@defai.digital/automatosx 11.2.5 → 11.2.7

package/dist/mcp/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import * as path4 from 'path';
-import path4__default, { dirname, join, extname as extname$1, basename, resolve, isAbsolute, sep, parse, delimiter } from 'path';
+import path4__default, { dirname, join, extname as extname$1, basename, resolve, relative, isAbsolute, sep, parse, delimiter } from 'path';
 import { fileURLToPath } from 'url';
 import { mkdir, appendFile, readFile, readdir, writeFile, rename, unlink, copyFile, access, stat, realpath } from 'fs/promises';
 import { existsSync, readFileSync, promises, mkdirSync, createWriteStream, writeFileSync, unlinkSync, constants } from 'fs';
@@ -86,7 +86,7 @@ function setLogLevel(level) {
 }
 var LOG_LEVELS, COLORS, SENSITIVE_KEYS, SimpleLogger, logger;
 var init_logger = __esm({
-  "src/utils/logger.ts"() {
+  "src/shared/logging/logger.ts"() {
     init_esm_shims();
     LOG_LEVELS = {
       trace: 0,
@@ -258,7 +258,7 @@ ${JSON.stringify(entry.context, null, 2)}`;
   }
 });
 
-// src/utils/errors.ts
+// src/shared/errors/errors.ts
 function toBaseError(error) {
   if (error instanceof BaseError) {
     return error;
@@ -279,7 +279,7 @@ function toBaseError(error) {
 }
 var BaseError, ConfigError, ProviderError;
 var init_errors = __esm({
-  "src/utils/errors.ts"() {
+  "src/shared/errors/errors.ts"() {
     init_esm_shims();
     BaseError = class extends Error {
       code;
@@ -568,7 +568,7 @@ var init_errors = __esm({
   }
 });
 
-// src/utils/process-manager.ts
+// src/shared/process/process-manager.ts
 var process_manager_exports = {};
 __export(process_manager_exports, {
   installExitHandlers: () => installExitHandlers,
@@ -618,7 +618,7 @@ function installExitHandlers() {
 }
 var ProcessManager, processManager, exitHandlersInstalled, exitInProgress;
 var init_process_manager = __esm({
-  "src/utils/process-manager.ts"() {
+  "src/shared/process/process-manager.ts"() {
     init_esm_shims();
     init_logger();
     ProcessManager = class {
@@ -690,7 +690,7 @@ var init_process_manager = __esm({
           if (child.killed || child.exitCode !== null) {
             continue;
           }
-          killPromises.push(new Promise((resolve4) => {
+          killPromises.push(new Promise((resolve5) => {
             let mainTimeoutId = null;
             let fallbackTimeoutId = null;
             let resolved = false;
@@ -705,7 +705,7 @@ var init_process_manager = __esm({
               }
               if (!resolved) {
                 resolved = true;
-                resolve4();
+                resolve5();
               }
             };
             child.once("exit", () => {
@@ -730,8 +730,8 @@ var init_process_manager = __esm({
         try {
           await Promise.race([
             Promise.all(killPromises),
-            new Promise((resolve4) => {
-              finalTimeoutId = setTimeout(resolve4, timeout);
+            new Promise((resolve5) => {
+              finalTimeoutId = setTimeout(resolve5, timeout);
             })
           ]);
         } finally {
@@ -782,8 +782,8 @@ var init_process_manager = __esm({
   }
 });
 var DEFAULT_OPTIONS, DatabaseFactory;
-var init_db_factory = __esm({
-  "src/utils/db-factory.ts"() {
+var init_factory = __esm({
+  "src/core/database/factory.ts"() {
     init_esm_shims();
     init_logger();
     DEFAULT_OPTIONS = {
@@ -966,7 +966,7 @@ var init_workspace_indexer = __esm({
   "src/core/workspace-indexer.ts"() {
     init_esm_shims();
     init_logger();
-    init_db_factory();
+    init_factory();
     DEFAULT_IGNORE_PATTERNS = [
       "node_modules/**",
       ".git/**",
@@ -1487,10 +1487,10 @@ var init_workspace_indexer = __esm({
   }
 });
 
