@decohere/scaffold 0.0.1-dev.18 → 0.0.1-dev.81

package/commonjs/src/webapi/devcontainer/codebase-rag-mcp.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "codebaseRagMcp", {
+    enumerable: true,
+    get: function() {
+        return codebaseRagMcp;
+    }
+});
+const _nodefs = require("node:fs");
+const _nodepath = require("node:path");
+const _nodeurl = require("node:url");
+function isRecord(value) {
+    return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function loadDotenv(path, env) {
+    let raw;
+    try {
+        raw = (0, _nodefs.readFileSync)(path, "utf8");
+    } catch  {
+        return;
+    }
+    for (const line of raw.split(/\r?\n/)){
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#") || !trimmed.includes("=")) continue;
+        const eq = trimmed.indexOf("=");
+        const key = trimmed.slice(0, eq).trim();
+        const value = trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
+        if (key && env[key] === undefined) env[key] = value;
+    }
+}
+function seedFromMcpJson(raw) {
+    let data;
+    try {
+        data = JSON.parse(raw);
+    } catch  {
+        return null;
+    }
+    if (!isRecord(data)) return null;
+    const servers = data.mcpServers;
+    if (!isRecord(servers)) return null;
+    const server = servers["codebase-rag"];
+    if (!isRecord(server)) return null;
+    const url = typeof server.url === "string" ? server.url.trim() : "";
+    const headers = isRecord(server.headers) ? server.headers : {};
+    const auth = typeof headers.Authorization === "string" ? headers.Authorization.trim() : "";
+    const token = auth.toLowerCase().startsWith("bearer ") ? auth.slice(7).trim() : "";
+    if (!url.startsWith("http") || token.length === 0) return null;
+    return {
+        url,
+        token
+    };
+}
+function mergeIntoMcpJson(input) {
+    const { mcpPath, url, token, hostRoot } = input;
+    if (!url || !token) {
+        return {
+            skipped: "no URL/token"
+        };
+    }
+    const xRoot = hostRoot || "${workspaceFolder}";
+    (0, _nodefs.mkdirSync)((0, _nodepath.dirname)(mcpPath), {
+        recursive: true
+    });
+    let data = {
+        mcpServers: {}
+    };
+    try {
+        if ((0, _nodefs.statSync)(mcpPath).size > 0) {
+            const loaded = JSON.parse((0, _nodefs.readFileSync)(mcpPath, "utf8"));
+            if (isRecord(loaded)) data = loaded;
+        }
+    } catch (err) {
+        const code = isRecord(err) && typeof err.code === "string" ? err.code : "";
+        if (code !== "ENOENT") {
+            console.log("codebase-rag MCP: existing mcp.json is invalid JSON; replacing rag entry only after backup");
+            (0, _nodefs.renameSync)(mcpPath, `${mcpPath}.bak`);
+        }
+    }
+    const servers = isRecord(data.mcpServers) ? data.mcpServers : {};
+    data.mcpServers = servers;
+    servers["codebase-rag"] = {
+        url,
+        headers: {
+            Authorization: `Bearer ${token}`,
+            "X-Codebase-Root": xRoot
+        }
+    };
+    (0, _nodefs.writeFileSync)(mcpPath, `${JSON.stringify(data, null, 2)}\n`, "utf8");
+    try {
+        (0, _nodefs.chmodSync)(mcpPath, 0o600);
+    } catch  {
+    // memfs and some hosts omit chmod
+    }
+    return {
+        path: mcpPath,
+        root: xRoot
+    };
+}
+function workspaceRoot(env = process.env) {
+    const fromEnv = env.CODEBASE_RAG_WORKSPACE?.trim();
+    if (fromEnv) return fromEnv;
+    // Scaffolded copy lives at <repo>/.devcontainer/codebase-rag-mcp.ts
+    return (0, _nodepath.dirname)((0, _nodepath.dirname)((0, _nodeurl.fileURLToPath)(require("url").pathToFileURL(__filename).toString())));
+}
+function mergeFromEnv(env = process.env) {
+    const root = workspaceRoot(env);
+    const cursorDir = (0, _nodepath.join)(root, ".cursor");
+    loadDotenv((0, _nodepath.join)(cursorDir, "codebase-rag.env"), env);
+    const url = (env.CODEBASE_RAG_MCP_URL ?? "").trim();
+    const token = (env.CODEBASE_RAG_MCP_TOKEN ?? "").trim();
+    const hostRoot = (env.CODEBASE_RAG_MCP_ROOT ?? "").trim() || root;
+    const result = mergeIntoMcpJson({
+        mcpPath: (0, _nodepath.join)(cursorDir, "mcp.json"),
+        url,
+        token,
+        hostRoot
+    });
