@atlisp/mcp 1.8.20 → 1.8.23

package/dist/atlisp-mcp.js

@@ -64,6 +64,9 @@ function parseArgs() {
       i++;
     } else if (args[i] === "--no-lint" || args[i] === "--lint-off") {
       result.noLint = true;
+    } else if (args[i] === "--security-level" && args[i + 1]) {
+      result.securityLevel = args[i + 1];
+      i++;
     }
   }
   return result;
@@ -101,6 +104,9 @@ function reloadConfig() {
   configReloadLock = false;
   return false;
 }
+function onConfigChange(callback) {
+  configWatchers.push(callback);
+}
 var envSchema, configSchema, cliArgs, envResult, env, configFilePath, fileConfig, config, configWatchers, configReloadLock, config_default;
 var init_config = __esm({
   "src/config.js"() {
@@ -138,7 +144,8 @@ var init_config = __esm({
       LINT_PRESET: z.string().optional().default(""),
       LINT_CONFIG_PATH: z.string().optional().default(""),
       LINT_LEVEL: z.string().optional().default(""),
-      NO_LINT: z.string().optional().default("")
+      NO_LINT: z.string().optional().default(""),
+      SECURITY_LEVEL: z.string().optional().default("strict")
     });
     configSchema = z.object({
       port: z.number().optional(),
@@ -180,7 +187,8 @@ var init_config = __esm({
       lintPreset: z.string().optional(),
       lintConfigPath: z.string().optional(),
       lintLevel: z.string().optional(),
-      noLint: z.boolean().optional()
+      noLint: z.boolean().optional(),
+      securityLevel: z.enum(["strict", "standard", "relaxed"]).optional()
     });
     cliArgs = parseArgs();
     envResult = envSchema.safeParse(process.env);
@@ -227,7 +235,8 @@ var init_config = __esm({
       lintPreset: fileConfig?.lintPreset || cliArgs.lintPreset || env.LINT_PRESET || void 0,
       lintConfigPath: fileConfig?.lintConfigPath || cliArgs.lintConfigPath || env.LINT_CONFIG_PATH || void 0,
       lintLevel: fileConfig?.lintLevel || cliArgs.lintLevel || env.LINT_LEVEL || void 0,
-      noLint: fileConfig?.noLint ?? cliArgs.noLint ?? env.NO_LINT === "true"
+      noLint: fileConfig?.noLint ?? cliArgs.noLint ?? env.NO_LINT === "true",
+      securityLevel: fileConfig?.securityLevel ?? cliArgs.securityLevel ?? (env.SECURITY_LEVEL || "strict")
     };
     if (config.lintConfigPath) process.env.LINT_CONFIG_PATH = config.lintConfigPath;
     if (config.lintPreset) process.env.LINT_PRESET = config.lintPreset;
@@ -6365,6 +6374,89 @@ var init_lint_tools = __esm({
   }
 });
 
+// src/tools/debug-tools.js
+var tools41;
+var init_debug_tools = __esm({
+  "src/tools/debug-tools.js"() {
+    tools41 = [
+      {
+        name: "debug_start",
+        description: "\u542F\u52A8\u4EA4\u4E92\u5F0F\u8C03\u8BD5\u4F1A\u8BDD\u3002\u5C06\u4EE3\u7801\u6309\u5757\u62C6\u5206\u4E3A\u65AD\u70B9\u7EA7\u6267\u884C\uFF0C\u52A0\u8F7D\u8C03\u8BD5\u8F85\u52A9\u51FD\u6570\u5230 CAD\uFF0C\u8DF3\u8FC7\u975E\u65AD\u70B9\u524D\u7F6E\u5757",
+        inputSchema: {
+          type: "object",
+          properties: {
+            code: { type: "string", description: "\u539F\u59CB AutoLISP \u4EE3\u7801" },
+            chunks: {
+              type: "array",
+              description: "\u7531\u6269\u5C55\u7AEF\u62C6\u5206\u597D\u7684\u4EE3\u7801\u5757\u5217\u8868",
+              items: {
+                type: "object",
+                properties: {
+                  id: { type: "integer", description: "\u5757\u5E8F\u53F7 (1-based)" },
+                  line: { type: "integer", description: "\u6E90\u6587\u4EF6\u884C\u53F7" },
+                  code: { type: "string", description: "\u5757\u7684 AutoLISP \u4EE3\u7801" },
+                  vars: { type: "array", items: { type: "string" }, description: "\u8BE5\u5757\u9700\u6355\u83B7\u7684\u53D8\u91CF\u540D" },
+                  isBreakpoint: { type: "boolean", description: "\u8BE5\u884C\u6709\u65AD\u70B9" },
+                  isDefunStart: { type: "boolean", description: "\u662F defun \u5B9A\u4E49\u5F00\u5934" }
+                },
+                required: ["id", "line", "code", "vars", "isBreakpoint"]
+              }
+            },
+            encoding: { type: "string", description: "\u7F16\u7801\uFF08\u9ED8\u8BA4 auto\uFF09" }
+          },
+          required: ["code", "chunks"]
+        }
+      },
+      {
+        name: "debug_step",
+        description: "\u6267\u884C\u4E00\u6B65\uFF08step\uFF09\u6216\u7EE7\u7EED\u5230\u4E0B\u4E00\u65AD\u70B9\uFF08continue\uFF09",
+        inputSchema: {
+          type: "object",
+          properties: {
+            sessionId: { type: "string", description: "\u8C03\u8BD5\u4F1A\u8BDD ID" },
+            action: { type: "string", enum: ["step", "continue"], description: "step=\u6267\u884C\u4E00\u4E2A\u5757, continue=\u5230\u4E0B\u4E00\u65AD\u70B9/\u7ED3\u675F" }
+          },
+          required: ["sessionId", "action"]
+        }
+      },
+      {
+        name: "debug_evaluate",
+        description: "\u8C03\u8BD5\u6682\u505C\u65F6\u6C42\u503C AutoLISP \u8868\u8FBE\u5F0F",
+        inputSchema: {
+          type: "object",
+          properties: {
+            sessionId: { type: "string", description: "\u8C03\u8BD5\u4F1A\u8BDD ID" },
+            expression: { type: "string", description: "\u4EFB\u610F AutoLISP \u8868\u8FBE\u5F0F" }
+          },
+          required: ["sessionId", "expression"]
+        }
+      },
+      {
+        name: "debug_get_state",
+        description: "\u67E5\u8BE2\u8C03\u8BD5\u4F1A\u8BDD\u5F53\u524D\u72B6\u6001",
+        inputSchema: {
+          type: "object",
+          properties: {
+            sessionId: { type: "string", description: "\u8C03\u8BD5\u4F1A\u8BDD ID" }
+          },
+          required: ["sessionId"]
+        }
+      },
+      {
+        name: "debug_stop",
+        description: "\u505C\u6B62\u8C03\u8BD5\u4F1A\u8BDD\uFF0C\u6E05\u7406 CAD \u5168\u5C40\u53D8\u91CF\u548C\u8F85\u52A9\u51FD\u6570",
+        inputSchema: {
+          type: "object",
+          properties: {
+            sessionId: { type: "string", description: "\u8C03\u8BD5\u4F1A\u8BDD ID" }
+          },
+          required: ["sessionId"]
+        }
+      }
+    ];
+  }
+});
+
 // src/tools/index.js
 function addAnnotations(tool) {
   const isDeprecated = DEPRECATED_TOOLS.has(tool.name);
@@ -6389,7 +6481,7 @@ function addAnnotations(tool) {
     }
   };
 }
-var READ_ONLY_TOOLS, DEPRECATED_TOOLS, EXTRA_DESTRUCTIVE, IDEMPOTENT_WRITE_TOOLS, OPEN_WORLD_TOOLS, tools41, toolsByName;
+var READ_ONLY_TOOLS, DEPRECATED_TOOLS, EXTRA_DESTRUCTIVE, IDEMPOTENT_WRITE_TOOLS, OPEN_WORLD_TOOLS, tools42, toolsByName;
 var init_tools = __esm({
   "src/tools/index.js"() {
     init_cad_tools();
@@ -6432,6 +6524,7 @@ var init_tools = __esm({
     init_context_tools();
