@indigoai-us/hq-cli 5.115.6 → 5.117.0

package/dist/commands/secrets.js

@@ -43,7 +43,19 @@ export const CLI_SECRETS_SET_SURFACE = "cli_secrets_set";
  */
 async function requireCognitoTokenForSecrets(commandLabel, capability = null) {
     requireApiKeyCapability(capability, commandLabel, { routeAvailable: false });
-    return ensureCognitoToken();
+    return ensureCognitoToken(secretsCredentialOptions());
+}
+/**
+ * A browser login is safe only when a person can answer it. This mirrors the
+ * repository's existing terminal convention in `canOfferTeamUpgrade`: both
+ * stdin and stderr must be TTYs, and CI is always non-interactive.
+ */
+function secretsCredentialOptions() {
+    return {
+        interactive: process.stdin.isTTY === true &&
+            process.stderr.isTTY === true &&
+            !process.env.CI,
+    };
 }
 function scopeOpts(opts) {
     if (opts.personal && opts.company) {
@@ -96,7 +108,7 @@ function resolveApiKeyCompanyUid(scope, commandLabel) {
     return ref;
 }
 async function resolveSecretsTarget(capability, commandLabel, scopeOptions) {
-    const cred = await resolveVaultCredentialForCapability(capability, commandLabel);
+    const cred = await resolveVaultCredentialForCapability(capability, commandLabel, secretsCredentialOptions());
     const scope = scopeOpts(scopeOptions);
     const isApiKey = cred.kind === "api-key";
     const companyUid = isApiKey
@@ -883,7 +895,7 @@ export function registerSecretsCommand(program) {
         .option("--reveal", "Include the decrypted secret value")
         .action(async (name, opts) => {
         try {
-            const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets get");
+            const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets get", secretsCredentialOptions());
             if (cred.kind === "api-key") {
                 if (!opts.reveal) {
                     console.error(chalk.red("HQ_API_KEY is set; `hq secrets get` without --reveal is not supported for API keys. " +
@@ -1434,7 +1446,7 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const keys = parseSecretNameList(_opts.only);
-            const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets exec");
+            const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets exec", secretsCredentialOptions());
             const companyUid = cred.kind === "api-key"
                 ? "__api_key__"
                 : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
@@ -1485,7 +1497,7 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.yellow("stdout is a terminal — values redacted. Use: source <(hq secrets env --only KEY1,KEY2)"));
             }
             const keys = parseSecretNameList(opts.only);
-            const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env");
+            const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env", secretsCredentialOptions());
             const companyUid = cred.kind === "api-key"
                 ? "__api_key__"
                 : await getEntityUid(cred.token, scopeOpts(secrets.opts()));

