@gemslibe/rbo 0.2.0

package/dist/rbo-mcp-stdio.js

@@ -0,0 +1,814 @@
+#!/usr/bin/env node
+
+// ../mcp-stdio/src/main.ts
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// ../mcp-stdio/src/proxy.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// ../../packages/shared/dist/versions.js
+var RBO_STDIO_ADAPTER_VERSION = "0.2.0";
+
+// ../../packages/shared/dist/errors.js
+import { z } from "zod";
+var ErrorCategorySchema = z.enum([
+  "validation",
+  "no_matching_agent",
+  "no_capacity",
+  "source_scan",
+  "secret_blocked",
+  "repo_clone",
+  "repo_fetch",
+  "base_commit_missing",
+  "bundle_import",
+  "snapshot_transfer",
+  "snapshot_hash",
+  "materialization",
+  "workspace_changed",
+  "shell_missing",
+  "process_spawn",
+  "process_exit",
+  "timeout",
+  "cancelled",
+  "agent_lost",
+  "artifact_collection",
+  "artifact_upload",
+  "cleanup",
+  "secret_missing",
+  "toolchain_changed",
+  "agent_disconnected",
+  "lease_expired",
+  "log_spool_limit",
+  "internal"
+]);
+
+// ../../packages/shared/dist/ids.js
+import { ulid } from "ulid";
+
+// ../../packages/shared/dist/paths.js
+var WINDOWS_RESERVED_NAMES = /* @__PURE__ */ new Set([
+  "CON",
+  "PRN",
+  "AUX",
+  "NUL",
+  "COM1",
+  "COM2",
+  "COM3",
+  "COM4",
+  "COM5",
+  "COM6",
+  "COM7",
+  "COM8",
+  "COM9",
+  "LPT1",
+  "LPT2",
+  "LPT3",
+  "LPT4",
+  "LPT5",
+  "LPT6",
+  "LPT7",
+  "LPT8",
+  "LPT9"
+]);
+function containsWindowsReservedName(pathStr) {
+  const normalized = pathStr.replace(/\\/g, "/");
+  for (const segment of normalized.split("/")) {
+    if (!segment)
+      continue;
+    const base = segment.includes(".") ? segment.slice(0, segment.indexOf(".")) : segment;
+    if (WINDOWS_RESERVED_NAMES.has(base.toUpperCase())) {
+      return true;
+    }
+  }
+  return false;
+}
+function isSafeRelativePath(value, options) {
+  const normalized = value.replace(/\\/g, "/");
+  if (normalized === "" || normalized === ".") {
+    return options?.allowDot === true;
+  }
+  if (normalized.startsWith("/") || normalized.startsWith("//") || normalized.startsWith("\\\\") || /^[a-zA-Z]:/.test(normalized) || normalized.includes("://")) {
+    return false;
+  }
+  const parts = normalized.split("/");
+  if (parts.some((part) => part === "" || part === "." || part === "..")) {
+    return false;
+  }
+  if (containsWindowsReservedName(normalized)) {
+    return false;
+  }
+  return true;
+}
+
+// ../../packages/shared/dist/controller-identity.js
+import selfsigned from "selfsigned";
+import { ulid as ulid2 } from "ulid";
+
+// ../../packages/shared/dist/host-load.js
+var DEFAULT_REFERENCE_CAPACITY_SCORE = 8 * 3e3;
+
+// ../../packages/protocol/dist/schemas.js
+import { z as z2 } from "zod";
+var StructuredErrorSchema = z2.object({
+  category: ErrorCategorySchema,
+  message: z2.string(),
+  retryable: z2.boolean(),
+  details: z2.record(z2.string(), z2.unknown()).optional()
+});
+var JobStateSchema = z2.enum([
+  "created",
+  "awaiting_confirmation",
+  "queued",
+  "matching",
+  "leased",
+  "preparing_source",
+  "transferring_source",
+  "materializing",
+  "starting",
+  "running",
+  "orphaned",
+  "collecting_artifacts",
+  "cleaning",
+  "completed"
+]);
+var JobOutcomeSchema = z2.enum(["succeeded", "failed", "timed_out", "cancelled", "lost"]);
+var RiskLevelSchema = z2.enum(["safe", "normal", "destructive", "hardware"]);
+var QueuePolicySchema = z2.enum(["local_fallback", "wait", "fail_fast"]);
+var CompletionPolicySchema = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("run_to_exit") }),
+  z2.object({ type: z2.literal("run_for_duration"), duration_seconds: z2.number().positive() }),
+  z2.object({
+    type: z2.literal("run_until_log_match"),
+    success_pattern: z2.string().min(1),
+    failure_pattern: z2.string().min(1).optional(),
+    max_duration_seconds: z2.number().positive()
+  })
+]);
+var ShellIdSchema = z2.enum(["bash", "zsh", "sh", "powershell", "pwsh", "cmd", "direct"]);
+var ExecutionConfigSchema = z2.object({
+  shell: ShellIdSchema.default("bash"),
+  script: z2.string().min(1),
+  env: z2.record(z2.string(), z2.string()).default({}),
+  // §13.4: values come from the Agent-side named secret store, never through MCP.
