@dewtech/dare-cli 3.3.0 → 3.5.0

package/dist/mcp-server/__tests__/error-sanitize.test.js

@@ -0,0 +1,66 @@
+import { describe, it, expect, vi } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { createErrorHandler } from '../middleware/error-handler.js';
+import { createCorsMiddleware } from '../middleware/cors.js';
+describe('createErrorHandler', () => {
+    it('should_never_leak_absolute_paths_in_5xx_body', async () => {
+        const logger = { error: vi.fn() };
+        const app = express();
+        app.get('/boom', () => {
+            const err = new Error('failed at C:\\Users\\secret\\proj and /etc/passwd');
+            err.stack =
+                'Error: failed\n    at /home/user/app/src/index.ts:10:1';
+            throw err;
+        });
+        app.use(createErrorHandler(logger));
+        const res = await request(app).get('/boom');
+        expect(res.status).toBe(500);
+        const body = JSON.stringify(res.body);
+        expect(body).not.toMatch(/([A-Za-z]:\\|\/etc\/|\/home\/)/);
+        expect(res.body.error).toBe('Internal server error');
+        expect(res.body.success).toBe(false);
+        expect(logger.error).toHaveBeenCalled();
+    });
+    it('should_include_correlation_id', async () => {
+        const app = express();
+        app.get('/boom', () => {
+            throw new Error('kaboom');
+        });
+        app.use(createErrorHandler({ error: vi.fn() }));
+        const res = await request(app).get('/boom');
+        expect(res.status).toBe(500);
+        expect(res.body.correlationId).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i);
+    });
+});
+describe('createCorsMiddleware', () => {
+    it('should_block_unknown_origin', async () => {
+        const app = express();
+        app.use(createCorsMiddleware());
+        app.get('/x', (_req, res) => res.json({ ok: true }));
+        const res = await request(app)
+            .options('/x')
+            .set('Origin', 'https://evil.example.com');
+        expect(res.status).toBe(204);
+        expect(res.headers['access-control-allow-origin']).toBeUndefined();
+    });
+    it('should_allow_requests_without_origin', async () => {
+        const app = express();
+        app.use(createCorsMiddleware());
+        app.get('/x', (_req, res) => res.json({ ok: true }));
+        const res = await request(app).get('/x');
+        expect(res.status).toBe(200);
+        expect(res.body).toEqual({ ok: true });
+    });
+    it('should_allow_localhost_origin', async () => {
+        const app = express();
+        app.use(createCorsMiddleware());
+        app.get('/x', (_req, res) => res.json({ ok: true }));
+        const res = await request(app)
+            .get('/x')
+            .set('Origin', 'http://localhost:3000');
+        expect(res.status).toBe(200);
+        expect(res.headers['access-control-allow-origin']).toBe('http://localhost:3000');
+    });
+});
+//# sourceMappingURL=error-sanitize.test.js.map

package/dist/mcp-server/__tests__/error-sanitize.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-sanitize.test.js","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/error-sanitize.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YAC1E,GAAkC,CAAC,KAAK;gBACvC,wDAAwD,CAAC;YAC3D,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CACpC,4EAA4E,CAC7E,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,OAAO,CAAC,IAAI,CAAC;aACb,GAAG,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,GAAG,CAAC,IAAI,CAAC;aACT,GAAG,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-server/__tests__/mcp-graph.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcp-graph.test.d.ts.map

package/dist/mcp-server/__tests__/mcp-graph.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-graph.test.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/mcp-graph.test.ts"],"names":[],"mappings":""}

