machine-bridge-mcp 0.18.1 → 1.0.1

package/src/local/worker-secret-file.mjs

@@ -0,0 +1,130 @@
+import { randomBytes } from "node:crypto";
+import { lstatSync, readdirSync, unlinkSync } from "node:fs";
+import { resolve } from "node:path";
+import { createExclusiveFileSync } from "./exclusive-file.mjs";
+import { currentProcessStartTimeMs, inspectProcessInstance } from "./process-identity.mjs";
+import { chmodRegularFileSync, ensureOwnerOnlyDirectorySync } from "./secure-file.mjs";
+
+const SECRET_FILE_PATTERN = /^worker-secrets-(\d+)-(\d+)(?:-p(\d+))?(?:-([a-f0-9]+))?\.json$/;
+
+export async function withWorkerSecretsFile(state, callback, options = {}) {
+  const dir = state.paths.profileDir;
+  ensureOwnerOnlyDirectorySync(dir, options.directoryOptions);
+  cleanupStaleWorkerSecretFiles(dir, options);
+  const createdAt = integerTimestamp(options.now?.() ?? Date.now());
+  const processStartedAt = integerTimestamp(options.processStartedAtMs ?? currentProcessStartTimeMs());
+  const random = (options.randomBytes || randomBytes)(6).toString("hex");
+  const tempPath = resolve(dir, `worker-secrets-${process.pid}-${createdAt}-p${processStartedAt}-${random}.json`);
+  const payload = {
+    ACCOUNT_ADMIN_SECRET: state.worker.accountAdminSecret,
+    DAEMON_SHARED_SECRET: state.worker.daemonSecret,
+    OAUTH_TOKEN_VERSION: state.worker.oauthTokenVersion,
+  };
+
+  let created = false;
+  let createdIdentity = null;
+  let result;
+  let primaryError;
+  try {
+    createExclusiveFileSync(tempPath, JSON.stringify(payload), { mode: 0o600 });
+    created = true;
+    createdIdentity = fileIdentity((options.lstatSync || lstatSync)(tempPath));
+    (options.chmodFile || chmodRegularFileSync)(tempPath, 0o600, "temporary Worker secrets file");
+    result = await callback(tempPath);
+  } catch (error) {
+    primaryError = error;
+  }
+
+  let cleanupError;
+  if (created) {
+    try {
+      removeFile(tempPath, options.removeFile || unlinkSync, "could not remove temporary Worker secrets file", createdIdentity, options.lstatSync || lstatSync);
+    } catch (error) {
+      cleanupError = error;
+    }
+  }
+
+  if (primaryError && cleanupError) {
+    const message = primaryError instanceof Error && primaryError.message
+      ? primaryError.message
+      : "Worker deployment failed";
+    throw new AggregateError(
+      [primaryError, cleanupError],
+      `${message}; temporary Worker secrets cleanup also failed`,
+    );
+  }
+  if (primaryError) throw primaryError;
+  if (cleanupError) throw cleanupError;
+  return result;
+}
+
+export function cleanupStaleWorkerSecretFiles(dir, options = {}) {
+  const inspect = options.inspectProcess || inspectProcessInstance;
+  const remove = options.removeFile || unlinkSync;
+  const readDirectory = options.readDirectory || readdirSync;
+  const inspectPath = options.lstatSync || lstatSync;
+  for (const entry of readDirectory(dir, { withFileTypes: true })) {
+    if (!entry.isFile()) continue;
+    const match = SECRET_FILE_PATTERN.exec(entry.name);
+    if (!match) continue;
+    const file = resolve(dir, entry.name);
+    let snapshot;
+    try {
+      const info = inspectPath(file);
+      if (info.isSymbolicLink() || !info.isFile()) continue;
+      snapshot = fileIdentity(info);
+    } catch (error) {
+      if (error?.code === "ENOENT") continue;
+      throw new Error(`could not inspect temporary Worker secrets file: ${entry.name}`, { cause: error });
+    }
+    const pid = Number(match[1]);
+    const createdAt = Number(match[2]);
+    const processStartedAt = match[3] ? Number(match[3]) : null;
+    let identity;
+    try {
+      identity = inspect({
+        pid,
+        startedAt: new Date(createdAt).toISOString(),
+        processStartedAt: processStartedAt ? new Date(processStartedAt).toISOString() : undefined,
+      });
+    } catch (error) {
+      throw new Error(`could not inspect temporary Worker secrets owner: ${entry.name}`, { cause: error });
+    }
+    if (!identity?.reclaimable) continue;
+    removeFile(file, remove, `could not remove stale temporary Worker secrets file: ${entry.name}`, snapshot, inspectPath);
+  }
+}
+
+function removeFile(file, remove, message = "could not remove temporary Worker secrets file", expectedIdentity = null, inspectPath = lstatSync) {
+  try {
+    if (expectedIdentity) {
+      const current = inspectPath(file);
+      if (current.isSymbolicLink() || !current.isFile() || !sameFileIdentity(expectedIdentity, fileIdentity(current))) {
+        throw new Error("temporary Worker secrets file identity changed before cleanup");
+      }
+    }
+    remove(file);
+  } catch (error) {
+    if (error?.code === "ENOENT") return;
+    throw new Error(message, { cause: error });
+  }
+}
+
+function fileIdentity(info) {
+  return {
+    dev: Number(info.dev),
+    ino: Number(info.ino),
+    size: Number(info.size),
+    mtimeMs: Number(info.mtimeMs),
+  };
+}
+
+function sameFileIdentity(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs;
+}
+
+function integerTimestamp(value) {
+  const timestamp = Math.floor(Number(value));
+  if (!Number.isSafeInteger(timestamp) || timestamp <= 0) throw new Error("temporary Worker secrets timestamp is invalid");
+  return timestamp;
+}

