@addai/node 0.30.13 → 0.30.15

package/dist/entitybox-mcp-broker.js

@@ -0,0 +1,420 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntityboxMcpBroker = void 0;
+const child_process_1 = require("child_process");
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+const entitybox_execution_lease_1 = require("./entitybox-execution-lease");
+const entitybox_mcp_contract_1 = require("./entitybox-mcp-contract");
+const MAX_RESPONSE = 32 * 1024 * 1024;
+const PROTOCOL = '2025-03-26';
+const unavailable = () => new entitybox_execution_lease_1.EntityboxExecutionError('The required desktop connection ended');
+/** One required, scoped native MCP connection per isolated task. The model
+ * receives a small MCP facade over the existing broker pipe, not this process,
+ * command line, configuration, entity key, pairing token or lease nonce. */
+class EntityboxMcpBroker {
+    lease;
+    proc;
+    closed;
+    didClose = false;
+    childPid;
+    buffer = Buffer.alloc(0);
+    diagnostics = '';
+    pending = new Map();
+    allowed;
+    secrets;
+    timeout;
+    actions;
+    catalog = [];
+    ready = false;
+    closing = false;
+    stopping;
+    clientPhase = 'new';
+    serial = Promise.resolve();
+    queued = 0;
+    failureCode;
+    constructor(lease, config) {
+        this.lease = lease;
+        lease.assertActive();
+        const descriptor = config?.connection;
+        const scope = (0, entitybox_mcp_contract_1.parseEntityboxMcpScope)(descriptor?.env?.ENTITYBOX_DESKTOP_SCOPE);
+        const actionScope = (0, entitybox_mcp_contract_1.parseEntityboxMcpScope)(config?.actions?.scope);
+        const sameScope = (s) => ['runId', 'desktopId', 'runtimeId'].every(k => s[k] === lease.identity.scope[k]);
+        if (!sameScope(scope) || !sameScope(actionScope)
+            || typeof config.actions.assertActive !== 'function' || typeof config.actions.stopAndVerify !== 'function'
+            || descriptor.command !== process.execPath || !Array.isArray(descriptor.args)
+            || descriptor.args[0] !== path.join(__dirname, 'entitybox-mcp-guard.js') || descriptor.args[1] !== '--'
+            || descriptor.args.length < 3 || descriptor.args.length > 40 || !descriptor.args.every(s => typeof s === 'string' && s.length > 0 && s.length < 16000)
+            || typeof descriptor.env.ENTITY_API_KEY !== 'string' || descriptor.env.ENTITY_API_KEY.length < 8
+            || !Object.entries(descriptor.env).every(([k, v]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(k) && typeof v === 'string' && v.length < 65536)
+            || !Array.isArray(config.allowedTools) || !config.allowedTools.length || config.allowedTools.length > 64
+            || !config.allowedTools.every(name => typeof name === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(name))
+            || new Set(config.allowedTools).size !== config.allowedTools.length
+            || (config.secrets !== undefined && (!Array.isArray(config.secrets) || !config.secrets.every(s => typeof s === 'string' && s.length >= 8 && s.length < 65536))))
+            throw unavailable();
+        this.timeout = config.requestTimeoutMs ?? 120000;
+        if (!Number.isInteger(this.timeout) || this.timeout < 50 || this.timeout > 120000)
+            throw unavailable();
+        this.actions = config.actions;
+        this.allowed = new Set(config.allowedTools);
+        if (descriptor.env.ENTITYBOX_ACTION_TRANSPORT !== undefined && descriptor.env.ENTITYBOX_ACTION_TRANSPORT !== this.actions.transport?.configuration)
+            throw unavailable();
+        this.secrets = [...new Set([descriptor.env.ENTITY_API_KEY, ...(this.actions.transport ? [this.actions.transport.token] : []), ...(config.secrets ?? [])])];
+        // Preserve only native process/Docker discovery essentials from the host.
+        // The selected connection's resolved environment remains host-side.
