@cybedefend/vibedefend 1.4.7 → 1.6.0

package/dist/mcp/proxy/spec.js

@@ -0,0 +1,203 @@
+/**
+ * What the proxy needs to reach one upstream MCP server, and how the CLI
+ * options turn into it.
+ *
+ * Phase 5 will read the same shape out of `~/.cybedefend/mcp/upstreams.json`;
+ * Phase 1 builds it from the command line only.
+ */
+import { parse as parseShellWords } from 'shell-quote';
+import { PROXY_ENV_PREFIX } from './paths.js';
+export class UpstreamSpecError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'UpstreamSpecError';
+    }
+}
+/** A short, stable label for logs. Never used as an identity (that is Phase 3). */
+export function describeUpstream(spec) {
+    return spec.transport === 'http'
+        ? spec.url
+        : [spec.command, ...spec.args].join(' ').trim() || spec.command;
+}
+function isHttpUrl(value) {
+    return /^https?:\/\//i.test(value.trim());
+}
+/** Shell operators, refused on both platforms. The proxy never runs a shell. */
+const WINDOWS_SHELL_OPERATORS = /(?:&&|\|\||[|&<>^])/;
+/**
+ * Splits a Windows command line.
+ *
+ * ⚠️ A backslash is a PATH SEPARATOR here, never an escape. That single
+ * difference is why this branch exists: run through a POSIX tokeniser,
+ * `C:\Program\node.exe` comes back as `C:Programnode.exe`, so
+ * `--upstream "C:\...\node.exe C:\...\index.js"` launched an executable
+ * that does not exist and the server exited 1 without naming anything.
+ * Measured on 2026-09-09, the first time this suite ran on a real Windows
+ * runner — the option had been broken on every Windows machine until then.
+ *
+ * Double quotes group, and only outside them do shell operators count: a
+ * `&&` inside a quoted argument is data, not syntax.
+ */
+function parseWindowsCommandLine(input) {
+    const words = [];
+    let current = '';
+    let quoted = false;
+    let started = false;
+    for (const char of input) {
+        if (char === '"') {
+            quoted = !quoted;
+            started = true;
+            continue;
+        }
+        if (!quoted && /\s/.test(char)) {
+            if (started)
+                words.push(current);
+            current = '';
+            started = false;
+            continue;
+        }
+        current += char;
+        started = true;
+    }
+    if (started)
+        words.push(current);
+    // Operators are looked for in the UNQUOTED text only, which is what
+    // `cmd.exe` would act on.
+    const unquoted = input.replace(/"[^"]*"/g, '');
+    if (WINDOWS_SHELL_OPERATORS.test(unquoted)) {
+        throw new UpstreamSpecError('shell syntax is not supported in an upstream command. ' +
+            'Pass the command and its arguments after `--`, or use --upstream-command / --upstream-arg.');
+    }
+    return words;
+}
+/**
+ * Splits a `--upstream "npx -y pkg"` string into a command and its arguments.
+ *
+ * Shell operators, globs and comments are refused rather than honoured: the
+ * proxy never runs a shell, so accepting `&&` here would either drop the tail
+ * silently or, worse, be interpreted later by `cmd.exe` on Windows. The
+ * parser is told to leave `$VAR` alone — there is no variable expansion in
+ * this option, and a value that silently became the empty string would be a
+ * hard bug to find.
+ *
+ * The platform is a parameter, not a read of `process.platform`, so both
+ * branches are exercised on every runner instead of only the one the test
+ * happens to run on — which is exactly how the backslash defect survived.
+ */
+export function parseCommandLine(input, platform = process.platform) {
+    if (platform === 'win32') {
+        const words = parseWindowsCommandLine(input);
+        if (words.length === 0)
+            throw new UpstreamSpecError('the upstream command is empty');
+        return { command: words[0], args: words.slice(1) };
+    }
+    const tokens = parseShellWords(input, (key) => `$${key}`);
+    const words = [];
+    for (const token of tokens) {
+        if (typeof token !== 'string') {
+            const rendered = typeof token === 'object' && token !== null && 'op' in token
+                ? String(token.op)
+                : 'a glob or a comment';
+            throw new UpstreamSpecError(`shell syntax is not supported in an upstream command (found ${rendered}). ` +
+                'Pass the command and its arguments after `--`, or use --upstream-command / --upstream-arg.');
+        }
+        words.push(token);
+    }
+    if (words.length === 0)
+        throw new UpstreamSpecError('the upstream command is empty');
+    return { command: words[0], args: words.slice(1) };
+}
+/** `KEY=VALUE`, repeated. An empty value is legal; a missing `=` is not. */
+export function parseAssignments(entries, label) {
+    const out = {};
+    for (const entry of entries) {
+        const separator = entry.indexOf('=');
+        if (separator <= 0) {
+            throw new UpstreamSpecError(`${label} expects KEY=VALUE, got "${entry}"`);
+        }
+        out[entry.slice(0, separator)] = entry.slice(separator + 1);
+    }
+    return out;
+}
+/** `Name: value`, repeated. The value keeps its internal colons. */
+export function parseHeaders(entries) {
+    const out = {};
+    for (const entry of entries) {
+        const separator = entry.indexOf(':');
+        if (separator <= 0) {
+            throw new UpstreamSpecError(`--header expects "Name: value", got "${entry}"`);
+        }
+        out[entry.slice(0, separator).trim()] = entry.slice(separator + 1).trim();
+    }
+    return out;
+}
+/**
+ * Builds the spec from the CLI options, in decreasing order of explicitness:
+ * the `--` form wins over `--upstream-command`, which wins over `--upstream`.
+ */
+export function resolveUpstreamSpec(options) {
+    const env = options.upstreamEnv?.length
+        ? parseAssignments(options.upstreamEnv, '--upstream-env')
+        : undefined;
+    const headers = options.header?.length ? parseHeaders(options.header) : undefined;
+    const trailing = options.trailing?.filter((part) => part !== '--') ?? [];
+    if (trailing.length > 0) {
+        return stdio(trailing[0], trailing.slice(1), env, options.upstreamCwd);
+    }
+    if (options.upstreamCommand) {
+        return stdio(options.upstreamCommand, options.upstreamArg ?? [], env, options.upstreamCwd);
+    }
+    if (options.upstream) {
+        if (isHttpUrl(options.upstream)) {
+            return { transport: 'http', url: options.upstream.trim(), headers };
+        }
+        const { command, args } = parseCommandLine(options.upstream);
+        return stdio(command, args, env, options.upstreamCwd);
+    }
+    throw new UpstreamSpecError('no upstream given. Use --upstream <url|command>, --upstream-command <cmd>, or pass the command after `--`.');
+}
+function stdio(command, args, env, cwd) {
+    if (!command || command.trim() === '') {
+        throw new UpstreamSpecError('the upstream command is empty');
+    }
+    return { transport: 'stdio', command, args: [...args], env, cwd };
+}
+/**
+ * Variables removed from the environment of a spawned upstream.
+ *
+ * `VIBEDEFEND_MCP_*` because it is the proxy's own configuration: an upstream
+ * would see settings that are none of its business, and — the reason this is
+ * testable — a server that reports its environment would answer differently
+ * behind the proxy than in front of it, which is the one thing Phase 1 rules
+ * out.
+ *
+ * The two token variables for a much harder reason. The proxy READS them as
+ * its own CybeDefend credential (`src/mcp/verify/token.ts`), and the process
+ * it is about to spawn is precisely the untrusted thing this product exists
+ * to watch. Handing it the credential we use to ask whether IT is malicious
+ * is not a defensible default, whatever the client would have done on its own.
+ */
+export const STRIPPED_UPSTREAM_ENV_VARS = [
+    'CYBEDEFEND_TOKEN',
+    'VIBEDEFEND_TOKEN',
+];
+/**
+ * The environment handed to a stdio upstream.
+ *
+ * An explicit `--upstream-env` override still wins: an operator who spelled a
+ * variable out on the command line meant that server to have it.
+ */
+export function upstreamEnvironment(parent, overrides) {
+    const out = {};
+    for (const [key, value] of Object.entries(parent)) {
+        if (value === undefined)
+            continue;
+        if (key.startsWith(PROXY_ENV_PREFIX))
+            continue;
+        if (STRIPPED_UPSTREAM_ENV_VARS.includes(key))
+            continue;
+        out[key] = value;
+    }
+    return overrides ? { ...out, ...overrides } : out;
+}
+//# sourceMappingURL=spec.js.map

