@akms/mcp-wsl 0.0.1

package/lib/index.cjs

@@ -0,0 +1,1916 @@
+'use strict';
+
+var mcp_js = require('@modelcontextprotocol/sdk/server/mcp.js');
+var os = require('os');
+var path = require('path');
+var child_process = require('child_process');
+var mcpSsh = require('@akms/mcp-ssh');
+var timers = require('timers');
+var fs = require('fs');
+var zod = require('zod');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var os__default = /*#__PURE__*/_interopDefault(os);
+var path__default = /*#__PURE__*/_interopDefault(path);
+var fs__default = /*#__PURE__*/_interopDefault(fs);
+
+// src/server.ts
+
+// src/_defs/defaults.ts
+var LOG_LEVEL_ENV = "WSL_MCP_LOG_LEVEL";
+var DEFAULT_EXEC_TIMEOUT_MS = 6e4;
+var DEFAULT_MAX_OUTPUT_CHARACTERS = 1e5;
+var DEFAULT_MAX_READ_FILE_BYTES = 2e5;
+var OUTPUT_HARD_CAP_MULTIPLIER = 4;
+var SESSION_IDLE_TIMEOUT_MS = 15 * 60 * 1e3;
+var SESSION_SWEEP_INTERVAL_MS = 6e4;
+var MAX_CONCURRENT_PROCESSES = 32;
+var CWD_MARKER = "__AKMS_WSL_CWD__";
+var MAX_DIRECTORY_ENTRIES = 1e3;
+var WSL_EXECUTABLE = "wsl.exe";
+var WSL_FAILURE_EXIT_CODES = [4294967295, -1];
+var SERVER_NAME = "akms-mcp-wsl";
+var SERVER_VERSION = "0.0.1";
+
+// src/_defs/env-vars.ts
+var SINGLE_HOST_ENV = {
+  /** Presence of this variable is what registers a distro at all. Name as `wsl -l -q` prints it. */
+  DISTRO: "WSL_DISTRO",
+  /** Linux user to run as (`wsl -u`); the distro's default user when unset. */
+  USER: "WSL_USER",
+  /** Alias shown to the model; defaults to the distro name. */
+  NAME: "WSL_NAME",
+  DESCRIPTION: "WSL_DESCRIPTION",
+  /** Directory new sessions start in. */
+  CWD: "WSL_CWD",
+  READONLY: "WSL_READONLY",
+  ALLOW_SUDO: "WSL_ALLOW_SUDO",
+  /** Interop `.exe` execution and writes under `/mnt/<drive>/`. Default false. */
+  ALLOW_WINDOWS: "WSL_ALLOW_WINDOWS",
+  /** Comma-separated binary names. */
+  ALLOW_COMMANDS: "WSL_ALLOW_COMMANDS",
+  /** Comma-separated regex sources. */
+  DENY_PATTERNS: "WSL_DENY_PATTERNS",
+  /** Comma-separated absolute path prefixes. */
+  ALLOWED_PATHS: "WSL_ALLOWED_PATHS",
+  EXEC_TIMEOUT_MS: "WSL_EXEC_TIMEOUT_MS",
+  MAX_OUTPUT_CHARACTERS: "WSL_MAX_OUTPUT",
+  MAX_READ_FILE_BYTES: "WSL_MAX_READ_BYTES"
+};
+var TRUTHY_ENV_VALUES = ["true", "1", "yes", "on"];
+var FALSY_ENV_VALUES = ["false", "0", "no", "off"];
+
+// src/_defs/wsl-rules.ts
+var WSL_CATASTROPHE_RULES = [
+  {
+    pattern: /^wsl(?:\.exe)?\b.*\s-(?:-shutdown|-terminate|-unregister|t)(?:\s|$)/i,
+    reason: "stops or removes the distro this server runs in (wsl --shutdown / --terminate / --unregister)"
+  },
+  {
+    pattern: /^wslconfig(?:\.exe)?\b.*\s\/(?:t|u)\b/i,
+    reason: "terminates or unregisters the distro this server runs in (wslconfig /t, /u)"
+  },
+  {
+    pattern: /^(?:poweroff|halt)\b/,
+    reason: "powers off the distro this server runs in"
+  },
+  {
+    pattern: /^systemctl\b.*\b(?:poweroff|halt|reboot|kexec|suspend|hibernate)\b/,
+    reason: "powers off or restarts the distro this server runs in"
+  },
+  {
+    pattern: /^(?:telinit|init)\s+[06]\b/,
+    reason: "halts or reboots the distro this server runs in"
+  }
+];
+var WINDOWS_INTEROP_BINARY_PATTERN = new RegExp(
+  "^(?:(?:powershell|pwsh|cmd|explorer|wsl|wslconfig|wslview|reg|regedit|schtasks|sc|net|netsh|taskkill|tasklist|mshta|rundll32|wscript|cscript|msiexec|start|winget|choco|scoop)(?:\\.exe|\\.cmd|\\.bat)?|.*\\.(?:exe|cmd|bat|ps1|msi|com))$",
+  "i"
+);
+var MOUNT_PATH_PATTERN = /\/mnt\/([a-z])(\/[^\s'"|;&<>]*)?/gi;
+
+// src/_libs/logger.ts
+var LEVEL_WEIGHTS = {
+  silent: 0,
+  debug: 1,
+  info: 2,
+  warn: 3,
+  error: 4
+};
+var SECRET_META_KEYS = ["password", "passphrase", "secret", "token"];
+function resolveThreshold() {
+  const configured = process.env[LOG_LEVEL_ENV];
+  if (configured == null) {
+    return "info";
+  }
+  const normalized = configured.toLowerCase();
+  if (Object.hasOwn(LEVEL_WEIGHTS, normalized) == false) {
+    return "info";
+  }
+  return normalized;
+}
+function maskSecrets(meta) {
+  const masked = {};
+  for (const [key, value] of Object.entries(meta)) {
+    if (SECRET_META_KEYS.includes(key.toLowerCase()) == true) {
+      masked[key] = "***";
+      continue;
+    }
+    masked[key] = value;
+  }
+  return masked;
+}
+function describeError(error) {
+  if (error instanceof Error) {
+    if (error.stack != null) {
+      return error.stack;
+    }
+    return error.message;
+  }
+  return String(error);
+}
+function write(level, message, meta) {
+  const threshold = resolveThreshold();
+  if (threshold === "silent") {
+    return;
+  }
+  if (LEVEL_WEIGHTS[level] < LEVEL_WEIGHTS[threshold]) {
+    return;
+  }
+  const record = {
+    time: (/* @__PURE__ */ new Date()).toISOString(),
+    level,
+    message,
+    ...maskSecrets(meta)
+  };
+  process.stderr.write(`${JSON.stringify(record)}
+`);
+}
+function createLogger(baseMeta) {
+  return {
+    child(meta) {
+      return createLogger({ ...baseMeta, ...meta });
+    },
+    debug(message, meta) {
+      write("debug", message, { ...baseMeta, ...meta });
+    },
+    info(message, meta) {
+      write("info", message, { ...baseMeta, ...meta });
+    },
+    warn(message, meta) {
+      write("warn", message, { ...baseMeta, ...meta });
+    },
+    error(error, message, meta) {
+      write("error", message, { ...baseMeta, ...meta, error: describeError(error) });
+    }
+  };
+}
+var $logger = createLogger({});
+
+// src/_libs/text.ts
+function truncateOutput(text, maxCharacters) {
+  if (text.length <= maxCharacters) {
+    return { text, truncated: false };
+  }
+  let cutAt = maxCharacters;
+  const lastKeptCode = text.charCodeAt(cutAt - 1);
+  if (lastKeptCode >= 55296 && lastKeptCode <= 56319) {
+    cutAt -= 1;
+  }
+  const droppedCharacters = text.length - cutAt;
+  const kept = text.slice(0, cutAt);
+  return {
+    text: `${kept}
+... [truncated ${droppedCharacters} characters of ${text.length}]`,
+    truncated: true
+  };
+}
+function quoteShellArgument(value) {
+  const escaped = value.replace(/'/g, `'\\''`);
+  return `'${escaped}'`;
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) {
+    return `${bytes} B`;
+  }
+  if (bytes < 1024 * 1024) {
+    const kilobytes = bytes / 1024;
+    return `${kilobytes.toFixed(1)} KB`;
+  }
+  const megabytes = bytes / (1024 * 1024);
+  return `${megabytes.toFixed(1)} MB`;
+}
+function expandHomePath(inputPath) {
+  let expanded = inputPath;
+  if (inputPath === "~") {
+    expanded = os__default.default.homedir();
+  } else if (inputPath.startsWith("~/") == true || inputPath.startsWith("~\\") == true) {
+    expanded = path__default.default.join(os__default.default.homedir(), inputPath.slice(2));
+  }
+  return path__default.default.resolve(expanded);
+}
+function mountPathToWindows(distroPath) {
+  const match = /^\/mnt\/([a-z])(?:\/(.*))?$/i.exec(distroPath.trim());
+  if (match == null) {
+    return null;
+  }
+  const drive = match[1].toUpperCase();
+  const rest = match[2] ?? "";
+  return `${drive}:/${rest}`;
+}
+
+// src/modules/config/host-profile.ts
+function readEnv(name) {
+  const value = process.env[name];
+  if (value == null) {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  if (trimmed === "") {
+    return void 0;
+  }
+  return trimmed;
+}
+function readBooleanEnv(name) {
+  const value = readEnv(name);
+  if (value == null) {
+    return void 0;
+  }
+  const normalized = value.toLowerCase();
+  if (TRUTHY_ENV_VALUES.includes(normalized) == true) {
+    return true;
+  }
+  if (FALSY_ENV_VALUES.includes(normalized) == false) {
+    throw new Error(`${name} must be one of ${[...TRUTHY_ENV_VALUES, ...FALSY_ENV_VALUES].join(", ")} (got "${value}")`);
+  }
+  return false;
+}
+function readIntegerEnv(name) {
+  const value = readEnv(name);
+  if (value == null) {
+    return void 0;
+  }
+  const parsed = Number(value);
+  if (Number.isInteger(parsed) == false || parsed <= 0) {
+    throw new Error(`${name} must be a positive integer (got "${value}")`);
+  }
+  return parsed;
+}
+function readListEnv(name) {
+  const value = readEnv(name);
+  if (value == null) {
+    return void 0;
+  }
+  const items = value.split(",").map((item) => item.trim()).filter((item) => item !== "");
+  if (items.length === 0) {
+    return void 0;
+  }
+  return items;
+}
+function compileDenyPatterns(sources) {
+  return sources.map((source) => {
+    try {
+      return new RegExp(source, "i");
+    } catch (ex) {
+      let detail = String(ex);
+      if (ex instanceof Error) {
+        detail = ex.message;
+      }
+      throw new Error(`${SINGLE_HOST_ENV.DENY_PATTERNS} has an invalid entry /${source}/: ${detail}`);
+    }
+  });
+}
+function loadHostProfile() {
+  const distro = readEnv(SINGLE_HOST_ENV.DISTRO);
+  if (distro == null) {
+    const _startupLogger = $logger.child({ context: "loadHostProfile" });
+    _startupLogger.warn("no distro is registered; set the distro variable and restart", {
+      env_vars: [SINGLE_HOST_ENV.DISTRO]
+    });
+    return null;
+  }
+  const name = readEnv(SINGLE_HOST_ENV.NAME) ?? distro;
+  const _logger = $logger.child({ context: "loadHostProfile", profile: name });
+  const allowCommands = readListEnv(SINGLE_HOST_ENV.ALLOW_COMMANDS) ?? [];
+  if (allowCommands.length > 0 && allowCommands.includes("pwd") == false) {
+    allowCommands.push("pwd");
+  }
+  const policy = {
+    readonly: readBooleanEnv(SINGLE_HOST_ENV.READONLY) ?? false,
+    allowSudo: readBooleanEnv(SINGLE_HOST_ENV.ALLOW_SUDO) ?? true,
+    execTimeoutMs: readIntegerEnv(SINGLE_HOST_ENV.EXEC_TIMEOUT_MS) ?? DEFAULT_EXEC_TIMEOUT_MS,
+    // Nothing connects; carried only because the shared policy type declares it.
