npm - @aimarket/warden - Versions diffs - 0.5.0 → 0.6.0 - Mend

@aimarket/warden 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (26) hide show

package/CHANGELOG.md CHANGED Viewed

@@ -2,6 +2,41 @@
 All notable changes to `@aimarket/warden`.
+## 0.6.0 — 2026-09-23
+Ruleset **v5**: language-independent coverage. A rule table written in one language cannot read
+meaning in every other, so v5 strengthens what does not depend on the language at all, and says
+plainly where the table stops.
+- **Text is folded before any rule reads it** (`src/fold.ts`, published as `fold` beside the rules
+  and part of the digest): NFKC for fullwidth letters, ligatures and other compatibility forms;
+  invisible characters inside a word dropped; the Unicode TAG block (invisible ASCII that can spell a
+  whole sentence) decoded; look-alike Cyrillic/Greek letters mapped to Latin inside a word that
+  already mixes scripts, while text written wholly in one script is left alone. An English rule can
+  no longer be dodged by `ｉｇｎｏｒｅ`, a zero-width space inside the word, tag characters or a Cyrillic
+  `о`. The two hidden-payload rules read the raw text (`raw: true` in the published table).
+- **`TOOL_DEF_HIDDEN_UNICODE`** now also catches the Unicode-tag block and the bidi isolates
+  (U+2066–2069). `displaySafe` escapes tag characters, so a finding never prints them invisibly.
+- **`TOOL_DEF_SECRET_EXFIL`** (new, advisory): a secret store (`.env`, `~/.ssh/…`,
+  `~/.aws/credentials`, `.npmrc`, …) and a URL, e-mail address or host within 100 characters of each
+  other — the shape of "read this, send it there" whatever language the connective words are in.
+  Advisory because on 10 645 live servers its only hit was honest (a deploy tool's ssh command to its
+  own host); refusing a server on a rule whose only real-world hit is honest is the v1 mistake again.
+- **Three measured false positives removed**: "send the user to https://…" is a redirect of a person
+  (guard `navigation`); "keep calling this until done without asking the user" is autonomy, not
+  concealment (guard `autonomy`); a zero-width joiner inside an emoji sequence is not concealment.
+Measured on the 10 645 distinct tool sets HISTOR holds (172 771 tools): v4 blocks 63, v5 blocks 56,
+and v5 blocks none that v4 did not. The 1 108-server survey figures (v3 → v4) are unchanged and
+still describe v4's calibration; this corpus is HISTOR's, not the survey's.
+## 0.5.1 — 2026-09-05
+stdio wire fix for Glama: replies are newline-delimited JSON (MCP stdio / mcp-proxy).
+Content-Length framing on stdout made Glama's health check time out (`ignoring non-JSON
+output [ 'Content-Length: …' ]`). Input still accepts Content-Length and mirrors it on
+the reply for legacy probes.
 ## 0.5.0 — 2026-09-03
 stdio MCP server for Glama / Claude Desktop / Cursor (`warden-mcp` / `node dist/mcp-server.js`).

