@kernlang/mcp 3.1.6 → 3.1.7

package/dist/transpiler-mcp.js

@@ -1,4 +1,4 @@
-import { accountNode, buildDiagnostics, camelKey, countTokens, getChildren, getFirstChild, getProps, serializeIR } from '@kernlang/core';
+import { accountNode, buildDiagnostics, camelKey, countTokens, getChildren, getFirstChild, getProps, serializeIR, } from '@kernlang/core';
 // ── Helpers ─────────────────────────────────────────────────────────────
 function json(value) {
     return JSON.stringify(value);
@@ -21,17 +21,20 @@ function str(value) {
 function extractDescription(node) {
     const props = getProps(node);
     const descNode = getFirstChild(node, 'description');
-    const raw = str(props.description)
-        || (descNode ? str(getProps(descNode).text) || str(getProps(descNode).value) : undefined)
-        || '';
+    const raw = str(props.description) ||
+        (descNode ? str(getProps(descNode).text) || str(getProps(descNode).value) : undefined) ||
+        '';
     return raw.replace(/[\u0000-\u001F\u007F-\u009F]/g, '').trim();
 }
 function indent(code, spaces) {
     const prefix = ' '.repeat(spaces);
-    return code.split('\n').map(line => line.length > 0 ? `${prefix}${line}` : '');
+    return code.split('\n').map((line) => (line.length > 0 ? `${prefix}${line}` : ''));
 }
 function splitCsv(value) {
-    return (value || '').split(',').map(p => p.trim()).filter(Boolean);
+    return (value || '')
+        .split(',')
+        .map((p) => p.trim())
+        .filter(Boolean);
 }
 // ── Guard collection (from Codex — robust prop aliases) ─────────────────
 function guardTarget(props) {
@@ -40,11 +43,20 @@ function guardTarget(props) {
 function collectGuard(node, fallbackAllowlist) {
     const props = getProps(node);
     const kind = str(props.name) || str(props.kind) || str(props.type);
-    if (kind !== 'sanitize' && kind !== 'pathContainment' && kind !== 'validate')
+    const validKinds = [
+        'sanitize',
+        'pathContainment',
+        'validate',
+        'auth',
+        'rateLimit',
+        'sizeLimit',
+        'sanitizeOutput',
+    ];
+    if (!validKinds.includes(kind))
         return null;
     const rawAllow = splitCsv(str(props.allowlist) || str(props.allow) || str(props.roots));
     return {
-        kind,
+        kind: kind,
         target: guardTarget(props),
         pattern: str(props.pattern),
         replacement: str(props.replacement),
@@ -53,15 +65,66 @@ function collectGuard(node, fallbackAllowlist) {
         regex: str(props.regex),
         baseDir: str(props.baseDir) || str(props.base) || str(props.root),
         allowlist: rawAllow.length > 0 ? rawAllow : fallbackAllowlist,
+        envVar: str(props.envVar) || str(props.env),
+        header: str(props.header),
+        windowMs: str(props.windowMs) || str(props.window),
+        maxRequests: str(props.maxRequests) || str(props.requests),
+        maxBytes: str(props.maxBytes) || (kind === 'sizeLimit' ? str(props.max) : undefined),
     };
 }
 function isPathLikeParam(name) {
-    return /(?:path|file|dir|root|workspace)/i.test(name);
+    return /(?:^|[_A-Z])(?:path|file|dir(?:ectory)?|root|workspace)(?:$|[_A-Z])/i.test(name);
+}
+// ── Handler effect detection — auto-inject guards for effects found in handler code ──
+const FILE_IO_PATTERN = /\b(readFile|readFileSync|writeFile|writeFileSync|readdir|readdirSync|unlink|unlinkSync|copyFile|rename|mkdir|rmdir|openSync|createReadStream|createWriteStream)\b/;
+const SHELL_EXEC_PATTERN = /\b(exec|execSync|execFile|execFileSync|spawn|spawnSync|child_process)\b/;
+const NETWORK_PATTERN = /\b(fetch|http\.request|https\.request|axios|got\.get|got\.post)\b/;
+function detectHandlerEffects(handlerCode) {
+    return {
+        fileIO: FILE_IO_PATTERN.test(handlerCode),
+        shellExec: SHELL_EXEC_PATTERN.test(handlerCode),
+        network: NETWORK_PATTERN.test(handlerCode),
+    };
+}
+/**
+ * Auto-inject missing guards based on handler code effects.