package/src/local/workspace-file-service.mjs

@@ -331,12 +331,20 @@ async function readUtf8File(filePath) {
   return decodeUtf8(buffer);
 }
 
+async function applyExactMode(filePath, mode) {
+  try {
+    await chmod(filePath, mode);
+  } catch (error) {
+    if (process.platform !== "win32") throw error;
+  }
+}
+
 async function atomicWriteText(full, content, existing = null, options = {}) {
   await mkdir(dirname(full), { recursive: true });
   const temp = join(dirname(full), `.${basename(full)}.mbm-${process.pid}-${randomBytes(6).toString("hex")}.tmp`);
   try {
     await writeFile(temp, content, { encoding: "utf8", flag: "wx", mode: existing ? existing.mode & 0o777 : 0o600 });
-    if (existing) await chmod(temp, existing.mode & 0o777).catch(() => {});
+    if (existing) await applyExactMode(temp, existing.mode & 0o777);
     if (options.expectedHash) {
       const current = await readUtf8File(full).catch(() => null);
       if (current === null || sha256(current) !== options.expectedHash) throw new Error("file changed before atomic commit");
@@ -377,7 +385,7 @@ async function commitPatchTransaction(operations) {
       await mkdir(dirname(operation.target), { recursive: true });
       const temp = join(dirname(operation.target), `.${basename(operation.target)}.mbm-patch-${process.pid}-${randomBytes(6).toString("hex")}.tmp`);
       await writeFile(temp, operation.content, { encoding: "utf8", flag: "wx", mode: operation.mode });
-      await chmod(temp, operation.mode).catch(() => {});
+      await applyExactMode(temp, operation.mode);
       staged.push({ operation, temp });
     }
 

