properties.
 
 ### Multi-Device Orchestration
 Run commands, install APKs, and compare outputs across multiple connected devices in parallel. Essential for comparative testing across Android versions and device models.
@@ -533,7 +568,7 @@ Scans the local network for ADB-enabled devices via ARP table queries and option
 On-device virtual machine management using QEMU with KVM hardware acceleration. Enables running guest Android VMs directly on the physical device — a capability unique to DeepADB. Dynamic resource allocation auto-detects host CPU cores and physical RAM, reserving 1 core and 35% of memory for the host OS to prevent starvation. Multi-VM support tracks resource consumption across concurrent VMs, refusing new VMs when the pool is exhausted rather than degrading host performance. Disk image management with qcow2 (sparse, snapshot-capable) and raw formats. ADB port forwarding to guest VMs enables DeepADB's full tool suite to target both host and guest devices simultaneously. Process lifecycle tracked via the centralized cleanup registry with SIGTERM/SIGKILL shutdown. Path containment verification on all image operations prevents directory traversal.
 
 ### ToolContext Architecture
-All 43 tool modules receive a unified `ToolContext` dependency bundle containing server, bridge, deviceManager, logger, security, and config. Adding new cross-cutting dependencies requires no module signature changes.
+All 45 tool modules receive a unified `ToolContext` dependency bundle containing server, bridge, deviceManager, logger, security, and config. Adding new cross-cutting dependencies requires no module signature changes.
 
 ## Environment Variables
 
@@ -550,10 +585,18 @@ All 43 tool modules receive a unified `ToolContext` dependency bundle containing
 | `DA_RETRY_COUNT` | `1` | Number of retries for transient ADB failures |
 | `DA_RETRY_DELAY` | `500` | Base retry delay in ms (doubles each attempt) |
 | `DA_LOG_LEVEL` | `info` | Log level: debug, info, warn, error |
+| `DA_ASCII_ONLY` | (auto-detect) | Set to `1` to force ASCII-only output in the startup warning banner. Default auto-detects via `WT_SESSION`/`TERM_PROGRAM`/`TERM` for Unicode-capable terminals; falls back to ASCII on legacy `cmd.exe`. |
+| `DA_RESOURCE_CACHE_TTL_MS` | `0` (disabled) | MCP Resource cache TTL in ms. Set to a positive value to cache resource reads (device://info, device://battery, etc.) for that duration. |
+| `DA_RESULT_HANDLE_DIR` | `{tempDir}/result-handles` | Storage root for tempdir-backed tool result handles. Override to relocate the store off the default temp directory. |
+| `DA_RESULT_HANDLE_TTL` | `43200` (12h) | Per-handle TTL in seconds. Handles older than this are evicted on startup sweep and during periodic eviction. Bounded to [60, 7 days]. |
+| `DA_RESULT_HANDLE_MAX_BYTES` | `5242880` (5 MB) | Per-handle size cap. Tools attempting to store a content block larger than this fail with an error. |
+| `DA_RESULT_HANDLE_TOTAL_BYTES` | `104857600` (100 MB) | Total result-handle store size cap across all handles. Triggers LRU eviction when exceeded. |
+| `DA_RESULT_HANDLE_MAX_COUNT` | `100` | Maximum number of active handles. Triggers LRU eviction when exceeded. |
 | `DA_SECURITY` | `false` | Enable security middleware (command filtering, rate limiting) |
 | `DA_BLOCKED_COMMANDS` | (none) | Comma-separated list of blocked shell command substrings |
 | `DA_ALLOWED_COMMANDS` | (none) | Comma-separated allowlist (if set, only matching commands run) |
-| `DA_RATE_LIMIT` | `0` | Max commands per minute (0 = unlimited) |
+| `DA_RATE_LIMIT` | `0` | Max commands per minute (0 = unlimited) |
+| `DA_CI_PING_TARGET` | `1.1.1.1` | Network reachability target used by `adb_ci_device_ready` (network reachability is one of the readiness checks alongside boot completion, ADB authorization, and package manager availability). Override to point at an internal target if `1.1.1.1` is firewalled. |
