@cleocode/cleo 2026.2.5

package/dist/mcp/lib/command-builder.d.ts

@@ -0,0 +1,52 @@
+/**
+ * CLI Command Builder
+ *
+ * Constructs safe CLI commands with proper argument escaping and flag formatting.
+ * Prevents shell injection attacks by properly escaping all arguments.
+ *
+ * @task T2914
+ */
+/**
+ * Escape shell argument to prevent injection
+ *
+ * Wraps argument in single quotes and escapes any embedded single quotes.
+ * This is safe for all shell interpreters (bash, sh, zsh).
+ */
+export declare function escapeArg(arg: string | number | boolean): string;
+/**
+ * Format CLI flags from key-value object
+ *
+ * Converts {json: true, parent: "T001"} to ["--json", "--parent", "T001"]
+ */
+export declare function formatFlags(flags: Record<string, unknown>): string[];
+/**
+ * Map domain+operation to CLI command
+ *
+ * Maps MCP domain/operation pairs to the actual CLI command structure.
+ * For example: domain='tasks', operation='add' -> command='add', addOperationAsSubcommand=false
+ */
+export declare function mapDomainToCommand(domain: string, operation: string): {
+    command: string;
+    addOperationAsSubcommand: boolean;
+};
+/**
+ * Build complete CLI command
+ *
+ * @param cliPath - Path to CLEO CLI executable
+ * @param domain - Domain name (e.g., 'tasks', 'session') OR direct command (e.g., 'show', 'add')
+ * @param operation - Operation name (e.g., 'show', 'list') OR first argument
+ * @param args - Positional arguments
+ * @param flags - Named flags/options
+ * @returns Complete command string ready for execution
+ *
+ * @example
+ * ```typescript
+ * buildCLICommand('cleo', 'tasks', 'show', ['T2914'], {json: true})
+ * // Returns: "cleo show 'T2914' --json"
+ *
+ * buildCLICommand('cleo', 'show', 'T2914', [], {json: true})
+ * // Returns: "cleo show 'T2914' --json"
+ * ```
+ */
+export declare function buildCLICommand(cliPath: string, domain: string, operation: string, args?: Array<string | number>, flags?: Record<string, unknown>): string;
+//# sourceMappingURL=command-builder.d.ts.map

package/dist/mcp/lib/command-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-builder.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/command-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAUhE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAqCpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,wBAAwB,EAAE,OAAO,CAAA;CAAE,CAkJ5H;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAM,EACjC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,MAAM,CA+CR"}

package/dist/mcp/lib/command-builder.js

@@ -0,0 +1,269 @@
+/**
+ * CLI Command Builder
+ *
+ * Constructs safe CLI commands with proper argument escaping and flag formatting.
+ * Prevents shell injection attacks by properly escaping all arguments.
+ *
+ * @task T2914
+ */
+/**
+ * Escape shell argument to prevent injection
+ *
+ * Wraps argument in single quotes and escapes any embedded single quotes.
+ * This is safe for all shell interpreters (bash, sh, zsh).
+ */
+export function escapeArg(arg) {
+    // Convert to string
+    const str = String(arg);
+    // Escape single quotes by replacing ' with '\''
+    // This closes the quote, adds an escaped quote, and reopens the quote
+    const escaped = str.replace(/'/g, "'\\''");
+    // Wrap in single quotes
+    return `'${escaped}'`;
+}
+/**
+ * Format CLI flags from key-value object
+ *
+ * Converts {json: true, parent: "T001"} to ["--json", "--parent", "T001"]
+ */
+export function formatFlags(flags) {
+    const result = [];
+    for (const [key, value] of Object.entries(flags)) {
+        // Skip undefined/null values
+        if (value === undefined || value === null) {
+            continue;
+        }
+        // Boolean flags
+        if (typeof value === 'boolean') {
+            if (value === true) {
+                result.push(`--${key}`);
+            }
+            // Skip false boolean flags (don't add anything)
+            continue;
+        }
+        // Array flags (multiple values)
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                result.push(`--${key}`, escapeArg(item));
+            }
+            continue;
+        }
+        // Object flags (JSON stringify)
+        if (typeof value === 'object') {
+            result.push(`--${key}`, escapeArg(JSON.stringify(value)));
+            continue;
+        }
+        // Regular flags (string/number)
+        result.push(`--${key}`, escapeArg(value));
+    }
+    return result;
+}
+/**
+ * Map domain+operation to CLI command
+ *
+ * Maps MCP domain/operation pairs to the actual CLI command structure.
