@dewtech/dare-cli 3.2.0 → 3.4.0

package/dist/dag-runner/state-store.js

@@ -11,19 +11,25 @@
 import path from 'path';
 import fs from 'fs-extra';
 export const DEFAULT_STATE_PATH = path.join('.dare', 'state.json');
+async function readPersistedState(stateFile) {
+    if (!(await fs.pathExists(stateFile)))
+        return null;
+    const raw = (await fs.readJson(stateFile));
+    return isPersistedState(raw) ? raw : null;
+}
+function emptyPersistedState() {
+    return {
+        version: 1,
+        updatedAt: new Date().toISOString(),
+        tasks: {},
+    };
+}
 /**
  * Read state from disk and merge it into `dag.tasks`. Missing tasks default
  * to PENDING.
  */
 export async function loadAndApplyState(dag, stateFile) {
-    const exists = await fs.pathExists(stateFile);
-    if (!exists) {
-        for (const task of dag.tasks)
-            task.status = task.status ?? 'PENDING';
-        return;
-    }
-    const raw = (await fs.readJson(stateFile));
-    const data = isPersistedState(raw) ? raw : null;
+    const data = await readPersistedState(stateFile);
     for (const task of dag.tasks) {
         const persisted = data?.tasks?.[task.id];
         if (persisted) {
@@ -42,6 +48,7 @@ export async function loadAndApplyState(dag, stateFile) {
  * Write the current `dag` runtime state to disk.
  */
 export async function saveState(dag, stateFile) {
+    const existing = await readPersistedState(stateFile);
     const tasks = {};
     for (const t of dag.tasks) {
         tasks[t.id] = {
@@ -50,6 +57,7 @@ export async function saveState(dag, stateFile) {
             error: t.error,
             tokens: t.tokens,
             duration: t.duration,
+            attempts: existing?.tasks?.[t.id]?.attempts,
         };
     }
     const payload = {
@@ -60,6 +68,29 @@ export async function saveState(dag, stateFile) {
     await fs.ensureDir(path.dirname(stateFile));
     await fs.writeJson(stateFile, payload, { spaces: 2 });
 }
+/** Return persisted attempts for a task (missing ⇒ []). */
+export async function getAttempts(cwd, taskId, stateFile = path.join(cwd, DEFAULT_STATE_PATH)) {
+    const data = await readPersistedState(stateFile);
+    return data?.tasks?.[taskId]?.attempts ?? [];
+}
+/** Append an attempt with monotonic `n` and persist to state.json. */
+export async function appendAttempt(cwd, taskId, attempt, stateFile = path.join(cwd, DEFAULT_STATE_PATH)) {
+    const data = (await readPersistedState(stateFile)) ?? emptyPersistedState();
+    const prev = data.tasks[taskId] ?? { status: 'PENDING' };
+    const attempts = [...(prev.attempts ?? [])];
+    const record = {
+        ...attempt,
+        n: attempts.length + 1,
+    };
+    data.tasks[taskId] = {
+        ...prev,
+        attempts: [...attempts, record],
+    };
+    data.updatedAt = new Date().toISOString();
+    await fs.ensureDir(path.dirname(stateFile));
+    await fs.writeJson(stateFile, data, { spaces: 2 });
+    return record;
+}
 function isPersistedState(value) {
     return (typeof value === 'object' &&
         value !== null &&

