@clonst/clonst 1.0.0

package/dist/utils/logger.js

@@ -0,0 +1,141 @@
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { logsDir } from "./paths.js";
+/**
+ * Human-readable server log: stderr only (stdout is reserved for the MCP stdio protocol).
+ */
+export function logStderr(message) {
+    process.stderr.write(`[clonst] ${message}\n`);
+}
+const SAFE_NAME = /^[A-Za-z0-9._-]+$/;
+/**
+ * Neutralizes any path traversal in a file/directory name: characters outside
+ * the whitelist become "_", "." and ".." are forbidden.
+ * Sanitization (not rejection): an ugly name beats a lost LLM response.
+ */
+export function sanitizeName(value) {
+    const cleaned = value.replace(/[^A-Za-z0-9._-]/g, "_");
+    if (cleaned === "" || /^\.+$/.test(cleaned))
+        return "_";
+    return cleaned;
+}
+function isValidSessionId(value) {
+    return SAFE_NAME.test(value) && !/^\.+$/.test(value);
+}
+/**
+ * Logger for one review session: one JSONL line per event, plus systematic
+ * saving of the complete raw CLI responses (project rule: never lose a paid
+ * LLM response, even if parsing fails afterwards).
+ *
+ * Layout:
+ *   ~/.clonst/logs/<sessionId>.jsonl
+ *   ~/.clonst/logs/raw/<sessionId>/<name>.txt
+ *
+ * A full ping-pong lives under ONE sessionId: round 1 starts under a
+ * provisional identifier then is migrated (migrateTo) to the reviewer's
+ * thread_id once known; later rounds open directly under that thread_id.
+ */
+export class SessionLogger {
+    _sessionId;
+    _jsonlPath;
+    _rawDir;
+    constructor(sessionId) {
+        // The sessionId is generated by Clonst: a non-conforming name is an internal bug, throw early.
+        if (!isValidSessionId(sessionId)) {
+            throw new Error(`Invalid sessionId: "${sessionId}"`);
+        }
+        this._sessionId = sessionId;
+        const dir = logsDir();
+        this._jsonlPath = path.join(dir, `${sessionId}.jsonl`);
+        this._rawDir = path.join(dir, "raw", sessionId);
+        mkdirSync(dir, { recursive: true });
+    }
+    get sessionId() {
+        return this._sessionId;
+    }
+    /** Path of the session's JSONL file (exposed for caller-side diagnostics). */
+    get jsonlPath() {
+        return this._jsonlPath;
+    }
+    /**
+     * Renames the session (JSONL file + raw directory) to a new identifier,
+     * typically the reviewer's thread_id once known at round 1. Never throws:
+     * on failure (existing target, lock...) the session keeps its provisional
+     * identifier and the failure is reported. Returns true if migration happened.
+     */
+    migrateTo(newSessionId) {
+        if (!isValidSessionId(newSessionId)) {
+            logStderr(`session migration refused: invalid identifier "${newSessionId}"`);
+            return false;
+        }
+        if (newSessionId === this._sessionId)
+            return true;
+        const dir = logsDir();
+        const newJsonlPath = path.join(dir, `${newSessionId}.jsonl`);
+        const newRawDir = path.join(dir, "raw", newSessionId);
+        try {
+            if (existsSync(newJsonlPath) || existsSync(newRawDir)) {
+                logStderr(`session migration refused: "${newSessionId}" already exists, logs kept under "${this._sessionId}"`);
+                return false;
+            }
+            if (existsSync(this._jsonlPath))
+                renameSync(this._jsonlPath, newJsonlPath);
+            if (existsSync(this._rawDir))
+                renameSync(this._rawDir, newRawDir);
+            const previous = this._sessionId;
+            this._sessionId = newSessionId;
+            this._jsonlPath = newJsonlPath;
+            this._rawDir = newRawDir;
+            this.log({ event: "session_migrated", from: previous, to: newSessionId });
+            return true;
+        }
+        catch (err) {
+            logStderr(`session migration failed (${err instanceof Error ? err.message : String(err)}), logs kept under "${this._sessionId}"`);
+            return false;
+        }
+    }
+    /** Appends a timestamped JSONL line. Never throws: a logging failure must not break a review. */
+    log(entry) {
+        try {
+            const line = JSON.stringify({ timestamp: new Date().toISOString(), ...entry });
+            appendFileSync(this._jsonlPath, line + "\n", "utf-8");
+        }
+        catch (err) {
+            logStderr(`failed to write JSONL log: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    /**
+     * Path of a file inside the session's raw directory (name sanitized,
+     * directory created). Used for files written directly by the CLIs
+     * (--output-last-message).
+     */
+    rawPath(name) {
+        mkdirSync(this._rawDir, { recursive: true });
+        return path.join(this._rawDir, sanitizeName(name));
+    }
+    /** Re-reads a file from the session's raw directory. null if absent or unreadable. */
+    readRaw(name) {
+        try {
+            return readFileSync(this.rawPath(name), "utf-8");
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Saves a complete raw response (CLI JSONL stdout, last message, etc.).
+     * Call it BEFORE any parsing attempt. Returns the written path, or null on failure.
+     */
+    saveRaw(name, content) {
+        try {
+            const filePath = this.rawPath(name);
+            writeFileSync(filePath, content, "utf-8");
+            return filePath;
+        }
+        catch (err) {
+            logStderr(`failed to save raw response ${name}: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=logger.js.map