+ * For example: domain='tasks', operation='add' -> command='add', addOperationAsSubcommand=false
+ */
+export function mapDomainToCommand(domain, operation) {
+    // Domain aliases used by legacy handlers/comments that should resolve to
+    // canonical CLI commands.
+    const domainAliases = {
+        import: { command: 'import-tasks', addOperationAsSubcommand: true },
+        lint: { command: 'validate', addOperationAsSubcommand: true },
+        skill: { command: 'skills', addOperationAsSubcommand: true },
+        version: { command: 'version', addOperationAsSubcommand: false },
+    };
+    if (domainAliases[domain]) {
+        return domainAliases[domain];
+    }
+    // For tasks domain, the operation IS the command
+    // For session/lifecycle domains, we need both (e.g., 'session start')
+    const domainOperationMap = {
+        tasks: {
+            show: { command: 'show', addOperationAsSubcommand: false },
+            list: { command: 'list', addOperationAsSubcommand: false },
+            find: { command: 'find', addOperationAsSubcommand: false },
+            add: { command: 'add', addOperationAsSubcommand: false },
+            update: { command: 'update', addOperationAsSubcommand: false },
+            complete: { command: 'complete', addOperationAsSubcommand: false },
+            delete: { command: 'delete', addOperationAsSubcommand: false },
+            archive: { command: 'archive', addOperationAsSubcommand: false },
+            restore: { command: 'restore', addOperationAsSubcommand: false },
+            reopen: { command: 'reopen', addOperationAsSubcommand: false },
+            exists: { command: 'exists', addOperationAsSubcommand: false },
+            next: { command: 'next', addOperationAsSubcommand: false },
+            depends: { command: 'deps show', addOperationAsSubcommand: false },
+            blockers: { command: 'blockers', addOperationAsSubcommand: false },
+            tree: { command: 'tree', addOperationAsSubcommand: false },
+            analyze: { command: 'analyze', addOperationAsSubcommand: false },
+        },
+        session: {
+            start: { command: 'session', addOperationAsSubcommand: true },
+            end: { command: 'session', addOperationAsSubcommand: true },
+            status: { command: 'session', addOperationAsSubcommand: true },
+            list: { command: 'session', addOperationAsSubcommand: true },
+            show: { command: 'session', addOperationAsSubcommand: true },
+            suspend: { command: 'session', addOperationAsSubcommand: true },
+            resume: { command: 'session', addOperationAsSubcommand: true },
+            history: { command: 'session', addOperationAsSubcommand: true },
+            archive: { command: 'session', addOperationAsSubcommand: true },
+            cleanup: { command: 'session', addOperationAsSubcommand: true },
+            switch: { command: 'session', addOperationAsSubcommand: true },
+        },
+        lifecycle: {
+            status: { command: 'lifecycle show', addOperationAsSubcommand: false },
+            show: { command: 'lifecycle show', addOperationAsSubcommand: false },
+            stages: { command: 'lifecycle show', addOperationAsSubcommand: false },
+            validate: { command: 'lifecycle gate', addOperationAsSubcommand: false },
+            record: { command: 'lifecycle complete', addOperationAsSubcommand: false },
+            start: { command: 'lifecycle start', addOperationAsSubcommand: false },
+            complete: { command: 'lifecycle complete', addOperationAsSubcommand: false },
+            enforce: { command: 'lifecycle gate', addOperationAsSubcommand: false },
+            skip: { command: 'lifecycle skip', addOperationAsSubcommand: false },
+            unskip: { command: 'lifecycle', addOperationAsSubcommand: true },
+            report: { command: 'lifecycle show', addOperationAsSubcommand: false },
+            export: { command: 'lifecycle', addOperationAsSubcommand: true },
+            import: { command: 'lifecycle', addOperationAsSubcommand: true },
+            gate: { command: 'lifecycle gate', addOperationAsSubcommand: false },
+            gates: { command: 'lifecycle show', addOperationAsSubcommand: false },
+            prerequisites: { command: 'lifecycle show', addOperationAsSubcommand: false },
+            history: { command: 'lifecycle show', addOperationAsSubcommand: false },
+            reset: { command: 'lifecycle start', addOperationAsSubcommand: false },
+            'gate.pass': { command: 'lifecycle gate', addOperationAsSubcommand: false },
+            'gate.fail': { command: 'lifecycle gate', addOperationAsSubcommand: false },
+        },
+        // Orchestrate domain maps to 'cleo orchestrate <subcommand>'
+        orchestrate: {
+            analyze: { command: 'orchestrate', addOperationAsSubcommand: true },
+            start: { command: 'orchestrate', addOperationAsSubcommand: true },
+            status: { command: 'orchestrate context', addOperationAsSubcommand: false },
+            next: { command: 'orchestrate', addOperationAsSubcommand: true },
