staff-mcp 1.0.27 → 1.0.29

package/dist/src/constants.d.ts

@@ -3,3 +3,26 @@ export declare const DEFAULT_TIMEOUT = 10000;
 export declare const SEARCH_MAX_COLUMNS = 200;
 export declare const SEARCH_MAX_MATCHES = 200;
 export declare const SEARCH_EXEC_MAX_BUFFER: number;
+/** Maximum image file size (10MB). Base64 encoding adds ~33% overhead. */
+export declare const IMAGE_SIZE_LIMIT: number;
+/** Number of leading bytes to read for magic-byte sniffing and binary detection. */
+export declare const FILE_SNIFF_SIZE = 4096;
+/** MIME types that are returned as image content blocks (not including SVG). */
+export declare const SUPPORTED_IMAGE_MIMES: Set<string>;
+/** Fallback: extension → MIME type mapping (used when sniffing fails, e.g. for SVG). */
+export declare const IMAGE_MIME_BY_EXTENSION: Record<string, string>;
+/**
+ * Sniff the MIME type of a file from its leading bytes (magic bytes).
+ * Returns null if the bytes don't match any known image signature.
+ */
+export declare function sniffImageMime(bytes: Uint8Array): string | null;
+/**
+ * Determine whether a file is binary (should not be read as text).
+ * Uses content-based detection only (no extension reliance):
+ * 1. Contains a null byte (0x00) → true
+ * 2. Ratio of non-printable bytes > 30% → true
+ *
+ * @param filepath - File path (reserved for future use, not currently used)
+ * @param bytes    - Leading bytes of the file (recommend 4096 bytes)
+ */
+export declare function isBinaryFile(filepath: string, bytes: Uint8Array): boolean;

package/dist/src/constants.js

@@ -3,4 +3,79 @@ export const DEFAULT_TIMEOUT = 10000;
 export const SEARCH_MAX_COLUMNS = 200;
 export const SEARCH_MAX_MATCHES = 200;
 export const SEARCH_EXEC_MAX_BUFFER = 50 * 1024 * 1024; // 50MB
+// --- Image reading support ---
+/** Maximum image file size (10MB). Base64 encoding adds ~33% overhead. */
+export const IMAGE_SIZE_LIMIT = 10 * 1024 * 1024;
+/** Number of leading bytes to read for magic-byte sniffing and binary detection. */
+export const FILE_SNIFF_SIZE = 4096;
+/** MIME types that are returned as image content blocks (not including SVG). */
+export const SUPPORTED_IMAGE_MIMES = new Set([
+    "image/jpeg",
+    "image/png",
+    "image/gif",
+    "image/webp",
+]);
+/** Fallback: extension → MIME type mapping (used when sniffing fails, e.g. for SVG). */
+export const IMAGE_MIME_BY_EXTENSION = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".svg": "image/svg+xml",
+    ".bmp": "image/bmp",
+    ".tiff": "image/tiff",
+    ".ico": "image/x-icon",
+};
+/**
+ * Sniff the MIME type of a file from its leading bytes (magic bytes).
+ * Returns null if the bytes don't match any known image signature.
+ */
+export function sniffImageMime(bytes) {
+    if (bytes.length >= 4 && bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4e && bytes[3] === 0x47) {
+        return "image/png";
+    }
+    if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) {
+        return "image/jpeg";
+    }
+    if (bytes.length >= 6 && bytes[0] === 0x47 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x38) {
+        return "image/gif";
+    }
+    // WebP: RIFF....WEBP
+    if (bytes.length >= 12 &&
+        bytes[0] === 0x52 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x46 &&
+        bytes[8] === 0x57 && bytes[9] === 0x45 && bytes[10] === 0x42 && bytes[11] === 0x50) {
+        return "image/webp";
+    }
+    return null;
+}
+// --- Binary file detection ---
+/**
+ * Determine whether a file is binary (should not be read as text).
