@defai.digital/automatosx 11.2.4 → 11.2.6

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import * as path4 from 'path';
-import path4__default, { dirname, join, isAbsolute, basename, resolve, extname as extname$1, relative, sep, normalize, parse as parse$1, delimiter } from 'path';
+import path4__default, { dirname, join, isAbsolute, basename, resolve, extname as extname$1, sep, relative, normalize, parse as parse$1, delimiter } from 'path';
 import { fileURLToPath } from 'url';
 import * as fs4 from 'fs/promises';
 import { mkdir, appendFile, access as access$1, readFile, stat, rm, readdir, copyFile, writeFile, rename, unlink, constants as constants$1, realpath as realpath$1 } from 'fs/promises';
@@ -393,7 +393,7 @@ var init_process_manager = __esm({
           if (child.killed || child.exitCode !== null) {
             continue;
           }
-          killPromises.push(new Promise((resolve12) => {
+          killPromises.push(new Promise((resolve13) => {
             let mainTimeoutId = null;
             let fallbackTimeoutId = null;
             let resolved = false;
@@ -408,7 +408,7 @@ var init_process_manager = __esm({
               }
               if (!resolved) {
                 resolved = true;
-                resolve12();
+                resolve13();
               }
             };
             child.once("exit", () => {
@@ -433,8 +433,8 @@ var init_process_manager = __esm({
         try {
           await Promise.race([
             Promise.all(killPromises),
-            new Promise((resolve12) => {
-              finalTimeoutId = setTimeout(resolve12, timeout);
+            new Promise((resolve13) => {
+              finalTimeoutId = setTimeout(resolve13, timeout);
             })
           ]);
         } finally {
@@ -2582,7 +2582,8 @@ var init_base_provider = __esm({
         try {
           const cliCommand2 = this.getCLICommand();
           const cliArgs = await this.getCLIArgs();
-          const argsString = cliArgs.length > 0 ? cliArgs.join(" ") + " " : "";
+          const escapedArgs = cliArgs.map((arg) => this.escapeShellArg(arg));
+          const argsString = escapedArgs.length > 0 ? escapedArgs.join(" ") + " " : "";
           const escapedPrompt = this.escapeShellArg(prompt);
           const fullCommand = `${cliCommand2} ${argsString}${escapedPrompt}`;
           const commandLength = fullCommand.length;
@@ -2625,7 +2626,7 @@ var init_base_provider = __esm({
        * @returns Promise resolving to stdout and stderr
        */
       async executeWithSpawn(command, cliCommand2) {
-        return new Promise((resolve12, reject) => {
+        return new Promise((resolve13, reject) => {
           const child = spawn(command, [], {
             shell: true,
             // Auto-detects: cmd.exe on Windows, /bin/sh on Unix
@@ -2724,11 +2725,16 @@ var init_base_provider = __esm({
             if (stderr) {
               logger.debug(`${cliCommand2} CLI stderr output`, { stderr: stderr.trim() });
             }
-            if (code === 0 || code === null) {
+            if ((code === 0 || code === null) && !signal) {
               if (progressParser) {
                 progressParser.succeed(`${cliCommand2} completed successfully`);
               }
-              resolve12({ stdout, stderr });
+              resolve13({ stdout, stderr });
+            } else if (signal) {
+              if (progressParser) {
+                progressParser.fail(`${cliCommand2} killed by signal ${signal}`);
+              }
+              reject(new Error(`${cliCommand2} CLI killed by signal ${signal}. stderr: ${stderr || "none"}`));
             } else {
               if (progressParser) {
                 progressParser.fail(`${cliCommand2} failed with code ${code}`);
@@ -2778,7 +2784,7 @@ var init_base_provider = __esm({
        * @returns Promise resolving to stdout and stderr
        */
       async executeWithStdin(cliCommand2, cliArgs, prompt) {
-        return new Promise((resolve12, reject) => {
+        return new Promise((resolve13, reject) => {
           const commandArgs = cliArgs ? cliArgs.split(" ").filter(Boolean) : [];
           logger.debug(`Executing ${cliCommand2} CLI with stdin`, {
             command: cliCommand2,
@@ -2891,7 +2897,7 @@ var init_base_provider = __esm({
               if (progressParser) {
                 progressParser.succeed(`${cliCommand2} completed successfully`);
               }
-              resolve12({ stdout, stderr });
+              resolve13({ stdout, stderr });
             } else {
               if (progressParser) {
                 progressParser.fail(`${cliCommand2} failed with code ${code}`);
@@ -3014,6 +3020,10 @@ ${fullPrompt}
               errors: responseValidation.error.issues,
               response
             });
+            throw new ProviderError(
+              `Provider returned invalid response structure: ${responseValidation.error.issues.map((i) => i.message).join(", ")}`,
+              "E1305" /* PROVIDER_EXEC_ERROR */
+            );
           }
           return response;
         } catch (error) {
@@ -3643,7 +3653,7 @@ var init_cli_wrapper = __esm({
        * Spawn codex process
        */
       async spawnProcess(args, prompt, timeout) {
-        return new Promise((resolve12, reject) => {
+        return new Promise((resolve13, reject) => {
           let stdout = "";
           let stderr = "";
           let hasTimedOut = false;
@@ -3700,7 +3710,7 @@ var init_cli_wrapper = __esm({
               return;
             }
             if (code === 0) {
-              resolve12({ stdout, stderr, exitCode: code });
+              resolve13({ stdout, stderr, exitCode: code });
             } else {
               reject(
                 new CodexError(
@@ -3733,7 +3743,7 @@ var init_cli_wrapper = __esm({
        * Spawn codex process with streaming support
        */
       async spawnProcessWithStreaming(args, prompt, timeout, renderer) {