+            ready: { command: 'orchestrate', addOperationAsSubcommand: true },
+            spawn: { command: 'orchestrate', addOperationAsSubcommand: true },
+            waves: { command: 'orchestrate analyze', addOperationAsSubcommand: false },
+            parallel: { command: 'orchestrate ready', addOperationAsSubcommand: false },
+            check: { command: 'orchestrate validate', addOperationAsSubcommand: false },
+            validate: { command: 'orchestrate', addOperationAsSubcommand: true },
+            context: { command: 'orchestrate', addOperationAsSubcommand: true },
+            skill: { command: 'orchestrate', addOperationAsSubcommand: true },
+        },
+        // Research domain maps to 'cleo research <subcommand>'
+        research: {
+            link: { command: 'research', addOperationAsSubcommand: true },
+            links: { command: 'research', addOperationAsSubcommand: true },
+            unlink: { command: 'research', addOperationAsSubcommand: true },
+            list: { command: 'research', addOperationAsSubcommand: true },
+            show: { command: 'research', addOperationAsSubcommand: true },
+            get: { command: 'research', addOperationAsSubcommand: true },
+            add: { command: 'research', addOperationAsSubcommand: true },
+            search: { command: 'research', addOperationAsSubcommand: true },
+            stats: { command: 'research manifest', addOperationAsSubcommand: false },
+            pending: { command: 'research', addOperationAsSubcommand: true },
+            inject: { command: 'research', addOperationAsSubcommand: true },
+            archive: { command: 'research', addOperationAsSubcommand: true },
+            'archive-list': { command: 'research', addOperationAsSubcommand: true },
+            status: { command: 'research', addOperationAsSubcommand: true },
+            compact: { command: 'research', addOperationAsSubcommand: true },
+            validate: { command: 'research', addOperationAsSubcommand: true },
+            // Manifest sub-operations map to actual CLI subcommands
+            'manifest.append': { command: 'research add', addOperationAsSubcommand: false },
+            'manifest.read': { command: 'research list', addOperationAsSubcommand: false },
+            'manifest.archive': { command: 'research archive', addOperationAsSubcommand: false },
+        },
+        system: {
+            version: { command: 'version', addOperationAsSubcommand: false },
+            'config.get': { command: 'config', addOperationAsSubcommand: false },
+            backup: { command: 'backup', addOperationAsSubcommand: false },
+            cleanup: { command: 'cleanup', addOperationAsSubcommand: false },
+            health: { command: 'doctor', addOperationAsSubcommand: false },
+            stats: { command: 'stats', addOperationAsSubcommand: false },
+            context: { command: 'context', addOperationAsSubcommand: false },
+        },
+        validate: {
+            schema: { command: 'validate', addOperationAsSubcommand: false },
+            task: { command: 'validate', addOperationAsSubcommand: false },
+            compliance: { command: 'compliance', addOperationAsSubcommand: false },
+            test: { command: 'test', addOperationAsSubcommand: false },
+        },
+    };
+    const mapping = domainOperationMap[domain]?.[operation];
+    if (mapping) {
+        return mapping;
+    }
+    // Handle compound operations (e.g., 'config.get' in 'system' domain)
+    // Split on first dot and try to resolve via a sub-domain
+    if (operation.includes('.')) {
+        const dotIndex = operation.indexOf('.');
+        const subDomain = operation.substring(0, dotIndex);
+        const subOp = operation.substring(dotIndex + 1);
+        // Check if there's a dedicated domain for the sub-operation
+        const subMapping = domainOperationMap[subDomain]?.[subOp];
+        if (subMapping) {
+            return subMapping;
+        }
+    }
+    // Default: use domain as command, operation as subcommand
+    return { command: domain, addOperationAsSubcommand: true };
+}
+/**
+ * Build complete CLI command
+ *
+ * @param cliPath - Path to CLEO CLI executable
+ * @param domain - Domain name (e.g., 'tasks', 'session') OR direct command (e.g., 'show', 'add')
+ * @param operation - Operation name (e.g., 'show', 'list') OR first argument
+ * @param args - Positional arguments
+ * @param flags - Named flags/options
+ * @returns Complete command string ready for execution
+ *
+ * @example
+ * ```typescript
+ * buildCLICommand('cleo', 'tasks', 'show', ['T2914'], {json: true})
+ * // Returns: "cleo show 'T2914' --json"
+ *
+ * buildCLICommand('cleo', 'show', 'T2914', [], {json: true})
+ * // Returns: "cleo show 'T2914' --json"
+ * ```
+ */
+export function buildCLICommand(cliPath, domain, operation, args = [], flags = {}) {
+    const parts = [cliPath];
+    // Check if we need to map domain+operation to CLI command
+    // This handles E2E tests that use domain='tasks', operation='add'
+    // versus domain handlers that use domain='add', operation=title
+    // Valid CLI commands that can be used directly as the first command word.