+  secret_refs: z2.record(z2.string(), z2.string()).optional(),
+  timeout_seconds: z2.number().positive().default(3600),
+  idle_timeout_seconds: z2.number().positive().optional(),
+  cancel_grace_seconds: z2.number().positive().default(10),
+  cleanup_script: z2.string().optional(),
+  cleanup_timeout_seconds: z2.number().positive().default(60),
+  tty: z2.boolean().default(false),
+  completion: CompletionPolicySchema.default({ type: "run_to_exit" })
+});
+var JobAdditionalRootSchema = z2.object({
+  source_path: z2.string().min(1),
+  mount_path: z2.string().min(1).refine((value) => isSafeRelativePath(value), {
+    message: "mount_path must be a relative path without '..', absolute, or UNC segments"
+  }),
+  include: z2.array(z2.string()).default(["**/*"]),
+  exclude: z2.array(z2.string()).default([]),
+  mode: z2.enum(["read_only", "read_write"]).default("read_only")
+});
+var SourceConfigSchema = z2.object({
+  project_root: z2.string().min(1),
+  // Relative path only — no absolute paths or `..` segments (§28.2 isolation).
+  cwd: z2.string().default(".").refine((value) => isSafeRelativePath(value, { allowDot: true }), {
+    message: "cwd must be a relative path without '..' or absolute segments"
+  }),
+  additional_roots: z2.array(JobAdditionalRootSchema).default([])
+});
+var SourcePolicySchema = z2.object({
+  include_untracked: z2.boolean().default(true),
+  include_ignored: z2.array(z2.string()).default([]),
+  secret_policy: z2.enum(["block", "warn", "allow"]).default("block")
+});
+var RequirementsConfigSchema = z2.object({
+  os: z2.array(z2.string()).optional(),
+  arch: z2.array(z2.string()).optional(),
+  tools: z2.record(z2.string(), z2.string()).optional(),
+  labels: z2.record(z2.string(), z2.string()).optional(),
+  secret_refs: z2.array(z2.string()).optional(),
+  min_memory_mb: z2.number().positive().optional(),
+  min_disk_mb: z2.number().positive().optional()
+});
+var PreferencesConfigSchema = z2.object({
+  agent_ids: z2.array(z2.string()).optional(),
+  os_order: z2.array(z2.string()).optional(),
+  prefer_repo_cache: z2.boolean().default(true),
+  prefer_build_cache: z2.boolean().default(true),
+  allow_local_fallback: z2.boolean().default(true)
+});
+var ArtifactRuleSchema = z2.object({
+  glob: z2.string().min(1),
+  required: z2.boolean().default(false)
+});
+var JobRequestSchema = z2.object({
+  client_request_id: z2.string().min(1),
+  name: z2.string().optional(),
+  source: SourceConfigSchema,
+  execution: ExecutionConfigSchema,
+  requirements: RequirementsConfigSchema.optional(),
+  preferences: PreferencesConfigSchema.optional(),
+  queue_policy: QueuePolicySchema.default("local_fallback"),
+  risk_level: RiskLevelSchema.default("normal"),
+  intent: z2.string().nullable().optional(),
+  source_policy: SourcePolicySchema.optional(),
+  artifacts: z2.array(ArtifactRuleSchema).optional()
+});
+var jobEventBase = {
+  sequence: z2.number().int().positive(),
+  created_at: z2.string().min(1),
+  job_id: z2.string().min(1),