+    connectTimeoutMs: 0,
+    maxOutputCharacters: readIntegerEnv(SINGLE_HOST_ENV.MAX_OUTPUT_CHARACTERS) ?? DEFAULT_MAX_OUTPUT_CHARACTERS,
+    maxReadFileBytes: readIntegerEnv(SINGLE_HOST_ENV.MAX_READ_FILE_BYTES) ?? DEFAULT_MAX_READ_FILE_BYTES,
+    allowCommands,
+    denyPatterns: compileDenyPatterns(readListEnv(SINGLE_HOST_ENV.DENY_PATTERNS) ?? []),
+    allowedPaths: readListEnv(SINGLE_HOST_ENV.ALLOWED_PATHS) ?? []
+  };
+  const profile = {
+    name,
+    distro,
+    username: readEnv(SINGLE_HOST_ENV.USER),
+    description: readEnv(SINGLE_HOST_ENV.DESCRIPTION),
+    defaultCwd: readEnv(SINGLE_HOST_ENV.CWD),
+    allowWindows: readBooleanEnv(SINGLE_HOST_ENV.ALLOW_WINDOWS) ?? false,
+    policy
+  };
+  _logger.info("host profile loaded", {
+    distro,
+    username: profile.username ?? "(distro default)",
+    readonly: policy.readonly,
+    allow_windows: profile.allowWindows
+  });
+  return profile;
+}
+function toHostSummary(profile) {
+  return {
+    name: profile.name,
+    distro: profile.distro,
+    username: profile.username ?? "(distro default)",
+    description: profile.description,
+    readonly: profile.policy.readonly,
+    allowSudo: profile.policy.allowSudo,
+    allowWindows: profile.allowWindows,
+    allowedPaths: profile.policy.allowedPaths,
+    allowCommands: profile.policy.allowCommands
+  };
+}
+var MAX_INSPECTION_DEPTH = 5;
+function inspectWslCommand(canonicalCommand, profile, depth = 0) {
+  if (depth === 0) {
+    const baseVerdict = mcpSsh.inspectCommand(canonicalCommand, profile.policy);
+    if (baseVerdict.allowed == false) {
+      return baseVerdict;
+    }
+  }
+  if (depth > MAX_INSPECTION_DEPTH) {
+    return {
+      allowed: false,
+      reason: `command nests substitutions deeper than ${MAX_INSPECTION_DEPTH} levels`,
+      offendingText: canonicalCommand
+    };
+  }
+  for (const substitution of mcpSsh.extractSubstitutions(canonicalCommand)) {
+    const nestedVerdict = inspectWslCommand(substitution, profile, depth + 1);
+    if (nestedVerdict.allowed == false) {
+      return nestedVerdict;
+    }
+  }
+  for (const segment of mcpSsh.splitCommandSegments(canonicalCommand)) {
+    const analysis = mcpSsh.analyzeSegment(segment);
+    for (const rule of WSL_CATASTROPHE_RULES) {
+      if (rule.pattern.test(analysis.normalizedText) == true) {
+        return { allowed: false, reason: rule.reason, offendingText: segment.trim() };
+      }
+    }
+    if (profile.allowWindows == false && WINDOWS_INTEROP_BINARY_PATTERN.test(analysis.binary) == true) {
+      return {
+        allowed: false,
+        reason: `'${analysis.binary}' is a Windows executable: interop leaves the distro for the machine running this server (set WSL_ALLOW_WINDOWS=true to permit it)`,
+        offendingText: segment.trim()
+      };
+    }
+    const mountPaths = collectMountPaths(segment, analysis);
+    if (mountPaths.length === 0) {
+      continue;
+    }
+    const writeShaped = isWriteShaped(segment, profile.policy);
+    if (profile.allowWindows == false && writeShaped == true) {
+      const mountTarget = findMountWriteTarget(segment, analysis);
+      if (mountTarget != null) {
+        return {
+          allowed: false,
+          reason: `writing to ${mountTarget} lands on the Windows filesystem of the machine running this server (set WSL_ALLOW_WINDOWS=true to permit writes under /mnt/<drive>/; reads and copies out of it are already allowed)`,
+          offendingText: segment.trim()
+        };
+      }
+    }
+    let access = "read";
+    if (writeShaped == true) {
+      access = "write";
+    }
+    for (const mountPath of mountPaths) {
+      const protectedVerdict = inspectMountPath(mountPath, access);
+      if (protectedVerdict.allowed == false) {
+        return protectedVerdict;
+      }
+    }
+  }
+  return { allowed: true };
+}
+function inspectWslPath(distroPath, profile, access) {
+  const baseVerdict = mcpSsh.inspectRemotePath(distroPath, profile.policy, access);
+  if (baseVerdict.allowed == false) {
+    return baseVerdict;
+  }
+  if (mountPathToWindows(distroPath) == null) {
+    return { allowed: true };
+  }
+  if (access === "write" && profile.allowWindows == false) {
+    return {
+      allowed: false,
+      reason: "writes under /mnt/<drive>/ land on the Windows filesystem of the machine running this server (set WSL_ALLOW_WINDOWS=true to permit them)",
+      offendingText: distroPath.trim()
+    };
+  }
+  return inspectMountPath(distroPath.trim(), access);
+}
+function inspectMountPath(distroPath, access) {
+  const windowsPath = mountPathToWindows(distroPath);
+  if (windowsPath == null) {
+    return { allowed: true };
+  }
+  const verdict = mcpSsh.inspectLocalPath(windowsPath, access);
+  if (verdict.allowed == true) {
+    return verdict;
+  }
+  return {
+    allowed: false,
+    reason: `${verdict.reason} (reached through ${distroPath})`,
+    offendingText: distroPath
+  };
+}
+var DESTINATION_LAST_BINARIES = /* @__PURE__ */ new Set(["cp", "rsync", "install", "scp"]);
+var DESTINATION_BY_OPTION = {
+  tar: /^(?:-C|--directory)$/,
+  unzip: /^-d$/,
+  curl: /^(?:-o|--output)$/,
+  wget: /^(?:-O|--output-document)$/
+};
+var TAR_CREATE_FLAG_PATTERN = /^(?:-[a-zA-Z]*[cru][a-zA-Z]*|--create|--append|--update|--concatenate|--delete)$/;
+function findMountWriteTarget(segment, analysis) {
+  for (const redirectionTarget of collectRedirectionTargets(segment)) {
+    if (isMountPath(redirectionTarget) == true) {
+      return redirectionTarget;
+    }
+  }
+  const binary = analysis.binary.toLowerCase();
+  let candidates = analysis.operands;
+  if (DESTINATION_LAST_BINARIES.has(binary) == true) {
+    candidates = [...analysis.operands.slice(-1), ...valuesAfterOption(analysis.tokens, TARGET_DIRECTORY_OPTION)];
+  } else if (binary === "tar") {
+    const creating = analysis.flags.some((flag) => TAR_CREATE_FLAG_PATTERN.test(flag) == true);
+    if (creating == false) {
+      candidates = valuesAfterOption(analysis.tokens, DESTINATION_BY_OPTION.tar);
+    }
+  } else if (DESTINATION_BY_OPTION[binary] != null) {
+    candidates = valuesAfterOption(analysis.tokens, DESTINATION_BY_OPTION[binary]);
+  }
+  candidates = [...candidates, ...valuesInFlags(analysis.flags)];
+  for (const candidate of candidates) {
+    if (isMountPath(candidate) == true) {
+      return candidate;
+    }
+  }
+  return null;
+}
+var TARGET_DIRECTORY_OPTION = /^(?:-t|--target-directory)$/;
+function valuesInFlags(flags) {
+  const values = [];
+  for (const flag of flags) {
+    const separator = flag.indexOf("=");
+    if (separator > 0) {
+      values.push(flag.slice(separator + 1));
+    }
+  }
+  return values;
+}
+function valuesAfterOption(tokens, optionPattern) {