package/dist/dag-runner/state-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../../src/dag-runner/state-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,UAAU,CAAC;AAiB1B,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAQ,EAAE,SAAiB;IACjE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAA6B,CAAC;IACvE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;YAC7B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;QACzC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,SAAiB;IACzD,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC1B,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAmB;QAC9B,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK;KACN,CAAC;IACF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,IAAI,KAAK;QAChB,OAAQ,KAA4B,CAAC,KAAK,KAAK,QAAQ,CACxD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../../src/dag-runner/state-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,UAAU,CAAC;AAmB1B,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AAEnE,KAAK,UAAU,kBAAkB,CAC/B,SAAiB;IAEjB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY,CAAC;IACtD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,EAAE;KACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAQ,EAAE,SAAiB;IACjE,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;YAC7B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;QACzC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,SAAiB;IACzD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC1B,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ;SAC5C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAmB;QAC9B,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK;KACN,CAAC;IACF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,MAAc,EACd,YAAoB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC;IAEtD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,MAAc,EACd,OAAiC,EACjC,YAAoB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC;IAEtD,MAAM,IAAI,GAAG,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC,IAAI,mBAAmB,EAAE,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAuB,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAkB;QAC5B,GAAG,OAAO;QACV,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;KACvB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;QACnB,GAAG,IAAI;QACP,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC;KAChC,CAAC;IACF,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,IAAI,KAAK;QAChB,OAAQ,KAA4B,CAAC,KAAK,KAAK,QAAQ,CACxD,CAAC;AACJ,CAAC"}

package/dist/exec/npm-invoke.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Invoke npm via node + npm-cli.js (RS-06: argv spawn, no .cmd wrapper on Windows).
+ */
+export declare function npmInvoke(subargs: string[]): {
+    command: string;
+    args: string[];
+};
+//# sourceMappingURL=npm-invoke.d.ts.map

package/dist/exec/npm-invoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-invoke.d.ts","sourceRoot":"","sources":["../../src/exec/npm-invoke.ts"],"names":[],"mappings":"AAoBA;;GAEG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EAAE,GAChB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CA2BrC"}

package/dist/exec/npm-invoke.js

@@ -0,0 +1,45 @@
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import fs from 'fs-extra';
+function findNpmOnPath() {
+    const pathKey = process.platform === 'win32' ? 'Path' : 'PATH';
+    for (const dir of (process.env[pathKey] ?? '').split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const nodeBin = path.join(dir, process.platform === 'win32' ? 'node.exe' : 'node');
+        const npmCli = path.join(dir, 'node_modules', 'npm', 'bin', 'npm-cli.js');
+        if (fs.existsSync(nodeBin) && fs.existsSync(npmCli)) {
+            return { npmCli, nodeBin };
+        }
+    }
+    return undefined;
+}
+/**
+ * Invoke npm via node + npm-cli.js (RS-06: argv spawn, no .cmd wrapper on Windows).
+ */
+export function npmInvoke(subargs) {
+    const fromPath = findNpmOnPath();
+    if (fromPath) {
+        return {
+            command: fromPath.nodeBin,
+            args: [fromPath.npmCli, ...subargs],
+        };
+    }
+    const require = createRequire(import.meta.url);
+    try {
+        const npmCli = require.resolve('npm/bin/npm-cli.js');
+        const nodeRoot = path.resolve(path.dirname(npmCli), '..', '..', '..');
+        const nodeBin = path.join(nodeRoot, process.platform === 'win32' ? 'node.exe' : 'node');
+        return {
+            command: fs.existsSync(nodeBin) ? nodeBin : process.execPath,
+            args: [npmCli, ...subargs],
+        };
+    }
+    catch {
+        return {
+            command: process.platform === 'win32' ? 'npm.cmd' : 'npm',
+            args: subargs,
+        };
+    }
+}
+//# sourceMappingURL=npm-invoke.js.map

package/dist/exec/npm-invoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-invoke.js","sourceRoot":"","sources":["../../src/exec/npm-invoke.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,UAAU,CAAC;AAE1B,SAAS,aAAa;IACpB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,GAAG,EACH,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CACnD,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC1E,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CACvB,OAAiB;IAEjB,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC;SACpC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,QAAQ,EACR,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CACnD,CAAC;QACF,OAAO;YACL,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ;YAC5D,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC;SAC3B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;YACzD,IAAI,EAAE,OAAO;SACd,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/exec/safe-spawn.d.ts

