@evomap/evolver-mcp 2.0.0-beta.2 → 2.0.0-beta.22

package/dist/productBridge.js

@@ -0,0 +1,250 @@
+// Unique writer for the EvoX product-tools MCP server (`evox-product`).
+// This is not the evolver gene/memory server. Desktop publishes a loopback
+// grant at ~/.evox/product-bridge.json; this module only registers a stdio
+// shim that fails closed until that file exists. Uninstall removes only a
+// managed evox-product entry.
+import { existsSync, lstatSync, mkdirSync, readFileSync, statSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { parse as parseToml, stringify as stringifyToml } from 'smol-toml';
+import { util } from '@evomap/evolver-core';
+import { commitSharedFile, SharedFileConflictError } from './sharedFileCommit.js';
+export const PRODUCT_BRIDGE_SERVER_ID = 'evox-product';
+export const PRODUCT_BRIDGE_MANAGED_KEY = '_evox_product_managed';
+export const PRODUCT_BRIDGE_PREVIOUS_KEY = '_evox_product_previous';
+export const PRODUCT_BRIDGE_GRANT_SCHEMA = 'evox.product_bridge.grant.v1';
+const CONFIG_WRITE_RETRIES = 5;
+const CONFIG_MODE = 0o600;
+const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+/** Resolve only a compiled JavaScript shim. Source TypeScript is never written into runtime config. */
+export function productBridgeShimPath() {
+    const modulePath = fileURLToPath(import.meta.url);
+    const candidates = [
+        fileURLToPath(new URL('./productBridgeShim.js', import.meta.url)),
+        join(dirname(modulePath), '../dist/productBridgeShim.js'),
+    ];
+    const built = candidates.find((candidate) => existsSync(candidate));
+    if (!built) {
+        throw new Error('[setup-hooks] product-bridge shim is not built; run the evolver-mcp build before installing the bridge.');
+    }
+    return built;
+}
+const NO_PREVIOUS_ENTRY = Symbol('no previous product bridge entry');
+function productBridgeServerEntry(previous = NO_PREVIOUS_ENTRY) {
+    return {
+        command: process.execPath,
+        args: [productBridgeShimPath()],
+        [PRODUCT_BRIDGE_MANAGED_KEY]: true,
+        ...(previous === NO_PREVIOUS_ENTRY ? {} : { [PRODUCT_BRIDGE_PREVIOUS_KEY]: previous }),
+    };
+}
+function previousEntryForForce(existing, hasExisting) {
+    if (!hasExisting)
+        return NO_PREVIOUS_ENTRY;
+    if (!isOwnedProductBridge(existing))
+        return existing;
+    return isObj(existing) && Object.prototype.hasOwnProperty.call(existing, PRODUCT_BRIDGE_PREVIOUS_KEY)
+        ? existing[PRODUCT_BRIDGE_PREVIOUS_KEY]
+        : NO_PREVIOUS_ENTRY;
+}
+/** Ownership is explicit. A matching filename alone is never enough to delete a user's server. */
+export function isOwnedProductBridge(entry) {
+    return isObj(entry) && entry[PRODUCT_BRIDGE_MANAGED_KEY] === true;
+}
+/** Restore a user entry previously preserved by an explicit force takeover. */
+export function restoreProductBridgeEntry(entry) {
+    if (!isOwnedProductBridge(entry) || !isObj(entry) || !Object.prototype.hasOwnProperty.call(entry, PRODUCT_BRIDGE_PREVIOUS_KEY)) {
+        return { restored: false };
+    }
+    return { restored: true, entry: entry[PRODUCT_BRIDGE_PREVIOUS_KEY] };
+}
+/** Merge a managed evox-product server into a parsed MCP JSON object (project .mcp.json or ~/.claude.json). */
+export function withClaudeProductBridge(data, force = false) {
+    if (Object.prototype.hasOwnProperty.call(data, 'mcpServers') && !isObj(data['mcpServers'])) {
+        throw new Error('[setup-hooks] refusing to overwrite MCP configuration: mcpServers must be an object.');
+    }
+    const servers = isObj(data['mcpServers']) ? { ...data['mcpServers'] } : {};
+    const hasExisting = Object.prototype.hasOwnProperty.call(servers, PRODUCT_BRIDGE_SERVER_ID);
+    const existing = servers[PRODUCT_BRIDGE_SERVER_ID];