-// src/utils/verbosity-manager.ts
+// src/shared/logging/verbosity-manager.ts
 var VerbosityManager;
 var init_verbosity_manager = __esm({
-  "src/utils/verbosity-manager.ts"() {
+  "src/shared/logging/verbosity-manager.ts"() {
     init_esm_shims();
     VerbosityManager = class _VerbosityManager {
       static instance = null;
@@ -1810,7 +1810,7 @@ var init_provider_schemas = __esm({
 });
 var StreamingProgressParser;
 var init_streaming_progress_parser = __esm({
-  "src/utils/streaming-progress-parser.ts"() {
+  "src/shared/process/streaming-progress-parser.ts"() {
     init_esm_shims();
     StreamingProgressParser = class {
       spinner = null;
@@ -2320,7 +2320,8 @@ var init_base_provider = __esm({
         try {
           const cliCommand = this.getCLICommand();
           const cliArgs = await this.getCLIArgs();
-          const argsString = cliArgs.length > 0 ? cliArgs.join(" ") + " " : "";
+          const escapedArgs = cliArgs.map((arg) => this.escapeShellArg(arg));
+          const argsString = escapedArgs.length > 0 ? escapedArgs.join(" ") + " " : "";
           const escapedPrompt = this.escapeShellArg(prompt);
           const fullCommand = `${cliCommand} ${argsString}${escapedPrompt}`;
           const commandLength = fullCommand.length;
@@ -2363,7 +2364,7 @@ var init_base_provider = __esm({
        * @returns Promise resolving to stdout and stderr
        */
       async executeWithSpawn(command, cliCommand) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           const child = spawn(command, [], {
             shell: true,
             // Auto-detects: cmd.exe on Windows, /bin/sh on Unix
@@ -2462,11 +2463,16 @@ var init_base_provider = __esm({
             if (stderr) {
               logger.debug(`${cliCommand} CLI stderr output`, { stderr: stderr.trim() });
             }
-            if (code === 0 || code === null) {
+            if ((code === 0 || code === null) && !signal) {
               if (progressParser) {
                 progressParser.succeed(`${cliCommand} completed successfully`);
               }
-              resolve4({ stdout, stderr });
+              resolve5({ stdout, stderr });
+            } else if (signal) {
+              if (progressParser) {
+                progressParser.fail(`${cliCommand} killed by signal ${signal}`);
+              }
+              reject(new Error(`${cliCommand} CLI killed by signal ${signal}. stderr: ${stderr || "none"}`));
             } else {
               if (progressParser) {
                 progressParser.fail(`${cliCommand} failed with code ${code}`);
@@ -2516,7 +2522,7 @@ var init_base_provider = __esm({
        * @returns Promise resolving to stdout and stderr
        */
       async executeWithStdin(cliCommand, cliArgs, prompt) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           const commandArgs = cliArgs ? cliArgs.split(" ").filter(Boolean) : [];
           logger.debug(`Executing ${cliCommand} CLI with stdin`, {
             command: cliCommand,
@@ -2629,7 +2635,7 @@ var init_base_provider = __esm({
               if (progressParser) {
                 progressParser.succeed(`${cliCommand} completed successfully`);
               }
-              resolve4({ stdout, stderr });
+              resolve5({ stdout, stderr });
             } else {
               if (progressParser) {
                 progressParser.fail(`${cliCommand} failed with code ${code}`);
@@ -2752,6 +2758,10 @@ ${fullPrompt}
               errors: responseValidation.error.issues,
               response
             });
+            throw new ProviderError(
+              `Provider returned invalid response structure: ${responseValidation.error.issues.map((i) => i.message).join(", ")}`,
+              "E1305" /* PROVIDER_EXEC_ERROR */
+            );
           }
           return response;
         } catch (error) {
@@ -3381,7 +3391,7 @@ var init_cli_wrapper = __esm({
        * Spawn codex process
        */
       async spawnProcess(args2, prompt, timeout) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           let stdout = "";
           let stderr = "";
           let hasTimedOut = false;
@@ -3438,7 +3448,7 @@ var init_cli_wrapper = __esm({
               return;
             }
             if (code === 0) {
-              resolve4({ stdout, stderr, exitCode: code });
+              resolve5({ stdout, stderr, exitCode: code });
             } else {
               reject(
                 new CodexError(
@@ -3471,7 +3481,7 @@ var init_cli_wrapper = __esm({
        * Spawn codex process with streaming support
        */
       async spawnProcessWithStreaming(args2, prompt, timeout, renderer) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           let stdout = "";
           let stderr = "";
           let hasTimedOut = false;
@@ -3541,7 +3551,7 @@ var init_cli_wrapper = __esm({
               if (renderer) {
                 renderer.succeed("Execution complete");
               }
-              resolve4({ stdout, stderr, exitCode: code });
+              resolve5({ stdout, stderr, exitCode: code });
             } else {
               if (renderer) {
                 renderer.fail(`Process exited with code ${code}`);
@@ -4008,14 +4018,14 @@ init_esm_shims();
 // src/mcp/server.ts
 init_esm_shims();
 