+    if (result.skipped != null) {
+        console.log(`codebase-rag MCP: skipped (${result.skipped})`);
+        return 0;
+    }
+    console.log(`codebase-rag MCP: wrote ${result.path} url=${url} root=${result.root}`);
+    return 0;
+}
+function seedPrint(mcpPath) {
+    let raw;
+    try {
+        raw = (0, _nodefs.readFileSync)(mcpPath, "utf8");
+    } catch  {
+        return 1;
+    }
+    const creds = seedFromMcpJson(raw);
+    if (creds == null) return 1;
+    console.log(creds.url);
+    console.log(creds.token);
+    return 0;
+}
+function main(argv = process.argv.slice(2)) {
+    const command = argv[0] ?? "merge";
+    if (command === "seed-print") {
+        const mcpPath = argv[1];
+        if (mcpPath == null || mcpPath.length === 0) return 1;
+        return seedPrint(mcpPath);
+    }
+    if (command === "merge") {
+        return mergeFromEnv();
+    }
+    console.error(`codebase-rag MCP: unknown command ${command}`);
+    return 1;
+}
+const invoked = (process.argv[1] ?? "").replaceAll("\\", "/");
+if (invoked.endsWith("/codebase-rag-mcp.ts") || invoked.endsWith("/codebase-rag-mcp.js")) {
+    process.exit(main());
+}
+const codebaseRagMcp = {
+    loadDotenv,
+    seedFromMcpJson,
+    mergeIntoMcpJson,
+    mergeFromEnv,
+    seedPrint,
+    main
+};
+
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9ob21lL3J1bm5lci93b3JrL2RlY29oZXJlL2RlY29oZXJlL3Byb2plY3RzL3NjYWZmb2xkL3NyYy93ZWJhcGkvZGV2Y29udGFpbmVyL2NvZGViYXNlLXJhZy1tY3AudHMiXSwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHtcblx0Y2htb2RTeW5jLFxuXHRta2RpclN5bmMsXG5cdHJlYWRGaWxlU3luYyxcblx0cmVuYW1lU3luYyxcblx0c3RhdFN5bmMsXG5cdHdyaXRlRmlsZVN5bmMsXG59IGZyb20gXCJub2RlOmZzXCI7XG5pbXBvcnQgeyBkaXJuYW1lLCBqb2luIH0gZnJvbSBcIm5vZGU6cGF0aFwiO1xuaW1wb3J0IHsgZmlsZVVSTFRvUGF0aCB9IGZyb20gXCJub2RlOnVybFwiO1xuXG5leHBvcnQgdHlwZSBDb2RlYmFzZVJhZ0NyZWRlbnRpYWxzID0ge1xuXHR1cmw6IHN0cmluZztcblx0dG9rZW46IHN0cmluZztcbn07XG5cbmV4cG9ydCB0eXBlIE1jcEpzb24gPSB7XG5cdG1jcFNlcnZlcnM/OiBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPjtcblx0W2tleTogc3RyaW5nXTogdW5rbm93bjtcbn07XG5cbmZ1bmN0aW9uIGlzUmVjb3JkKHZhbHVlOiB1bmtub3duKTogdmFsdWUgaXMgUmVjb3JkPHN0cmluZywgdW5rbm93bj4ge1xuXHRyZXR1cm4gdmFsdWUgIT0gbnVsbCAmJiB0eXBlb2YgdmFsdWUgPT09IFwib2JqZWN0XCIgJiYgIUFycmF5LmlzQXJyYXkodmFsdWUpO1xufVxuXG5mdW5jdGlvbiBsb2FkRG90ZW52KHBhdGg6IHN0cmluZywgZW52OiBOb2RlSlMuUHJvY2Vzc0Vudik6IHZvaWQge1xuXHRsZXQgcmF3OiBzdHJpbmc7XG5cdHRyeSB7XG5cdFx0cmF3ID0gcmVhZEZpbGVTeW5jKHBhdGgsIFwidXRmOFwiKTtcblx0fSBjYXRjaCB7XG5cdFx0cmV0dXJuO1xuXHR9XG5cdGZvciAoY29uc3QgbGluZSBvZiByYXcuc3BsaXQoL1xccj9cXG4vKSkge1xuXHRcdGNvbnN0IHRyaW1tZWQgPSBsaW5lLnRyaW0oKTtcblx0XHRpZiAoIXRyaW1tZWQgfHwgdHJpbW1lZC5zdGFydHNXaXRoKFwiI1wiKSB8fCAhdHJpbW1lZC5pbmNsdWRlcyhcIj1cIikpIGNvbnRpbnVlO1xuXHRcdGNvbnN0IGVxID0gdHJpbW1lZC5pbmRleE9mKFwiPVwiKTtcblx0XHRjb25zdCBrZXkgPSB0cmltbWVkLnNsaWNlKDAsIGVxKS50cmltKCk7XG5cdFx0Y29uc3QgdmFsdWUgPSB0cmltbWVkXG5cdFx0XHQuc2xpY2UoZXEgKyAxKVxuXHRcdFx0LnRyaW0oKVxuXHRcdFx0LnJlcGxhY2UoL15bXCInXXxbXCInXSQvZywgXCJcIik7XG5cdFx0aWYgKGtleSAmJiBlbnZba2V5XSA9PT0gdW5kZWZpbmVkKSBlbnZba2V5XSA9IHZhbHVlO1xuXHR9XG59XG5cbmZ1bmN0aW9uIHNlZWRGcm9tTWNwSnNvbihyYXc6IHN0cmluZyk6IENvZGViYXNlUmFnQ3JlZGVudGlhbHMgfCBudWxsIHtcblx0bGV0IGRhdGE6IHVua25vd247XG5cdHRyeSB7XG5cdFx0ZGF0YSA9IEpTT04ucGFyc2UocmF3KTtcblx0fSBjYXRjaCB7XG5cdFx0cmV0dXJuIG51bGw7XG5cdH1cblx0aWYgKCFpc1JlY29yZChkYXRhKSkgcmV0dXJuIG51bGw7XG5cdGNvbnN0IHNlcnZlcnMgPSBkYXRhLm1jcFNlcnZlcnM7XG5cdGlmICghaXNSZWNvcmQoc2VydmVycykpIHJldHVybiBudWxsO1xuXHRjb25zdCBzZXJ2ZXIgPSBzZXJ2ZXJzW1wiY29kZWJhc2UtcmFnXCJdO1xuXHRpZiAoIWlzUmVjb3JkKHNlcnZlcikpIHJldHVybiBudWxsO1xuXHRjb25zdCB1cmwgPSB0eXBlb2Ygc2VydmVyLnVybCA9PT0gXCJzdHJpbmdcIiA/IHNlcnZlci51cmwudHJpbSgpIDogXCJcIjtcblx0Y29uc3QgaGVhZGVycyA9IGlzUmVjb3JkKHNlcnZlci5oZWFkZXJzKSA/IHNlcnZlci5oZWFkZXJzIDoge307XG5cdGNvbnN0IGF1dGggPSB0eXBlb2YgaGVhZGVycy5BdXRob3JpemF0aW9uID09PSBcInN0cmluZ1wiID8gaGVhZGVycy5BdXRob3JpemF0aW9uLnRyaW0oKSA6IFwiXCI7XG5cdGNvbnN0IHRva2VuID0gYXV0aC50b0xvd2VyQ2FzZSgpLnN0YXJ0c1dpdGgoXCJiZWFyZXIgXCIpID8gYXV0aC5zbGljZSg3KS50cmltKCkgOiBcIlwiO1xuXHRpZiAoIXVybC5zdGFydHNXaXRoKFwiaHR0cFwiKSB8fCB0b2tlbi5sZW5ndGggPT09IDApIHJldHVybiBudWxsO1xuXHRyZXR1cm4geyB1cmwsIHRva2VuIH07XG59XG5cbmZ1bmN0aW9uIG1lcmdlSW50b01jcEpzb24oaW5wdXQ6IHtcblx0bWNwUGF0aDogc3RyaW5nO1xuXHR1cmw6IHN0cmluZztcblx0dG9rZW46IHN0cmluZztcblx0aG9zdFJvb3Q6IHN0cmluZztcbn0pOiB7IHNraXBwZWQ/OiBzdHJpbmc7IHBhdGg/OiBzdHJpbmc7IHJvb3Q/OiBzdHJpbmcgfSB7XG5cdGNvbnN0IHsgbWNwUGF0aCwgdXJsLCB0b2tlbiwgaG9zdFJvb3QgfSA9IGlucHV0O1xuXHRpZiAoIXVybCB8fCAhdG9rZW4pIHtcblx0XHRyZXR1cm4geyBza2lwcGVkOiBcIm5vIFVSTC90b2tlblwiIH07XG5cdH1cblxuXHRjb25zdCB4Um9vdCA9IGhvc3RSb290IHx8IFwiJHt3b3Jrc3BhY2VGb2xkZXJ9XCI7XG5cdG1rZGlyU3luYyhkaXJuYW1lKG1jcFBhdGgpLCB7IHJlY3Vyc2l2ZTogdHJ1ZSB9KTtcblxuXHRsZXQgZGF0YTogTWNwSnNvbiA9IHsgbWNwU2VydmVyczoge30gfTtcblx0dHJ5IHtcblx0XHRpZiAoc3RhdFN5bmMobWNwUGF0aCkuc2l6ZSA+IDApIHtcblx0XHRcdGNvbnN0IGxvYWRlZDogdW5rbm93biA9IEpTT04ucGFyc2UocmVhZEZpbGVTeW5jKG1jcFBhdGgsIFwidXRmOFwiKSk7XG5cdFx0XHRpZiAoaXNSZWNvcmQobG9hZGVkKSkgZGF0YSA9IGxvYWRlZCBhcyBNY3BKc29uO1xuXHRcdH1cblx0fSBjYXRjaCAoZXJyKSB7XG5cdFx0Y29uc3QgY29kZSA9IGlzUmVjb3JkKGVycikgJiYgdHlwZW9mIGVyci5jb2RlID09PSBcInN0cmluZ1wiID8gZXJyLmNvZGUgOiBcIlwiO1xuXHRcdGlmIChjb2RlICE9PSBcIkVOT0VOVFwiKSB7XG5cdFx0XHRjb25zb2xlLmxvZyhcblx0XHRcdFx0XCJjb2RlYmFzZS1yYWcgTUNQOiBleGlzdGluZyBtY3AuanNvbiBpcyBpbnZhbGlkIEpTT047IHJlcGxhY2luZyByYWcgZW50cnkgb25seSBhZnRlciBiYWNrdXBcIixcblx0XHRcdCk7XG5cdFx0XHRyZW5hbWVTeW5jKG1jcFBhdGgsIGAke21jcFBhdGh9LmJha2ApO1xuXHRcdH1cblx0fVxuXG5cdGNvbnN0IHNlcnZlcnMgPSBpc1JlY29yZChkYXRhLm1jcFNlcnZlcnMpID8gZGF0YS5tY3BTZXJ2ZXJzIDoge307XG5cdGRhdGEubWNwU2VydmVycyA9IHNlcnZlcnM7XG5cdHNlcnZlcnNbXCJjb2RlYmFzZS1yYWdcIl0gPSB7XG5cdFx0dXJsLFxuXHRcdGhlYWRlcnM6IHtcblx0XHRcdEF1dGhvcml6YXRpb246IGBCZWFyZXIgJHt0b2tlbn1gLFxuXHRcdFx0XCJYLUNvZGViYXNlLVJvb3RcIjogeFJvb3QsXG5cdFx0fSxcblx0fTtcblx0d3JpdGVGaWxlU3luYyhtY3BQYXRoLCBgJHtKU09OLnN0cmluZ2lmeShkYXRhLCBudWxsLCAyKX1cXG5gLCBcInV0ZjhcIik7XG5cdHRyeSB7XG5cdFx0Y2htb2RTeW5jKG1jcFBhdGgsIDBvNjAwKTtcblx0fSBjYXRjaCB7XG5cdFx0Ly8gbWVtZnMgYW5kIHNvbWUgaG9zdHMgb21pdCBjaG1vZFxuXHR9XG5cdHJldHVybiB7IHBhdGg6IG1jcFBhdGgsIHJvb3Q6IHhSb290IH07XG59XG5cbmZ1bmN0aW9uIHdvcmtzcGFjZVJvb3QoZW52OiBOb2RlSlMuUHJvY2Vzc0VudiA9IHByb2Nlc3MuZW52KTogc3RyaW5nIHtcblx0Y29uc3QgZnJvbUVudiA9IGVudi5DT0RFQkFTRV9SQUdfV09SS1NQQUNFPy50cmltKCk7XG5cdGlmIChmcm9tRW52KSByZXR1cm4gZnJvbUVudjtcblx0Ly8gU2NhZmZvbGRlZCBjb3B5IGxpdmVzIGF0IDxyZXBvPi8uZGV2Y29udGFpbmVyL2NvZGViYXNlLXJhZy1tY3AudHNcblx0cmV0dXJuIGRpcm5hbWUoZGlybmFtZShmaWxlVVJMVG9QYXRoKGltcG9ydC5tZXRhLnVybCkpKTtcbn1cblxuZnVuY3Rpb24gbWVyZ2VGcm9tRW52KGVudjogTm9kZUpTLlByb2Nlc3NFbnYgPSBwcm9jZXNzLmVudik6IG51bWJlciB7XG5cdGNvbnN0IHJvb3QgPSB3b3Jrc3BhY2VSb290KGVudik7XG5cdGNvbnN0IGN1cnNvckRpciA9IGpvaW4ocm9vdCwgXCIuY3Vyc29yXCIpO1xuXHRsb2FkRG90ZW52KGpvaW4oY3Vyc29yRGlyLCBcImNvZGViYXNlLXJhZy5lbnZcIiksIGVudik7XG5cdGNvbnN0IHVybCA9IChlbnYuQ09ERUJBU0VfUkFHX01DUF9VUkwgPz8gXCJcIikudHJpbSgpO1xuXHRjb25zdCB0b2tlbiA9IChlbnYuQ09ERUJBU0VfUkFHX01DUF9UT0tFTiA/PyBcIlwiKS50cmltKCk7XG5cdGNvbnN0IGhvc3RSb290ID0gKGVudi5DT0RFQkFTRV9SQUdfTUNQX1JPT1QgPz8gXCJcIikudHJpbSgpIHx8IHJvb3Q7XG5cdGNvbnN0IHJlc3VsdCA9IG1lcmdlSW50b01jcEpzb24oe1xuXHRcdG1jcFBhdGg6IGpvaW4oY3Vyc29yRGlyLCBcIm1jcC5qc29uXCIpLFxuXHRcdHVybCxcblx0XHR0b2tlbixcblx0XHRob3N0Um9vdCxcblx0fSk7XG5cdGlmIChyZXN1bHQuc2tpcHBlZCAhPSBudWxsKSB7XG5cdFx0Y29uc29sZS5sb2coYGNvZGViYXNlLXJhZyBNQ1A6IHNraXBwZWQgKCR7cmVzdWx0LnNraXBwZWR9KWApO1xuXHRcdHJldHVybiAwO1xuXHR9XG5cdGNvbnNvbGUubG9nKGBjb2RlYmFzZS1yYWcgTUNQOiB3cm90ZSAke3Jlc3VsdC5wYXRofSB1cmw9JHt1cmx9IHJvb3Q9JHtyZXN1bHQucm9vdH1gKTtcblx0cmV0dXJuIDA7XG59XG5cbmZ1bmN0aW9uIHNlZWRQcmludChtY3BQYXRoOiBzdHJpbmcpOiBudW1iZXIge1xuXHRsZXQgcmF3OiBzdHJpbmc7XG5cdHRyeSB7XG5cdFx0cmF3ID0gcmVhZEZpbGVTeW5jKG1jcFBhdGgsIFwidXRmOFwiKTtcblx0fSBjYXRjaCB7XG5cdFx0cmV0dXJuIDE7XG5cdH1cblx0Y29uc3QgY3JlZHMgPSBzZWVkRnJvbU1jcEpzb24ocmF3KTtcblx0aWYgKGNyZWRzID09IG51bGwpIHJldHVybiAxO1xuXHRjb25zb2xlLmxvZyhjcmVkcy51cmwpO1xuXHRjb25zb2xlLmxvZyhjcmVkcy50b2tlbik7XG5cdHJldHVybiAwO1xufVxuXG5mdW5jdGlvbiBtYWluKGFyZ3YgPSBwcm9jZXNzLmFyZ3Yuc2xpY2UoMikpOiBudW1iZXIge1xuXHRjb25zdCBjb21tYW5kID0gYXJndlswXSA/PyBcIm1lcmdlXCI7XG5cdGlmIChjb21tYW5kID09PSBcInNlZWQtcHJpbnRcIikge1xuXHRcdGNvbnN0IG1jcFBhdGggPSBhcmd2WzFdO1xuXHRcdGlmIChtY3BQYXRoID09IG51bGwgfHwgbWNwUGF0aC5sZW5ndGggPT09IDApIHJldHVybiAxO1xuXHRcdHJldHVybiBzZWVkUHJpbnQobWNwUGF0aCk7XG5cdH1cblx0aWYgKGNvbW1hbmQgPT09IFwibWVyZ2VcIikge1xuXHRcdHJldHVybiBtZXJnZUZyb21FbnYoKTtcblx0fVxuXHRjb25zb2xlLmVycm9yKGBjb2RlYmFzZS1yYWcgTUNQOiB1bmtub3duIGNvbW1hbmQgJHtjb21tYW5kfWApO1xuXHRyZXR1cm4gMTtcbn1cblxuY29uc3QgaW52b2tlZCA9IChwcm9jZXNzLmFyZ3ZbMV0gPz8gXCJcIikucmVwbGFjZUFsbChcIlxcXFxcIiwgXCIvXCIpO1xuaWYgKGludm9rZWQuZW5kc1dpdGgoXCIvY29kZWJhc2UtcmFnLW1jcC50c1wiKSB8fCBpbnZva2VkLmVuZHNXaXRoKFwiL2NvZGViYXNlLXJhZy1tY3AuanNcIikpIHtcblx0cHJvY2Vzcy5leGl0KG1haW4oKSk7XG59XG5cbmV4cG9ydCBjb25zdCBjb2RlYmFzZVJhZ01jcCA9IHtcblx0bG9hZERvdGVudixcblx0c2VlZEZyb21NY3BKc29uLFxuXHRtZXJnZUludG9NY3BKc29uLFxuXHRtZXJnZUZyb21FbnYsXG5cdHNlZWRQcmludCxcblx0bWFpbixcbn07XG4iXSwibmFtZXMiOlsiY29kZWJhc2VSYWdNY3AiLCJpc1JlY29yZCIsInZhbHVlIiwiQXJyYXkiLCJpc0FycmF5IiwibG9hZERvdGVudiIsInBhdGgiLCJlbnYiLCJyYXciLCJyZWFkRmlsZVN5bmMiLCJsaW5lIiwic3BsaXQiLCJ0cmltbWVkIiwidHJpbSIsInN0YXJ0c1dpdGgiLCJpbmNsdWRlcyIsImVxIiwiaW5kZXhPZiIsImtleSIsInNsaWNlIiwicmVwbGFjZSIsInVuZGVmaW5lZCIsInNlZWRGcm9tTWNwSnNvbiIsImRhdGEiLCJKU09OIiwicGFyc2UiLCJzZXJ2ZXJzIiwibWNwU2VydmVycyIsInNlcnZlciIsInVybCIsImhlYWRlcnMiLCJhdXRoIiwiQXV0aG9yaXphdGlvbiIsInRva2VuIiwidG9Mb3dlckNhc2UiLCJsZW5ndGgiLCJtZXJnZUludG9NY3BKc29uIiwiaW5wdXQiLCJtY3BQYXRoIiwiaG9zdFJvb3QiLCJza2lwcGVkIiwieFJvb3QiLCJta2RpclN5bmMiLCJkaXJuYW1lIiwicmVjdXJzaXZlIiwic3RhdFN5bmMiLCJzaXplIiwibG9hZGVkIiwiZXJyIiwiY29kZSIsImNvbnNvbGUiLCJsb2ciLCJyZW5hbWVTeW5jIiwid3JpdGVGaWxlU3luYyIsInN0cmluZ2lmeSIsImNobW9kU3luYyIsInJvb3QiLCJ3b3Jrc3BhY2VSb290IiwicHJvY2VzcyIsImZyb21FbnYiLCJDT0RFQkFTRV9SQUdfV09SS1NQQUNFIiwiZmlsZVVSTFRvUGF0aCIsIm1lcmdlRnJvbUVudiIsImN1cnNvckRpciIsImpvaW4iLCJDT0RFQkFTRV9SQUdfTUNQX1VSTCIsIkNPREVCQVNFX1JBR19NQ1BfVE9LRU4iLCJDT0RFQkFTRV9SQUdfTUNQX1JPT1QiLCJyZXN1bHQiLCJzZWVkUHJpbnQiLCJjcmVkcyIsIm1haW4iLCJhcmd2IiwiY29tbWFuZCIsImVycm9yIiwiaW52b2tlZCIsInJlcGxhY2VBbGwiLCJlbmRzV2l0aCIsImV4aXQiXSwibWFwcGluZ3MiOiI7Ozs7K0JBOEthQTs7O2VBQUFBOzs7d0JBdktOOzBCQUN1Qjt5QkFDQTtBQVk5QixTQUFTQyxTQUFTQyxLQUFjO0lBQy9CLE9BQU9BLFNBQVMsUUFBUSxPQUFPQSxVQUFVLFlBQVksQ0FBQ0MsTUFBTUMsT0FBTyxDQUFDRjtBQUNyRTtBQUVBLFNBQVNHLFdBQVdDLElBQVksRUFBRUMsR0FBc0I7SUFDdkQsSUFBSUM7SUFDSixJQUFJO1FBQ0hBLE1BQU1DLElBQUFBLG9CQUFZLEVBQUNILE1BQU07SUFDMUIsRUFBRSxPQUFNO1FBQ1A7SUFDRDtJQUNBLEtBQUssTUFBTUksUUFBUUYsSUFBSUcsS0FBSyxDQUFDLFNBQVU7UUFDdEMsTUFBTUMsVUFBVUYsS0FBS0csSUFBSTtRQUN6QixJQUFJLENBQUNELFdBQVdBLFFBQVFFLFVBQVUsQ0FBQyxRQUFRLENBQUNGLFFBQVFHLFFBQVEsQ0FBQyxNQUFNO1FBQ25FLE1BQU1DLEtBQUtKLFFBQVFLLE9BQU8sQ0FBQztRQUMzQixNQUFNQyxNQUFNTixRQUFRTyxLQUFLLENBQUMsR0FBR0gsSUFBSUgsSUFBSTtRQUNyQyxNQUFNWCxRQUFRVSxRQUNaTyxLQUFLLENBQUNILEtBQUssR0FDWEgsSUFBSSxHQUNKTyxPQUFPLENBQUMsZ0JBQWdCO1FBQzFCLElBQUlGLE9BQU9YLEdBQUcsQ0FBQ1csSUFBSSxLQUFLRyxXQUFXZCxHQUFHLENBQUNXLElBQUksR0FBR2hCO0lBQy9DO0FBQ0Q7QUFFQSxTQUFTb0IsZ0JBQWdCZCxHQUFXO0lBQ25DLElBQUllO0lBQ0osSUFBSTtRQUNIQSxPQUFPQyxLQUFLQyxLQUFLLENBQUNqQjtJQUNuQixFQUFFLE9BQU07UUFDUCxPQUFPO0lBQ1I7SUFDQSxJQUFJLENBQUNQLFNBQVNzQixPQUFPLE9BQU87SUFDNUIsTUFBTUcsVUFBVUgsS0FBS0ksVUFBVTtJQUMvQixJQUFJLENBQUMxQixTQUFTeUIsVUFBVSxPQUFPO0lBQy9CLE1BQU1FLFNBQVNGLE9BQU8sQ0FBQyxlQUFlO0lBQ3RDLElBQUksQ0FBQ3pCLFNBQVMyQixTQUFTLE9BQU87SUFDOUIsTUFBTUMsTUFBTSxPQUFPRCxPQUFPQyxHQUFHLEtBQUssV0FBV0QsT0FBT0MsR0FBRyxDQUFDaEIsSUFBSSxLQUFLO0lBQ2pFLE1BQU1pQixVQUFVN0IsU0FBUzJCLE9BQU9FLE9BQU8sSUFBSUYsT0FBT0UsT0FBTyxHQUFHLENBQUM7SUFDN0QsTUFBTUMsT0FBTyxPQUFPRCxRQUFRRSxhQUFhLEtBQUssV0FBV0YsUUFBUUUsYUFBYSxDQUFDbkIsSUFBSSxLQUFLO0lBQ3hGLE1BQU1vQixRQUFRRixLQUFLRyxXQUFXLEdBQUdwQixVQUFVLENBQUMsYUFBYWlCLEtBQUtaLEtBQUssQ0FBQyxHQUFHTixJQUFJLEtBQUs7SUFDaEYsSUFBSSxDQUFDZ0IsSUFBSWYsVUFBVSxDQUFDLFdBQVdtQixNQUFNRSxNQUFNLEtBQUssR0FBRyxPQUFPO0lBQzFELE9BQU87UUFBRU47UUFBS0k7SUFBTTtBQUNyQjtBQUVBLFNBQVNHLGlCQUFpQkMsS0FLekI7SUFDQSxNQUFNLEVBQUVDLE9BQU8sRUFBRVQsR0FBRyxFQUFFSSxLQUFLLEVBQUVNLFFBQVEsRUFBRSxHQUFHRjtJQUMxQyxJQUFJLENBQUNSLE9BQU8sQ0FBQ0ksT0FBTztRQUNuQixPQUFPO1lBQUVPLFNBQVM7UUFBZTtJQUNsQztJQUVBLE1BQU1DLFFBQVFGLFlBQVk7SUFDMUJHLElBQUFBLGlCQUFTLEVBQUNDLElBQUFBLGlCQUFPLEVBQUNMLFVBQVU7UUFBRU0sV0FBVztJQUFLO0lBRTlDLElBQUlyQixPQUFnQjtRQUFFSSxZQUFZLENBQUM7SUFBRTtJQUNyQyxJQUFJO1FBQ0gsSUFBSWtCLElBQUFBLGdCQUFRLEVBQUNQLFNBQVNRLElBQUksR0FBRyxHQUFHO1lBQy9CLE1BQU1DLFNBQWtCdkIsS0FBS0MsS0FBSyxDQUFDaEIsSUFBQUEsb0JBQVksRUFBQzZCLFNBQVM7WUFDekQsSUFBSXJDLFNBQVM4QyxTQUFTeEIsT0FBT3dCO1FBQzlCO0lBQ0QsRUFBRSxPQUFPQyxLQUFLO1FBQ2IsTUFBTUMsT0FBT2hELFNBQVMrQyxRQUFRLE9BQU9BLElBQUlDLElBQUksS0FBSyxXQUFXRCxJQUFJQyxJQUFJLEdBQUc7UUFDeEUsSUFBSUEsU0FBUyxVQUFVO1lBQ3RCQyxRQUFRQyxHQUFHLENBQ1Y7WUFFREMsSUFBQUEsa0JBQVUsRUFBQ2QsU0FBUyxHQUFHQSxRQUFRLElBQUksQ0FBQztRQUNyQztJQUNEO0lBRUEsTUFBTVosVUFBVXpCLFNBQVNzQixLQUFLSSxVQUFVLElBQUlKLEtBQUtJLFVBQVUsR0FBRyxDQUFDO0lBQy9ESixLQUFLSSxVQUFVLEdBQUdEO0lBQ2xCQSxPQUFPLENBQUMsZUFBZSxHQUFHO1FBQ3pCRztRQUNBQyxTQUFTO1lBQ1JFLGVBQWUsQ0FBQyxPQUFPLEVBQUVDLE9BQU87WUFDaEMsbUJBQW1CUTtRQUNwQjtJQUNEO0lBQ0FZLElBQUFBLHFCQUFhLEVBQUNmLFNBQVMsR0FBR2QsS0FBSzhCLFNBQVMsQ0FBQy9CLE1BQU0sTUFBTSxHQUFHLEVBQUUsQ0FBQyxFQUFFO0lBQzdELElBQUk7UUFDSGdDLElBQUFBLGlCQUFTLEVBQUNqQixTQUFTO0lBQ3BCLEVBQUUsT0FBTTtJQUNQLGtDQUFrQztJQUNuQztJQUNBLE9BQU87UUFBRWhDLE1BQU1nQztRQUFTa0IsTUFBTWY7SUFBTTtBQUNyQztBQUVBLFNBQVNnQixjQUFjbEQsTUFBeUJtRCxRQUFRbkQsR0FBRztJQUMxRCxNQUFNb0QsVUFBVXBELElBQUlxRCxzQkFBc0IsRUFBRS9DO0lBQzVDLElBQUk4QyxTQUFTLE9BQU9BO0lBQ3BCLG9FQUFvRTtJQUNwRSxPQUFPaEIsSUFBQUEsaUJBQU8sRUFBQ0EsSUFBQUEsaUJBQU8sRUFBQ2tCLElBQUFBLHNCQUFhLEVBQUM7QUFDdEM7QUFFQSxTQUFTQyxhQUFhdkQsTUFBeUJtRCxRQUFRbkQsR0FBRztJQUN6RCxNQUFNaUQsT0FBT0MsY0FBY2xEO0lBQzNCLE1BQU13RCxZQUFZQyxJQUFBQSxjQUFJLEVBQUNSLE1BQU07SUFDN0JuRCxXQUFXMkQsSUFBQUEsY0FBSSxFQUFDRCxXQUFXLHFCQUFxQnhEO0lBQ2hELE1BQU1zQixNQUFNLEFBQUN0QixDQUFBQSxJQUFJMEQsb0JBQW9CLElBQUksRUFBQyxFQUFHcEQsSUFBSTtJQUNqRCxNQUFNb0IsUUFBUSxBQUFDMUIsQ0FBQUEsSUFBSTJELHNCQUFzQixJQUFJLEVBQUMsRUFBR3JELElBQUk7SUFDckQsTUFBTTBCLFdBQVcsQUFBQ2hDLENBQUFBLElBQUk0RCxxQkFBcUIsSUFBSSxFQUFDLEVBQUd0RCxJQUFJLE1BQU0yQztJQUM3RCxNQUFNWSxTQUFTaEMsaUJBQWlCO1FBQy9CRSxTQUFTMEIsSUFBQUEsY0FBSSxFQUFDRCxXQUFXO1FBQ3pCbEM7UUFDQUk7UUFDQU07SUFDRDtJQUNBLElBQUk2QixPQUFPNUIsT0FBTyxJQUFJLE1BQU07UUFDM0JVLFFBQVFDLEdBQUcsQ0FBQyxDQUFDLDJCQUEyQixFQUFFaUIsT0FBTzVCLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDM0QsT0FBTztJQUNSO0lBQ0FVLFFBQVFDLEdBQUcsQ0FBQyxDQUFDLHdCQUF3QixFQUFFaUIsT0FBTzlELElBQUksQ0FBQyxLQUFLLEVBQUV1QixJQUFJLE1BQU0sRUFBRXVDLE9BQU9aLElBQUksRUFBRTtJQUNuRixPQUFPO0FBQ1I7QUFFQSxTQUFTYSxVQUFVL0IsT0FBZTtJQUNqQyxJQUFJOUI7SUFDSixJQUFJO1FBQ0hBLE1BQU1DLElBQUFBLG9CQUFZLEVBQUM2QixTQUFTO0lBQzdCLEVBQUUsT0FBTTtRQUNQLE9BQU87SUFDUjtJQUNBLE1BQU1nQyxRQUFRaEQsZ0JBQWdCZDtJQUM5QixJQUFJOEQsU0FBUyxNQUFNLE9BQU87SUFDMUJwQixRQUFRQyxHQUFHLENBQUNtQixNQUFNekMsR0FBRztJQUNyQnFCLFFBQVFDLEdBQUcsQ0FBQ21CLE1BQU1yQyxLQUFLO0lBQ3ZCLE9BQU87QUFDUjtBQUVBLFNBQVNzQyxLQUFLQyxPQUFPZCxRQUFRYyxJQUFJLENBQUNyRCxLQUFLLENBQUMsRUFBRTtJQUN6QyxNQUFNc0QsVUFBVUQsSUFBSSxDQUFDLEVBQUUsSUFBSTtJQUMzQixJQUFJQyxZQUFZLGNBQWM7UUFDN0IsTUFBTW5DLFVBQVVrQyxJQUFJLENBQUMsRUFBRTtRQUN2QixJQUFJbEMsV0FBVyxRQUFRQSxRQUFRSCxNQUFNLEtBQUssR0FBRyxPQUFPO1FBQ3BELE9BQU9rQyxVQUFVL0I7SUFDbEI7SUFDQSxJQUFJbUMsWUFBWSxTQUFTO1FBQ3hCLE9BQU9YO0lBQ1I7SUFDQVosUUFBUXdCLEtBQUssQ0FBQyxDQUFDLGtDQUFrQyxFQUFFRCxTQUFTO0lBQzVELE9BQU87QUFDUjtBQUVBLE1BQU1FLFVBQVUsQUFBQ2pCLENBQUFBLFFBQVFjLElBQUksQ0FBQyxFQUFFLElBQUksRUFBQyxFQUFHSSxVQUFVLENBQUMsTUFBTTtBQUN6RCxJQUFJRCxRQUFRRSxRQUFRLENBQUMsMkJBQTJCRixRQUFRRSxRQUFRLENBQUMseUJBQXlCO0lBQ3pGbkIsUUFBUW9CLElBQUksQ0FBQ1A7QUFDZDtBQUVPLE1BQU12RSxpQkFBaUI7SUFDN0JLO0lBQ0FpQjtJQUNBYztJQUNBMEI7SUFDQU87SUFDQUU7QUFDRCJ9

package/commonjs/src/webapi/devcontainer/codebase-rag-mcp.ts

@@ -0,0 +1,182 @@
+import {
+	chmodSync,
+	mkdirSync,
+	readFileSync,
+	renameSync,
+	statSync,
+	writeFileSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export type CodebaseRagCredentials = {
+	url: string;
+	token: string;
+};
+
+export type McpJson = {
+	mcpServers?: Record<string, unknown>;
+	[key: string]: unknown;
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return value != null && typeof value === "object" && !Array.isArray(value);
+}
+
+function loadDotenv(path: string, env: NodeJS.ProcessEnv): void {
+	let raw: string;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch {
+		return;
+	}
+	for (const line of raw.split(/\r?\n/)) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#") || !trimmed.includes("=")) continue;
+		const eq = trimmed.indexOf("=");
+		const key = trimmed.slice(0, eq).trim();
+		const value = trimmed
+			.slice(eq + 1)
+			.trim()
+			.replace(/^["']|["']$/g, "");
+		if (key && env[key] === undefined) env[key] = value;
+	}
+}
+
+function seedFromMcpJson(raw: string): CodebaseRagCredentials | null {
+	let data: unknown;
+	try {
+		data = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	if (!isRecord(data)) return null;
+	const servers = data.mcpServers;
+	if (!isRecord(servers)) return null;
+	const server = servers["codebase-rag"];
+	if (!isRecord(server)) return null;
+	const url = typeof server.url === "string" ? server.url.trim() : "";