+  const values = [];
+  for (let index = 0; index < tokens.length - 1; index++) {
+    if (optionPattern.test(tokens[index]) == true) {
+      values.push(tokens[index + 1]);
+    }
+  }
+  return values;
+}
+function collectRedirectionTargets(segment) {
+  const targets = [];
+  for (const match of segment.matchAll(/>{1,2}\s*(['"]?)([^\s'"|;&<>]+)/g)) {
+    targets.push(match[2]);
+  }
+  return targets;
+}
+function bareCandidate(candidate) {
+  return candidate.replace(/^['"]|['"]$/g, "").replace(/^[A-Za-z_][\w-]*=/, "");
+}
+function isMountPath(candidate) {
+  return /^\/mnt\/[a-z](?:\/|$)/i.test(bareCandidate(candidate));
+}
+function collectMountPaths(segment, analysis) {
+  const found = /* @__PURE__ */ new Set();
+  const candidates = [
+    ...analysis.operands,
+    ...valuesInFlags(analysis.flags),
+    ...collectRedirectionTargets(segment)
+  ];
+  for (const candidate of candidates) {
+    if (isMountPath(candidate) == true) {
+      found.add(bareCandidate(candidate));
+    }
+  }
+  for (const match of segment.matchAll(MOUNT_PATH_PATTERN)) {
+    found.add(match[0]);
+  }
+  return Array.from(found);
+}
+function isWriteShaped(segment, policy) {
+  const readonlyPolicy = { ...policy, readonly: true };
+  const verdict = mcpSsh.inspectCommand(segment, readonlyPolicy);
+  return verdict.allowed == false;
+}
+
+// src/modules/wsl/wsl-command.ts
+function buildWslArguments(profile, script) {
+  const wslArguments = ["-d", profile.distro];
+  if (profile.username != null) {
+    wslArguments.push("-u", profile.username);
+  }
+  wslArguments.push("--exec", "bash", "-lc", script);
+  return wslArguments;
+}
+function buildDistroScript(command, cwd, trackCwd) {
+  const lines = [];
+  if (cwd != null && cwd !== "") {
+    const quotedCwd = quoteShellArgument(cwd);
+    lines.push(`cd ${quotedCwd} 2>/dev/null || { echo 'akms-mcp-wsl: cannot enter the requested working directory' >&2; exit 1; }`);
+  }
+  lines.push(command);
+  if (trackCwd == true) {
+    lines.push("__akms_exit=$?");
+    lines.push(`printf '\\n${CWD_MARKER}%s' "$PWD"`);
+    lines.push("exit $__akms_exit");
+  }
+  return lines.join("\n");
+}
+function extractCwdMarker(stdout) {
+  const markerIndex = stdout.lastIndexOf(CWD_MARKER);
+  if (markerIndex < 0) {
+    return { output: stdout };
+  }
+  const markerPayload = stdout.slice(markerIndex + CWD_MARKER.length);
+  const cwd = (markerPayload.split("\n")[0] ?? "").trim();
+  let output = stdout.slice(0, markerIndex);
+  if (output.endsWith("\n") == true) {
+    output = output.slice(0, -1);
+  }
+  if (cwd === "") {
+    return { output };
+  }
+  return { output, cwd };
+}
+
+// src/modules/wsl/wsl-host.ts
+var activeProcessCount = 0;
+var WslHost = class {
+  constructor(profile) {
+    this.profile = profile;
+  }
+  /**
+   * Screens a command against this profile's policy, then runs it.
+   *
+   * The canonical form is what gets screened *and* what gets sent — validating one
+   * string while executing another is a bypass by construction.
+   *
+   * @throws {GuardRejectionError} If the policy refuses the command or the cwd.
+   * @throws {Error} If `wsl.exe` itself fails (unknown distro, service down) or cannot be spawned.
+   */
+  async exec(options) {
+    const canonicalCommand = mcpSsh.canonicalizeCommand(options.command);
+    const verdict = inspectWslCommand(canonicalCommand, this.profile);
+    if (verdict.allowed == false) {
+      throw new mcpSsh.GuardRejectionError(verdict);
+    }
+    if (options.cwd != null) {
+      const cwdVerdict = mcpSsh.inspectWorkingDirectory(options.cwd);
+      if (cwdVerdict.allowed == false) {
+        throw new mcpSsh.GuardRejectionError(cwdVerdict);
+      }
+    }
+    const _logger = $logger.child({ context: "WslHost.exec", profile: this.profile.name, cwd: options.cwd });
+    const script = buildDistroScript(canonicalCommand, options.cwd, options.trackCwd);
+    const raw = await this.runProcess({
+      script,
+      timeoutMs: options.timeoutMs,
+      maxCapturedBytes: options.maxOutputCharacters * OUTPUT_HARD_CAP_MULTIPLIER
+    });
+    let output = raw.stdout.toString("utf8");
+    let cwd = void 0;
+    if (options.trackCwd == true) {
+      const parsed = extractCwdMarker(output);
+      output = parsed.output;
+      cwd = parsed.cwd;
+    }
+    const truncatedStdout = truncateOutput(output, options.maxOutputCharacters);
+    const truncatedStderr = truncateOutput(raw.stderr.toString("utf8"), options.maxOutputCharacters);
+    const result = {
+      stdout: truncatedStdout.text,
+      stderr: truncatedStderr.text,
+      exitCode: raw.exitCode,
+      timedOut: raw.timedOut,
+      truncated: truncatedStdout.truncated == true || truncatedStderr.truncated == true || raw.capExceeded == true,
+      durationMs: raw.durationMs
+    };
+    if (raw.signal != null) {
+      result.signal = raw.signal;
+    }
+    if (cwd != null) {
+      result.cwd = cwd;
+    }
+    _logger.debug("command finished", {
+      exit_code: result.exitCode,
+      duration_ms: result.durationMs,
+      timed_out: result.timedOut,
+      truncated: result.truncated
+    });
+    return result;
+  }
+  /**
+   * Spawns `wsl.exe` for one script and collects what it produced.
+   *
+   * Not guarded — callers own that: `exec` screens the command, the file operations
+   * screen the path and build the script themselves. stdin is closed (or fed and then
+   * closed) so anything that waits for input fails at once instead of hanging until the
+   * timeout.
+   *
+   * @throws {Error} If the process ceiling is reached, `wsl.exe` cannot be started, or
+   *                 `wsl.exe` reports a failure of its own rather than the command's exit
+   *                 status — that message (unknown distro, service down) is the whole diagnosis.
+   */
+  async runProcess(options) {
+    if (activeProcessCount >= MAX_CONCURRENT_PROCESSES) {
+      throw new Error(`too many concurrent wsl.exe processes (${MAX_CONCURRENT_PROCESSES}); wait for running calls to finish`);
+    }
+    const _logger = $logger.child({ context: "WslHost.runProcess", profile: this.profile.name });
+    const wslArguments = buildWslArguments(this.profile, options.script);
+    const startedAt = Date.now();
+    activeProcessCount += 1;
+    try {
+      const raw = await new Promise((resolve, reject) => {
+        let stdinMode = "ignore";
+        if (options.stdin != null) {
+          stdinMode = "pipe";
+        }
+        const child = child_process.spawn(WSL_EXECUTABLE, wslArguments, {
+          // WSL_UTF8: wsl.exe's *own* messages (unknown distro, service errors) are
+          // UTF-16 by default even on a pipe; the Linux side is UTF-8 regardless.