package/dist/lib/agent-kit/creds.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Host key + machine-creds file handling for external agents.
+ *
+ * The private key and the creds file are the whole credential: a stolen
+ * creds file without the key mints nothing (hq-cloud signs every mint with
+ * the key), so both are written 0600 and never printed. Nothing in this
+ * module reads `~/.hq/cognito-tokens.json` — a human's session is never
+ * consulted, copied, or reused by an agent identity (policy
+ * never-extract-stored-session-tokens-to-forge-privileged-calls).
+ */
+import type { AgentKitPaths, KitComponent } from "./paths.js";
+/** Exact `machine-creds.json` shape for an external agent (api-contract v1). */
+export interface ExternalMachineCreds {
+    username: string;
+    secret: string;
+    /** Cognito user pool the machine user lives in (informational for the host). */
+    userPoolId?: string;
+    clientId: string;
+    region: string;
+    entityType: "agent";
+    entityUid: string;
+    runtime: "external";
+    hostKeyPath: string;
+    companySlug: string;
+    apiBaseUrl: string;
+}
+export interface HostKeyPair {
+    privatePem: string;
+    publicPem: string;
+    /** SHA-256 of the DER (SPKI) public key, hex, first 16 chars. */
+    fingerprint: string;
+}
+/** Contract fingerprint: sha256(DER SPKI public key) hex, first 16 chars. */
+export declare function hostFingerprint(publicPem: string): string;
+export declare function generateHostKeyPair(): HostKeyPair;
+export declare function writeHostKeyPair(paths: Pick<AgentKitPaths, "hostKeyPath" | "hostKeyPubPath">, pair: HostKeyPair): void;
+export declare function writeMachineCreds(paths: Pick<AgentKitPaths, "machineCredsPath">, creds: ExternalMachineCreds): void;
+/**
+ * Read the creds file without trusting it: returns null unless it is an
+ * external-agent file with every contract field present.
+ */
+export declare function readExternalMachineCreds(paths: Pick<AgentKitPaths, "machineCredsPath">): ExternalMachineCreds | null;
+/** Whether ANY machine-creds file exists (external or hosted) at the kit path. */
+export declare function machineCredsFileExists(paths: Pick<AgentKitPaths, "machineCredsPath">): boolean;
+/**
+ * Component health stamp the kit services write and the heartbeat reads:
+ * `<status> <iso8601>` — same line shape as the hosted box's component files.
+ */
+export type ComponentStatus = "ok" | "error";
+export declare function writeComponentStatus(paths: Pick<AgentKitPaths, "stateDir">, component: KitComponent, status: ComponentStatus, now?: () => Date): void;
+export interface ComponentReading {
+    status: ComponentStatus;
+    at: Date | null;
+}
+/**
+ * Read a component stamp. A missing file, an unparseable line, or a stamp
+ * older than `staleAfterMs` reads as `error` — silence is never health.
+ */
+export declare function readComponentStatus(paths: Pick<AgentKitPaths, "stateDir">, component: KitComponent, staleAfterMs: number, now?: () => Date): ComponentReading;
+//# sourceMappingURL=creds.d.ts.map