     init_batch_transaction_tools();
     init_lint_tools();
+    init_debug_tools();
     READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
       "get_cad_info",
       "get_platform_info",
@@ -6514,7 +6607,8 @@ var init_tools = __esm({
       "analyze_lisp_code",
       "format_lisp_code",
       "list_lint_rules",
-      "lint_project"
+      "lint_project",
+      "debug_get_state"
     ]);
     DEPRECATED_TOOLS = /* @__PURE__ */ new Set([]);
     EXTRA_DESTRUCTIVE = /* @__PURE__ */ new Set([
@@ -6570,7 +6664,7 @@ var init_tools = __esm({
       "import_page_setup",
       "load_linetype"
     ]);
-    tools41 = [
+    tools42 = [
       ...tools,
       ...tools2,
       ...tools3,
@@ -6610,9 +6704,10 @@ var init_tools = __esm({
       ...tools38,
       ...tools39,
       ...tools37,
-      ...tools40
+      ...tools40,
+      ...tools41
     ].map(addAnnotations);
-    toolsByName = new Map(tools41.map((t) => [t.name, t]));
+    toolsByName = new Map(tools42.map((t) => [t.name, t]));
   }
 });
 
@@ -6665,7 +6760,7 @@ function parseLispList(str) {
   });
 }
 function createMcpServer(handlers = {}) {
-  const { tools: tools42 = [], handleToolCall: handleToolCall2 = () => ({ content: [] }) } = handlers;
+  const { tools: tools43 = [], handleToolCall: handleToolCall2 = () => ({ content: [] }) } = handlers;
   const server = new Server(
     { name: SERVER_NAME, version: SERVER_VERSION },
     {
@@ -6688,8 +6783,8 @@ function createMcpServer(handlers = {}) {
     const params = request.params || {};
     const cursor = decodeCursor(params.cursor);
     const PAGE_SIZE = 100;
-    const page = tools42.slice(cursor, cursor + PAGE_SIZE);
-    const nextCursor = cursor + PAGE_SIZE < tools42.length ? encodeCursor(cursor + PAGE_SIZE) : void 0;
+    const page = tools43.slice(cursor, cursor + PAGE_SIZE);
+    const nextCursor = cursor + PAGE_SIZE < tools43.length ? encodeCursor(cursor + PAGE_SIZE) : void 0;
     return { tools: page, nextCursor };
   });
   server.setRequestHandler(CallToolRequestSchema, async (request) => {
@@ -7038,11 +7133,11 @@ function createMcpServer(handlers = {}) {
         if (p.toLowerCase().startsWith(prefix)) values.push(p);
       }
     } else if (ref?.type === "tool") {
-      for (const t of tools42) {
+      for (const t of tools43) {
         if (t.name.toLowerCase().startsWith(prefix)) values.push(t.name);
       }
     } else if (ref?.type === "ref/parameter") {
-      const toolDef = tools42.find((t) => t.name === ref.name);
+      const toolDef = tools43.find((t) => t.name === ref.name);
       if (toolDef?.inputSchema?.properties) {
         const paramName = argument.name;
         const paramDef = toolDef.inputSchema.properties[paramName];
@@ -8160,17 +8255,27 @@ function analyzeLispCode(code, options = {}) {
   if (process.env.NO_LINT === "true" && !options.force) {
     return { valid: true, errors: [], warnings: [], issues: [], summary: "lint \u5DF2\u8DF3\u8FC7" };
   }
+  const securityLevel = config_default?.securityLevel || "strict";
+  if (securityLevel === "relaxed" && !options.force) {
+    return { valid: true, errors: [], warnings: [], issues: [], summary: "\u5B89\u5168\u9650\u5236\u5DF2\u5173\u95ED (relaxed)" };
+  }
   try {
-    const config2 = options.lintConfig ? mergeConfig(getDefaultConfig(), options.lintConfig) : getDefaultConfig();
-    const lintIssues = runChecks(code, options.file || "<eval>", config2);
+    const lintConfig = options.lintConfig ? mergeConfig(getDefaultConfig(), options.lintConfig) : getDefaultConfig();
+    if (securityLevel === "standard") {
+      for (const key of Object.keys(REQUIRED_ERROR_CHECKS)) {
+        lintConfig.checks[key] = "warn";
+      }
+    }
+    const lintIssues = runChecks(code, options.file || "<eval>", lintConfig);
     for (const rule of CUSTOM_RULES) {
+      const effectiveSeverity = securityLevel === "standard" ? "warn" : rule.severity;
       const match = code.match(rule.re);
       if (match) {
         const line = code.slice(0, match.index).split("\n").length;
         lintIssues.push({
           file: options.file || "<eval>",
           line,
-          severity: rule.severity,
+          severity: effectiveSeverity,
           rule: rule.rule,
           message: rule.msg
         });
@@ -8206,6 +8311,7 @@ function mergeConfig(base, overrides) {
 var CUSTOM_RULES, defaultConfig, REQUIRED_ERROR_CHECKS;
 var init_lint_analyzer = __esm({
   "src/lint-analyzer.js"() {
+    init_config();
     CUSTOM_RULES = [
       { rule: "command_shell", severity: "error", re: /\(\s*command\s+"\s*[_.]*\s*shell\s*"/i, msg: '(command "shell" ...) \u4F1A\u542F\u52A8\u7CFB\u7EDF Shell' },
       { rule: "vl_registry_write", severity: "error", re: /\(\s*vl-registry-write[\s\)]/i, msg: "vl-registry-write \u4F1A\u4FEE\u6539 Windows \u6CE8\u518C\u8868" },
@@ -8545,6 +8651,359 @@ var init_constraint_handlers = __esm({
   }
 });
 
+// src/debug-engine.js
+import { randomUUID as randomUUID4 } from "crypto";
+async function ensureCad() {
+  if (!cad.connected) {
+    log("Debug engine: CAD not connected, attempting auto-connect...");
+    await cad.connect();
+  }
+  if (!cad.connected) {
+    throw new Error("CAD \u672A\u8FDE\u63A5");
+  }
+}
+async function createSession(code, chunks, encoding) {
+  if (sessions.size >= MAX_SESSIONS2) {
+    let oldest = null;
+    for (const [id, s] of sessions) {
+      if (!oldest || s.createdAt < oldest.createdAt) oldest = { id, s };
+    }
+    if (oldest) {
+      sessions.delete(oldest.id);
+      log(`Debug session ${oldest.id} evicted (max sessions)`);
+    }
+  }
+  if (!chunks || chunks.length === 0) {
+    throw new Error("Chunks array is empty");
+  }
+  if (chunks.length > MAX_CHUNKS) {
+    throw new Error(`Too many chunks: ${chunks.length} (max ${MAX_CHUNKS})`);
+  }
+  for (const chunk of chunks) {
+    if (typeof chunk.id !== "number" || typeof chunk.code !== "string") {
+      throw new Error("Each chunk must have id (number) and code (string)");
+    }
+  }
+  const sessionId = randomUUID4();
+  const session = new DebugSession(sessionId, code, chunks, encoding);
+  sessions.set(sessionId, session);
+  return sessionId;
+}
+function getSession(id) {
+  return sessions.get(id) || null;
+}
+async function closeSession(sessionId) {
+  const session = sessions.get(sessionId);
+  if (!session) return false;
+  try {
+    if (cad.connected) {
+      await cad.sendCommand(CLEANUP_CODE + "\n");
+    }
+  } catch (e) {
+    log(`Debug cleanup warning: ${e.message}`);
+  }
+  sessions.delete(sessionId);
+  return true;
+}
+async function loadHelpers(session) {
+  await ensureCad();
+  try {