-        return new Promise((resolve12, reject) => {
+        return new Promise((resolve13, reject) => {
           let stdout = "";
           let stderr = "";
           let hasTimedOut = false;
@@ -3803,7 +3813,7 @@ var init_cli_wrapper = __esm({
               if (renderer) {
                 renderer.succeed("Execution complete");
               }
-              resolve12({ stdout, stderr, exitCode: code });
+              resolve13({ stdout, stderr, exitCode: code });
             } else {
               if (renderer) {
                 renderer.fail(`Process exited with code ${code}`);
@@ -4291,16 +4301,16 @@ var init_command_builder = __esm({
         const args = [];
         args.push("-p", this.escape(prompt));
         if (options.provider) {
-          args.push("--provider", options.provider);
+          args.push("--provider", this.escape(options.provider));
         }
         if (options.model) {
-          args.push("--model", options.model);
+          args.push("--model", this.escape(options.model));
         }
         if (options.apiKey) {
-          args.push("--api-key", options.apiKey);
+          args.push("--api-key", this.escape(options.apiKey));
         }
         if (options.baseUrl) {
-          args.push("--base-url", options.baseUrl);
+          args.push("--base-url", this.escape(options.baseUrl));
         }
         if (options.directory) {
           args.push("--directory", this.escape(options.directory));
@@ -4318,7 +4328,7 @@ var init_command_builder = __esm({
           args.push("--selection", this.escape(options.selection));
         }
         if (options.lineRange) {
-          args.push("--line-range", options.lineRange);
+          args.push("--line-range", this.escape(options.lineRange));
         }
         if (options.gitDiff) {
           args.push("--git-diff");
@@ -9279,7 +9289,7 @@ var PRECOMPILED_CONFIG = {
     "enableFreeTierPrioritization": true,
     "enableWorkloadAwareRouting": true
   },
-  "version": "11.2.4"
+  "version": "11.2.6"
 };
 
 // src/core/config-schemas.ts
@@ -10902,7 +10912,7 @@ var configCommand = {
       } else if (process.env.AUTOMATOSX_CONFIG_PATH) {
         configPath = process.env.AUTOMATOSX_CONFIG_PATH;
       } else {
-        const projectConfig = resolve(process.cwd(), "automatosx.config.json");
+        const projectConfig = resolve(process.cwd(), "ax.config.json");
         const hiddenConfig = resolve(process.cwd(), ".automatosx", "config.json");
         const fs7 = await import('fs');
         if (fs7.existsSync(projectConfig)) {
@@ -11165,9 +11175,9 @@ var PromptHelper = class {
    */
   async question(query) {
     const rl = this.ensureInterface();
-    return new Promise((resolve12) => {
+    return new Promise((resolve13) => {
       rl.question(query, (answer) => {
-        resolve12(answer.trim());
+        resolve13(answer.trim());
       });
     });
   }
@@ -12128,7 +12138,7 @@ var __filename2 = fileURLToPath(import.meta.url);
 var __dirname3 = dirname(__filename2);
 function getPackageRoot() {
   const currentDir = __dirname3;
-  if (currentDir.includes("/dist")) {
+  if (currentDir.includes(`${sep}dist`) || currentDir.includes("/dist")) {
     return join(currentDir, "..");
   } else {
     return join(currentDir, "../..");
@@ -13362,18 +13372,30 @@ var setupCommand = {
       } else if (axCliConfigured === "manual_required") {
         console.log(chalk5.yellow("   \u26A0 ax-cli detected - manual MCP configuration required"));
         console.log(chalk5.gray("     Run: ax-cli mcp add automatosx --transport stdio --command ax --args mcp server"));
+      } else if (axCliConfigured === "error") {
+        console.log(chalk5.yellow("   \u26A0 ax-cli MCP configuration failed"));
+        console.log(chalk5.gray("     CLI integration still works via subprocess"));
       } else {
         console.log(chalk5.green("   \u2713 ax-cli MCP integration configured"));
       }
+      let geminiMcpStatus = "skipped";
       if (providers["gemini-cli"]) {
         console.log(chalk5.cyan("\u{1F50C} Setting up Gemini CLI integration..."));
         const geminiDir = join(projectDir, ".gemini");
         const geminiDirExistedBefore = await checkExists2(geminiDir);
-        await setupGeminiIntegration(projectDir, packageRoot);
+        geminiMcpStatus = await setupGeminiIntegration(projectDir, packageRoot);
         if (!geminiDirExistedBefore) {
           createdResources.push(geminiDir);
         }
-        console.log(chalk5.green("   \u2713 Gemini CLI integration configured"));
+        if (geminiMcpStatus === "configured") {
+          console.log(chalk5.green("   \u2713 Gemini CLI MCP integration configured"));
+        } else if (geminiMcpStatus === "skipped") {
+          console.log(chalk5.yellow("   \u26A0 Gemini CLI MCP skipped (MCP server not found)"));
+          console.log(chalk5.gray("     CLI integration still works via subprocess"));
+        } else {
+          console.log(chalk5.yellow("   \u26A0 Gemini CLI MCP configuration failed"));
+          console.log(chalk5.gray("     CLI integration still works via subprocess"));
+        }
       }
       console.log(chalk5.cyan("\u{1F4C2} Creating workspace directories..."));
       await createWorkspaceDirectories(projectDir);
@@ -13382,17 +13404,11 @@ var setupCommand = {
       const isGitRepo = await checkExists2(gitDir);
       if (!isGitRepo) {
         console.log(chalk5.cyan("\u{1F527} Initializing git repository..."));
-        await initializeGitRepository(projectDir);
-        console.log(chalk5.green("   \u2713 Git repository initialized"));
-      }
-      console.log(chalk5.cyan("\u{1F50C} Setting up Codex CLI MCP integration..."));
-      const codexDir = join(projectDir, ".codex");
-      const codexDirExistedBefore = await checkExists2(codexDir);
-      await setupCodexIntegration(projectDir, packageRoot);
-      if (!codexDirExistedBefore) {
-        createdResources.push(codexDir);