package/dist/lib/agent-kit/creds.js

@@ -0,0 +1,123 @@
+/**
+ * Host key + machine-creds file handling for external agents.
+ *
+ * The private key and the creds file are the whole credential: a stolen
+ * creds file without the key mints nothing (hq-cloud signs every mint with
+ * the key), so both are written 0600 and never printed. Nothing in this
+ * module reads `~/.hq/cognito-tokens.json` — a human's session is never
+ * consulted, copied, or reused by an agent identity (policy
+ * never-extract-stored-session-tokens-to-forge-privileged-calls).
+ */
+import { createHash, createPublicKey, generateKeyPairSync } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { componentStatePath } from "./paths.js";
+/** Contract fingerprint: sha256(DER SPKI public key) hex, first 16 chars. */
+export function hostFingerprint(publicPem) {
+    const der = createPublicKey(publicPem).export({ type: "spki", format: "der" });
+    return createHash("sha256").update(der).digest("hex").slice(0, 16);
+}
+export function generateHostKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    const privatePem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+    const publicPem = publicKey.export({ type: "spki", format: "pem" }).toString();
+    return { privatePem, publicPem, fingerprint: hostFingerprint(publicPem) };
+}
+/** Write a file atomically with the given mode, replacing any existing one. */
+function writePrivateFile(dest, contents, mode) {
+    fs.mkdirSync(path.dirname(dest), { recursive: true, mode: 0o700 });
+    const tmp = `${dest}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, contents, { mode });
+    fs.chmodSync(tmp, mode);
+    fs.renameSync(tmp, dest);
+}
+export function writeHostKeyPair(paths, pair) {
+    writePrivateFile(paths.hostKeyPath, pair.privatePem, 0o600);
+    writePrivateFile(paths.hostKeyPubPath, pair.publicPem, 0o644);
+}
+export function writeMachineCreds(paths, creds) {
+    writePrivateFile(paths.machineCredsPath, `${JSON.stringify(creds, null, 2)}\n`, 0o600);
+}
+/**
+ * Read the creds file without trusting it: returns null unless it is an
+ * external-agent file with every contract field present.
+ */
+export function readExternalMachineCreds(paths) {
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(paths.machineCredsPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!raw || typeof raw !== "object")
+        return null;
+    const r = raw;
+    const str = (k) => typeof r[k] === "string" && r[k].length > 0 ? r[k] : null;
+    const username = str("username");
+    const secret = str("secret");
+    const clientId = str("clientId");
+    const region = str("region");
+    const entityUid = str("entityUid");
+    const userPoolId = str("userPoolId");
+    const hostKeyPath = str("hostKeyPath");
+    const companySlug = str("companySlug");
+    const apiBaseUrl = str("apiBaseUrl");
+    if (r.runtime !== "external" ||
+        r.entityType !== "agent" ||
+        !username ||
+        !secret ||
+        !clientId ||
+        !region ||
+        !entityUid ||
+        !entityUid.startsWith("agt_") ||
+        !hostKeyPath ||
+        !companySlug ||
+        !apiBaseUrl) {
+        return null;
+    }
+    return {