+ * Uses content-based detection only (no extension reliance):
+ * 1. Contains a null byte (0x00) → true
+ * 2. Ratio of non-printable bytes > 30% → true
+ *
+ * @param filepath - File path (reserved for future use, not currently used)
+ * @param bytes    - Leading bytes of the file (recommend 4096 bytes)
+ */
+export function isBinaryFile(filepath, bytes) {
+    if (bytes.length === 0) {
+        return false;
+    }
+    // 1. Null byte detection - text files almost never contain 0x00
+    let nonPrintableCount = 0;
+    for (let i = 0; i < bytes.length; i++) {
+        const b = bytes[i];
+        if (b === 0x00) {
+            return true;
+        }
+        // Count non-printable bytes (excluding common whitespace: \t=9, \n=10, \r=13)
+        if (b < 9 || (b > 13 && b < 32)) {
+            nonPrintableCount++;
+        }
+    }
+    // 2. Non-printable ratio threshold
+    return nonPrintableCount / bytes.length > 0.3;
+}
 //# sourceMappingURL=constants.js.map

package/dist/src/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAE/D,gCAAgC;AAEhC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IAC3C,YAAY;IACZ,WAAW;IACX,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAA2B;IAC7D,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,cAAc;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1G,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrF,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1G,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,qBAAqB;IACrB,IACE,KAAK,CAAC,MAAM,IAAI,EAAE;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAChF,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAClF,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gCAAgC;AAEhC;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAiB;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gEAAgE;IAChE,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,8EAA8E;QAC9E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAChC,iBAAiB,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,OAAO,iBAAiB,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;AAChD,CAAC"}

package/dist/src/docker-proxy.d.ts

@@ -0,0 +1,32 @@
+interface SignalSource {
+    on(event: NodeJS.Signals, listener: () => void): unknown;
+    removeListener(event: NodeJS.Signals, listener: () => void): unknown;
+}
+export interface DockerProxyOptions {
+    command?: string;
+    commandPrefixArgs?: readonly string[];
+    input?: NodeJS.ReadableStream;
+    signalSource?: SignalSource;
+    gracefulShutdownTimeoutMs?: number;
+    containerIdWaitTimeoutMs?: number;
+    containerCleanupTimeoutMs?: number;
+    forceKillTimeoutMs?: number;
+}
+/**
+ * Reject Docker options that would detach the CLI or disable the lifecycle
+ * guarantees managed by staff-mcp. This validator is intentionally applied to
+ * user-supplied Docker options only, because the command executed inside the
+ * container can legitimately contain similarly named flags.
+ */
+export declare function validateAdditionalDockerArgs(args: readonly string[]): void;
+/**
+ * Run the Docker-compatible CLI and keep its lifecycle tied to this process.
+ *
+ * For stdio transport, the caller's stdin remains the MCP data channel. For
+ * HTTP/reverse transports, child.stdin is intentionally kept open as a private
+ * lifecycle pipe instead of being connected to process.stdin. This allows the
+ * service to run under PM2/systemd/Supervisor even when fd 0 is /dev/null, while
+ * still making the container exit if the host proxy disappears unexpectedly.
+ */
+export declare function runDockerProxy(dockerArgs: readonly string[], transport: string, options?: DockerProxyOptions): Promise<number>;
+export {};

package/dist/src/docker-proxy.js

@@ -0,0 +1,492 @@
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+const HANDLED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+const DEFAULT_GRACEFUL_SHUTDOWN_TIMEOUT_MS = 20_000;
+const DEFAULT_CONTAINER_ID_WAIT_TIMEOUT_MS = 1_000;
+const DEFAULT_CONTAINER_CLEANUP_TIMEOUT_MS = 20_000;
+const DEFAULT_FORCE_KILL_TIMEOUT_MS = 5_000;
+const CONTAINER_ID_POLL_INTERVAL_MS = 50;
+function exitCodeFromSignal(signal) {
+    switch (signal) {
+        case "SIGHUP":
+            return 129;
+        case "SIGINT":
+            return 130;
+        case "SIGKILL":
+            return 137;
+        case "SIGTERM":
+            return 143;
+        default:
+            return 1;
+    }
+}
+function hasManagedIdentityArg(args) {
+    return args.some((arg) => arg === "--cidfile" ||
+        arg.startsWith("--cidfile=") ||
+        arg === "--name" ||
+        arg.startsWith("--name="));
+}
+function prepareContainerIdentity(dockerArgs) {
+    const args = [...dockerArgs];
+    if (hasManagedIdentityArg(args)) {
+        throw new Error("--cidfile and --name are managed internally by staff-mcp.");
+    }
+    const runIndex = args.indexOf("run");
+    if (runIndex < 0) {
+        throw new Error("Docker proxy arguments must contain the 'run' subcommand.");
+    }
+    const ownedDirectory = fs.mkdtempSync(path.join(os.tmpdir(), "staff-mcp-container-"));
+    const cidFilePath = path.join(ownedDirectory, "container.cid");
+    const containerName = `staff-mcp-${process.pid}-${randomUUID()}`;
+    args.splice(runIndex + 1, 0, "--cidfile", cidFilePath, "--name", containerName);
+    return { args, cidFilePath, containerName, ownedDirectory };
+}
+function readContainerId(cidFilePath) {
+    try {
+        const containerId = fs.readFileSync(cidFilePath, "utf8").trim();
+        return /^[a-f0-9]{64}$/i.test(containerId) ? containerId : undefined;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT") {
+            return undefined;
+        }
+        console.error(`[staff-mcp] Failed to read Docker cidfile '${cidFilePath}':`, error);
+        return undefined;
+    }
+}
+function delay(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+function isMissingContainerError(stderr) {
+    return /no such container|no container with (?:name or id|id|name).*found|container .* does not exist/i.test(stderr);
+}
+/**
+ * Reject Docker options that would detach the CLI or disable the lifecycle
+ * guarantees managed by staff-mcp. This validator is intentionally applied to
+ * user-supplied Docker options only, because the command executed inside the
+ * container can legitimately contain similarly named flags.
