@aarmos/bridge 0.1.10 → 0.1.11

package/dist/chunk-GMH5B5YX.js

@@ -0,0 +1,871 @@
+#!/usr/bin/env node
+
+// src/bridge.ts
+import { WebSocketServer, WebSocket } from "ws";
+
+// src/rpc/router.ts
+import { z as z3 } from "zod";
+import fs from "fs/promises";
+import path from "path";
+import { spawn } from "child_process";
+import { simpleGit } from "simple-git";
+import pg from "pg";
+
+// src/lib/http-broker.ts
+import { z } from "zod";
+var HttpCallParams = z.object({
+  method: z.enum(["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"]).default("GET"),
+  url: z.string().url(),
+  headers: z.record(z.string()).optional(),
+  body: z.string().optional(),
+  // caller stringifies JSON — keeps signing deterministic
+  bearerEnv: z.string().optional(),
+  timeoutMs: z.number().int().min(100).max(6e4).default(15e3)
+});
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return "";
+  }
+}
+function previewHttpCall(p, allowed) {
+  const host = hostOf(p.url);
+  if (!allowed.has(host)) {
+    throw new Error(
+      `http.call host not allowed: ${host} (start with --allow-http ${host} or add it to the pack)`
+    );
+  }
+  const redactedHeaders = { ...p.headers ?? {} };
+  for (const k of Object.keys(redactedHeaders)) {
+    if (/^authorization$/i.test(k)) redactedHeaders[k] = "***";
+  }
+  if (p.bearerEnv) redactedHeaders["Authorization"] = `Bearer $${p.bearerEnv}`;
+  return {
+    method: p.method,
+    url: p.url,
+    host,
+    headers: redactedHeaders,
+    bodyBytes: p.body?.length ?? 0
+  };
+}
+async function executeHttpCall(p, allowed) {
+  const host = hostOf(p.url);
+  if (!allowed.has(host)) throw new Error(`http.call host not allowed: ${host}`);
+  const headers = { ...p.headers ?? {} };
+  if (p.bearerEnv) {
+    const tok = process.env[p.bearerEnv];
+    if (!tok) throw new Error(`http.call: env ${p.bearerEnv} is not set on this host`);
+    headers["Authorization"] = `Bearer ${tok}`;
+  }
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), p.timeoutMs);
+  try {
+    const res = await fetch(p.url, {
+      method: p.method,
+      headers,
+      body: p.body,
+      signal: controller.signal
+    });
+    const bodyBuf = new Uint8Array(await res.arrayBuffer());
+    const capped = bodyBuf.length > 1048576 ? bodyBuf.slice(0, 1048576) : bodyBuf;
+    const bodySnippet = new TextDecoder("utf-8", { fatal: false }).decode(capped).slice(0, 4e3);
+    const outHeaders = {};
+    res.headers.forEach((v, k) => outHeaders[k] = v);
+    return { status: res.status, headers: outHeaders, bodySnippet, bytes: bodyBuf.length };
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+// src/lib/mcp-broker.ts
+import { z as z2 } from "zod";
+var McpToolParams = z2.object({
+  endpoint: z2.string().url(),
+  tool: z2.string().min(1),
+  args: z2.record(z2.unknown()).default({}),
+  bearerEnv: z2.string().optional(),
+  /** Optional operator hint for the risk classifier. Defaults to "write". */
+  riskHint: z2.enum(["read", "write", "destructive"]).optional(),
+  timeoutMs: z2.number().int().min(100).max(6e4).default(15e3)
+});
+function previewMcpTool(p, allowed) {
+  if (!allowed.has(p.endpoint)) {
+    throw new Error(
+      `mcp.tool endpoint not allowed: ${p.endpoint} (start with --allow-mcp ${p.endpoint})`
+    );
+  }
+  return {
+    endpoint: p.endpoint,
+    tool: p.tool,
+    argKeys: Object.keys(p.args ?? {}),
+    riskHint: p.riskHint ?? "write"
+  };
+}
+async function executeMcpTool(p, allowed) {
+  if (!allowed.has(p.endpoint)) throw new Error(`mcp.tool endpoint not allowed: ${p.endpoint}`);
+  const headers = {
+    "Content-Type": "application/json",
+    // Streamable HTTP servers reject requests without both types.