@@ -0,0 +1,21 @@
+export interface SafeSpawnResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+}
+export interface SafeSpawnOptions {
+    cwd: string;
+    timeoutSeconds: number;
+    maxChars?: number;
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * Remove env vars that look like secrets before passing to child processes (RS-02).
+ */
+export declare function sanitizeEnv(base: NodeJS.ProcessEnv | undefined): NodeJS.ProcessEnv;
+/**
+ * Spawn with argv (shell:false), sanitized env, timeout and capped output (RS-06).
+ */
+export declare function safeSpawn(command: string, args: ReadonlyArray<string>, opts: SafeSpawnOptions): Promise<SafeSpawnResult>;
+//# sourceMappingURL=safe-spawn.d.ts.map

package/dist/exec/safe-spawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-spawn.d.ts","sourceRoot":"","sources":["../../src/exec/safe-spawn.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAkCD;;GAEG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,GAClC,MAAM,CAAC,UAAU,CAanB;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,eAAe,CAAC,CAgE1B"}

package/dist/exec/safe-spawn.js

@@ -0,0 +1,108 @@
+import { spawn } from 'node:child_process';
+const DEFAULT_MAX_CHARS = 4000;
+const SECRET_KEY_PATTERN = /(SECRET|TOKEN|KEY|PASSWORD|CREDENTIAL|API_KEY|AUTH|PRIVATE)/i;
+const ENV_ALLOWLIST = new Set([
+    'PATH',
+    'PATHEXT',
+    'HOME',
+    'USERPROFILE',
+    'HOMEDRIVE',
+    'HOMEPATH',
+    'SYSTEMROOT',
+    'WINDIR',
+    'COMSPEC',
+    'APPDATA',
+    'LOCALAPPDATA',
+    'TEMP',
+    'TMP',
+    'NODE_ENV',
+    'DARE_LOG_LEVEL',
+    'SystemRoot',
+    'ProgramFiles',
+    'ProgramFiles(x86)',
+    'ProgramW6432',
+]);
+function appendCapped(buffer, chunk, max) {
+    if (buffer.length >= max)
+        return buffer;
+    return (buffer + chunk).slice(0, max);
+}
+/**
+ * Remove env vars that look like secrets before passing to child processes (RS-02).
+ */
+export function sanitizeEnv(base) {
+    const source = base ?? process.env;
+    const out = {};
+    for (const [key, value] of Object.entries(source)) {
+        if (value === undefined)
+            continue;
+        if (ENV_ALLOWLIST.has(key)) {
+            out[key] = value;
+            continue;
+        }
+        if (SECRET_KEY_PATTERN.test(key))
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Spawn with argv (shell:false), sanitized env, timeout and capped output (RS-06).
+ */
+export async function safeSpawn(command, args, opts) {
+    const maxChars = opts.maxChars ?? DEFAULT_MAX_CHARS;
+    const env = sanitizeEnv(opts.env);
+    return new Promise((resolve) => {
+        let proc;
+        try {
+            proc = spawn(command, [...args], {
+                cwd: opts.cwd,
+                shell: false,
+                env,
+            });
+        }
+        catch (err) {
+            resolve({
+                code: 1,
+                stdout: '',
+                stderr: `spawn error: ${err instanceof Error ? err.message : String(err)}`,
+                timedOut: false,
+            });
+            return;
+        }
+        let stdout = '';
+        let stderr = '';
+        let timedOut = false;
+        proc.stdout?.on('data', (chunk) => {
+            stdout = appendCapped(stdout, chunk.toString(), maxChars);
+        });
+        proc.stderr?.on('data', (chunk) => {
+            stderr = appendCapped(stderr, chunk.toString(), maxChars);
+        });
+        const timer = setTimeout(() => {
+            timedOut = true;
+            proc.kill('SIGTERM');
+            stderr = appendCapped(stderr, `\n[safe-spawn] timed out after ${opts.timeoutSeconds}s`, maxChars);
+        }, opts.timeoutSeconds * 1000);
+        proc.on('error', (err) => {
+            clearTimeout(timer);
+            resolve({
+                code: 1,
+                stdout,
+                stderr: appendCapped(stderr, `spawn error: ${err.message}`, maxChars),
+                timedOut,
+            });
+        });
+        proc.on('close', (code) => {
+            clearTimeout(timer);
+            const exitCode = code ?? 0;
+            resolve({
+                code: timedOut && exitCode === 0 ? 124 : exitCode,
+                stdout,
+                stderr,
+                timedOut,
+            });
+        });
+    });
+}
+//# sourceMappingURL=safe-spawn.js.map