+        const env = {};
+        for (const key of ['PATH', 'Path', 'SystemRoot', 'WINDIR', 'ComSpec', 'PATHEXT', 'TEMP', 'TMP', 'HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA'])
+            if (process.env[key] !== undefined)
+                env[key] = process.env[key];
+        Object.assign(env, descriptor.env);
+        if (this.actions.transport)
+            env.ENTITYBOX_ACTION_TRANSPORT = this.actions.transport.configuration;
+        this.proc = (0, child_process_1.spawn)(descriptor.command, [...descriptor.args], { env, cwd: __dirname, windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] });
+        this.closed = new Promise(resolve => this.proc.once('close', () => {
+            this.didClose = true;
+            if (!this.closing)
+                this.fail();
+            this.rejectPending();
+            resolve();
+        }));
+        this.proc.on('error', () => this.fail());
+        this.proc.stdin.on('error', () => { if (!this.closing)
+            this.fail(); });
+        this.proc.stdout.on('data', chunk => this.consume(chunk));
+        this.proc.stdout.on('error', () => this.fail());
+        // Guard diagnostics are bounded and private. Raw MCP stderr is suppressed
+        // by the actual guard, including package-manager/credential diagnostics.
+        this.proc.stderr.setEncoding('utf8');
+        this.proc.stderr.on('data', chunk => {
+            this.diagnostics += chunk;
+            if (this.diagnostics.length > 4096) {
+                this.fail();
+                return;
+            }
+            let end;
+            while ((end = this.diagnostics.indexOf('\n')) >= 0) {
+                const line = this.diagnostics.slice(0, end);
+                this.diagnostics = this.diagnostics.slice(end + 1);
+                const match = /^\[entitybox-mcp\] child_pid=(\d+)$/.exec(line);
+                if (match) {
+                    if (this.childPid !== undefined)
+                        this.fail();
+                    else
+                        this.childPid = Number(match[1]);
+                }
+            }
+        });
+        lease.signal.addEventListener('abort', () => { void this.stopAndVerify().catch(() => { }); }, { once: true });
+        if (lease.signal.aborted)
+            this.fail();
+    }
+    static async connect(lease, config) {
+        let broker;
+        try {
+            broker = new EntityboxMcpBroker(lease, config);
+            await broker.active();
+            const initialized = await broker.rpc('initialize', { protocolVersion: PROTOCOL, capabilities: {}, clientInfo: { name: 'entitybox-native-broker', version: '1' } }, 15000);
+            (0, entitybox_mcp_contract_1.assertEntityboxMcpCapability)(initialized, lease.identity.scope);
+            if (config.actions.transport) {
+                const capability = initialized.capabilities?.experimental?.['ai.add.entitybox.actionTransport'];
+                const scoped = (0, entitybox_mcp_contract_1.parseEntityboxMcpScope)(capability?.scope);
+                if (capability.version !== 1 || capability.requestId !== lease.identity.requestId || capability.attemptId !== lease.identity.attemptId
+                    || scoped.runId !== lease.identity.scope.runId || scoped.desktopId !== lease.identity.scope.desktopId || scoped.runtimeId !== lease.identity.scope.runtimeId)
+                    throw unavailable();
+            }
+            if (initialized.protocolVersion !== PROTOCOL)
+                throw unavailable();
+            broker.notify('notifications/initialized');
+            const result = await broker.rpc('tools/list', {}, 15000);
+            if (!Array.isArray(result.tools) || result.tools.length > 256 || result.nextCursor !== undefined)
+                throw unavailable();
+            const names = new Set();
+            for (const tool of result.tools) {
+                if (!tool || typeof tool.name !== 'string' || names.has(tool.name))
+                    throw unavailable();
+                names.add(tool.name);
+                if (broker.allowed.has(tool.name)) {
+                    if (!tool.inputSchema || tool.inputSchema.type !== 'object')
+                        throw unavailable();
+                    broker.catalog.push(tool);
+                }
+            }