package/dist/mcp/proxy/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/mcp/proxy/spec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAoB9C,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,IAAkB;IACjD,OAAO,IAAI,CAAC,SAAS,KAAK,MAAM;QAC9B,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;GAaG;AACH,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC,MAAM,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,OAAO,IAAI,IAAI,CAAC;QAChB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEjC,oEAAoE;IACpE,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,iBAAiB,CACzB,wDAAwD;YACtD,4FAA4F,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;QACrF,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK;gBAC1D,CAAC,CAAC,MAAM,CAAE,KAAyB,CAAC,EAAE,CAAC;gBACvC,CAAC,CAAC,qBAAqB,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,+DAA+D,QAAQ,KAAK;gBAC1E,4FAA4F,CAC/F,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;IACrF,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAC9B,OAA0B,EAC1B,KAAa;IAEb,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,iBAAiB,CAAC,GAAG,KAAK,4BAA4B,KAAK,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,OAA0B;IACrD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,KAAK,GAAG,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAwB;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM;QACrC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACzD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAElF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;IACzE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,IAAI,iBAAiB,CACzB,4GAA4G,CAC7G,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CACZ,OAAe,EACf,IAAuB,EACvB,GAAuC,EACvC,GAAuB;IAEvB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,kBAAkB;IAClB,kBAAkB;CACnB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAyB,EACzB,SAAkC;IAElC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAC/C,IAAI,0BAA0B,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACvD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACpD,CAAC"}

