@jonaspauleta/cursor-bridge 0.2.0

package/dist/validate.js

@@ -0,0 +1,112 @@
+import { realpathSync, existsSync } from "node:fs";
+import { resolve, sep, dirname } from "node:path";
+import { ValidationError } from "./errors.js";
+const MODES = ["default", "plan", "ask"];
+const MODELS = new Set([
+    "composer-2.5-fast",
+    "composer-2.5",
+    "claude-4.6-sonnet-medium",
+]);
+const SHA_RE = /^[0-9a-f]{7,40}$/;
+export function assertMode(mode) {
+    if (!MODES.includes(mode)) {
+        throw new ValidationError(`invalid mode: ${JSON.stringify(mode)} (expected default|plan|ask)`);
+    }
+    return mode;
+}
+export function assertModel(model) {
+    if (!MODELS.has(model)) {
+        throw new ValidationError(`model not allowlisted: ${JSON.stringify(model)}`);
+    }
+    return model;
+}
+// Exported for the Part B orchestrator's mechanical SHA resolution: it validates
+// BASE_SHA/HEAD_SHA before they reach the final-gate `git diff` command.
+// Not imported by the server runtime — this is intentional, not dead code.
+export function assertSha(sha) {
+    if (!SHA_RE.test(sha)) {
+        throw new ValidationError(`not a valid git SHA (need 7-40 hex): ${JSON.stringify(sha)}`);
+    }
+    return sha;
+}
+/**
+ * Returns the canonical (realpath'd) cwd if it is the allowed root or strictly
+ * within it. Rejects traversal/expansion tokens before touching the FS, then
+ * defeats symlink escapes by canonicalizing both sides and prefix-checking.
+ */
+export function assertWorkspacePath(cwd, allowedRoot) {
+    if (cwd.includes("..") || cwd.startsWith("~")) {
+        throw new ValidationError(`workspace path rejected (traversal/expansion): ${cwd}`);
+    }
+    const root = realpathSync(resolve(allowedRoot));
+    let real;
+    try {
+        real = realpathSync(resolve(cwd));
+    }
+    catch {
+        throw new ValidationError(`workspace path does not exist: ${cwd}`);
+    }
+    if (real !== root && !real.startsWith(root + sep)) {
+        throw new ValidationError(`workspace path escapes allowed root: ${cwd}`);
+    }
+    return real;
+}
+const IMAGE_SIZES = new Set(["auto", "1024x1024", "1536x1024", "1024x1536"]);
+const IMAGE_QUALITIES = new Set(["auto", "low", "medium", "high"]);
+const IMAGE_EXT_RE = /\.(png|jpe?g|webp)$/i;
+const MAX_REFERENCE_IMAGES = 8;
+export function assertCount(count) {
+    if (!Number.isInteger(count) || count < 1 || count > 10) {
+        throw new ValidationError(`count out of range (expected integer 1-10): ${JSON.stringify(count)}`);
+    }
+    return count;
+}
+export function assertSize(size) {
+    if (!IMAGE_SIZES.has(size)) {
+        throw new ValidationError(`size not allowlisted: ${JSON.stringify(size)} (auto|1024x1024|1536x1024|1024x1536)`);
+    }
+    return size;
+}
+export function assertQuality(quality) {
+    if (!IMAGE_QUALITIES.has(quality)) {
+        throw new ValidationError(`quality not allowlisted: ${JSON.stringify(quality)} (auto|low|medium|high)`);
+    }
+    return quality;
+}
+/**
+ * Validates an output directory that MAY NOT EXIST YET (unlike assertWorkspacePath,
+ * which requires existence). Rejects traversal/expansion, lexically checks the full
+ * resolved path against the canonical root, then realpath-checks the nearest existing
+ * ancestor to defeat symlink escapes through existing directories.
+ */
+export function assertOutputDir(dir, allowedRoot) {
+    if (dir.includes("..") || dir.startsWith("~")) {
+        throw new ValidationError(`output dir rejected (traversal/expansion): ${dir}`);
+    }
+    const root = realpathSync(resolve(allowedRoot));
+    const abs = resolve(dir);
+    if (abs !== root && !abs.startsWith(root + sep)) {
+        throw new ValidationError(`output dir escapes allowed root: ${dir}`);
+    }
+    let probe = abs;
+    while (!existsSync(probe) && dirname(probe) !== probe) {
+        probe = dirname(probe);
+    }
+    const realProbe = realpathSync(probe);
+    if (realProbe !== root && !realProbe.startsWith(root + sep)) {
+        throw new ValidationError(`output dir escapes allowed root (symlink): ${dir}`);
+    }
+    return abs;
+}
+export function assertReferenceImages(paths, allowedRoot) {
+    if (paths.length > MAX_REFERENCE_IMAGES) {
+        throw new ValidationError(`too many reference images (max ${MAX_REFERENCE_IMAGES}): ${paths.length}`);
+    }
+    return paths.map((p) => {
+        if (!IMAGE_EXT_RE.test(p)) {
+            throw new ValidationError(`reference image not an allowed type (png|jpg|jpeg|webp): ${p}`);
+        }
+        return assertWorkspacePath(p, allowedRoot); // requires existence + containment
+    });
+}
+//# sourceMappingURL=validate.js.map

package/dist/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAI9C,MAAM,KAAK,GAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS;IAC7B,mBAAmB;IACnB,cAAc;IACd,0BAA0B;CAC3B,CAAC,CAAC;AACH,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAElC,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAkB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,IAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,yEAAyE;AACzE,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,WAAmB;IAClE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,eAAe,CAAC,kDAAkD,GAAG,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAKD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AACrF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3E,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,eAAe,CAAC,+CAA+C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,IAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,OAAuB,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,WAAmB;IAC9D,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,eAAe,CAAC,8CAA8C,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACtD,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,eAAe,CAAC,8CAA8C,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAe,EAAE,WAAmB;IACxE,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CAAC,kCAAkC,oBAAoB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,4DAA4D,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,mBAAmB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,mCAAmC;IACjF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@jonaspauleta/cursor-bridge",
+  "version": "0.2.0",
+  "description": "MCP server bridging the cursor-agent and codex CLIs to Claude Code: run_cursor_agent (Composer 2.5) and generate_image (gpt-image-2).",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "claude-code",
+    "cursor-agent",
+    "codex",
+    "gpt-image-2",
+    "stdio",
+    "ai"
+  ],
+  "license": "MIT",
+  "author": "João Paulo Santos <jonaspauleta2@gmail.com>",
+  "type": "module",
+  "bin": { "cursor-bridge": "dist/index.js" },
+  "files": ["dist"],
+  "engines": { "node": ">=20" },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jonaspauleta/cursor-bridge.git"
+  },
+  "homepage": "https://github.com/jonaspauleta/cursor-bridge#readme",
+  "bugs": { "url": "https://github.com/jonaspauleta/cursor-bridge/issues" },
+  "publishConfig": { "access": "public" },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "tsx src/index.ts",
+    "start": "node dist/index.js",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:smoke": "RUN_CURSOR_SMOKE=1 vitest run smoke",
+    "test:smoke:codex": "RUN_CODEX_SMOKE=1 vitest run codex.smoke",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm run typecheck && npm test"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.22.3",
+    "typescript": "^5.9.0",
+    "vitest": "^4.1.0"
+  }
+}