package/src/shared/server-metadata.json

@@ -2,13 +2,12 @@
   "name": "machine-bridge-mcp",
   "protocolVersion": "2025-11-25",
   "supportedProtocolVersions": [
-    "2025-11-25",
-    "2025-06-18",
-    "2025-03-26"
+    "2025-11-25"
   ],
   "instructions": [
     "You are connected to a local workspace through machine-bridge-mcp.",
     "At the start of each substantive local task, call resolve_task_capabilities with the current user request and target path. Apply the returned session/project instructions, follow the automatically selected relevant skill when present, and prefer registered local commands for repeatable workflows.",
+    "Before any GitHub read or mutation, apply the effective project control-plane instructions. When a project requires local git, gh, and gh api through Machine Bridge, never use a hosted GitHub connector or ChatGPT GitHub plugin; if the local control plane is unavailable, stop rather than substitute another GitHub tool.",
     "The MCP initialize response automatically appends conservative built-in working agreements, bounded automatic project facts, the configured global model_instructions_file, and the current root instruction chain when the local daemon is reachable; session_bootstrap exposes the same material explicitly.",
     "For existing-browser work, use the paired Machine Bridge browser extension. It operates the user current Chromium profile and tabs, can inspect DOM/source, fill complex forms, and inject sensitive text from registered local resources without returning those values.",
     "For local application work, use structured application discovery and Accessibility actions. Arbitrary caller-supplied AppleScript or JavaScript is intentionally not accepted.",

package/src/worker/http.ts

@@ -43,15 +43,14 @@ export function authorizationRedirectLocation(redirectUri: string, code: string,
   return location;
 }
 
-export function json(value: unknown, status = 200): Response {
-  return new Response(JSON.stringify(value), {
-    status,
-    headers: {
-      "content-type": "application/json; charset=utf-8",
-      "cache-control": "no-store",
-      "x-content-type-options": "nosniff",
-    },
+export function json(value: unknown, status = 200, extraHeaders: HeadersInit = {}): Response {
+  const headers = new Headers({
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store",
+    "x-content-type-options": "nosniff",
   });
+  for (const [name, headerValue] of new Headers(extraHeaders)) headers.set(name, headerValue);
+  return new Response(JSON.stringify(value), { status, headers });
 }
 
 export function html(value: string, status = 200): Response {

package/src/worker/index.ts

@@ -1,6 +1,8 @@
 import { DurableObject } from "cloudflare:workers";
 import serverMetadata from "../shared/server-metadata.json";
-import { PendingCallRegistry } from "./pending-calls";
+import { PendingCallRegistrationError, PendingCallRegistry } from "./pending-calls";
+import { mcpClientRequestKey, resolveMcpSession } from "./mcp-session";
+import { daemonToolTimeoutMs } from "./tool-timeout";
 import { WorkerObservability } from "./observability";
 import { daemonToolError, publicWorkerToolError, WorkerToolError } from "./errors";
 import { sanitizeDaemonPolicy, sanitizeDaemonTools, type DaemonPolicy } from "./policy";
@@ -20,7 +22,7 @@ import {
 } from "./http";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "0.18.1";
+const SERVER_VERSION = "1.0.1";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";
@@ -289,12 +291,15 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     if (!isJsonRpcRequest(body)) return json(rpcError(null, -32600, "Invalid JSON-RPC request"), 400);
     const protocolError = validateProtocolVersionHeader(request, body);
     if (protocolError) return json(protocolError, 400);
-    const response = await this.dispatchJsonRpc(body, base, authorized);
+
+    const session = await resolveMcpSession(request, body.method, this.identityKey(), authorized.tokenKey);
+    if (session.kind === "invalid") return json(rpcError(body.id, -32001, "MCP session not found"), 404);
+    const response = await this.dispatchJsonRpc(body, base, authorized, session.kind === "active" ? session.sessionId : "");
     if (response === null) return new Response(null, { status: 202 });
-    return json(response);
+    return session.kind === "initialize" ? json(response, 200, { "mcp-session-id": session.sessionId }) : json(response);
   }
 