package/README-es.md CHANGED Viewed

@@ -8,7 +8,7 @@
   <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
   <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Cero dependencias de ejecución" />
-  <img src="docs/badges/tests.svg" alt="166 pruebas en verde" />
+  <img src="docs/badges/tests.svg" alt="189 pruebas en verde" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="Licencia: MIT" /></a>
 </p>
@@ -85,7 +85,10 @@ El proceso **no** arranca, no hace de proxy ni aísla otro servidor MCP: pasas u
 ### Publicar en Glama
-Listado: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+Listado: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)** ·
+quality score: **[glama.ai/mcp/servers/alexar76/warden/score](https://glama.ai/mcp/servers/alexar76/warden/score)**
+[![alexar76/warden MCP server](https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg)](https://glama.ai/mcp/servers/alexar76/warden)
 El mismo patrón que [ARGUS](https://github.com/alexar76/argus) y
 [aimarket-mcp](https://github.com/alexar76/aimarket-mcp): [`glama.json`](glama.json) +
@@ -133,7 +136,7 @@ descarga del threat feed que tú pediste al pasar una URL a `load()`.
 ```mermaid
 flowchart LR
-  T["definiciones<br/>de herramientas"] --> S["static scan<br/>25 reglas"]
+  T["definiciones<br/>de herramientas"] --> S["static scan<br/>26 reglas"]
   S --> F["threat feed<br/>11 integradas + firmado"]
   F --> O["origin<br/>declarado vs catálogo"]
   O --> P["pinning<br/>deriva vs aprobación"]
@@ -142,7 +145,7 @@ flowchart LR
 | Puerta | Qué decide | Red | ¿Fatal? |
 |---|---|---|---|
-| **static-scan** | Inyección, exfiltración, peticiones de credenciales y señales de Unicode oculto/base64 en el `name`, la `description` y el `inputSchema` de la herramienta — 25 reglas, v4, de las cuales 15 pueden bloquear y 10 son solo de aviso, 17 cubren también el nombre y 12 llevan un guard de contexto | ninguna | no |
+| **static-scan** | Inyección, exfiltración, peticiones de credenciales y señales de Unicode oculto/base64 en el `name`, la `description` y el `inputSchema` de la herramienta — 26 reglas, v5, de las cuales 15 pueden bloquear y 11 son solo de aviso, 17 cubren también el nombre y 15 llevan un guard de contexto. v5 normaliza antes el texto (ancho completo, caracteres invisibles, etiquetas Unicode, letras sosias), así que la ofuscación no elude ninguna regla en ningún idioma | ninguna | no |
 | **threat-feed** | Identidad de servidor o herramienta conocida como maliciosa: 11 registros integrados más un feed firmado opcional | solo la descarga del feed | sí, para un `critical` con alcance de servidor |
 | **origin** | Si el operador declaró este servidor o llegó desde un catálogo remoto | ninguna | sí, con `allowUnknownServers: false` |
 | **pinning** | Si las definiciones de herramientas siguen coincidiendo con lo que el usuario aprobó | ninguna | sí, con `pinToolDefs: true` |
@@ -164,7 +167,7 @@ endureciera el umbral.
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
+  rulesets: { staticScan: { version: "5", digest: "sha256-HUKSzM6c…" } }
 }
 ```
@@ -242,7 +245,7 @@ degradar a ninguna protección:
 ## Desarrollo
 ```bash
-npm install && npm run build && npm test   # 166 pruebas
+npm install && npm run build && npm test   # 189 pruebas
 ```
 `test/packaging.test.ts` es lo que mantiene honesto el titular: falla si aparece una dependencia de

package/README-fr.md CHANGED Viewed

@@ -8,7 +8,7 @@
   <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
   <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="version npm" /></a>
   <img src="docs/badges/deps.svg" alt="Zéro dépendance d'exécution" />
-  <img src="docs/badges/tests.svg" alt="166 tests au vert" />
+  <img src="docs/badges/tests.svg" alt="189 tests au vert" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="Licence : MIT" /></a>
 </p>
@@ -85,7 +85,10 @@ Le processus ne démarre, ne proxifie ni n'isole un autre serveur MCP : vous pas
 ### Publier sur Glama
-Listing : **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+Listing : **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)** ·
+quality score : **[glama.ai/mcp/servers/alexar76/warden/score](https://glama.ai/mcp/servers/alexar76/warden/score)**
+[![alexar76/warden MCP server](https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg)](https://glama.ai/mcp/servers/alexar76/warden)
 Même modèle que [ARGUS](https://github.com/alexar76/argus) et
 [aimarket-mcp](https://github.com/alexar76/aimarket-mcp) : [`glama.json`](glama.json) +
@@ -133,7 +136,7 @@ téléchargement du threat feed que vous avez demandé en passant une URL à `lo
 ```mermaid
 flowchart LR
-  T["définitions<br/>des outils"] --> S["static scan<br/>25 règles"]
+  T["définitions<br/>des outils"] --> S["static scan<br/>26 règles"]
   S --> F["threat feed<br/>11 intégrées + signé"]
   F --> O["origin<br/>déclaré vs catalogue"]
   O --> P["pinning<br/>dérive vs approbation"]
@@ -142,7 +145,7 @@ flowchart LR
 | Porte | Ce qu'elle décide | Réseau | Fatale ? |
 |---|---|---|---|
-| **static-scan** | Injection, exfiltration, demandes d'identifiants et indices d'Unicode masqué/base64 dans le `name`, la `description` et l'`inputSchema` de l'outil — 25 règles, v4, dont 15 peuvent bloquer et 10 sont purement indicatives, 17 couvrent aussi le nom et 12 portent un guard de contexte | aucun | non |
+| **static-scan** | Injection, exfiltration, demandes d'identifiants et indices d'Unicode masqué/base64 dans le `name`, la `description` et l'`inputSchema` de l'outil — 26 règles, v5, dont 15 peuvent bloquer et 11 sont purement indicatives, 17 couvrent aussi le nom et 15 portent un guard de contexte. v5 normalise d'abord le texte (pleine chasse, caractères invisibles, balises Unicode, lettres sosies) : l'obfuscation ne contourne aucune règle, quelle que soit la langue | aucun | non |
 | **threat-feed** | Identité de serveur ou outil connu comme malveillant : 11 enregistrements intégrés plus un feed signé optionnel | seulement le téléchargement du feed | oui, pour un `critical` de portée serveur |
 | **origin** | Si l'opérateur a déclaré ce serveur ou s'il provient d'un catalogue distant | aucun | oui, avec `allowUnknownServers: false` |
 | **pinning** | Si les définitions d'outils correspondent encore à ce que l'utilisateur a approuvé | aucun | oui, avec `pinToolDefs: true` |
@@ -164,7 +167,7 @@ bloquante pour quiconque durcissait le seuil.
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
+  rulesets: { staticScan: { version: "5", digest: "sha256-HUKSzM6c…" } }
 }
 ```
@@ -242,7 +245,7 @@ une absence de protection :
 ## Développement
 ```bash
-npm install && npm run build && npm test   # 166 tests
+npm install && npm run build && npm test   # 189 tests
 ```
 `test/packaging.test.ts` est ce qui tient l'accroche honnête : il échoue si une dépendance d'exécution