+    if (hasExisting && !isOwnedProductBridge(existing) && !force) {
+        return { changed: false, skipped: true, data };
+    }
+    const previous = previousEntryForForce(existing, hasExisting);
+    const next = productBridgeServerEntry(previous);
+    if (JSON.stringify(existing) === JSON.stringify(next))
+        return { changed: false, data };
+    return { changed: true, data: { ...data, mcpServers: { ...servers, [PRODUCT_BRIDGE_SERVER_ID]: next } } };
+}
+/** Merge a managed evox-product table into parsed Codex TOML. */
+export function withCodexProductBridge(data, force = false) {
+    if (Object.prototype.hasOwnProperty.call(data, 'mcp_servers') && !isObj(data['mcp_servers'])) {
+        throw new Error('[setup-hooks] refusing to overwrite MCP configuration: mcp_servers must be an object.');
+    }
+    const servers = isObj(data['mcp_servers']) ? { ...data['mcp_servers'] } : {};
+    const hasExisting = Object.prototype.hasOwnProperty.call(servers, PRODUCT_BRIDGE_SERVER_ID);
+    const existing = servers[PRODUCT_BRIDGE_SERVER_ID];
+    if (hasExisting && !isOwnedProductBridge(existing) && !force) {
+        return { changed: false, skipped: true, data };
+    }
+    const previous = previousEntryForForce(existing, hasExisting);
+    const next = productBridgeServerEntry(previous);
+    if (JSON.stringify(existing) === JSON.stringify(next))
+        return { changed: false, data };
+    return { changed: true, data: { ...data, mcp_servers: { ...servers, [PRODUCT_BRIDGE_SERVER_ID]: next } } };
+}
+function assertNotSymlink(path, label) {
+    let st;
+    try {
+        st = lstatSync(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    if (st.isSymbolicLink()) {
+        throw new Error(`[setup-hooks] refusing to operate: ${label} ${path} is a symbolic link.`);
+    }
+}
+function assertConfigPathSafe(path, label) {
+    assertNotSymlink(path, label);
+    assertNotSymlink(`${path}.evolver.lock`, `${label} lock`);
+    const parent = lstatSync(dirname(path));
+    if (parent.isSymbolicLink())
+        throw new Error(`[setup-hooks] refusing to operate: ${label} parent directory is a symbolic link.`);
+    if (!parent.isDirectory())
+        throw new Error(`[setup-hooks] refusing to operate: ${label} parent is not a directory.`);
+}
+function readConfigSnapshot(path, label, parse) {
+    assertConfigPathSafe(path, label);
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { data: {}, raw: undefined, mode: CONFIG_MODE };
+        throw error;
+    }
+    if (!raw.trim())
+        throw new Error(`[setup-hooks] refusing to overwrite ${label} (${path}): the existing file is empty.`);
+    let data;
+    try {
+        data = parse(raw.trim());
+    }
+    catch (error) {
+        throw new Error(`[setup-hooks] refusing to overwrite ${label} (${path}): the existing document is malformed.`, { cause: error });
+    }
+    if (!isObj(data))
+        throw new Error(`[setup-hooks] refusing to overwrite ${label} (${path}): the existing document must be an object.`);
+    const mode = statSync(path).mode & 0o777;
+    return { data, raw, mode: mode === 0 ? CONFIG_MODE : mode & 0o700 };
+}
+function readRawIfExists(path) {
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}
+function releaseConfigLock(lockPath) {
+    const released = util.releaseLock(lockPath);
+    if (!released.released)
+        throw new util.LockReleaseError(released.reason);
+}
+/** Lock, compare, and commit a product bridge update without clobbering concurrent runtime writes. */
+function updateConfigFile(path, label, parse, serialize, update) {
+    const lockPath = `${path}.evolver.lock`;
+    assertConfigPathSafe(path, label);
+    util.acquireLock(lockPath);
+    try {
+        for (let attempt = 1; attempt <= CONFIG_WRITE_RETRIES; attempt += 1) {