+	const headers = isRecord(server.headers) ? server.headers : {};
+	const auth = typeof headers.Authorization === "string" ? headers.Authorization.trim() : "";
+	const token = auth.toLowerCase().startsWith("bearer ") ? auth.slice(7).trim() : "";
+	if (!url.startsWith("http") || token.length === 0) return null;
+	return { url, token };
+}
+
+function mergeIntoMcpJson(input: {
+	mcpPath: string;
+	url: string;
+	token: string;
+	hostRoot: string;
+}): { skipped?: string; path?: string; root?: string } {
+	const { mcpPath, url, token, hostRoot } = input;
+	if (!url || !token) {
+		return { skipped: "no URL/token" };
+	}
+
+	const xRoot = hostRoot || "${workspaceFolder}";
+	mkdirSync(dirname(mcpPath), { recursive: true });
+
+	let data: McpJson = { mcpServers: {} };
+	try {
+		if (statSync(mcpPath).size > 0) {
+			const loaded: unknown = JSON.parse(readFileSync(mcpPath, "utf8"));
+			if (isRecord(loaded)) data = loaded as McpJson;
+		}
+	} catch (err) {
+		const code = isRecord(err) && typeof err.code === "string" ? err.code : "";
+		if (code !== "ENOENT") {
+			console.log(
+				"codebase-rag MCP: existing mcp.json is invalid JSON; replacing rag entry only after backup",
+			);
+			renameSync(mcpPath, `${mcpPath}.bak`);
+		}
+	}
+
+	const servers = isRecord(data.mcpServers) ? data.mcpServers : {};
+	data.mcpServers = servers;
+	servers["codebase-rag"] = {
+		url,
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"X-Codebase-Root": xRoot,
+		},
+	};
+	writeFileSync(mcpPath, `${JSON.stringify(data, null, 2)}\n`, "utf8");
+	try {
+		chmodSync(mcpPath, 0o600);
+	} catch {
+		// memfs and some hosts omit chmod
+	}
+	return { path: mcpPath, root: xRoot };
+}
+
+function workspaceRoot(env: NodeJS.ProcessEnv = process.env): string {
+	const fromEnv = env.CODEBASE_RAG_WORKSPACE?.trim();
+	if (fromEnv) return fromEnv;
+	// Scaffolded copy lives at <repo>/.devcontainer/codebase-rag-mcp.ts
+	return dirname(dirname(fileURLToPath(import.meta.url)));
+}
+
+function mergeFromEnv(env: NodeJS.ProcessEnv = process.env): number {
+	const root = workspaceRoot(env);
+	const cursorDir = join(root, ".cursor");
+	loadDotenv(join(cursorDir, "codebase-rag.env"), env);
+	const url = (env.CODEBASE_RAG_MCP_URL ?? "").trim();
+	const token = (env.CODEBASE_RAG_MCP_TOKEN ?? "").trim();
+	const hostRoot = (env.CODEBASE_RAG_MCP_ROOT ?? "").trim() || root;
+	const result = mergeIntoMcpJson({
+		mcpPath: join(cursorDir, "mcp.json"),
+		url,
+		token,
+		hostRoot,
+	});
+	if (result.skipped != null) {
+		console.log(`codebase-rag MCP: skipped (${result.skipped})`);
+		return 0;
+	}
+	console.log(`codebase-rag MCP: wrote ${result.path} url=${url} root=${result.root}`);
+	return 0;
+}
+
+function seedPrint(mcpPath: string): number {
+	let raw: string;
+	try {
+		raw = readFileSync(mcpPath, "utf8");
+	} catch {
+		return 1;
+	}
+	const creds = seedFromMcpJson(raw);
+	if (creds == null) return 1;
+	console.log(creds.url);
+	console.log(creds.token);
+	return 0;
+}
+
+function main(argv = process.argv.slice(2)): number {
+	const command = argv[0] ?? "merge";
+	if (command === "seed-print") {
+		const mcpPath = argv[1];
+		if (mcpPath == null || mcpPath.length === 0) return 1;
+		return seedPrint(mcpPath);
+	}
+	if (command === "merge") {
+		return mergeFromEnv();
+	}
+	console.error(`codebase-rag MCP: unknown command ${command}`);
+	return 1;
+}
+
+const invoked = (process.argv[1] ?? "").replaceAll("\\", "/");
+if (invoked.endsWith("/codebase-rag-mcp.ts") || invoked.endsWith("/codebase-rag-mcp.js")) {
+	process.exit(main());
+}
+
+export const codebaseRagMcp = {
+	loadDotenv,
+	seedFromMcpJson,
+	mergeIntoMcpJson,
+	mergeFromEnv,
+	seedPrint,
+	main,
+};

package/commonjs/src/webapi/devcontainer/host-scripts.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get DevContainerHostScripts () {
+        return DevContainerHostScripts;
+    },
+    get codebaseRagMcpSourcePath () {
+        return codebaseRagMcpSourcePath;
+    },
+    get devcontainerTemplatePath () {
+        return devcontainerTemplatePath;
+    }
+});
+const _nodefs = require("node:fs");
+const _nodeurl = require("node:url");
+const TEMPLATE_FILES = [
+    "initialize.sh",
+    "post-create.sh",
+    "post-start.sh",
+    "tty-prompt.sh",