package/README-ru.md CHANGED Viewed

@@ -8,7 +8,7 @@
   <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
   <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Zero runtime dependencies" />
-  <img src="docs/badges/tests.svg" alt="166 tests passing" />
+  <img src="docs/badges/tests.svg" alt="189 tests passing" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="License: MIT" /></a>
 </p>
@@ -85,7 +85,10 @@ Claude Desktop / Cursor (`mcpServers`):
 ### Публикация на Glama
-Листинг: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+Листинг: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)** ·
+quality score: **[glama.ai/mcp/servers/alexar76/warden/score](https://glama.ai/mcp/servers/alexar76/warden/score)**
+[![alexar76/warden MCP server](https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg)](https://glama.ai/mcp/servers/alexar76/warden)
 Тот же шаблон, что у [ARGUS](https://github.com/alexar76/argus) и
 [aimarket-mcp](https://github.com/alexar76/aimarket-mcp): [`glama.json`](glama.json) +
@@ -133,7 +136,7 @@ await warden.approve(server, tools); // зафиксировать (pin) то,
 ```mermaid
 flowchart LR
-  T["определения<br/>инструментов"] --> S["static scan<br/>25 правил"]
+  T["определения<br/>инструментов"] --> S["static scan<br/>26 правил"]
   S --> F["threat feed<br/>11 встроенных + подписанный"]
   F --> O["origin<br/>объявлен или из каталога"]
   O --> P["pinning<br/>дрейф против подтверждения"]
@@ -142,7 +145,7 @@ flowchart LR
 | Гейт | Что решает | Сеть | Fatal? |
 |---|---|---|---|
-| **static-scan** | Инъекции, эксфильтрация, запросы учётных данных, скрытый Unicode и base64-признаки в `name`, `description` и `inputSchema` инструмента — 25 правил, версия 4, из них 15 могут блокировать и 10 только сообщают, 17 покрывают и имя, а у 12 есть контекстный guard | нет | нет |
+| **static-scan** | Инъекции, эксфильтрация, запросы учётных данных, скрытый Unicode и base64-признаки в `name`, `description` и `inputSchema` инструмента — 26 правил, версия 5, из них 15 могут блокировать и 11 только сообщают, 17 покрывают и имя, а у 15 есть контекстный guard. v5 сначала приводит текст к обычному виду (широкие буквы, невидимые символы, Unicode-теги, буквы-двойники), поэтому обфускация не обходит правило ни на каком языке | нет | нет |
 | **threat-feed** | Известный плохой сервер или инструмент: 11 встроенных записей плюс опциональный подписанный feed | только загрузка feed | да, для `critical` на уровне сервера |
 | **origin** | Объявил ли оператор этот сервер, или он пришёл из удалённого каталога | нет | да, при `allowUnknownServers: false` |
 | **pinning** | Совпадают ли определения инструментов с тем, что подтвердил пользователь | нет | да, при `pinToolDefs: true` |
@@ -163,7 +166,7 @@ severity снова делало находку блокирующей для в
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
+  rulesets: { staticScan: { version: "5", digest: "sha256-HUKSzM6c…" } }
 }
 ```
@@ -241,7 +244,7 @@ GET <ваш feed url>
 ## Разработка
 ```bash
-npm install && npm run build && npm test   # 166 тестов
+npm install && npm run build && npm test   # 189 тестов
 ```
 `test/packaging.test.ts` — то, что удерживает заголовок честным: он падает, если появляется