+            const snapshot = readConfigSnapshot(path, label, parse);
+            const next = update(snapshot.data);
+            if (!next.changed)
+                return { changed: false, ...(next.skipped ? { skipped: true } : {}) };
+            assertConfigPathSafe(path, label);
+            if (readRawIfExists(path) !== snapshot.raw)
+                continue;
+            try {
+                commitSharedFile({
+                    path,
+                    expectedRaw: snapshot.raw,
+                    nextRaw: serialize(next.data),
+                    mode: snapshot.mode,
+                });
+                return { changed: true };
+            }
+            catch (error) {
+                if (error instanceof SharedFileConflictError)
+                    continue;
+                throw error;
+            }
+        }
+        throw new Error(`[setup-hooks] refusing to overwrite ${label} (${path}): the file changed repeatedly while the product bridge was being installed.`);
+    }
+    finally {
+        releaseConfigLock(lockPath);
+    }
+}
+export function installClaudeProductBridge(configRoot, force = false) {
+    const path = join(configRoot, '.mcp.json');
+    const result = updateConfigFile(path, '.mcp.json', (raw) => JSON.parse(raw), (data) => `${JSON.stringify(data, null, 2)}\n`, (data) => withClaudeProductBridge(data, force));
+    return { ...result, path };
+}
+export function uninstallClaudeProductBridge(configRoot) {
+    const path = join(configRoot, '.mcp.json');
+    if (!existsSync(path))
+        return false;
+    const result = updateConfigFile(path, '.mcp.json', (raw) => JSON.parse(raw), (data) => `${JSON.stringify(data, null, 2)}\n`, (data) => {
+        const servers = data['mcpServers'];
+        if (!isObj(servers) || !isOwnedProductBridge(servers[PRODUCT_BRIDGE_SERVER_ID]))
+            return { changed: false, data };
+        const next = { ...servers };
+        const restored = restoreProductBridgeEntry(next[PRODUCT_BRIDGE_SERVER_ID]);
+        if (restored.restored)
+            next[PRODUCT_BRIDGE_SERVER_ID] = restored.entry;
+        else
+            delete next[PRODUCT_BRIDGE_SERVER_ID];
+        const out = { ...data };
+        if (Object.keys(next).length > 0)
+            out['mcpServers'] = next;
+        else
+            delete out['mcpServers'];
+        return { changed: true, data: out };
+    });
+    return result.changed;
+}
+export function installCodexProductBridge(configRoot, force = false) {
+    const path = join(configRoot, '.codex', 'config.toml');
+    assertNotSymlink(join(configRoot, '.codex'), '.codex');
+    mkdirSync(dirname(path), { recursive: true });
+    const result = updateConfigFile(path, '.codex/config.toml', (raw) => parseToml(raw), (data) => `${stringifyToml(data)}\n`, (data) => withCodexProductBridge(data, force));
+    return { ...result, path };
+}
+export function uninstallCodexProductBridge(configRoot) {
+    const path = join(configRoot, '.codex', 'config.toml');
+    if (!existsSync(path))
+        return false;
+    const result = updateConfigFile(path, '.codex/config.toml', (raw) => parseToml(raw), (data) => `${stringifyToml(data)}\n`, (data) => {
+        const servers = data['mcp_servers'];
+        if (!isObj(servers) || !isOwnedProductBridge(servers[PRODUCT_BRIDGE_SERVER_ID]))
+            return { changed: false, data };
+        const next = { ...servers };
+        const restored = restoreProductBridgeEntry(next[PRODUCT_BRIDGE_SERVER_ID]);
+        if (restored.restored)
+            next[PRODUCT_BRIDGE_SERVER_ID] = restored.entry;
+        else
+            delete next[PRODUCT_BRIDGE_SERVER_ID];
+        const out = { ...data };
+        if (Object.keys(next).length > 0)