package/dist/exec/safe-spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-spawn.js","sourceRoot":"","sources":["../../src/exec/safe-spawn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAgB3C,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,kBAAkB,GACtB,8DAA8D,CAAC;AAEjE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM;IACN,SAAS;IACT,MAAM;IACN,aAAa;IACb,WAAW;IACX,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,SAAS;IACT,cAAc;IACd,MAAM;IACN,KAAK;IACL,UAAU;IACV,gBAAgB;IAChB,YAAY;IACZ,cAAc;IACd,mBAAmB;IACnB,cAAc;CACf,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,GAAW;IAC9D,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,IAAmC;IAEnC,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IACnC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC3C,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAe,EACf,IAA2B,EAC3B,IAAsB;IAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACpD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,KAAK;gBACZ,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC;gBACN,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC1E,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACjD,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACjD,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,MAAM,GAAG,YAAY,CACnB,MAAM,EACN,kCAAkC,IAAI,CAAC,cAAc,GAAG,EACxD,QAAQ,CACT,CAAC;QACJ,CAAC,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;QAE/B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,IAAI,EAAE,CAAC;gBACP,MAAM;gBACN,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC;gBACrE,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC;gBACN,IAAI,EAAE,QAAQ,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ;gBACjD,MAAM;gBACN,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/graphrag/graph-rag.js

@@ -1,30 +1,30 @@
 import initSqlJs from 'sql.js';
 import path from 'path';
 import fs from 'fs-extra';
-const SCHEMA_SQL = `
-CREATE TABLE IF NOT EXISTS nodes (
-  id TEXT PRIMARY KEY,
-  type TEXT NOT NULL,
-  label TEXT NOT NULL,
-  description TEXT,
-  metadata TEXT DEFAULT '{}',
-  created_at TEXT DEFAULT (datetime('now')),
-  updated_at TEXT DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS edges (
-  id TEXT PRIMARY KEY,
-  source_id TEXT NOT NULL,
-  target_id TEXT NOT NULL,
-  type TEXT NOT NULL,
-  weight REAL DEFAULT 1.0,
-  metadata TEXT DEFAULT '{}'
-);
-
-CREATE INDEX IF NOT EXISTS idx_nodes_type ON nodes(type);
-CREATE INDEX IF NOT EXISTS idx_edges_source ON edges(source_id);
-CREATE INDEX IF NOT EXISTS idx_edges_target ON edges(target_id);
-CREATE INDEX IF NOT EXISTS idx_edges_type ON edges(type);
+const SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS nodes (
+  id TEXT PRIMARY KEY,
+  type TEXT NOT NULL,
+  label TEXT NOT NULL,
+  description TEXT,
+  metadata TEXT DEFAULT '{}',
+  created_at TEXT DEFAULT (datetime('now')),
+  updated_at TEXT DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS edges (
+  id TEXT PRIMARY KEY,
+  source_id TEXT NOT NULL,
+  target_id TEXT NOT NULL,
+  type TEXT NOT NULL,
+  weight REAL DEFAULT 1.0,
+  metadata TEXT DEFAULT '{}'
+);
+
+CREATE INDEX IF NOT EXISTS idx_nodes_type ON nodes(type);
+CREATE INDEX IF NOT EXISTS idx_edges_source ON edges(source_id);
+CREATE INDEX IF NOT EXISTS idx_edges_target ON edges(target_id);
+CREATE INDEX IF NOT EXISTS idx_edges_type ON edges(type);
 `;
 export class GraphRAG {
     constructor(dbPath) {

