@dewtech/dare-cli 3.3.0 → 3.4.0

package/dist/mcp-server/__tests__/auth.test.js

@@ -0,0 +1,72 @@
+import { describe, it, expect } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { createAuthMiddleware, redactToken, isLoopbackIp, } from '../middleware/auth.js';
+const TOKEN = 'test-secret-token-uuid';
+function appWithAuth(overrides) {
+    const app = express();
+    app.set('trust proxy', true);
+    app.use(createAuthMiddleware({
+        token: TOKEN,
+        allowLoopbackWithoutToken: overrides?.allowLoopbackWithoutToken ?? true,
+    }));
+    app.get('/protected', (_req, res) => res.json({ ok: true }));
+    return app;
+}
+describe('createAuthMiddleware', () => {
+    it('should_allow_loopback_without_token', async () => {
+        const res = await request(appWithAuth())
+            .get('/protected')
+            .set('Host', '127.0.0.1');
+        expect(res.status).toBe(200);
+        expect(res.body).toEqual({ ok: true });
+    });
+    it('should_reject_non_loopback_without_token', async () => {
+        const app = express();
+        app.set('trust proxy', true);
+        app.use((req, _res, next) => {
+            Object.defineProperty(req, 'ip', { value: '203.0.113.1', configurable: true });
+            Object.defineProperty(req.socket, 'remoteAddress', {
+                value: '203.0.113.1',
+                configurable: true,
+            });
+            next();
+        });
+        app.use(createAuthMiddleware({ token: TOKEN, allowLoopbackWithoutToken: true }));
+        app.get('/protected', (_req, res) => res.json({ ok: true }));
+        const res = await request(app).get('/protected');
+        expect(res.status).toBe(401);
+        expect(res.body).toEqual({ error: 'Unauthorized' });
+    });
+    it('should_accept_valid_bearer', async () => {
+        const res = await request(appWithAuth())
+            .get('/protected')
+            .set('Authorization', `Bearer ${TOKEN}`);
+        expect(res.status).toBe(200);
+    });
+    it('should_accept_query_token_on_loopback', async () => {
+        const res = await request(appWithAuth())
+            .get(`/protected?token=${TOKEN}`)
+            .set('Host', '127.0.0.1');
+        expect(res.status).toBe(200);
+    });
+    it('should_reject_invalid_token', async () => {
+        const res = await request(appWithAuth())
+            .get('/protected')
+            .set('Authorization', 'Bearer wrong-token');
+        expect(res.status).toBe(401);
+        expect(res.body).toEqual({ error: 'Unauthorized' });
+    });
+    it('should_redact_token_in_logs', () => {
+        expect(redactToken(TOKEN)).toBe('test...uuid');
+        expect(redactToken(TOKEN)).not.toContain(TOKEN);
+        expect(redactToken('short')).toBe('[REDACTED]');
+    });
+    it('isLoopbackIp recognizes loopback addresses', () => {
+        expect(isLoopbackIp('127.0.0.1')).toBe(true);
+        expect(isLoopbackIp('::1')).toBe(true);
+        expect(isLoopbackIp('::ffff:127.0.0.1')).toBe(true);
+        expect(isLoopbackIp('10.0.0.1')).toBe(false);
+    });
+});
+//# sourceMappingURL=auth.test.js.map

package/dist/mcp-server/__tests__/auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.js","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAM,MAAM,QAAQ,CAAC;AAClD,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,YAAY,GACb,MAAM,uBAAuB,CAAC;AAE/B,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAEvC,SAAS,WAAW,CAAC,SAAmD;IACtE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CACL,oBAAoB,CAAC;QACnB,KAAK,EAAE,KAAK;QACZ,yBAAyB,EAAE,SAAS,EAAE,yBAAyB,IAAI,IAAI;KACxE,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;aACrC,GAAG,CAAC,YAAY,CAAC;aACjB,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE;gBACjD,KAAK,EAAE,aAAa;gBACpB,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACjF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE7D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;aACrC,GAAG,CAAC,YAAY,CAAC;aACjB,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;aACrC,GAAG,CAAC,oBAAoB,KAAK,EAAE,CAAC;aAChC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;aACrC,GAAG,CAAC,YAAY,CAAC;aACjB,GAAG,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-server/__tests__/boot-config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=boot-config.test.d.ts.map