package/dist/mcp/proxy/sse.js

@@ -0,0 +1,77 @@
+const LINE_BREAK = /\r\n|\n|\r/;
+export class SseParser {
+    buffer = '';
+    dataLines = [];
+    eventName;
+    eventId;
+    retry;
+    /** Survives across events: an event without `id:` keeps the previous one. */
+    lastEventId;
+    push(chunk) {
+        this.buffer += chunk;
+        const events = [];
+        for (;;) {
+            const match = LINE_BREAK.exec(this.buffer);
+            if (!match)
+                break;
+            const line = this.buffer.slice(0, match.index);
+            this.buffer = this.buffer.slice(match.index + match[0].length);
+            const event = this.consumeLine(line);
+            if (event)
+                events.push(event);
+        }
+        return events;
+    }
+    get currentEventId() {
+        return this.lastEventId;
+    }
+    consumeLine(line) {
+        if (line === '')
+            return this.dispatch();
+        if (line.startsWith(':'))
+            return undefined;
+        const colon = line.indexOf(':');
+        const field = colon === -1 ? line : line.slice(0, colon);
+        let value = colon === -1 ? '' : line.slice(colon + 1);
+        if (value.startsWith(' '))
+            value = value.slice(1);
+        switch (field) {
+            case 'event':
+                this.eventName = value;
+                break;
+            case 'data':
+                this.dataLines.push(value);
+                break;
+            case 'id':
+                this.eventId = value;
+                break;
+            case 'retry': {
+                const parsed = Number(value);
+                if (Number.isInteger(parsed) && parsed >= 0)
+                    this.retry = parsed;
+                break;
+            }
+            default:
+                break;
+        }
+        return undefined;
+    }
+    dispatch() {
+        const hadData = this.dataLines.length > 0;
+        const data = this.dataLines.join('\n');
+        const name = this.eventName;
+        const id = this.eventId;
+        const retry = this.retry;
+        this.dataLines = [];
+        this.eventName = undefined;
+        this.eventId = undefined;
+        this.retry = undefined;
+        if (id !== undefined)
+            this.lastEventId = id;
+        // A blank line that closed nothing is a heartbeat, not an event.
+        if (!hadData && name === undefined)
+            return undefined;
+        return { event: name ?? 'message', data, id: id ?? this.lastEventId, retry };
+    }
+}
+//# sourceMappingURL=sse.js.map

package/dist/mcp/proxy/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../../src/mcp/proxy/sse.ts"],"names":[],"mappings":"AAmBA,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC,MAAM,OAAO,SAAS;IACZ,MAAM,GAAG,EAAE,CAAC;IACZ,SAAS,GAAa,EAAE,CAAC;IACzB,SAAS,CAAqB;IAC9B,OAAO,CAAqB;IAC5B,KAAK,CAAqB;IAClC,6EAA6E;IACrE,WAAW,CAAqB;IAExC,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACrB,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK;gBAAE,MAAM;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,WAAW,CAAC,IAAY;QAC9B,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAElD,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,OAAO;gBACV,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;gBACvB,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3B,MAAM;YACR,KAAK,IAAI;gBACP,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;gBACrB,MAAM;YACR,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;oBAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;gBACjE,MAAM;YACR,CAAC;YACD;gBACE,MAAM;QACV,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,QAAQ;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAEzB,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,EAAE,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;QAE5C,iEAAiE;QACjE,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;IAC/E,CAAC;CACF"}

package/dist/mcp/proxy/upstream.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=upstream.js.map

package/dist/mcp/proxy/upstream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.js","sourceRoot":"","sources":["../../../src/mcp/proxy/upstream.ts"],"names":[],"mappings":""}