+            if (broker.catalog.length !== broker.allowed.size)
+                throw unavailable();
+            await broker.active();
+            broker.ready = true;
+            return broker;
+        }
+        catch {
+            lease.fence();
+            if (broker)
+                await broker.stopAndVerify().catch(() => { });
+            throw unavailable();
+        }
+    }
+    /** Public process identity for the owning runtime's resource ledger. */
+    get processId() { return this.proc.pid; }
+    async active() {
+        this.lease.assertActive();
+        if (this.closing || this.didClose)
+            throw unavailable();
+        await this.actions.assertActive();
+        this.lease.assertActive();
+        if (this.closing || this.didClose)
+            throw unavailable();
+    }
+    rejectPending() {
+        for (const request of this.pending.values()) {
+            clearTimeout(request.timer);
+            request.reject(unavailable());
+        }
+        this.pending.clear();
+    }
+    fail() {
+        if (!this.closing)
+            this.failureCode = 'entitybox_mcp_connection_failed';
+        this.rejectPending();
+        this.lease.fence();
+    }
+    consume(chunk) {
+        if (this.closing)
+            return;
+        try {
+            this.buffer = Buffer.concat([this.buffer, chunk]);
+            let end;
+            while ((end = this.buffer.indexOf(10)) >= 0) {
+                if (end > MAX_RESPONSE)
+                    throw unavailable();
+                const response = JSON.parse(this.buffer.subarray(0, end).toString('utf8'));
+                this.buffer = this.buffer.subarray(end + 1);
+                if (!response || response.jsonrpc !== '2.0' || Array.isArray(response))
+                    throw unavailable();
+                // This facade advertises no server-initiated requests/subscriptions.
+                // Bounded progress/list-change notifications carry no authority.
+                if (response.id === undefined && ['notifications/progress', 'notifications/tools/list_changed', 'notifications/message'].includes(response.method))
+                    continue;
+                if (typeof response.id !== 'string' || response.method !== undefined)
+                    throw unavailable();
+                const request = this.pending.get(response.id);
+                if (!request)
+                    throw unavailable();
+                this.pending.delete(response.id);
+                clearTimeout(request.timer);
+                if (response.error || !response.result || typeof response.result !== 'object') {
+                    request.reject(unavailable());
+                    this.fail();
+                    return;
+                }
+                request.resolve(response.result);
+            }
+            if (this.buffer.length > MAX_RESPONSE)
+                throw unavailable();
+        }
+        catch {
+            this.fail();
+        }
+    }
+    rpc(method, params, timeout = this.timeout) {
+        this.lease.assertActive();
+        if (this.closing || this.didClose || this.pending.size >= 8)
+            return Promise.reject(unavailable());
+        const id = (0, crypto_1.randomUUID)();
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => this.fail(), timeout);
+            this.pending.set(id, { resolve, reject, timer });
+            this.proc.stdin.write(JSON.stringify({ jsonrpc: '2.0', id, method, params }) + '\n', error => { if (error)
+                this.fail(); });
+        });
+    }
+    notify(method) {
+        this.lease.assertActive();
+        this.proc.stdin.write(JSON.stringify({ jsonrpc: '2.0', method }) + '\n', error => { if (error)
+            this.fail(); });
+    }
+    async handle(raw, signal, emit) {
+        const cancellation = raw;
+        if (cancellation?.kind === 'desktop_mcp' && cancellation.message?.jsonrpc === '2.0'
+            && cancellation.message.method === 'notifications/cancelled' && cancellation.message.id === undefined) {
+            // This control message must never wait behind the action it cancels.
+            this.fail();
+            throw unavailable();
+        }
+        // Serialize desktop requests; a queued action must recheck authority after
+        // the previous action settles. Model request IDs never become native IDs.