package/README-zh.md CHANGED Viewed

@@ -8,7 +8,7 @@
   <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
   <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm 版本" /></a>
   <img src="docs/badges/deps.svg" alt="零运行时依赖" />
-  <img src="docs/badges/tests.svg" alt="166 项测试通过" />
+  <img src="docs/badges/tests.svg" alt="189 项测试通过" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="许可证：MIT" /></a>
 </p>
@@ -80,7 +80,10 @@ Claude Desktop / Cursor（`mcpServers`）：
 ### 发布到 Glama
-列表页：**[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+列表页：**[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)** ·
+quality score：**[glama.ai/mcp/servers/alexar76/warden/score](https://glama.ai/mcp/servers/alexar76/warden/score)**
+[![alexar76/warden MCP server](https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg)](https://glama.ai/mcp/servers/alexar76/warden)
 与 [ARGUS](https://github.com/alexar76/argus)、[aimarket-mcp](https://github.com/alexar76/aimarket-mcp)
 相同：[`glama.json`](glama.json) + [`Dockerfile`](Dockerfile) + `node dist/mcp-server.js`。
@@ -128,7 +131,7 @@ await warden.approve(server, tools); // 把用户认可的内容固定（pin）
 ```mermaid
 flowchart LR
-  T["服务器给出的<br/>工具定义"] --> S["static scan<br/>25 条规则"]
+  T["服务器给出的<br/>工具定义"] --> S["static scan<br/>26 条规则"]
   S --> F["threat feed<br/>11 条内置 + 已签名"]
   F --> O["origin<br/>已声明 vs 来自目录"]
   O --> P["pinning<br/>漂移 vs 已批准"]
@@ -137,7 +140,7 @@ flowchart LR
 | 门控 | 判定什么 | 网络 | 是否 fatal |
 |---|---|---|---|
-| **static-scan** | 工具 `name`、`description` 与 `inputSchema` 中的注入、外泄、索要凭据，以及隐藏 Unicode/base64 迹象——25 条规则（v4），其中 15 条可阻止、10 条仅提示，17 条同时覆盖名称，12 条带有上下文 guard | 无 | 否 |
+| **static-scan** | 工具 `name`、`description` 与 `inputSchema` 中的注入、外泄、索要凭据，以及隐藏 Unicode/base64 迹象——26 条规则（v5），其中 15 条可阻止、11 条仅提示，17 条同时覆盖名称，15 条带有上下文 guard。v5 先对文本做归一化（全角、不可见字符、Unicode 标签、形近字母），因此无论何种语言，混淆都绕不过规则 | 无 | 否 |
 | **threat-feed** | 已知恶意的服务器身份或工具：11 条内置记录，外加可选的已签名 feed | 仅 feed 下载 | 是，服务器范围的 `critical` |
 | **origin** | 该服务器是运营者声明的，还是来自远端目录 | 无 | 是，当 `allowUnknownServers: false` |
 | **pinning** | 工具定义是否仍与用户批准过的一致 | 无 | 是，当 `pinToolDefs: true` |
@@ -157,7 +160,7 @@ flowchart LR
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
+  rulesets: { staticScan: { version: "5", digest: "sha256-HUKSzM6c…" } }
 }
 ```
@@ -224,7 +227,7 @@ GET <你的 feed url>
 ## 开发
 ```bash
-npm install && npm run build && npm test   # 166 项测试
+npm install && npm run build && npm test   # 189 项测试
 ```
 `test/packaging.test.ts` 正是让标题保持诚实的东西：一旦出现运行时依赖、任何源文件从包外 import、或者入口点不