+ */
+export function validateAdditionalDockerArgs(args) {
+    for (const arg of args) {
+        const normalized = arg.toLowerCase();
+        const isShortDetachOption = (/^-[^-][a-z]*$/i.test(arg) && arg.slice(1).includes("d")) || normalized.startsWith("-d=");
+        if (isShortDetachOption ||
+            normalized === "--detach" ||
+            (normalized.startsWith("--detach=") && normalized !== "--detach=false")) {
+            throw new Error("detached containers are not supported by the staff-mcp Docker proxy");
+        }
+        if (normalized.startsWith("--rm=") && !["--rm=true", "--rm=t", "--rm=1"].includes(normalized)) {
+            throw new Error("--rm cannot be disabled by the staff-mcp Docker proxy");
+        }
+        if (normalized.startsWith("--interactive=") &&
+            !["--interactive=true", "--interactive=t", "--interactive=1"].includes(normalized)) {
+            throw new Error("interactive stdin cannot be disabled by the staff-mcp Docker proxy");
+        }
+        if (/^-[^-]*i[^=]*=/.test(arg)) {
+            throw new Error("assigned -i values are not supported; use -i or --interactive=true");
+        }
+        if (normalized === "--cidfile" ||
+            normalized.startsWith("--cidfile=") ||
+            normalized === "--name" ||
+            normalized.startsWith("--name=")) {
+            throw new Error("--cidfile and --name are managed internally by staff-mcp");
+        }
+    }
+}
+/**
+ * Run the Docker-compatible CLI and keep its lifecycle tied to this process.
+ *
+ * For stdio transport, the caller's stdin remains the MCP data channel. For
+ * HTTP/reverse transports, child.stdin is intentionally kept open as a private
+ * lifecycle pipe instead of being connected to process.stdin. This allows the
+ * service to run under PM2/systemd/Supervisor even when fd 0 is /dev/null, while
+ * still making the container exit if the host proxy disappears unexpectedly.
+ */
+export async function runDockerProxy(dockerArgs, transport, options = {}) {
+    const command = options.command ?? "docker";
+    const commandPrefixArgs = [...(options.commandPrefixArgs ?? [])];
+    const input = options.input ?? process.stdin;
+    const signalSource = options.signalSource ?? process;
+    const gracefulShutdownTimeoutMs = options.gracefulShutdownTimeoutMs ?? DEFAULT_GRACEFUL_SHUTDOWN_TIMEOUT_MS;
+    const containerIdWaitTimeoutMs = options.containerIdWaitTimeoutMs ?? DEFAULT_CONTAINER_ID_WAIT_TIMEOUT_MS;
+    const containerCleanupTimeoutMs = options.containerCleanupTimeoutMs ?? DEFAULT_CONTAINER_CLEANUP_TIMEOUT_MS;
+    const forceKillTimeoutMs = options.forceKillTimeoutMs ?? DEFAULT_FORCE_KILL_TIMEOUT_MS;
+    let containerIdentity;
+    try {
+        containerIdentity = prepareContainerIdentity(dockerArgs);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(`[staff-mcp] Failed to prepare Docker proxy: ${message}`);
+        return 1;
+    }
+    return new Promise((resolve) => {
+        let child;
+        let cleanupChild;
+        let runExit;
+        let trackedContainerId;
+        let settled = false;
+        let shutdownStarted = false;
+        let shutdownActivated = false;
+        let cleanupInProgress = false;
+        let cleanupAttempted = false;
+        let containerCleanupConfirmed = false;
+        let cleanupFailed = false;
+        let escalationPromise;
+        let gracefulTimer;
+        let postCleanupTimer;
+        let postCleanupFinalTimer;
+        let cidPollTimer;
+        const signalHandlers = new Map();
+        const captureContainerId = () => {
+            if (!trackedContainerId) {
+                trackedContainerId = readContainerId(containerIdentity.cidFilePath);
+            }
+            return trackedContainerId;
+        };
+        const isChildRunning = () => child !== undefined && child.exitCode === null && child.signalCode === null;
+        const removeListeners = () => {
+            for (const [signal, handler] of signalHandlers) {
+                signalSource.removeListener(signal, handler);
+            }
+            signalHandlers.clear();
+            if (transport === "stdio" && child?.stdin) {
+                input.unpipe(child.stdin);
+                input.removeListener("end", handleInputEnd);
+                input.removeListener("error", handleInputError);
+            }
+        };
+        const finish = (exitCode) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            if (gracefulTimer) {
+                clearTimeout(gracefulTimer);
+            }
+            if (postCleanupTimer) {
+                clearTimeout(postCleanupTimer);
+            }
+            if (postCleanupFinalTimer) {
+                clearTimeout(postCleanupFinalTimer);
+            }
+            if (cidPollTimer) {
+                clearInterval(cidPollTimer);
+            }
+            removeListeners();
+            try {
+                fs.rmSync(containerIdentity.ownedDirectory, { recursive: true, force: true });
+            }
+            catch (error) {
+                console.error(`[staff-mcp] Failed to remove temporary cidfile directory '${containerIdentity.ownedDirectory}':`, error);
+            }
+            resolve(exitCode);
+        };
+        const maybeFinish = () => {
+            if (!runExit || cleanupInProgress) {
+                return;
+            }
+            finish(cleanupFailed ? 1 : (runExit.code ?? exitCodeFromSignal(runExit.signal)));
+        };
+        const closeLifecyclePipe = () => {
+            if (!child?.stdin) {
+                return;
+            }
+            if (transport === "stdio") {
+                input.unpipe(child.stdin);
+            }
+            if (!child.stdin.destroyed && !child.stdin.writableEnded) {
+                child.stdin.end();
+            }
+        };
+        const waitForContainerId = async () => {
+            const deadline = Date.now() + containerIdWaitTimeoutMs;
+            let containerId = captureContainerId();