+        if (++this.queued > 8) {
+            this.queued--;
+            this.fail();
+            throw unavailable();
+        }
+        const abort = () => this.fail();
+        signal.addEventListener('abort', abort, { once: true });
+        if (signal.aborted)
+            abort();
+        const operation = this.serial.then(async () => {
+            try {
+                await this.active();
+                const r = raw, m = r?.message;
+                if (!this.ready || !r || r.kind !== 'desktop_mcp' || Object.keys(r).sort().join(',') !== 'kind,message'
+                    || !m || m.jsonrpc !== '2.0' || typeof m.method !== 'string' || Array.isArray(m)
+                    || Object.keys(m).some(k => !['jsonrpc', 'id', 'method', 'params'].includes(k))
+                    || Buffer.byteLength(JSON.stringify(m)) > 512 * 1024
+                    || (m.id !== undefined && !(typeof m.id === 'string' && m.id.length <= 128) && !(typeof m.id === 'number' && Number.isSafeInteger(m.id))))
+                    throw unavailable();
+                let result;
+                if (m.method === 'initialize' && this.clientPhase === 'new' && m.id !== undefined && typeof m.params?.protocolVersion === 'string') {
+                    this.clientPhase = 'initialized';
+                    result = { protocolVersion: PROTOCOL, serverInfo: { name: 'entitybox-native-desktop', version: '1' }, capabilities: { tools: {}, experimental: { 'ai.add.entitybox.desktopScope': this.lease.identity.scope } } };
+                }
+                else if (m.method === 'notifications/initialized' && m.id === undefined && this.clientPhase === 'initialized') {
+                    this.clientPhase = 'ready';
+                    result = null;
+                }
+                else if (m.method === 'notifications/cancelled' && m.id === undefined) {
+                    // Canceling an external desktop action needs task-wide stop proof.
+                    this.fail();
+                    throw unavailable();
+                }
+                else if (this.clientPhase !== 'ready' || m.id === undefined)
+                    throw unavailable();
+                else if (m.method === 'ping')
+                    result = {};
+                else if (m.method === 'tools/list' && (!m.params || Object.keys(m.params).length === 0))
+                    result = { tools: this.catalog };
+                else if (m.method === 'tools/call' && m.params && typeof m.params.name === 'string' && this.allowed.has(m.params.name)
+                    && Object.keys(m.params).every(k => ['name', 'arguments', '_meta'].includes(k))
+                    && (m.params.arguments === undefined || (m.params.arguments && typeof m.params.arguments === 'object' && !Array.isArray(m.params.arguments)))) {
+                    result = await this.rpc('tools/call', { name: m.params.name, arguments: m.params.arguments ?? {} });
+                }
+                else
+                    throw unavailable();
+                await this.active();
+                if (signal.aborted)
+                    throw unavailable();
+                let text = JSON.stringify(result === null ? null : { jsonrpc: '2.0', id: m.id, result });
+                // Scrub JSON-escaped representations too, retaining valid JSON even if
+                // a trusted connection secret contains a quote or newline.
+                for (const secret of this.secrets)
+                    text = text.split(JSON.stringify(secret).slice(1, -1)).join('[redacted]');
+                const bytes = Buffer.from(text);
+                if (bytes.length > MAX_RESPONSE)
+                    throw unavailable();
+                await emit({ type: 'head', status: 200, contentType: 'application/json' });
+                for (let offset = 0; offset < bytes.length; offset += 16384) {
+                    this.lease.assertActive();
+                    if (signal.aborted)
+                        throw unavailable();
+                    await emit({ type: 'data', data: bytes.subarray(offset, offset + 16384).toString('base64') });
+                }
+                this.lease.assertActive();
+                await emit({ type: 'end' });
+            }
+            catch {
+                this.fail();
+                throw unavailable();
+            }
+        });
+        this.serial = operation.catch(() => { });
+        try {
+            await operation;
+        }
+        finally {
+            this.queued--;
+            signal.removeEventListener('abort', abort);
+        }
+    }
+    /** Aggregate this with the isolated model owner's stop proof before calling
+     * lease.acknowledgeStopped. Never acknowledge on MCP/container exit alone. */
+    async stopAndVerify() {
+        if (!this.stopping) {
+            this.closing = true;
+            this.stopping = Promise.resolve().then(async () => {