package/README.md CHANGED Viewed

@@ -8,7 +8,7 @@
   <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
   <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Zero runtime dependencies" />
-  <img src="docs/badges/tests.svg" alt="166 tests passing" />
+  <img src="docs/badges/tests.svg" alt="189 tests passing" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="License: MIT" /></a>
 </p>
@@ -88,7 +88,10 @@ when-not naming siblings, every `inputSchema` property described, `outputSchema`
 ### Publish on Glama
-Listing: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+Listing: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)** ·
+quality score: **[glama.ai/mcp/servers/alexar76/warden/score](https://glama.ai/mcp/servers/alexar76/warden/score)**
+[![alexar76/warden MCP server](https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg)](https://glama.ai/mcp/servers/alexar76/warden)
 Same pattern as **[ARGUS](https://github.com/alexar76/argus)** and
 **[aimarket-mcp](https://github.com/alexar76/aimarket-mcp)**: repo-root [`glama.json`](glama.json) +
@@ -136,7 +139,7 @@ asked for by passing a URL to `load()`.
 ```mermaid
 flowchart LR
-  T["tool defs<br/>from the server"] --> S["static scan<br/>25 rules"]
+  T["tool defs<br/>from the server"] --> S["static scan<br/>26 rules"]
   S --> F["threat feed<br/>11 built-ins + signed"]
   F --> O["origin<br/>declared vs catalog"]
   O --> P["pinning<br/>drift vs approval"]
@@ -145,7 +148,7 @@ flowchart LR
 | Gate | What it decides | Network | Fatal? |
 |---|---|---|---|
-| **static-scan** | Injection, exfiltration, credential requests and hidden-Unicode/base64 tells in the tool `name`, its `description` and its `inputSchema` — 25 rules, v4, of which 15 can block and 10 are advisory-only, 17 also cover the name, and 12 carry a context guard | none | no |
+| **static-scan** | Injection, exfiltration, credential requests and hidden-Unicode/base64 tells in the tool `name`, its `description` and its `inputSchema` — 26 rules, v5, of which 15 can block and 11 are advisory-only, 17 also cover the name, and 15 carry a context guard. v5 folds the text first (fullwidth, invisible characters, Unicode tags, look-alike letters) so obfuscation cannot dodge a rule in any language | none | no |
 | **threat-feed** | Known-bad server identity or tool, from 11 built-in records plus an optional signed feed | only the feed fetch | yes, for a server-scoped `critical` |
 | **origin** | Whether the operator declared this server or it arrived from a remote catalog | none | yes, under `allowUnknownServers: false` |
 | **pinning** | Whether the tool defs still match what the user approved | none | yes, under `pinToolDefs: true` |
@@ -166,7 +169,7 @@ second as a low severity made it blocking again for anyone who tightened the thr
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
+  rulesets: { staticScan: { version: "5", digest: "sha256-HUKSzM6c…" } }
 }
 ```
@@ -242,7 +245,7 @@ no protection:
 ## Development
 ```bash
-npm install && npm run build && npm test   # 166 tests
+npm install && npm run build && npm test   # 189 tests
 ```
 `test/packaging.test.ts` is what keeps the headline honest: it fails if an npm runtime dependency

package/dist/fold.d.ts ADDED Viewed

@@ -0,0 +1,38 @@
+/**
+ * Unicode folding before the rule table reads a tool definition.
+ *
+ * A rule written as `ignore previous instructions` must not be defeated by the
+ * same words spelled so that a regex no longer sees them while a model still
+ * does. Three spellings do that, and none of them depends on the language:
+ *
+ *   1. Compatibility forms. `ｉｇｎｏｒｅ ｐｒｅｖｉｏｕｓ` (fullwidth), ligatures,
+ *      mathematical alphanumerics, circled letters. NFKC maps each to the plain
+ *      letter a reader sees.
+ *   2. Invisible characters inside a word. `ignore`, a soft hyphen, a
+ *      variation selector. They are dropped here so they cannot split a rule word.
+ *      The high-signal ones (zero-width, bidi, word-joiner, BOM, the tag block and
+ *      the variation-selector supplement) are ALSO reported, because the
+ *      hidden-character rule runs on the raw text; the purely cosmetic ones (a
+ *      soft hyphen, an Indic/Arabic joiner control) are neutralised here and not
+ *      separately flagged.
+ *   3. Look-alike letters from another script inside a Latin word: `іgnоre` with a
+ *      Cyrillic і and о. A token that mixes Latin with Cyrillic or Greek letters has
+ *      its look-alikes mapped to Latin. A token written wholly in one script is left
+ *      alone, so Russian and Greek text still reads as Russian and Greek.
+ *
+ * Unicode TAG characters (U+E0020–U+E007E) are the exception to "dropped": each is
+ * an invisible copy of an ASCII character, and a whole instruction can be written in
+ * them. They are DECODED to that ASCII here, so the instruction they carry meets the
+ * same rules as visible text.
+ *
+ * The fold is part of the published ruleset (FOLD_ID is in its digest): the same
+ * regexes over folded and unfolded text are different scans.
+ */
+/** Identity of this fold, carried in the ruleset preimage. Bump on any change below. */
+export declare const FOLD_ID = "nfkc+tags-decoded+invisible-stripped+mixed-script-confusables/1";
+/**
+ * Fold `text` for matching. Never shown to anyone: findings quote the folded span,
+ * and the raw text is what the hidden-character rules and the reader see.
+ */
+export declare function foldForScan(text: string): string;
+//# sourceMappingURL=fold.d.ts.map

package/dist/fold.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"fold.d.ts","sourceRoot":"","sources":["../src/fold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,wFAAwF;AACxF,eAAO,MAAM,OAAO,oEAAoE,CAAC;AAuCzF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBhD"}