+        const gitInitSuccess = await initializeGitRepository(projectDir);
+        if (gitInitSuccess) {
+          console.log(chalk5.green("   \u2713 Git repository initialized"));
+        }
       }
-      console.log(chalk5.green("   \u2713 Codex CLI MCP integration configured"));
       console.log(chalk5.cyan("\u{1F4DD} Updating .gitignore..."));
       await updateGitignore(projectDir);
       console.log(chalk5.green("   \u2713 .gitignore updated"));
@@ -13889,10 +13905,10 @@ async function initializeGitRepository(projectDir) {
     const isGitRepo = await checkExists2(gitDir);
     if (isGitRepo) {
       logger.info("Git repository already exists, skipping initialization");
-      return;
+      return true;
     }
     const { spawn: spawn9 } = await import('child_process');
-    await new Promise((resolve12, reject) => {
+    await new Promise((resolve13, reject) => {
       const child = spawn9("git", ["init"], {
         cwd: projectDir,
         stdio: "pipe",
@@ -13908,7 +13924,7 @@ async function initializeGitRepository(projectDir) {
           reject(new Error(`git init failed with code ${code}: ${stderr}`));
         } else {
           logger.info("Git repository set up successfully");
-          resolve12();
+          resolve13();
         }
       });
       child.on("error", (error) => {
@@ -13927,6 +13943,7 @@ async function initializeGitRepository(projectDir) {
         return;
       }
     });
+    return true;
   } catch (error) {
     const errorMessage = error.message;
     if (errorMessage.includes("ENOENT") || errorMessage.includes("spawn git")) {
@@ -13942,6 +13959,7 @@ async function initializeGitRepository(projectDir) {
         error: errorMessage
       });
     }
+    return false;
   }
 }
 async function updateGitignore(projectDir) {
@@ -14124,24 +14142,25 @@ async function initializeSpecKit(projectDir) {
 async function setupGeminiIntegration(projectDir, packageRoot) {
   const geminiDir = join(projectDir, ".gemini");
   await mkdir(geminiDir, { recursive: true });
-  await setupGeminiMCPConfig(projectDir, packageRoot);
+  const mcpStatus = await setupGeminiMCPConfig(projectDir, packageRoot);
+  return mcpStatus;
 }
 async function setupGeminiMCPConfig(projectDir, packageRoot) {
   const mcpServersPath = join(projectDir, ".gemini", "mcp-servers.json");
   try {
-    const globalMcpPath = join(packageRoot, "dist", "mcp", "index.js");
     const localMcpPath = join(projectDir, "node_modules", "@defai.digital", "automatosx", "dist", "mcp", "index.js");
+    const globalMcpPath = join(packageRoot, "dist", "mcp", "index.js");
     let mcpServerPath;
-    if (await checkExists2(globalMcpPath)) {
-      mcpServerPath = globalMcpPath;
-    } else if (await checkExists2(localMcpPath)) {
+    if (await checkExists2(localMcpPath)) {
       mcpServerPath = localMcpPath;
+    } else if (await checkExists2(globalMcpPath)) {
+      mcpServerPath = globalMcpPath;
     } else {
       logger.warn("AutomatosX MCP server not found, skipping Gemini CLI MCP configuration", {
-        globalPath: globalMcpPath,
-        localPath: localMcpPath
+        localPath: localMcpPath,
+        globalPath: globalMcpPath
       });
-      return;
+      return "skipped";
     }
     let mcpConfig = {};
     if (await checkExists2(mcpServersPath)) {
@@ -14173,32 +14192,15 @@ async function setupGeminiMCPConfig(projectDir, packageRoot) {
       path: mcpServersPath,
       mcpServerPath
     });
+    return "configured";
   } catch (error) {
     logger.warn("Failed to setup Gemini CLI MCP configuration", {
       error: error.message,
       path: mcpServersPath
     });
+    return "failed";
   }
 }
-async function setupCodexIntegration(projectDir, packageRoot) {
-  const codexDir = join(projectDir, ".codex");
-  await mkdir(codexDir, { recursive: true });
-  await setupCodexMCPConfig(projectDir);
-}
-async function setupCodexMCPConfig(_projectDir, _packageRoot) {
-  const mcpServersPath = join(_projectDir, ".codex", "mcp-servers.json");
-  if (await checkExists2(mcpServersPath)) {
-    try {
-      const { unlink: unlink7 } = await import('fs/promises');
-      await unlink7(mcpServersPath);
-      logger.info("Removed .codex/mcp-servers.json - using CLI mode instead of MCP", {
-        path: mcpServersPath
-      });
-    } catch {
-    }
-  }
-  logger.debug("Codex integration configured for CLI mode (MCP disabled)");
-}
 async function createWorkspaceDirectories(projectDir) {
   const workspaceDirs = [
     join(projectDir, "automatosx"),
@@ -16068,7 +16070,7 @@ var configureCommand = {
       }
       console.log(chalk5.bold.cyan("\n\u2728 AutomatosX Setup Wizard\n"));
       console.log(chalk5.dim("This wizard will help you configure the OpenAI integration mode.\n"));
-      const configPath = resolve(process.cwd(), "automatosx.config.json");
+      const configPath = resolve(process.cwd(), "ax.config.json");
       const config = await loadConfig(configPath);
       if (!config.providers.openai) {
         console.log(chalk5.red("\n\u274C OpenAI provider not found in configuration\n"));
@@ -18237,23 +18239,29 @@ var Router = class {
         const isCircuitOpen = this.circuitBreaker.isOpen(provider.name);
         healthMultipliers.set(provider.name, isCircuitOpen ? 0.5 : 1);
       }
-      const scores = await getProviderMetricsTracker().getAllScores(
-        providerNames,
-        strategyManager.getWeights(),
-        healthMultipliers
-      );
-      if (scores.length > 0) {
-        const scoreMap = new Map(scores.map((s) => [s.provider, s.totalScore]));
-        const originalOrder = providersToTry.map((p) => p.name);
-        providersToTry = [...providersToTry].sort((a, b) => {
-          const scoreA = scoreMap.get(a.name) ?? 0;
-          const scoreB = scoreMap.get(b.name) ?? 0;
-          return scoreB - scoreA;
-        });
-        logger.debug("Provider order after multi-factor routing", {
-          original: originalOrder,