package/dist/graphrag/types.d.ts

@@ -1,5 +1,5 @@
-export type NodeType = 'task' | 'file' | 'schema' | 'endpoint' | 'component' | 'entity' | 'concept';
-export type EdgeType = 'depends_on' | 'implements' | 'uses' | 'references' | 'related_to' | 'contains' | 'extends';
+export type NodeType = 'task' | 'file' | 'schema' | 'endpoint' | 'component' | 'entity' | 'concept' | 'gate';
+export type EdgeType = 'depends_on' | 'implements' | 'uses' | 'references' | 'related_to' | 'contains' | 'extends' | 'verified_by';
 export interface GraphNode {
     id: string;
     type: NodeType;

package/dist/graphrag/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/graphrag/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;AACpG,MAAM,MAAM,QAAQ,GAAG,YAAY,GAAG,YAAY,GAAG,MAAM,GAAG,YAAY,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,CAAC;AAEnH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,QAAS,SAAQ,SAAS;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAClE,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAS,SAAQ,SAAS;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC3C,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;CACvC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/graphrag/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,MAAM,GACN,QAAQ,GACR,UAAU,GACV,WAAW,GACX,QAAQ,GACR,SAAS,GACT,MAAM,CAAC;AACX,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,YAAY,GACZ,MAAM,GACN,YAAY,GACZ,YAAY,GACZ,UAAU,GACV,SAAS,GACT,aAAa,CAAC;AAElB,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,QAAS,SAAQ,SAAS;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAClE,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAS,SAAQ,SAAS;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC3C,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;CACvC"}

package/dist/mcp-server/__tests__/auth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth.test.d.ts.map

package/dist/mcp-server/__tests__/auth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/auth.test.ts"],"names":[],"mappings":""}

package/dist/mcp-server/__tests__/auth.test.js

@@ -0,0 +1,72 @@
+import { describe, it, expect } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { createAuthMiddleware, redactToken, isLoopbackIp, } from '../middleware/auth.js';
+const TOKEN = 'test-secret-token-uuid';
+function appWithAuth(overrides) {
+    const app = express();
+    app.set('trust proxy', true);
+    app.use(createAuthMiddleware({
+        token: TOKEN,
+        allowLoopbackWithoutToken: overrides?.allowLoopbackWithoutToken ?? true,
+    }));
+    app.get('/protected', (_req, res) => res.json({ ok: true }));
+    return app;
+}
+describe('createAuthMiddleware', () => {
+    it('should_allow_loopback_without_token', async () => {
+        const res = await request(appWithAuth())
+            .get('/protected')
+            .set('Host', '127.0.0.1');
+        expect(res.status).toBe(200);
+        expect(res.body).toEqual({ ok: true });
+    });
+    it('should_reject_non_loopback_without_token', async () => {
+        const app = express();
+        app.set('trust proxy', true);
+        app.use((req, _res, next) => {
+            Object.defineProperty(req, 'ip', { value: '203.0.113.1', configurable: true });
+            Object.defineProperty(req.socket, 'remoteAddress', {
+                value: '203.0.113.1',
+                configurable: true,
+            });
+            next();
+        });
+        app.use(createAuthMiddleware({ token: TOKEN, allowLoopbackWithoutToken: true }));
+        app.get('/protected', (_req, res) => res.json({ ok: true }));
+        const res = await request(app).get('/protected');
+        expect(res.status).toBe(401);
+        expect(res.body).toEqual({ error: 'Unauthorized' });
+    });
+    it('should_accept_valid_bearer', async () => {
+        const res = await request(appWithAuth())
+            .get('/protected')
+            .set('Authorization', `Bearer ${TOKEN}`);
+        expect(res.status).toBe(200);
+    });
+    it('should_accept_query_token_on_loopback', async () => {
+        const res = await request(appWithAuth())
+            .get(`/protected?token=${TOKEN}`)
+            .set('Host', '127.0.0.1');
+        expect(res.status).toBe(200);
+    });
+    it('should_reject_invalid_token', async () => {
+        const res = await request(appWithAuth())
+            .get('/protected')
+            .set('Authorization', 'Bearer wrong-token');
+        expect(res.status).toBe(401);
+        expect(res.body).toEqual({ error: 'Unauthorized' });
+    });
+    it('should_redact_token_in_logs', () => {
+        expect(redactToken(TOKEN)).toBe('test...uuid');
+        expect(redactToken(TOKEN)).not.toContain(TOKEN);
+        expect(redactToken('short')).toBe('[REDACTED]');
+    });
+    it('isLoopbackIp recognizes loopback addresses', () => {
+        expect(isLoopbackIp('127.0.0.1')).toBe(true);
+        expect(isLoopbackIp('::1')).toBe(true);
+        expect(isLoopbackIp('::ffff:127.0.0.1')).toBe(true);
+        expect(isLoopbackIp('10.0.0.1')).toBe(false);
+    });
+});
+//# sourceMappingURL=auth.test.js.map