package/dist/mcp-server/__tests__/boot-config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-config.test.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/boot-config.test.ts"],"names":[],"mappings":""}

package/dist/mcp-server/__tests__/boot-config.test.js

@@ -0,0 +1,29 @@
+import { describe, it, expect } from 'vitest';
+import { redactToken } from '../middleware/auth.js';
+import { resolveMcpBindHost, resolveMcpToken, shouldWarnLanExposure, } from '../boot-config.js';
+describe('MCP boot config', () => {
+    it('defaults bind host to 127.0.0.1', () => {
+        expect(resolveMcpBindHost({})).toBe('127.0.0.1');
+    });
+    it('respects DARE_MCP_BIND override', () => {
+        expect(resolveMcpBindHost({ DARE_MCP_BIND: '0.0.0.0' })).toBe('0.0.0.0');
+    });
+    it('warns on 0.0.0.0 LAN exposure', () => {
+        expect(shouldWarnLanExposure('0.0.0.0')).toBe(true);
+        expect(shouldWarnLanExposure('127.0.0.1')).toBe(false);
+    });
+    it('boot log redaction never contains full generated token', () => {
+        const token = resolveMcpToken({});
+        const masked = redactToken(token);
+        expect(masked).not.toBe(token);
+        if (token.length > 8) {
+            expect(masked).not.toContain(token);
+        }
+    });
+    it('uses DARE_MCP_TOKEN when provided', () => {
+        const token = 'my-fixed-boot-token-value';
+        expect(resolveMcpToken({ DARE_MCP_TOKEN: token })).toBe(token);
+        expect(redactToken(token)).not.toContain(token);
+    });
+});
+//# sourceMappingURL=boot-config.test.js.map

package/dist/mcp-server/__tests__/boot-config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-config.test.js","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/boot-config.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,kBAAkB,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,KAAK,GAAG,2BAA2B,CAAC;QAC1C,MAAM,CAAC,eAAe,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-server/__tests__/error-sanitize.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=error-sanitize.test.d.ts.map

package/dist/mcp-server/__tests__/error-sanitize.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-sanitize.test.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/error-sanitize.test.ts"],"names":[],"mappings":""}

package/dist/mcp-server/__tests__/error-sanitize.test.js

@@ -0,0 +1,66 @@
+import { describe, it, expect, vi } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { createErrorHandler } from '../middleware/error-handler.js';
+import { createCorsMiddleware } from '../middleware/cors.js';
+describe('createErrorHandler', () => {
+    it('should_never_leak_absolute_paths_in_5xx_body', async () => {
+        const logger = { error: vi.fn() };
+        const app = express();
+        app.get('/boom', () => {
+            const err = new Error('failed at C:\\Users\\secret\\proj and /etc/passwd');
+            err.stack =
+                'Error: failed\n    at /home/user/app/src/index.ts:10:1';
+            throw err;
+        });
+        app.use(createErrorHandler(logger));
+        const res = await request(app).get('/boom');
+        expect(res.status).toBe(500);
+        const body = JSON.stringify(res.body);
+        expect(body).not.toMatch(/([A-Za-z]:\\|\/etc\/|\/home\/)/);
+        expect(res.body.error).toBe('Internal server error');
+        expect(res.body.success).toBe(false);
+        expect(logger.error).toHaveBeenCalled();
+    });
+    it('should_include_correlation_id', async () => {
+        const app = express();
+        app.get('/boom', () => {
+            throw new Error('kaboom');
+        });
+        app.use(createErrorHandler({ error: vi.fn() }));
+        const res = await request(app).get('/boom');
+        expect(res.status).toBe(500);
+        expect(res.body.correlationId).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i);
+    });
+});
+describe('createCorsMiddleware', () => {
+    it('should_block_unknown_origin', async () => {
+        const app = express();
+        app.use(createCorsMiddleware());
+        app.get('/x', (_req, res) => res.json({ ok: true }));
+        const res = await request(app)
+            .options('/x')
+            .set('Origin', 'https://evil.example.com');
+        expect(res.status).toBe(204);
+        expect(res.headers['access-control-allow-origin']).toBeUndefined();
+    });
+    it('should_allow_requests_without_origin', async () => {
+        const app = express();
+        app.use(createCorsMiddleware());
+        app.get('/x', (_req, res) => res.json({ ok: true }));
+        const res = await request(app).get('/x');
+        expect(res.status).toBe(200);
+        expect(res.body).toEqual({ ok: true });
+    });
+    it('should_allow_localhost_origin', async () => {
+        const app = express();
+        app.use(createCorsMiddleware());
+        app.get('/x', (_req, res) => res.json({ ok: true }));
+        const res = await request(app)
+            .get('/x')
+            .set('Origin', 'http://localhost:3000');
+        expect(res.status).toBe(200);
+        expect(res.headers['access-control-allow-origin']).toBe('http://localhost:3000');
+    });
+});
+//# sourceMappingURL=error-sanitize.test.js.map