-          reordered: providersToTry.map((p) => p.name),
-          scores: Object.fromEntries(scoreMap)
+      try {
+        const scores = await getProviderMetricsTracker().getAllScores(
+          providerNames,
+          strategyManager.getWeights(),
+          healthMultipliers
+        );
+        if (scores.length > 0) {
+          const scoreMap = new Map(scores.map((s) => [s.provider, s.totalScore]));
+          const originalOrder = providersToTry.map((p) => p.name);
+          providersToTry = [...providersToTry].sort((a, b) => {
+            const scoreA = scoreMap.get(a.name) ?? 0;
+            const scoreB = scoreMap.get(b.name) ?? 0;
+            return scoreB - scoreA;
+          });
+          logger.debug("Provider order after multi-factor routing", {
+            original: originalOrder,
+            reordered: providersToTry.map((p) => p.name),
+            scores: Object.fromEntries(scoreMap)
+          });
+        }
+      } catch (scoringError) {
+        logger.warn("Multi-factor scoring failed, using priority order", {
+          error: scoringError.message
         });
       }
     }
@@ -20132,8 +20140,11 @@ var MemoryManager = class _MemoryManager {
       }
       const tempPath = `${this.config.dbPath}.restore.tmp`;
       const srcDb = new Database2(srcPath, { readonly: true });
-      await srcDb.backup(tempPath);
-      srcDb.close();
+      try {
+        await srcDb.backup(tempPath);
+      } finally {
+        srcDb.close();
+      }
       try {
         const tempDb = new Database2(tempPath, { readonly: true });
         tempDb.prepare("SELECT COUNT(*) FROM memory_entries").get();
@@ -22725,7 +22736,7 @@ var __filename4 = fileURLToPath(import.meta.url);
 var __dirname5 = dirname(__filename4);
 function getPackageRoot3() {
   const currentDir = __dirname5;
-  if (currentDir.includes("/dist")) {
+  if (currentDir.includes(`${sep}dist`) || currentDir.includes("/dist")) {
     return join(currentDir, "..");
   } else {
     return join(currentDir, "../..");
@@ -22856,6 +22867,7 @@ init_path_resolver();
 // src/core/conversation-context-store.ts
 init_esm_shims();
 init_logger();
+var VALID_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
 var ConversationContextStore = class {
   storePath;
   maxEntries;
@@ -22865,6 +22877,33 @@ var ConversationContextStore = class {
     this.maxEntries = options.maxEntries ?? 100;
     this.ttlMs = options.ttlMs ?? 24 * 60 * 60 * 1e3;
   }
+  /**
+   * Validate and sanitize context ID to prevent path traversal attacks
+   *
+   * SECURITY: This is critical to prevent path traversal vulnerabilities.
+   * A malicious ID like "../../.ssh/id_rsa" could read/write/delete files
+   * outside the context store directory.
+   *
+   * @param id - Context ID to validate
+   * @returns Sanitized file path within storePath
+   * @throws Error if ID is invalid or path escapes storePath
+   */
+  validateAndResolvePath(id) {
+    if (!VALID_ID_PATTERN.test(id)) {
+      throw new Error(
+        `Invalid context ID: "${id}". IDs must be 1-64 characters, alphanumeric with underscores/hyphens only.`
+      );
+    }
+    const filePath = join(this.storePath, `${id}.json`);
+    const resolvedPath = resolve(filePath);
+    const resolvedStorePath = resolve(this.storePath);
+    const relativePath = relative(resolvedStorePath, resolvedPath);
+    if (relativePath.startsWith("..") || relativePath.includes("/..") || relativePath.includes("\\..")) {
+      logger.error("[ContextStore] Path traversal attempt blocked", { id, resolvedPath });
+      throw new Error(`Security violation: context ID "${id}" would escape store directory`);
+    }
+    return resolvedPath;
+  }
   /**
    * Initialize store (create directory if needed)
    */
@@ -22882,7 +22921,7 @@ var ConversationContextStore = class {
    */
   async save(context) {
     await this.initialize();
-    const filePath = join(this.storePath, `${context.id}.json`);
+    const filePath = this.validateAndResolvePath(context.id);
     const data = JSON.stringify(context, null, 2);
     try {
       await writeFile(filePath, data, "utf-8");
@@ -22901,7 +22940,7 @@ var ConversationContextStore = class {
    * Get conversation context by ID
    */
   async get(id) {
-    const filePath = join(this.storePath, `${id}.json`);
+    const filePath = this.validateAndResolvePath(id);
     try {
       const data = await readFile(filePath, "utf-8");
       const context = JSON.parse(data);
@@ -22955,7 +22994,7 @@ var ConversationContextStore = class {
    * Delete context entry
    */
   async delete(id) {
-    const filePath = join(this.storePath, `${id}.json`);
+    const filePath = this.validateAndResolvePath(id);
     try {
       await unlink(filePath);
       logger.info("[ContextStore] Context deleted", { id });
@@ -25339,7 +25378,7 @@ ${context.task}`;
    * @param signal - Optional AbortSignal to cancel the sleep
    */
   sleep(ms, signal) {
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       if (signal?.aborted) {
         reject(new Error("Sleep cancelled"));
         return;
@@ -25349,7 +25388,7 @@ ${context.task}`;
         if (abortHandler && signal) {
           signal.removeEventListener("abort", abortHandler);
         }
-        resolve12();
+        resolve13();
       }, ms);
       if (signal) {
         abortHandler = () => {
@@ -26767,10 +26806,10 @@ var McpClient = class extends EventEmitter {
       return;
     }
     if (this.state.status === "connecting") {
-      return new Promise((resolve12, reject) => {
+      return new Promise((resolve13, reject) => {
         const onConnected = () => {
           this.off("error", onError);
-          resolve12();
+          resolve13();
         };
         const onError = (err) => {
           this.off("connected", onConnected);
@@ -26937,14 +26976,14 @@ var McpClient = class extends EventEmitter {
       method,
       params
     };