+    await cad.sendCommand(HELPER_DEFUNS + "\n");
+  } catch (e) {
+    throw new Error(`Failed to load debug helpers: ${e.message}`);
+  }
+}
+async function fastForward(session) {
+  await ensureCad();
+  session.state = "running";
+  while (session.currentIndex < session.totalChunks) {
+    const chunk = session.chunks[session.currentIndex];
+    if (chunk.isBreakpoint) break;
+    try {
+      await cad.sendCommandWithResult(chunk.code, session.encoding);
+    } catch (e) {
+      session.state = "error";
+      session.error = `Fast-forward error at chunk ${chunk.id}: ${e.message}`;
+      throw new Error(session.error);
+    }
+    session.currentIndex++;
+  }
+  if (session.currentIndex >= session.totalChunks) {
+    session.state = "done";
+    return {
+      done: true,
+      finalResult: session.finalResult
+    };
+  }
+  session.state = "paused";
+  return {
+    done: false,
+    pausedAt: {
+      id: session.chunks[session.currentIndex].id,
+      line: session.chunks[session.currentIndex].line
+    }
+  };
+}
+async function executeStep(session) {
+  await ensureCad();
+  if (session.state !== "paused" && session.state !== "ready") {
+    throw new Error(`Invalid state: ${session.state} (expected paused or ready)`);
+  }
+  if (session.currentIndex >= session.totalChunks) {
+    session.state = "done";
+    return { done: true, finalResult: session.finalResult };
+  }
+  const chunk = session.chunks[session.currentIndex];
+  const vars = chunk.vars || [];
+  session.state = "running";
+  let rawResult;
+  try {
+    const varCapture = vars.length > 0 ? `(mapcar (function (lambda (v) (list (vl-prin1-to-string v) (if (boundp v) (vl-prin1-to-string (eval v)) nil)))) (list ${vars.map((v) => `'${v}`).join(" ")})` : "nil";
+    const lispCode = `(progn
+  (setq @::dbg/result (progn ${chunk.code}))
+  (list
+    (vl-prin1-to-string @::dbg/result)
+    ${varCapture}))`;
+    rawResult = await cad.sendCommandWithResult(lispCode, session.encoding);
+  } catch (e) {
+    session.state = "error";
+    session.error = `Step error at chunk ${chunk.id}: ${e.message}`;
+    throw new Error(session.error);
+  }
+  session.currentIndex++;
+  session.finalResult = rawResult;
+  let parsedResult = rawResult;
+  let variables = [];
+  try {
+    const parsed = parseLispRecursive(rawResult);
+    if (Array.isArray(parsed) && parsed.length >= 2) {
+      parsedResult = parsed[0] !== null ? String(parsed[0]) : "nil";
+      if (Array.isArray(parsed[1])) {
+        variables = parsed[1].map((item) => {
+          if (Array.isArray(item) && item.length >= 2) {
+            return { name: String(item[0] || ""), value: item[1] !== null ? String(item[1]) : "nil" };
+          }
+          return null;
+        }).filter(Boolean);
+      }
+    }
+  } catch {
+    parsedResult = rawResult || "nil";
+  }
+  const checkpoint = {
+    id: chunk.id,
+    line: chunk.line,
+    variables,
+    result: parsedResult
+  };
+  session.lastCheckpoint = checkpoint;
+  if (session.currentIndex >= session.totalChunks) {
+    session.state = "done";
+    return {
+      done: true,
+      checkpoint,
+      finalResult: parsedResult
+    };
+  }
+  session.state = "paused";
+  return { done: false, checkpoint };
+}
+async function continueExecution(session) {
+  await ensureCad();
+  if (session.state !== "paused" && session.state !== "ready") {
+    throw new Error(`Invalid state: ${session.state} (expected paused or ready)`);
+  }
+  while (session.currentIndex < session.totalChunks) {
+    const chunk = session.chunks[session.currentIndex];
+    if (chunk.isBreakpoint) {
+      return await executeStep(session);
+    }
+    try {
+      await cad.sendCommandWithResult(chunk.code, session.encoding);
+    } catch (e) {
+      session.state = "error";
+      session.error = `Continue error at chunk ${chunk.id}: ${e.message}`;
+      throw new Error(session.error);
+    }
+    session.currentIndex++;
+    session.finalResult = null;
+  }
+  session.state = "done";
+  return { done: true, finalResult: session.finalResult };
+}
+async function evaluateExpression(session, expression) {
+  await ensureCad();
+  if (session.state !== "paused") {
+    throw new Error(`Invalid state: ${session.state} (expected paused)`);
+  }
+  try {
+    const result = await cad.sendCommandWithResult(`(vl-prin1-to-string ${expression})`, session.encoding);
+    return { value: result || "nil" };
+  } catch (e) {
+    return { error: `CAD error: ${e.message}` };
+  }
+}
+var sessions, MAX_SESSIONS2, MAX_CHUNKS, HELPER_DEFUNS, CLEANUP_CODE, DebugSession;
+var init_debug_engine = __esm({
+  "src/debug-engine.js"() {
+    init_cad();
+    init_logger();
+    init_handler_utils();
+    sessions = /* @__PURE__ */ new Map();
+    MAX_SESSIONS2 = 10;
+    MAX_CHUNKS = 500;
+    HELPER_DEFUNS = `
+(defun @::dbg/exec-chunk (chunk-code var-names)
+  (setq @::dbg/result (eval (read chunk-code)))
+  (if var-names
+    (setq @::dbg/snapshot
+      (mapcar
+        (function (lambda (v)
+          (list (vl-prin1-to-string v)
+                (if (boundp v) (vl-prin1-to-string (eval v)) nil))))
+        var-names))
+    (setq @::dbg/snapshot nil))
+  (list @::dbg/result @::dbg/snapshot))
+`;
+    CLEANUP_CODE = `
+(if (not (vl-catch-all-error-p (vl-catch-all-apply (function (lambda ()
+  (mapcar (function (lambda (s) (set s nil)))
+    (quote (@::dbg/result @::dbg/snapshot @::dbg/state @::dbg/chunks @::dbg/idx @::dbg/encoding))))))))
+  (princ "ok"))
+`;
+    DebugSession = class {
+      constructor(sessionId, code, chunks, encoding) {
+        this.sessionId = sessionId;
+        this.code = code;
+        this.chunks = chunks;
+        this.totalChunks = chunks.length;
+        this.currentIndex = 0;
+        this.encoding = encoding || null;
+        this.state = "ready";
+        this.lastCheckpoint = null;
+        this.finalResult = null;
+        this.createdAt = Date.now();
+        this.error = null;
+      }
+    };
+  }
+});
+
+// src/handlers/debug-handlers.js
+var debug_handlers_exports = {};
+__export(debug_handlers_exports, {
+  debugEvaluate: () => debugEvaluate,
+  debugGetState: () => debugGetState,
+  debugStart: () => debugStart,
+  debugStep: () => debugStep,
+  debugStop: () => debugStop
+});
+async function debugGetState(args) {
+  try {
+    const { sessionId } = args || {};
+    if (!sessionId) return mcpError("Missing required argument: sessionId");
+    const session = getSession(sessionId);
+    if (!session) return mcpError(`Debug session not found: ${sessionId}`);
+    const checkpoint = session.lastCheckpoint;
+    return mcpSuccess(JSON.stringify({
+      state: session.state,