+  attempt_id: z2.string().min(1)
+};
+var JobEventSchema = z2.discriminatedUnion("type", [
+  z2.object({
+    type: z2.literal("state_transition"),
+    ...jobEventBase,
+    from_state: JobStateSchema,
+    to_state: JobStateSchema
+  }),
+  z2.object({
+    type: z2.literal("snapshot_captured"),
+    ...jobEventBase,
+    snapshot_id: z2.string().min(1),
+    content_id: z2.string().min(1)
+  }),
+  z2.object({
+    type: z2.literal("materialized"),
+    ...jobEventBase,
+    workspace: z2.string().min(1)
+  }),
+  z2.object({
+    type: z2.literal("process_started"),
+    ...jobEventBase,
+    workspace: z2.string().min(1),
+    pid: z2.number().int().positive().optional()
+  }),
+  z2.object({
+    type: z2.literal("artifact_collected"),
+    ...jobEventBase,
+    artifact_id: z2.string().min(1),
+    path: z2.string().min(1),
+    sha256: z2.string().min(1)
+  }),
+  z2.object({
+    type: z2.literal("artifact_skipped"),
+    ...jobEventBase,
+    path: z2.string().min(1),
+    reason: z2.string().min(1)
+  }),
+  z2.object({
+    type: z2.literal("artifact_limit_exceeded"),
+    ...jobEventBase,
+    reason: z2.enum(["file_count", "total_bytes"]),
+    limit: z2.number().int().positive(),
+    actual: z2.number().int().positive()
+  }),
+  z2.object({
+    type: z2.literal("secret_warning"),
+    ...jobEventBase,
+    path: z2.string().min(1),
+    reason: z2.string().min(1)
+  }),
+  z2.object({
+    type: z2.literal("env_override_ignored"),
+    ...jobEventBase,
+    name: z2.string().min(1),
+    reason: z2.string().min(1)
+  }),
+  z2.object({
+    type: z2.literal("cancel_requested"),
+    ...jobEventBase,
+    reason: z2.string().optional(),
+    signalled: z2.boolean()
+  }),
+  z2.object({
+    type: z2.literal("cleanup_error"),
+    ...jobEventBase,
+    exit_code: z2.number().int().nullable(),
+    timed_out: z2.boolean(),
+    message: z2.string().min(1)
+  }),
+  z2.object({
+    type: z2.literal("error"),
+    ...jobEventBase,
+    category: ErrorCategorySchema,
+    message: z2.string().min(1)
+  })
+]);
+var ToolchainProfileSchema = z2.object({
+  id: z2.string(),
+  kind: z2.string(),
+  version: z2.string(),
+  platform: z2.string(),
+  activation: z2.object({
+    type: z2.enum(["source_script", "environment_variables", "path_prepend"]),
+    path: z2.string().optional(),
+    env: z2.record(z2.string(), z2.string()).optional()
+  }),
+  environment_fingerprint: z2.string()
+});
+var BuildCacheKindSchema = z2.enum(["ccache", "sccache", "npm", "pnpm", "pip"]);
+var AgentCapabilityReportSchema = z2.object({
+  agent_id: z2.string(),
+  display_name: z2.string(),
+  hostname: z2.string(),
+  os: z2.object({
+    family: z2.enum(["macos", "windows", "linux"]),
+    version: z2.string(),
+    arch: z2.string()
+  }),
+  resources: z2.object({
+    cpu_logical: z2.number(),
+    memory_total_mb: z2.number(),
+    memory_free_mb: z2.number(),
+    disk_free_mb: z2.number(),
+    /**
+     * Agent-reported CPU busy fraction in [0, 1] for §19.2 scheduler scoring.