+ * If handler uses readFileSync but no param has pathContainment → inject on string params.
+ * If handler uses exec but no param has sanitize → inject sanitize on string params.
+ */
+function autoInjectEffectGuards(params, parentGuards, effects, fallbackAllowlist) {
+    const allGuards = [...params.flatMap((p) => p.guards), ...parentGuards];
+    const stringParams = params.filter((p) => p.type === 'string');
+    if (stringParams.length === 0)
+        return;
+    // File I/O without pathContainment → inject on all string params
+    if (effects.fileIO && !allGuards.some((g) => g.kind === 'pathContainment')) {
+        for (const p of stringParams) {
+            if (!p.guards.some((g) => g.kind === 'pathContainment')) {
+                p.guards.push({ kind: 'pathContainment', target: p.name, allowlist: fallbackAllowlist });
+            }
+        }
+    }
+    // Shell exec without sanitize on all string params → inject
+    if (effects.shellExec) {
+        for (const p of stringParams) {
+            if (!p.guards.some((g) => g.kind === 'sanitize')) {
+                p.guards.push({ kind: 'sanitize', target: p.name, allowlist: [] });
+            }
+        }
+    }
+    // Network calls without sanitize → inject sanitize on string params
+    if (effects.network) {
+        for (const p of stringParams) {
+            if (!p.guards.some((g) => g.kind === 'sanitize')) {
+                p.guards.push({ kind: 'sanitize', target: p.name, allowlist: [] });
+            }
+        }
+    }
 }
 function collectParams(node, fallbackAllowlist) {
     const paramNodes = getChildren(node, 'param');
     const parentGuards = getChildren(node, 'guard')
-        .map(g => collectGuard(g, fallbackAllowlist))
+        .map((g) => collectGuard(g, fallbackAllowlist))
         .filter((g) => !!g);
     return paramNodes.map((paramNode) => {
         const props = getProps(paramNode);
@@ -69,12 +132,12 @@ function collectParams(node, fallbackAllowlist) {
         const type = str(props.type) || 'string';
         const guards = [
             ...getChildren(paramNode, 'guard')
-                .map(g => collectGuard(g, fallbackAllowlist))
+                .map((g) => collectGuard(g, fallbackAllowlist))
                 .filter((g) => !!g),
-            ...parentGuards.filter(g => !g.target ? paramNodes.length === 1 : g.target === name),
+            ...parentGuards.filter((g) => (!g.target ? paramNodes.length === 1 : g.target === name)),
         ];
         // Auto-inject pathContainment for path-like params (from Codex)
-        if (!guards.some(g => g.kind === 'pathContainment') && isPathLikeParam(name)) {
+        if (!guards.some((g) => g.kind === 'pathContainment') && isPathLikeParam(name)) {
             guards.push({ kind: 'pathContainment', target: name, allowlist: fallbackAllowlist });
         }
         return {
@@ -118,28 +181,49 @@ function zodForParam(param) {
             expr = 'z.string()';
             break;
     }
-    // Apply validate guards
-    for (const guard of param.guards.filter(g => g.kind === 'validate')) {
-        if (guard.min)
+    // Apply validate guards — skip NaN values from malformed .kern input
+    for (const guard of param.guards.filter((g) => g.kind === 'validate')) {
+        if (guard.min && !Number.isNaN(Number(guard.min)))
             expr += `.min(${Number(guard.min)})`;
-        if (guard.max)
+        if (guard.max && !Number.isNaN(Number(guard.max)))
             expr += `.max(${Number(guard.max)})`;
-        if (guard.regex)
-            expr += `.regex(new RegExp(${json(guard.regex)}))`;
+        if (guard.regex) {
+            try {
+                new RegExp(guard.regex);
+                expr += `.regex(new RegExp(${json(guard.regex)}))`;