+    "codebase-rag.env.example"
+];
+function devcontainerTemplatePath(name) {
+    return (0, _nodeurl.fileURLToPath)(new URL(`./templates/${name}`, require("url").pathToFileURL(__filename).toString()));
+}
+function codebaseRagMcpSourcePath() {
+    return (0, _nodeurl.fileURLToPath)(new URL("./codebase-rag-mcp.ts", require("url").pathToFileURL(__filename).toString()));
+}
+class DevContainerHostScripts {
+    files() {
+        return [
+            ...TEMPLATE_FILES.map((name)=>({
+                    filePath: `.devcontainer/${name}`,
+                    content: (0, _nodefs.readFileSync)(devcontainerTemplatePath(name), "utf8")
+                })),
+            {
+                filePath: ".devcontainer/codebase-rag-mcp.ts",
+                content: (0, _nodefs.readFileSync)(codebaseRagMcpSourcePath(), "utf8")
+            }
+        ];
+    }
+}
+
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9ob21lL3J1bm5lci93b3JrL2RlY29oZXJlL2RlY29oZXJlL3Byb2plY3RzL3NjYWZmb2xkL3NyYy93ZWJhcGkvZGV2Y29udGFpbmVyL2hvc3Qtc2NyaXB0cy50cyJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyByZWFkRmlsZVN5bmMgfSBmcm9tIFwibm9kZTpmc1wiO1xuaW1wb3J0IHsgZmlsZVVSTFRvUGF0aCB9IGZyb20gXCJub2RlOnVybFwiO1xuaW1wb3J0IHR5cGUgeyBTb3VyY2VGaWxlLCBTb3VyY2VGaWxlUHJvdmlkZXIgfSBmcm9tIFwiLi4vLi4vbW9kZWxzL3NvdXJjZS1maWxlLmpzXCI7XG5cbmNvbnN0IFRFTVBMQVRFX0ZJTEVTID0gW1xuXHRcImluaXRpYWxpemUuc2hcIixcblx0XCJwb3N0LWNyZWF0ZS5zaFwiLFxuXHRcInBvc3Qtc3RhcnQuc2hcIixcblx0XCJ0dHktcHJvbXB0LnNoXCIsXG5cdFwiY29kZWJhc2UtcmFnLmVudi5leGFtcGxlXCIsXG5dIGFzIGNvbnN0O1xuXG5leHBvcnQgZnVuY3Rpb24gZGV2Y29udGFpbmVyVGVtcGxhdGVQYXRoKG5hbWU6IHN0cmluZyk6IHN0cmluZyB7XG5cdHJldHVybiBmaWxlVVJMVG9QYXRoKG5ldyBVUkwoYC4vdGVtcGxhdGVzLyR7bmFtZX1gLCBpbXBvcnQubWV0YS51cmwpKTtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGNvZGViYXNlUmFnTWNwU291cmNlUGF0aCgpOiBzdHJpbmcge1xuXHRyZXR1cm4gZmlsZVVSTFRvUGF0aChuZXcgVVJMKFwiLi9jb2RlYmFzZS1yYWctbWNwLnRzXCIsIGltcG9ydC5tZXRhLnVybCkpO1xufVxuXG4vKiogSG9zdCArIGNvbnRhaW5lciBzY3JpcHRzIGZvciB0aGUgc2NhZmZvbGRlZCBEZXYgQ29udGFpbmVyLiAqL1xuZXhwb3J0IGNsYXNzIERldkNvbnRhaW5lckhvc3RTY3JpcHRzIGltcGxlbWVudHMgU291cmNlRmlsZVByb3ZpZGVyIHtcblx0cHVibGljIGZpbGVzKCk6IFNvdXJjZUZpbGVbXSB7XG5cdFx0cmV0dXJuIFtcblx0XHRcdC4uLlRFTVBMQVRFX0ZJTEVTLm1hcCgobmFtZSkgPT4gKHtcblx0XHRcdFx0ZmlsZVBhdGg6IGAuZGV2Y29udGFpbmVyLyR7bmFtZX1gLFxuXHRcdFx0XHRjb250ZW50OiByZWFkRmlsZVN5bmMoZGV2Y29udGFpbmVyVGVtcGxhdGVQYXRoKG5hbWUpLCBcInV0ZjhcIiksXG5cdFx0XHR9KSksXG5cdFx0XHR7XG5cdFx0XHRcdGZpbGVQYXRoOiBcIi5kZXZjb250YWluZXIvY29kZWJhc2UtcmFnLW1jcC50c1wiLFxuXHRcdFx0XHRjb250ZW50OiByZWFkRmlsZVN5bmMoY29kZWJhc2VSYWdNY3BTb3VyY2VQYXRoKCksIFwidXRmOFwiKSxcblx0XHRcdH0sXG5cdFx0XTtcblx0fVxufVxuIl0sIm5hbWVzIjpbIkRldkNvbnRhaW5lckhvc3RTY3JpcHRzIiwiY29kZWJhc2VSYWdNY3BTb3VyY2VQYXRoIiwiZGV2Y29udGFpbmVyVGVtcGxhdGVQYXRoIiwiVEVNUExBVEVfRklMRVMiLCJuYW1lIiwiZmlsZVVSTFRvUGF0aCIsIlVSTCIsImZpbGVzIiwibWFwIiwiZmlsZVBhdGgiLCJjb250ZW50IiwicmVhZEZpbGVTeW5jIl0sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7OztRQXFCYUE7ZUFBQUE7O1FBTEdDO2VBQUFBOztRQUpBQztlQUFBQTs7O3dCQVphO3lCQUNDO0FBRzlCLE1BQU1DLGlCQUFpQjtJQUN0QjtJQUNBO0lBQ0E7SUFDQTtJQUNBO0NBQ0E7QUFFTSxTQUFTRCx5QkFBeUJFLElBQVk7SUFDcEQsT0FBT0MsSUFBQUEsc0JBQWEsRUFBQyxJQUFJQyxJQUFJLENBQUMsWUFBWSxFQUFFRixNQUFNLEVBQUU7QUFDckQ7QUFFTyxTQUFTSDtJQUNmLE9BQU9JLElBQUFBLHNCQUFhLEVBQUMsSUFBSUMsSUFBSSx5QkFBeUI7QUFDdkQ7QUFHTyxNQUFNTjtJQUNMTyxRQUFzQjtRQUM1QixPQUFPO2VBQ0hKLGVBQWVLLEdBQUcsQ0FBQyxDQUFDSixPQUFVLENBQUE7b0JBQ2hDSyxVQUFVLENBQUMsY0FBYyxFQUFFTCxNQUFNO29CQUNqQ00sU0FBU0MsSUFBQUEsb0JBQVksRUFBQ1QseUJBQXlCRSxPQUFPO2dCQUN2RCxDQUFBO1lBQ0E7Z0JBQ0NLLFVBQVU7Z0JBQ1ZDLFNBQVNDLElBQUFBLG9CQUFZLEVBQUNWLDRCQUE0QjtZQUNuRDtTQUNBO0lBQ0Y7QUFDRCJ9

package/commonjs/src/webapi/devcontainer/templates/codebase-rag.env.example

@@ -0,0 +1,3 @@
+# Optional. Written to .cursor/codebase-rag.env by initialize.sh (gitignored).
+# CODEBASE_RAG_MCP_URL=https://rag.example.com/mcp
+# CODEBASE_RAG_MCP_TOKEN=

package/commonjs/src/webapi/devcontainer/templates/initialize.sh

@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# Runs on the host before the container is created (devcontainer initializeCommand).
+# Creates bind-mount sources as the host user so Docker does not create them as root.
+# Optional npm / gh / MCP setup is y/N on a TTY; no TTY skips.