+     * Missing at schedule time is treated as 1 (pessimistic) by the Controller.
+     */
+    cpu_load: z2.number().min(0).max(1).optional(),
+    /** Additive Phase 6 capacity fields (bytes). */
+    disk_free_bytes: z2.number().nonnegative().optional(),
+    disk_min_free_bytes: z2.number().nonnegative().optional(),
+    disk_pressure: z2.boolean().optional(),
+    /**
+     * Primary-core clock speed (MHz) from os.cpus()[0].speed, for host-aware scheduling's
+     * capacity score (cpu_logical * cpu_speed_mhz). Optional — missing is treated as an
+     * unknown/lowest-priority capacity by the Controller, same spirit as cpu_load's pessimistic
+     * default above.
+     */
+    cpu_speed_mhz: z2.number().nonnegative().optional()
+  }),
+  execution: z2.object({
+    max_jobs: z2.number(),
+    shells: z2.array(z2.string()),
+    supports_tty: z2.boolean(),
+    supports_process_tree_kill: z2.boolean()
+  }),
+  tools: z2.record(z2.string(), z2.array(z2.string())),
+  toolchain_profiles: z2.array(ToolchainProfileSchema),
+  labels: z2.record(z2.string(), z2.string()),
+  secret_refs: z2.array(z2.string()),
+  /**
+   * Optional Phase 5 repository-cache advertisement for scheduler affinity (§19.2).
+   * Agents may report canonical ids (and optionally known commits) present in mirrors.
+   */
+  repository_cache: z2.array(z2.object({
+    canonical_id: z2.string().min(1),
+    /** Optional known commits present in the mirror (best-effort). */
+    commits: z2.array(z2.string().min(1)).optional()
+  })).optional(),
+  /**
+   * Optional Phase 7 named build-cache advertisement for scheduler affinity.
+   * Opaque cache identity keys currently present (hashes only — no secrets).
+   */
+  build_caches: z2.array(z2.object({
+    kind: BuildCacheKindSchema,
+    keys: z2.array(z2.string().min(1)).optional()
+  })).optional(),
+  /** Phase 6: false under disk/spool pressure — Agent also lease_rejects. */
+  accepting_jobs: z2.boolean().optional(),
+  /**
+   * Operator-configured scheduling priority (§19.2 / §19.3). When unset, the
+   * Controller applies OS-family defaults at schedule time.
+   */
+  configured_priority: z2.number().optional()
+});
+
+// ../../packages/protocol/dist/messages.js
+import { z as z3 } from "zod";
+var AgentMessageTypeSchema = z3.enum([
+  "hello",
+  "pairing_request",
+  "capabilities",
+  "heartbeat",
+  "lease_accept",
+  "lease_reject",
+  "source_need",
+  "source_ready",
+  "job_started",
+  "log_chunk",
+  "job_exit",
+  "artifact_manifest",
+  "cleanup_complete",
+  "agent_error",
+  "recovery_report"
+]);
+var ControllerMessageTypeSchema = z3.enum([
+  "hello_ack",
+  "pairing_challenge",
+  "lease_offer",
+  "prepare_source",
+  "snapshot_download",
+  "bundle_download",
+  "run_job",
+  "cancel_job",
+  "artifact_upload_grant",
+  "pause",
+  "resume",
+  "refresh_capabilities",
+  "shutdown",
+  "log_ack",
+  "reconcile_decision"
+]);
+var ProtocolMessageTypeSchema = z3.enum([
+  ...AgentMessageTypeSchema.options,
+  ...ControllerMessageTypeSchema.options
+]);
+var JOB_SCOPED_MESSAGE_TYPES = /* @__PURE__ */ new Set([
+  "lease_offer",
+  "lease_accept",
+  "lease_reject",
+  "prepare_source",
+  "snapshot_download",
+  "bundle_download",
+  "run_job",
+  "cancel_job",
+  "source_need",
+  "source_ready",
+  "job_started",
+  "log_chunk",
+  "job_exit",
+  "artifact_manifest",
+  "artifact_upload_grant",
+  "cleanup_complete",
+  "log_ack",
+  "recovery_report",
+  "reconcile_decision"
+]);
+var LeaseOfferPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  /** Controller-assigned job id — injected as RBO_JOB_ID on the Agent. */