 | `DA_AUDIT_LOG` | `true` | Log all executed commands for audit trail (set to `false` to disable) |
 | `DA_PLUGIN_DIR` | `{tempDir}/plugins` | Directory to scan for plugin .js modules at startup |
 | `DA_REGISTRY_URL` | GitHub default | URL of the community plugin registry JSON manifest |
@@ -565,7 +608,8 @@ All 43 tool modules receive a unified `ToolContext` dependency bundle containing
 | `DA_WS_CORS_ORIGIN` | (none — deny) | Allowed CORS origin for WebSocket health endpoint |
 | `DA_GRAPHQL_PORT` | (disabled) | Set to a port number to enable the GraphQL API endpoint (requires `npm install graphql`) |
 | `DA_GRAPHQL_CORS_ORIGIN` | (none — deny) | Allowed CORS origin for GraphQL API |
-| `DA_WORKFLOW_REGISTRY_URL` | (derived from DA_REGISTRY_URL) | URL of the workflow marketplace JSON manifest |
+| `DA_WORKFLOW_REGISTRY_URL` | (derived from DA_REGISTRY_URL) | URL of the workflow marketplace JSON manifest |
+| `DA_TEST_PIN` | (none) | Numeric PIN used by `tests/test-ui-control.mjs` to exercise screen-lock/unlock tests. Without it, the 4 lock-state tests skip. Format: `DA_TEST_PIN=0000 npm test`. |
 
 ## Project Structure
 
@@ -587,15 +631,16 @@ DeepADB/
 │   │   ├── device.ts           # Device info and properties (3 tools)
 │   │   ├── shell.ts            # Shell and root command execution (2 tools)
 │   │   ├── packages.ts         # App lifecycle, install, permissions, intents (12 tools)
-│   │   ├── files.ts            # Push, pull, ls, cat (4 tools)
+│   │   ├── files.ts            # File operations — push, pull, write, find, grep, replace, stat, checksum, chmod, chown, touch, fsinfo (18 tools)
 │   │   ├── logs.ts             # Logcat snapshots — filtered (3 tools)
 │   │   ├── logcat-watch.ts     # Persistent logcat with ring buffer and poll (4 tools)
 │   │   ├── diagnostics.ts      # dumpsys, telephony, battery, network, perf, bugreport, crash logs, heap dump (9 tools)
 │   │   ├── ui.ts               # Screenshots, input, activity, UI hierarchy, annotated screencap, screen state (8 tools)
+│   │   ├── input-gestures.ts   # Drag, long press, double tap, text, URL, orientation, clipboard, tap-element, wait-element, wait-stable, scroll-until, compressed screenshot, batch actions, fling, pinch, screen size, device state, notifications (18 tools)
 │   │   ├── screen-record.ts    # Screen video recording start/stop (2 tools)
 │   │   ├── control.ts          # Airplane, WiFi, data, location, screen, settings, reboot (9 tools)
 │   │   ├── wireless.ts         # WiFi pairing, connect, disconnect, TCP/IP (4 tools)
-│   │   ├── forwarding.ts       # Port forwarding and reverse forwarding (3 tools)
+│   │   ├── forwarding.ts       # Port forwarding — forward, reverse, list, remove, managed tunnels with auto-port-pick (8 tools)
 │   │   ├── emulator.ts         # AVD list, start, stop with on-device KVM/QEMU detection (3 tools)
 │   │   ├── qemu.ts             # QEMU/KVM VM management — setup, images, start, stop, status, guest ADB connect/disconnect/shell (8 tools)
 │   │   ├── testing.ts          # Structured test sessions with numbered steps (3 tools)
@@ -603,7 +648,7 @@ DeepADB/
 │   │   ├── snapshot.ts         # Device state capture, compare, restore (3 tools)
 │   │   ├── network-capture.ts  # tcpdump start/stop, network connections (3 tools)
 │   │   ├── ci.ts               # CI wait-boot, device-ready, run-tests (3 tools)
-│   │   ├── plugins.ts          # Plugin loader and plugin info tools (2 tools)
+│   │   ├── plugins.ts          # Plugin loader, info, and dynamic tool loading (2 tools)
 │   │   ├── baseband.ts         # Modem/baseband inspection and radio diagnostics (6 tools)
 │   │   ├── accessibility.ts    # Automated WCAG accessibility auditing (3 tools)