package/dist/mcp-server/__tests__/mcp-graph.test.js

@@ -0,0 +1,85 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'fs-extra';
+import os from 'node:os';
+import path from 'node:path';
+import request from 'supertest';
+import { createMcpServer } from '../server.js';
+import { buildGraphFromFixture, loadFixture } from '../../__tests__/graphrag/fixtures/dual-graph/build-fixture-graph.js';
+import { JsonGraph } from '../../graphrag/json-graph.js';
+describe('MCP graph tools', () => {
+    let projectRoot;
+    beforeEach(async () => {
+        projectRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'mcp-graph-'));
+        await fs.ensureDir(path.join(projectRoot, 'DARE'));
+        await fs.writeJson(path.join(projectRoot, 'dare.config.json'), { name: 'mcp-graph-test' });
+        await fs.writeFile(path.join(projectRoot, 'dare-graph.yml'), 'backend: json\njson:\n  path: .dare/graph.json\n');
+        const graphPath = path.join(projectRoot, '.dare', 'graph.json');
+        const graph = new JsonGraph(graphPath);
+        await graph.init();
+        buildGraphFromFixture(graph, loadFixture('impact-chain'));
+        graph.close();
+    });
+    afterEach(async () => {
+        await fs.remove(projectRoot).catch(() => undefined);
+    });
+    function app() {
+        return createMcpServer(projectRoot, { allowLoopbackWithoutToken: true });
+    }
+    it('lists graph tools in GET /tools', async () => {
+        const res = await request(app()).get('/tools');
+        const names = res.body.tools.map((t) => t.name);
+        expect(names).toContain('graph_locate');
+        expect(names).toContain('graph_map_requirement');
+        expect(names).toContain('graph_traverse');
+    });
+    it('POST /graph/locate returns candidates', async () => {
+        const res = await request(app())
+            .post('/graph/locate')
+            .send({ seed: 'math', hops: 3, limit: 5 });
+        expect(res.status).toBe(200);
+        expect(res.body.success).toBe(true);
+        expect(res.body.candidates.length).toBeGreaterThan(0);
+    });
+    it('POST /graph/locate rejects missing seed', async () => {
+        const res = await request(app()).post('/graph/locate').send({});
+        expect(res.status).toBe(400);
+        expect(res.body.error).toBe('seed is required');
+    });
+    it('POST /graph/locate rejects path escape', async () => {
+        const res = await request(app()).post('/graph/locate').send({ seed: '../etc/passwd' });
+        expect(res.status).toBe(403);
+    });
+    it('POST /graph/map-requirement maps RF-03', async () => {
+        const res = await request(app()).post('/graph/map-requirement').send({ reqId: 'RF-03' });
+        expect(res.status).toBe(200);
+        expect(res.body.success).toBe(true);
+        expect(res.body.symbols).toContain('src/math.ts::add');
+        expect(res.body.tasks).toContain('task-201');
+    });
+    it('POST /graph/map-requirement rejects invalid reqId', async () => {
+        const res = await request(app()).post('/graph/map-requirement').send({ reqId: 'BAD' });
+        expect(res.status).toBe(400);
+        expect(res.body.error).toBe('invalid reqId');
+    });
+    it('POST /graph/traverse returns nodes and edges', async () => {
+        const res = await request(app()).post('/graph/traverse').send({
+            seedNodeIds: ['requirement:RF-03'],
+            maxHops: 3,
+            edgeTypes: ['depends_on', 'implements', 'affects'],
+        });
+        expect(res.status).toBe(200);
+        expect(res.body.success).toBe(true);
+        expect(res.body.nodes.length).toBeGreaterThan(0);
+    });
+    it('POST /graph/traverse requires seedNodeIds', async () => {
+        const res = await request(app()).post('/graph/traverse').send({});
+        expect(res.status).toBe(400);
+        expect(res.body.error).toBe('seedNodeIds is required');
+    });
+    it('deterministic locate responses', async () => {
+        const a = await request(app()).post('/graph/locate').send({ seed: 'math' });
+        const b = await request(app()).post('/graph/locate').send({ seed: 'math' });
+        expect(a.body).toEqual(b.body);
+    });
+});
+//# sourceMappingURL=mcp-graph.test.js.map

package/dist/mcp-server/__tests__/mcp-graph.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-graph.test.js","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/mcp-graph.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,qEAAqE,CAAC;AACzH,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,IAAI,WAAmB,CAAC;IAExB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3F,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EACxC,kDAAkD,CACnD,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,qBAAqB,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1D,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,SAAS,GAAG;QACV,OAAO,eAAe,CAAC,WAAW,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAI,GAAG,CAAC,IAAI,CAAC,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;aAC7B,IAAI,CAAC,eAAe,CAAC;aACrB,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC;YAC5D,WAAW,EAAE,CAAC,mBAAmB,CAAC;YAClC,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-server/__tests__/path-confinement.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=path-confinement.test.d.ts.map