-// src/utils/version.ts
+// src/shared/helpers/version.ts
 init_esm_shims();
 var __dirname$1 = dirname(fileURLToPath(import.meta.url));
 function getVersion() {
   try {
     const possiblePaths = [
-      join(__dirname$1, "../../package.json"),
-      // From src/utils
+      join(__dirname$1, "../../../package.json"),
+      // From src/shared/helpers
       join(__dirname$1, "../package.json")
       // From dist
     ];
@@ -4043,10 +4053,10 @@ var MCP_PROTOCOL_VERSION = "2024-11-05";
 // src/mcp/server.ts
 init_logger();
 
-// src/core/config.ts
+// src/core/config/loader.ts
 init_esm_shims();
 
-// src/utils/path-utils.ts
+// src/shared/validation/path-utils.ts
 init_esm_shims();
 function normalizePath(filePath) {
   if (!filePath) return filePath;
@@ -4444,11 +4454,11 @@ var DEFAULT_CONFIG = {
   }
 };
 
-// src/core/config.ts
+// src/core/config/loader.ts
 init_errors();
 init_logger();
 
-// src/utils/deep-merge.ts
+// src/shared/helpers/deep-merge.ts
 init_esm_shims();
 function deepMerge(defaults, user) {
   if (user === null || user === void 0) {
@@ -4588,7 +4598,7 @@ function isNonNegativeInteger(value) {
   return typeof value === "number" && Number.isInteger(value) && value >= 0;
 }
 
-// src/core/cache.ts
+// src/core/cache/cache.ts
 init_esm_shims();
 init_logger();
 var TTLCache = class {
@@ -4873,7 +4883,7 @@ var TTLCache = class {
   }
 };
 
-// src/utils/resource-calculator.ts
+// src/shared/helpers/resource-calculator.ts
 init_esm_shims();
 function getSystemResources() {
   const totalMemory = os2.totalmem();
@@ -4915,13 +4925,13 @@ function calculateMaxConcurrentAgents(staticLimit) {
   };
 }
 
-// src/config.generated.ts
+// src/core/config/generated.ts
 init_esm_shims();
 var PRECOMPILED_CONFIG = {
   "providers": {
     "claude-code": {
       "enabled": true,
-      "priority": 3,
+      "priority": 1,
       "timeout": 27e5,
       "command": "claude",
       "healthCheck": {
@@ -4981,7 +4991,7 @@ var PRECOMPILED_CONFIG = {
     },
     "openai": {
       "enabled": true,
-      "priority": 1,
+      "priority": 3,
       "timeout": 27e5,
       "command": "codex",
       "healthCheck": {
@@ -5219,10 +5229,10 @@ var PRECOMPILED_CONFIG = {
     "enableFreeTierPrioritization": true,
     "enableWorkloadAwareRouting": true
   },
-  "version": "11.2.5"
+  "version": "11.2.7"
 };
 
-// src/core/config-schemas.ts
+// src/core/config/schemas.ts
 init_esm_shims();
 z.enum([
   "claude",
@@ -5523,7 +5533,7 @@ function safeValidateConfig(config) {
 }
 automatosXConfigSchema.partial().passthrough();
 
-// src/core/config.ts
+// src/core/config/loader.ts
 var configCache = new TTLCache({
   ttl: 6e4,
   // 60 seconds
@@ -5557,7 +5567,7 @@ async function loadConfigUncached(projectDir) {
         logger.warn("\u26A0\uFE0F  DEPRECATED: automatosx.config.{yaml,json} is deprecated.");
         logger.warn("   Please rename to ax.config.{yaml,json} for future compatibility.");
         logger.warn("   Migration: mv automatosx.config.json ax.config.json");
-        logger.warn("   Support will be removed in v10.0.0.");
+        logger.warn("   Support will be removed in a future version.");
       }
       return await loadConfigFile(configPath);
     }
@@ -6052,7 +6062,7 @@ function validateConfig(config) {
   return errors;
 }
 
-// src/core/router.ts
+// src/core/router/router.ts
 init_esm_shims();
 init_logger();
 init_errors();
@@ -6061,7 +6071,7 @@ init_errors();
 init_esm_shims();
 init_logger();
 
-// src/core/path-resolver.ts
+// src/shared/validation/path-resolver.ts
 init_esm_shims();
 
 // src/types/path.ts
@@ -6074,7 +6084,7 @@ var PathError = class extends Error {
   }
 };
 
-// src/core/path-resolver.ts
+// src/shared/validation/path-resolver.ts
 function isWindowsPath(path5) {
   return /^[a-zA-Z]:[/\\]/.test(path5);
 }
@@ -6614,7 +6624,7 @@ async function getProviderLimitManager(stateDirectory) {
   return ProviderLimitManager.getInstance(stateDirectory);
 }
 