+      currentIndex: session.currentIndex,
+      totalChunks: session.totalChunks,
+      currentCheckpoint: checkpoint || void 0,
+      error: session.error
+    }));
+  } catch (e) {
+    return mcpError(e.message);
+  }
+}
+async function debugStop(args) {
+  try {
+    const { sessionId } = args || {};
+    if (!sessionId) return mcpError("Missing required argument: sessionId");
+    const session = getSession(sessionId);
+    if (!session) {
+      return mcpError(`Debug session not found: ${sessionId}`);
+    }
+    const ok = await closeSession(sessionId);
+    return mcpSuccess(JSON.stringify({ success: ok }));
+  } catch (e) {
+    return mcpError(e.message);
+  }
+}
+var debugStart, debugStep, debugEvaluate;
+var init_debug_handlers = __esm({
+  "src/handlers/debug-handlers.js"() {
+    init_handler_utils();
+    init_debug_engine();
+    debugStart = withCadConnection(async (args) => {
+      try {
+        const { code, chunks, encoding } = args || {};
+        if (!code) return mcpError("Missing required argument: code");
+        if (!chunks || !Array.isArray(chunks)) return mcpError("Missing required argument: chunks (must be an array)");
+        const sessionId = await createSession(code, chunks, encoding);
+        const session = getSession(sessionId);
+        if (!session) return mcpError("Failed to create debug session");
+        await loadHelpers(session);
+        const ffResult = await fastForward(session);
+        if (session.state === "error") {
+          await closeSession(sessionId);
+          return mcpError(session.error);
+        }
+        return mcpSuccess(JSON.stringify({
+          sessionId,
+          totalChunks: session.totalChunks,
+          ...ffResult
+        }));
+      } catch (e) {
+        return mcpError(e.message);
+      }
+    });
+    debugStep = withCadConnection(async (args) => {
+      try {
+        const { sessionId, action } = args || {};
+        if (!sessionId) return mcpError("Missing required argument: sessionId");
+        if (!action) return mcpError("Missing required argument: action");
+        const session = getSession(sessionId);
+        if (!session) return mcpError(`Debug session not found: ${sessionId}`);
+        if (session.state !== "paused" && session.state !== "ready") {
+          return mcpError(`Invalid state: ${session.state} (expected paused or ready)`);
+        }
+        let result;
+        if (action === "step") {
+          result = await executeStep(session);
+        } else if (action === "continue") {
+          result = await continueExecution(session);
+        } else {
+          return mcpError(`Invalid action: ${action} (expected step or continue)`);
+        }
+        if (session.state === "error") {
+          return mcpError(session.error);
+        }
+        return mcpSuccess(JSON.stringify(result));
+      } catch (e) {
+        return mcpError(e.message);
+      }
+    });
+    debugEvaluate = withCadConnection(async (args) => {
+      try {
+        const { sessionId, expression } = args || {};
+        if (!sessionId) return mcpError("Missing required argument: sessionId");
+        if (!expression) return mcpError("Missing required argument: expression");
+        const session = getSession(sessionId);
+        if (!session) return mcpError(`Debug session not found: ${sessionId}`);
+        if (session.state !== "paused") {
+          return mcpError(`Invalid state: ${session.state} (expected paused)`);
+        }
+        const result = await evaluateExpression(session, expression);
+        if (result.error) return mcpError(result.error);
+        return mcpSuccess(JSON.stringify({ value: result.value }));
+      } catch (e) {
+        return mcpError(e.message);
+      }
+    });
+  }
+});
+
 // src/handlers/dim-hatch-handlers.js
 var dim_hatch_handlers_exports = {};
 __export(dim_hatch_handlers_exports, {
@@ -13825,6 +14284,7 @@ var init_ = __esm({
       "./handlers/block-handlers.js": () => Promise.resolve().then(() => (init_block_handlers(), block_handlers_exports)),
       "./handlers/cad-handlers.js": () => Promise.resolve().then(() => (init_cad_handlers(), cad_handlers_exports)),
       "./handlers/constraint-handlers.js": () => Promise.resolve().then(() => (init_constraint_handlers(), constraint_handlers_exports)),
+      "./handlers/debug-handlers.js": () => Promise.resolve().then(() => (init_debug_handlers(), debug_handlers_exports)),
       "./handlers/dim-hatch-handlers.js": () => Promise.resolve().then(() => (init_dim_hatch_handlers(), dim_hatch_handlers_exports)),
       "./handlers/draw-handlers.js": () => Promise.resolve().then(() => (init_draw_handlers(), draw_handlers_exports)),
       "./handlers/edit-handlers.js": () => Promise.resolve().then(() => (init_edit_handlers(), edit_handlers_exports)),
@@ -14712,22 +15172,65 @@ var init_trigger_engine = __esm({
 });
 
 // src/lisp-security.js
+function getLevel() {
+  const level = config_default?.securityLevel || "strict";
+  return CVT[level] || THREAT_BLOCK;
+}
+function resolveSeverity(rule) {
+  if (_cachedLevel) return _cachedLevel;
+  _cachedLevel = getLevel();
+  return _cachedLevel;
+}
+function getEffectiveSeverity() {
+  return resolveSeverity();
+}
 function stripStringsAndComments(code) {
   const withoutStrings = code.replace(/"([^"\\]*(?:\\.[^"\\]*)*)"/g, "");
   return withoutStrings.replace(/;.*$/gm, "");
 }
-var THREAT_BLOCK, THREAT_WARN, SECURITY_RULES;
+var THREAT_BLOCK, THREAT_WARN, THREAT_ALLOW, CVT, SECURITY_RULES, _cachedLevel;
 var init_lisp_security = __esm({
   "src/lisp-security.js"() {
     init_logger();
+    init_config();
     THREAT_BLOCK = "block";
     THREAT_WARN = "warn";
+    THREAT_ALLOW = "allow";
+    CVT = {
+      strict: THREAT_BLOCK,
+      standard: THREAT_WARN,
+      relaxed: THREAT_ALLOW
+    };
     SECURITY_RULES = [
-      { re: /\bstartapp\s*[(\s]/i, severity: THREAT_BLOCK, msg: "\u7981\u6B62\u4F7F\u7528 startapp \u51FD\u6570" },
-      { re: /\bvl-bt\b/i, severity: THREAT_BLOCK, msg: "\u7981\u6B62\u4F7F\u7528 vl-bt \u51FD\u6570" },
-      { re: /\bvlax-import-type-library\b/i, severity: THREAT_BLOCK, msg: "\u7981\u6B62\u5BFC\u5165\u7C7B\u578B\u5E93" },
-      { re: /\bdos_command_string\s*[(\s]/i, severity: THREAT_BLOCK, msg: "\u7981\u6B62\u4F7F\u7528 dos_command_string" }
+      { re: /\bstartapp\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u4F7F\u7528 startapp \u51FD\u6570" },
+      { re: /\bvl-bt\b/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u4F7F\u7528 vl-bt \u51FD\u6570" },
+      { re: /\bvlax-import-type-library\b/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u5BFC\u5165\u7C7B\u578B\u5E93" },