+    Accept: "application/json, text/event-stream"
+  };
+  if (p.bearerEnv) {
+    const tok = process.env[p.bearerEnv];
+    if (!tok) throw new Error(`mcp.tool: env ${p.bearerEnv} is not set on this host`);
+    headers["Authorization"] = `Bearer ${tok}`;
+  }
+  const body = JSON.stringify({
+    jsonrpc: "2.0",
+    id: Date.now(),
+    method: "tools/call",
+    params: { name: p.tool, arguments: p.args ?? {} }
+  });
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), p.timeoutMs);
+  try {
+    const res = await fetch(p.endpoint, {
+      method: "POST",
+      headers,
+      body,
+      signal: controller.signal
+    });
+    const text = await res.text();
+    const payload = text.startsWith("event:") || text.includes("\ndata:") ? extractFirstSseData(text) : text;
+    let parsed = payload;
+    try {
+      parsed = JSON.parse(payload);
+    } catch {
+    }
+    const envelope = parsed;
+    if (envelope && typeof envelope === "object" && "error" in envelope && envelope.error) {
+      return { ok: false, error: envelope.error };
+    }
+    return { ok: res.ok, result: envelope?.result ?? parsed };
+  } finally {
+    clearTimeout(t);
+  }
+}
+function extractFirstSseData(text) {
+  for (const line of text.split(/\r?\n/)) {
+    if (line.startsWith("data:")) return line.slice(5).trim();
+  }
+  return text;
+}
+
+// src/lib/llm-test.ts
+var DOCS = "https://aarmos.io/docs/byo-llm";
+var DEFAULT_TIMEOUT_MS = 6e3;
+var TEMPLATES = {
+  LLM_AUTH_INVALID: {
+    message: "Provider rejected the API key.",
+    hint: "Re-check the key in Settings \u2192 AI Provider. Rotated keys need to be pasted again.",
+    docsUrl: DOCS
+  },
+  LLM_RATE_LIMITED: {
+    message: "Provider rate-limited the test request.",
+    hint: "Wait a few seconds and retry. Persistent 429s usually mean a per-minute cap on the account.",
+    docsUrl: DOCS
+  },
+  LLM_QUOTA_EXCEEDED: {
+    message: "Provider account is out of credit/quota.",
+    hint: "Top up or switch provider. Test-connection uses 1 token \u2014 this is a real account problem, not the test.",
+    docsUrl: DOCS
+  },
+  LLM_NETWORK: {
+    message: "Could not reach the provider.",
+    hint: "Check the machine's network. For self-hosted endpoints, verify the daemon is running.",
+    docsUrl: DOCS
+  },
+  LLM_UNREACHABLE: {
+    message: "Custom endpoint did not respond.",
+    hint: "Verify the base URL is reachable from this machine (curl it) and CORS isn't blocking the browser client.",
+    docsUrl: DOCS
+  },
+  LLM_TIMEOUT: {
+    message: "Provider did not respond within the test window.",
+    hint: "Retry, or raise the timeout. A cold container can take >6s on the first request.",
+    docsUrl: DOCS
+  },
+  LLM_BAD_REQUEST: {
+    message: "Provider rejected the request shape.",
+    hint: "Usually a wrong model name or an endpoint that doesn't speak OpenAI-compatible chat completions.",
+    docsUrl: DOCS
+  },
+  LLM_MODEL_NOT_FOUND: {
+    message: "Provider does not know that model.",
+    hint: "Pick a model the account has access to. Model IDs are case-sensitive.",
+    docsUrl: DOCS
+  },
+  LLM_UNKNOWN: {
+    message: "Provider returned an unexpected error.",
+    hint: "Re-run with the CLI to see the raw upstream response, then file an issue if it looks like a bug.",
+    docsUrl: DOCS
+  }
+};
+function makeError(code, overrides = {}) {
+  const base = TEMPLATES[code];
+  return {
+    code,
+    message: overrides.message ?? base.message,
+    hint: overrides.hint ?? base.hint,
+    docsUrl: overrides.docsUrl ?? base.docsUrl