-// src/utils/performance-markers.ts
+// src/shared/profiling/performance-markers.ts
 init_esm_shims();
 init_logger();
 var PERFORMANCE_THRESHOLDS = {
@@ -6768,7 +6778,7 @@ var PerformanceTimer = class {
   }
 };
 
-// src/core/routing-strategy.ts
+// src/core/router/routing-strategy.ts
 init_esm_shims();
 
 // src/types/routing.ts
@@ -6845,7 +6855,7 @@ var ROUTING_STRATEGIES = {
 init_esm_shims();
 init_logger();
 
-// src/utils/statistics.ts
+// src/shared/helpers/statistics.ts
 init_esm_shims();
 function getPercentileIndex(length, percentile) {
   if (length === 0) {
@@ -7291,7 +7301,7 @@ function getProviderMetricsTracker() {
   return globalMetricsTracker;
 }
 
-// src/core/routing-strategy.ts
+// src/core/router/routing-strategy.ts
 init_logger();
 var RoutingStrategyManager = class extends EventEmitter {
   strategy;
@@ -7574,7 +7584,7 @@ function getRoutingStrategyManager(config) {
   return globalRoutingStrategy;
 }
 
-// src/core/circuit-breaker.ts
+// src/core/router/circuit-breaker.ts
 init_esm_shims();
 init_logger();
 var DEFAULT_CONFIG2 = {
@@ -7737,7 +7747,7 @@ var CircuitBreaker = class {
   }
 };
 
-// src/core/router-trace-logger.ts
+// src/core/router/trace-logger.ts
 init_esm_shims();
 init_logger();
 var RouterTraceLogger = class {
@@ -8109,7 +8119,7 @@ async function getProviderSession(workspacePath) {
   return providerSessionInstances.get(path5);
 }
 
-// src/core/router.ts
+// src/core/router/router.ts
 var Router = class {
   providers;
   fallbackEnabled;
@@ -8289,23 +8299,29 @@ var Router = class {
         const isCircuitOpen = this.circuitBreaker.isOpen(provider.name);
         healthMultipliers.set(provider.name, isCircuitOpen ? 0.5 : 1);
       }
-      const scores = await getProviderMetricsTracker().getAllScores(
-        providerNames,
-        strategyManager.getWeights(),
-        healthMultipliers
-      );
-      if (scores.length > 0) {
-        const scoreMap = new Map(scores.map((s) => [s.provider, s.totalScore]));
-        const originalOrder = providersToTry.map((p) => p.name);
-        providersToTry = [...providersToTry].sort((a, b) => {
-          const scoreA = scoreMap.get(a.name) ?? 0;
-          const scoreB = scoreMap.get(b.name) ?? 0;
-          return scoreB - scoreA;
-        });
-        logger.debug("Provider order after multi-factor routing", {
-          original: originalOrder,
-          reordered: providersToTry.map((p) => p.name),
-          scores: Object.fromEntries(scoreMap)
+      try {
+        const scores = await getProviderMetricsTracker().getAllScores(
+          providerNames,
+          strategyManager.getWeights(),
+          healthMultipliers
+        );
+        if (scores.length > 0) {
+          const scoreMap = new Map(scores.map((s) => [s.provider, s.totalScore]));
+          const originalOrder = providersToTry.map((p) => p.name);
+          providersToTry = [...providersToTry].sort((a, b) => {
+            const scoreA = scoreMap.get(a.name) ?? 0;
+            const scoreB = scoreMap.get(b.name) ?? 0;
+            return scoreB - scoreA;
+          });
+          logger.debug("Provider order after multi-factor routing", {
+            original: originalOrder,
+            reordered: providersToTry.map((p) => p.name),
+            scores: Object.fromEntries(scoreMap)
+          });
+        }
+      } catch (scoringError) {
+        logger.warn("Multi-factor scoring failed, using priority order", {
+          error: scoringError.message
         });
       }
     }
@@ -8913,10 +8929,10 @@ Run 'ax doctor' to diagnose provider setup.` : "";
   }
 };
 
-// src/core/lazy-memory-manager.ts
+// src/core/memory/lazy-manager.ts
 init_esm_shims();
 
-// src/core/memory-manager.ts
+// src/core/memory/manager.ts
 init_esm_shims();
 
 // src/types/memory.ts
@@ -8930,11 +8946,11 @@ var MemoryError = class extends Error {
   }
 };
 