+      { re: /\bdos_command_string\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u4F7F\u7528 dos_command_string" },
+      { re: /\beval\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u4F7F\u7528 eval \u51FD\u6570" },
+      { re: /\bcommand\s*["\s]*[_(]?\s*["']?\.?\s*_?(?:shell|quit|exit|close|open|new|recover|audit|purge|wblock|export)/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u4F7F\u7528\u5371\u9669 CAD \u547D\u4EE4" },
+      { re: /\bload\s*[(\s"]/i, baseSeverity: THREAT_BLOCK, msg: "load \u51FD\u6570\u53EF\u80FD\u52A0\u8F7D\u5916\u90E8\u4EE3\u7801" },
+      { re: /\b(?:read-line|read-char|write-line|write-char)\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: "\u6587\u4EF6 I/O \u64CD\u4F5C\u53EF\u80FD\u5F71\u54CD\u7CFB\u7EDF" },
+      { re: /\bvl-file-copy\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u6587\u4EF6\u590D\u5236" },
+      { re: /\bvl-file-delete\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u6587\u4EF6\u5220\u9664" },
+      { re: /\bvl-file-rename\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u6587\u4EF6\u91CD\u547D\u540D" },
+      { re: /\bvl-registry-write[\s\)]/i, baseSeverity: THREAT_BLOCK, msg: "vl-registry-write \u4F1A\u4FEE\u6539\u6CE8\u518C\u8868" },
+      { re: /\bvl-exit-with-value\b/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u4F7F\u7528 vl-exit-with-value" },
+      { re: /\bvl-exit-with-error\b/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u4F7F\u7528 vl-exit-with-error" },
+      { re: /\bvlax-add-cmd\b/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u6CE8\u518C\u65B0\u547D\u4EE4" },
+      { re: /\bvla-Delete\b/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u76F4\u63A5\u5220\u9664 vla \u5BF9\u8C61" },
+      { re: /\bvla-Save\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u76F4\u63A5\u4FDD\u5B58\u6587\u6863" },
+      { re: /\bdirectory\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u4F7F\u7528 directory \u51FD\u6570" },
+      { re: /\bvla-deletefile\b/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u5220\u9664\u6587\u4EF6" },
+      { re: /\bvla-copyfile\b/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u590D\u5236\u6587\u4EF6" },
+      { re: /\bvla-movefile\b/i, baseSeverity: THREAT_BLOCK, msg: "\u7981\u6B62\u79FB\u52A8\u6587\u4EF6" }
     ];
+    _cachedLevel = null;
+    try {
+      onConfigChange(() => {
+        _cachedLevel = null;
+      });
+    } catch (_) {
+    }
   }
 });
 
@@ -14747,21 +15250,23 @@ function clearSessionAllowlist(sessionId) {
 }
 function validateLispCode(code, sessionId = null) {
   const withoutComments = stripStringsAndComments(code);
+  const effectiveSeverity = getEffectiveSeverity();
   const results = [];
   let blocked = false;
   for (let i = 0; i < RULES2.length; i++) {
     const rule = RULES2[i];
     if (rule.re.test(withoutComments)) {
       const isAllowed = sessionId && getSessionAllowlist(sessionId).has(i);
+      const severity = effectiveSeverity === THREAT_ALLOW ? THREAT_ALLOW : isAllowed ? THREAT_ALLOW : effectiveSeverity;
       results.push({
         ruleIndex: i,
-        severity: rule.severity,
+        severity,
         message: rule.msg,
-        blocked: !isAllowed && rule.severity === THREAT_BLOCK,
-        warned: !isAllowed && rule.severity === THREAT_WARN,
-        allowed: isAllowed
+        blocked: severity === THREAT_BLOCK,
+        warned: severity === THREAT_WARN,
+        allowed: severity === THREAT_ALLOW
       });
-      if (!isAllowed && rule.severity === THREAT_BLOCK) {
+      if (severity === THREAT_BLOCK) {
         blocked = true;
       }
     }
@@ -14777,6 +15282,7 @@ var RULES2, sessionAllowlist;
 var init_lisp_sandbox = __esm({
   "src/lisp-sandbox.js"() {
     init_logger();
+    init_config();
     init_lisp_security();
     RULES2 = SECURITY_RULES;
     sessionAllowlist = /* @__PURE__ */ new Map();
@@ -14784,54 +15290,54 @@ var init_lisp_sandbox = __esm({
 });
 
 // src/repl-engine.js
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 function ensureCleanup2() {
   if (cleanupTimer2) return;
   cleanupTimer2 = setInterval(() => {
     const now = Date.now();
-    for (const [id, session] of sessions) {
+    for (const [id, session] of sessions2) {
       if (now - session.createdAt > SESSION_TTL) {
-        sessions.delete(id);
+        sessions2.delete(id);
         log(`REPL session ${id} expired (TTL)`);
       }
     }
   }, CLEANUP_INTERVAL3);
   cleanupTimer2.unref();
 }
-function createSession() {
-  if (sessions.size >= MAX_SESSIONS2) {
+function createSession2() {
+  if (sessions2.size >= MAX_SESSIONS3) {
     let oldest = null;
-    for (const [id, s] of sessions) {
+    for (const [id, s] of sessions2) {
       if (!oldest || s.lastActivity < oldest.lastActivity) oldest = { id, s };
     }
     if (oldest) {
-      sessions.delete(oldest.id);
+      sessions2.delete(oldest.id);
       log(`REPL session ${oldest.id} evicted (max sessions reached)`);
     }
   }
   ensureCleanup2();
-  const sessionId = randomUUID4();
+  const sessionId = randomUUID5();
   const session = new ReplSession(sessionId);
-  sessions.set(sessionId, session);
+  sessions2.set(sessionId, session);
   return sessionId;
 }
 async function executeInSession(sessionId, code) {
-  let session = sessions.get(sessionId);
+  let session = sessions2.get(sessionId);
   if (!session) {
-    sessionId = createSession();
-    session = sessions.get(sessionId);
+    sessionId = createSession2();
+    session = sessions2.get(sessionId);
   }
   const result = await session.execute(code);
   return { sessionId, result, history: session.history };
 }
 function getHistory(sessionId) {
-  const session = sessions.get(sessionId);
+  const session = sessions2.get(sessionId);
   if (!session) return null;
   return session.history;
 }
-function listSessions() {
+function listSessions2() {
   const result = [];
-  for (const [id, session] of sessions) {
+  for (const [id, session] of sessions2) {
     result.push({
       sessionId: id,
       historyCount: session.history.length,
@@ -14841,20 +15347,20 @@ function listSessions() {
   }
   return result;
 }
-function closeSession(id) {
-  const session = sessions.get(id);
+function closeSession2(id) {
+  const session = sessions2.get(id);
   if (!session) return false;
-  sessions.delete(id);
+  sessions2.delete(id);
   return true;
 }
-var sessions, MAX_SESSIONS2, SESSION_TTL, CLEANUP_INTERVAL3, cleanupTimer2, SETQ_RE, ReplSession;
+var sessions2, MAX_SESSIONS3, SESSION_TTL, CLEANUP_INTERVAL3, cleanupTimer2, SETQ_RE, ReplSession;
 var init_repl_engine = __esm({
   "src/repl-engine.js"() {