package/dist/mcp-server/__tests__/error-sanitize.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-sanitize.test.js","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/error-sanitize.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YAC1E,GAAkC,CAAC,KAAK;gBACvC,wDAAwD,CAAC;YAC3D,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CACpC,4EAA4E,CAC7E,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,OAAO,CAAC,IAAI,CAAC;aACb,GAAG,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,GAAG,CAAC,IAAI,CAAC;aACT,GAAG,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-server/__tests__/path-confinement.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=path-confinement.test.d.ts.map

package/dist/mcp-server/__tests__/path-confinement.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-confinement.test.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/path-confinement.test.ts"],"names":[],"mappings":""}

package/dist/mcp-server/__tests__/path-confinement.test.js

@@ -0,0 +1,135 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'fs-extra';
+import os from 'node:os';
+import path from 'node:path';
+import request from 'supertest';
+import { createMcpServer } from '../server.js';
+const MALICIOUS_PROJECT_PATHS = [
+    '../../../etc/passwd',
+    '..\\..\\..\\windows\\system32',
+    '/etc/passwd',
+    'C:\\Windows\\System32',
+    '....//....//etc/passwd',
+    '..%2f..%2f..%2fetc%2fpasswd',
+    'DARE/../../../etc/passwd',
+    '/tmp/../../etc/passwd',
+    '\\\\?\\C:\\secret',
+    'file:///etc/passwd',
+    '....\\....\\etc\\passwd',
+    '%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd',
+    'foo/../../../bar',
+    '....//....//....//etc/passwd',
+    '..;/..;/..;/etc/passwd',
+    '.\\..\\.\\..\\.\\etc\\passwd',
+    'DARE/..\\..\\..\\secret',
+    'null\0byte',
+    'task/../../dare.config.json',
+    '/proc/self/environ',
+    'http://evil.com/../../../etc/passwd',
+    'zip://../../etc/passwd',
+    '~/.ssh/id_rsa',
+    '$HOME/../../etc/passwd',
+];
+const INVALID_TASK_IDS = [
+    '../../../etc/passwd',
+    '..%2F..%2Fetc%2Fpasswd',
+    'task-../escape',
+    'not-a-task',
+    'task-',
+    'TASK-001',
+    'task-001/extra',
+    'task-001/../../../secret',
+    '%2e%2e%2fsecret',
+];
+describe('MCP path confinement', () => {
+    let projectRoot;
+    let outsideSecret;
+    beforeEach(async () => {
+        projectRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'mcp-confine-'));
+        outsideSecret = path.join(path.dirname(projectRoot), `outside-secret-${Date.now()}.txt`);
+        await fs.writeFile(outsideSecret, 'OUTSIDE_SECRET_DATA');
+        await fs.ensureDir(path.join(projectRoot, 'DARE'));
+        await fs.writeFile(path.join(projectRoot, 'DARE', 'TASKS.md'), '| task-001 | demo | ⏳ PENDING |\n| task-abc-extra | other | ✅ DONE |');
+        await fs.writeFile(path.join(projectRoot, 'DARE', 'BLUEPRINT.md'), '# Architecture\nsecurity hardening\n');
+        await fs.writeFile(path.join(projectRoot, 'DARE', 'dare-dag.yaml'), 'tasks:\n  - id: task-001\n');
+        await fs.writeJson(path.join(projectRoot, 'dare.config.json'), { name: 'confine-test' });
+    });
+    afterEach(async () => {
+        await fs.remove(projectRoot).catch(() => undefined);
+        await fs.remove(outsideSecret).catch(() => undefined);
+    });
+    function app() {
+        return createMcpServer(projectRoot, { authToken: 'confine-test-token' });
+    }
+    function assertNoLeak(body) {
+        const serialized = JSON.stringify(body);
+        expect(serialized).not.toContain('OUTSIDE_SECRET_DATA');
+        expect(serialized).not.toMatch(/[A-Za-z]:\\Users\\/);
+        expect(serialized).not.toMatch(/\/etc\/passwd/);
+        expect(serialized).not.toContain(projectRoot);
+    }
+    for (const malicious of MALICIOUS_PROJECT_PATHS) {
+        it(`ignores malicious projectPath in context/query: ${malicious.slice(0, 40)}`, async () => {
+            const res = await request(app())
+                .post('/context/query')
+                .send({ type: 'task', query: 'task-001', projectPath: malicious });
+            expect([200, 400]).toContain(res.status);
+            assertNoLeak(res.body);
+            if (res.status === 200) {
+                expect(res.body.success).toBe(true);
+            }
+        });
+    }
+    it('health returns basename only, never absolute project root', async () => {
+        const res = await request(app()).get('/health');
+        expect(res.status).toBe(200);