-// src/core/memory-manager.ts
+// src/core/memory/manager.ts
 init_logger();
-init_db_factory();
+init_factory();
 
-// src/core/memory-manager-schemas.ts
+// src/core/memory/schemas.ts
 init_esm_shims();
 var MemoryMetadataSchema = z.object({
   type: z.string().min(1).max(100),
@@ -9210,7 +9226,7 @@ var MemoryCleanupStrategies = class {
   }
 };
 
-// src/core/memory-manager.ts
+// src/core/memory/manager.ts
 var MemoryManager = class _MemoryManager {
   // v5.6.18: Performance optimization - Static regex for FTS5 query sanitization
   // Moving these to class-level constants reduces 90% sanitization time
@@ -10183,8 +10199,11 @@ var MemoryManager = class _MemoryManager {
       }
       const tempPath = `${this.config.dbPath}.restore.tmp`;
       const srcDb = new Database2(srcPath, { readonly: true });
-      await srcDb.backup(tempPath);
-      srcDb.close();
+      try {
+        await srcDb.backup(tempPath);
+      } finally {
+        srcDb.close();
+      }
       try {
         const tempDb = new Database2(tempPath, { readonly: true });
         tempDb.prepare("SELECT COUNT(*) FROM memory_entries").get();
@@ -10467,7 +10486,7 @@ var MemoryManager = class _MemoryManager {
   }
 };
 
-// src/core/lazy-memory-manager.ts
+// src/core/memory/lazy-manager.ts
 init_logger();
 var LazyMemoryManager = class {
   manager;
@@ -10673,7 +10692,7 @@ var LazyMemoryManager = class {
   }
 };
 
-// src/core/session-manager.ts
+// src/core/session/manager.ts
 init_esm_shims();
 
 // src/types/orchestration.ts
@@ -10696,10 +10715,10 @@ var SessionError = class extends Error {
   }
 };
 
-// src/core/session-manager.ts
+// src/core/session/manager.ts
 init_logger();
 
-// src/core/session-manager-schemas.ts
+// src/core/session/schemas.ts
 init_esm_shims();
 var SessionTaskInfoSchema = z.object({
   id: z.string().min(1).max(200),
@@ -10742,7 +10761,7 @@ z.object({
   offset: z.number().int().nonnegative().optional()
 }).strict();
 
-// src/core/session-manager.ts
+// src/core/session/manager.ts
 var SessionManager = class _SessionManager {
   /** Active sessions (in-memory, keyed by session ID) */
   activeSessions = /* @__PURE__ */ new Map();
@@ -12935,17 +12954,30 @@ function safeValidateAgentProfile(profile) {
 }
 agentProfileSchema.partial();
 
-// src/agents/profile-loader.ts
-var __filename2 = fileURLToPath(import.meta.url);
-var __dirname3 = dirname(__filename2);
-function getPackageRoot() {
-  const currentDir = __dirname3;
-  if (currentDir.includes("/dist")) {
-    return join(currentDir, "..");
-  } else {
-    return join(currentDir, "../..");
+// src/shared/helpers/package-root.ts
+init_esm_shims();
+var cachedPackageRoot = null;
+function getPackageRoot(startDir) {
+  if (cachedPackageRoot && !startDir) {
+    return cachedPackageRoot;
+  }
+  const __filename2 = fileURLToPath(import.meta.url);
+  const __dirname3 = dirname(__filename2);
+  let current = startDir || __dirname3;
+  const root = "/";
+  while (current !== root) {
+    if (existsSync(join(current, "package.json"))) {
+      {
+        cachedPackageRoot = current;
+      }
+      return current;
+    }
+    current = dirname(current);
   }
+  return startDir || __dirname3;
 }
+
+// src/agents/profile-loader.ts
 var ProfileLoader = class {
   profilesDir;
   fallbackProfilesDir;
@@ -13629,23 +13661,13 @@ var ProfileLoader = class {
 // src/agents/abilities-manager.ts
 init_esm_shims();
 init_logger();
-var __filename3 = fileURLToPath(import.meta.url);
-var __dirname4 = dirname(__filename3);
-function getPackageRoot2() {
-  const currentDir = __dirname4;
-  if (currentDir.includes("/dist")) {
-    return join(currentDir, "..");
-  } else {
-    return join(currentDir, "../..");
-  }
-}
 var AbilitiesManager = class {
   abilitiesDir;
   fallbackAbilitiesDir;
   cache;
   constructor(abilitiesDir, fallbackAbilitiesDir) {
     this.abilitiesDir = abilitiesDir;
-    this.fallbackAbilitiesDir = fallbackAbilitiesDir || join(getPackageRoot2(), "examples/abilities");
+    this.fallbackAbilitiesDir = fallbackAbilitiesDir || join(getPackageRoot(), "examples/abilities");
     this.cache = new TTLCache({
       maxEntries: 50,
       ttl: 6e5,
@@ -13930,9 +13952,10 @@ var TeamManager = class {
   }
 };
 