+          env: { ...process.env, WSL_UTF8: "1" },
+          stdio: [stdinMode, "pipe", "pipe"],
+          windowsHide: true
+        });
+        const stdoutStream = child.stdout;
+        const stderrStream = child.stderr;
+        if (stdoutStream == null || stderrStream == null) {
+          reject(new Error("wsl.exe was spawned without stdio pipes"));
+          return;
+        }
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
+        let sinkBytes = 0;
+        let timedOut = false;
+        let capExceeded = false;
+        let settled = false;
+        let stdinFailure = null;
+        const timeoutTimer = setTimeout(() => {
+          timedOut = true;
+          _logger.warn("command timed out, killing wsl.exe", { timeout_ms: options.timeoutMs });
+          child.kill();
+        }, options.timeoutMs);
+        timeoutTimer.unref();
+        const finish = (exitCode, signal) => {
+          if (settled == true) {
+            return;
+          }
+          settled = true;
+          clearTimeout(timeoutTimer);
+          const output = {
+            stdout: Buffer.concat(stdoutChunks),
+            stderr: Buffer.concat(stderrChunks),
+            sinkBytes,
+            exitCode,
+            timedOut,
+            capExceeded,
+            durationMs: Date.now() - startedAt
+          };
+          if (signal != null) {
+            output.signal = signal;
+          }
+          resolve(output);
+        };
+        const fail = (error) => {
+          if (settled == true) {
+            return;
+          }
+          settled = true;
+          clearTimeout(timeoutTimer);
+          reject(error);
+        };
+        const exceedCap = (stream) => {
+          if (capExceeded == true) {
+            return;
+          }
+          capExceeded = true;
+          _logger.warn(`${stream} exceeded the hard cap, killing wsl.exe`, { hard_cap: options.maxCapturedBytes });
+          child.kill();
+        };
+        if (options.stdoutSink != null) {
+          const sink = options.stdoutSink;
+          stdoutStream.on("data", (chunk) => {
+            sinkBytes += chunk.length;
+          });
+          stdoutStream.pipe(sink, { end: false });
+          sink.on("error", fail);
+        } else {
+          stdoutStream.on("data", (chunk) => {
+            if (capExceeded == true) {
+              return;
+            }
+            stdoutChunks.push(chunk);
+            stdoutBytes += chunk.length;
+            if (stdoutBytes > options.maxCapturedBytes) {
+              exceedCap("stdout");
+            }
+          });
+        }
+        stderrStream.on("data", (chunk) => {
+          if (capExceeded == true) {
+            return;
+          }
+          stderrChunks.push(chunk);
+          stderrBytes += chunk.length;
+          if (stderrBytes > options.maxCapturedBytes) {
+            exceedCap("stderr");
+          }
+        });
+        child.on("error", fail);
+        child.on("close", (exitCode, signal) => {
+          if (stdinFailure != null) {
+            fail(new Error(`local input failed while feeding the distro: ${stdinFailure.message}`));
+            return;
+          }
+          finish(exitCode, signal);
+        });
+        if (options.stdin != null && child.stdin != null) {
+          child.stdin.on("error", () => {
+          });
+          if (Buffer.isBuffer(options.stdin) == true) {
+            child.stdin.end(options.stdin);
+          } else {
+            const source = options.stdin;
+            source.on("error", (error) => {
+              stdinFailure = error;
+              child.kill();
+            });
+            source.pipe(child.stdin);
+          }
+        }
+      });
+      if (raw.exitCode != null && WSL_FAILURE_EXIT_CODES.includes(raw.exitCode) == true) {
+        let detail = `${raw.stdout.toString("utf8")}
+${raw.stderr.toString("utf8")}`.trim();
+        if (detail === "" && options.stdoutSink != null) {
+          detail = "wsl.exe reported a failure of its own (unknown distro, WSL service down) \u2014 run akms-mcp-wsl --check";
+        }
+        throw new Error(`wsl.exe failed for distro '${this.profile.distro}': ${detail}`);
+      }
+      return raw;
+    } finally {
+      activeProcessCount -= 1;
+    }
+  }
+};
+var MAX_OPEN_SESSIONS = 32;
+var WslSession = class {
+  constructor(sessionId, host) {
+    this.sessionId = sessionId;
+    this.host = host;
+    this.execCount = 0;
+    this.openedAt = /* @__PURE__ */ new Date();
+    /** Tail of the serialized operation chain; see `runExclusive`. */
+    this.operationChain = Promise.resolve();
+    this.activeOperationCount = 0;
+    this.cwd = host.profile.defaultCwd ?? "";
+    this.lastUsedAt = /* @__PURE__ */ new Date();
+  }
+  get profile() {
+    return this.host.profile;
+  }
+  /** True while an operation is running, so the idle sweeper leaves it alone. */
+  get isBusy() {
+    return this.activeOperationCount > 0;
+  }
+  touch() {
+    this.lastUsedAt = /* @__PURE__ */ new Date();
+  }
+  /**
+   * Runs `operation` with exclusive use of this session.
+   *
+   * Serialized because `cwd` is read-modify-write across a process run: two concurrent
+   * calls both read the old directory, and the one that finishes second writes it back —
+   * silently undoing the other's `cd`.
+   */
+  async runExclusive(operation) {
+    const previous = this.operationChain;
+    let releaseChain = () => {
+    };
+    this.operationChain = new Promise((resolve) => {
+      releaseChain = resolve;
+    });
+    await previous.catch(() => {
+    });
+    this.activeOperationCount += 1;
+    this.touch();
+    try {
+      return await operation(this.host);
+    } finally {
+      this.activeOperationCount -= 1;
+      this.touch();
+      releaseChain();
+    }
+  }
+  /**
+   * Runs a command in this session's working directory and adopts wherever it ended up,
+   * so a `cd` in one call is still in effect on the next.
+   *
+   * Passing `cwd` runs this command elsewhere *and* moves the session there — same
+   * result as prefixing `cd <cwd> &&`, which is what a shell user would expect.
+   */
+  async exec(command, options) {
+    const policy = this.profile.policy;
+    const targetCwd = options?.cwd ?? this.cwd;
+    return await this.runExclusive(async (host) => {
+      const result = await host.exec({
+        command,
+        cwd: targetCwd,
+        timeoutMs: options?.timeoutMs ?? policy.execTimeoutMs,
+        maxOutputCharacters: policy.maxOutputCharacters,
+        trackCwd: true
+      });
+      if (result.cwd != null && result.cwd !== "") {
+        const verdict = mcpSsh.inspectWorkingDirectory(result.cwd);
+        if (verdict.allowed == true) {
+          this.cwd = result.cwd;
+        } else {
+          const _logger = $logger.child({ context: "WslSession.exec", session_id: this.sessionId });
+          _logger.warn("reported working directory contains unsafe characters, keeping the previous cwd", {
+            reported_cwd: result.cwd
+          });
+        }
+      }
+      this.execCount += 1;
+      return result;
+    });
+  }
+  toInfo() {
+    let displayCwd = this.cwd;
+    if (displayCwd === "") {
+      displayCwd = "(login default)";
+    }
+    return {
+      sessionId: this.sessionId,
+      profileName: this.profile.name,
+      distro: this.profile.distro,
+      username: this.profile.username ?? "(distro default)",
+      cwd: displayCwd,
+      openedAt: this.openedAt.toISOString(),
+      lastUsedAt: this.lastUsedAt.toISOString(),
+      execCount: this.execCount
+    };
+  }
+};
+var WslSessionManager = class {
+  constructor() {
+    this.sessions = /* @__PURE__ */ new Map();
+    this.sequence = 0;
+    this.sweepTimer = null;
+  }
+  /**
+   * Registers a session. Nothing is opened — the caller probes with `pwd` to prove
+   * the distro answers and to settle the starting directory.
+   *
+   * @throws {Error} If the session ceiling is reached.
+   */
+  open(host) {
+    if (this.sessions.size >= MAX_OPEN_SESSIONS) {
+      throw new Error(`too many open wsl sessions (${MAX_OPEN_SESSIONS}), close some with wsl_disconnect first`);
+    }
+    this.sequence += 1;
+    const sessionId = `${host.profile.name}#${this.sequence}`;
+    const session = new WslSession(sessionId, host);
+    this.sessions.set(sessionId, session);
+    const _logger = $logger.child({ context: "WslSessionManager.open", session_id: sessionId, profile: host.profile.name });
+    _logger.info("wsl session opened", { open_sessions: this.sessions.size });
+    return session;
+  }
+  /**
+   * Looks up a session, failing with the list of live ids so the caller can self-correct.
+   *
+   * @throws {Error} If no session matches `sessionId`.
+   */
+  require(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (session == null) {
+      const openIds = Array.from(this.sessions.keys());
+      let openSummary = "none";
+      if (openIds.length > 0) {
+        openSummary = openIds.join(", ");
+      }
+      throw new Error(`unknown wsl session '${sessionId}' (open sessions: ${openSummary})`);
+    }
+    return session;
+  }
+  close(sessionId) {
+    const deleted = this.sessions.delete(sessionId);
+    if (deleted == false) {
+      return false;
+    }
+    const _logger = $logger.child({ context: "WslSessionManager.close", session_id: sessionId });
+    _logger.info("wsl session closed", { open_sessions: this.sessions.size });
+    return true;
+  }
+  closeAll() {
+    for (const sessionId of Array.from(this.sessions.keys())) {
+      this.close(sessionId);
+    }
+  }
+  list() {
+    return Array.from(this.sessions.values()).map((session) => session.toInfo());
+  }
+  /** Starts the idle sweeper; the timer is unref'd so it never holds the process open. */
+  startIdleSweeper() {
+    if (this.sweepTimer != null) {
+      return;
+    }
+    this.sweepTimer = timers.setInterval(() => {
+      const expiredAt = Date.now() - SESSION_IDLE_TIMEOUT_MS;
+      for (const session of Array.from(this.sessions.values())) {
+        if (session.isBusy == true) {
+          continue;
+        }
+        if (session.lastUsedAt.getTime() > expiredAt) {
+          continue;
+        }
+        const _logger = $logger.child({
+          context: "WslSessionManager.sweep",
+          session_id: session.sessionId,
+          idle_ms: Date.now() - session.lastUsedAt.getTime()
+        });
+        _logger.info("forgetting idle wsl session");
+        this.close(session.sessionId);
+      }
+    }, SESSION_SWEEP_INTERVAL_MS);
+    this.sweepTimer.unref();
+  }
+  stopIdleSweeper() {
+    if (this.sweepTimer == null) {
+      return;
+    }
+    timers.clearInterval(this.sweepTimer);
+    this.sweepTimer = null;
+  }
+};
+var METADATA_CAPTURE_BYTES = 4 * 1024 * 1024;
+function requirePermittedPath(host, distroPath, access) {
+  const verdict = inspectWslPath(distroPath, host.profile, access);
+  if (verdict.allowed == false) {
+    throw new mcpSsh.GuardRejectionError(verdict);
+  }
+}
+async function runFixedScript(host, script, stdin) {
+  const output = await host.runProcess({
+    script,
+    stdin,
+    timeoutMs: host.profile.policy.execTimeoutMs,
+    maxCapturedBytes: METADATA_CAPTURE_BYTES
+  });
+  if (output.timedOut == true) {
+    throw new Error(`timed out after ${host.profile.policy.execTimeoutMs}ms`);
+  }
+  if (output.exitCode !== 0) {
+    const detail = output.stderr.toString("utf8").trim();
+    throw new Error(detail === "" ? `exit code ${output.exitCode}` : detail);
+  }
+  return output.stdout;
+}
+var ENTRY_TYPES = {
+  f: "file",
+  d: "directory",
+  l: "symlink"
+};
+async function listDirectory(host, distroPath) {
+  requirePermittedPath(host, distroPath, "read");
+  const quotedPath = quoteShellArgument(distroPath);
+  const findPrefix = `find ${quotedPath} -mindepth 1 -maxdepth 1`;
+  const script = [
+    `test -d ${quotedPath} || { echo 'not a directory' >&2; exit 2; }`,
+    // First line: the true entry count. The listing itself is bounded with `head`, so
+    // a directory of a million files costs the distro a `find`, not this server 4 MB.