+  };
+}
+function classifyProviderError(status, message, providerId, isCustom, aborted = false) {
+  const msg = (message || "").toLowerCase();
+  const prefix = `${providerId}${status ? ` [${status}]` : ""}: `;
+  const wrap = (base) => ({
+    ...base,
+    message: `${prefix}${message || base.message}`
+  });
+  if (aborted || /abort/.test(msg)) return wrap(makeError("LLM_TIMEOUT"));
+  if (status === 401 || status === 403 || /invalid api key|unauthori[sz]ed|permission|forbidden/.test(msg)) {
+    return wrap(makeError("LLM_AUTH_INVALID"));
+  }
+  if (status === 429 || /rate.?limit|too many requests|rpm/.test(msg)) {
+    if (/quota|exhausted|billing|insufficient|credit/.test(msg)) {
+      return wrap(makeError("LLM_QUOTA_EXCEEDED"));
+    }
+    return wrap(makeError("LLM_RATE_LIMITED"));
+  }
+  if (status === 402 || /quota|exhausted|billing|insufficient|credit/.test(msg)) {
+    return wrap(makeError("LLM_QUOTA_EXCEEDED"));
+  }
+  if (status === 404 || /model.*(not.?found|does not exist|unknown)/.test(msg)) {
+    return wrap(makeError("LLM_MODEL_NOT_FOUND"));
+  }
+  if (status === 400 || status === 422) return wrap(makeError("LLM_BAD_REQUEST"));
+  if (status === 0 || /failed to fetch|network|econnrefused|etimedout|enotfound|dns/.test(msg)) {
+    return wrap(makeError(isCustom ? "LLM_UNREACHABLE" : "LLM_NETWORK"));
+  }
+  return wrap(makeError("LLM_UNKNOWN"));
+}
+function isValidEndpoint(u) {
+  try {
+    const url = new URL(u);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+async function testLlmConnection(p) {
+  const providerId = p.providerId || "custom";
+  const isCustom = providerId === "custom" || !p.baseUrl.includes("api.openai.com");
+  if (!isValidEndpoint(p.baseUrl)) {
+    return {
+      ok: false,
+      latencyMs: 0,
+      error: classifyProviderError(0, `invalid baseUrl: ${p.baseUrl}`, providerId, isCustom)
+    };
+  }
+  if (!p.model) {
+    return {
+      ok: false,
+      latencyMs: 0,
+      error: classifyProviderError(400, "missing model id", providerId, isCustom)
+    };
+  }
+  const url = p.baseUrl.replace(/\/+$/, "") + "/chat/completions";
+  const headers = {
+    "Content-Type": "application/json",
+    ...p.apiKey ? { Authorization: `Bearer ${p.apiKey}` } : {},
+    ...p.headers ?? {}
+  };
+  const ctrl = new AbortController();
+  const timeoutMs = p.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  const started = Date.now();
+  let aborted = false;
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        model: p.model,
+        messages: [{ role: "user", content: "ping" }],
+        max_tokens: 1
+      }),
+      signal: ctrl.signal
+    });
+    const latencyMs = Date.now() - started;
+    if (res.ok) return { ok: true, latencyMs, providerId, model: p.model };
+    const body = await res.text().catch(() => "");
+    return {
+      ok: false,
+      latencyMs,
+      error: classifyProviderError(res.status, body.slice(0, 240), providerId, isCustom)
+    };
+  } catch (e) {
+    const latencyMs = Date.now() - started;
+    const raw = e instanceof Error ? e.message : String(e);
+    aborted = ctrl.signal.aborted;
+    return {
+      ok: false,
+      latencyMs,
+      error: classifyProviderError(0, raw, providerId, isCustom, aborted)
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/rpc/router.ts
+var TestConnectionParams = z3.object({
+  providerId: z3.string().min(1),
+  baseUrl: z3.string().url(),
+  apiKey: z3.string().optional(),
+  model: z3.string().min(1),
+  headers: z3.record(z3.string()).optional(),