     init_cad();
     init_logger();
     init_lint_analyzer();
-    sessions = /* @__PURE__ */ new Map();
-    MAX_SESSIONS2 = 50;
+    sessions2 = /* @__PURE__ */ new Map();
+    MAX_SESSIONS3 = 50;
     SESSION_TTL = 30 * 60 * 1e3;
     CLEANUP_INTERVAL3 = 5 * 60 * 1e3;
     cleanupTimer2 = null;
@@ -15323,7 +15829,7 @@ function registerTool(toolDef, handler) {
   }
   customTools.push(toolDef);
   customHandlers.set(toolDef.name, handler);
-  tools41.push(toolDef);
+  tools42.push(toolDef);
   return true;
 }
 function callCustomTool(name, args) {
@@ -15841,10 +16347,10 @@ ${CAD_PLATFORMS.join("\n")}
         return { content: [{ type: "text", text: JSON.stringify(history) }] };
       },
       lisp_repl_list: () => {
-        return { content: [{ type: "text", text: JSON.stringify(listSessions()) }] };
+        return { content: [{ type: "text", text: JSON.stringify(listSessions2()) }] };
       },
       lisp_repl_close: (a) => {
-        const ok = closeSession(a.sessionId);
+        const ok = closeSession2(a.sessionId);
         return { content: [{ type: "text", text: JSON.stringify({ success: ok }) }] };
       },
       // === Streaming ===
@@ -15916,6 +16422,12 @@ ${CAD_PLATFORMS.join("\n")}
           return { content: [{ type: "text", text: `\u9879\u76EE\u5206\u6790\u5931\u8D25: ${e.message}` }], isError: true };
         }
       },
+      // === Debug ===
+      debug_start: lazy("debug_start", (a) => a),
+      debug_step: lazy("debug_step", (a) => a),
+      debug_evaluate: lazy("debug_evaluate", (a) => a),
+      debug_get_state: lazy("debug_get_state", (a) => a),
+      debug_stop: lazy("debug_stop", (a) => a),
       // === Sandbox (Security) ===
       sandbox_validate: (a) => {
         const result = validateLispCode(a.code, a.sessionId || null);
@@ -16009,14 +16521,14 @@ ${CAD_PLATFORMS.join("\n")}
       // === Meta Tools ===
       search_tools: async (a) => {
         const q = (a.query || "").toLowerCase();
-        const results = tools41.filter((t) => t.name.toLowerCase().includes(q) || (t.description || "").toLowerCase().includes(q));
+        const results = tools42.filter((t) => t.name.toLowerCase().includes(q) || (t.description || "").toLowerCase().includes(q));
         const text = results.length ? `\u627E\u5230 ${results.length} \u4E2A\u5DE5\u5177:
 ${results.map((t) => `${t.name}: ${t.description}`).join("\n")}` : `\u672A\u627E\u5230\u5305\u542B "${a.query}" \u7684\u5DE5\u5177`;
         return { content: [{ type: "text", text }] };
       },
       list_tools_by_category: async (a) => {
         const categories = {};
-        for (const t of tools41) {
+        for (const t of tools42) {
           let cat = "\u5176\u4ED6";
           const n = t.name;
           if (/^(draw_|create_3d_|create_box|create_cone|create_cylinder|create_sphere|create_torus|create_wedge|extrude_|revolve_|boolean_|slice_solid|thicken_|offset_surface|create_loft_|create_region)/.test(n)) cat = "\u7ED8\u56FE\u4E0E3D";
@@ -16352,7 +16864,7 @@ var init_mcp_server_state = __esm({
     progressContext = new AsyncLocalStorage();
     sessionServers = /* @__PURE__ */ new Map();
     sessionTransports = /* @__PURE__ */ new Map();
-    mcpHandlers = { tools: tools41, handleToolCall };
+    mcpHandlers = { tools: tools42, handleToolCall };
     _stdioServer = null;
     _pendingResourceUpdated = /* @__PURE__ */ new Set();
     _resourceUpdatedTimer = null;
@@ -16576,7 +17088,7 @@ function propertyPairsToObject(pairs) {
   }
   return obj;
 }
-async function ensureCad() {
+async function ensureCad2() {
   if (!cad.connected) await cad.connect();
   if (!cad.connected) throw createError(ERROR_CODES.CAD_NOT_CONNECTED);
 }
@@ -16744,7 +17256,7 @@ function parseTableRecord(rec, tableName) {
   return obj.name ? obj : null;
 }
 async function getEntityByHandle(handle) {
-  await ensureCad();
+  await ensureCad2();
   const code = `(progn
     (vl-load-com)
         (if (setq ent (handent "${escapeLispString(handle)}"))
@@ -16854,7 +17366,7 @@ async function getEntities(params = {}) {
   const cacheKey = `dwg:entities:${JSON.stringify(params)}`;
   const cached = getCached(cacheKey);
   if (cached) return cached;
-  await ensureCad();
+  await ensureCad2();
   const hasFilter = params.type || params.layer || params.bbox;
   if (!hasFilter) {
     return await getEntitiesSummary(cacheKey);
@@ -16890,7 +17402,7 @@ async function getTextContent(params = {}) {
   const cacheKey = `dwg:text-content:${JSON.stringify(params)}`;
   const cached = getCached(cacheKey);
   if (cached) return cached;
-  await ensureCad();
+  await ensureCad2();
   const offset = Math.max(0, parseInt(params.offset) || 0);
   const limit = Math.min(Math.max(1, parseInt(params.limit) || 5e3), 5e3);
   try {
@@ -17040,7 +17552,7 @@ async function combineText(params = {}) {
   return { total: blocks.length, blocks, medianHeight: mh };
 }
 async function getDwgName() {
-  await ensureCad();
+  await ensureCad2();
   try {
     const code = `(vl-princ-to-string (getvar "dwgname"))`;
     const name = await cad.sendCommandWithResult(code);
@@ -17050,7 +17562,7 @@ async function getDwgName() {
   }
 }
 async function getDwgPath() {
-  await ensureCad();
+  await ensureCad2();
   try {
     const code = `(progn
       (setq prefix (vl-princ-to-string (getvar "dwgprefix")))
@@ -17083,7 +17595,7 @@ async function getBlockRefs(params = {}) {
   const cacheKey = `dwg:block-refs:${params.blockName || "all"}`;
   const cached = getCached(cacheKey);
   if (cached) return cached;
-  await ensureCad();
+  await ensureCad2();
   try {
     const code = buildBlockRefsCode(params.blockName);
     const resultStr = await cad.sendCommandWithResult(code);
@@ -17145,7 +17657,7 @@ async function getTables(params = {}) {
   const cacheKey = `dwg:tbl:${tblName}`;
   const cached = getCached(cacheKey);
   if (cached) return cached;
-  await ensureCad();
+  await ensureCad2();
   try {
     const code = buildTablesCode(tblName);
     const resultStr = await cad.sendCommandWithResult(code);
@@ -17227,7 +17739,7 @@ async function getPackages(filterName = null) {
   const cacheKey = filterName ? `packages:${filterName}` : "packages:all";
   const cached = getCached(cacheKey);
   if (cached) return cached;
-  await ensureCad();
+  await ensureCad2();
   try {
     const code = `(mapcar 'cdr @::*local-pkgs*)`;
     const result = await cad.sendCommandWithResult(code);
@@ -17300,7 +17812,7 @@ async function getDwgList() {
   const cacheKey = "cad:dwgs";
   const cached = getCached(cacheKey);
   if (cached) return cached;
-  await ensureCad();
+  await ensureCad2();
   try {
     const code = `(progn