-  private async dispatchJsonRpc(request: JsonRpcRequest, base: string, authorized: AuthorizedToken): Promise<Record<string, unknown> | null> {
+  private async dispatchJsonRpc(request: JsonRpcRequest, base: string, authorized: AuthorizedToken, sessionId: string): Promise<Record<string, unknown> | null> {
     if (request.method === "initialize") {
       const requested = asObject(request.params).protocolVersion;
       const protocolVersion = typeof requested === "string" && MCP_SUPPORTED_PROTOCOL_VERSIONS.includes(requested as typeof MCP_SUPPORTED_PROTOCOL_VERSIONS[number])
@@ -318,7 +323,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     }
     if (request.method === "notifications/initialized") return null;
     if (request.method === "notifications/cancelled") {
-      this.cancelClientRequest(clientRequestKey(authorized, asObject(request.params).requestId));
+      this.cancelClientRequest(mcpClientRequestKey(authorized.tokenKey, sessionId, asObject(request.params).requestId));
       return null;
     }
     if (request.method === "logging/setLevel") return rpcResult(request.id, {});
@@ -330,7 +335,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       const name = requiredString(params, "name");
       const args = asObject(params.arguments);
       try {
-        const result = await this.callTool(name, args, base, authorized, clientRequestKey(authorized, request.id));
+        const result = await this.callTool(name, args, base, authorized, mcpClientRequestKey(authorized.tokenKey, sessionId, request.id));
         return rpcResult(request.id, textToolResult(result));
       } catch (error) {
         return rpcResult(request.id, textToolResult({ error: publicWorkerToolError(error) }, true));
@@ -378,16 +383,25 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     if (!socket) throw new WorkerToolError("unavailable", "local daemon is not connected; keep the CLI start command running", true);
     const id = randomToken("call");
     const timeoutMs = daemonToolTimeoutMs(name, args);
-    const result = this.pending.register({
-      id,
-      socket,
-      clientRequestKey: requestKey,
-      timeoutMs,
-      onTimeout: (record) => {
-        sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
-        return new WorkerToolError("timeout", `daemon tool timed out: ${name}`, true);
-      },
-    });
+    let result: Promise<unknown>;
+    try {
+      result = this.pending.register({
+        id,
+        socket,
+        clientRequestKey: requestKey,
+        tool: name,
+        timeoutMs,
+        onTimeout: (record) => {
+          sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
+          return new WorkerToolError("timeout", `daemon tool timed out: ${name}`, true);
+        },
+      });
+    } catch (error) {
+      if (error instanceof PendingCallRegistrationError) {
+        throw new WorkerToolError(error.code, error.message, error.retryable);
+      }
+      throw error;
+    }
     this.observability.callStarted(name);
     try {
       socket.send(JSON.stringify({
@@ -1004,25 +1018,6 @@ function stringOrUndefined(value: unknown): string | undefined {
   return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
 
-function clampNumber(value: unknown, fallback: number, min: number, max: number): number {
-  const number = typeof value === "number" && Number.isFinite(value) ? value : Number.parseInt(String(value ?? ""), 10);
-  const safe = Number.isFinite(number) ? number : fallback;
-  return Math.min(Math.max(Math.floor(safe), min), max);
-}
-
-function daemonToolTimeoutMs(name: string, args: Record<string, unknown>): number {
-  if (name === "session_bootstrap") return 10_000;
-  const configurable = new Set([
-    "exec_command", "run_process", "run_local_command", "open_local_application",
-    "inspect_local_application", "operate_local_application", "browser_list_tabs",
-    "browser_manage_tabs", "browser_wait", "browser_get_source", "browser_inspect_page", "browser_action", "browser_fill_form",
-    "browser_screenshot", "browser_upload_files",
-  ]);
-  if (!configurable.has(name)) return 60_000;
-  const seconds = clampNumber(args.timeout_seconds, name === "browser_fill_form" ? 60 : 120, 1, 600);
-  return Math.min((seconds + 5) * 1000, 610_000);
-}
-
 function sessionInstructionText(value: unknown): string {
   const object = asObject(value);
   const instructions = typeof object.instructions === "string" ? object.instructions : "";
@@ -1042,8 +1037,3 @@ function validateProtocolVersionHeader(request: Request, body: JsonRpcRequest):
     supported: [...MCP_SUPPORTED_PROTOCOL_VERSIONS],
   });
 }
-
-function clientRequestKey(authorized: AuthorizedToken, requestId: unknown): string | undefined {
-  if (requestId === null || (typeof requestId !== "string" && typeof requestId !== "number")) return undefined;
-  return `${authorized.tokenKey}:${typeof requestId}:${String(requestId)}`;
-}