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       const timeoutMs = timeout ?? this.config.timeout;
       const timeoutHandle = setTimeout(() => {
         this.pendingRequests.delete(id);
         reject(new Error(`Request timed out after ${timeoutMs}ms: ${method}`));
       }, timeoutMs);
       this.pendingRequests.set(id, {
-        resolve: resolve12,
+        resolve: resolve13,
         reject,
         timeout: timeoutHandle
       });
@@ -27402,15 +27441,15 @@ var McpClientPool = class extends EventEmitter {
     }
   }
   async waitForConnection(provider, pool) {
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       const timeout = setTimeout(() => {
-        const index = pool.waitQueue.findIndex((w) => w.resolve === resolve12);
+        const index = pool.waitQueue.findIndex((w) => w.resolve === resolve13);
         if (index !== -1) {
           pool.waitQueue.splice(index, 1);
         }
         reject(new ConnectionTimeoutError(provider, this.config.acquireTimeoutMs));
       }, this.config.acquireTimeoutMs);
-      pool.waitQueue.push({ resolve: resolve12, reject, timeout });
+      pool.waitQueue.push({ resolve: resolve13, reject, timeout });
       logger.debug("[MCP Pool] Waiting for connection", {
         provider,
         queuePosition: pool.waitQueue.length
@@ -28887,6 +28926,8 @@ var McpServer = class _McpServer {
   initializationPromise = null;
   initializationMutex = new Mutex();
   // BUG FIX (v9.0.1): Prevent concurrent initialization
+  stdinMutex = new Mutex();
+  // BUG FIX: Prevent race conditions in stdin message processing
   version;
   ajv;
   compiledValidators = /* @__PURE__ */ new Map();
@@ -29262,7 +29303,15 @@ var McpServer = class _McpServer {
    * v10.5.0: Capture clientInfo for Smart Routing
    */
   async handleInitialize(request, id) {
-    const clientInfo = request.params.clientInfo;
+    const clientInfo = request.params?.clientInfo;
+    if (!clientInfo || typeof clientInfo.name !== "string" || typeof clientInfo.version !== "string") {
+      logger.warn("[MCP Server] Invalid initialize request: missing or invalid clientInfo", {
+        hasParams: !!request.params,
+        hasClientInfo: !!clientInfo,
+        clientInfo
+      });
+      return this.createErrorResponse(id, -32600 /* InvalidRequest */, "Invalid initialize request: clientInfo with name and version is required");
+    }
     logger.info("[MCP Server] Initialize request received (fast handshake mode)", { clientInfo });
     this.session = {
       clientInfo: {
@@ -29388,67 +29437,77 @@ ${json}`;
     logger.info("[MCP Server] Starting stdio JSON-RPC server...");
     let buffer = "";
     let contentLength = null;
-    process.stdin.on("data", async (chunk) => {
-      buffer += chunk.toString("utf-8");
-      if (buffer.length > STDIO_MAX_BUFFER_SIZE) {
-        logger.error("[MCP Server] Buffer size exceeded maximum", {
-          bufferSize: buffer.length,
-          maxSize: STDIO_MAX_BUFFER_SIZE
-        });
-        buffer = "";
-        contentLength = null;
-        return;
-      }
-      let iterations = 0;
-      while (iterations < STDIO_MAX_ITERATIONS) {
-        iterations++;
-        if (contentLength === null) {
-          const delimiter2 = buffer.includes("\r\n\r\n") ? "\r\n\r\n" : buffer.includes("\n\n") ? "\n\n" : null;
-          if (!delimiter2) break;
-          const headerEndIndex = buffer.indexOf(delimiter2);
-          const headerBlock = buffer.slice(0, headerEndIndex);
-          for (const line of headerBlock.split(delimiter2 === "\r\n\r\n" ? "\r\n" : "\n")) {
-            const [key, value] = line.split(":", 2).map((s) => s.trim());
-            if (key && key.toLowerCase() === "content-length" && value) {
-              contentLength = parseInt(value, 10);
-              if (isNaN(contentLength) || contentLength <= 0 || contentLength > STDIO_MAX_MESSAGE_SIZE) {
-                logger.error("[MCP Server] Invalid Content-Length", { contentLength });
-                buffer = buffer.slice(headerEndIndex + delimiter2.length);
-                contentLength = null;
-                continue;
+    process.stdin.on("data", (chunk) => {
+      void this.stdinMutex.runExclusive(async () => {
+        buffer += chunk.toString("utf-8");
+        if (buffer.length > STDIO_MAX_BUFFER_SIZE) {
+          logger.error("[MCP Server] Buffer size exceeded maximum", {
+            bufferSize: buffer.length,
+            maxSize: STDIO_MAX_BUFFER_SIZE
+          });
+          buffer = "";
+          contentLength = null;
+          return;
+        }
+        let iterations = 0;
+        while (iterations < STDIO_MAX_ITERATIONS) {
+          iterations++;
+          if (contentLength === null) {
+            const delimiter2 = buffer.includes("\r\n\r\n") ? "\r\n\r\n" : buffer.includes("\n\n") ? "\n\n" : null;
+            if (!delimiter2) break;
+            const headerEndIndex = buffer.indexOf(delimiter2);
+            const headerBlock = buffer.slice(0, headerEndIndex);
+            for (const line of headerBlock.split(delimiter2 === "\r\n\r\n" ? "\r\n" : "\n")) {
+              const [key, value] = line.split(":", 2).map((s) => s.trim());
+              if (key && key.toLowerCase() === "content-length" && value) {
+                contentLength = parseInt(value, 10);
+                if (isNaN(contentLength) || contentLength <= 0 || contentLength > STDIO_MAX_MESSAGE_SIZE) {
+                  logger.error("[MCP Server] Invalid Content-Length", { contentLength });
+                  this.writeResponse({
+                    jsonrpc: "2.0",
+                    id: null,
+                    error: {
+                      code: -32600 /* InvalidRequest */,
+                      message: `Invalid Content-Length: ${contentLength}`
+                    }
+                  });
+                  buffer = buffer.slice(headerEndIndex + delimiter2.length);
+                  contentLength = null;
+                  continue;