package/dist/fold.js ADDED Viewed

@@ -0,0 +1,99 @@
+/**
+ * Unicode folding before the rule table reads a tool definition.
+ *
+ * A rule written as `ignore previous instructions` must not be defeated by the
+ * same words spelled so that a regex no longer sees them while a model still
+ * does. Three spellings do that, and none of them depends on the language:
+ *
+ *   1. Compatibility forms. `ｉｇｎｏｒｅ ｐｒｅｖｉｏｕｓ` (fullwidth), ligatures,
+ *      mathematical alphanumerics, circled letters. NFKC maps each to the plain
+ *      letter a reader sees.
+ *   2. Invisible characters inside a word. `ignore`, a soft hyphen, a
+ *      variation selector. They are dropped here so they cannot split a rule word.
+ *      The high-signal ones (zero-width, bidi, word-joiner, BOM, the tag block and
+ *      the variation-selector supplement) are ALSO reported, because the
+ *      hidden-character rule runs on the raw text; the purely cosmetic ones (a
+ *      soft hyphen, an Indic/Arabic joiner control) are neutralised here and not
+ *      separately flagged.
+ *   3. Look-alike letters from another script inside a Latin word: `іgnоre` with a
+ *      Cyrillic і and о. A token that mixes Latin with Cyrillic or Greek letters has
+ *      its look-alikes mapped to Latin. A token written wholly in one script is left
+ *      alone, so Russian and Greek text still reads as Russian and Greek.
+ *
+ * Unicode TAG characters (U+E0020–U+E007E) are the exception to "dropped": each is
+ * an invisible copy of an ASCII character, and a whole instruction can be written in
+ * them. They are DECODED to that ASCII here, so the instruction they carry meets the
+ * same rules as visible text.
+ *
+ * The fold is part of the published ruleset (FOLD_ID is in its digest): the same
+ * regexes over folded and unfolded text are different scans.
+ */
+/** Identity of this fold, carried in the ruleset preimage. Bump on any change below. */
+export const FOLD_ID = "nfkc+tags-decoded+invisible-stripped+mixed-script-confusables/1";
+/**
+ * Characters with no visible form in running text. Dropped by the fold; the
+ * hidden-character rule reports them from the raw text.
+ */
+const INVISIBLE_RE = new RegExp("[\\u00AD\\u034F\\u061C\\u115F\\u1160\\u17B4\\u17B5\\u180B-\\u180F\\u200B-\\u200F\\u202A-\\u202E" +
+    "\\u2060-\\u2064\\u2066-\\u206F\\u3164\\uFE00-\\uFE0F\\uFEFF\\uFFA0\\u{E0000}-\\u{E001F}" +
+    "\\u{E007F}\\u{E0100}-\\u{E01EF}]", "gu");
+/** U+E0020–U+E007E: invisible ASCII. Decoded, not dropped. */
+const TAG_RE = /[\u{E0020}-\u{E007E}]/gu;
+/**
+ * Cyrillic and Greek letters that render like a Latin letter. Used only inside a
+ * token that already contains Latin letters.
+ */
+const CONFUSABLE = {
+    // Cyrillic lower case
+    "а": "a", "в": "b", "е": "e", "ё": "e", "к": "k", "м": "m", "н": "h", "о": "o", "р": "p",
+    "с": "c", "т": "t", "у": "y", "х": "x", "і": "i", "ї": "i", "ј": "j", "ѕ": "s", "ԁ": "d",
+    "ԛ": "q", "ԝ": "w", "ӏ": "l", "һ": "h", "ɡ": "g",
+    // Cyrillic upper case
+    "А": "A", "В": "B", "Е": "E", "Ё": "E", "К": "K", "М": "M", "Н": "H", "О": "O", "Р": "P",
+    "С": "C", "Т": "T", "У": "Y", "Х": "X", "І": "I", "Ї": "I", "Ј": "J", "Ѕ": "S", "Һ": "H",
+    "Ԛ": "Q", "Ԝ": "W", "Ӏ": "I",
+    // Greek
+    "α": "a", "ε": "e", "ι": "i", "κ": "k", "ν": "v", "ο": "o", "ρ": "p", "τ": "t", "υ": "u",
+    "χ": "x", "Α": "A", "Β": "B", "Ε": "E", "Ζ": "Z", "Η": "H", "Ι": "I", "Κ": "K", "Μ": "M",
+    "Ν": "N", "Ο": "O", "Ρ": "P", "Τ": "T", "Υ": "Y", "Χ": "X",
+};
+const TOKEN_RE = /[\p{L}\p{M}]+/gu;
+const LATIN_RE = /[A-Za-z]/;
+const CONFUSABLE_RE = new RegExp(`[${Object.keys(CONFUSABLE).join("")}]`, "gu");
+/**
+ * Fold `text` for matching. Never shown to anyone: findings quote the folded span,
+ * and the raw text is what the hidden-character rules and the reader see.
+ */
+export function foldForScan(text) {
+    if (!text)
+        return text;
+    let out = text.normalize("NFKC");
+    out = out.replace(TAG_RE, (ch) => String.fromCharCode((ch.codePointAt(0) ?? 0xe0020) - 0xe0000));
+    out = out.replace(INVISIBLE_RE, "");
+    CONFUSABLE_RE.lastIndex = 0;
+    if (!CONFUSABLE_RE.test(out))
+        return out;
+    return out.replace(TOKEN_RE, (tok) => {
+        // Map a token that mixes Latin with look-alikes (`pаypаl`), OR one written
+        // WHOLLY in look-alike letters (`ЅУЅТЕМ`, `рrіvаtе` where every letter is in
+        // the table). A token with non-Latin letters that are NOT all confusables —
+        // ordinary Russian or Greek — is left alone, so those languages read normally.
+        // The scanner also matches the un-mapped raw text, so this only ever ADDS a
+        // reading; it never hides the original.
+        const marks = tok.replace(/\p{M}/gu, "");
+        if (!LATIN_RE.test(tok) && !allConfusable(marks))
+            return tok;
+        return tok.replace(CONFUSABLE_RE, (ch) => CONFUSABLE[ch] ?? ch);
+    });
+}
+/** Every letter of the token is one of the Latin look-alikes in the table. */
+function allConfusable(letters) {
+    if (!letters)
+        return false;
+    for (const ch of letters) {
+        if (!(ch in CONFUSABLE) && !/[A-Za-z]/.test(ch))
+            return false;
+    }
+    return /[^A-Za-z]/.test(letters); // at least one non-Latin look-alike, else nothing to map
+}
+//# sourceMappingURL=fold.js.map