 │   │   ├── regression.ts       # Performance baseline and regression detection (3 tools)
@@ -623,9 +668,11 @@ DeepADB/
 │   │   ├── selinux-audit.ts    # SELinux status, AVC denials, permission auditing (3 tools)
 │   │   ├── thermal-power.ts    # Thermal zones, CPU frequency, battery drain (3 tools)
 │   │   ├── network-discovery.ts # ADB-over-network scanning and auto-connect (3 tools)
-│   │   └── wireless-firmware.ts # WiFi, Bluetooth, NFC, GPS firmware identification (4 tools)
+│   │   ├── sensors.ts          # Hardware sensor enumeration, IIO power monitor reading (2 tools)
+│   │   ├── result-handles.ts   # Tempdir-backed result handle store — list, drop, drop-all (3 tools) + the result://{tool}/{name} resource
+│   │   ├── wireless-firmware.ts # WiFi, Bluetooth, NFC, GPS firmware identification (4 tools)
 │   │   ├── build.ts            # Gradle build and install (2 tools)
-│   │   ├── resources.ts        # MCP Resources — device state surfaces (4 resources)
+│   │   ├── resources.ts        # MCP Resources — 4 device-state surfaces: device://info|battery|telephony|list (5th, result://, lives in result-handles.ts)
 │   │   └── prompts.ts          # MCP Prompts — workflow templates (4 prompts)
 │   ├── middleware/
 │   │   ├── auth.ts             # Bearer token authentication for network transports (DA_AUTH_TOKEN)
@@ -637,7 +684,10 @@ DeepADB/
 │   │   ├── png-utils.ts        # Zero-dependency PNG decode/encode/draw primitives for screenshot annotation and diffing
 │   │   ├── ui-dump.ts          # Shared uiautomator XML capture with concurrent-safe paths, on-device /data/local/tmp routing, and cleanup
 │   │   ├── cleanup.ts          # Centralized process cleanup registry for SIGINT/SIGTERM/exit
-│   │   └── logger.ts           # stderr-safe logging (MCP-compliant)
+│   │   ├── logger.ts           # stderr-safe logging (MCP-compliant)
+│   │   ├── fs-utils.ts         # Filename sanitization, atomic write, private-dir helpers, within-dir containment check
+│   │   ├── parse-utils.ts      # Shared parseIntSafe for env-var numeric parsing (single source of truth)
+│   │   └── result-handle.ts    # Tempdir-backed tool result content cache with TTL, LRU, and token-hash isolation
 │   └── config/
 │       └── config.ts           # Configuration, env vars, startup validation
 ├── package.json
@@ -647,23 +697,27 @@ DeepADB/
 ├── README.md
 ├── SECURITY.md                  # Threat model, security architecture, deployment hardening, vulnerability reporting
 ├── CHANGELOG.md                 # Version history from v0.1.0 to current
-├── LICENSE                      # MIT license
-├── tests/
-│   ├── run-all.mjs              # Run all test suites sequentially with summary (tracks skipped counts)
-│   ├── test-hw.mjs              # Hardware core: health, identity, baseband, thermal, profiles, wireless firmware, crash analysis (34 tests)
-│   ├── test-shell-files.mjs     # Shell, filesystem, packages, diagnostics (24 tests)
-│   ├── test-ui-control.mjs      # UI hierarchy, screenshots, settings, input gestures, UI automation, device awareness, accessibility, screen lock/unlock, multi-touch (46 tests)
-│   ├── test-monitoring.mjs      # Logcat watchers, snapshots, OTA, regression, workflows (25 tests)
-│   ├── test-security.mjs        # Input sanitization, shell injection, AT command safety (25 tests)
-│   ├── test-lifecycle.mjs       # App lifecycle, file push/pull, input, port forwarding, screen recording, test sessions (22 tests)
-│   ├── test-analysis.mjs        # Thermal/snapshot/regression comparison, firmware diff, screenshot diff, test gen, RIL intercept, AT cross-validation, permission management (23 tests)
-│   ├── test-boundaries.mjs      # Zod bounds enforcement, input injection, error paths, sensitive data protection (31 tests)