package/dist/utils/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzG,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,OAAO,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC;IACxD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,aAAa;IAChB,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,OAAO,CAAS;IAExB,YAAY,SAAiB;QAC3B,+FAA+F;QAC/F,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAChD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,8EAA8E;IAC9E,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,YAAoB;QAC5B,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;YACpC,SAAS,CAAC,kDAAkD,YAAY,GAAG,CAAC,CAAC;YAC7E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,YAAY,KAAK,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAElD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,QAAQ,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtD,SAAS,CAAC,+BAA+B,YAAY,sCAAsC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;gBAC/G,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAC3E,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC;YACjC,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC;YAC/B,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC;YAC/B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;YAClI,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,iGAAiG;IACjG,GAAG,CAAC,KAA8B;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC/E,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,IAAY;QAClB,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,sFAAsF;IACtF,OAAO,CAAC,IAAY;QAClB,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,IAAY,EAAE,OAAe;QACnC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC1C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,+BAA+B,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/utils/paths.js

@@ -0,0 +1,16 @@
+import os from "node:os";
+import path from "node:path";
+/**
+ * Root of Clonst's persistent data (config, logs, raw responses).
+ * Overridable through CLONST_HOME (used by tests to isolate themselves).
+ */
+export function clonstHome() {
+    return process.env.CLONST_HOME || path.join(os.homedir(), ".clonst");
+}
+export function logsDir() {
+    return path.join(clonstHome(), "logs");
+}
+export function configPath() {
+    return path.join(clonstHome(), "config.json");
+}
+//# sourceMappingURL=paths.js.map

package/dist/utils/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/utils/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC"}