+    `${findPrefix} -printf x | wc -c`,
+    // One line per entry: type \t mode \t size \t mtime \t name. `-printf` never quotes,
+    // and a name cannot contain a newline in any directory a tool should be listing.
+    `${findPrefix} -printf '%y\\t%m\\t%s\\t%TY-%Tm-%TdT%TH:%TM:%.2TS\\t%f\\n' | head -n ${MAX_DIRECTORY_ENTRIES + 1}`
+  ].join("\n");
+  const stdout = await runFixedScript(host, script);
+  const [countLine, ...lines] = stdout.toString("utf8").split("\n").filter((line) => line !== "");
+  const reportedCount = Number(countLine) || 0;
+  const entries = [];
+  for (const line of lines) {
+    const [typeLetter, mode, size, modifiedAt, ...nameParts] = line.split("	");
+    const name = nameParts.join("	");
+    if (name == null || name === "") {
+      continue;
+    }
+    entries.push({
+      name,
+      type: ENTRY_TYPES[typeLetter] ?? "other",
+      sizeBytes: Number(size) || 0,
+      mode: `0${mode}`,
+      modifiedAt
+    });
+  }
+  entries.sort((left, right) => {
+    if (left.type === "directory" && right.type !== "directory") {
+      return -1;
+    }
+    if (left.type !== "directory" && right.type === "directory") {
+      return 1;
+    }
+    return left.name.localeCompare(right.name);
+  });
+  const totalCount = Math.max(reportedCount, entries.length);
+  const truncated = totalCount > MAX_DIRECTORY_ENTRIES;
+  return {
+    entries: entries.slice(0, MAX_DIRECTORY_ENTRIES),
+    totalCount,
+    truncated
+  };
+}
+async function readFile(host, distroPath, maxBytes) {
+  requirePermittedPath(host, distroPath, "read");
+  const quotedPath = quoteShellArgument(distroPath);
+  const statScript = [
+    `test -e ${quotedPath} || { echo 'no such file' >&2; exit 2; }`,
+    `test -d ${quotedPath} && { echo 'is a directory' >&2; exit 2; }`,
+    `stat -c %s ${quotedPath}`
+  ].join("\n");
+  const sizeBytes = Number((await runFixedScript(host, statScript)).toString("utf8").trim()) || 0;
+  const probeBytes = maxBytes + 1;
+  const output = await host.runProcess({
+    script: `head -c ${probeBytes} ${quotedPath}`,
+    timeoutMs: host.profile.policy.execTimeoutMs,
+    maxCapturedBytes: probeBytes
+  });
+  if (output.exitCode !== 0 && output.capExceeded == false) {
+    throw new Error(output.stderr.toString("utf8").trim() || `exit code ${output.exitCode}`);
+  }
+  const truncated = output.stdout.length > maxBytes;
+  const kept = output.stdout.subarray(0, maxBytes);
+  return {
+    content: kept.toString("utf8"),
+    sizeBytes,
+    readBytes: kept.length,
+    truncated
+  };
+}
+async function writeFile(host, args) {
+  const { distroPath, content, append } = args;
+  requirePermittedPath(host, distroPath, "write");
+  const payload = Buffer.from(content, "utf8");
+  const quotedPath = quoteShellArgument(distroPath);
+  let redirection = ">";
+  if (append == true) {
+    redirection = ">>";
+  }
+  await runFixedScript(host, `cat ${redirection} ${quotedPath}`, payload);
+  return payload.length;
+}
+async function uploadFile(host, localPath, distroPath) {
+  requirePermittedPath(host, distroPath, "write");
+  const localStats = fs__default.default.statSync(localPath);
+  if (localStats.isFile() == false) {
+    throw new Error(`local path is not a regular file: ${localPath}`);
+  }
+  const stream = fs__default.default.createReadStream(localPath);
+  try {
+    await runFixedScript(host, `cat > ${quoteShellArgument(distroPath)}`, stream);
+  } finally {
+    stream.destroy();
+  }
+  return localStats.size;
+}
+async function downloadFile(host, distroPath, localPath) {
+  requirePermittedPath(host, distroPath, "read");
+  const parent = path__default.default.dirname(localPath);
+  if (fs__default.default.existsSync(parent) == false) {
+    throw new Error(`local directory does not exist: ${parent}`);
+  }
+  const quotedPath = quoteShellArgument(distroPath);
+  const script = [
+    `test -f ${quotedPath} || { echo 'not a regular file' >&2; exit 2; }`,
+    `cat ${quotedPath}`
+  ].join("\n");
+  const sink = fs__default.default.createWriteStream(localPath);
+  let output;
+  try {
+    output = await host.runProcess({
+      script,
+      stdoutSink: sink,
+      timeoutMs: host.profile.policy.execTimeoutMs,
+      maxCapturedBytes: METADATA_CAPTURE_BYTES
+    });
+    if (output.timedOut == true) {
+      throw new Error(`timed out after ${host.profile.policy.execTimeoutMs}ms; the partial file was removed`);
+    }
+    if (output.exitCode !== 0) {
+      throw new Error(output.stderr.toString("utf8").trim() || `exit code ${output.exitCode}`);
+    }
+  } catch (ex) {
+    await new Promise((resolve) => {
+      sink.end(resolve);
+    });
+    fs__default.default.rmSync(localPath, { force: true });
+    throw ex;
+  }
+  await new Promise((resolve) => {
+    sink.end(resolve);
+  });
+  return output.sinkBytes;
+}
+var LISTING_TIMEOUT_MS = 1e4;
+var PROBE_CAPTURE_BYTES = 64 * 1024;
+var LISTING_ROW_PATTERN = /^\s*\*?\s*(.+?)\s+(Running|Stopped|Installing)\s+(\d)\s*$/;
+async function queryDistroListing(distro) {
+  const _logger = $logger.child({ context: "queryDistroListing", distro });
+  const listing = await new Promise((resolve, reject) => {
+    const child = child_process.spawn(WSL_EXECUTABLE, ["-l", "-v"], {
+      env: { ...process.env, WSL_UTF8: "1" },
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true
+    });
+    const chunks = [];
+    const timer = setTimeout(() => {
+      child.kill();
+    }, LISTING_TIMEOUT_MS);
+    timer.unref();
+    child.stdout.on("data", (chunk) => {
+      chunks.push(chunk);
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.on("close", () => {
+      clearTimeout(timer);
+      resolve(Buffer.concat(chunks).toString("utf8"));
+    });
+  });
+  for (const line of listing.split(/\r?\n/)) {
+    const match = LISTING_ROW_PATTERN.exec(line);
+    if (match == null) {
+      continue;
+    }
+    if (match[1].toLowerCase() !== distro.toLowerCase()) {
+      continue;
+    }
+    return {
+      installed: true,
+      state: match[2],
+      wslVersion: Number(match[3])
+    };
+  }
+  _logger.warn("distro not present in wsl -l -v");
+  return { installed: false, state: "unknown" };
+}
+async function probeDistroFacts(host) {
+  const script = [
+    `printf 'mode=%s\\n' "$(wslinfo --networking-mode 2>/dev/null || echo unknown)"`,
+    `printf 'init=%s\\n' "$(ps -p 1 -o comm= 2>/dev/null || echo unknown)"`,
+    `printf 'kernel=%s\\n' "$(uname -r 2>/dev/null || echo unknown)"`
+  ].join("\n");
+  const output = await host.runProcess({
+    script,
+    timeoutMs: LISTING_TIMEOUT_MS,
+    maxCapturedBytes: PROBE_CAPTURE_BYTES
+  });
+  const facts = {};
+  for (const line of output.stdout.toString("utf8").split("\n")) {
+    const [key, ...rest] = line.split("=");
+    const value = rest.join("=").trim();
+    if (key === "mode") {
+      facts.networkingMode = value;
+    } else if (key === "init") {
+      facts.systemd = value === "systemd";
+    } else if (key === "kernel") {
+      facts.kernel = value;
+    }
+  }
+  return facts;
+}
+
+// src/modules/tools/format.ts
+var ENTRY_TYPE_MARKERS = {
+  file: "-",
+  directory: "d",
+  symlink: "l",
+  other: "?"