+        username,
+        secret,
+        ...(userPoolId ? { userPoolId } : {}),
+        clientId,
+        region,
+        entityType: "agent",
+        entityUid,
+        runtime: "external",
+        hostKeyPath,
+        companySlug,
+        apiBaseUrl,
+    };
+}
+/** Whether ANY machine-creds file exists (external or hosted) at the kit path. */
+export function machineCredsFileExists(paths) {
+    return fs.existsSync(paths.machineCredsPath);
+}
+export function writeComponentStatus(paths, component, status, now = () => new Date()) {
+    fs.mkdirSync(paths.stateDir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(componentStatePath(paths, component), `${status} ${now().toISOString()}\n`, { mode: 0o600 });
+}
+/**
+ * Read a component stamp. A missing file, an unparseable line, or a stamp
+ * older than `staleAfterMs` reads as `error` — silence is never health.
+ */
+export function readComponentStatus(paths, component, staleAfterMs, now = () => new Date()) {
+    let line;
+    try {
+        line = fs.readFileSync(componentStatePath(paths, component), "utf8").trim();
+    }
+    catch {
+        return { status: "error", at: null };
+    }
+    const [status, iso] = line.split(/\s+/, 2);
+    const at = iso ? new Date(iso) : null;
+    if (status !== "ok" || !at || Number.isNaN(at.getTime())) {
+        return { status: "error", at: at && !Number.isNaN(at.getTime()) ? at : null };
+    }
+    if (now().getTime() - at.getTime() > staleAfterMs) {
+        return { status: "error", at };
+    }
+    return { status: "ok", at };
+}
+//# sourceMappingURL=creds.js.map

package/dist/lib/agent-kit/kit-config.d.ts

@@ -0,0 +1,29 @@
+/**
+ * ~/.hq-agent/kit.json — settings `hq agent kit install` records so the
+ * services (which only receive `hq agent kit run <service>`) know where to
+ * sync and how often. Kept separate from machine-creds.json, which is the
+ * contract-shaped credential file and nothing else.
+ */
+import type { AgentKitPaths } from "./paths.js";
+export declare const DEFAULT_SYNC_INTERVAL_MS: number;
+export declare const DEFAULT_INBOX_POLL_MS = 15000;
+export declare const DEFAULT_HEARTBEAT_INTERVAL_MS = 60000;
+export declare const DEFAULT_MESH_REFRESH_MS: number;
+export interface KitConfig {
+    /** Local HQ tree the company vault syncs into (companies/<slug>/ …). */
+    hqRoot: string;
+    syncIntervalMs: number;
+    inboxPollMs: number;
+    heartbeatIntervalMs: number;
+    meshRefreshMs: number;
+    /** Ack mirrored inbox items on the server after writing them locally. */
+    inboxAck: boolean;
+    installedAt: string;
+    cliVersion: string;
+}
+export declare function defaultHqRoot(paths: Pick<AgentKitPaths, "agentDir">): string;
+export declare function defaultKitConfig(paths: Pick<AgentKitPaths, "agentDir">, cliVersion: string, now?: () => Date): KitConfig;
+export declare function writeKitConfig(paths: Pick<AgentKitPaths, "kitConfigPath">, config: KitConfig): void;
+/** Read kit.json, falling back to defaults for any missing/invalid field. */
+export declare function readKitConfig(paths: Pick<AgentKitPaths, "kitConfigPath" | "agentDir">, cliVersion: string): KitConfig;
+//# sourceMappingURL=kit-config.d.ts.map