package/dist/utils/process.js

@@ -0,0 +1,186 @@
+import { spawn } from "node:child_process";
+import { logStderr } from "./logger.js";
+export const DEFAULT_TIMEOUT_MS = 600_000;
+/** After a timeout kill, max delay before giving up even if 'close' never fires. */
+const KILL_GRACE_MS = 10_000;
+// Variables inherited from the parent Claude Code session (Clonst is spawned by
+// it). We do not propagate them to LLM CLIs: they can trigger nested-session
+// behaviors.
+const STRIPPED_ENV_PREFIXES = ["CLAUDECODE", "CLAUDE_CODE_"];
+export function cleanEnv(base = process.env) {
+    const env = {};
+    for (const [key, value] of Object.entries(base)) {
+        if (STRIPPED_ENV_PREFIXES.some((prefix) => key.startsWith(prefix)))
+            continue;
+        env[key] = value;
+    }
+    return env;
+}
+/**
+ * Guard for dynamic identifiers (e.g. the thread_id returned by Codex).
+ * Accepts only [A-Za-z0-9._-], enough for UUIDs and model names.
+ * Do NOT use this for file paths: quoteArg handles those.
+ */
+export function assertSafeArg(arg, label) {
+    if (!/^[A-Za-z0-9._-]+$/.test(arg)) {
+        throw new Error(`Unsafe dynamic argument for ${label}: "${arg}"`);
+    }
+    return arg;
+}
+// Characters that need no quoting (simple Windows/POSIX paths included).
+const WIN_SAFE_ARG = /^[A-Za-z0-9_\-.:\\/=]+$/;
+const POSIX_SAFE_ARG = /^[A-Za-z0-9_\-.:/=]+$/;
+/**
+ * Centralized argument quoting for shell:true (required on Windows for the npm
+ * .cmd/.ps1 shims). Callers pass RAW arguments, never pre-quoted ones.
+ *
+ * Windows (cmd.exe + msvcrt parsing): the characters `"`, `%` and newlines have
+ * no legitimate use in Clonst (flags, UUIDs, paths) and their cmd escaping rules
+ * are too fragile: explicit rejection. Other arguments are wrapped in double
+ * quotes, with trailing backslashes doubled (msvcrt rule: `C:\dir\` -> `"C:\dir\\"`).
+ *
+ * POSIX (/bin/sh): single quotes, with `'` escaped as `'\''`.
+ */
+export function quoteArg(arg) {
+    if (arg.length === 0) {
+        return process.platform === "win32" ? '""' : "''";
+    }
+    if (process.platform === "win32") {
+        if (WIN_SAFE_ARG.test(arg))
+            return arg;
+        if (/["%\r\n]/.test(arg)) {
+            throw new Error(`Argument cannot be safely represented under cmd.exe: "${arg}"`);
+        }
+        const withDoubledTrailingBackslashes = arg.replace(/(\\+)$/, "$1$1");
+        return `"${withDoubledTrailingBackslashes}"`;
+    }
+    if (POSIX_SAFE_ARG.test(arg))
+        return arg;
+    return `'${arg.replaceAll("'", `'\\''`)}'`;
+}
+function killProcessTree(pid) {
+    if (process.platform === "win32") {
+        // proc.kill() would only kill the intermediate shell (shell:true): the child
+        // codex.exe would survive and keep consuming quota. taskkill /T kills the tree.
+        const killer = spawn("taskkill", ["/pid", String(pid), "/T", "/F"], {
+            shell: false,
+            stdio: "ignore",
+        });
+        killer.on("error", (err) => {
+            logStderr(`taskkill unreachable for pid ${pid}: ${err.message}`);
+        });
+        killer.on("exit", (code) => {
+            if (code !== 0) {
+                logStderr(`taskkill failed for pid ${pid} (exit ${code}): orphan process possible`);
+            }
+        });
+    }
+    else {
+        // The process was spawned with detached:true, so it leads its own group:
+        // kill(-pid) kills the whole group (shell + child CLI).
+        try {
+            process.kill(-pid, "SIGKILL");
+        }
+        catch {
+            try {
+                process.kill(pid, "SIGKILL");
+            }
+            catch {
+                // already gone
+            }
+        }
+    }
+}
+// A simple executable name: letters/digits/._-, no path separator, no space.
+const SIMPLE_COMMAND = /^[A-Za-z0-9._-]+$/;
+/**
+ * Spawns a CLI and captures stdout/stderr as UTF-8.
+ *
+ * Contract:
+ * - `command` is a SIMPLE EXECUTABLE NAME resolved via PATH ("codex", "node", ...).
+ *   Never a path (absolute or relative), never dynamic content: with shell:true,
+ *   the command is not quoted by Node and a path with spaces would break
+ *   (C:\Program Files\...). Validated here, fails early otherwise.
+ * - `args` is passed RAW (no caller-side pre-quoting), quoting is centralized
+ *   here through quoteArg. This covers dynamic paths passed as arguments, e.g.
+ *   `--output-last-message <file under ~/.clonst/>` (tested, spaces included).
+ * - Large variable content (prompts) goes through options.stdin.
+ */
+export function spawnCLI(command, args, options = {}) {
+    if (!SIMPLE_COMMAND.test(command)) {
+        throw new Error(`spawnCLI expects a simple executable name resolved via PATH, got: "${command}"`);
+    }
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const start = Date.now();
+    const quotedArgs = args.map(quoteArg);
+    return new Promise((resolve, reject) => {
+        const proc = spawn(command, quotedArgs, {
+            cwd: options.cwd,
+            env: cleanEnv(),
+            shell: true,
+            windowsHide: true,
+            // POSIX: process group leader, so kill(-pid) kills the whole tree.
+            detached: process.platform !== "win32",
+        });
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        let settled = false;
+        let graceTimer;
+        const settle = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (graceTimer)
+                clearTimeout(graceTimer);
+            resolve(result);
+        };
+        const timer = setTimeout(() => {
+            timedOut = true;
+            if (proc.pid !== undefined)
+                killProcessTree(proc.pid);
+            // If even the kill does not trigger 'close' (taskkill failure), return what
+            // we have instead of blocking the caller forever.
+            graceTimer = setTimeout(() => {
+                logStderr(`process ${command} still alive ${KILL_GRACE_MS} ms after the kill, giving up`);
+                settle({ stdout, stderr, exitCode: null, durationMs: Date.now() - start, timedOut: true });
+            }, KILL_GRACE_MS);
+        }, timeoutMs);
+        proc.stdout.setEncoding("utf-8");
+        proc.stderr.setEncoding("utf-8");
+        proc.stdout.on("data", (chunk) => {
+            stdout += chunk;
+        });
+        proc.stderr.on("data", (chunk) => {
+            stderr += chunk;
+        });
+        // EPIPE is possible if the process dies before the pipe closes, with or
+        // without provided stdin (end() is called in every case): an error event
+        // without a listener would crash the whole MCP server.
+        proc.stdin.on("error", () => { });
+        if (options.stdin !== undefined) {
+            proc.stdin.write(options.stdin, "utf-8");
+        }
+        proc.stdin.end();
+        proc.on("error", (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (graceTimer)
+                clearTimeout(graceTimer);
+            reject(err);
+        });
+        proc.on("close", (code) => {
+            settle({
+                stdout,
+                stderr,
+                exitCode: code,
+                durationMs: Date.now() - start,
+                timedOut,
+            });
+        });
+    });
+}
+//# sourceMappingURL=process.js.map