+        expect(res.body.projectRoot).toBe(path.basename(projectRoot));
+        expect(res.body.projectRoot).not.toBe(projectRoot);
+        assertNoLeak(res.body);
+    });
+    it('rejects empty query with 400', async () => {
+        const res = await request(app())
+            .post('/context/query')
+            .send({ type: 'task', query: '' });
+        expect(res.status).toBe(400);
+        expect(res.body).toEqual({ error: 'query is required' });
+    });
+    it('rejects invalid context type with 400', async () => {
+        const res = await request(app())
+            .post('/context/query')
+            .send({ type: 'evil', query: 'x' });
+        expect(res.status).toBe(400);
+        expect(res.body).toEqual({ error: 'invalid context type' });
+    });
+    for (const taskId of INVALID_TASK_IDS) {
+        it(`rejects invalid task id GET /tasks/${taskId.slice(0, 30)}`, async () => {
+            const res = await request(app()).get(`/tasks/${encodeURIComponent(taskId)}`);
+            expect(res.status).toBe(400);
+            expect(res.body).toEqual({ error: 'invalid task id' });
+            assertNoLeak(res.body);
+        });
+    }
+    it('accepts valid task-001 id', async () => {
+        const res = await request(app()).get('/tasks/task-001');
+        expect(res.status).toBe(200);
+        expect(res.body.id).toBe('task-001');
+    });
+    it('accepts valid task-abc-extra id', async () => {
+        const res = await request(app()).get('/tasks/task-abc-extra');
+        expect(res.status).toBe(200);
+        expect(res.body.id).toBe('task-abc-extra');
+    });
+    it('blueprint reads only under project DARE/', async () => {
+        const res = await request(app()).get('/blueprint');
+        expect(res.status).toBe(200);
+        expect(res.body.content).toContain('Architecture');
+        assertNoLeak(res.body);
+    });
+    it('project config reads only dare.config.json under root', async () => {
+        const res = await request(app()).get('/project');
+        expect(res.status).toBe(200);
+        expect(res.body.name).toBe('confine-test');
+        assertNoLeak(res.body);
+    });
+});
+//# sourceMappingURL=path-confinement.test.js.map

package/dist/mcp-server/__tests__/path-confinement.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-confinement.test.js","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/path-confinement.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,uBAAuB,GAAG;IAC9B,qBAAqB;IACrB,+BAA+B;IAC/B,aAAa;IACb,uBAAuB;IACvB,wBAAwB;IACxB,6BAA6B;IAC7B,0BAA0B;IAC1B,uBAAuB;IACvB,mBAAmB;IACnB,oBAAoB;IACpB,yBAAyB;IACzB,yCAAyC;IACzC,kBAAkB;IAClB,8BAA8B;IAC9B,wBAAwB;IACxB,8BAA8B;IAC9B,yBAAyB;IACzB,YAAY;IACZ,6BAA6B;IAC7B,oBAAoB;IACpB,qCAAqC;IACrC,wBAAwB;IACxB,eAAe;IACf,wBAAwB;CACzB,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,qBAAqB;IACrB,wBAAwB;IACxB,gBAAgB;IAChB,YAAY;IACZ,OAAO;IACP,UAAU;IACV,gBAAgB;IAChB,0BAA0B;IAC1B,iBAAiB;CAClB,CAAC;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,IAAI,WAAmB,CAAC;IACxB,IAAI,aAAqB,CAAC;IAE1B,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACvE,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,kBAAkB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzF,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;QACzD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAC1C,sEAAsE,CACvE,CAAC;QACF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,sCAAsC,CAAC,CAAC;QAC3G,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAClG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,SAAS,GAAG;QACV,OAAO,eAAe,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,SAAS,YAAY,CAAC,IAAa;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACxD,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrD,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,uBAAuB,EAAE,CAAC;QAChD,EAAE,CAAC,mDAAmD,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;iBAC7B,IAAI,CAAC,gBAAgB,CAAC;iBACtB,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;YAErE,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnD,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;aAC7B,IAAI,CAAC,gBAAgB,CAAC;aACtB,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;aAC7B,IAAI,CAAC,gBAAgB,CAAC;aACtB,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,EAAE,CAAC,sCAAsC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACvD,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACnD,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3C,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-server/bin/server.js