package/dist/mcp-server/__tests__/path-confinement.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-confinement.test.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/path-confinement.test.ts"],"names":[],"mappings":""}

package/dist/mcp-server/__tests__/path-confinement.test.js

@@ -0,0 +1,135 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'fs-extra';
+import os from 'node:os';
+import path from 'node:path';
+import request from 'supertest';
+import { createMcpServer } from '../server.js';
+const MALICIOUS_PROJECT_PATHS = [
+    '../../../etc/passwd',
+    '..\\..\\..\\windows\\system32',
+    '/etc/passwd',
+    'C:\\Windows\\System32',
+    '....//....//etc/passwd',
+    '..%2f..%2f..%2fetc%2fpasswd',
+    'DARE/../../../etc/passwd',
+    '/tmp/../../etc/passwd',
+    '\\\\?\\C:\\secret',
+    'file:///etc/passwd',
+    '....\\....\\etc\\passwd',
+    '%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd',
+    'foo/../../../bar',
+    '....//....//....//etc/passwd',
+    '..;/..;/..;/etc/passwd',
+    '.\\..\\.\\..\\.\\etc\\passwd',
+    'DARE/..\\..\\..\\secret',
+    'null\0byte',
+    'task/../../dare.config.json',
+    '/proc/self/environ',
+    'http://evil.com/../../../etc/passwd',
+    'zip://../../etc/passwd',
+    '~/.ssh/id_rsa',
+    '$HOME/../../etc/passwd',
+];
+const INVALID_TASK_IDS = [
+    '../../../etc/passwd',
+    '..%2F..%2Fetc%2Fpasswd',
+    'task-../escape',
+    'not-a-task',
+    'task-',
+    'TASK-001',
+    'task-001/extra',
+    'task-001/../../../secret',
+    '%2e%2e%2fsecret',
+];
+describe('MCP path confinement', () => {
+    let projectRoot;
+    let outsideSecret;
+    beforeEach(async () => {
+        projectRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'mcp-confine-'));
+        outsideSecret = path.join(path.dirname(projectRoot), `outside-secret-${Date.now()}.txt`);
+        await fs.writeFile(outsideSecret, 'OUTSIDE_SECRET_DATA');
+        await fs.ensureDir(path.join(projectRoot, 'DARE'));
+        await fs.writeFile(path.join(projectRoot, 'DARE', 'TASKS.md'), '| task-001 | demo | ⏳ PENDING |\n| task-abc-extra | other | ✅ DONE |');
+        await fs.writeFile(path.join(projectRoot, 'DARE', 'BLUEPRINT.md'), '# Architecture\nsecurity hardening\n');
+        await fs.writeFile(path.join(projectRoot, 'DARE', 'dare-dag.yaml'), 'tasks:\n  - id: task-001\n');
+        await fs.writeJson(path.join(projectRoot, 'dare.config.json'), { name: 'confine-test' });
+    });
+    afterEach(async () => {
+        await fs.remove(projectRoot).catch(() => undefined);
+        await fs.remove(outsideSecret).catch(() => undefined);
+    });
+    function app() {
+        return createMcpServer(projectRoot, { authToken: 'confine-test-token' });
+    }
+    function assertNoLeak(body) {
+        const serialized = JSON.stringify(body);
+        expect(serialized).not.toContain('OUTSIDE_SECRET_DATA');
+        expect(serialized).not.toMatch(/[A-Za-z]:\\Users\\/);
+        expect(serialized).not.toMatch(/\/etc\/passwd/);
+        expect(serialized).not.toContain(projectRoot);
+    }
+    for (const malicious of MALICIOUS_PROJECT_PATHS) {
+        it(`ignores malicious projectPath in context/query: ${malicious.slice(0, 40)}`, async () => {
+            const res = await request(app())
+                .post('/context/query')
+                .send({ type: 'task', query: 'task-001', projectPath: malicious });
+            expect([200, 400]).toContain(res.status);
+            assertNoLeak(res.body);
+            if (res.status === 200) {
+                expect(res.body.success).toBe(true);
+            }
+        });
+    }
+    it('health returns basename only, never absolute project root', async () => {
+        const res = await request(app()).get('/health');
+        expect(res.status).toBe(200);
+        expect(res.body.projectRoot).toBe(path.basename(projectRoot));
+        expect(res.body.projectRoot).not.toBe(projectRoot);
+        assertNoLeak(res.body);
+    });
+    it('rejects empty query with 400', async () => {
+        const res = await request(app())
+            .post('/context/query')
+            .send({ type: 'task', query: '' });
+        expect(res.status).toBe(400);
+        expect(res.body).toEqual({ error: 'query is required' });
+    });
+    it('rejects invalid context type with 400', async () => {
+        const res = await request(app())
+            .post('/context/query')
+            .send({ type: 'evil', query: 'x' });
+        expect(res.status).toBe(400);
+        expect(res.body).toEqual({ error: 'invalid context type' });
+    });
+    for (const taskId of INVALID_TASK_IDS) {
+        it(`rejects invalid task id GET /tasks/${taskId.slice(0, 30)}`, async () => {
+            const res = await request(app()).get(`/tasks/${encodeURIComponent(taskId)}`);
+            expect(res.status).toBe(400);
+            expect(res.body).toEqual({ error: 'invalid task id' });
+            assertNoLeak(res.body);
+        });
+    }
+    it('accepts valid task-001 id', async () => {
+        const res = await request(app()).get('/tasks/task-001');
+        expect(res.status).toBe(200);
+        expect(res.body.id).toBe('task-001');
+    });
+    it('accepts valid task-abc-extra id', async () => {
+        const res = await request(app()).get('/tasks/task-abc-extra');
+        expect(res.status).toBe(200);
+        expect(res.body.id).toBe('task-abc-extra');
+    });
+    it('blueprint reads only under project DARE/', async () => {
+        const res = await request(app()).get('/blueprint');
+        expect(res.status).toBe(200);
+        expect(res.body.content).toContain('Architecture');
+        assertNoLeak(res.body);
+    });
+    it('project config reads only dare.config.json under root', async () => {
+        const res = await request(app()).get('/project');
+        expect(res.status).toBe(200);
+        expect(res.body.name).toBe('confine-test');
+        assertNoLeak(res.body);
+    });
+});
+//# sourceMappingURL=path-confinement.test.js.map

package/dist/mcp-server/__tests__/path-confinement.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-confinement.test.js","sourceRoot":"","sources":["../../../src/mcp-server/__tests__/path-confinement.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,uBAAuB,GAAG;IAC9B,qBAAqB;IACrB,+BAA+B;IAC/B,aAAa;IACb,uBAAuB;IACvB,wBAAwB;IACxB,6BAA6B;IAC7B,0BAA0B;IAC1B,uBAAuB;IACvB,mBAAmB;IACnB,oBAAoB;IACpB,yBAAyB;IACzB,yCAAyC;IACzC,kBAAkB;IAClB,8BAA8B;IAC9B,wBAAwB;IACxB,8BAA8B;IAC9B,yBAAyB;IACzB,YAAY;IACZ,6BAA6B;IAC7B,oBAAoB;IACpB,qCAAqC;IACrC,wBAAwB;IACxB,eAAe;IACf,wBAAwB;CACzB,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,qBAAqB;IACrB,wBAAwB;IACxB,gBAAgB;IAChB,YAAY;IACZ,OAAO;IACP,UAAU;IACV,gBAAgB;IAChB,0BAA0B;IAC1B,iBAAiB;CAClB,CAAC;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,IAAI,WAAmB,CAAC;IACxB,IAAI,aAAqB,CAAC;IAE1B,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACvE,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,kBAAkB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzF,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;QACzD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAC1C,sEAAsE,CACvE,CAAC;QACF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,sCAAsC,CAAC,CAAC;QAC3G,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAClG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,SAAS,GAAG;QACV,OAAO,eAAe,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,SAAS,YAAY,CAAC,IAAa;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACxD,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrD,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,uBAAuB,EAAE,CAAC;QAChD,EAAE,CAAC,mDAAmD,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;iBAC7B,IAAI,CAAC,gBAAgB,CAAC;iBACtB,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;YAErE,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnD,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;aAC7B,IAAI,CAAC,gBAAgB,CAAC;aACtB,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;aAC7B,IAAI,CAAC,gBAAgB,CAAC;aACtB,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,EAAE,CAAC,sCAAsC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACvD,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACnD,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3C,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-server/bin/server.js