+  job_id: z3.string().min(1),
+  job_request: JobRequestSchema,
+  snapshot_metadata: z3.object({
+    snapshot_id: z3.string().min(1),
+    content_id: z3.string().min(1),
+    size_bytes: z3.number().int().nonnegative(),
+    sha256: z3.string().min(1)
+  }),
+  selected_toolchain_profiles: z3.array(ToolchainProfileSchema).optional(),
+  lease_ttl_seconds: z3.number().positive()
+});
+var LeaseAcceptPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive()
+});
+var LeaseRejectPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  reason: z3.string().min(1)
+});
+var SourceNeedReasonSchema = z3.enum([
+  "base_present",
+  "base_commit_missing",
+  "bundle_required",
+  "full_snapshot_required",
+  "repo_fetch_failed"
+]);
+var DataTransferDescriptorSchema = z3.object({
+  download_url: z3.string().min(1),
+  data_token: z3.string().min(1),
+  expected_size_bytes: z3.number().int().nonnegative(),
+  expected_sha256: z3.string().min(1)
+});
+var PrepareSourceRepoSchema = z3.object({
+  url: z3.string().min(1),
+  canonical_id: z3.string().min(1),
+  branch: z3.string().nullable(),
+  base_commit: z3.string().min(1),
+  fetch_refs: z3.array(z3.string().min(1)).default([])
+});
+var PrepareSourceFullPayloadSchema = z3.object({
+  source_mode: z3.literal("full"),
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  download_url: z3.string().min(1),
+  data_token: z3.string().min(1),
+  expected_size_bytes: z3.number().int().nonnegative(),
+  expected_sha256: z3.string().min(1),
+  manifest: z3.unknown().optional()
+});
+var PrepareSourceGitOverlayPayloadSchema = z3.object({
+  source_mode: z3.literal("git_overlay"),
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  repo: PrepareSourceRepoSchema,
+  overlay: DataTransferDescriptorSchema,
+  manifest: z3.unknown().optional()
+});
+var PrepareSourcePayloadSchema = z3.discriminatedUnion("source_mode", [
+  PrepareSourceFullPayloadSchema,
+  PrepareSourceGitOverlayPayloadSchema
+]);
+var SourceNeedPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  reason: SourceNeedReasonSchema,
+  detail: z3.string().optional()
+});
+var BundleDownloadPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  download_url: z3.string().min(1),
+  data_token: z3.string().min(1),
+  expected_size_bytes: z3.number().int().nonnegative(),
+  expected_sha256: z3.string().min(1)
+});
+var SourceReadyPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive()
+});
+var RunJobPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive()
+});
+var CancelJobPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  grace_seconds: z3.number().positive().default(10),
+  reason: z3.string().optional()
+});
+var JobStartedPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  pid: z3.number().int().positive().optional()
+});
+var LogChunkPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  stream: z3.enum(["stdout", "stderr"]),
+  sequence: z3.number().int().positive(),
+  bytes: z3.string()
+});
+var JobExitPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  exit_code: z3.number().int().nullable(),
+  outcome: JobOutcomeSchema,
+  failure_category: ErrorCategorySchema.optional(),
+  failure_message: z3.string().optional()
+});
+var ArtifactManifestPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  artifacts: z3.array(z3.object({
+    logical_name: z3.string().min(1),
+    path: z3.string().min(1),
+    size_bytes: z3.number().int().nonnegative(),
+    sha256: z3.string().min(1)
+  }))
+});
+var ArtifactUploadGrantPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  artifacts: z3.array(z3.object({
+    logical_name: z3.string().min(1),