+                }
               }
             }
-          }
-          if (contentLength === null) {
-            logger.error("[MCP Server] No Content-Length header found");
+            if (contentLength === null) {
+              logger.error("[MCP Server] No Content-Length header found");
+              buffer = buffer.slice(headerEndIndex + delimiter2.length);
+              continue;
+            }
             buffer = buffer.slice(headerEndIndex + delimiter2.length);
-            continue;
           }
-          buffer = buffer.slice(headerEndIndex + delimiter2.length);
-        }
-        if (Buffer.byteLength(buffer, "utf-8") < contentLength) break;
-        const messageBuffer = Buffer.from(buffer, "utf-8");
-        const jsonMessage = messageBuffer.slice(0, contentLength).toString("utf-8");
-        buffer = messageBuffer.slice(contentLength).toString("utf-8");
-        contentLength = null;
-        try {
-          const request = JSON.parse(jsonMessage);
-          logger.debug("[MCP Server] Request received", { method: request.method, id: request.id });
-          const response = await this.handleRequest(request);
-          if (request.id !== void 0 && request.id !== null) {
-            this.writeResponse(response);
+          if (Buffer.byteLength(buffer, "utf-8") < contentLength) break;
+          const messageBuffer = Buffer.from(buffer, "utf-8");
+          const jsonMessage = messageBuffer.slice(0, contentLength).toString("utf-8");
+          buffer = messageBuffer.slice(contentLength).toString("utf-8");
+          contentLength = null;
+          try {
+            const request = JSON.parse(jsonMessage);
+            logger.debug("[MCP Server] Request received", { method: request.method, id: request.id });
+            const response = await this.handleRequest(request);
+            if (request.id !== void 0 && request.id !== null) {
+              this.writeResponse(response);
+            }
+          } catch (error) {
+            logger.error("[MCP Server] Failed to parse or handle request", { jsonMessage, error });
+            this.writeResponse({ jsonrpc: "2.0", id: null, error: { code: -32700 /* ParseError */, message: "Parse error: Invalid JSON" } });
           }
-        } catch (error) {
-          logger.error("[MCP Server] Failed to parse or handle request", { jsonMessage, error });
-          this.writeResponse({ jsonrpc: "2.0", id: null, error: { code: -32700 /* ParseError */, message: "Parse error: Invalid JSON" } });
         }
-      }
-      if (iterations >= STDIO_MAX_ITERATIONS) {
-        logger.warn("[MCP Server] Maximum iterations reached in message processing", {
-          iterations,
-          bufferSize: buffer.length
-        });
-      }
+        if (iterations >= STDIO_MAX_ITERATIONS) {
+          logger.warn("[MCP Server] Maximum iterations reached in message processing", {
+            iterations,
+            bufferSize: buffer.length
+          });
+        }
+      });
     });
     const shutdown = (reason) => {
       logger.info(`[MCP Server] ${reason}`);
@@ -30339,7 +30398,7 @@ var UnifiedMCPManager = class {
       };
       this.setupProcessHandlers(config.name, childProcess, serverProcess);
       this.servers.set(config.name, serverProcess);
-      await new Promise((resolve12) => setTimeout(resolve12, 100));
+      await new Promise((resolve13) => setTimeout(resolve13, 100));
       if (childProcess.killed || childProcess.exitCode !== null) {
         throw new Error(
           `Server process exited immediately with code ${childProcess.exitCode}`
@@ -30362,6 +30421,14 @@ var UnifiedMCPManager = class {
         name: config.name,
         error: error.message
       });
+      const serverProcess = this.servers.get(config.name);
+      if (serverProcess?.process && !serverProcess.process.killed) {
+        try {
+          serverProcess.process.kill("SIGTERM");
+        } catch {
+        }
+      }
+      this.servers.delete(config.name);
       throw error;
     }
   }
@@ -30442,7 +30509,7 @@ var UnifiedMCPManager = class {
   async restartServer(serverName) {
     logger.info("UnifiedMCPManager: Restarting server", { name: serverName });
     await this.stopServer(serverName);
-    await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+    await new Promise((resolve13) => setTimeout(resolve13, 1e3));
     const serverConfig = this.config.servers.find((s) => s.name === serverName);
     if (!serverConfig) {
       throw new Error(`Server configuration not found: ${serverName}`);
@@ -30689,31 +30756,34 @@ var UnifiedMCPManager = class {
         this.pendingRestarts.set(serverName, restartTimer);
       }
     });
-    if (this.config.logging?.logServerOutput) {
-      if (process2.stdout) {
-        process2.stdout.on("data", (data) => {
+    const shouldLog = this.config.logging?.logServerOutput;
+    if (process2.stdout) {
+      process2.stdout.on("data", (data) => {
+        if (shouldLog) {
           logger.debug(`MCP[${serverName}] stdout:`, {
             data: data.toString().trim()
           });
-        });
-      }
-      if (process2.stderr) {
-        process2.stderr.on("data", (data) => {
+        }
+      });
+    }
+    if (process2.stderr) {
+      process2.stderr.on("data", (data) => {
+        if (shouldLog) {
           logger.debug(`MCP[${serverName}] stderr:`, {
             data: data.toString().trim()
           });
-        });
-      }
+        }
+      });
     }
   }
   /**
    * Wait for process to exit
    */
   async waitForExit(process2, timeoutMs) {
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       const exitListener = () => {
         clearTimeout(timeout);
-        resolve12();
+        resolve13();
       };
       const timeout = setTimeout(() => {
         process2.removeListener("exit", exitListener);
@@ -31768,8 +31838,8 @@ var deleteCommand = {
           input: process.stdin,
           output: process.stdout