package/dist/lib/agent-kit/kit-config.js

@@ -0,0 +1,54 @@
+/**
+ * ~/.hq-agent/kit.json — settings `hq agent kit install` records so the
+ * services (which only receive `hq agent kit run <service>`) know where to
+ * sync and how often. Kept separate from machine-creds.json, which is the
+ * contract-shaped credential file and nothing else.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const DEFAULT_SYNC_INTERVAL_MS = 5 * 60_000;
+export const DEFAULT_INBOX_POLL_MS = 15_000;
+export const DEFAULT_HEARTBEAT_INTERVAL_MS = 60_000;
+export const DEFAULT_MESH_REFRESH_MS = 5 * 60_000;
+export function defaultHqRoot(paths) {
+    return path.join(paths.agentDir, "hq");
+}
+export function defaultKitConfig(paths, cliVersion, now = () => new Date()) {
+    return {
+        hqRoot: defaultHqRoot(paths),
+        syncIntervalMs: DEFAULT_SYNC_INTERVAL_MS,
+        inboxPollMs: DEFAULT_INBOX_POLL_MS,
+        heartbeatIntervalMs: DEFAULT_HEARTBEAT_INTERVAL_MS,
+        meshRefreshMs: DEFAULT_MESH_REFRESH_MS,
+        inboxAck: false,
+        installedAt: now().toISOString(),
+        cliVersion,
+    };
+}
+export function writeKitConfig(paths, config) {
+    fs.mkdirSync(path.dirname(paths.kitConfigPath), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(paths.kitConfigPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+}
+/** Read kit.json, falling back to defaults for any missing/invalid field. */
+export function readKitConfig(paths, cliVersion) {
+    const base = defaultKitConfig(paths, cliVersion);
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(paths.kitConfigPath, "utf8"));
+    }
+    catch {
+        return base;
+    }
+    const num = (k) => typeof raw[k] === "number" && raw[k] > 0 ? raw[k] : base[k];
+    return {
+        hqRoot: typeof raw.hqRoot === "string" && raw.hqRoot ? raw.hqRoot : base.hqRoot,
+        syncIntervalMs: num("syncIntervalMs"),
+        inboxPollMs: num("inboxPollMs"),
+        heartbeatIntervalMs: num("heartbeatIntervalMs"),
+        meshRefreshMs: num("meshRefreshMs"),
+        inboxAck: raw.inboxAck === true,
+        installedAt: typeof raw.installedAt === "string" ? raw.installedAt : base.installedAt,
+        cliVersion: typeof raw.cliVersion === "string" ? raw.cliVersion : base.cliVersion,
+    };
+}
+//# sourceMappingURL=kit-config.js.map

package/dist/lib/agent-kit/log.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Per-service log under ~/.hq-agent/logs/<service>.log, rotated at 5 MB.
+ * Lines are sanitized so a bearer token or secret reference can never land
+ * on disk even through an error message.
+ */
+import type { AgentKitPaths } from "./paths.js";
+export declare const KIT_LOG_MAX_BYTES: number;
+export type KitLogLevel = "info" | "warn" | "error";
+export type KitLogger = (level: KitLogLevel, message: string) => void;
+export declare function sanitizeLogLine(message: string): string;
+export declare function formatKitLogLine(level: KitLogLevel, message: string, now?: () => Date): string;
+export declare function createKitLogger(paths: Pick<AgentKitPaths, "logsDir">, service: string, opts?: {
+    now?: () => Date;
+    echo?: boolean;
+    maxBytes?: number;
+}): KitLogger;
+//# sourceMappingURL=log.d.ts.map