+            while (!containerId && isChildRunning() && Date.now() < deadline) {
+                await delay(Math.min(CONTAINER_ID_POLL_INTERVAL_MS, Math.max(1, deadline - Date.now())));
+                containerId = captureContainerId();
+            }
+            return containerId;
+        };
+        const forceRemoveContainer = (containerId) => new Promise((resolveCleanup) => {
+            let completed = false;
+            let cleanupSpawned = false;
+            let cleanupTimer;
+            let cleanupForceTimer;
+            let cleanupFinalTimer;
+            let stderr = "";
+            const complete = (success) => {
+                if (completed) {
+                    return;
+                }
+                completed = true;
+                if (cleanupTimer) {
+                    clearTimeout(cleanupTimer);
+                }
+                if (cleanupForceTimer) {
+                    clearTimeout(cleanupForceTimer);
+                }
+                if (cleanupFinalTimer) {
+                    clearTimeout(cleanupFinalTimer);
+                }
+                cleanupChild = undefined;
+                resolveCleanup(success);
+            };
+            try {
+                cleanupChild = spawn(command, [...commandPrefixArgs, "rm", "-f", containerId], {
+                    stdio: ["ignore", "ignore", "pipe"],
+                });
+            }
+            catch (error) {
+                console.error(`[staff-mcp] Failed to start fallback container cleanup for ${containerId}:`, error);
+                complete(false);
+                return;
+            }
+            cleanupChild.once("spawn", () => {
+                cleanupSpawned = true;
+            });
+            cleanupChild.stderr?.on("data", (chunk) => {
+                if (stderr.length < 8_192) {
+                    stderr += chunk.toString();
+                }
+            });
+            cleanupChild.once("error", (error) => {
+                console.error(`[staff-mcp] Failed to run fallback container cleanup for ${containerId}: ${error.message}`);
+                if (!cleanupSpawned && cleanupChild?.pid === undefined) {
+                    complete(false);
+                }
+            });
+            cleanupChild.once("close", (code, signal) => {
+                if (completed) {
+                    return;
+                }
+                const detail = stderr.trim();
+                if (code === 0 || isMissingContainerError(detail)) {
+                    console.error(`[staff-mcp] Fallback container cleanup completed for ${containerId}.`);
+                    complete(true);
+                    return;
+                }
+                console.error(`[staff-mcp] Fallback container cleanup failed for ${containerId}: code ${code ?? "null"}` +
+                    `${signal ? `, signal ${signal}` : ""}${detail ? `, ${detail}` : ""}`);
+                complete(false);
+            });
+            cleanupTimer = setTimeout(() => {
+                console.error(`[staff-mcp] Fallback container cleanup for ${containerId} exceeded ${containerCleanupTimeoutMs}ms; sending SIGTERM.`);
+                cleanupChild?.kill("SIGTERM");
+                cleanupForceTimer = setTimeout(() => {
+                    if (!completed) {
+                        console.error(`[staff-mcp] Fallback container cleanup for ${containerId} did not stop within an additional ${forceKillTimeoutMs}ms; sending SIGKILL.`);
+                        cleanupChild?.kill("SIGKILL");
+                        cleanupFinalTimer = setTimeout(() => {
+                            if (!completed) {
+                                console.error(`[staff-mcp] Fallback container cleanup for ${containerId} did not report completion after SIGKILL.`);
+                                complete(false);
+                            }
+                        }, forceKillTimeoutMs);
+                    }
+                }, forceKillTimeoutMs);
+            }, containerCleanupTimeoutMs);
+        });
+        const scheduleRunCliTermination = () => {
+            if (!isChildRunning() || postCleanupTimer) {
+                return;
+            }
+            child.kill("SIGTERM");
+            postCleanupTimer = setTimeout(() => {
+                if (!isChildRunning()) {
+                    return;
+                }
+                console.error(`[staff-mcp] Docker CLI did not exit within ${forceKillTimeoutMs}ms; sending SIGKILL.`);
+                child.kill("SIGKILL");
+                postCleanupFinalTimer = setTimeout(() => {
+                    if (!runExit && isChildRunning()) {
+                        console.error("[staff-mcp] Docker CLI did not report completion after SIGKILL.");
+                        cleanupFailed = true;
+                        runExit = { code: 1, signal: null };
+                        maybeFinish();
+                    }
+                }, forceKillTimeoutMs);
+            }, forceKillTimeoutMs);
+        };
+        const escalateShutdown = () => {
+            if (escalationPromise) {
+                return escalationPromise;
+            }
+            escalationPromise = (async () => {
+                if (gracefulTimer) {
+                    clearTimeout(gracefulTimer);
+                    gracefulTimer = undefined;
+                }
+                if (!isChildRunning()) {
+                    return;
+                }
+                if (containerCleanupConfirmed || cleanupAttempted) {
+                    scheduleRunCliTermination();
+                    return;
+                }
+                const containerId = await waitForContainerId();
+                if (!isChildRunning()) {
+                    return;
+                }
+                if (!containerId) {
+                    // Do not treat "no such container" as successful cleanup while the
+                    // Docker CLI may still be pulling an image or creating the container.