+            out['mcp_servers'] = next;
+        else
+            delete out['mcp_servers'];
+        return { changed: true, data: out };
+    });
+    return result.changed;
+}

package/dist/productBridgeShim.d.ts

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+export declare const GRANT_SCHEMA = "evox.product_bridge.grant.v1";
+export declare const MAX_STDIO_FRAME_BYTES: number;
+export declare const MAX_IN_FLIGHT_REQUESTS = 32;
+export declare const MAX_PENDING_STDIO_FRAMES = 64;
+export declare const MAX_PENDING_STDIO_BYTES: number;
+interface JsonRpcMessage {
+    jsonrpc?: string;
+    id?: unknown;
+    method?: string;
+    params?: unknown;
+    result?: unknown;
+    error?: unknown;
+}
+export declare function grantFilePath(env?: NodeJS.ProcessEnv): string;
+export declare function isLoopbackHttp(raw: string): boolean;
+export declare function readGrant(filePath?: string): {
+    url: string;
+    grant: string;
+};
+/** 将请求、通知和客户端响应转发到回环 product bridge。 */
+export declare function dispatch(req: JsonRpcMessage): Promise<Record<string, unknown> | null>;
+export interface DecodedStdioChunk {
+    readonly frames: string[];
+    readonly oversizedFrames: number;
+}
+/** MCP stdio 使用换行分隔 JSON；解码器限制单帧大小，并排出当前缓冲区中的全部完整帧。 */
+export declare class StdioLineDecoder {
+    private pending;
+    private discardingOversized;
+    push(chunk: Buffer | string): DecodedStdioChunk;
+    finish(): {
+        incomplete: boolean;
+    };
+}
+/** 对等待转发的完整帧同时施加数量和字节上限。 */
+export declare class BoundedStdioFrameQueue {
+    private readonly frames;
+    private queuedBytes;
+    get length(): number;
+    get bytes(): number;
+    enqueue(frame: string): boolean;
+    shift(): string | undefined;
+    isBelowResumeWatermark(): boolean;
+}
+export interface StdioBridgeOutput {
+    write(message: string): boolean;
+    on(event: 'drain', listener: () => void): unknown;
+}
+/** 启动可注入流和转发函数的 stdio bridge，便于验证背压与协议行为。 */
+export declare function runStdioBridge(input?: NodeJS.ReadableStream, output?: StdioBridgeOutput, dispatchMessage?: typeof dispatch): void;
+export {};

package/dist/productBridgeShim.js

@@ -0,0 +1,338 @@
+#!/usr/bin/env node
+// EvoX 产品工具的按需 stdio 代理；本进程绝不监听端口。
+// Desktop 通过 ~/.evox/product-bridge.json（或 EVOX_PRODUCT_BRIDGE_GRANT_FILE）发布授权。
+import { randomBytes } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import http from 'node:http';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const GRANT_SCHEMA = 'evox.product_bridge.grant.v1';
+const GRANT_HEADER = 'X-Evox-Product-Bridge-Grant';
+const NONCE_HEADER = 'X-Evox-Product-Bridge-Nonce';
+const MAX_GRANT_BYTES = 64 * 1024;
+export const MAX_STDIO_FRAME_BYTES = 2 * 1024 * 1024;
+export const MAX_IN_FLIGHT_REQUESTS = 32;
+export const MAX_PENDING_STDIO_FRAMES = 64;
+export const MAX_PENDING_STDIO_BYTES = 8 * 1024 * 1024;
+const REQUEST_TIMEOUT_MS = 30_000;
+export function grantFilePath(env = process.env) {
+    const override = String(env['EVOX_PRODUCT_BRIDGE_GRANT_FILE'] ?? '').trim();
+    if (override)
+        return override;
+    return join(homedir(), '.evox', 'product-bridge.json');
+}
+export function isLoopbackHttp(raw) {
+    try {
+        const url = new URL(raw);
+        const host = url.hostname.toLowerCase();
+        return url.protocol === 'http:' && (host === '127.0.0.1' || host === '::1' || host === '[::1]');
+    }
+    catch {
+        return false;
+    }
+}
+export function readGrant(filePath = grantFilePath()) {
+    if (!existsSync(filePath)) {
+        throw new Error('EvoX Desktop is not publishing a product-bridge grant. Start EvoX Desktop and retry.');
+    }
+    const st = lstatSync(filePath);
+    if (st.isSymbolicLink() || !st.isFile() || st.size > MAX_GRANT_BYTES) {