package/src/worker/mcp-session.ts

@@ -0,0 +1,72 @@
+const SESSION_PATTERN = /^mcp_([A-Za-z0-9_-]{32})_([A-Za-z0-9_-]{43})$/;
+
+export async function createMcpSessionId(identityKey: string, tokenKey: string): Promise<string> {
+  const nonceBytes = new Uint8Array(24);
+  crypto.getRandomValues(nonceBytes);
+  const nonce = base64Url(nonceBytes);
+  const signature = await sessionSignature(identityKey, tokenKey, nonce);
+  return `mcp_${nonce}_${signature}`;
+}
+
+export async function validateMcpSessionId(sessionId: string, identityKey: string, tokenKey: string): Promise<boolean> {
+  const match = String(sessionId || "").match(SESSION_PATTERN);
+  if (!match) return false;
+  const expected = await sessionSignature(identityKey, tokenKey, match[1]);
+  return constantTimeTextEqual(match[2], expected);
+}
+
+async function sessionSignature(identityKey: string, tokenKey: string, nonce: string): Promise<string> {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(identityKey),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    new TextEncoder().encode(`machine-bridge-mcp-session-v1\0${tokenKey}\0${nonce}`),
+  );
+  return base64Url(new Uint8Array(signature));
+}
+
+function constantTimeTextEqual(left: string, right: string): boolean {
+  const leftBytes = new TextEncoder().encode(left);
+  const rightBytes = new TextEncoder().encode(right);
+  let difference = leftBytes.length ^ rightBytes.length;
+  for (let index = 0; index < Math.max(leftBytes.length, rightBytes.length); index += 1) {
+    difference |= (leftBytes[index] ?? 0) ^ (rightBytes[index] ?? 0);
+  }
+  return difference === 0;
+}
+
+function base64Url(bytes: Uint8Array): string {
+  return btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+
+export type McpSessionResolution =
+  | { kind: "initialize"; sessionId: string }
+  | { kind: "active"; sessionId: string }
+  | { kind: "invalid"; sessionId: string };
+
+export async function resolveMcpSession(
+  request: Request,
+  method: string,
+  identityKey: string,
+  tokenKey: string,
+): Promise<McpSessionResolution> {
+  if (method === "initialize") {
+    return { kind: "initialize", sessionId: await createMcpSessionId(identityKey, tokenKey) };
+  }
+  const sessionId = request.headers.get("mcp-session-id")?.trim() || "";
+  if (sessionId && !(await validateMcpSessionId(sessionId, identityKey, tokenKey))) {
+    return { kind: "invalid", sessionId };
+  }
+  return { kind: "active", sessionId };
+}
+
+export function mcpClientRequestKey(tokenKey: string, sessionId: string, requestId: unknown): string | undefined {
+  if (!sessionId || requestId === null || (typeof requestId !== "string" && typeof requestId !== "number")) return undefined;
+  return `${tokenKey}:${sessionId}:${typeof requestId}:${String(requestId)}`;
+}

package/src/worker/oauth-state.ts

@@ -1,6 +1,6 @@
 import { normalizeAccountRole, type AccountRole } from "./access";
 
-export const OAUTH_STORE_SCHEMA_VERSION = 1;
+const OAUTH_STORE_SCHEMA_VERSION = 1;
 const PASSWORD_TOKEN_PATTERN = /^[a-z][a-z0-9_]{2,31}_[A-Za-z0-9_-]{43}$/;
 