@@ -1,14 +1,26 @@
 #!/usr/bin/env node
-import { createMcpServer } from '../server.js';
 import chalk from 'chalk';
-const PORT = parseInt(process.env.DARE_MCP_PORT || '3000', 10);
-const PROJECT_PATH = process.env.DARE_PROJECT_PATH || process.cwd();
-const app = createMcpServer(PROJECT_PATH);
-const server = app.listen(PORT, () => {
+import pino from 'pino';
+import { createMcpServer } from '../server.js';
+import { redactToken } from '../middleware/auth.js';
+import { resolveMcpBindHost, resolveMcpPort, resolveMcpProjectPath, resolveMcpToken, shouldWarnLanExposure, } from '../boot-config.js';
+const logger = pino({ transport: { target: 'pino-pretty' } });
+const PORT = resolveMcpPort();
+const HOST = resolveMcpBindHost();
+const PROJECT_PATH = resolveMcpProjectPath();
+const TOKEN = resolveMcpToken();
+if (shouldWarnLanExposure(HOST)) {
+    logger.warn('DARE_MCP_BIND=0.0.0.0 exposes MCP to LAN — use only in trusted networks');
+}
+const app = createMcpServer(PROJECT_PATH, { authToken: TOKEN });
+const server = app.listen(PORT, HOST, () => {
+    const maskedToken = redactToken(TOKEN);
     console.log(chalk.blue.bold('\n🔌 DARE MCP Server\n'));
     console.log(`  ${chalk.gray('Status:')}  ${chalk.green('Running')}`);
-    console.log(`  ${chalk.gray('Port:')}    ${chalk.cyan(PORT)}`);
+    console.log(`  ${chalk.gray('Host:')}    ${chalk.cyan(HOST)}`);
+    console.log(`  ${chalk.gray('Port:')}    ${chalk.cyan(String(PORT))}`);
     console.log(`  ${chalk.gray('Project:')} ${chalk.cyan(PROJECT_PATH)}`);
+    console.log(`  ${chalk.gray('Token:')}   ${chalk.yellow(maskedToken)}`);
     console.log(`\n  ${chalk.gray('Endpoints:')}`);
     console.log(`  ${chalk.cyan('GET')}  /health`);
     console.log(`  ${chalk.cyan('GET')}  /tools`);

package/dist/mcp-server/bin/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/mcp-server/bin/server.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AAEpE,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;AAE1C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;IACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/mcp-server/bin/server.ts"],"names":[],"mappings":";AAEA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;AAE9D,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;AAC9B,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;AAClC,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;AAC7C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;AAEhC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;IAChC,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAEhE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;IACzC,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC"}

package/dist/mcp-server/boot-config.d.ts

@@ -0,0 +1,6 @@
+export declare function resolveMcpBindHost(env?: NodeJS.ProcessEnv): string;
+export declare function resolveMcpPort(env?: NodeJS.ProcessEnv): number;
+export declare function resolveMcpProjectPath(env?: NodeJS.ProcessEnv): string;
+export declare function resolveMcpToken(env?: NodeJS.ProcessEnv): string;
+export declare function shouldWarnLanExposure(host: string): boolean;
+//# sourceMappingURL=boot-config.d.ts.map

package/dist/mcp-server/boot-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-config.d.ts","sourceRoot":"","sources":["../../src/mcp-server/boot-config.ts"],"names":[],"mappings":"AAEA,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE3E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAElF;AAED,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE5E;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D"}

package/dist/mcp-server/boot-config.js

@@ -0,0 +1,17 @@
+import { randomUUID } from 'node:crypto';
+export function resolveMcpBindHost(env = process.env) {
+    return env.DARE_MCP_BIND ?? '127.0.0.1';
+}
+export function resolveMcpPort(env = process.env) {
+    return parseInt(env.DARE_MCP_PORT || '3000', 10);
+}
+export function resolveMcpProjectPath(env = process.env) {
+    return env.DARE_PROJECT_PATH || process.cwd();
+}
+export function resolveMcpToken(env = process.env) {
+    return env.DARE_MCP_TOKEN ?? randomUUID();
+}
+export function shouldWarnLanExposure(host) {
+    return host === '0.0.0.0';
+}
+//# sourceMappingURL=boot-config.js.map