+        throw new Error('product-bridge grant file is not a regular file');
+    }
+    const data = JSON.parse(readFileSync(filePath, 'utf8'));
+    if (data.schema !== GRANT_SCHEMA) {
+        throw new Error(`product-bridge grant schema is not ${GRANT_SCHEMA}`);
+    }
+    if (!isLoopbackHttp(String(data.url ?? '')) || !String(data.grant ?? '').trim()) {
+        throw new Error('product-bridge grant is missing a loopback URL or token');
+    }
+    return { url: String(data.url).trim(), grant: String(data.grant).trim() };
+}
+function postJson(url, body, headers) {
+    return new Promise((resolvePromise, reject) => {
+        const target = new URL(url);
+        const payload = Buffer.from(JSON.stringify(body), 'utf8');
+        if (payload.length > MAX_STDIO_FRAME_BYTES) {
+            reject(new Error('product-bridge request is too large'));
+            return;
+        }
+        const req = http.request({
+            protocol: target.protocol,
+            hostname: target.hostname.replace(/^\[(.*)\]$/, '$1'),
+            port: target.port,
+            path: `${target.pathname}${target.search}`,
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'content-length': payload.length, ...headers },
+        }, (res) => {
+            const chunks = [];
+            let size = 0;
+            let oversized = false;
+            res.on('data', (chunk) => {
+                if (oversized)
+                    return;
+                size += chunk.length;
+                if (size > MAX_STDIO_FRAME_BYTES) {
+                    oversized = true;
+                    req.destroy(new Error('product-bridge response is too large'));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            res.on('end', () => {
+                if (oversized)
+                    return;
+                if ((res.statusCode ?? 500) < 200 || (res.statusCode ?? 500) >= 300) {
+                    reject(new Error(`product-bridge returned HTTP ${res.statusCode ?? 500}`));
+                    return;
+                }
+                const raw = Buffer.concat(chunks).toString('utf8').trim();
+                if (!raw) {
+                    resolvePromise(undefined);
+                    return;
+                }
+                try {
+                    const parsed = JSON.parse(raw);
+                    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                        reject(new Error('product-bridge returned a non-object JSON-RPC message'));
+                        return;
+                    }
+                    resolvePromise(parsed);
+                }
+                catch {
+                    reject(new Error('product-bridge returned invalid JSON'));
+                }
+            });
+        });
+        req.setTimeout(REQUEST_TIMEOUT_MS, () => {
+            req.destroy(new Error('product-bridge request timed out'));
+        });
+        req.on('error', reject);
+        req.end(payload);
+    });
+}
+function rpcError(id, message, code = -32000) {
+    return { jsonrpc: '2.0', id: id ?? null, error: { code, message } };
+}
+function isJsonRpcResponse(req) {
+    return req.id !== undefined && ('result' in req || 'error' in req) && req.method === undefined;
+}
+/** 将请求、通知和客户端响应转发到回环 product bridge。 */
+export async function dispatch(req) {
+    if (!req || req.jsonrpc !== '2.0')
+        return rpcError(req?.id, 'invalid JSON-RPC request', -32600);
+    const isRequest = typeof req.method === 'string' && req.method.length > 0;
+    const isResponse = isJsonRpcResponse(req);
+    if (!isRequest && !isResponse)
+        return rpcError(req.id, 'invalid JSON-RPC request', -32600);
+    const expectsResponse = isRequest && req.id !== undefined;
+    let grant;
+    try {
+        grant = readGrant();
+    }