         });
-        const answer = await new Promise((resolve12) => {
-          rl.question(chalk5.yellow("\nAre you sure you want to delete this entry? (y/N): "), resolve12);
+        const answer = await new Promise((resolve13) => {
+          rl.question(chalk5.yellow("\nAre you sure you want to delete this entry? (y/N): "), resolve13);
         });
         rl.close();
         if (answer.toLowerCase() !== "y" && answer.toLowerCase() !== "yes") {
@@ -32729,7 +32799,7 @@ ${this.config.locale === "zh" ? "\u8ACB\u9078\u64C7" : "Select"}${defaultDisplay
   async promptWithTimeout(prompt, parser, defaultValue) {
     const rl = this.getReadline();
     const template = this.getTemplate();
-    return new Promise((resolve12) => {
+    return new Promise((resolve13) => {
       let resolved = false;
       let timeoutHandle;
       let warningHandle;
@@ -32743,7 +32813,7 @@ ${this.config.locale === "zh" ? "\u8ACB\u9078\u64C7" : "Select"}${defaultDisplay
 ${template.timedOut}`);
           rl.close();
           this.rl = null;
-          resolve12({
+          resolve13({
             value: defaultValue,
             timedOut: true
           });
@@ -32767,7 +32837,7 @@ ${template.timeoutWarning(30)}`);
             clearTimeout(warningHandle);
           }
           const value = parser(answer);
-          resolve12({
+          resolve13({
             value,
             timedOut: false
           });
@@ -33849,9 +33919,9 @@ ${action.modifications}`;
               )
             );
             console.log(chalk5.gray(`   Waiting ${delay}ms before retry...`));
-            await new Promise((resolve12) => setTimeout(resolve12, delay));
+            await new Promise((resolve13) => setTimeout(resolve13, delay));
           } else {
-            await new Promise((resolve12) => setTimeout(resolve12, delay));
+            await new Promise((resolve13) => setTimeout(resolve13, delay));
           }
         }
         const executionOptions = {
@@ -36988,7 +37058,7 @@ Result: ${result.stages.map((s) => s.output).join("\n\n")}`;
         if (argv.save) {
           try {
             const savePath = argv.save;
-            const saveDir = join(savePath, "..");
+            const saveDir = dirname(savePath);
             await mkdir(saveDir, { recursive: true });
             const outputData = formatForSave(result, argv.format || "text", {
               agent: resolvedAgentName,
@@ -37036,7 +37106,7 @@ Response: ${result.response.content}`;
       if (router) {
         router.destroy();
       }
-      await new Promise((resolve12) => setImmediate(resolve12));
+      await new Promise((resolve13) => setImmediate(resolve13));
       if (!verbosity.isQuiet()) {
         const executionTime = ((Date.now() - executionStartTime) / 1e3).toFixed(1);
         if (verbosity.isNormal()) {
@@ -37103,7 +37173,7 @@ Response: ${result.response.content}`;
             logger.debug("Context cleanup error", { error: errMsg });
           });
         }
-        await new Promise((resolve12) => setImmediate(resolve12));
+        await new Promise((resolve13) => setImmediate(resolve13));
         try {
           const { processManager: processManager2 } = await Promise.resolve().then(() => (init_process_manager(), process_manager_exports));
           await processManager2.shutdown(3e3);
@@ -38002,10 +38072,10 @@ async function getCurrentVersion() {
     return result.dependencies["@defai.digital/automatosx"]?.version || "unknown";
   } catch (error) {
     const { readFile: readFile24 } = await import('fs/promises');
-    const { dirname: dirname16, join: join48 } = await import('path');
+    const { dirname: dirname17, join: join48 } = await import('path');
     const { fileURLToPath: fileURLToPath8 } = await import('url');
     const __filename7 = fileURLToPath8(import.meta.url);
-    const __dirname8 = dirname16(__filename7);
+    const __dirname8 = dirname17(__filename7);
     const pkgPath = join48(__dirname8, "../../../package.json");
     const content = await readFile24(pkgPath, "utf-8");
     const pkg = JSON.parse(content);
@@ -38160,16 +38230,22 @@ var cleanupCommand = {
   },
   handler: async (argv) => {
     try {
+      const olderThan = argv.olderThan ?? 7;
+      if (isNaN(olderThan) || olderThan < 0) {
+        console.error(chalk5.red.bold("\n\u2717 Invalid --older-than value\n"));
+        console.error(chalk5.red("Value must be a non-negative number (days)"));
+        process.exit(1);
+      }
       const { detectProjectRoot: detectProjectRoot2 } = await Promise.resolve().then(() => (init_path_resolver(), path_resolver_exports));
       const projectDir = await detectProjectRoot2(process.cwd());
       const workspaceManager = new WorkspaceManager(projectDir);
       if (!argv.confirm) {
         console.log(chalk5.yellow(`
-\u26A0 This will remove temporary files older than ${argv.olderThan} days`));
+\u26A0 This will remove temporary files older than ${olderThan} days`));
         console.log(chalk5.gray("Run with --confirm to proceed\n"));
         process.exit(0);
       }
-      const removed = await workspaceManager.cleanupTmp(argv.olderThan);
+      const removed = await workspaceManager.cleanupTmp(olderThan);
       console.log(chalk5.green.bold(`
 \u2713 Cleanup complete
 `));
@@ -39444,7 +39520,7 @@ var resumeCommand = {
       if (router) {
         router.destroy();
       }
-      await new Promise((resolve12) => setImmediate(resolve12));
+      await new Promise((resolve13) => setImmediate(resolve13));
       console.log(chalk5.green.bold("\u2705 Complete\n"));
       process.exit(0);
     } catch (error) {
@@ -39464,7 +39540,7 @@ var resumeCommand = {
         if (router) {
           router.destroy();
         }
-        await new Promise((resolve12) => setImmediate(resolve12));
+        await new Promise((resolve13) => setImmediate(resolve13));
       } catch (cleanupError) {
         const errMsg = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