+    path: z3.string().min(1),
+    size_bytes: z3.number().int().nonnegative(),
+    sha256: z3.string().min(1),
+    upload_url: z3.string().min(1),
+    upload_token: z3.string().min(1)
+  }))
+});
+var CleanupCompletePayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  exit_code: z3.number().int().nullable(),
+  timed_out: z3.boolean(),
+  message: z3.string().optional()
+});
+var LogAckPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  sequence: z3.number().int().positive()
+});
+var RecoveryReportStatusSchema = z3.enum([
+  "running",
+  "completed_awaiting_upload",
+  "orphaned"
+]);
+var RecoveryReportPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  status: RecoveryReportStatusSchema,
+  process_identity: z3.string().min(1),
+  last_sent_sequence: z3.number().int().nonnegative(),
+  last_acked_sequence: z3.number().int().nonnegative(),
+  artifact_upload_pending: z3.boolean()
+});
+var ReconcileDecisionPayloadSchema = z3.object({
+  attempt_id: z3.string().min(1),
+  lease_id: z3.string().min(1),
+  lease_epoch: z3.number().int().positive(),
+  action: z3.enum(["adopt", "terminate_stale"]),
+  resume_from_sequence: z3.number().int().nonnegative().optional(),
+  reason: z3.string().optional()
+});
+var WireMessageEnvelopeSchema = z3.object({
+  protocol: z3.number().int().positive(),
+  type: ProtocolMessageTypeSchema,
+  message_id: z3.string(),
+  sent_at: z3.string(),
+  attempt_id: z3.string().nullable(),
+  lease_id: z3.string().nullable(),
+  lease_epoch: z3.number().nullable(),
+  payload: z3.record(z3.string(), z3.unknown())
+}).superRefine((msg, ctx) => {
+  if (JOB_SCOPED_MESSAGE_TYPES.has(msg.type)) {
+    if (msg.attempt_id === null || msg.lease_id === null || msg.lease_epoch === null) {
+      ctx.addIssue({
+        code: z3.ZodIssueCode.custom,
+        message: `job-scoped message '${msg.type}' requires attempt_id, lease_id and lease_epoch (\xA720.2)`
+      });
+    }
+  }
+});
+
+// ../../packages/protocol/dist/mcp-tools.js
+import { z as z4 } from "zod";
+var JOB_SUBMIT_INPUT = JobRequestSchema.shape;
+var JOB_CONFIRM_INPUT = {
+  job_id: z4.string().min(1),
+  confirmation_token: z4.string().min(1)
+};
+var AGENTS_LIST_INPUT = {
+  include_offline: z4.boolean().default(false)
+};
+var JOB_GET_INPUT = {
+  job_id: z4.string().min(1)
+};
+var JOB_WAIT_INPUT = {
+  job_id: z4.string().min(1),
+  wait_seconds: z4.number().int().min(0).max(300).default(30),
+  include_log_tail_lines: z4.number().int().min(0).max(1e3).default(0)
+};
+var JOB_LOGS_INPUT = {
+  job_id: z4.string().min(1),
+  // null means "current active attempt, or terminal attempt for a terminal job" (§23.5)
+  attempt_id: z4.string().nullable().default(null),
+  cursor: z4.number().int().min(0).default(0),
+  max_bytes: z4.number().int().positive().max(1024 * 1024).default(65536),
+  streams: z4.array(z4.enum(["stdout", "stderr", "events"])).default(["stdout", "stderr"])
+};
+var JOB_CANCEL_INPUT = {
+  job_id: z4.string().min(1),
+  reason: z4.string().optional()
+};
+var JOB_ARTIFACTS_INPUT = {
+  job_id: z4.string().min(1)
+};
+var ARTIFACT_MATERIALIZE_INPUT = {
+  artifact_id: z4.string().min(1),
+  destination_path: z4.string().min(1),
+  overwrite: z4.boolean().default(false)
+};
+var AGENT_PROBE_INPUT = {
+  agent_id: z4.string().min(1)
+};
+var MCP_TOOL_DEFS = [
+  {
+    name: "agents_list",
+    description: "List registered worker agents and their capabilities.",
+    inputShape: AGENTS_LIST_INPUT
+  },
+  {
+    name: "job_submit",
+    description: "Submit a build/test job and capture an immutable workspace snapshot.",
+    inputShape: JOB_SUBMIT_INPUT
+  },