       (vl-load-com)
@@ -17370,7 +17882,7 @@ function getCodingStandards() {
   return data || { error: "\u7F16\u7801\u89C4\u8303\u6587\u4EF6\u52A0\u8F7D\u5931\u8D25" };
 }
 async function getCadEvents(params) {
-  await ensureCad();
+  await ensureCad2();
   try {
     const code = `(progn (setq cnt 0) (if (setq ss (ssget "_X")) (setq cnt (sslength ss))) (list (cons "entityCount" cnt) (cons "dwgName" (getvar "dwgname")) (cons "dwgPath" (getvar "dwgprefix"))))`;
     const result = await cad.sendCommandWithResult(code);
@@ -17804,7 +18316,7 @@ init_subscription_manager();
 init_mcp_server_state();
 init_sse_session();
 import express from "express";
-import { randomUUID as randomUUID5, createHash } from "crypto";
+import { randomUUID as randomUUID6, createHash } from "crypto";
 import fs14 from "fs";
 import path17 from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
@@ -17992,7 +18504,7 @@ var cachedToolsJson = null;
 var cachedToolsJsonAt = 0;
 function getToolsJson() {
   if (cachedToolsJson && Date.now() - cachedToolsJsonAt < 3e4) return cachedToolsJson;
-  cachedToolsJson = JSON.stringify(tools41.map((t) => ({
+  cachedToolsJson = JSON.stringify(tools42.map((t) => ({
     name: t.name,
     description: t.description,
     inputSchema: t.inputSchema
@@ -18161,7 +18673,7 @@ function setupRoutes(app) {
       },
       mcp: {
         sessions: sessionServers.size,
-        tools: tools41.length,
+        tools: tools42.length,
         sseSessions: sseCount
       },
       pool: {
@@ -18184,7 +18696,7 @@ function setupRoutes(app) {
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       cad: { connected: cad.connected, platform: cad.getPlatform?.(), version: cad.getVersion?.(), commandQueueSize: cad._getQueueSize ? cad._getQueueSize() : 0, restartCount: cad._getRestartCount ? cad._getRestartCount() : 0 },
       system: { uptime: process.uptime(), memory: { rssMB: Math.round(memUsage.rss / 1024 / 1024), heapUsedMB: Math.round(memUsage.heapUsed / 1024 / 1024), heapTotalMB: Math.round(memUsage.heapTotal / 1024 / 1024) }, cpu: process.cpuUsage() },
-      mcp: { sessions: sessionServers.size, tools: tools41.length, sseSessions: sseCount },
+      mcp: { sessions: sessionServers.size, tools: tools42.length, sseSessions: sseCount },
       pool: poolStats
     });
   });
@@ -18222,7 +18734,7 @@ function setupRoutes(app) {
   app.get("/api/docs", (req, res) => {
     const html = loadHtml("api-docs", {
       VERSION: SERVER_VERSION,
-      TOOLS_COUNT: tools41.length
+      TOOLS_COUNT: tools42.length
     });
     res.setHeader("Content-Type", "text/html; charset=utf-8");
     res.send(html);
@@ -18243,7 +18755,7 @@ function setupRoutes(app) {
       SESSIONS_COUNT: sessionServers.size,
       CAD_STATUS_CLASS: cadConnected ? "status-ok" : "status-error",
       CAD_STATUS_TEXT: cadStatusText,
-      TOOLS_COUNT: tools41.length
+      TOOLS_COUNT: tools42.length
     });
     res.setHeader("Content-Type", "text/html; charset=utf-8");
     res.send(html);
@@ -18261,7 +18773,7 @@ function setupRoutes(app) {
   app.get("/sse", mcpLimiter, handleSse);
   app.post("/message", mcpLimiter, handleMessage);
   app.get("/cad/events", (req, res) => {
-    const sessionId = randomUUID5();
+    const sessionId = randomUUID6();
     subscribeEvents(sessionId, res);
     req.on("close", () => {
       unsubscribeEvents(sessionId);
@@ -18271,7 +18783,7 @@ function setupRoutes(app) {
   return app;
 }
 async function handleMcpPost(req, res) {
-  const sessionId = req.headers["mcp-session-id"] || req.query.sessionId || randomUUID5();
+  const sessionId = req.headers["mcp-session-id"] || req.query.sessionId || randomUUID6();
   sessionManager.createSession(sessionId);
   const body = req.body;
   if (!body) {
@@ -18339,7 +18851,7 @@ async function getMcpResponse(sessionId, body) {
 }
 async function handleSse(req, res) {
   const lastEventId = parseLastEventId(req);
-  let sessionId = randomUUID5();
+  let sessionId = randomUUID6();
   let resumeMessages = [];
   if (lastEventId !== null) {
     const existingSession = sessionManager.get(sessionId);
@@ -18405,7 +18917,7 @@ init_cad();
 init_constants();
 init_tools();
 init_subscription_manager();
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import { WebSocketServer } from "ws";
 var PING_INTERVAL = 3e4;
 var CAD_POLL_INTERVAL = 5e3;
@@ -18435,7 +18947,7 @@ function sendWelcome(ws, clientId) {
         server: { name: SERVER_NAME, version: SERVER_VERSION },
         capabilities: SERVER_CAPABILITIES,
         clientId,
-        toolCount: tools41.length,
+        toolCount: tools42.length,
         cadConnected: cad.connected,
         cadPlatform: cad.connected ? cad.getPlatform() : null,
         cadVersion: cad.connected ? cad.getVersion() : null
@@ -18602,7 +19114,7 @@ function createWebSocketServer(httpServer) {
   startCadPolling();
   _wss = new WebSocketServer({ server: httpServer, path: "/ws" });
   _wss.on("connection", (ws, req) => {
-    const clientId = randomUUID6();
+    const clientId = randomUUID7();
     connectedClients.set(clientId, ws);
     log(`WebSocket connected: ${clientId} (${connectedClients.size} total) from ${req.socket.remoteAddress}`);
     sendWelcome(ws, clientId);
@@ -18809,14 +19321,14 @@ init_logger();
 init_mcp_handlers();
 init_mcp_tools();
 import { StreamableHTTPServerTransport as StreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 var mcpServer = null;
 var streamableTransport = null;
 async function initStreamableHttpServer() {
   if (mcpServer) return;
-  mcpServer = createMcpServer({ tools: tools41, handleToolCall });
+  mcpServer = createMcpServer({ tools: tools42, handleToolCall });
   streamableTransport = new StreamableHTTPServerTransport2({
-    sessionIdGenerator: () => randomUUID7()
+    sessionIdGenerator: () => randomUUID8()
   });
   await mcpServer.connect(streamableTransport);
   streamableTransport.onerror = (err) => error(`Streamable HTTP transport error: ${err.message}`);
@@ -18883,51 +19395,65 @@ if (isMcpScript) {
 Usage: atlisp-mcp [options]
 
 Options:
-  -v, --version           Show version number
-  -h, --help             Show this help message
-   --transport <type>     Transport: http, stdio, or ws (default: http)
-  --port <port>         HTTP port (default: 8110)
-  --host <host>         HTTP host (default: 0.0.0.0)
-   --stdio                Shorthand for --transport stdio
-   --ws                   Shorthand for --transport ws
-   --config <path>       Path to config file (default: ~/.atlisp/atlisp.config.json)
-   --ssl-key <path>     SSL key file path (enables HTTPS)
-   --ssl-cert <path>    SSL certificate file path