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=tty-prompt.sh
+source "$here/tty-prompt.sh"
+
+npm_dir="$root/.devcontainer/npm-auth"
+gh_dir="$root/.devcontainer/gh-auth"
+gh_env="$root/.devcontainer/gh.env"
+cursor_dir="$root/.cursor"
+RAG_ENV="$cursor_dir/codebase-rag.env"
+
+run_codebase_rag_mcp() {
+	local script="$here/codebase-rag-mcp.ts"
+	CODEBASE_RAG_WORKSPACE="$root" node --experimental-strip-types "$script" "$@"
+}
+
+load_rag_env() {
+	RAG_URL=""
+	RAG_TOKEN=""
+	[[ -f "$RAG_ENV" ]] || return 0
+	# shellcheck disable=SC1090
+	set -a
+	# shellcheck disable=SC1090
+	source "$RAG_ENV"
+	set +a
+	RAG_URL="${CODEBASE_RAG_MCP_URL:-}"
+	RAG_TOKEN="${CODEBASE_RAG_MCP_TOKEN:-}"
+}
+
+write_rag_env() {
+	mkdir -p "$(dirname "$RAG_ENV")"
+	umask 077
+	cat >"$RAG_ENV" <<EOF
+# Written by .devcontainer/initialize.sh. Not in git.
+CODEBASE_RAG_MCP_URL=${RAG_URL}
+CODEBASE_RAG_MCP_TOKEN=${RAG_TOKEN}
+CODEBASE_RAG_MCP_ROOT=${root}
+EOF
+	chmod 600 "$RAG_ENV"
+	if [[ -n "$RAG_URL" && -n "$RAG_TOKEN" ]]; then
+		run_codebase_rag_mcp merge || true
+	fi
+}
+
+seed_rag_from_host_mcp() {
+	local mcp="${HOME}/.cursor/mcp.json"
+	[[ -f "$mcp" ]] || return 1
+	command -v node >/dev/null 2>&1 || return 1
+	run_codebase_rag_mcp seed-print "$mcp"
+}
+
+ensure_cursor_dir() {
+	mkdir -p "$cursor_dir"
+}
+
+ensure_auth_dir() {
+	local dir="$1"
+	if ! mkdir -p "$dir" 2>/dev/null; then
+		echo "Cannot create $dir (permission denied)." >&2
+		echo "The scaffold container likely left .devcontainer root-owned. Fix with:" >&2
+		echo "  sudo chown -R \"$USER:$USER\" \"$root\"" >&2
+		exit 1
+	fi
+	{
+		echo "*"
+		echo "!.gitignore"
+	} >"$dir/.gitignore"
+}
+
+ensure_gh_env() {
+	if [[ -d "$gh_env" ]]; then
+		echo "Refusing to start: $gh_env is a directory (left by a prior bind mount). Remove it and rebuild." >&2
+		exit 1
+	fi
+	touch "$gh_env"
+}
+
+setup_npm_auth() {
+	if [[ -f "$npm_dir/.npmrc" ]]; then
+		echo "npm auth: using $npm_dir/.npmrc"
+		return 0
+	fi
+	if ! prompt_yn "Configure npm auth for this workspace?"; then
+		echo "npm auth: skipped"
+		return 0
+	fi
+	if [[ -f "${HOME}/.npmrc" ]]; then
+		cp -a "${HOME}/.npmrc" "$npm_dir/.npmrc"
+		echo "npm auth: copied ~/.npmrc → $npm_dir/.npmrc"
+		return 0
+	fi
+	echo "npm auth: no ~/.npmrc — log in inside the container if prompted"
+}
+
+setup_gh_auth() {
+	if [[ -f "$gh_dir/hosts.yml" ]]; then
+		echo "gh auth: using $gh_dir/hosts.yml"
+		return 0
+	fi
+	if ! prompt_yn "Configure GitHub CLI auth for this workspace?"; then
+		echo "gh auth: skipped"
+		return 0
+	fi
+	if [[ -f "${HOME}/.config/gh/hosts.yml" ]]; then
+		cp -a "${HOME}/.config/gh/hosts.yml" "$gh_dir/hosts.yml"
+		[[ -f "${HOME}/.config/gh/config.yml" ]] &&
+			cp -a "${HOME}/.config/gh/config.yml" "$gh_dir/config.yml"
+		echo "gh auth: copied ~/.config/gh → $gh_dir"
+		return 0
+	fi
+	echo "gh auth: no ~/.config/gh/hosts.yml — log in inside the container if prompted"
+}
+
+setup_codebase_rag_env() {
+	load_rag_env
+	if [[ -n "$RAG_URL" && -n "$RAG_TOKEN" ]]; then
+		write_rag_env
+		echo "codebase-rag MCP: using $RAG_ENV"
+		return 0
+	fi
+
+	local seeded
+	if seeded="$(seed_rag_from_host_mcp 2>/dev/null)"; then
+		if prompt_yn "Found codebase-rag in ~/.cursor/mcp.json. Use it for this workspace?" y; then
+			RAG_URL="$(printf '%s\n' "$seeded" | sed -n '1p')"
+			RAG_TOKEN="$(printf '%s\n' "$seeded" | sed -n '2p')"
+			write_rag_env
+			echo "codebase-rag MCP: imported HTTP server from ~/.cursor/mcp.json → $RAG_ENV"
+			return 0
+		fi
+	fi
+
+	if ! prompt_yn "Configure codebase RAG MCP (semantic search)?"; then
+		RAG_URL=""
+		RAG_TOKEN=""
+		write_rag_env
+		echo "codebase-rag MCP: skipped"
+		return 0
+	fi
+
+	printf '%s\n' "Empty URL skips. Example: https://rag.example.com/mcp" >/dev/tty
+	printf '%s' "MCP URL: " >/dev/tty
+	read_tty RAG_URL
+	RAG_URL="$(printf '%s' "$RAG_URL" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+	if [[ -z "$RAG_URL" ]]; then
+		RAG_TOKEN=""
+		write_rag_env
+		echo "codebase-rag MCP: skipped"
+		return 0
+	fi
+	printf '%s' "Bearer token (hidden): " >/dev/tty
+	read_tty RAG_TOKEN hidden
+	write_rag_env
+	echo "codebase-rag MCP: saved $RAG_ENV"
+}
+
+ensure_auth_dir "$npm_dir"
+ensure_auth_dir "$gh_dir"
+ensure_gh_env
+ensure_cursor_dir
+setup_npm_auth
+setup_gh_auth
+setup_codebase_rag_env

package/commonjs/src/webapi/devcontainer/templates/post-create.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Runs after container create and when workspace content updates
+# (devcontainer postCreateCommand / updateContentCommand).
+# Installs deps when missing or when the lockfile changed; skips otherwise.
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$root"
+
+lockfile="pnpm-lock.yaml"
+stamp="node_modules/.decohere-pnpm-lock.sha"
+
+current_hash=""
+if [[ -f "$lockfile" ]]; then
+	current_hash="$(sha256sum "$lockfile" | awk '{print $1}')"
+elif [[ -f package.json ]]; then
+	current_hash="$(sha256sum package.json | awk '{print $1}')"
+fi
+
+if [[ -d node_modules/.bin ]] && [[ -n "$current_hash" ]] && [[ -f "$stamp" ]] && [[ "$(cat "$stamp")" == "$current_hash" ]]; then
+	echo "node_modules: up to date, skipping pnpm install"
+	exit 0
+fi
+
+echo "node_modules: installing dependencies (first create may take a while)..."
+if [[ -f "$lockfile" ]]; then
+	pnpm install --frozen-lockfile
+else
+	pnpm install
+fi
+
+if [[ -n "$current_hash" ]]; then
+	mkdir -p node_modules
+	printf '%s\n' "$current_hash" >"$stamp"
+fi