+    catch (error) {
+        return expectsResponse ? rpcError(req.id, error instanceof Error ? error.message : String(error)) : null;
+    }
+    const headers = { [GRANT_HEADER]: grant.grant };
+    if (req.method === 'tools/call')
+        headers[NONCE_HEADER] = randomBytes(16).toString('hex');
+    try {
+        const response = await postJson(grant.url, req, headers);
+        if (!expectsResponse)
+            return null;
+        if (!response)
+            return rpcError(req.id, 'product-bridge returned an empty response');
+        response['id'] = req.id;
+        response['jsonrpc'] = '2.0';
+        return response;
+    }
+    catch (error) {
+        return expectsResponse ? rpcError(req.id, error instanceof Error ? error.message : String(error)) : null;
+    }
+}
+/** MCP stdio 使用换行分隔 JSON；解码器限制单帧大小，并排出当前缓冲区中的全部完整帧。 */
+export class StdioLineDecoder {
+    pending = Buffer.alloc(0);
+    discardingOversized = false;
+    push(chunk) {
+        const incoming = typeof chunk === 'string' ? Buffer.from(chunk, 'utf8') : chunk;
+        const frames = [];
+        let oversizedFrames = 0;
+        let offset = 0;
+        while (offset < incoming.length) {
+            if (this.discardingOversized) {
+                const newline = incoming.indexOf(0x0a, offset);
+                if (newline === -1)
+                    break;
+                this.discardingOversized = false;
+                offset = newline + 1;
+                continue;
+            }
+            const newline = incoming.indexOf(0x0a, offset);
+            if (newline === -1) {
+                const tail = incoming.subarray(offset);
+                if (this.pending.length + tail.length > MAX_STDIO_FRAME_BYTES) {
+                    this.pending = Buffer.alloc(0);
+                    this.discardingOversized = true;
+                    oversizedFrames += 1;
+                }
+                else {
+                    this.pending = Buffer.concat([this.pending, tail]);
+                }
+                break;
+            }
+            let line = Buffer.concat([this.pending, incoming.subarray(offset, newline)]);
+            this.pending = Buffer.alloc(0);
+            offset = newline + 1;
+            if (line.at(-1) === 0x0d)
+                line = line.subarray(0, -1);
+            if (line.length === 0)
+                continue;
+            if (line.length > MAX_STDIO_FRAME_BYTES) {
+                oversizedFrames += 1;
+                continue;
+            }
+            frames.push(line.toString('utf8'));
+        }
+        return { frames, oversizedFrames };
+    }
+    finish() {
+        const incomplete = this.pending.length > 0;
+        this.pending = Buffer.alloc(0);
+        return { incomplete };
+    }
+}
+/** 对等待转发的完整帧同时施加数量和字节上限。 */
+export class BoundedStdioFrameQueue {
+    frames = [];
+    queuedBytes = 0;
+    get length() { return this.frames.length; }
+    get bytes() { return this.queuedBytes; }
+    enqueue(frame) {
+        const bytes = Buffer.byteLength(frame, 'utf8');
+        if (this.frames.length >= MAX_PENDING_STDIO_FRAMES || this.queuedBytes + bytes > MAX_PENDING_STDIO_BYTES) {
+            return false;
+        }
+        this.frames.push({ frame, bytes });
+        this.queuedBytes += bytes;
+        return true;
+    }
+    shift() {
+        const item = this.frames.shift();
+        if (!item)
+            return undefined;
+        this.queuedBytes -= item.bytes;
+        return item.frame;
+    }
+    isBelowResumeWatermark() {
+        return this.frames.length <= Math.floor(MAX_PENDING_STDIO_FRAMES / 2)
+            && this.queuedBytes <= Math.floor(MAX_PENDING_STDIO_BYTES / 2);
+    }
+}
+/** 启动可注入流和转发函数的 stdio bridge，便于验证背压与协议行为。 */