+  timeoutMs: z3.number().int().min(100).max(3e4).optional()
+});
+var RpcRequest = z3.object({
+  id: z3.union([z3.string(), z3.number()]),
+  type: z3.literal("rpc"),
+  method: z3.string(),
+  params: z3.unknown().optional()
+});
+var BatchAction = z3.object({
+  kind: z3.enum(["fs.write", "shell.exec", "http.call", "mcp.tool"]),
+  params: z3.unknown()
+});
+async function handleRpc(session, msg) {
+  const parsed = RpcRequest.safeParse(msg);
+  if (!parsed.success) return { type: "error", error: "invalid rpc envelope" };
+  const { id, method, params } = parsed.data;
+  try {
+    const result = await dispatch(session, method, params);
+    return { id, type: "result", result };
+  } catch (err) {
+    const maybe = err && typeof err === "object" && "aarmos" in err ? err.aarmos : void 0;
+    const message = err instanceof Error ? err.message : String(err);
+    return maybe ? { id, type: "error", error: message, aarmos: maybe } : { id, type: "error", error: message };
+  }
+}
+async function dispatch(session, method, params) {
+  switch (method) {
+    // ---- reads (always live, never previewed) ------------------------------
+    case "fs.read": {
+      const { path: rel, encoding } = z3.object({ path: z3.string(), encoding: z3.enum(["utf8", "base64"]).default("utf8") }).parse(params);
+      const abs = session.resolveInJail(rel);
+      const buf = await fs.readFile(abs);
+      return { path: rel, encoding, data: encoding === "utf8" ? buf.toString("utf8") : buf.toString("base64") };
+    }
+    case "fs.list": {
+      const { path: rel } = z3.object({ path: z3.string().default(".") }).parse(params);
+      const abs = session.resolveInJail(rel);
+      const entries = await fs.readdir(abs, { withFileTypes: true });
+      return entries.map((e) => ({ name: e.name, dir: e.isDirectory(), file: e.isFile() }));
+    }
+    case "git.status": {
+      return await simpleGit(session.workspace).status();
+    }
+    case "git.branch": {
+      return await simpleGit(session.workspace).branch();
+    }
+    // ---- mutations (previewed under dry-run) -------------------------------
+    case "fs.write": {
+      const preview = await previewFsWrite(session, params);
+      if (session.dryRun) return { preview: true, action: preview };
+      return await executeFsWrite(session, params);
+    }
+    case "shell.exec": {
+      const preview = previewShellExec(session, params);
+      if (session.dryRun) return { preview: true, action: preview };
+      return await executeShellExec(session, params);
+    }
+    case "http.call": {
+      const p = HttpCallParams.parse(params);
+      const preview = { kind: "http.call", params: p, preview: previewHttpCall(p, session.httpAllow) };
+      if (session.dryRun) return { preview: true, action: preview };
+      return await executeHttpCall(p, session.httpAllow);
+    }
+    case "mcp.tool": {
+      const p = McpToolParams.parse(params);
+      const preview = { kind: "mcp.tool", params: p, preview: previewMcpTool(p, session.mcpAllow) };
+      if (session.dryRun) return { preview: true, action: preview };
+      return await executeMcpTool(p, session.mcpAllow);
+    }
+    // ---- LLM diagnostics (no receipt, no chat) -----------------------------
+    // Dry-runs a BYO-LLM provider so the CLI can surface the same
+    // structured LLM_* AarmosError codes the PWA shows in Settings, without
+    // minting an AVAR chat receipt. Never routed through the sticky
+    // active-provider ring; caller supplies the config each call.