package/dist/mcp-server/__tests__/auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.js","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAM,MAAM,QAAQ,CAAC;AAClD,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,YAAY,GACb,MAAM,uBAAuB,CAAC;AAE/B,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAEvC,SAAS,WAAW,CAAC,SAAmD;IACtE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CACL,oBAAoB,CAAC;QACnB,KAAK,EAAE,KAAK;QACZ,yBAAyB,EAAE,SAAS,EAAE,yBAAyB,IAAI,IAAI;KACxE,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;aACrC,GAAG,CAAC,YAAY,CAAC;aACjB,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE;gBACjD,KAAK,EAAE,aAAa;gBACpB,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACjF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE7D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;aACrC,GAAG,CAAC,YAAY,CAAC;aACjB,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;aACrC,GAAG,CAAC,oBAAoB,KAAK,EAAE,CAAC;aAChC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;aACrC,GAAG,CAAC,YAAY,CAAC;aACjB,GAAG,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-server/__tests__/boot-config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=boot-config.test.d.ts.map

package/dist/mcp-server/__tests__/boot-config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-config.test.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/boot-config.test.ts"],"names":[],"mappings":""}

package/dist/mcp-server/__tests__/boot-config.test.js

@@ -0,0 +1,29 @@
+import { describe, it, expect } from 'vitest';
+import { redactToken } from '../middleware/auth.js';
+import { resolveMcpBindHost, resolveMcpToken, shouldWarnLanExposure, } from '../boot-config.js';
+describe('MCP boot config', () => {
+    it('defaults bind host to 127.0.0.1', () => {
+        expect(resolveMcpBindHost({})).toBe('127.0.0.1');
+    });
+    it('respects DARE_MCP_BIND override', () => {
+        expect(resolveMcpBindHost({ DARE_MCP_BIND: '0.0.0.0' })).toBe('0.0.0.0');
+    });
+    it('warns on 0.0.0.0 LAN exposure', () => {
+        expect(shouldWarnLanExposure('0.0.0.0')).toBe(true);
+        expect(shouldWarnLanExposure('127.0.0.1')).toBe(false);
+    });
+    it('boot log redaction never contains full generated token', () => {
+        const token = resolveMcpToken({});
+        const masked = redactToken(token);
+        expect(masked).not.toBe(token);
+        if (token.length > 8) {
+            expect(masked).not.toContain(token);
+        }
+    });
+    it('uses DARE_MCP_TOKEN when provided', () => {
+        const token = 'my-fixed-boot-token-value';
+        expect(resolveMcpToken({ DARE_MCP_TOKEN: token })).toBe(token);
+        expect(redactToken(token)).not.toContain(token);
+    });
+});
+//# sourceMappingURL=boot-config.test.js.map