@@ -1,14 +1,26 @@
 #!/usr/bin/env node
-import { createMcpServer } from '../server.js';
 import chalk from 'chalk';
-const PORT = parseInt(process.env.DARE_MCP_PORT || '3000', 10);
-const PROJECT_PATH = process.env.DARE_PROJECT_PATH || process.cwd();
-const app = createMcpServer(PROJECT_PATH);
-const server = app.listen(PORT, () => {
+import pino from 'pino';
+import { createMcpServer } from '../server.js';
+import { redactToken } from '../middleware/auth.js';
+import { resolveMcpBindHost, resolveMcpPort, resolveMcpProjectPath, resolveMcpToken, shouldWarnLanExposure, } from '../boot-config.js';
+const logger = pino({ transport: { target: 'pino-pretty' } });
+const PORT = resolveMcpPort();
+const HOST = resolveMcpBindHost();
+const PROJECT_PATH = resolveMcpProjectPath();
+const TOKEN = resolveMcpToken();
+if (shouldWarnLanExposure(HOST)) {
+    logger.warn('DARE_MCP_BIND=0.0.0.0 exposes MCP to LAN — use only in trusted networks');
+}
+const app = createMcpServer(PROJECT_PATH, { authToken: TOKEN });
+const server = app.listen(PORT, HOST, () => {
+    const maskedToken = redactToken(TOKEN);
     console.log(chalk.blue.bold('\n🔌 DARE MCP Server\n'));
     console.log(`  ${chalk.gray('Status:')}  ${chalk.green('Running')}`);
-    console.log(`  ${chalk.gray('Port:')}    ${chalk.cyan(PORT)}`);
+    console.log(`  ${chalk.gray('Host:')}    ${chalk.cyan(HOST)}`);
+    console.log(`  ${chalk.gray('Port:')}    ${chalk.cyan(String(PORT))}`);
     console.log(`  ${chalk.gray('Project:')} ${chalk.cyan(PROJECT_PATH)}`);
+    console.log(`  ${chalk.gray('Token:')}   ${chalk.yellow(maskedToken)}`);
     console.log(`\n  ${chalk.gray('Endpoints:')}`);
     console.log(`  ${chalk.cyan('GET')}  /health`);
     console.log(`  ${chalk.cyan('GET')}  /tools`);

package/dist/mcp-server/bin/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/mcp-server/bin/server.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AAEpE,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;AAE1C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;IACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/mcp-server/bin/server.ts"],"names":[],"mappings":";AAEA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;AAE9D,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;AAC9B,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;AAClC,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;AAC7C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;AAEhC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;IAChC,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAEhE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;IACzC,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC"}

package/dist/mcp-server/boot-config.d.ts

@@ -0,0 +1,6 @@
+export declare function resolveMcpBindHost(env?: NodeJS.ProcessEnv): string;
+export declare function resolveMcpPort(env?: NodeJS.ProcessEnv): number;
+export declare function resolveMcpProjectPath(env?: NodeJS.ProcessEnv): string;
+export declare function resolveMcpToken(env?: NodeJS.ProcessEnv): string;
+export declare function shouldWarnLanExposure(host: string): boolean;
+//# sourceMappingURL=boot-config.d.ts.map