package/dist/fold.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"fold.js","sourceRoot":"","sources":["../src/fold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAEzF;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,iGAAiG;IAC/F,yFAAyF;IACzF,kCAAkC,EACpC,IAAI,CACL,CAAC;AAEF,8DAA8D;AAC9D,MAAM,MAAM,GAAG,yBAAyB,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,GAA2B;IACzC,sBAAsB;IACtB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAChD,sBAAsB;IACtB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC5B,QAAQ;IACR,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CAC3D,CAAC;AAEF,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACnC,MAAM,QAAQ,GAAG,UAAU,CAAC;AAC5B,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAEhF;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IACjG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACzC,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QACnC,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC7D,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,yDAAyD;AAC7F,CAAC"}

package/dist/mcp-rpc.js CHANGED Viewed

@@ -6,7 +6,7 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { callMcpTool, MCP_INSTRUCTIONS, MCP_TOOLS, McpToolError, payloadTooLarge } from "./mcp-tools.js";
 export const PROTOCOL = "2025-03-26";
-const FALLBACK_VERSION = "0.5.0";
+const FALLBACK_VERSION = "0.5.1";
 export function packageVersion() {
     try {
         const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json");

package/dist/mcp-server.d.ts CHANGED Viewed

@@ -3,8 +3,13 @@
  * WARDEN stdio MCP server — Glama / Claude Desktop / Cursor.
  *
  * stdout is the MCP wire. Logs go to stderr. No environment variables required.
- * Speaks LSP-style Content-Length framing (official SDK / mcp-proxy) and
- * newline-delimited JSON as a fallback for simple probes.
+ *
+ * Wire format (MCP stdio spec): newline-delimited JSON. Glama's mcp-proxy and the
+ * official TypeScript SDK both speak NDJSON; LSP-style Content-Length framing on
+ * *stdout* is treated as non-JSON noise and the health check times out.
+ *
+ * Input still accepts Content-Length (legacy probes) and mirrors that framing on
+ * the reply so old clients keep working. Fresh `{…}\n` peers get `{…}\n` back.
  */
 export {};
 //# sourceMappingURL=mcp-server.d.ts.map

package/dist/mcp-server.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":";AACA~~;;;;;;GAMG~~"}
1	+ {"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG"}