         logger.debug("Cleanup error ignored", { error: errMsg });
@@ -41755,7 +41831,7 @@ var doctorCommand = {
       }
     }
     async function checkCLIVersion() {
-      return new Promise((resolve12) => {
+      return new Promise((resolve13) => {
         const child = spawn("gemini", ["--version"], {
           stdio: ["ignore", "pipe", "pipe"]
         });
@@ -41769,14 +41845,14 @@ var doctorCommand = {
         });
         child.on("close", (code) => {
           if (code === 0 && stdout.trim()) {
-            resolve12({
+            resolve13({
               name: "CLI Version",
               status: "pass",
               message: "Gemini CLI version detected",
               details: stdout.trim()
             });
           } else {
-            resolve12({
+            resolve13({
               name: "CLI Version",
               status: "warn",
               message: "Could not detect version",
@@ -41786,7 +41862,7 @@ var doctorCommand = {
         });
         setTimeout(() => {
           child.kill();
-          resolve12({
+          resolve13({
             name: "CLI Version",
             status: "fail",
             message: "Version check timed out"
@@ -43283,22 +43359,30 @@ var DagGenerator = class {
   }
   /**
    * Calculate maximum depth of DAG (longest path)
+   * BUG FIX: Added cycle detection with visiting set to prevent infinite recursion
    */
   calculateMaxDepth(dag) {
     const depths = /* @__PURE__ */ new Map();
+    const visiting = /* @__PURE__ */ new Set();
     const calculateDepth = (nodeId) => {
       if (depths.has(nodeId)) {
         return depths.get(nodeId);
       }
+      if (visiting.has(nodeId)) {
+        return 0;
+      }
+      visiting.add(nodeId);
       const node = dag.nodes.find((n) => n.id === nodeId);
       if (!node || !node.dependencies || node.dependencies.length === 0) {
         depths.set(nodeId, 1);
+        visiting.delete(nodeId);
         return 1;
       }
       const depthValues = node.dependencies.map((dep) => calculateDepth(dep));
       const maxDepDep = depthValues.length > 0 ? Math.max(...depthValues) : 0;
       const depth = maxDepDep + 1;
       depths.set(nodeId, depth);
+      visiting.delete(nodeId);
       return depth;
     };
     let maxDepth = 0;
@@ -44297,11 +44381,23 @@ var genCommand = {
         process.exit(1);
       }
       specFile = resolve(process.cwd(), specFile);
-      const dangerousPaths = ["/etc", "/sys", "/proc", "/dev", "/root", "/boot"];
-      const isDangerousPath = dangerousPaths.some(
+      const dangerousUnixPaths = ["/etc", "/sys", "/proc", "/dev", "/root", "/boot"];
+      const isDangerousUnixPath = dangerousUnixPaths.some(
         (dangerous) => specFile.startsWith(dangerous + "/") || specFile === dangerous
       );
-      if (isDangerousPath) {
+      const specFileLower = specFile.toLowerCase();
+      const dangerousWindowsPaths = [
+        "c:\\windows",
+        "c:\\program files",
+        "c:\\program files (x86)",
+        "c:\\programdata",
+        "c:\\users\\public",
+        "c:\\system32"
+      ];
+      const isDangerousWindowsPath = dangerousWindowsPaths.some(
+        (dangerous) => specFileLower.startsWith(dangerous + "\\") || specFileLower === dangerous
+      );
+      if (isDangerousUnixPath || isDangerousWindowsPath) {
         console.error(chalk5.red(`\u2717 Error: Access to system directory '${specFile}' is not allowed`));
         console.error(chalk5.gray("Spec files should be in your project directory"));
         process.exit(1);
@@ -46458,7 +46554,7 @@ async function findProcesses(processName, verbose) {
 }
 async function killProcess(pid, verbose) {
   try {
-    await new Promise((resolve12, reject) => {
+    await new Promise((resolve13, reject) => {
       const proc = spawn("kill", ["-TERM", String(pid)], {
         stdio: "pipe",
         shell: false
@@ -46466,23 +46562,23 @@ async function killProcess(pid, verbose) {
       });
       proc.on("close", (code) => {
         if (code === 0) {
-          resolve12();
+          resolve13();
         } else {
           reject(new Error(`kill -TERM failed with code ${code}`));
         }
       });
       proc.on("error", reject);
     });
-    await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+    await new Promise((resolve13) => setTimeout(resolve13, 1e3));
     try {
-      await new Promise((resolve12, reject) => {
+      await new Promise((resolve13, reject) => {
         const proc = spawn("ps", ["-p", String(pid)], {
           stdio: "pipe",
           shell: false
         });
         proc.on("close", (code) => {
           if (code === 0) {
-            resolve12();
+            resolve13();
           } else {
             reject(new Error("Process not running"));
           }
@@ -46492,14 +46588,14 @@ async function killProcess(pid, verbose) {
       if (verbose) {
         logger.debug(`Process ${pid} didn't respond to SIGTERM, using SIGKILL`);
       }
-      await new Promise((resolve12, reject) => {
+      await new Promise((resolve13, reject) => {
         const proc = spawn("kill", ["-KILL", String(pid)], {
           stdio: "pipe",
           shell: false
         });
         proc.on("close", (code) => {
           if (code === 0) {
-            resolve12();
+            resolve13();
           } else {
             reject(new Error(`kill -KILL failed with code ${code}`));
           }
@@ -48077,7 +48173,7 @@ async function handleKill(argv) {
 `);
   console.log(chalk5.yellow("This will immediately disable the feature for ALL users."));
   console.log(chalk5.gray("Press Ctrl+C to cancel, or wait 5 seconds to confirm...\n"));
-  await new Promise((resolve12) => setTimeout(resolve12, 5e3));
+  await new Promise((resolve13) => setTimeout(resolve13, 5e3));
   try {
     await flagManager.killSwitch(flagName, reason);
     console.log(chalk5.red("\u2713 Kill switch activated"));