+  {
+    name: "job_confirm",
+    description: "Confirm a destructive or hardware-risk job after snapshot capture.",
+    inputShape: JOB_CONFIRM_INPUT
+  },
+  {
+    name: "job_get",
+    description: "Get current state and metadata of a job.",
+    inputShape: JOB_GET_INPUT
+  },
+  {
+    name: "job_wait",
+    description: "Wait up to wait_seconds for a job to reach a terminal state; returns current state otherwise.",
+    inputShape: JOB_WAIT_INPUT
+  },
+  {
+    name: "job_logs",
+    description: "Read incremental job logs from an attempt-scoped cursor.",
+    inputShape: JOB_LOGS_INPUT
+  },
+  {
+    name: "job_cancel",
+    description: "Cancel a running or queued job.",
+    inputShape: JOB_CANCEL_INPUT
+  },
+  {
+    name: "job_artifacts",
+    description: "List collected artifacts of a job, grouped by attempt.",
+    inputShape: JOB_ARTIFACTS_INPUT
+  },
+  {
+    name: "artifact_materialize",
+    description: "Copy one stored artifact into an allowed local destination path on the development PC.",
+    inputShape: ARTIFACT_MATERIALIZE_INPUT
+  },
+  {
+    name: "agent_probe",
+    description: "Trigger a capability re-probe of one agent.",
+    inputShape: AGENT_PROBE_INPUT
+  }
+];
+
+// ../../packages/protocol/dist/compatibility-matrix.js
+import { z as z5 } from "zod";
+var CompatibilityCellSchema = z5.object({
+  client: z5.string().min(1),
+  transport: z5.enum(["stdio", "streamable_http"]),
+  status: z5.enum(["verified", "not_verified"]),
+  revision: z5.string().min(1),
+  os: z5.string().min(1),
+  client_version: z5.string().min(1),
+  config_ref: z5.string().min(1),
+  workflow: z5.string().min(1),
+  limitation: z5.string().optional(),
+  evidence_path: z5.string().optional()
+});
+var CompatibilityMatrixSchema = z5.object({
+  schema_version: z5.literal(1),
+  generated_at: z5.string().min(1),
+  policy: z5.string().min(1),
+  cells: z5.array(CompatibilityCellSchema).min(1)
+});
+
+// ../mcp-stdio/src/proxy.ts
+function createStdioProxyServer(options) {
+  const server = new McpServer({
+    name: "rbo-mcp-stdio",
+    version: RBO_STDIO_ADAPTER_VERSION
+  });
+  const baseUrl = options.controllerUrl.replace(/\/+$/, "");
+  for (const def of MCP_TOOL_DEFS) {
+    server.registerTool(
+      def.name,
+      { description: def.description, inputSchema: def.inputShape },
+      async (args) => {
+        const response = await fetch(`${baseUrl}/internal/v1/tools/${def.name}`, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "x-rbo-client-id": options.clientId,
+            "x-rbo-client-transport": "stdio"
+          },
+          body: JSON.stringify(args ?? {})
+        });
+        const text = await response.text();
+        return {
+          content: [{ type: "text", text }],
+          isError: !response.ok
+        };
+      }
+    );
+  }
+  return server;
+}
+
+// ../mcp-stdio/src/main.ts
+function argValue(flag) {
+  const index = process.argv.indexOf(flag);
+  if (index === -1 || index + 1 >= process.argv.length) {
+    return void 0;
+  }
+  return process.argv[index + 1];
+}
+async function main() {
+  const controllerUrl = argValue("--controller") ?? process.env.RBO_CONTROLLER_URL ?? "http://127.0.0.1:7410";
+  const clientId = argValue("--client-id") ?? process.env.RBO_CLIENT_ID ?? `mcp-stdio-${process.pid}`;
+  const server = createStdioProxyServer({ controllerUrl, clientId });
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  console.error(`rbo mcp-stdio connected to ${controllerUrl} as ${clientId}`);
+}
+main().catch((error) => {
+  console.error(`rbo mcp-stdio failed: ${String(error)}`);
+  process.exit(1);
+});