package/dist/lib/agent-kit/log.js

@@ -0,0 +1,46 @@
+/**
+ * Per-service log under ~/.hq-agent/logs/<service>.log, rotated at 5 MB.
+ * Lines are sanitized so a bearer token or secret reference can never land
+ * on disk even through an error message.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { serviceLogPath } from "./paths.js";
+export const KIT_LOG_MAX_BYTES = 5 * 1024 * 1024;
+export function sanitizeLogLine(message) {
+    return message
+        .replace(/Bearer\s+[A-Za-z0-9._-]+/gi, "Bearer [REDACTED]")
+        .replace(/eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, "[JWT REDACTED]")
+        .replace(/"secret"\s*:\s*"[^"]*"/g, '"secret":"[REDACTED]"')
+        .replace(/\r?\n/g, " ")
+        .slice(0, 1000);
+}
+export function formatKitLogLine(level, message, now = () => new Date()) {
+    return `${now().toISOString()} ${level} ${sanitizeLogLine(message)}`;
+}
+export function createKitLogger(paths, service, opts = {}) {
+    const file = serviceLogPath(paths, service);
+    const maxBytes = opts.maxBytes ?? KIT_LOG_MAX_BYTES;
+    return (level, message) => {
+        const line = formatKitLogLine(level, message, opts.now);
+        try {
+            fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+            try {
+                if (fs.statSync(file).size > maxBytes) {
+                    fs.renameSync(file, `${file}.1`);
+                }
+            }
+            catch {
+                /* no file yet */
+            }
+            fs.appendFileSync(file, `${line}\n`, { mode: 0o600 });
+        }
+        catch {
+            /* best-effort */
+        }
+        if (opts.echo) {
+            (level === "error" ? process.stderr : process.stdout).write(`${line}\n`);
+        }
+    };
+}
+//# sourceMappingURL=log.js.map

package/dist/lib/agent-kit/mcp/jsonrpc.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Minimal stdio MCP server core (JSON-RPC 2.0, newline-delimited).
+ *
+ * hq-cli carries no MCP SDK dependency and the full HQ MCP surface lives in
+ * the separate @indigoai-us/hq-mcp package (a bin, not a library). `hq agent
+ * mcp` needs only the tools subset of the protocol — initialize, ping,
+ * tools/list, tools/call — so this module implements exactly that over a
+ * transport-agnostic `dispatch()` (tests drive it directly) plus a stdio
+ * pump. Every request is answered; notifications are consumed silently;
+ * malformed input yields a JSON-RPC error rather than a crash.
+ */
+export declare const MCP_PROTOCOL_VERSIONS: readonly ["2025-06-18", "2025-03-26", "2024-11-05"];
+export declare const MCP_LATEST_PROTOCOL_VERSION: "2025-06-18";
+export interface JsonRpcRequest {
+    jsonrpc: "2.0";
+    id?: string | number | null;
+    method: string;
+    params?: unknown;
+}
+export interface JsonRpcResponse {
+    jsonrpc: "2.0";
+    id: string | number | null;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+export declare const JSONRPC_PARSE_ERROR = -32700;
+export declare const JSONRPC_INVALID_REQUEST = -32600;
+export declare const JSONRPC_METHOD_NOT_FOUND = -32601;
+export declare const JSONRPC_INVALID_PARAMS = -32602;
+export declare const JSONRPC_INTERNAL_ERROR = -32603;
+export interface McpToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+}
+export interface McpToolContent {
+    type: "text";
+    text: string;
+}
+export interface McpToolResult {
+    content: McpToolContent[];
+    isError?: boolean;
+}
+export type McpToolHandler = (args: Record<string, unknown>) => Promise<McpToolResult>;
+export interface McpTool extends McpToolDefinition {
+    handler: McpToolHandler;
+}
+export interface McpServerOptions {
+    name: string;
+    version: string;
+    instructions?: string;
+    tools: McpTool[];
+}
+export declare class McpToolInputError extends Error {
+    constructor(message: string);
+}
+export declare function textResult(text: string): McpToolResult;
+export declare function errorResult(text: string): McpToolResult;
+export declare class McpServer {
+    private readonly opts;
+    private readonly tools;
+    private initialized;
+    constructor(opts: McpServerOptions);
+    listTools(): McpToolDefinition[];
+    /**
+     * Handle one decoded message. Returns null for notifications (no reply)
+     * and for responses the client sends us (we issue no requests).
+     */
+    dispatch(message: unknown): Promise<JsonRpcResponse | null>;
+    /** Decode one line, dispatch, and encode the reply (or null). */
+    handleLine(line: string): Promise<string | null>;
+    isInitialized(): boolean;
+    /**
+     * Pump newline-delimited messages from `input` to `output` until EOF.
+     * Requests are processed strictly in order so tool side effects (a DM
+     * send, a secrets exec) never interleave.
+     */
+    serve(input: NodeJS.ReadableStream, output: NodeJS.WritableStream): Promise<void>;
+}
+//# sourceMappingURL=jsonrpc.d.ts.map