+    case "aarmos.testConnection": {
+      const p = TestConnectionParams.parse(params);
+      return await testLlmConnection(p);
+    }
+    // ---- session controls --------------------------------------------------
+    case "session.setDryRun": {
+      const { on } = z3.object({ on: z3.boolean() }).parse(params);
+      session.dryRun = on;
+      return { dryRun: session.dryRun };
+    }
+    case "session.state": {
+      return { dryRun: session.dryRun, workspace: session.workspace };
+    }
+    // ---- read-only Postgres (only if operator passed --allow-sql) ----------
+    case "db.list": {
+      return {
+        databases: [...session.sqlAllow.values()].map((s) => ({ alias: s.alias }))
+      };
+    }
+    case "db.query": {
+      return await executeDbQuery(session, params);
+    }
+    // ---- scoped filesystem read (only if operator passed --allow-read) ------
+    case "fs.scopedRoots": {
+      return { roots: [...session.readAllow] };
+    }
+    case "fs.scopedRead": {
+      const { path: abs, encoding } = z3.object({
+        path: z3.string(),
+        encoding: z3.enum(["utf8", "base64"]).default("utf8")
+      }).parse(params);
+      const real = session.assertReadable(abs);
+      const buf = await fs.readFile(real);
+      if (buf.byteLength > 2 * 1024 * 1024) {
+        throw new Error(
+          `file too large for scopedRead (${buf.byteLength} bytes; cap 2 MiB)`
+        );
+      }
+      return {
+        path: real,
+        encoding,
+        bytes: buf.byteLength,
+        data: encoding === "utf8" ? buf.toString("utf8") : buf.toString("base64")
+      };
+    }
+    case "fs.scopedList": {
+      const { path: abs } = z3.object({ path: z3.string() }).parse(params);
+      const real = session.assertReadable(abs);
+      const entries = await fs.readdir(real, { withFileTypes: true });
+      return {
+        path: real,
+        entries: entries.map((e) => ({
+          name: e.name,
+          absPath: path.join(real, e.name),
+          dir: e.isDirectory(),
+          file: e.isFile()
+        }))
+      };
+    }
+    // ---- batch apply (commits an approved plan, ignoring dryRun) -----------
+    case "apply.batch": {
+      const { actions } = z3.object({ actions: z3.array(BatchAction) }).parse(params);
+      const results = [];
+      for (const a of actions) {
+        try {
+          let res;
+          if (a.kind === "fs.write") res = await executeFsWrite(session, a.params);
+          else if (a.kind === "shell.exec") res = await executeShellExec(session, a.params);
+          else if (a.kind === "http.call") res = await executeHttpCall(HttpCallParams.parse(a.params), session.httpAllow);
+          else res = await executeMcpTool(McpToolParams.parse(a.params), session.mcpAllow);
+          results.push({ ok: true, kind: a.kind, result: res });
+        } catch (err) {
+          results.push({
+            ok: false,
+            kind: a.kind,
+            error: err instanceof Error ? err.message : String(err)
+          });
+          break;
+        }
+      }
+      return { applied: results.length, results };
+    }
+    default:
+      throw new Error(`unknown method: ${method}`);
+  }
+}
+var FsWriteParams = z3.object({
+  path: z3.string(),
+  data: z3.string(),
+  encoding: z3.enum(["utf8", "base64"]).default("utf8")
+});
+async function previewFsWrite(session, params) {
+  const p = FsWriteParams.parse(params);
+  const abs = session.resolveInJail(p.path);
+  let before = null;
+  let existed = false;
+  try {
+    const buf = await fs.readFile(abs);
+    existed = true;
+    before = p.encoding === "utf8" ? buf.toString("utf8") : buf.toString("base64");
+  } catch {
+  }
+  const after = p.data;
+  return {
+    kind: "fs.write",
+    params: p,
+    preview: {
+      path: p.path,
+      encoding: p.encoding,
+      existed,
+      bytesBefore: before?.length ?? 0,
+      bytesAfter: after.length,
+      before,
+      after
+    }
+  };
+}
+async function executeFsWrite(session, params) {
+  const p = FsWriteParams.parse(params);
+  const abs = session.resolveInJail(p.path);
+  await fs.mkdir(pathDirname(abs), { recursive: true });
+  await fs.writeFile(abs, p.encoding === "utf8" ? p.data : Buffer.from(p.data, "base64"));
+  return { path: p.path, bytes: p.data.length };
+}
+var ShellExecParams = z3.object({
+  bin: z3.string(),
+  args: z3.array(z3.string()).default([]),
+  cwd: z3.string().default(".")