+    // These are commands where domain IS the command itself (e.g., domain='add', operation='My Task Title').
+    // Do NOT include domain names that need mapDomainToCommand lookup (like 'session', 'lifecycle',
+    // 'orchestrate', 'research', 'tasks', 'focus', 'system', 'validate').
+    const validCliCommands = [
+        'add', 'list', 'show', 'find', 'update', 'complete', 'delete', 'archive',
+        'restore', 'exists', 'next', 'version', 'dash', 'analyze', 'config',
+        'backup', 'init', 'blockers', 'deps', 'tree',
+    ];
+    if (!validCliCommands.includes(domain)) {
+        // This looks like domain='tasks', operation='add' pattern from E2E tests
+        // Map it to the proper CLI command
+        const mapping = mapDomainToCommand(domain, operation);
+        parts.push(mapping.command);
+        // For commands that need the operation as a subcommand (session, lifecycle)
+        if (mapping.addOperationAsSubcommand) {
+            parts.push(escapeArg(operation));
+        }
+        // For tasks domain, the operation IS already the command, so don't add it again
+    }
+    else {
+        // This is already a direct CLI command (domain='add', operation=title)
+        parts.push(domain);
+        // Add operation (may be user-controlled, e.g., task title, so escape it)
+        if (operation) {
+            parts.push(escapeArg(operation));
+        }
+    }
+    // Add positional arguments (escaped)
+    for (const arg of args) {
+        parts.push(escapeArg(arg));
+    }
+    // Add flags (escaped)
+    const flagParts = formatFlags(flags);
+    parts.push(...flagParts);
+    return parts.join(' ');
+}
+//# sourceMappingURL=command-builder.js.map

package/dist/mcp/lib/command-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-builder.js","sourceRoot":"","sources":["../../../src/mcp/lib/command-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAA8B;IACtD,oBAAoB;IACpB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAExB,gDAAgD;IAChD,sEAAsE;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE3C,wBAAwB;IACxB,OAAO,IAAI,OAAO,GAAG,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAA8B;IACxD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,6BAA6B;QAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,gBAAgB;QAChB,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YAC1B,CAAC;YACD,gDAAgD;YAChD,SAAS;QACX,CAAC;QAED,gCAAgC;QAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,EAAE,SAAS,CAAC,IAAiC,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,SAAS;QACX,CAAC;QAED,gCAAgC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QAED,gCAAgC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,EAAE,SAAS,CAAC,KAAkC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,SAAiB;IAClE,yEAAyE;IACzE,0BAA0B;IAC1B,MAAM,aAAa,GAA2E;QAC5F,MAAM,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,IAAI,EAAE;QACnE,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;QAC7D,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE;QAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE;KACjE,CAAC;IAEF,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,iDAAiD;IACjD,sEAAsE;IACtE,MAAM,kBAAkB,GAA2F;QACjH,KAAK,EAAE;YACL,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC1D,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC1D,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC1D,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACxD,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC9D,QAAQ,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAClE,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAChE,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAChE,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC9D,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC9D,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC1D,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAClE,QAAQ,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAClE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC1D,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE;SACjE;QACD,OAAO,EAAE;YACP,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC7D,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC3D,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC9D,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC5D,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC/D,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC/D,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC/D,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC/D,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,IAAI,EAAE;SAC/D;QACD,SAAS,EAAE;YACT,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACtE,IAAI,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACpE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACtE,QAAQ,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACxE,MAAM,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC1E,KAAK,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACtE,QAAQ,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC5E,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACvE,IAAI,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACpE,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAChE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACtE,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAChE,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAChE,IAAI,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACpE,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACrE,aAAa,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC7E,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACvE,KAAK,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACtE,WAAW,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC3E,WAAW,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE;SAC5E;QACD,6DAA6D;QAC7D,WAAW,EAAE;YACX,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,IAAI,EAAE;YACnE,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,IAAI,EAAE;YACjE,MAAM,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC3E,IAAI,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAChE,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,IAAI,EAAE;YACjE,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,IAAI,EAAE;YACjE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC1E,QAAQ,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC3E,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC3E,QAAQ,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,IAAI,EAAE;YACpE,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,IAAI,EAAE;YACnE,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,IAAI,EAAE;SAClE;QACD,uDAAuD;QACvD,QAAQ,EAAE;YACR,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC7D,KAAK,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC9D,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC/D,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC7D,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC7D,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC5D,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC5D,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC/D,KAAK,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACxE,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAChE,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC/D,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAChE,cAAc,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YACvE,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC/D,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAChE,QAAQ,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE;YACjE,wDAAwD;YACxD,iBAAiB,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC/E,eAAe,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC9E,kBAAkB,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,EAAE;SACrF;QACD,MAAM,EAAE;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAChE,YAAY,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACpE,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAChE,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC9D,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE;SACjE;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAChE,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,KAAK,EAAE;YAC9D,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,KAAK,EAAE;YACtE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE;SAC3D;KACF,CAAC;IAEF,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IAExD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qEAAqE;IACrE,yDAAyD;IACzD,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAChD,4DAA4D;QAC5D,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,MAAc,EACd,SAAiB,EACjB,OAA+B,EAAE,EACjC,QAAiC,EAAE;IAEnC,MAAM,KAAK,GAAa,CAAC,OAAO,CAAC,CAAC;IAElC,0DAA0D;IAC1D,kEAAkE;IAClE,gEAAgE;IAChE,0EAA0E;IAC1E,yGAAyG;IACzG,gGAAgG;IAChG,sEAAsE;IACtE,MAAM,gBAAgB,GAAG;QACvB,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS;QACxE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ;QACnE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM;KAC7C,CAAC;IAEF,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,yEAAyE;QACzE,mCAAmC;QACnC,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE5B,4EAA4E;QAC5E,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,gFAAgF;IAClF,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEnB,yEAAyE;QACzE,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,sBAAsB;IACtB,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;IAEzB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}

package/dist/mcp/lib/config.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Configuration loader for CLEO MCP Server
+ *
+ * Loads configuration from:
+ * 1. Environment variables (CLEO_MCP_*)
+ * 2. Config file (.cleo/config.json)
+ * 3. Defaults (fallback values)
+ *
+ * @task T2928
+ */
+import { MCPConfig } from './defaults.js';
+/**
+ * Configuration validation error
+ */
+export declare class ConfigValidationError extends Error {
+    field: string;
+    value: unknown;
+    constraint: string;
+    constructor(field: string, value: unknown, constraint: string);
+}
+/**
+ * Validate complete configuration
+ */
+export declare function validateConfig(config: MCPConfig): void;