+                this.lease.fence();
+                this.rejectPending();
+                const results = await Promise.allSettled([this.closeOwnedConnection(), this.actions.stopAndVerify()]);
+                if (results.some(r => r.status === 'rejected'))
+                    throw new entitybox_execution_lease_1.EntityboxExecutionError('Desktop actions have not been confirmed stopped');
+            });
+        }
+        const stopped = this.stopping;
+        try {
+            await stopped;
+        }
+        catch (error) {
+            if (this.stopping === stopped)
+                this.stopping = undefined;
+            throw error;
+        }
+    }
+    async closeOwnedConnection() {
+        if (!this.didClose) {
+            this.proc.stdin.end();
+            let timer;
+            const wait = (ms) => Promise.race([this.closed.then(() => true), new Promise(r => { timer = setTimeout(() => r(false), ms); })]);
+            try {
+                if (!await wait(8000)) {
+                    if (this.proc.exitCode === null && this.proc.signalCode === null) {
+                        if (process.platform === 'win32' && this.proc.pid)
+                            await new Promise(resolve => (0, child_process_1.execFile)('taskkill', ['/PID', String(this.proc.pid), '/T', '/F'], { windowsHide: true, timeout: 5000 }, () => resolve()));
+                        else
+                            this.proc.kill('SIGTERM'); // guard owns and stops its MCP child
+                    }
+                    clearTimeout(timer);
+                    if (!await wait(8000))
+                        throw unavailable();
+                }
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        if (!this.didClose)
+            throw unavailable();
+        if (this.childPid) {
+            try {
+                process.kill(this.childPid, 0);
+            }
+            catch (error) {
+                if (error.code === 'ESRCH')
+                    return;
+                throw unavailable();
+            }
+            // Never kill a reaped child's PID: it may have been reused. An ambiguous
+            // still-present identity refuses proof and retains the desktop slot.
+            throw unavailable();
+        }
+    }
+}
+exports.EntityboxMcpBroker = EntityboxMcpBroker;

package/dist/entitybox-mcp-contract.d.ts

@@ -0,0 +1,10 @@
+/** Public compatibility metadata, not a credential or execution lease. */
+export declare const ENTITYBOX_MCP_SCOPE_CAPABILITY = "ai.add.entitybox.desktopScope";
+export interface EntityboxMcpScope {
+    version: 1;
+    runId: string;
+    desktopId: string;
+    runtimeId: string;
+}
+export declare function parseEntityboxMcpScope(raw: unknown): EntityboxMcpScope;
+export declare function assertEntityboxMcpCapability(result: unknown, expected: EntityboxMcpScope): void;

package/dist/entitybox-mcp-contract.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENTITYBOX_MCP_SCOPE_CAPABILITY = void 0;
+exports.parseEntityboxMcpScope = parseEntityboxMcpScope;
+exports.assertEntityboxMcpCapability = assertEntityboxMcpCapability;
+/** Public compatibility metadata, not a credential or execution lease. */
+exports.ENTITYBOX_MCP_SCOPE_CAPABILITY = 'ai.add.entitybox.desktopScope';
+function parseEntityboxMcpScope(raw) {
+    const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    const value = typeof raw === 'string' && raw.length <= 512 ? JSON.parse(raw) : raw;
+    if (!value || typeof value !== 'object' || Array.isArray(value) || value.version !== 1
+        || Object.keys(value).sort().join(',') !== 'desktopId,runId,runtimeId,version'
+        || !['runId', 'desktopId', 'runtimeId'].every(key => typeof value[key] === 'string' && uuid.test(value[key]))) {
+        throw new Error('Invalid EntityBox desktop scope');
+    }
+    return Object.freeze({ version: 1, runId: value.runId.toLowerCase(), desktopId: value.desktopId.toLowerCase(), runtimeId: value.runtimeId.toLowerCase() });
+}
+function assertEntityboxMcpCapability(result, expected) {
+    const capabilities = result?.capabilities;
+    const actual = parseEntityboxMcpScope(capabilities?.experimental?.[exports.ENTITYBOX_MCP_SCOPE_CAPABILITY]);
+    if (actual.runId !== expected.runId || actual.desktopId !== expected.desktopId || actual.runtimeId !== expected.runtimeId) {
+        throw new Error('The desktop connection did not acknowledge this task scope');
+    }
+}

package/dist/entitybox-mcp-guard.d.ts

@@ -0,0 +1,3 @@
+export declare function runEntityboxMcpGuard(options?: {
+    startupTimeoutMs?: number;
+}): void;

package/dist/entitybox-mcp-guard.js

@@ -0,0 +1,167 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runEntityboxMcpGuard = runEntityboxMcpGuard;
+// Wrap only EntityBox's desktop MCP. Validate the initialize response from the
+// SAME child that receives subsequent messages, before exposing it to an agent.