-│   ├── test-qemu.mjs            # QEMU/KVM setup, image management, VM status, guest connectivity errors (13 on-device tests)
-│   ├── test-qemu-boot.mjs       # QEMU Alpine VM boot, KVM acceleration, topology detection, guest ADB connectivity (14 on-device tests)
-│   └── lib/
-│       └── harness.mjs          # Shared test harness (stdio JSON-RPC transport, 6 assertion types)
-└── docs/
-    └── future-roadmap.md       # Feature history and future ideas
+├── LICENSE                      # Apache 2.0 license
+└── tests/
+    ├── run-all.mjs              # Run all test suites sequentially with summary (tracks skipped counts)
+    ├── test-hw.mjs              # Hardware core: health, identity, baseband, thermal, profiles, wireless firmware, crash analysis (34 tests)
+    ├── test-shell-files.mjs     # Shell, filesystem, packages, diagnostics (24 tests)
+    ├── test-ui-control.mjs      # UI hierarchy, screenshots, settings, input gestures, UI automation, device awareness, accessibility, screen lock/unlock, multi-touch (46 tests)
+    ├── test-monitoring.mjs      # Logcat watchers, snapshots, OTA, regression, workflows (43 tests)
+    ├── test-security.mjs        # Input sanitization, shell injection, AT command safety, QEMU shell escaping, heap-dump validation (116 on-device, 105 host)
+    ├── test-lifecycle.mjs       # App lifecycle, file push/pull, input, port forwarding, screen recording, test sessions (24 tests)
+    ├── test-analysis.mjs        # Thermal/snapshot/regression comparison, firmware diff, screenshot diff, test gen, RIL intercept, AT cross-validation, permission management (23 tests)
+    ├── test-boundaries.mjs      # Zod bounds enforcement, input injection, error paths, sensitive data protection, wireless ADB coverage, multi-device basics, tunnel automation, device-free coverage boundaries (78 tests)
+    ├── test-sensors.mjs         # HAL sensors, IIO power monitors, category filters, formatting, wake-up, rate display (30 tests)
+    ├── test-files-extended.mjs  # File tool coverage — write, find, stat, checksum, mkdir, rm, move, copy, chmod, touch, fsinfo, chown, grep, replace; push safety; sed-escape regression (95 tests)
+    ├── test-result-handles.mjs # Result handle store — listing, retrieval, drop, isolation, eviction (19 tests)
+    ├── test-qemu.mjs            # QEMU/KVM setup, image management, VM status, guest connectivity errors (13 on-device tests)
+    ├── test-qemu-boot.mjs       # QEMU Alpine VM boot with auto-fetch of kernel/initrd, KVM acceleration, topology detection, guest ADB connectivity (17 on-device tests)
+    ├── test-supply-chain.mjs    # Supply-chain hardening checks for fetch and network paths (24 tests)
+    ├── test-sanitize-fuzz.mjs   # Property-based fuzzing of shell sanitizers — shellQuote/shellEscape round-trip, validateShellArg rejection (19 tests)
+    ├── test-transports.mjs      # Transport smoke — HTTP/SSE + WebSocket MCP round-trip, GraphQL health query (8 tests)
+    └── lib/
+        └── harness.mjs          # Shared test harness (stdio JSON-RPC transport, assertion primitives)
 ```
 
 ## Tech Stack
@@ -671,9 +725,9 @@ DeepADB/
 - **Runtime**: Node.js ≥22 (ES2024, ESM)
 - **Language**: TypeScript 6.0 (strict mode, NodeNext module resolution)
 - **MCP SDK**: `@modelcontextprotocol/sdk` ^1.24.0 (currently resolves to 1.29.0)
-- **Validation**: Zod ^3.25.0
+- **Validation**: Zod ^4.4.3
 - **Transport**: stdio (JSON-RPC), HTTP/SSE, WebSocket (optional `ws`), GraphQL API (optional `graphql`)
 
 ## License
 
-MIT
+Apache License 2.0 — see [LICENSE](LICENSE) and [NOTICE](NOTICE). The v1.1.2 release migrated from MIT to Apache 2.0 for the explicit patent grant and contributor attribution requirements; existing forks/installs remain valid under the prior MIT terms.