+});
+function previewShellExec(session, params) {
+  const p = ShellExecParams.parse(params);
+  if (!session.shellAllow.has(p.bin)) throw new Error(`shell binary not allowed: ${p.bin}`);
+  const absCwd = session.resolveInJail(p.cwd);
+  return {
+    kind: "shell.exec",
+    params: p,
+    preview: {
+      commandLine: [p.bin, ...p.args].join(" "),
+      cwd: absCwd,
+      binary: p.bin,
+      args: p.args
+    }
+  };
+}
+async function executeShellExec(session, params) {
+  const p = ShellExecParams.parse(params);
+  if (!session.shellAllow.has(p.bin)) throw new Error(`shell binary not allowed: ${p.bin}`);
+  const absCwd = session.resolveInJail(p.cwd);
+  return await execAllowed(p.bin, p.args, absCwd);
+}
+function pathDirname(p) {
+  const i = p.lastIndexOf("/");
+  return i >= 0 ? p.slice(0, i) : ".";
+}
+function execAllowed(bin, args, cwd) {
+  return new Promise((resolve) => {
+    const child = spawn(bin, args, { cwd, shell: false });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (b) => stdout += b.toString());
+    child.stderr.on("data", (b) => stderr += b.toString());
+    child.on("close", (code) => resolve({ code: code ?? 0, stdout, stderr }));
+  });
+}
+var DbQueryParams = z3.object({
+  alias: z3.string().optional(),
+  sql: z3.string().min(1),
+  params: z3.array(z3.unknown()).default([]),
+  rowLimit: z3.number().int().min(1).max(1e4).default(500),
+  statementTimeoutMs: z3.number().int().min(100).max(3e4).default(5e3)
+});
+async function executeDbQuery(session, params) {
+  const p = DbQueryParams.parse(params);
+  if (session.sqlAllow.size === 0) {
+    throw new Error(
+      "db.query is not permitted \u2014 start the CLI with --allow-sql <alias>=<dsn> to opt in."
+    );
+  }
+  let entry;
+  if (p.alias) {
+    entry = session.sqlAllow.get(p.alias);
+    if (!entry) throw new Error(`unknown --allow-sql alias: ${p.alias}`);
+  } else if (session.sqlAllow.size === 1) {
+    entry = session.sqlAllow.values().next().value;
+  } else {
+    throw new Error(
+      `alias required (registered: ${[...session.sqlAllow.keys()].join(", ")})`
+    );
+  }
+  const client = new pg.Client({ connectionString: entry.dsn });
+  const started = Date.now();
+  try {
+    await client.connect();
+    await client.query("BEGIN READ ONLY");
+    await client.query(`SET LOCAL statement_timeout = ${p.statementTimeoutMs}`);
+    const res = await client.query({ text: p.sql, values: p.params });
+    await client.query("ROLLBACK");
+    const truncated = res.rows.length > p.rowLimit;
+    return {
+      alias: entry.alias,
+      command: res.command,
+      rowCount: res.rowCount,
+      returnedRows: Math.min(res.rows.length, p.rowLimit),
+      truncated,
+      fields: res.fields?.map((f) => ({ name: f.name, dataTypeID: f.dataTypeID })),
+      rows: truncated ? res.rows.slice(0, p.rowLimit) : res.rows,
+      elapsedMs: Date.now() - started
+    };
+  } finally {
+    try {
+      await client.end();
+    } catch {
+    }
+  }
+}
+
+// src/watchers/files.ts
+import chokidar from "chokidar";
+import path2 from "path";
+function startFileWatcher(session, emit) {
+  const watcher = chokidar.watch(session.workspace, {
+    ignored: [
+      /(^|[/\\])\../,
+      // dotfiles
+      /node_modules/,
+      /dist|build|\.next|\.turbo|\.cache/
+    ],
+    ignoreInitial: true,
+    awaitWriteFinish: { stabilityThreshold: 120, pollInterval: 40 },
+    persistent: true
+  });
+  const send = (kind) => (p) => {
+    const rel = path2.relative(session.workspace, p) || ".";
+    emit({ kind, path: rel, at: Date.now() });
+  };
+  watcher.on("add", send("add")).on("change", send("change")).on("unlink", send("unlink")).on("addDir", send("addDir")).on("unlinkDir", send("unlinkDir"));