+/**
+ * Load configuration from all sources
+ *
+ * Priority order:
+ * 1. Environment variables (CLEO_MCP_*)
+ * 2. Config file (.cleo/config.json)
+ * 3. Defaults
+ */
+export declare function loadConfig(projectRoot?: string): MCPConfig;
+/**
+ * Get global configuration (singleton)
+ */
+export declare function getConfig(): MCPConfig;
+/**
+ * Reset global configuration (for testing)
+ */
+export declare function resetConfig(): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/mcp/lib/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EACL,SAAS,EAOV,MAAM,eAAe,CAAC;AAEvB;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAErC,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,MAAM;gBAFlB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,MAAM;CAK5B;AAuJD;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAatD;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAuD1D;AAQD;;GAEG;AACH,wBAAgB,SAAS,IAAI,SAAS,CAKrC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAElC"}

package/dist/mcp/lib/config.js

@@ -0,0 +1,248 @@
+/**
+ * Configuration loader for CLEO MCP Server
+ *
+ * Loads configuration from:
+ * 1. Environment variables (CLEO_MCP_*)
+ * 2. Config file (.cleo/config.json)
+ * 3. Defaults (fallback values)
+ *
+ * @task T2928
+ */
+import { readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { DEFAULT_CONFIG, DEFAULT_LIFECYCLE_ENFORCEMENT, DEFAULT_PROTOCOL_VALIDATION, DEFAULT_RATE_LIMITING, ENV_PREFIX, CONFIG_SCHEMA, } from './defaults.js';
+/**
+ * Configuration validation error
+ */
+export class ConfigValidationError extends Error {
+    field;
+    value;
+    constraint;
+    constructor(field, value, constraint) {
+        super(`Invalid config field '${field}': ${constraint} (got ${value})`);
+        this.field = field;
+        this.value = value;
+        this.constraint = constraint;
+        this.name = 'ConfigValidationError';
+    }
+}
+/**
+ * Load configuration value from environment variable
+ */
+function loadFromEnv(key) {
+    const envKey = `${ENV_PREFIX}${key.toUpperCase()}`;
+    return process.env[envKey];
+}
+/**
+ * Parse environment variable to appropriate type
+ */
+function parseEnvValue(key, value) {
+    const schema = CONFIG_SCHEMA[key];
+    if (schema.type === 'boolean') {
+        return value.toLowerCase() === 'true' || value === '1';
+    }
+    if (schema.type === 'number') {
+        const num = parseInt(value, 10);
+        if (isNaN(num)) {
+            throw new ConfigValidationError(key, value, 'must be a number');
+        }
+        return num;
+    }
+    return value;
+}
+/**
+ * Load configuration from .cleo/config.json file
+ */
+function loadFromFile(projectRoot) {
+    const root = projectRoot || process.cwd();
+    const configPath = join(root, '.cleo', 'config.json');
+    if (!existsSync(configPath)) {
+        return {};
+    }
+    try {
+        const content = readFileSync(configPath, 'utf-8');
+        const config = JSON.parse(content);
+        // Extract MCP-specific config if nested
+        const result = {};
+        if (config.mcp) {
+            if (config.mcp.cliPath !== undefined)
+                result.cliPath = config.mcp.cliPath;
+            if (config.mcp.timeout !== undefined)
+                result.timeout = config.mcp.timeout;
+            if (config.mcp.logLevel !== undefined)
+                result.logLevel = config.mcp.logLevel;
+            if (config.mcp.enableMetrics !== undefined)
+                result.enableMetrics = config.mcp.enableMetrics;
+            if (config.mcp.maxRetries !== undefined)
+                result.maxRetries = config.mcp.maxRetries;
+            if (config.mcp.features?.queryCache !== undefined)
+                result.queryCache = config.mcp.features.queryCache;
+            if (config.mcp.features?.queryCacheTtl !== undefined)
+                result.queryCacheTtl = config.mcp.features.queryCacheTtl;
+            if (config.mcp.features?.auditLog !== undefined)
+                result.auditLog = config.mcp.features.auditLog;
+            if (config.mcp.features?.strictValidation !== undefined)
+                result.strictValidation = config.mcp.features.strictValidation;
+        }
+        // Extract lifecycle enforcement config (Section 12.2)
+        if (config.lifecycleEnforcement) {
+            result.lifecycleEnforcement = {
+                ...DEFAULT_LIFECYCLE_ENFORCEMENT,
+                ...config.lifecycleEnforcement,
+            };
+        }
+        // Extract protocol validation config (Section 12.3)
+        if (config.protocolValidation) {
+            result.protocolValidation = {
+                ...DEFAULT_PROTOCOL_VALIDATION,
+                ...config.protocolValidation,
+            };
+        }
+        // Extract rate limiting config (Section 13.3)
+        if (config.rateLimiting || config.mcp?.rateLimiting) {
+            const rlConfig = config.rateLimiting || config.mcp?.rateLimiting;
+            result.rateLimiting = {
+                ...DEFAULT_RATE_LIMITING,
+                ...rlConfig,