-// src/core/conversation-context-store.ts
+// src/core/session/context-store.ts
 init_esm_shims();
 init_logger();
+var VALID_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
 var ConversationContextStore = class {
   storePath;
   maxEntries;
@@ -13942,6 +13965,33 @@ var ConversationContextStore = class {
     this.maxEntries = options.maxEntries ?? 100;
     this.ttlMs = options.ttlMs ?? 24 * 60 * 60 * 1e3;
   }
+  /**
+   * Validate and sanitize context ID to prevent path traversal attacks
+   *
+   * SECURITY: This is critical to prevent path traversal vulnerabilities.
+   * A malicious ID like "../../.ssh/id_rsa" could read/write/delete files
+   * outside the context store directory.
+   *
+   * @param id - Context ID to validate
+   * @returns Sanitized file path within storePath
+   * @throws Error if ID is invalid or path escapes storePath
+   */
+  validateAndResolvePath(id) {
+    if (!VALID_ID_PATTERN.test(id)) {
+      throw new Error(
+        `Invalid context ID: "${id}". IDs must be 1-64 characters, alphanumeric with underscores/hyphens only.`
+      );
+    }
+    const filePath = join(this.storePath, `${id}.json`);
+    const resolvedPath = resolve(filePath);
+    const resolvedStorePath = resolve(this.storePath);
+    const relativePath = relative(resolvedStorePath, resolvedPath);
+    if (relativePath.startsWith("..") || relativePath.includes("/..") || relativePath.includes("\\..")) {
+      logger.error("[ContextStore] Path traversal attempt blocked", { id, resolvedPath });
+      throw new Error(`Security violation: context ID "${id}" would escape store directory`);
+    }
+    return resolvedPath;
+  }
   /**
    * Initialize store (create directory if needed)
    */
@@ -13959,7 +14009,7 @@ var ConversationContextStore = class {
    */
   async save(context) {
     await this.initialize();
-    const filePath = join(this.storePath, `${context.id}.json`);
+    const filePath = this.validateAndResolvePath(context.id);
     const data = JSON.stringify(context, null, 2);
     try {
       await writeFile(filePath, data, "utf-8");
@@ -13978,7 +14028,7 @@ var ConversationContextStore = class {
    * Get conversation context by ID
    */
   async get(id) {
-    const filePath = join(this.storePath, `${id}.json`);
+    const filePath = this.validateAndResolvePath(id);
     try {
       const data = await readFile(filePath, "utf-8");
       const context = JSON.parse(data);
@@ -14032,7 +14082,7 @@ var ConversationContextStore = class {
    * Delete context entry
    */
   async delete(id) {
-    const filePath = join(this.storePath, `${id}.json`);
+    const filePath = this.validateAndResolvePath(id);
     try {
       await unlink(filePath);
       logger.info("[ContextStore] Context deleted", { id });
@@ -14725,7 +14775,7 @@ var TimeoutManager = class {
   }
 };
 
-// src/utils/timeout-validator.ts
+// src/shared/validation/timeout-validator.ts
 init_esm_shims();
 init_errors();
 var MIN_WARNING_THRESHOLD2 = 0.5;
@@ -14798,7 +14848,7 @@ function validateAndBuildTimeoutConfig(executionConfig) {
   return config;
 }
 