package/dist/mcp-server/__tests__/boot-config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-config.test.js","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/boot-config.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,kBAAkB,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,KAAK,GAAG,2BAA2B,CAAC;QAC1C,MAAM,CAAC,eAAe,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-server/__tests__/error-sanitize.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=error-sanitize.test.d.ts.map

package/dist/mcp-server/__tests__/error-sanitize.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-sanitize.test.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/error-sanitize.test.ts"],"names":[],"mappings":""}

package/dist/mcp-server/__tests__/error-sanitize.test.js

@@ -0,0 +1,66 @@
+import { describe, it, expect, vi } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { createErrorHandler } from '../middleware/error-handler.js';
+import { createCorsMiddleware } from '../middleware/cors.js';
+describe('createErrorHandler', () => {
+    it('should_never_leak_absolute_paths_in_5xx_body', async () => {
+        const logger = { error: vi.fn() };
+        const app = express();
+        app.get('/boom', () => {
+            const err = new Error('failed at C:\\Users\\secret\\proj and /etc/passwd');
+            err.stack =
+                'Error: failed\n    at /home/user/app/src/index.ts:10:1';
+            throw err;
+        });
+        app.use(createErrorHandler(logger));
+        const res = await request(app).get('/boom');
+        expect(res.status).toBe(500);
+        const body = JSON.stringify(res.body);
+        expect(body).not.toMatch(/([A-Za-z]:\\|\/etc\/|\/home\/)/);
+        expect(res.body.error).toBe('Internal server error');
+        expect(res.body.success).toBe(false);
+        expect(logger.error).toHaveBeenCalled();
+    });
+    it('should_include_correlation_id', async () => {
+        const app = express();
+        app.get('/boom', () => {
+            throw new Error('kaboom');
+        });
+        app.use(createErrorHandler({ error: vi.fn() }));
+        const res = await request(app).get('/boom');
+        expect(res.status).toBe(500);
+        expect(res.body.correlationId).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i);
+    });
+});
+describe('createCorsMiddleware', () => {
+    it('should_block_unknown_origin', async () => {
+        const app = express();
+        app.use(createCorsMiddleware());
+        app.get('/x', (_req, res) => res.json({ ok: true }));
+        const res = await request(app)
+            .options('/x')
+            .set('Origin', 'https://evil.example.com');
+        expect(res.status).toBe(204);
+        expect(res.headers['access-control-allow-origin']).toBeUndefined();
+    });
+    it('should_allow_requests_without_origin', async () => {
+        const app = express();
+        app.use(createCorsMiddleware());
+        app.get('/x', (_req, res) => res.json({ ok: true }));
+        const res = await request(app).get('/x');
+        expect(res.status).toBe(200);
+        expect(res.body).toEqual({ ok: true });
+    });
+    it('should_allow_localhost_origin', async () => {
+        const app = express();
+        app.use(createCorsMiddleware());
+        app.get('/x', (_req, res) => res.json({ ok: true }));
+        const res = await request(app)
+            .get('/x')
+            .set('Origin', 'http://localhost:3000');
+        expect(res.status).toBe(200);
+        expect(res.headers['access-control-allow-origin']).toBe('http://localhost:3000');
+    });
+});
+//# sourceMappingURL=error-sanitize.test.js.map

package/dist/mcp-server/__tests__/error-sanitize.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-sanitize.test.js","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/error-sanitize.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YAC1E,GAAkC,CAAC,KAAK;gBACvC,wDAAwD,CAAC;YAC3D,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CACpC,4EAA4E,CAC7E,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,OAAO,CAAC,IAAI,CAAC;aACb,GAAG,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,GAAG,CAAC,IAAI,CAAC;aACT,GAAG,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-server/__tests__/path-confinement.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=path-confinement.test.d.ts.map

package/dist/mcp-server/__tests__/path-confinement.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-confinement.test.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/path-confinement.test.ts"],"names":[],"mappings":""}