+  return () => void watcher.close();
+}
+
+// src/watchers/git.ts
+import { simpleGit as simpleGit2 } from "simple-git";
+function startGitWatcher(session, emit) {
+  const git = simpleGit2(session.workspace);
+  let lastBranch = null;
+  let lastHead = null;
+  let stopped = false;
+  const tick = async () => {
+    if (stopped) return;
+    try {
+      const status = await git.status();
+      const head = (await git.revparse(["HEAD"])).trim();
+      const branch = status.current ?? null;
+      if (branch !== lastBranch || head !== lastHead) {
+        const kind = branch !== lastBranch ? "branch" : "head";
+        lastBranch = branch;
+        lastHead = head;
+        emit({ kind, branch, head, at: Date.now() });
+      }
+    } catch {
+      stopped = true;
+      return;
+    }
+    if (!stopped) setTimeout(tick, 1500);
+  };
+  void tick();
+  return () => {
+    stopped = true;
+  };
+}
+
+// src/session.ts
+import path3 from "path";
+import fs2 from "fs";
+var DEFAULT_SHELL_ALLOW = [
+  "git",
+  "npm",
+  "pnpm",
+  "bun",
+  "node",
+  "ls",
+  "cat",
+  "rg",
+  "grep"
+];
+function createSession(opts) {
+  const workspace = path3.resolve(opts.workspace);
+  const shellAllow = /* @__PURE__ */ new Set([...DEFAULT_SHELL_ALLOW, ...opts.extraShellAllow]);
+  const sqlAllow = /* @__PURE__ */ new Map();
+  for (const entry of opts.sqlAllow ?? []) {
+    if (sqlAllow.has(entry.alias)) {
+      throw new Error(`duplicate --allow-sql alias: ${entry.alias}`);
+    }
+    sqlAllow.set(entry.alias, entry);
+  }
+  const readAllow = [];
+  for (const raw of opts.readAllow ?? []) {
+    const abs = path3.resolve(raw);
+    let real;
+    try {
+      real = fs2.realpathSync(abs);
+    } catch {
+      throw new Error(`--allow-read path does not exist: ${raw}`);
+    }
+    readAllow.push(real);
+  }
+  const httpAllow = new Set(opts.httpAllow ?? []);
+  const mcpAllow = new Set(opts.mcpAllow ?? []);
+  const capabilities = [
+    "fs.read",
+    "fs.write",
+    "fs.list",
+    "shell.exec",
+    "git.status",
+    "git.branch",
+    "events.fs",
+    "events.git",
+    "session.setDryRun",
+    "apply.batch"
+  ];
+  if (sqlAllow.size > 0) {
+    capabilities.push("db.list", "db.query");
+  }
+  if (readAllow.length > 0) {
+    capabilities.push("fs.scopedRoots", "fs.scopedRead", "fs.scopedList");
+  }
+  if (httpAllow.size > 0) capabilities.push("http.call");
+  if (mcpAllow.size > 0) capabilities.push("mcp.tool");
+  return {
+    workspace,
+    shellAllow,
+    sqlAllow,
+    readAllow,
+    httpAllow,
+    mcpAllow,
+    dryRun: true,
+    capabilities,
+    resolveInJail(rel) {
+      const abs = path3.resolve(workspace, rel);
+      const rrel = path3.relative(workspace, abs);
+      if (rrel.startsWith("..") || path3.isAbsolute(rrel)) {
+        throw new Error(`path escapes workspace: ${rel}`);
+      }
+      return abs;
+    },
+    assertReadable(abs) {
+      if (!path3.isAbsolute(abs)) {
+        throw new Error(`fs.scoped* requires an absolute path: ${abs}`);
+      }
+      let real;
+      try {
+        real = fs2.realpathSync(abs);
+      } catch {
+        throw new Error(`path not found: ${abs}`);
+      }
+      for (const root of readAllow) {
+        const rel = path3.relative(root, real);
+        if (rel === "" || !rel.startsWith("..") && !path3.isAbsolute(rel)) {
+          return real;
+        }
+      }
+      throw new Error(`path is not inside any --allow-read root: ${abs}`);
+    }
+  };
+}
+
+// src/bridge.ts
+async function startBridge(opts) {
+  installProcessGuards();
+  const wss = new WebSocketServer({
+    host: "127.0.0.1",
+    port: opts.port,
+    // Origin check — reject anything outside the allow list.