+};
+function formatHostProfile(profile, status) {
+  if (profile == null) {
+    return [
+      "No WSL distro is registered.",
+      "",
+      "Put the distro in this server's MCP entry \u2014 one server entry per distro and user:",
+      "",
+      `    "env": {`,
+      `        "${SINGLE_HOST_ENV.DISTRO}": "ubuntu",`,
+      `        "${SINGLE_HOST_ENV.USER}": "root"`,
+      "    }",
+      "",
+      `${SINGLE_HOST_ENV.DISTRO} is the whole minimum (the name as 'wsl -l -q' prints it); ${SINGLE_HOST_ENV.USER} defaults to the distro's default user.`,
+      "Restart this server after changing it \u2014 environment variables are fixed for the life of the process."
+    ].join("\n");
+  }
+  const summary = toHostSummary(profile);
+  let accessLabel = "writable";
+  if (summary.readonly == true) {
+    accessLabel = "READ-ONLY";
+  }
+  let sudoLabel = "sudo=disabled";
+  if (summary.allowSudo == true) {
+    sudoLabel = "sudo=enabled";
+  }
+  let windowsLabel = "windows=locked (no interop .exe, no writes under /mnt/<drive>/)";
+  if (summary.allowWindows == true) {
+    windowsLabel = "windows=open (interop .exe and /mnt/<drive>/ writes allowed; operator credential and MCP config paths still refused)";
+  }
+  const lines = [];
+  lines.push(`${summary.name}  \u2192  ${summary.username}@${summary.distro} (WSL, this machine)  ${accessLabel}  ${sudoLabel}`);
+  lines.push(`    ${windowsLabel}`);
+  if (summary.description != null) {
+    lines.push(`    ${summary.description}`);
+  }
+  if (status != null) {
+    lines.push(`    ${formatDistroStatus(status)}`);
+  }
+  if (summary.allowedPaths.length > 0) {
+    lines.push(`    file tools limited to: ${summary.allowedPaths.join(", ")} (does not restrict wsl_exec)`);
+  }
+  if (summary.allowCommands.length > 0) {
+    lines.push(`    commands limited to: ${summary.allowCommands.join(", ")}`);
+  }
+  return lines.join("\n");
+}
+function formatDistroStatus(status) {
+  if (status.installed == false) {
+    return "distro: NOT FOUND in 'wsl -l -v' \u2014 check the name (wsl -l -q) and the WSL_DISTRO variable";
+  }
+  const parts = [`distro: ${status.state}`];
+  if (status.wslVersion != null) {
+    parts.push(`WSL ${status.wslVersion}`);
+  }
+  if (status.networkingMode != null) {
+    parts.push(`networking ${status.networkingMode}`);
+  }
+  if (status.systemd != null) {
+    if (status.systemd == true) {
+      parts.push("systemd");
+    } else {
+      parts.push("no systemd");
+    }
+  }
+  if (status.kernel != null) {
+    parts.push(`kernel ${status.kernel}`);
+  }
+  if (status.state === "Stopped") {
+    parts.push("(the first command will start it)");
+  }
+  return parts.join("  \xB7  ");
+}
+function formatExecResult(result, timeoutMs) {
+  const headerParts = [];
+  if (result.exitCode != null) {
+    headerParts.push(`exit code: ${result.exitCode}`);
+  } else {
+    headerParts.push("exit code: none (killed)");
+  }
+  if (result.signal != null) {
+    headerParts.push(`signal: ${result.signal}`);
+  }
+  headerParts.push(`${result.durationMs}ms`);
+  if (result.cwd != null) {
+    headerParts.push(`cwd: ${result.cwd}`);
+  }
+  const lines = [headerParts.join("  \xB7  ")];
+  if (result.timedOut == true) {
+    lines.push(`TIMED OUT after ${timeoutMs}ms \u2014 wsl.exe was killed, but the process inside the distro may still be running.`);
+  }
+  if (result.truncated == true) {
+    lines.push("Output was truncated; narrow the command (grep / head / tail) or raise WSL_MAX_OUTPUT for this profile.");
+  }
+  lines.push("");
+  lines.push("--- stdout ---");
+  if (result.stdout === "") {
+    lines.push("(empty)");
+  } else {
+    lines.push(result.stdout);
+  }
+  if (result.stderr !== "") {
+    lines.push("");
+    lines.push("--- stderr ---");
+    lines.push(result.stderr);
+  }
+  return lines.join("\n");
+}
+function formatGuardRejection(action, verdict) {
+  const lines = [`Blocked by the host profile's guard policy: ${verdict.reason}`];
+  if (verdict.offendingText != null && verdict.offendingText !== action) {
+    lines.push(`Offending part: ${verdict.offendingText}`);
+  }
+  lines.push(`Requested: ${action}`);
+  lines.push("Nothing was run in the distro. Adjust the request, or relax the profile's policy in the MCP entry.");
+  return lines.join("\n");
+}
+function formatSessionList(sessions) {
+  if (sessions.length === 0) {
+    return "No open WSL sessions. Open one with wsl_connect, or omit 'session' to run a one-off command.";
+  }
+  const lines = [`${sessions.length} open WSL session(s):`];
+  const now = Date.now();
+  for (const session of sessions) {
+    const idleSeconds = Math.round((now - new Date(session.lastUsedAt).getTime()) / 1e3);
+    lines.push("");
+    lines.push(`${session.sessionId}  \u2192  ${session.username}@${session.distro}  profile: ${session.profileName}`);
+    lines.push(`    cwd: ${session.cwd}  \xB7  ${session.execCount} command(s)  \xB7  idle ${idleSeconds}s  \xB7  opened ${session.openedAt}`);
+  }
+  return lines.join("\n");
+}
+function formatDirectoryListing(distroPath, listing) {
+  if (listing.totalCount === 0) {
+    return `${distroPath} is empty.`;
+  }
+  let header = `${distroPath} \u2014 ${listing.totalCount} entrie(s):`;
+  if (listing.truncated == true) {
+    header = `${distroPath} \u2014 ${listing.totalCount} entrie(s), showing the first ${listing.entries.length}:`;
+  }
+  const lines = [header, ""];
+  for (const entry of listing.entries) {
+    const marker = ENTRY_TYPE_MARKERS[entry.type];
+    const size = formatBytes(entry.sizeBytes).padStart(9);
+    let name = entry.name;
+    if (entry.type === "directory") {
+      name = `${entry.name}/`;
+    }
+    lines.push(`${marker}  ${entry.mode}  ${size}  ${entry.modifiedAt}  ${name}`);
+  }
+  if (listing.truncated == true) {
+    lines.push("");
+    lines.push("Listing was capped; narrow the path or filter with wsl_exec if you need the rest.");
+  }
+  return lines.join("\n");
+}
+
+// src/modules/tools/tool-context.ts
+function textResult(text) {
+  return { content: [{ type: "text", text }] };
+}
+function errorResult(message) {
+  return { content: [{ type: "text", text: message }], isError: true };
+}
+function describeError2(error) {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return String(error);
+}
+function toToolError(error, toolName, action) {
+  const _logger = $logger.child({ context: toolName });
+  if (error instanceof mcpSsh.GuardRejectionError) {
+    _logger.warn("rejected by the guard", { reason: error.verdict.reason, action });
+    const rendered = formatGuardRejection(action, error.verdict);
+    return errorResult(rendered);
+  }
+  _logger.error(error, `${toolName} failed`);
+  return errorResult(`${toolName} failed: ${describeError2(error)}`);
+}
+function resolveHost(context, args) {
+  const hasSession = args.session != null && args.session.trim() !== "";
+  if (hasSession == true) {
+    const session = context.sessions.require(args.session.trim());
+    return { host: session.host, session };
+  }
+  if (context.host == null) {
+    throw new Error(`no distro is registered \u2014 set ${SINGLE_HOST_ENV.DISTRO} (and optionally ${SINGLE_HOST_ENV.USER}) in this server's env block, then restart it`);
+  }
+  return { host: context.host, session: null };
+}
+
+// src/modules/tools/exec-tools.ts
+function registerExecTools(server, context) {
+  server.registerTool(
+    "wsl_exec",
+    {
+      title: "Run a command in WSL",
+      description: [
+        "Run a shell command in the configured WSL distro (as the configured user, in a login bash) and return stdout, stderr and the exit code.",
+        "Pass 'session' to reuse a session, which remembers its working directory; omit it for a one-off call.",
+        "A non-zero exit code is reported as normal output, not as a tool error \u2014 read the exit code and stderr to judge the outcome.",
+        "Almost everything is permitted: package installs, service restarts, sudo, interpreters. Refused outright: catastrophic operations (wiping the filesystem root, formatting a disk, powering off or shutting down the distro), and \u2014 unless the profile opens them \u2014 Windows interop executables and writes under /mnt/<drive>/.",
+        "stdin is closed. A job that must outlive the call needs all three descriptors detached: nohup cmd > log 2>&1 < /dev/null &"
+      ].join(" "),
+      inputSchema: {
+        command: zod.z.string().min(1).describe("Shell command, exactly as it would be typed in a terminal. Chaining with ';', '&&', '||' and pipes is allowed; each part is screened separately."),
+        session: zod.z.string().optional().describe("Session id from wsl_connect. Keeps the working directory across calls."),
+        cwd: zod.z.string().optional().describe("Absolute directory to run in, with no shell metacharacters. With a session, the session also moves there."),
+        timeoutMs: zod.z.number().int().positive().optional().describe("Lowers the command timeout for this call; it cannot exceed the profile's own limit. wsl.exe is killed when it elapses; the process inside the distro may survive.")