+                    // Stop the CLI first; its close handler will then remove the unique
+                    // generated name after no further create request can be issued.
+                    console.error(`[staff-mcp] Docker cidfile was unavailable; terminating the CLI before cleaning up '${containerIdentity.containerName}'.`);
+                    scheduleRunCliTermination();
+                    return;
+                }
+                cleanupInProgress = true;
+                cleanupAttempted = true;
+                const removed = await forceRemoveContainer(containerId);
+                cleanupInProgress = false;
+                if (removed) {
+                    containerCleanupConfirmed = true;
+                    cleanupFailed = false;
+                    // Once the exact tracked container has been removed, it is safe to
+                    // terminate a stuck CLI.
+                }
+                else {
+                    cleanupFailed = true;
+                    console.error(`[staff-mcp] Container ${containerId} could not be confirmed removed; terminating the stuck Docker CLI with an error status.`);
+                }
+                scheduleRunCliTermination();
+                maybeFinish();
+            })().finally(() => {
+                escalationPromise = undefined;
+            });
+            return escalationPromise;
+        };
+        const activateShutdown = () => {
+            if (!shutdownStarted || shutdownActivated || !child) {
+                return;
+            }
+            shutdownActivated = true;
+            closeLifecyclePipe();
+            gracefulTimer = setTimeout(() => {
+                if (!isChildRunning()) {
+                    return;
+                }
+                console.error(`[staff-mcp] Docker proxy did not exit within ${gracefulShutdownTimeoutMs}ms; removing its tracked container.`);
+                void escalateShutdown();
+            }, gracefulShutdownTimeoutMs);
+        };
+        const requestShutdown = (reason, repeatedSignal = false) => {
+            if (settled) {
+                return;
+            }
+            if (!shutdownStarted) {
+                shutdownStarted = true;
+                console.error(`[staff-mcp] Docker proxy shutdown requested: ${reason}`);
+                activateShutdown();
+                return;
+            }
+            if (repeatedSignal) {
+                console.error(`[staff-mcp] Repeated shutdown signal received: ${reason}`);
+                void escalateShutdown();
+            }
+        };
+        function handleInputEnd() {
+            requestShutdown("stdio input closed");
+        }
+        function handleInputError(error) {
+            console.error(`[staff-mcp] Docker proxy input error: ${error.message}`);
+            requestShutdown("stdio input error");
+        }
+        for (const signal of HANDLED_SIGNALS) {
+            const handler = () => requestShutdown(`received ${signal}`, true);
+            signalHandlers.set(signal, handler);
+            signalSource.on(signal, handler);
+        }
+        try {
+            child = spawn(command, [...commandPrefixArgs, ...containerIdentity.args], {
+                stdio: ["pipe", "inherit", "inherit"],
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.error(`[staff-mcp] Failed to start docker proxy: ${message}`);
+            finish(1);
+            return;
+        }
+        if (!child.stdin) {
+            console.error("[staff-mcp] Failed to start docker proxy: child stdin is unavailable.");
+            child.kill("SIGKILL");
+            finish(1);
+            return;
+        }
+        child.stdin.on("error", (error) => {
+            if (!settled && error.code !== "EPIPE") {
+                console.error(`[staff-mcp] Docker proxy stdin error: ${error.message}`);
+            }
+        });
+        child.once("error", (error) => {
+            if (settled) {
+                return;
+            }
+            if (child?.pid === undefined) {
+                console.error(`[staff-mcp] Failed to start docker proxy: ${error.message}`);
+                finish(1);
+                return;
+            }
+            console.error(`[staff-mcp] Docker proxy process error: ${error.message}`);
+            cleanupFailed = true;
+            requestShutdown("Docker proxy process error", true);
+        });
+        child.once("close", (code, signal) => {
+            if (settled) {
+                return;
+            }
+            captureContainerId();
+            runExit = { code, signal };
+            if (gracefulTimer) {
+                clearTimeout(gracefulTimer);
+            }
+            if (postCleanupTimer) {
+                clearTimeout(postCleanupTimer);
+            }
+            if (postCleanupFinalTimer) {
+                clearTimeout(postCleanupFinalTimer);
+            }
+            console.error(`[staff-mcp] Docker proxy exited with code ${code ?? "null"}${signal ? ` (signal ${signal})` : ""}.`);
+            // If a supervisor killed the Docker CLI directly, --rm may not have
+            // completed. Clean up by exact ID when available, otherwise use the
+            // unique generated name that was part of the container-create request.