package/dist/mcp-server/boot-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-config.d.ts","sourceRoot":"","sources":["../../src/mcp-server/boot-config.ts"],"names":[],"mappings":"AAEA,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE3E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAElF;AAED,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE5E;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D"}

package/dist/mcp-server/boot-config.js

@@ -0,0 +1,17 @@
+import { randomUUID } from 'node:crypto';
+export function resolveMcpBindHost(env = process.env) {
+    return env.DARE_MCP_BIND ?? '127.0.0.1';
+}
+export function resolveMcpPort(env = process.env) {
+    return parseInt(env.DARE_MCP_PORT || '3000', 10);
+}
+export function resolveMcpProjectPath(env = process.env) {
+    return env.DARE_PROJECT_PATH || process.cwd();
+}
+export function resolveMcpToken(env = process.env) {
+    return env.DARE_MCP_TOKEN ?? randomUUID();
+}
+export function shouldWarnLanExposure(host) {
+    return host === '0.0.0.0';
+}
+//# sourceMappingURL=boot-config.js.map

package/dist/mcp-server/boot-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-config.js","sourceRoot":"","sources":["../../src/mcp-server/boot-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,GAAG,CAAC,aAAa,IAAI,WAAW,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO,QAAQ,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxE,OAAO,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,GAAG,CAAC,cAAc,IAAI,UAAU,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,IAAI,KAAK,SAAS,CAAC;AAC5B,CAAC"}

package/dist/mcp-server/middleware/auth.d.ts

@@ -0,0 +1,10 @@
+import type { RequestHandler } from 'express';
+export interface McpAuthOptions {
+    readonly token: string;
+    readonly allowLoopbackWithoutToken?: boolean;
+}
+/** Mask token for logs — never log the full secret (RF-14). */
+export declare function redactToken(token: string): string;
+export declare function isLoopbackIp(ip: string | undefined): boolean;
+export declare function createAuthMiddleware(opts: McpAuthOptions): RequestHandler;
+//# sourceMappingURL=auth.d.ts.map

package/dist/mcp-server/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,cAAc,EAAE,MAAM,SAAS,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;CAC9C;AAED,+DAA+D;AAC/D,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD;AAMD,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAI5D;AAiBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAezE"}

package/dist/mcp-server/middleware/auth.js

@@ -0,0 +1,44 @@
+/** Mask token for logs — never log the full secret (RF-14). */
+export function redactToken(token) {
+    if (token.length <= 8)
+        return '[REDACTED]';
+    return `${token.slice(0, 4)}...${token.slice(-4)}`;
+}
+function normalizeIp(ip) {
+    return ip.replace(/^::ffff:/, '');
+}
+export function isLoopbackIp(ip) {
+    if (!ip)
+        return false;
+    const n = normalizeIp(ip);
+    return n === '127.0.0.1' || n === '::1';
+}
+function isLoopbackRequest(req) {
+    return isLoopbackIp(req.ip) || isLoopbackIp(req.socket.remoteAddress ?? undefined);
+}
+function extractToken(req) {
+    const auth = req.headers.authorization;
+    if (typeof auth === 'string' && auth.startsWith('Bearer ')) {
+        return auth.slice('Bearer '.length).trim();
+    }
+    if (isLoopbackRequest(req) && typeof req.query.token === 'string') {
+        return req.query.token;
+    }
+    return undefined;
+}
+export function createAuthMiddleware(opts) {
+    const allowLoopback = opts.allowLoopbackWithoutToken ?? true;
+    return (req, res, next) => {
+        const provided = extractToken(req);
+        if (provided === opts.token) {
+            next();
+            return;
+        }
+        if (!provided && allowLoopback && isLoopbackRequest(req)) {
+            next();
+            return;
+        }
+        res.status(401).json({ error: 'Unauthorized' });
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/mcp-server/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/mcp-server/middleware/auth.ts"],"names":[],"mappings":"AAOA,+DAA+D;AAC/D,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAsB;IACjD,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IACrC,OAAO,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAClE,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAoB;IACvD,MAAM,aAAa,GAAG,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC;IAE7D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,aAAa,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC"}

package/dist/mcp-server/middleware/cors.d.ts

@@ -0,0 +1,6 @@
+import type { RequestHandler } from 'express';
+export interface McpCorsOptions {
+    readonly allowedOrigins?: ReadonlyArray<string>;
+}
+export declare function createCorsMiddleware(opts?: McpCorsOptions): RequestHandler;
+//# sourceMappingURL=cors.d.ts.map