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true
+      }
+    },
+    async ({ command, session, cwd, timeoutMs }) => {
+      let _logger = $logger.child({ context: "wsl_exec" });
+      try {
+        const { host, session: openSession } = resolveHost(context, { session });
+        const profile = host.profile;
+        _logger = _logger.child({ profile: profile.name, session_id: openSession?.sessionId });
+        const requestedTimeoutMs = timeoutMs ?? profile.policy.execTimeoutMs;
+        const effectiveTimeoutMs = Math.min(requestedTimeoutMs, profile.policy.execTimeoutMs);
+        let requestedCwd = void 0;
+        if (cwd != null && cwd.trim() !== "") {
+          requestedCwd = cwd.trim();
+        }
+        _logger.debug("running command", { command, timeout_ms: effectiveTimeoutMs });
+        let result;
+        if (openSession != null) {
+          result = await openSession.exec(command, { cwd: requestedCwd, timeoutMs: effectiveTimeoutMs });
+        } else {
+          result = await host.exec({
+            command,
+            cwd: requestedCwd ?? profile.defaultCwd,
+            timeoutMs: effectiveTimeoutMs,
+            maxOutputCharacters: profile.policy.maxOutputCharacters,
+            trackCwd: false
+          });
+        }
+        _logger.info("command finished", {
+          exit_code: result.exitCode,
+          duration_ms: result.durationMs,
+          timed_out: result.timedOut
+        });
+        return textResult(formatExecResult(result, effectiveTimeoutMs));
+      } catch (ex) {
+        return toToolError(ex, "wsl_exec", command);
+      }
+    }
+  );
+}
+var SESSION_DESCRIPTION = "Session id from wsl_connect. Optional \u2014 the file tools do not depend on a session's working directory, paths are absolute.";
+function requirePermittedLocalPath(localPath, access) {
+  const verdict = mcpSsh.inspectLocalPath(localPath, access);
+  if (verdict.allowed == false) {
+    throw new mcpSsh.GuardRejectionError(verdict);
+  }
+}
+function registerFileTools(server, context) {
+  server.registerTool(
+    "wsl_list_dir",
+    {
+      title: "List a directory in WSL",
+      description: [
+        "List a directory in the distro, with type, permissions, size and mtime.",
+        "Cheaper and more structured than running 'ls -la' through wsl_exec, and it works on a read-only profile."
+      ].join(" "),
+      inputSchema: {
+        path: zod.z.string().min(1).describe("Absolute directory path in the distro. When WSL_ALLOWED_PATHS is set, only paths inside it are accepted."),
+        session: zod.z.string().optional().describe(SESSION_DESCRIPTION)
+      },
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: true
+      }
+    },
+    async ({ path: distroPath, session }) => {
+      const _logger = $logger.child({ context: "wsl_list_dir", distro_path: distroPath });
+      try {
+        const { host } = resolveHost(context, { session });
+        const listing = await listDirectory(host, distroPath);
+        _logger.info("directory listed", { entry_count: listing.totalCount, truncated: listing.truncated });
+        return textResult(formatDirectoryListing(distroPath, listing));
+      } catch (ex) {
+        return toToolError(ex, "wsl_list_dir", `list ${distroPath}`);
+      }
+    }
+  );
+  server.registerTool(
+    "wsl_read_file",
+    {
+      title: "Read a file in WSL",
+      description: [
+        "Read a text file in the distro and return its contents.",
+        "Oversized files come back truncated to their leading bytes rather than failing, so pointing this at a large log is safe.",
+        "Files that report size 0 but hold content (/proc, /sys) are read in full up to the ceiling."
+      ].join(" "),
+      inputSchema: {
+        path: zod.z.string().min(1).describe("Absolute file path in the distro."),
+        session: zod.z.string().optional().describe(SESSION_DESCRIPTION),
+        maxBytes: zod.z.number().int().positive().optional().describe("Lowers the read ceiling for this call; it cannot exceed WSL_MAX_READ_BYTES.")
+      },
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: true
+      }
+    },
+    async ({ path: distroPath, session, maxBytes }) => {
+      const _logger = $logger.child({ context: "wsl_read_file", distro_path: distroPath });
+      try {
+        const { host } = resolveHost(context, { session });
+        const requestedLimit = maxBytes ?? host.profile.policy.maxReadFileBytes;
+        const readLimit = Math.min(requestedLimit, host.profile.policy.maxReadFileBytes);
+        const file = await readFile(host, distroPath, readLimit);
+        let header = `${distroPath} \u2014 ${formatBytes(file.readBytes)} read`;
+        if (file.sizeBytes > 0) {
+          header = `${distroPath} \u2014 ${formatBytes(file.sizeBytes)}`;
+        }
+        if (file.truncated == true) {
+          header += `, truncated to the first ${formatBytes(file.readBytes)}`;
+        }
+        _logger.info("file read", { size_bytes: file.sizeBytes, read_bytes: file.readBytes, truncated: file.truncated });
+        return textResult(`${header}
+
+${file.content}`);
+      } catch (ex) {
+        return toToolError(ex, "wsl_read_file", `read ${distroPath}`);
+      }
+    }
+  );
+  server.registerTool(
+    "wsl_write_file",
+    {
+      title: "Write a file in WSL",
+      description: [
+        "Write or append UTF-8 text to a file in the distro. The content never passes through a shell, so quoting is not a concern.",
+        "Prefer this over heredocs in wsl_exec. Parent directories must exist. Refused on a read-only profile, and under /mnt/<drive>/ unless the profile allows Windows writes."
+      ].join(" "),
+      inputSchema: {
+        path: zod.z.string().min(1).describe("Absolute file path in the distro."),
+        content: zod.z.string().describe("Text to write."),
+        append: zod.z.boolean().optional().describe("Append instead of overwrite. Default false."),
+        session: zod.z.string().optional().describe(SESSION_DESCRIPTION)
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true
+      }
+    },
+    async ({ path: distroPath, content, append, session }) => {
+      const _logger = $logger.child({ context: "wsl_write_file", distro_path: distroPath });
+      try {
+        const { host } = resolveHost(context, { session });
+        const written = await writeFile(host, { distroPath, content, append: append ?? false });
+        let verb = "Wrote";
+        if (append == true) {
+          verb = "Appended";
+        }
+        _logger.info("file written", { bytes: written, append: append ?? false });
+        return textResult(`${verb} ${formatBytes(written)} to ${distroPath}`);
+      } catch (ex) {
+        return toToolError(ex, "wsl_write_file", `write ${distroPath}`);
+      }
+    }
+  );
+  server.registerTool(
+    "wsl_upload",
+    {
+      title: "Upload a file into WSL",
+      description: [
+        "Copy a file from this machine into the distro. The local path is resolved on the Windows side (a POSIX-looking path becomes <current drive>\\\u2026), and the reply prints it \u2014 check it.",
+        "Credential files and MCP configuration on the local side are refused."
+      ].join(" "),
+      inputSchema: {
+        localPath: zod.z.string().min(1).describe("Path on this machine, '~' expanded."),
+        remotePath: zod.z.string().min(1).describe("Absolute destination path in the distro (the file, not its directory)."),
+        session: zod.z.string().optional().describe(SESSION_DESCRIPTION)
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true
+      }
+    },
+    async ({ localPath, remotePath, session }) => {
+      const resolvedLocalPath = expandHomePath(localPath);
+      const _logger = $logger.child({ context: "wsl_upload", local_path: resolvedLocalPath, distro_path: remotePath });
+      try {
+        requirePermittedLocalPath(resolvedLocalPath, "read");
+        const { host } = resolveHost(context, { session });
+        const sent = await uploadFile(host, resolvedLocalPath, remotePath);
+        _logger.info("file uploaded", { bytes: sent });
+        return textResult(`Uploaded ${formatBytes(sent)}: ${resolvedLocalPath} \u2192 ${remotePath}`);
+      } catch (ex) {
+        return toToolError(ex, "wsl_upload", `upload ${resolvedLocalPath} to ${remotePath}`);
+      }
+    }
+  );
+  server.registerTool(
+    "wsl_download",
+    {
+      title: "Download a file from WSL",
+      description: [
+        "Copy a file from the distro to this machine. The local path is resolved on the Windows side and printed in the reply \u2014 check it.",
+        "The destination directory must already exist; credential locations and MCP configuration on the local side are refused."
+      ].join(" "),
+      inputSchema: {
+        remotePath: zod.z.string().min(1).describe("Absolute source path in the distro."),
+        localPath: zod.z.string().min(1).describe("Destination path on this machine, '~' expanded."),
+        session: zod.z.string().optional().describe(SESSION_DESCRIPTION)
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true
+      }
+    },
+    async ({ remotePath, localPath, session }) => {
+      const resolvedLocalPath = expandHomePath(localPath);
+      const _logger = $logger.child({ context: "wsl_download", local_path: resolvedLocalPath, distro_path: remotePath });
+      try {
+        requirePermittedLocalPath(resolvedLocalPath, "write");
+        const { host } = resolveHost(context, { session });
+        const received = await downloadFile(host, remotePath, resolvedLocalPath);
+        _logger.info("file downloaded", { bytes: received });
+        return textResult(`Downloaded ${formatBytes(received)}: ${remotePath} \u2192 ${resolvedLocalPath}`);
+      } catch (ex) {
+        return toToolError(ex, "wsl_download", `download ${remotePath} to ${resolvedLocalPath}`);
+      }
+    }
+  );
+}
+
+// src/modules/tools/host-tools.ts
+function registerHostTools(server, context) {
+  server.registerTool(
+    "wsl_list_hosts",
+    {
+      title: "Show the WSL distro",
+      description: [
+        "Show the WSL distro and user this server runs commands in, with its guard policy and current state (running or stopped, WSL version, networking mode, whether systemd is PID 1).",
+        "Call this first: it is the only reachable distro, and its policy decides what the other tools will accept.",
+        "The networking mode matters when reasoning about ports \u2014 in mirrored mode a port Windows holds cannot be bound inside the distro, and a listing inside the distro shows only its own namespace."