-// src/utils/error-formatter.ts
+// src/shared/errors/error-formatter.ts
 init_esm_shims();
 init_errors();
 function formatError(error, options = {}) {
@@ -16466,7 +16516,7 @@ ${context.task}`;
    * @param signal - Optional AbortSignal to cancel the sleep
    */
   sleep(ms, signal) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       if (signal?.aborted) {
         reject(new Error("Sleep cancelled"));
         return;
@@ -16476,7 +16526,7 @@ ${context.task}`;
         if (abortHandler && signal) {
           signal.removeEventListener("abort", abortHandler);
         }
-        resolve4();
+        resolve5();
       }, ms);
       if (signal) {
         abortHandler = () => {
@@ -17894,10 +17944,10 @@ var McpClient = class extends EventEmitter {
       return;
     }
     if (this.state.status === "connecting") {
-      return new Promise((resolve4, reject) => {
+      return new Promise((resolve5, reject) => {
         const onConnected = () => {
           this.off("error", onError);
-          resolve4();
+          resolve5();
         };
         const onError = (err) => {
           this.off("connected", onConnected);
@@ -18064,14 +18114,14 @@ var McpClient = class extends EventEmitter {
       method,
       params
     };
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const timeoutMs = timeout ?? this.config.timeout;
       const timeoutHandle = setTimeout(() => {
         this.pendingRequests.delete(id);
         reject(new Error(`Request timed out after ${timeoutMs}ms: ${method}`));
       }, timeoutMs);
       this.pendingRequests.set(id, {
-        resolve: resolve4,
+        resolve: resolve5,
         reject,
         timeout: timeoutHandle
       });
@@ -18529,15 +18579,15 @@ var McpClientPool = class extends EventEmitter {
     }
   }
   async waitForConnection(provider, pool) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const timeout = setTimeout(() => {
-        const index = pool.waitQueue.findIndex((w) => w.resolve === resolve4);
+        const index = pool.waitQueue.findIndex((w) => w.resolve === resolve5);
         if (index !== -1) {
           pool.waitQueue.splice(index, 1);
         }
         reject(new ConnectionTimeoutError(provider, this.config.acquireTimeoutMs));
       }, this.config.acquireTimeoutMs);
-      pool.waitQueue.push({ resolve: resolve4, reject, timeout });
+      pool.waitQueue.push({ resolve: resolve5, reject, timeout });
       logger.debug("[MCP Pool] Waiting for connection", {
         provider,
         queuePosition: pool.waitQueue.length
@@ -20014,6 +20064,8 @@ var McpServer = class _McpServer {
   initializationPromise = null;
   initializationMutex = new Mutex();
   // BUG FIX (v9.0.1): Prevent concurrent initialization
+  stdinMutex = new Mutex();
+  // BUG FIX: Prevent race conditions in stdin message processing
   version;
   ajv;
   compiledValidators = /* @__PURE__ */ new Map();
@@ -20389,7 +20441,15 @@ var McpServer = class _McpServer {
    * v10.5.0: Capture clientInfo for Smart Routing
    */
   async handleInitialize(request, id) {
-    const clientInfo = request.params.clientInfo;
+    const clientInfo = request.params?.clientInfo;
+    if (!clientInfo || typeof clientInfo.name !== "string" || typeof clientInfo.version !== "string") {
+      logger.warn("[MCP Server] Invalid initialize request: missing or invalid clientInfo", {
+        hasParams: !!request.params,
+        hasClientInfo: !!clientInfo,
+        clientInfo
+      });
+      return this.createErrorResponse(id, -32600 /* InvalidRequest */, "Invalid initialize request: clientInfo with name and version is required");
+    }
     logger.info("[MCP Server] Initialize request received (fast handshake mode)", { clientInfo });
     this.session = {
       clientInfo: {
@@ -20515,67 +20575,77 @@ ${json}`;
     logger.info("[MCP Server] Starting stdio JSON-RPC server...");
     let buffer = "";
     let contentLength = null;
-    process.stdin.on("data", async (chunk) => {
-      buffer += chunk.toString("utf-8");
-      if (buffer.length > STDIO_MAX_BUFFER_SIZE) {
-        logger.error("[MCP Server] Buffer size exceeded maximum", {
-          bufferSize: buffer.length,
-          maxSize: STDIO_MAX_BUFFER_SIZE
-        });
-        buffer = "";
-        contentLength = null;
-        return;
-      }
-      let iterations = 0;
-      while (iterations < STDIO_MAX_ITERATIONS) {
-        iterations++;
-        if (contentLength === null) {
-          const delimiter2 = buffer.includes("\r\n\r\n") ? "\r\n\r\n" : buffer.includes("\n\n") ? "\n\n" : null;
-          if (!delimiter2) break;
-          const headerEndIndex = buffer.indexOf(delimiter2);
-          const headerBlock = buffer.slice(0, headerEndIndex);
-          for (const line of headerBlock.split(delimiter2 === "\r\n\r\n" ? "\r\n" : "\n")) {
-            const [key, value] = line.split(":", 2).map((s) => s.trim());
-            if (key && key.toLowerCase() === "content-length" && value) {
-              contentLength = parseInt(value, 10);
-              if (isNaN(contentLength) || contentLength <= 0 || contentLength > STDIO_MAX_MESSAGE_SIZE) {