+    verifyClient: (info, cb) => {
+      const origin = info.origin ?? "";
+      if (opts.allowedOrigins.includes(origin)) return cb(true);
+      console.warn(`[aarmos] rejected origin: ${origin}`);
+      cb(false, 403, "origin not allowed");
+    }
+  });
+  wss.on("error", (err) => {
+    console.warn(`[aarmos] server error (continuing): ${err.message}`);
+  });
+  let activeClient = null;
+  wss.on("connection", (ws, req) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    const token = url.searchParams.get("token");
+    if (!token || token !== opts.pairingToken) {
+      ws.close(4401, "invalid pairing token");
+      return;
+    }
+    if (activeClient && activeClient.readyState === WebSocket.OPEN) {
+      ws.close(4409, "another client is already paired");
+      return;
+    }
+    activeClient = ws;
+    const session = createSession({
+      workspace: opts.workspace,
+      extraShellAllow: opts.extraShellAllow,
+      sqlAllow: opts.sqlAllow,
+      readAllow: opts.readAllow
+    });
+    console.log("\u25C6 PWA paired");
+    const send = (msg) => {
+      if (ws.readyState === WebSocket.OPEN) {
+        try {
+          ws.send(JSON.stringify(msg));
+        } catch (err) {
+          console.warn(`[aarmos] send failed (client likely gone): ${err.message}`);
+        }
+      }
+    };
+    const stopFiles = startFileWatcher(
+      session,
+      (evt) => send({ type: "event", channel: "fs", event: evt })
+    );
+    const stopGit = startGitWatcher(
+      session,
+      (evt) => send({ type: "event", channel: "git", event: evt })
+    );
+    ws.on("message", async (raw) => {
+      let msg;
+      try {
+        msg = JSON.parse(String(raw));
+      } catch {
+        return send({ type: "error", error: "invalid json" });
+      }
+      try {
+        const res = await handleRpc(session, msg);
+        send(res);
+      } catch (err) {
+        send({ type: "error", error: err.message });
+      }
+    });
+    ws.on("error", (err) => {
+      console.warn(`[aarmos] socket error: ${err.message}`);
+    });
+    ws.on("close", (code, reason) => {
+      stopFiles();
+      stopGit();
+      if (activeClient === ws) activeClient = null;
+      const why = reason?.toString() || `code ${code}`;
+      console.log(
+        `\u25C7 Client disconnected (${why}). Standing by on ${opts.port} \u2014 rerun pairing from the PWA to reconnect.`
+      );
+    });
+    send({
+      type: "hello",
+      workspace: opts.workspace,
+      capabilities: session.capabilities,
+      dryRun: session.dryRun,
+      protocol: "aarmos-bridge/1"
+    });
+  });
+  await new Promise((resolve) => wss.once("listening", () => resolve()));
+  const address = wss.address();
+  const boundPort = typeof address === "object" && address ? address.port : opts.port;
+  return { port: boundPort, url: `ws://127.0.0.1:${boundPort}` };
+}
+var guardsInstalled = false;
+function installProcessGuards() {
+  if (guardsInstalled) return;
+  guardsInstalled = true;
+  process.on("uncaughtException", (err) => {
+    console.warn(`[aarmos] uncaughtException (kept alive): ${err.message}`);
+  });
+  process.on("unhandledRejection", (reason) => {
+    console.warn(`[aarmos] unhandledRejection (kept alive): ${String(reason)}`);
+  });
+  process.on("SIGINT", () => {
+    console.log("\n\u25C7 Shutting down aarmos bridge. bye.");
+    process.exit(0);
+  });
+}
+
+export {
+  handleRpc,
+  createSession,
+  startBridge
+};