package/dist/mcp-server/middleware/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACjD;AAcD,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAyB1E"}

package/dist/mcp-server/middleware/cors.js

@@ -0,0 +1,30 @@
+const DEFAULT_PATTERNS = ['http://127.0.0.1:*', 'http://localhost:*'];
+function originMatchesPattern(origin, pattern) {
+    if (!pattern.includes('*'))
+        return origin === pattern;
+    const [prefix] = pattern.split('*');
+    return origin.startsWith(prefix);
+}
+function isOriginAllowed(origin, patterns) {
+    return patterns.some((p) => originMatchesPattern(origin, p));
+}
+export function createCorsMiddleware(opts) {
+    const patterns = opts?.allowedOrigins ?? DEFAULT_PATTERNS;
+    return (req, res, next) => {
+        const origin = req.headers.origin;
+        if (origin && isOriginAllowed(origin, patterns)) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
+            res.setHeader('Vary', 'Origin');
+        }
+        if (req.method === 'OPTIONS') {
+            if (origin && isOriginAllowed(origin, patterns)) {
+                res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+                res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+            }
+            res.status(204).end();
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=cors.js.map

package/dist/mcp-server/middleware/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/mcp-server/middleware/cors.ts"],"names":[],"mappings":"AAMA,MAAM,gBAAgB,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;AAEtE,SAAS,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAC3D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,QAA+B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,MAAM,QAAQ,GAAG,IAAI,EAAE,cAAc,IAAI,gBAAgB,CAAC;IAE1D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAElC,IAAI,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,iCAAiC,CAAC,CAAC;gBACjF,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,6BAA6B,CAC9B,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/mcp-server/middleware/error-handler.d.ts

@@ -0,0 +1,11 @@
+import type { ErrorRequestHandler } from 'express';
+export interface SanitizedErrorBody {
+    readonly success: false;
+    readonly error: string;
+    readonly correlationId: string;
+}
+export interface ErrorHandlerLogger {
+    error(obj: Record<string, unknown>, msg: string): void;
+}
+export declare function createErrorHandler(logger: ErrorHandlerLogger): ErrorRequestHandler;
+//# sourceMappingURL=error-handler.d.ts.map

package/dist/mcp-server/middleware/error-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/middleware/error-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEnD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACxD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,mBAAmB,CAclF"}

package/dist/mcp-server/middleware/error-handler.js

@@ -0,0 +1,14 @@
+import { randomUUID } from 'node:crypto';
+export function createErrorHandler(logger) {
+    return (err, req, res, _next) => {
+        const correlationId = randomUUID();
+        logger.error({ err, correlationId, route: req.path }, 'mcp request failed');
+        const body = {
+            success: false,
+            error: 'Internal server error',
+            correlationId,
+        };
+        res.status(500).json(body);
+    };
+}
+//# sourceMappingURL=error-handler.js.map

package/dist/mcp-server/middleware/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../../src/mcp-server/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAazC,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EACvC,oBAAoB,CACrB,CAAC;QACF,MAAM,IAAI,GAAuB;YAC/B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uBAAuB;YAC9B,aAAa;SACd,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC"}

package/dist/mcp-server/server.d.ts

@@ -1,8 +1,9 @@
-import { Express } from 'express';
+import { type Express } from 'express';
 export interface ContextQuery {
     type: 'file' | 'task' | 'dependency' | 'architecture' | 'schema' | 'endpoint';
     query: string;
     limit?: number;
+    /** @deprecated Ignored — server uses DARE_PROJECT_PATH / cwd only */
     projectPath?: string;
 }
 export interface ContextResult {
@@ -17,5 +18,9 @@ export interface TaskStatus {
     status: 'PENDING' | 'IN_PROGRESS' | 'DONE' | 'FAILED' | 'SKIPPED';
     updatedAt: string;
 }
-export declare function createMcpServer(projectPath?: string): Express;
+export interface McpServerOptions {
+    authToken?: string;
+    allowLoopbackWithoutToken?: boolean;
+}
+export declare function createMcpServer(projectRoot?: string, options?: McpServerOptions): Express;
 //# sourceMappingURL=server.d.ts.map