package/build/bridge/adb-bridge.d.ts

@@ -54,6 +54,20 @@ export declare class AdbBridge {
      *
      * In ADB mode: spawns `adb -s <serial> <args...>`
      * LocalBridge overrides this to spawn commands directly.
+     *
+     * N6 CALLER CONTRACT: there is NO built-in size budget on accumulated
+     * stdout/stderr from the returned ChildProcess. A caller that forgets
+     * to drain stdout (no `.on("data", ...)` handler) will accumulate
+     * indefinitely in the OS pipe buffer until the child blocks on write.
+     * Current callers (logcat-watch.ts, ril-intercept.ts) implement their
+     * own ring-buffering with bounded size. Any new caller MUST either:
+     *   (1) drain stdout via a handler that bounds in-memory accumulation,
+     *       OR
+     *   (2) discard stdout via `stdio: ["ignore", "ignore", "ignore"]`
+     *       (override the default below) if output isn't needed,
+     *       OR
+     *   (3) pipe stdout to a file via Node's `pipe()` with rotation.
+     * Forgetting to drain is the most common spawn-based memory leak.
      */
     spawnStreaming(args: string[], device?: string): ChildProcess;
 }

package/build/bridge/adb-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adb-bridge.d.ts","sourceRoot":"","sources":["../../src/bridge/adb-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAoC,YAAY,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGjD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAkBD,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,MAAM;IAK1B;;;OAGG;IACG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,CAAC;IAuB5E,OAAO,CAAC,KAAK;IAIb;;OAEG;YACW,QAAQ;IAiEtB,kDAAkD;IAC5C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,CAAC;IAI9E,6CAA6C;IACvC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,CAAC;IAIlF,wDAAwD;IAClD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAKhC,oDAAoD;IAC9C,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC;IAS9B;;;;;;;OAOG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY;CAe9D;AAED,8CAA8C;AAC9C,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAgB,MAAM,EAAE,SAAS,CAAC;gBAEtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;CAK/C"}
+{"version":3,"file":"adb-bridge.d.ts","sourceRoot":"","sources":["../../src/bridge/adb-bridge.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,OAAO,EAAoC,YAAY,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGjD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA+BD,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,MAAM;IAK1B;;;OAGG;IACG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,CAAC;IAuB5E,OAAO,CAAC,KAAK;IAIb;;OAEG;YACW,QAAQ;IAiEtB,kDAAkD;IAC5C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,CAAC;IAI9E,6CAA6C;IACvC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,CAAC;IAIlF,wDAAwD;IAClD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAKhC,oDAAoD;IAC9C,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC;IAS9B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY;CAe9D;AAED,8CAA8C;AAC9C,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAgB,MAAM,EAAE,SAAS,CAAC;gBAEtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;CAK/C"}