+            if (!cleanupInProgress &&
+                !cleanupAttempted &&
+                !containerCleanupConfirmed &&
+                (signal !== null || code !== 0)) {
+                const cleanupReference = trackedContainerId ?? containerIdentity.containerName;
+                cleanupInProgress = true;
+                cleanupAttempted = true;
+                void forceRemoveContainer(cleanupReference)
+                    .then((removed) => {
+                    containerCleanupConfirmed = removed;
+                    cleanupFailed = !removed;
+                })
+                    .finally(() => {
+                    cleanupInProgress = false;
+                    maybeFinish();
+                });
+                return;
+            }
+            maybeFinish();
+        });
+        cidPollTimer = setInterval(captureContainerId, CONTAINER_ID_POLL_INTERVAL_MS);
+        cidPollTimer.unref();
+        if (transport === "stdio") {
+            input.once("end", handleInputEnd);
+            input.once("error", handleInputError);
+            input.pipe(child.stdin);
+        }
+        // A signal source can synchronously request shutdown while handlers are
+        // being installed (and a real OS signal can arrive during startup).
+        activateShutdown();
+    });
+}
+//# sourceMappingURL=docker-proxy.js.map

package/dist/src/docker-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-proxy.js","sourceRoot":"","sources":["../../src/docker-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AACjE,MAAM,oCAAoC,GAAG,MAAM,CAAC;AACpD,MAAM,oCAAoC,GAAG,KAAK,CAAC;AACnD,MAAM,oCAAoC,GAAG,MAAM,CAAC;AACpD,MAAM,6BAA6B,GAAG,KAAK,CAAC;AAC5C,MAAM,6BAA6B,GAAG,EAAE,CAAC;AA8BzC,SAAS,kBAAkB,CAAC,MAA6B;IACvD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC;QACb;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAuB;IACpD,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,KAAK,WAAW;QACnB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;QAC5B,GAAG,KAAK,QAAQ;QAChB,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,UAA6B;IAC7D,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;IAC7B,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,cAAc,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,aAAa,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB;IAC1C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,OAAO,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,8CAA8C,WAAW,IAAI,EAAE,KAAK,CAAC,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,YAAoB;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAc;IAC7C,OAAO,gGAAgG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAuB;IAClE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,mBAAmB,GACvB,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAE7F,IACE,mBAAmB;YACnB,UAAU,KAAK,UAAU;YACzB,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,UAAU,KAAK,gBAAgB,CAAC,EACvE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,IACE,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACvC,CAAC,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAClF,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QAED,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QAED,IACE,UAAU,KAAK,WAAW;YAC1B,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC;YACnC,UAAU,KAAK,QAAQ;YACvB,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAA6B,EAC7B,SAAiB,EACjB,UAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC;IAC5C,MAAM,iBAAiB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC;IACrD,MAAM,yBAAyB,GAC7B,OAAO,CAAC,yBAAyB,IAAI,oCAAoC,CAAC;IAC5E,MAAM,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI,oCAAoC,CAAC;IAC1G,MAAM,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,IAAI,oCAAoC,CAAC;IAC5G,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,6BAA6B,CAAC;IAEvF,IAAI,iBAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,iBAAiB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,+CAA+C,OAAO,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACrC,IAAI,KAA+B,CAAC;QACpC,IAAI,YAAsC,CAAC;QAC3C,IAAI,OAA8B,CAAC;QACnC,IAAI,kBAAsC,CAAC;QAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,iBAA4C,CAAC;QACjD,IAAI,aAAyC,CAAC;QAC9C,IAAI,gBAA4C,CAAC;QACjD,IAAI,qBAAiD,CAAC;QACtD,IAAI,YAAwC,CAAC;QAE7C,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8B,CAAC;QAE7D,MAAM,kBAAkB,GAAG,GAAuB,EAAE;YAClD,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,kBAAkB,GAAG,eAAe,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,kBAAkB,CAAC;QAC5B,CAAC,CAAC;QAEF,MAAM,cAAc,GAAG,GAAG,EAAE,CAC1B,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;QAE9E,MAAM,eAAe,GAAG,GAAG,EAAE;YAC3B,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,cAAc,EAAE,CAAC;gBAC/C,YAAY,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YACD,cAAc,CAAC,KAAK,EAAE,CAAC;YAEvB,IAAI,SAAS