+      ].join(" "),
+      inputSchema: {},
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      }
+    },
+    async () => {
+      const _logger = $logger.child({ context: "wsl_list_hosts" });
+      try {
+        const host = context.host;
+        let status = null;
+        if (host != null) {
+          status = await queryDistroListing(host.profile.distro);
+          if (status.installed == true && status.state === "Running") {
+            const facts = await probeDistroFacts(host);
+            status = { ...status, ...facts };
+          }
+        }
+        const listing = formatHostProfile(host?.profile ?? null, status);
+        _logger.debug("host profile returned", { profile: host?.profile.name, state: status?.state });
+        return textResult(listing);
+      } catch (ex) {
+        return toToolError(ex, "wsl_list_hosts", "show the distro");
+      }
+    }
+  );
+}
+function registerSessionTools(server, context) {
+  server.registerTool(
+    "wsl_connect",
+    {
+      title: "Open a WSL session",
+      description: [
+        "Open a session in the configured distro and return its session id.",
+        "A session remembers the working directory, so a 'cd' in one wsl_exec still applies to the next. Each command is still its own process \u2014 nothing else (environment variables, background jobs) persists between calls.",
+        "Close it with wsl_disconnect when done; idle sessions are forgotten automatically."
+      ].join(" "),
+      inputSchema: {
+        cwd: zod.z.string().optional().describe("Absolute directory to start in, with no shell metacharacters. Defaults to WSL_CWD, else the login shell's directory.")
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: true
+      }
+    },
+    async ({ cwd }) => {
+      let _logger = $logger.child({ context: "wsl_connect" });
+      let openedSessionId = null;
+      try {
+        const { host } = resolveHost(context, {});
+        const session = context.sessions.open(host);
+        openedSessionId = session.sessionId;
+        _logger = _logger.child({ session_id: session.sessionId });
+        if (cwd != null && cwd.trim() !== "") {
+          session.cwd = cwd.trim();
+        }
+        const probe = await session.exec("pwd");
+        const probeSucceeded = probe.exitCode === 0 && probe.timedOut == false;
+        if (probeSucceeded == false) {
+          context.sessions.close(session.sessionId);
+          openedSessionId = null;
+          _logger.warn("session probe failed, closing the session", {
+            exit_code: probe.exitCode,
+            timed_out: probe.timedOut,
+            stderr: probe.stderr
+          });
+          return errorResult(`wsl_connect failed: could not confirm the starting directory.
+${probe.stderr.trim()}`);
+        }
+        const profile = host.profile;
+        const lines = [
+          `Opened session ${session.sessionId} \u2192 ${profile.username ?? "(distro default)"}@${profile.distro}`,
+          `cwd: ${session.cwd}`
+        ];
+        if (profile.policy.readonly == true) {
+          lines.push("This distro is READ-ONLY: writes, redirections and uploads will be rejected.");
+        }
+        lines.push(`Run commands with wsl_exec({ session: "${session.sessionId}", command: "..." }).`);
+        _logger.info("session opened via tool", { cwd: session.cwd });
+        return textResult(lines.join("\n"));
+      } catch (ex) {
+        if (openedSessionId != null) {
+          context.sessions.close(openedSessionId);
+        }
+        return toToolError(ex, "wsl_connect", "open a session");
+      }
+    }
+  );
+  server.registerTool(
+    "wsl_disconnect",
+    {
+      title: "Close a WSL session",
+      description: "Close a session opened with wsl_connect. Nothing in the distro is affected \u2014 only this server's memory of the working directory.",
+      inputSchema: {
+        session: zod.z.string().min(1).describe("Session id from wsl_connect.")
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      }
+    },
+    async ({ session }) => {
+      const _logger = $logger.child({ context: "wsl_disconnect", session_id: session });
+      try {
+        const closed = context.sessions.close(session.trim());
+        if (closed == false) {
+          return errorResult(`no open session '${session}'`);
+        }
+        _logger.info("session closed via tool");
+        return textResult(`Closed session ${session}.`);
+      } catch (ex) {
+        return toToolError(ex, "wsl_disconnect", `close session ${session}`);
+      }
+    }
+  );
+  server.registerTool(
+    "wsl_list_sessions",
+    {
+      title: "List open WSL sessions",
+      description: "List the sessions this server holds, with their working directory, command count and idle time.",
+      inputSchema: {},
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      }
+    },
+    async () => {
+      try {
+        return textResult(formatSessionList(context.sessions.list()));
+      } catch (ex) {
+        return toToolError(ex, "wsl_list_sessions", "list sessions");
+      }
+    }
+  );
+}
+
+// src/modules/tools/index.ts
+function registerAllTools(server, context) {
+  registerHostTools(server, context);
+  registerSessionTools(server, context);
+  registerExecTools(server, context);
+  registerFileTools(server, context);
+}
+
+// src/server.ts
+var SERVER_INSTRUCTIONS = [
+  "This server runs shell commands and transfers files in one WSL distro on this machine, through wsl.exe \u2014 no SSH, no network.",
+  "The distro and the Linux user are fixed in this server's own environment \u2014 there is no distro or user argument, and no other machine is reachable through it.",
+  "",
+  "wsl_list_hosts shows which distro and user this is, whether the distro is running, its networking mode, and what it permits. Call it before assuming anything about access or ports.",
+  "",
+  "Workflow:",
+  "1. One command: wsl_exec with just 'command'.",
+  "2. Several commands in a row: wsl_connect once, then wsl_exec with 'session' (the working directory persists across calls), then wsl_disconnect. Only the directory persists \u2014 each command is its own process.",
+  "3. Files: wsl_list_dir, wsl_read_file, wsl_write_file, wsl_upload, wsl_download \u2014 prefer these over shell equivalents; no quoting to get wrong.",
+  "",
+  "What is permitted: ordinary administration, without asking \u2014 package installs, service restarts, sudo, interpreters, config edits, deployments.",
+  "Refused always: operations that destroy the distro or cut this channel \u2014 wiping the filesystem root or a system directory, deleting a file the distro cannot boot without, formatting a disk, writing raw bytes to a block device, powering off, wsl --shutdown / --terminate / --unregister, flushing the firewall, removing every cron job.",
+  "Refused unless the profile opens them (WSL_ALLOW_WINDOWS): running Windows executables through interop (powershell.exe, cmd.exe, any .exe) and writing under /mnt/<drive>/. Reading under /mnt/<drive>/ is allowed. The operator's credential files and MCP configuration under /mnt/ are refused regardless \u2014 those define this very guard.",
+  "The profile may add its own limits (read-only, an allow-list, deny patterns, path restrictions). wsl_list_hosts shows which apply.",
+  "",
+  "Commands run in a login bash with no terminal and with stdin closed, so anything that waits for input fails immediately instead of hanging: use non-interactive flags (apt-get -y, sudo -n), 'top -bn1' rather than 'top', and wsl_write_file rather than an editor.",
+  "A job that may outlive its timeout must be detached with all three descriptors redirected \u2014 nohup cmd > log 2>&1 < /dev/null & \u2014 otherwise wsl.exe waits on the open pipe until the timeout. Poll it through its log.",
+  "",
+  "A guard rejection is a policy decision, not a transient failure \u2014 do not retry the same command; report it and ask before working around it.",
+  "A non-zero exit code is returned as normal output; read it and stderr to judge what happened.",
+  "You still carry the judgement the guards do not: this is a real host, and an irreversible action deserves a check with the operator first."
+].join("\n");
+function createWslMcpServer() {
+  const _logger = $logger.child({ context: "createWslMcpServer" });
+  const profile = loadHostProfile();
+  let host = null;
+  if (profile != null) {
+    host = new WslHost(profile);
+  }
+  const sessions = new WslSessionManager();
+  sessions.startIdleSweeper();
+  const server = new mcp_js.McpServer(
+    {
+      name: SERVER_NAME,
+      version: SERVER_VERSION
+    },
+    {
+      instructions: SERVER_INSTRUCTIONS
+    }
+  );
+  const context = {
+    host,
+    sessions
+  };
+  registerAllTools(server, context);
+  _logger.info("mcp server built", { profile: profile?.name ?? null });
+  return {
+    server,
+    sessions,
+    profile,
+    shutdown() {
+      sessions.stopIdleSweeper();
+      sessions.closeAll();
+    }
+  };
+}
+
+Object.defineProperty(exports, "GuardRejectionError", {
+  enumerable: true,
+  get: function () { return mcpSsh.GuardRejectionError; }
+});
+exports.$logger = $logger;
+exports.LOG_LEVEL_ENV = LOG_LEVEL_ENV;
+exports.SERVER_NAME = SERVER_NAME;
+exports.SERVER_VERSION = SERVER_VERSION;
+exports.SINGLE_HOST_ENV = SINGLE_HOST_ENV;
+exports.WslHost = WslHost;
+exports.WslSession = WslSession;
+exports.WslSessionManager = WslSessionManager;
+exports.buildDistroScript = buildDistroScript;
+exports.buildWslArguments = buildWslArguments;
+exports.createWslMcpServer = createWslMcpServer;
+exports.downloadFile = downloadFile;
+exports.extractCwdMarker = extractCwdMarker;
+exports.inspectWslCommand = inspectWslCommand;
+exports.inspectWslPath = inspectWslPath;
+exports.listDirectory = listDirectory;
+exports.loadHostProfile = loadHostProfile;
+exports.probeDistroFacts = probeDistroFacts;
+exports.queryDistroListing = queryDistroListing;
+exports.readFile = readFile;
+exports.registerAllTools = registerAllTools;
+exports.toHostSummary = toHostSummary;
+exports.uploadFile = uploadFile;
+exports.writeFile = writeFile;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map