-                logger.error("[MCP Server] Invalid Content-Length", { contentLength });
-                buffer = buffer.slice(headerEndIndex + delimiter2.length);
-                contentLength = null;
-                continue;
+    process.stdin.on("data", (chunk) => {
+      void this.stdinMutex.runExclusive(async () => {
+        buffer += chunk.toString("utf-8");
+        if (buffer.length > STDIO_MAX_BUFFER_SIZE) {
+          logger.error("[MCP Server] Buffer size exceeded maximum", {
+            bufferSize: buffer.length,
+            maxSize: STDIO_MAX_BUFFER_SIZE
+          });
+          buffer = "";
+          contentLength = null;
+          return;
+        }
+        let iterations = 0;
+        while (iterations < STDIO_MAX_ITERATIONS) {
+          iterations++;
+          if (contentLength === null) {
+            const delimiter2 = buffer.includes("\r\n\r\n") ? "\r\n\r\n" : buffer.includes("\n\n") ? "\n\n" : null;
+            if (!delimiter2) break;
+            const headerEndIndex = buffer.indexOf(delimiter2);
+            const headerBlock = buffer.slice(0, headerEndIndex);
+            for (const line of headerBlock.split(delimiter2 === "\r\n\r\n" ? "\r\n" : "\n")) {
+              const [key, value] = line.split(":", 2).map((s) => s.trim());
+              if (key && key.toLowerCase() === "content-length" && value) {
+                contentLength = parseInt(value, 10);
+                if (isNaN(contentLength) || contentLength <= 0 || contentLength > STDIO_MAX_MESSAGE_SIZE) {
+                  logger.error("[MCP Server] Invalid Content-Length", { contentLength });
+                  this.writeResponse({
+                    jsonrpc: "2.0",
+                    id: null,
+                    error: {
+                      code: -32600 /* InvalidRequest */,
+                      message: `Invalid Content-Length: ${contentLength}`
+                    }
+                  });
+                  buffer = buffer.slice(headerEndIndex + delimiter2.length);
+                  contentLength = null;
+                  continue;
+                }
               }
             }
-          }
-          if (contentLength === null) {
-            logger.error("[MCP Server] No Content-Length header found");
+            if (contentLength === null) {
+              logger.error("[MCP Server] No Content-Length header found");
+              buffer = buffer.slice(headerEndIndex + delimiter2.length);
+              continue;
+            }
             buffer = buffer.slice(headerEndIndex + delimiter2.length);
-            continue;
           }
-          buffer = buffer.slice(headerEndIndex + delimiter2.length);
-        }
-        if (Buffer.byteLength(buffer, "utf-8") < contentLength) break;
-        const messageBuffer = Buffer.from(buffer, "utf-8");
-        const jsonMessage = messageBuffer.slice(0, contentLength).toString("utf-8");
-        buffer = messageBuffer.slice(contentLength).toString("utf-8");
-        contentLength = null;
-        try {
-          const request = JSON.parse(jsonMessage);
-          logger.debug("[MCP Server] Request received", { method: request.method, id: request.id });
-          const response = await this.handleRequest(request);
-          if (request.id !== void 0 && request.id !== null) {
-            this.writeResponse(response);
+          if (Buffer.byteLength(buffer, "utf-8") < contentLength) break;
+          const messageBuffer = Buffer.from(buffer, "utf-8");
+          const jsonMessage = messageBuffer.slice(0, contentLength).toString("utf-8");
+          buffer = messageBuffer.slice(contentLength).toString("utf-8");
+          contentLength = null;
+          try {
+            const request = JSON.parse(jsonMessage);
+            logger.debug("[MCP Server] Request received", { method: request.method, id: request.id });
+            const response = await this.handleRequest(request);
+            if (request.id !== void 0 && request.id !== null) {
+              this.writeResponse(response);
+            }
+          } catch (error) {
+            logger.error("[MCP Server] Failed to parse or handle request", { jsonMessage, error });
+            this.writeResponse({ jsonrpc: "2.0", id: null, error: { code: -32700 /* ParseError */, message: "Parse error: Invalid JSON" } });
           }
-        } catch (error) {
-          logger.error("[MCP Server] Failed to parse or handle request", { jsonMessage, error });
-          this.writeResponse({ jsonrpc: "2.0", id: null, error: { code: -32700 /* ParseError */, message: "Parse error: Invalid JSON" } });
         }
-      }
-      if (iterations >= STDIO_MAX_ITERATIONS) {
-        logger.warn("[MCP Server] Maximum iterations reached in message processing", {
-          iterations,
-          bufferSize: buffer.length
-        });
-      }
+        if (iterations >= STDIO_MAX_ITERATIONS) {
+          logger.warn("[MCP Server] Maximum iterations reached in message processing", {
+            iterations,
+            bufferSize: buffer.length
+          });
+        }
+      });
     });
     const shutdown = (reason) => {
       logger.info(`[MCP Server] ${reason}`);