+const child_process_1 = require("child_process");
+const entitybox_mcp_contract_1 = require("./entitybox-mcp-contract");
+const MAX_MESSAGE_BYTES = 32 * 1024 * 1024;
+const ERROR_MESSAGE = 'The native desktop connection cannot verify this computer task. Update the runtime and desktop connection, then start a new task.';
+function runEntityboxMcpGuard(options = {}) {
+    let phase = 'new';
+    let child, requestId;
+    let timer, exitCode = 0;
+    let expected;
+    const [separator, command, ...args] = process.argv.slice(2);
+    try {
+        if (separator !== '--' || !command)
+            throw new Error();
+        expected = (0, entitybox_mcp_contract_1.parseEntityboxMcpScope)(process.env.ENTITYBOX_DESKTOP_SCOPE);
+    }
+    catch {
+        process.stderr.write('[entitybox-mcp] invalid_configuration\n');
+        process.exitCode = 1;
+        return;
+    }
+    const finish = () => {
+        if (timer)
+            clearTimeout(timer);
+        process.stdin.destroy();
+        process.exitCode = exitCode;
+        process.stdout.end();
+    };
+    const stop = (code, reason) => {
+        if (phase === 'closing')
+            return;
+        phase = 'closing';
+        exitCode = code;
+        if (timer)
+            clearTimeout(timer);
+        if (reason)
+            process.stderr.write('[entitybox-mcp] ' + reason + '\n');
+        if (reason && requestId !== undefined && !process.stdout.destroyed) {
+            process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: requestId, error: { code: -32001, message: ERROR_MESSAGE } }) + '\n');
+        }
+        if (!child || child.exitCode !== null || child.signalCode !== null) {
+            finish();
+            return;
+        }
+        // Only this directly owned child/tree is eligible for termination. This
+        // does not cancel work already started inside a desktop container.
+        child.stdin.destroy();
+        if (process.platform === 'win32' && child.pid) {
+            (0, child_process_1.execFile)('taskkill', ['/PID', String(child.pid), '/T', '/F'], { windowsHide: true, timeout: 5000 }, () => {
+                if (child && child.exitCode === null && child.signalCode === null)
+                    child.kill('SIGKILL');
+            });
+        }
+        else if (child.pid) {
+            try {
+                process.kill(-child.pid, 'SIGKILL');
+            }
+            catch {
+                child.kill('SIGKILL');
+            }
+        }
+    };
+    const send = (source, target, line) => {
+        if (!target.write(line + '\n')) {
+            source.pause();
+            target.once('drain', () => source.resume());
+        }
+    };
+    const readLines = (source, accept) => {
+        let buffer = Buffer.alloc(0);
+        source.on('data', (chunk) => {
+            if (phase === 'closing')
+                return;
+            buffer = Buffer.concat([buffer, chunk]);
+            let newline;
+            while ((newline = buffer.indexOf(10)) !== -1) {
+                if (newline > MAX_MESSAGE_BYTES) {
+                    stop(1, 'message_too_large');
+                    return;
+                }
+                const line = buffer.subarray(0, newline).toString('utf8').replace(/\r$/, '');
+                buffer = buffer.subarray(newline + 1);
+                try {
+                    const message = JSON.parse(line);
+                    if (!message || Array.isArray(message) || message.jsonrpc !== '2.0')
+                        throw new Error();
+                    accept(message, line);
+                }
+                catch {
+                    stop(1, 'invalid_protocol');
+                }
+                if (phase === 'closing')
+                    return;