package/dist/utils/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/utils/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAmBxC,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,oFAAoF;AACpF,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,gFAAgF;AAChF,6EAA6E;AAC7E,aAAa;AACb,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAE7D,MAAM,UAAU,QAAQ,CAAC,OAA0B,OAAO,CAAC,GAAG;IAC5D,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAAE,SAAS;QAC7E,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,KAAa;IACtD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,MAAM,GAAG,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,MAAM,YAAY,GAAG,yBAAyB,CAAC;AAC/C,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,8BAA8B,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,IAAI,8BAA8B,GAAG,CAAC;IAC/C,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACzC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,6EAA6E;QAC7E,gFAAgF;QAChF,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YAClE,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,SAAS,CAAC,gCAAgC,GAAG,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,SAAS,CAAC,2BAA2B,GAAG,UAAU,IAAI,4BAA4B,CAAC,CAAC;YACtF,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,yEAAyE;QACzE,wDAAwD;QACxD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAe,EACf,IAAc,EACd,UAA2B,EAAE;IAE7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,sEAAsE,OAAO,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE;YACtC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,QAAQ,EAAE;YACf,KAAK,EAAE,IAAI;YACX,WAAW,EAAE,IAAI;YACjB,mEAAmE;YACnE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACvC,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,UAAsC,CAAC;QAE3C,MAAM,MAAM,GAAG,CAAC,MAAsB,EAAQ,EAAE;YAC9C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,UAAU;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YACzC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;gBAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtD,4EAA4E;YAC5E,kDAAkD;YAClD,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,SAAS,CAAC,WAAW,OAAO,gBAAgB,aAAa,+BAA+B,CAAC,CAAC;gBAC1F,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7F,CAAC,EAAE,aAAa,CAAC,CAAC;QACpB,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACvC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACvC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAEjB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,UAAU;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,CAAC;gBACL,MAAM;gBACN,MAAM;gBACN,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@clonst/clonst",
+  "version": "1.0.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "description": "MCP server that lets Claude Code get its plans and code adversarially reviewed by Codex, in a ping-pong loop until consensus",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "clonst": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "!dist/tests"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "npm test && npm run smoke",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "smoke": "node scripts/smoke-mcp.mjs",
+    "test": "npm run build && node --test \"dist/tests/**/*.test.js\""
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "keywords": [
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
+    "claude",
+    "claude-code",
+    "codex",
+    "openai",
+    "anthropic",
+    "chatgpt",
+    "code-review",
+    "ai-code-review",
+    "adversarial-review",
+    "second-opinion",
+    "llm",
+    "developer-tools"
+  ],
+  "author": "Christopher <christopher@capritora.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/capritora/clonst.git"
+  },
+  "homepage": "https://github.com/capritora/clonst#readme",
+  "bugs": {
+    "url": "https://github.com/capritora/clonst/issues"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.0",
+    "typescript": "^6.0.3"
+  }
+}