+                query: { ...DEFAULT_RATE_LIMITING.query, ...rlConfig?.query },
+                mutate: { ...DEFAULT_RATE_LIMITING.mutate, ...rlConfig?.mutate },
+                spawn: { ...DEFAULT_RATE_LIMITING.spawn, ...rlConfig?.spawn },
+            };
+        }
+        // If no mcp block, check for flat config keys
+        if (!config.mcp) {
+            return config;
+        }
+        return result;
+    }
+    catch (error) {
+        // Log error but don't fail - fall back to defaults
+        console.error(`Warning: Failed to load config file: ${error}`);
+        return {};
+    }
+}
+/**
+ * Validate configuration field
+ */
+function validateField(key, value) {
+    const schema = CONFIG_SCHEMA[key];
+    if (!schema) {
+        return; // Unknown fields are ignored
+    }
+    // Type check
+    const actualType = typeof value;
+    if (actualType !== schema.type) {
+        throw new ConfigValidationError(key, value, `must be of type ${schema.type}`);
+    }
+    // Enum check
+    if ('enum' in schema && schema.enum && !schema.enum.includes(value)) {
+        throw new ConfigValidationError(key, value, `must be one of: ${schema.enum.join(', ')}`);
+    }
+    // Range check for numbers
+    if (schema.type === 'number') {
+        const numValue = value;
+        if ('min' in schema && numValue < schema.min) {
+            throw new ConfigValidationError(key, value, `must be >= ${schema.min}`);
+        }
+        if ('max' in schema && numValue > schema.max) {
+            throw new ConfigValidationError(key, value, `must be <= ${schema.max}`);
+        }
+    }
+}
+/**
+ * Validate complete configuration
+ */
+export function validateConfig(config) {
+    for (const [key, value] of Object.entries(config)) {
+        validateField(key, value);
+    }
+    // Required field check
+    for (const [key, schema] of Object.entries(CONFIG_SCHEMA)) {
+        if ('required' in schema && schema.required) {
+            if (config[key] === undefined) {
+                throw new ConfigValidationError(key, undefined, 'is required');
+            }
+        }
+    }
+}
+/**
+ * Load configuration from all sources
+ *
+ * Priority order:
+ * 1. Environment variables (CLEO_MCP_*)
+ * 2. Config file (.cleo/config.json)
+ * 3. Defaults
+ */
+export function loadConfig(projectRoot) {
+    // Start with defaults (deep copy nested objects)
+    const config = {
+        ...DEFAULT_CONFIG,
+        lifecycleEnforcement: { ...DEFAULT_LIFECYCLE_ENFORCEMENT },
+        protocolValidation: { ...DEFAULT_PROTOCOL_VALIDATION },
+        rateLimiting: {
+            ...DEFAULT_RATE_LIMITING,
+            query: { ...DEFAULT_RATE_LIMITING.query },
+            mutate: { ...DEFAULT_RATE_LIMITING.mutate },
+            spawn: { ...DEFAULT_RATE_LIMITING.spawn },
+        },
+    };
+    // Load from file (overrides defaults)
+    const fileConfig = loadFromFile(projectRoot);
+    // Merge nested objects carefully
+    if (fileConfig.lifecycleEnforcement) {
+        config.lifecycleEnforcement = {
+            ...config.lifecycleEnforcement,
+            ...fileConfig.lifecycleEnforcement,
+        };
+        delete fileConfig.lifecycleEnforcement;
+    }
+    if (fileConfig.protocolValidation) {
+        config.protocolValidation = {
+            ...config.protocolValidation,
+            ...fileConfig.protocolValidation,
+        };
+        delete fileConfig.protocolValidation;
+    }
+    if (fileConfig.rateLimiting) {
+        config.rateLimiting = {
+            ...config.rateLimiting,
+            ...fileConfig.rateLimiting,
+            query: { ...config.rateLimiting.query, ...fileConfig.rateLimiting.query },
+            mutate: { ...config.rateLimiting.mutate, ...fileConfig.rateLimiting.mutate },
+            spawn: { ...config.rateLimiting.spawn, ...fileConfig.rateLimiting.spawn },
+        };
+        delete fileConfig.rateLimiting;
+    }
+    Object.assign(config, fileConfig);
+    // Load from environment (overrides file and defaults)
+    for (const key of Object.keys(DEFAULT_CONFIG)) {
+        const envValue = loadFromEnv(key);
+        if (envValue !== undefined) {
+            config[key] = parseEnvValue(key, envValue);
+        }
+    }
+    // Validate final configuration
+    validateConfig(config);
+    return config;
+}
+/**
+ * Global configuration singleton
+ * Loaded once at module initialization
+ */
+let globalConfig = null;
+/**
+ * Get global configuration (singleton)
+ */
+export function getConfig() {
+    if (globalConfig === null) {
+        globalConfig = loadConfig();
+    }
+    return globalConfig;
+}
+/**
+ * Reset global configuration (for testing)
+ */
+export function resetConfig() {
+    globalConfig = null;
+}
+//# sourceMappingURL=config.js.map