-   --debug               Enable debug mode
-   --lint-preset <type>  Lint preset: recommended, strict, or relaxed
-   --lint-config <path>  Path to atlisp-lint.json config file
-   --lint-level <level>  Lint level: error, warn, or off
-   --no-lint             Disable lint pre-check for eval_lisp
-   --lint-off            Same as --no-lint
+  -v, --version                Show version number
+  -h, --help                   Show this help message
+  --transport <type>           Transport: http, stdio, ws (default: http)
+  --stdio                      Shorthand for --transport stdio
+  --ws                         Shorthand for --transport ws
+  --port <port>                HTTP port (default: 8110)
+  --host <host>                HTTP host (default: 0.0.0.0)
+  --config <path>              Path to config file (default: ~/.atlisp/atlisp.config.json)
+  --ssl-key <path>             SSL key file path (enables HTTPS)
+  --ssl-cert <path>            SSL certificate file path
+  --debug                      Enable debug mode
+  --metrics-enabled            Enable /metrics endpoint (true/false)
+  --lint-preset <type>         Lint preset: recommended, strict, relaxed
+  --lint-config <path>         Path to atlisp-lint.json config file
+  --lint-level <level>         Lint level: error, warn, off
+  --no-lint                    Disable lint pre-check for eval_lisp
+  --lint-off                   Same as --no-lint
+  --api-key <key>              API key for authentication
+  --security-level <type>      Security level: strict, standard, relaxed (default: strict)
 
 Environment Variables:
-   TRANSPORT             Transport mode (http/stdio/ws)
-   PORT                  HTTP port
-   HOST                  HTTP host
-   MCP_API_KEY           API key for authentication
-   ENABLE_SSE            Enable SSE (true/false)
-   DEBUG                 Enable debug logging (true/false)
-   METRICS_ENABLED      Enable /metrics endpoint (true/false)
-   SSL_KEY_PATH          SSL key file path
-   SSL_CERT_PATH         SSL certificate file path
+  TRANSPORT             Transport mode (http/stdio/ws)
+  PORT                  HTTP port (default: 8110)
+  HOST                  HTTP host (default: 0.0.0.0)
+  MCP_API_KEY           API key for authentication
+  ENABLE_SSE            Enable SSE (true/false, default: true)
+  DEBUG                 Enable debug logging (true/false)
+  DEBUG_FILE            Debug log file path
+  METRICS_ENABLED       Enable /metrics endpoint (true/false, default: true)
+  SSL_KEY_PATH          SSL key file path
+  SSL_CERT_PATH         SSL certificate file path
+  SECURITY_LEVEL        Security level: strict, standard, relaxed (default: strict)
+  CONFIG_FILE           Path to config file
+  LINT_PRESET           Lint preset (recommended/strict/relaxed)
+  LINT_CONFIG_PATH      Path to atlisp-lint.json
+  LINT_LEVEL            Lint level (error/warn/off)
+  NO_LINT               Disable lint (true/false)
+  REQUEST_LOG_ENABLED   Enable request logging (true/false, default: true)
+  CORS_ORIGIN           CORS origin (default: *)
+  RATE_LIMIT_WINDOW     Rate limit window in ms (default: 60000)
+  RATE_LIMIT_MAX        Max requests per window (default: 100)
 
 Examples:
-  atlisp-mcp                       Start HTTP server on port 8110
-  atlisp-mcp --port 3000          Start HTTP server on port 3000
-  atlisp-mcp --stdio               Start in stdio mode for MCP clients
-  atlisp-mcp --config ~/my.json   Use custom config file
-  atlisp-mcp --debug              Enable debug output
-  TRANSPORT=stdio atlisp-mcp      Via env var for stdio mode
-  atlisp-mcp --ws                 Start WebSocket server on port 8110
-  TRANSPORT=ws atlisp-mcp         Via env var for WebSocket mode
+  atlisp-mcp                           Start HTTP server on port 8110
+  atlisp-mcp --port 3000               Start HTTP server on port 3000
+  atlisp-mcp --stdio                   Start in stdio mode for MCP clients
+  atlisp-mcp --config ~/my.json        Use custom config file
+  atlisp-mcp --debug                   Enable debug output
+  atlisp-mcp --ssl-key key.pem --ssl-cert cert.pem  Start HTTPS server
+  TRANSPORT=stdio atlisp-mcp           Via env var for stdio mode
+  TRANSPORT=ws atlisp-mcp              Via env var for WebSocket mode
 
 API Endpoints:
-  GET  /health    Health check
-  GET  /metrics   Prometheus metrics (if enabled)
-  POST /mcp       MCP JSON-RPC endpoint
-  GET  /sse       Server-Sent Events endpoint
-  POST /message   SSE message endpoint
-  WS   /ws        WebSocket endpoint
+  GET  /health         Health check
+  GET  /metrics        Prometheus metrics (if enabled)
+  POST /mcp            MCP JSON-RPC endpoint
+  GET  /sse            Server-Sent Events endpoint
+  POST /message        SSE message endpoint
+  WS   /ws             WebSocket endpoint
   POST /config/reload  Reload configuration
 
 For more info: https://atlisp.cn
@@ -18955,6 +19481,16 @@ For more info: https://atlisp.cn
       process.env.LINT_LEVEL = cliArgs2[++i];
     } else if (arg === "--no-lint" || arg === "--lint-off") {
       process.env.NO_LINT = "true";
+    } else if (arg === "--security-level" && cliArgs2[i + 1]) {
+      process.env.SECURITY_LEVEL = cliArgs2[++i];
+    } else if (arg === "--ssl-key" && cliArgs2[i + 1]) {
+      process.env.SSL_KEY_PATH = cliArgs2[++i];
+    } else if (arg === "--ssl-cert" && cliArgs2[i + 1]) {
+      process.env.SSL_CERT_PATH = cliArgs2[++i];
+    } else if (arg === "--api-key" && cliArgs2[i + 1]) {
+      process.env.MCP_API_KEY = cliArgs2[++i];
+    } else if (arg === "--metrics-enabled" && cliArgs2[i + 1]) {
+      process.env.METRICS_ENABLED = cliArgs2[++i];
     }
   }
 }
@@ -18975,7 +19511,7 @@ async function initCadConnection() {
 }
 async function startServer() {
   await loadPlugins();
-  initPlugins({ cad, config: config_default, log, registerTool, tools: tools41 });
+  initPlugins({ cad, config: config_default, log, registerTool, tools: tools42 });
   onPluginChange((type, name) => {
     log(`Plugin changed: ${type} ${name}`);
     broadcastToolListChanged();
@@ -18999,7 +19535,7 @@ async function startServer() {
   }
   if (config_default.transport === "stdio") {
     await initCadConnection();
-    const mcpServer2 = createStdioServer({ tools: tools41, handleToolCall });
+    const mcpServer2 = createStdioServer({ tools: tools42, handleToolCall });
     const transport = new StdioServerTransport();
     const sessionId = "stdio-session";
     sessionManager.createSession(sessionId);
@@ -19100,5 +19636,5 @@ export {
   handleToolCall,
   loadAtlibFunctionLib,
   startServer,
-  tools41 as tools
+  tools42 as tools
 };