+export function runStdioBridge(input = process.stdin, output = process.stdout, dispatchMessage = dispatch) {
+    const decoder = new StdioLineDecoder();
+    const pendingFrames = new BoundedStdioFrameQueue();
+    let inFlight = 0;
+    let inputPaused = false;
+    let outputBlocked = false;
+    const writeMessage = (message) => {
+        if (!output.write(`${JSON.stringify(message)}\n`)) {
+            outputBlocked = true;
+            pauseInput();
+        }
+    };
+    const processFrame = async (frame) => {
+        let req;
+        try {
+            const parsed = JSON.parse(frame);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                writeMessage(rpcError(null, 'invalid JSON-RPC request', -32600));
+                return;
+            }
+            req = parsed;
+        }
+        catch (error) {
+            writeMessage(rpcError(null, error instanceof Error ? error.message : String(error), -32700));
+            return;
+        }
+        const response = await dispatchMessage(req);
+        if (response)
+            writeMessage(response);
+    };
+    const processFrameSafely = (frame) => {
+        void processFrame(frame).catch((error) => {
+            writeMessage(rpcError(null, error instanceof Error ? error.message : String(error)));
+        }).finally(() => {
+            inFlight -= 1;
+            drainFrames();
+        });
+    };
+    const pauseInput = () => {
+        if (inputPaused)
+            return;
+        inputPaused = true;
+        input.pause();
+    };
+    const resumeInputIfSafe = () => {
+        if (!inputPaused || outputBlocked || !pendingFrames.isBelowResumeWatermark())
+            return;
+        inputPaused = false;
+        input.resume();
+    };
+    const writeOverloadForRequest = (frame) => {
+        try {
+            const parsed = JSON.parse(frame);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                return;
+            const request = parsed;
+            if (typeof request.method === 'string' && request.id !== undefined) {
+                writeMessage(rpcError(request.id, 'product-bridge stdio queue is full', -32001));
+            }
+        }
+        catch {
+            // 语法错误会由正常解析路径报告；过载路径不再保留该帧。
+        }
+    };
+    function drainFrames() {
+        while (!outputBlocked && inFlight < MAX_IN_FLIGHT_REQUESTS && pendingFrames.length > 0) {
+            const frame = pendingFrames.shift();
+            if (frame === undefined)
+                return;
+            inFlight += 1;
+            processFrameSafely(frame);
+        }
+        resumeInputIfSafe();
+    }
+    output.on('drain', () => {
+        outputBlocked = false;
+        drainFrames();
+    });
+    input.on('data', (chunk) => {
+        const decoded = decoder.push(chunk);
+        for (let index = 0; index < decoded.oversizedFrames; index += 1) {
+            writeMessage(rpcError(null, 'product-bridge stdio frame is too large', -32600));
+        }
+        for (const frame of decoded.frames) {
+            if (!outputBlocked && inFlight < MAX_IN_FLIGHT_REQUESTS && pendingFrames.length === 0) {
+                inFlight += 1;
+                processFrameSafely(frame);
+            }
+            else if (!pendingFrames.enqueue(frame)) {
+                pauseInput();
+                writeOverloadForRequest(frame);
+            }
+        }
+        drainFrames();
+    });
+    input.on('end', () => {
+        if (decoder.finish().incomplete)
+            writeMessage(rpcError(null, 'incomplete newline-delimited JSON-RPC frame', -32700));
+    });
+}
+function isEntrypoint() {
+    const argvPath = process.argv[1];
+    return argvPath !== undefined && resolve(argvPath) === resolve(fileURLToPath(import.meta.url));
+}
+if (isEntrypoint())
+    runStdioBridge();