+            }
+            if (buffer.length > MAX_MESSAGE_BYTES)
+                stop(1, 'message_too_large');
+        });
+        source.on('error', () => stop(1, 'transport_error'));
+    };
+    readLines(process.stdin, (message, line) => {
+        if (phase === 'ready') {
+            if (message.method === 'initialize') {
+                stop(1, 'duplicate_initialize');
+                return;
+            }
+            send(process.stdin, child.stdin, line);
+            return;
+        }
+        if (phase !== 'new' || message.method !== 'initialize' || !['string', 'number'].includes(typeof message.id)) {
+            stop(1, 'initialize_required');
+            return;
+        }
+        requestId = message.id;
+        phase = 'starting';
+        try {
+            child = (0, child_process_1.spawn)(command, args, { env: process.env, cwd: process.cwd(), windowsHide: true, detached: process.platform !== 'win32', stdio: ['pipe', 'pipe', 'pipe'] });
+        }
+        catch {
+            stop(1, 'connection_start_failed');
+            return;
+        }
+        child.once('spawn', () => process.stderr.write('[entitybox-mcp] child_pid=' + child.pid + '\n'));
+        child.on('error', () => stop(1, 'connection_start_failed'));
+        child.stdin.on('error', () => stop(1, 'transport_error'));
+        // Never echo raw startup/stderr diagnostics: package scripts may include
+        // credentials or complete command arguments in them.
+        child.stderr.resume();
+        readLines(child.stdout, (response, responseLine) => {
+            if (phase === 'starting') {
+                if (response.id !== requestId || response.method !== undefined || response.error || !response.result) {
+                    stop(1, 'scope_not_acknowledged');
+                    return;
+                }
+                try {
+                    (0, entitybox_mcp_contract_1.assertEntityboxMcpCapability)(response.result, expected);
+                }
+                catch {
+                    stop(1, 'scope_not_acknowledged');
+                    return;
+                }
+                phase = 'ready';
+                if (timer)
+                    clearTimeout(timer);
+                requestId = undefined;
+            }
+            if (phase === 'ready')
+                send(child.stdout, process.stdout, responseLine);
+        });
+        child.once('close', code => {
+            if (phase !== 'closing')
+                stop(code === 0 ? 0 : 1, phase === 'ready' ? undefined : 'connection_ended_before_initialize');
+            finish();
+        });
+        timer = setTimeout(() => stop(1, 'initialize_timeout'), options.startupTimeoutMs ?? 15000);
+        send(process.stdin, child.stdin, line);
+    });
+    process.stdin.on('end', () => stop(0));
+    process.stdout.on('error', () => stop(1));
+    process.on('SIGINT', () => stop(0));
+    process.on('SIGTERM', () => stop(0));
+}
+if (require.main === module)
+    runEntityboxMcpGuard();

package/dist/entitybox-model-artifact.d.ts

@@ -0,0 +1,9 @@
+/** Explicit compiled adapter dependencies. Never enumerate host configuration,
+ * login state, provider directories or the rest of the runtime distribution. */
+export declare const ENTITYBOX_MODEL_FILES: readonly ["paths.js", "claude-binary.js", "win.js", "claude-system-prompt.js", "prompt-transport.js", "claude-print.js", "entitybox/model-mcp-proxy.js", "entitybox/model-entry.js"];
+export interface EntityboxModelArtifact {
+    files: Readonly<Record<string, string>>;
+    sha256: string;
+}
+export declare function readEntityboxModelArtifact(compiledRoot?: string): EntityboxModelArtifact;
+export declare const ENTITYBOX_MODEL_LOADER: string;