package/dist/lib/agent-kit/mcp/jsonrpc.js

@@ -0,0 +1,164 @@
+/**
+ * Minimal stdio MCP server core (JSON-RPC 2.0, newline-delimited).
+ *
+ * hq-cli carries no MCP SDK dependency and the full HQ MCP surface lives in
+ * the separate @indigoai-us/hq-mcp package (a bin, not a library). `hq agent
+ * mcp` needs only the tools subset of the protocol — initialize, ping,
+ * tools/list, tools/call — so this module implements exactly that over a
+ * transport-agnostic `dispatch()` (tests drive it directly) plus a stdio
+ * pump. Every request is answered; notifications are consumed silently;
+ * malformed input yields a JSON-RPC error rather than a crash.
+ */
+export const MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
+export const MCP_LATEST_PROTOCOL_VERSION = MCP_PROTOCOL_VERSIONS[0];
+export const JSONRPC_PARSE_ERROR = -32700;
+export const JSONRPC_INVALID_REQUEST = -32600;
+export const JSONRPC_METHOD_NOT_FOUND = -32601;
+export const JSONRPC_INVALID_PARAMS = -32602;
+export const JSONRPC_INTERNAL_ERROR = -32603;
+export class McpToolInputError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "McpToolInputError";
+    }
+}
+export function textResult(text) {
+    return { content: [{ type: "text", text }] };
+}
+export function errorResult(text) {
+    return { content: [{ type: "text", text }], isError: true };
+}
+function ok(id, result) {
+    return { jsonrpc: "2.0", id, result };
+}
+function fail(id, code, message, data) {
+    return { jsonrpc: "2.0", id, error: { code, message, ...(data !== undefined ? { data } : {}) } };
+}
+export class McpServer {
+    opts;
+    tools = new Map();
+    initialized = false;
+    constructor(opts) {
+        this.opts = opts;
+        for (const tool of opts.tools) {
+            if (this.tools.has(tool.name))
+                throw new Error(`duplicate MCP tool ${tool.name}`);
+            this.tools.set(tool.name, tool);
+        }
+    }
+    listTools() {
+        return [...this.tools.values()].map(({ name, description, inputSchema }) => ({
+            name,
+            description,
+            inputSchema,
+        }));
+    }
+    /**
+     * Handle one decoded message. Returns null for notifications (no reply)
+     * and for responses the client sends us (we issue no requests).
+     */
+    async dispatch(message) {
+        if (!message || typeof message !== "object" || Array.isArray(message)) {
+            return fail(null, JSONRPC_INVALID_REQUEST, "expected a JSON-RPC object");
+        }
+        const msg = message;
+        if (typeof msg.method !== "string") {
+            // A response to a server-initiated request; we never send any.
+            if ("result" in msg || "error" in msg)
+                return null;
+            return fail(msg.id ?? null, JSONRPC_INVALID_REQUEST, "missing method");
+        }
+        const isNotification = msg.id === undefined;
+        const id = msg.id ?? null;
+        const params = (msg.params && typeof msg.params === "object" ? msg.params : {});
+        if (isNotification) {
+            if (msg.method === "notifications/initialized")
+                this.initialized = true;
+            return null;
+        }
+        switch (msg.method) {
+            case "initialize": {
+                const requested = typeof params.protocolVersion === "string" ? params.protocolVersion : "";
+                const protocolVersion = MCP_PROTOCOL_VERSIONS.includes(requested)
+                    ? requested
+                    : MCP_LATEST_PROTOCOL_VERSION;
+                return ok(id, {
+                    protocolVersion,
+                    capabilities: { tools: { listChanged: false } },
+                    serverInfo: { name: this.opts.name, version: this.opts.version },
+                    ...(this.opts.instructions ? { instructions: this.opts.instructions } : {}),
+                });
+            }
+            case "ping":
+                return ok(id, {});
+            case "tools/list":
+                return ok(id, { tools: this.listTools() });
+            case "tools/call": {
+                const name = typeof params.name === "string" ? params.name : "";
+                const tool = this.tools.get(name);
+                if (!tool)
+                    return fail(id, JSONRPC_INVALID_PARAMS, `unknown tool: ${name || "(missing name)"}`);
+                const args = params.arguments && typeof params.arguments === "object" && !Array.isArray(params.arguments)
+                    ? params.arguments
+                    : {};
+                try {
+                    return ok(id, await tool.handler(args));
+                }
+                catch (err) {
+                    if (err instanceof McpToolInputError)
+                        return fail(id, JSONRPC_INVALID_PARAMS, err.message);
+                    // Tool execution failures are results, not protocol errors, so the
+                    // model can read and react to them.
+                    return ok(id, errorResult(err instanceof Error ? err.message : String(err)));
+                }
+            }
+            default:
+                return fail(id, JSONRPC_METHOD_NOT_FOUND, `method not found: ${msg.method}`);
+        }
+    }
+    /** Decode one line, dispatch, and encode the reply (or null). */
+    async handleLine(line) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            return null;
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch {
+            return JSON.stringify(fail(null, JSONRPC_PARSE_ERROR, "invalid JSON"));
+        }
+        const reply = await this.dispatch(parsed);
+        return reply ? JSON.stringify(reply) : null;
+    }
+    isInitialized() {
+        return this.initialized;
+    }
+    /**
+     * Pump newline-delimited messages from `input` to `output` until EOF.
+     * Requests are processed strictly in order so tool side effects (a DM
+     * send, a secrets exec) never interleave.
+     */
+    async serve(input, output) {
+        let buffer = "";
+        const write = (s) => new Promise((resolve, reject) => output.write(`${s}\n`, (err) => (err ? reject(err) : resolve())));
+        input.setEncoding("utf8");
+        for await (const chunk of input) {
+            buffer += chunk;
+            let nl;
+            while ((nl = buffer.indexOf("\n")) >= 0) {
+                const line = buffer.slice(0, nl);
+                buffer = buffer.slice(nl + 1);
+                const reply = await this.handleLine(line);
+                if (reply)
+                    await write(reply);
+            }
+        }
+        if (buffer.trim()) {
+            const reply = await this.handleLine(buffer);
+            if (reply)
+                await write(reply);
+        }
+    }
+}
+//# sourceMappingURL=jsonrpc.js.map