 export interface AccountRecord {

package/src/worker/pending-calls.ts

@@ -1,7 +1,21 @@
+export class PendingCallRegistrationError extends Error {
+  readonly code: "conflict" | "limit_exceeded";
+  readonly retryable: boolean;
+
+  constructor(code: "conflict" | "limit_exceeded", message: string, retryable = false) {
+    super(message);
+    this.name = "PendingCallRegistrationError";
+    this.code = code;
+    this.retryable = retryable;
+  }
+}
+
 export interface PendingCallRecord {
   id: string;
   socket: WebSocket;
   clientRequestKey?: string;
+  tool: string;
+  startedAt: number;
   timeout: ReturnType<typeof setTimeout>;
   resolve: (value: unknown) => void;
   reject: (error: Error) => void;
@@ -11,6 +25,7 @@ interface RegisterPendingCall {
   id: string;
   socket: WebSocket;
   clientRequestKey?: string;
+  tool: string;
   timeoutMs: number;
   onTimeout: (record: PendingCallRecord) => Error;
 }
@@ -33,11 +48,12 @@ export class PendingCallRegistry {
   }
 
   register(input: RegisterPendingCall): Promise<unknown> {
-    if (this.byId.size >= this.maximum) throw new Error("too many concurrent daemon tool calls");
-    if (this.byId.has(input.id)) throw new Error("duplicate internal daemon call id");
+    if (this.byId.size >= this.maximum) throw new PendingCallRegistrationError("limit_exceeded", "too many concurrent daemon tool calls", true);
+    if (this.byId.has(input.id)) throw new PendingCallRegistrationError("conflict", "duplicate internal daemon call id");
     if (input.clientRequestKey && this.byRequestKey.has(input.clientRequestKey)) {
-      throw new Error("duplicate in-flight JSON-RPC request id for this access token");
+      throw new PendingCallRegistrationError("conflict", "duplicate in-flight JSON-RPC request id within this MCP session");
     }
+    const startedAt = Date.now();
     return new Promise((resolve, reject) => {
       const timeout = setTimeout(() => {
         const record = this.take(input.id);
@@ -51,6 +67,8 @@ export class PendingCallRegistry {
         id: input.id,
         socket: input.socket,
         clientRequestKey: input.clientRequestKey,
+        tool: String(input.tool || "unknown"),
+        startedAt,
         timeout,
         resolve,
         reject,
@@ -92,8 +110,21 @@ export class PendingCallRegistry {
     return ids.length;
   }
 
-  snapshot(): { active: number; request_keys: number; maximum: number } {
-    return { active: this.byId.size, request_keys: this.byRequestKey.size, maximum: this.maximum };
+  snapshot(): { active: number; request_keys: number; maximum: number; oldest_ms: number; by_tool: Record<string, number> } {
+    const now = Date.now();
+    const byTool: Record<string, number> = {};
+    let oldestMs = 0;
+    for (const record of this.byId.values()) {
+      byTool[record.tool] = (byTool[record.tool] || 0) + 1;
+      oldestMs = Math.max(oldestMs, now - record.startedAt);
+    }
+    return {
+      active: this.byId.size,
+      request_keys: this.byRequestKey.size,
+      maximum: this.maximum,
+      oldest_ms: oldestMs,
+      by_tool: byTool,
+    };
   }
 
   private take(id: string): PendingCallRecord | undefined {

package/src/worker/tool-timeout.ts

@@ -0,0 +1,18 @@
+export function daemonToolTimeoutMs(name: string, args: Record<string, unknown>): number {
+  if (name === "session_bootstrap") return 10_000;
+  const configurable = new Set([
+    "exec_command", "run_process", "run_local_command", "open_local_application",
+    "inspect_local_application", "operate_local_application", "browser_list_tabs",
+    "browser_manage_tabs", "browser_wait", "browser_get_source", "browser_inspect_page",
+    "browser_action", "browser_fill_form", "browser_screenshot", "browser_upload_files",
+  ]);
+  if (!configurable.has(name)) return 60_000;
+  const seconds = clampNumber(args.timeout_seconds, name === "browser_fill_form" ? 60 : 120, 1, 600);
+  return Math.min((seconds + 5) * 1000, 610_000);
+}
+
+function clampNumber(value: unknown, fallback: number, min: number, max: number): number {
+  const number = typeof value === "number" && Number.isFinite(value) ? value : Number.parseInt(String(value ?? ""), 10);
+  const safe = Number.isFinite(number) ? number : fallback;
+  return Math.min(Math.max(Math.floor(safe), min), max);
+}