,KAAK,OAAO,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;gBAC1C,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC1B,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;gBAC5C,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,EAAE;YAClC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YAEf,IAAI,aAAa,EAAE,CAAC;gBAClB,YAAY,CAAC,aAAa,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,YAAY,CAAC,gBAAgB,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,YAAY,CAAC,qBAAqB,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,aAAa,CAAC,YAAY,CAAC,CAAC;YAC9B,CAAC;YAED,eAAe,EAAE,CAAC;YAElB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CACX,6DAA6D,iBAAiB,CAAC,cAAc,IAAI,EACjG,KAAK,CACN,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC,CAAC;QAEF,MAAM,WAAW,GAAG,GAAG,EAAE;YACvB,IAAI,CAAC,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC,CAAC;QAEF,MAAM,kBAAkB,GAAG,GAAG,EAAE;YAC9B,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;gBAClB,OAAO;YACT,CAAC;YAED,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC1B,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBACzD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACpB,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,kBAAkB,GAAG,KAAK,IAAiC,EAAE;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB,CAAC;YACvD,IAAI,WAAW,GAAG,kBAAkB,EAAE,CAAC;YACvC,OAAO,CAAC,WAAW,IAAI,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBACjE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzF,WAAW,GAAG,kBAAkB,EAAE,CAAC;YACrC,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC;QAEF,MAAM,oBAAoB,GAAG,CAAC,WAAmB,EAAoB,EAAE,CACrE,IAAI,OAAO,CAAU,CAAC,cAAc,EAAE,EAAE;YACtC,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,cAAc,GAAG,KAAK,CAAC;YAC3B,IAAI,YAAwC,CAAC;YAC7C,IAAI,iBAA6C,CAAC;YAClD,IAAI,iBAA6C,CAAC;YAClD,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAAE,EAAE;gBACpC,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,SAAS,GAAG,IAAI,CAAC;gBACjB,IAAI,YAAY,EAAE,CAAC;oBACjB,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC7B,CAAC;gBACD,IAAI,iBAAiB,EAAE,CAAC;oBACtB,YAAY,CAAC,iBAAiB,CAAC,CAAC;gBAClC,CAAC;gBACD,IAAI,iBAAiB,EAAE,CAAC;oBACtB,YAAY,CAAC,iBAAiB,CAAC,CAAC;gBAClC,CAAC;gBACD,YAAY,GAAG,SAAS,CAAC;gBACzB,cAAc,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC,CAAC;YAEF,IAAI,CAAC;gBACH,YAAY,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE;oBAC7E,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,8DAA8D,WAAW,GAAG,EAAE,KAAK,CAAC,CAAC;gBACnG,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC9B,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAChD,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACnC,OAAO,CAAC,KAAK,CAAC,4DAA4D,WAAW,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3G,IAAI,CAAC,cAAc,IAAI,YAAY,EAAE,GAAG,KAAK,SAAS,EAAE,CAAC;oBACvD,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAC1C,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO;gBACT,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,IAAI,KAAK,CAAC,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClD,OAAO,CAAC,KAAK,CAAC,wDAAwD,WAAW,GAAG,CAAC,CAAC;oBACtF,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACf,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,KAAK,CACX,qDAAqD,WAAW,UAAU,IAAI,IAAI,MAAM,EAAE;oBACxF,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACxE,CAAC;gBACF,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YAEH,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC7B,OAAO,CAAC,KAAK,CACX,8CAA8C,WAAW,aAAa,yBAAyB,sBAAsB,CACtH,CAAC;gBACF,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC9B,iBAAiB,GAAG,UAAU,CAAC,GAAG,EAAE;oBAClC,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,OAAO,CAAC,KAAK,CACX,8CAA8C,WAAW,sCAAsC,kBAAkB,sBAAsB,CACxI,CAAC;wBACF,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;wBAC9B,iBAAiB,GAAG,UAAU,CAAC,GAAG,EAAE;4BAClC,IAAI,CAAC,SAAS,EAAE,CAAC;gCACf,OAAO,CAAC,KAAK,CACX,8CAA8C,WAAW,2CAA2C,CACrG,CAAC;gCACF,QAAQ,CAAC,KAAK,CAAC,CAAC;4BAClB,CAAC;wBACH,CAAC,EAAE,kBAAkB,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC,EAAE,kBAAkB,CAAC,CAAC;YACzB,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEL,MAAM,yBAAyB,GAAG,GAAG,EAAE;YACrC,IAAI,CAAC,cAAc,EAAE,IAAI,gBAAgB,EAAE,CAAC;gBAC1C,OAAO;YACT,CAAC;YAED,KAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE;gBACjC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;oBACtB,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,KAAK,CACX,8CAA8C,kBAAkB,sBAAsB,CACvF,CAAC;gBACF,KAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvB,qBAAqB,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtC,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE,EAAE,CAAC;wBACjC,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;wBACjF,aAAa,GAAG,IAAI,CAAC;wBACrB,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;wBACpC,WAAW,EAAE,CAAC;oBAChB,CAAC;gBACH,CAAC,EAAE,kBAAkB,CAAC,CAAC;YACzB,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACzB,CAAC,CAAC;QAEF,MAAM,gBAAgB,GAAG,GAAkB,EAAE;YAC3C,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YAED,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC9B,IAAI,aAAa,EAAE,CAAC;oBAClB,YAAY,CAAC,aAAa,CAAC,CAAC;oBAC5B,aAAa,GAAG,SAAS,CAAC;gBAC5B,CAAC;gBAED,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;oBACtB,OAAO;gBACT,CAAC;gBAED,IAAI,yBAAyB,IAAI,gBAAgB,EAAE,CAAC;oBAClD,yBAAyB,EAAE,CAAC;oBAC5B,OAAO;gBACT,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;gBAC/C,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;oBACtB,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,mEAAmE;oBACnE,sEAAsE;oBACtE,oEAAoE;oBACpE,gEAAgE;oBAChE,OAAO,CAAC,KAAK,CACX,uFAAuF,iBAAiB,CAAC,aAAa,IAAI,CAC3H,CAAC;oBACF,yBAAyB,EAAE,CAAC;oBAC5B,OAAO;gBACT,CAAC;gBAED,iBAAiB,GAAG,IAAI,CAAC;gBACzB,gBAAgB,GAAG,IAAI,CAAC;gBACxB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;gBACxD,iBAAiB,GAAG,KAAK,CAAC;gBAE1B,IAAI,OAAO,EAAE,CAAC;oBACZ,yBAAyB,GAAG,IAAI,CAAC;oBACjC,aAAa,GAAG,KAAK,CAAC;oBACtB,mEAAmE;oBACnE,yBAAyB;gBAC3B,CAAC;qBAAM,CAAC;oBACN,aAAa,GAAG,IAAI,CAAC;oBACrB,OAAO,CAAC,KAAK,CACX,yBAAyB,WAAW,yFAAyF,CAC9H,CAAC;gBACJ,CAAC;gBAED,yBAAyB,EAAE,CAAC;gBAC5B,WAAW,EAAE,CAAC;YAChB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChB,iBAAiB,GAAG,SAAS,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,OAAO,iBAAiB,CAAC;QAC3B,CAAC,CAAC;QAEF,MAAM,gBAAgB,GAAG,GAAG,EAAE;YAC5B,IAAI,CAAC,eAAe,IAAI,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,iBAAiB,GAAG,IAAI,CAAC;YACzB,kBAAkB,EAAE,CAAC;YAErB,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;oBACtB,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,KAAK,CACX,gDAAgD,yBAAyB,qCAAqC,CAC/G,CAAC;gBACF,KAAK,gBAAgB,EAAE,CAAC;YAC1B,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAChC,CAAC,CAAC;QAEF,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,cAAc,GAAG,KAAK,EAAE,EAAE;YACjE,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YAED,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,eAAe,GAAG,IAAI,CAAC;gBACvB,OAAO,CAAC,KAAK,CAAC,gDAAgD,MAAM,EAAE,CAAC,CAAC;gBACxE,gBAAgB,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,CAAC,KAAK,CAAC,kDAAkD,MAAM,EAAE,CAAC,CAAC;gBAC1E,KAAK,gBAAgB,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC;QAEF,SAAS,cAAc;YACrB,eAAe,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,SAAS,gBAAgB,CAAC,KAAY;YACpC,OAAO,CAAC,KAAK,CAAC,yCAAyC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,eAAe,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,YAAY,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;YAClE,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE;gBACxE,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,6CAA6C,OAAO,EAAE,CAAC,CAAC;YACtE,MAAM,CAAC,CAAC,CAAC,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;YACvF,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,CAAC,CAAC,CAAC;YACV,OAAO;QACT,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACvD,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACvC,OAAO,CAAC,KAAK,CAAC,yCAAyC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YAED,IAAI,KAAK,EAAE,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CAAC,6CAA6C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5E,MAAM,CAAC,CAAC,CAAC,CAAC;gBACV,OAAO;YACT,CAAC;YAED,OAAO,CAAC,KAAK,CAAC,2CAA2C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,aAAa,GAAG,IAAI,CAAC;YACrB,eAAe,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YAED,kBAAkB,EAAE,CAAC;YACrB,OAAO,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC3B,IAAI,aAAa,EAAE,CAAC;gBAClB,YAAY,CAAC,aAAa,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,YAAY,CAAC,gBAAgB,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,YAAY,CAAC,qBAAqB,CAAC,CAAC;YACtC,CAAC;YAED,OAAO,CAAC,KAAK,CACX,6CAA6C,IAAI,IAAI,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CACrG,CAAC;YAEF,oEAAoE;YACpE,oEAAoE;YACpE,uEAAuE;YACvE,IACE,CAAC,iBAAiB;gBAClB,CAAC,gBAAgB;gBACjB,CAAC,yBAAyB;gBAC1B,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,EAC/B,CAAC;gBACD,MAAM,gBAAgB,GAAG,kBAAkB,IAAI,iBAAiB,CAAC,aAAa,CAAC;gBAC/E,iBAAiB,GAAG,IAAI,CAAC;gBACzB,gBAAgB,GAAG,IAAI,CAAC;gBACxB,KAAK,oBAAoB,CAAC,gBAAgB,CAAC;qBACxC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;oBAChB,yBAAyB,GAAG,OAAO,CAAC;oBACpC,aAAa,GAAG,CAAC,OAAO,CAAC;gBAC3B,CAAC,CAAC;qBACD,OAAO,CAAC,GAAG,EAAE;oBACZ,iBAAiB,GAAG,KAAK,CAAC;oBAC1B,WAAW,EAAE,CAAC;gBAChB,CAAC,CAAC,CAAC;gBACL,OAAO;YACT,CAAC;YAED,WAAW,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,YAAY,GAAG,WAAW,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;QAC9E,YAAY,CAAC,KAAK,EAAE,CAAC;QAErB,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QAED,wEAAwE;QACxE,oEAAoE;QACpE,gBAAgB,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC"}