package/dist/mcp/lib/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/mcp/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAEL,cAAc,EACd,6BAA6B,EAC7B,2BAA2B,EAC3B,qBAAqB,EACrB,UAAU,EACV,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAErC;IACA;IACA;IAHT,YACS,KAAa,EACb,KAAc,EACd,UAAkB;QAEzB,KAAK,CAAC,yBAAyB,KAAK,MAAM,UAAU,SAAS,KAAK,GAAG,CAAC,CAAC;QAJhE,UAAK,GAAL,KAAK,CAAQ;QACb,UAAK,GAAL,KAAK,CAAS;QACd,eAAU,GAAV,UAAU,CAAQ;QAGzB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;IACnD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,KAAa;IAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAiC,CAAC,CAAC;IAEhE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,WAAoB;IACxC,MAAM,IAAI,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAEtD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,wCAAwC;QACxC,MAAM,MAAM,GAAuB,EAAE,CAAC;QAEtC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC1E,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC1E,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS;gBAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC7E,IAAI,MAAM,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS;gBAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;YAC5F,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS;gBAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;YACnF,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,KAAK,SAAS;gBAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YACtG,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,KAAK,SAAS;gBAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC/G,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,SAAS;gBAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAChG,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,KAAK,SAAS;gBAAE,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1H,CAAC;QAED,sDAAsD;QACtD,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAChC,MAAM,CAAC,oBAAoB,GAAG;gBAC5B,GAAG,6BAA6B;gBAChC,GAAG,MAAM,CAAC,oBAAoB;aAC/B,CAAC;QACJ,CAAC;QAED,oDAAoD;QACpD,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,CAAC,kBAAkB,GAAG;gBAC1B,GAAG,2BAA2B;gBAC9B,GAAG,MAAM,CAAC,kBAAkB;aAC7B,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC;YACjE,MAAM,CAAC,YAAY,GAAG;gBACpB,GAAG,qBAAqB;gBACxB,GAAG,QAAQ;gBACX,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE;gBAC7D,MAAM,EAAE,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE;gBAChE,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE;aAC9D,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mDAAmD;QACnD,OAAO,CAAC,KAAK,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,KAAc;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAiC,CAAC,CAAC;IAEhE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,6BAA6B;IACvC,CAAC;IAED,aAAa;IACb,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC;IAChC,IAAI,UAAU,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,qBAAqB,CAC7B,GAAG,EACH,KAAK,EACL,mBAAmB,MAAM,CAAC,IAAI,EAAE,CACjC,CAAC;IACJ,CAAC;IAED,aAAa;IACb,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAc,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,qBAAqB,CAC7B,GAAG,EACH,KAAK,EACL,mBAAmB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,KAAe,CAAC;QACjC,IAAI,KAAK,IAAI,MAAM,IAAI,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,qBAAqB,CAC7B,GAAG,EACH,KAAK,EACL,cAAc,MAAM,CAAC,GAAG,EAAE,CAC3B,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,IAAI,MAAM,IAAI,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,qBAAqB,CAC7B,GAAG,EACH,KAAK,EACL,cAAc,MAAM,CAAC,GAAG,EAAE,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiB;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,uBAAuB;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1D,IAAI,UAAU,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,GAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,IAAI,qBAAqB,CAAC,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,WAAoB;IAC7C,iDAAiD;IACjD,MAAM,MAAM,GAAc;QACxB,GAAG,cAAc;QACjB,oBAAoB,EAAE,EAAE,GAAG,6BAA6B,EAAE;QAC1D,kBAAkB,EAAE,EAAE,GAAG,2BAA2B,EAAE;QACtD,YAAY,EAAE;YACZ,GAAG,qBAAqB;YACxB,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE;YACzC,MAAM,EAAE,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE;YAC3C,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE;SAC1C;KACF,CAAC;IAEF,sCAAsC;IACtC,MAAM,UAAU,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC7C,iCAAiC;IACjC,IAAI,UAAU,CAAC,oBAAoB,EAAE,CAAC;QACpC,MAAM,CAAC,oBAAoB,GAAG;YAC5B,GAAG,MAAM,CAAC,oBAAoB;YAC9B,GAAG,UAAU,CAAC,oBAAoB;SACnC,CAAC;QACF,OAAQ,UAAkB,CAAC,oBAAoB,CAAC;IAClD,CAAC;IACD,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;QAClC,MAAM,CAAC,kBAAkB,GAAG;YAC1B,GAAG,MAAM,CAAC,kBAAkB;YAC5B,GAAG,UAAU,CAAC,kBAAkB;SACjC,CAAC;QACF,OAAQ,UAAkB,CAAC,kBAAkB,CAAC;IAChD,CAAC;IACD,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,CAAC,YAAY,GAAG;YACpB,GAAG,MAAM,CAAC,YAAY;YACtB,GAAG,UAAU,CAAC,YAAY;YAC1B,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE;YACzE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE;YAC5E,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE;SAC1E,CAAC;QACF,OAAQ,UAAkB,CAAC,YAAY,CAAC;IAC1C,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAElC,sDAAsD;IACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAA2B,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAU,CAAC;QACtD,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,IAAI,YAAY,GAAqB,IAAI,CAAC;AAE1C;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,YAAY,GAAG,UAAU,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC"}