package/dist/mcp-server/boot-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-config.js","sourceRoot":"","sources":["../../src/mcp-server/boot-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,GAAG,CAAC,aAAa,IAAI,WAAW,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO,QAAQ,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxE,OAAO,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,GAAG,CAAC,cAAc,IAAI,UAAU,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,IAAI,KAAK,SAAS,CAAC;AAC5B,CAAC"}

package/dist/mcp-server/middleware/auth.d.ts

@@ -0,0 +1,10 @@
+import type { RequestHandler } from 'express';
+export interface McpAuthOptions {
+    readonly token: string;
+    readonly allowLoopbackWithoutToken?: boolean;
+}
+/** Mask token for logs — never log the full secret (RF-14). */
+export declare function redactToken(token: string): string;
+export declare function isLoopbackIp(ip: string | undefined): boolean;
+export declare function createAuthMiddleware(opts: McpAuthOptions): RequestHandler;
+//# sourceMappingURL=auth.d.ts.map

package/dist/mcp-server/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,cAAc,EAAE,MAAM,SAAS,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;CAC9C;AAED,+DAA+D;AAC/D,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD;AAMD,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAI5D;AAiBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAezE"}

package/dist/mcp-server/middleware/auth.js

@@ -0,0 +1,44 @@
+/** Mask token for logs — never log the full secret (RF-14). */
+export function redactToken(token) {
+    if (token.length <= 8)
+        return '[REDACTED]';
+    return `${token.slice(0, 4)}...${token.slice(-4)}`;
+}
+function normalizeIp(ip) {
+    return ip.replace(/^::ffff:/, '');
+}
+export function isLoopbackIp(ip) {
+    if (!ip)
+        return false;
+    const n = normalizeIp(ip);
+    return n === '127.0.0.1' || n === '::1';
+}
+function isLoopbackRequest(req) {
+    return isLoopbackIp(req.ip) || isLoopbackIp(req.socket.remoteAddress ?? undefined);
+}
+function extractToken(req) {
+    const auth = req.headers.authorization;
+    if (typeof auth === 'string' && auth.startsWith('Bearer ')) {
+        return auth.slice('Bearer '.length).trim();
+    }
+    if (isLoopbackRequest(req) && typeof req.query.token === 'string') {
+        return req.query.token;
+    }
+    return undefined;
+}
+export function createAuthMiddleware(opts) {
+    const allowLoopback = opts.allowLoopbackWithoutToken ?? true;
+    return (req, res, next) => {
+        const provided = extractToken(req);
+        if (provided === opts.token) {
+            next();
+            return;
+        }
+        if (!provided && allowLoopback && isLoopbackRequest(req)) {
+            next();
+            return;
+        }
+        res.status(401).json({ error: 'Unauthorized' });
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/mcp-server/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/mcp-server/middleware/auth.ts"],"names":[],"mappings":"AAOA,+DAA+D;AAC/D,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAsB;IACjD,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IACrC,OAAO,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAClE,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAoB;IACvD,MAAM,aAAa,GAAG,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC;IAE7D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,aAAa,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC"}

package/dist/mcp-server/middleware/cors.d.ts

@@ -0,0 +1,6 @@
+import type { RequestHandler } from 'express';
+export interface McpCorsOptions {
+    readonly allowedOrigins?: ReadonlyArray<string>;
+}
+export declare function createCorsMiddleware(opts?: McpCorsOptions): RequestHandler;
+//# sourceMappingURL=cors.d.ts.map

package/dist/mcp-server/middleware/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACjD;AAcD,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAyB1E"}