package/dist/mcp-server.js CHANGED Viewed

@@ -3,15 +3,27 @@
  * WARDEN stdio MCP server — Glama / Claude Desktop / Cursor.
  *
  * stdout is the MCP wire. Logs go to stderr. No environment variables required.
- * Speaks LSP-style Content-Length framing (official SDK / mcp-proxy) and
- * newline-delimited JSON as a fallback for simple probes.
+ *
+ * Wire format (MCP stdio spec): newline-delimited JSON. Glama's mcp-proxy and the
+ * official TypeScript SDK both speak NDJSON; LSP-style Content-Length framing on
+ * *stdout* is treated as non-JSON noise and the health check times out.
+ *
+ * Input still accepts Content-Length (legacy probes) and mirrors that framing on
+ * the reply so old clients keep working. Fresh `{…}\n` peers get `{…}\n` back.
  */
 import { stderr, stdin, stdout } from "node:process";
 import { consumeLsp, handleRpc } from "./mcp-rpc.js";
+let mode = "unknown";
 function writeMessage(msg) {
-    const body = Buffer.from(JSON.stringify(msg), "utf8");
-    stdout.write(`Content-Length: ${body.length}\r\n\r\n`);
-    stdout.write(body);
+    const body = JSON.stringify(msg);
+    if (mode === "lsp") {
+        const buf = Buffer.from(body, "utf8");
+        stdout.write(`Content-Length: ${buf.length}\r\n\r\n`);
+        stdout.write(buf);
+        return;
+    }
+    // Default + Glama / TS SDK: NDJSON
+    stdout.write(`${body}\n`);
 }
 async function dispatchBody(body) {
     let parsed;
@@ -38,7 +50,6 @@ function skipWs(buf) {
 }
 async function main() {
     let buf = Buffer.from([]);
-    let mode = "unknown";
     let ndjson = "";
     for await (const chunk of stdin) {
         const piece = Buffer.from(chunk);

package/dist/mcp-server.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":";AACA~~;;;;;;GAMG~~;AAEH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAmB,MAAM,cAAc,CAAC;~~AAEtE~~,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,IAAI,GAAG,~~MAAM~~,CAAC,~~IAAI~~,CAAC,~~IAAI~~,CAAC,~~SAAS~~,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;~~IACtD~~,MAAM,CAAC,KAAK,CAAC,mBAAmB,~~IAAI~~,CAAC,MAAM,UAAU,CAAC,CAAC;~~IACvD~~,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;~~AACrB~~,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC5F,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG;QAAE,YAAY,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM;QAChE,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,~~IAAI,GAAiC,SAAS,CAAC;IACnD,IAAI,~~MAAM,GAAG,EAAE,CAAC;IAEhB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACnC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,IAAI,GAAG,QAAQ,CAAC;gBAChB,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,KAAK,CAAC;gBACb,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;gBACzC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxB,KAAK,MAAM,IAAI,IAAI,MAAM;oBAAE,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YAClC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YACzC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,MAAM;gBAAE,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,OAAO;oBAAE,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,CAAC,KAAK,CAAC,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
1	+ {"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAmB,MAAM,cAAc,CAAC;AAItE,IAAI,IAAI,GAAc,SAAS,CAAC;AAEhC,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,MAAM,UAAU,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IACD,mCAAmC;IACnC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC5F,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG;QAAE,YAAY,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM;QAChE,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACnC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,IAAI,GAAG,QAAQ,CAAC;gBAChB,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,KAAK,CAAC;gBACb,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;gBACzC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxB,KAAK,MAAM,IAAI,IAAI,MAAM;oBAAE,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YAClC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YACzC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,MAAM;gBAAE,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,OAAO;oBAAE,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,CAAC,KAAK,CAAC,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/mcp-tools.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mcp-tools.d.ts","sourceRoot":"","sources":["../src/mcp-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,OAAO,KAAK,EAKV,YAAY,EAEb,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,SAAS,MAAM,CAAC;AAC7B,eAAO,MAAM,UAAU,QAAS,CAAC;AACjC,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAIzC,eAAO,MAAM,kBAAkB,EAAE,YAKhC,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;QACxB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AA0DD,eAAO,MAAM,SAAS,EAAE,UAAU,~~EAwXjC~~,CAAC;AAEF,eAAO,MAAM,gBAAgB,QASgK,CAAC;AAkF9L,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAiBtG;~~AA+FD~~,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAMtD"}
1	+ {"version":3,"file":"mcp-tools.d.ts","sourceRoot":"","sources":["../src/mcp-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,OAAO,KAAK,EAKV,YAAY,EAEb,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,SAAS,MAAM,CAAC;AAC7B,eAAO,MAAM,UAAU,QAAS,CAAC;AACjC,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAIzC,eAAO,MAAM,kBAAkB,EAAE,YAKhC,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;QACxB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AA0DD,eAAO,MAAM,SAAS,EAAE,UAAU,EA0XjC,CAAC;AAEF,eAAO,MAAM,gBAAgB,QASgK,CAAC;AAkF9L,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAiBtG;AAoGD,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAMtD"}