package/dist/mcp-server/middleware/cors.js

@@ -0,0 +1,30 @@
+const DEFAULT_PATTERNS = ['http://127.0.0.1:*', 'http://localhost:*'];
+function originMatchesPattern(origin, pattern) {
+    if (!pattern.includes('*'))
+        return origin === pattern;
+    const [prefix] = pattern.split('*');
+    return origin.startsWith(prefix);
+}
+function isOriginAllowed(origin, patterns) {
+    return patterns.some((p) => originMatchesPattern(origin, p));
+}
+export function createCorsMiddleware(opts) {
+    const patterns = opts?.allowedOrigins ?? DEFAULT_PATTERNS;
+    return (req, res, next) => {
+        const origin = req.headers.origin;
+        if (origin && isOriginAllowed(origin, patterns)) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
+            res.setHeader('Vary', 'Origin');
+        }
+        if (req.method === 'OPTIONS') {
+            if (origin && isOriginAllowed(origin, patterns)) {
+                res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+                res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+            }
+            res.status(204).end();
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=cors.js.map

package/dist/mcp-server/middleware/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/mcp-server/middleware/cors.ts"],"names":[],"mappings":"AAMA,MAAM,gBAAgB,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;AAEtE,SAAS,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAC3D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,QAA+B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,MAAM,QAAQ,GAAG,IAAI,EAAE,cAAc,IAAI,gBAAgB,CAAC;IAE1D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAElC,IAAI,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,iCAAiC,CAAC,CAAC;gBACjF,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,6BAA6B,CAC9B,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/mcp-server/middleware/error-handler.d.ts

@@ -0,0 +1,11 @@
+import type { ErrorRequestHandler } from 'express';
+export interface SanitizedErrorBody {
+    readonly success: false;
+    readonly error: string;
+    readonly correlationId: string;
+}
+export interface ErrorHandlerLogger {
+    error(obj: Record<string, unknown>, msg: string): void;
+}
+export declare function createErrorHandler(logger: ErrorHandlerLogger): ErrorRequestHandler;
+//# sourceMappingURL=error-handler.d.ts.map

package/dist/mcp-server/middleware/error-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/middleware/error-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEnD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACxD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,mBAAmB,CAclF"}

package/dist/mcp-server/middleware/error-handler.js

@@ -0,0 +1,14 @@
+import { randomUUID } from 'node:crypto';
+export function createErrorHandler(logger) {
+    return (err, req, res, _next) => {
+        const correlationId = randomUUID();
+        logger.error({ err, correlationId, route: req.path }, 'mcp request failed');
+        const body = {
+            success: false,
+            error: 'Internal server error',
+            correlationId,
+        };
+        res.status(500).json(body);
+    };
+}
+//# sourceMappingURL=error-handler.js.map

package/dist/mcp-server/middleware/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../../src/mcp-server/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAazC,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EACvC,oBAAoB,CACrB,CAAC;QACF,MAAM,IAAI,GAAuB;YAC/B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uBAAuB;YAC9B,aAAa;SACd,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC"}

package/dist/mcp-server/server.d.ts

@@ -1,8 +1,9 @@
-import { Express } from 'express';
+import { type Express } from 'express';
 export interface ContextQuery {
     type: 'file' | 'task' | 'dependency' | 'architecture' | 'schema' | 'endpoint';
     query: string;
     limit?: number;
+    /** @deprecated Ignored — server uses DARE_PROJECT_PATH / cwd only */
     projectPath?: string;
 }
 export interface ContextResult {
@@ -17,5 +18,9 @@ export interface TaskStatus {
     status: 'PENDING' | 'IN_PROGRESS' | 'DONE' | 'FAILED' | 'SKIPPED';
     updatedAt: string;
 }
-export declare function createMcpServer(projectPath?: string): Express;
+export interface McpServerOptions {
+    authToken?: string;
+    allowLoopbackWithoutToken?: boolean;
+}
+export declare function createMcpServer(projectRoot?: string, options?: McpServerOptions): Express;
 //# sourceMappingURL=server.d.ts.map

package/dist/mcp-server/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp-server/server.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAqB,OAAO,EAAE,MAAM,SAAS,CAAC;AAQ9D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,GAAG,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAClE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,WAAW,GAAE,MAAsB,GAAG,OAAO,CAmN5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp-server/server.ts"],"names":[],"mappings":"AAEA,OAAgB,EAAE,KAAK,OAAO,EAAkD,MAAM,SAAS,CAAC;AAiBhG,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,GAAG,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAClE,SAAS,EAAE,MAAM,CAAC;CACnB;AAuBD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AA0DD,wBAAgB,eAAe,CAC7B,WAAW,GAAE,MAAuD,EACpE,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAkWT"}