+            }
+            catch {
+                /* skip invalid regex — ReDoS prevention */
+            }
+        }
     }
-    // Apply inline min/max/regex from param props
+    // Apply inline min/max from param props — skip NaN
     const pp = getProps(param.node);
-    if (pp.min !== undefined && !param.guards.some(g => g.kind === 'validate' && g.min)) {
+    if (pp.min !== undefined &&
+        !Number.isNaN(Number(pp.min)) &&
+        !param.guards.some((g) => g.kind === 'validate' && g.min)) {
         expr += `.min(${Number(pp.min)})`;
     }
-    if (pp.max !== undefined && !param.guards.some(g => g.kind === 'validate' && g.max)) {
+    if (pp.max !== undefined &&
+        !Number.isNaN(Number(pp.max)) &&
+        !param.guards.some((g) => g.kind === 'validate' && g.max)) {
         expr += `.max(${Number(pp.max)})`;
     }
     if (param.description) {
         expr += `.describe(${json(param.description)})`;
     }
     if (param.defaultValue !== undefined) {
-        const dv = param.type === 'number' || param.type === 'int' ? param.defaultValue : json(param.defaultValue);
+        const t = param.type;
+        const isNumeric = t === 'number' || t === 'float' || t === 'int' || t === 'integer';
+        const dv = isNumeric
+            ? Number.isNaN(Number(param.defaultValue))
+                ? '0'
+                : param.defaultValue
+            : t === 'boolean' || t === 'bool'
+                ? param.defaultValue === 'true'
+                    ? 'true'
+                    : 'false'
+                : json(param.defaultValue);
         expr += `.default(${dv})`;
     }
     else if (param.optional) {
@@ -152,27 +236,99 @@ function emitGuardLines(params) {
     const lines = [];
     for (const param of params) {
         const accessor = `params[${json(param.name)}]`;
-        for (const guard of param.guards.filter(g => g.kind === 'sanitize')) {
+        for (const guard of param.guards.filter((g) => g.kind === 'sanitize')) {
             const pattern = guard.pattern || '[^\\w./ -]';
+            // Validate regex at transpile time to prevent ReDoS in generated code
+            try {
+                new RegExp(pattern);
+            }
+            catch {
+                continue;
+            }
             lines.push(`${accessor} = sanitizeValue(${accessor}, ${json(pattern)}, ${json(guard.replacement || '')});`);
         }
-        const pathGuard = param.guards.find(g => g.kind === 'pathContainment');
+        const pathGuard = param.guards.find((g) => g.kind === 'pathContainment');
         if (pathGuard) {
+            // Guard against undefined/null becoming the string "undefined"
+            lines.push(`if (${accessor} == null || ${accessor} === "") throw new Error("${param.name} is required for path containment check");`);
             const base = pathGuard.baseDir
                 ? `path.resolve(${json(pathGuard.baseDir)}, String(${accessor}))`
                 : `path.resolve(String(${accessor}))`;
-            lines.push(`${accessor} = ensurePathContainment(${base}, ALLOWED_PATHS);`);
+            // Use guard-specific allowlist if set, otherwise fall back to global ALLOWED_PATHS
+            const hasExplicitAllowlist = pathGuard.allowlist.length > 0 &&
+                !(pathGuard.allowlist.length === 1 && pathGuard.allowlist[0] === 'process.cwd()');
+            if (hasExplicitAllowlist) {
+                const inlineList = `[${pathGuard.allowlist.map((v) => json(v)).join(', ')}].map(r => path.resolve(r))`;
+                lines.push(`${accessor} = ensurePathContainment(${base}, ${inlineList});`);
+            }
+            else {
+                lines.push(`${accessor} = ensurePathContainment(${base}, ALLOWED_PATHS);`);
+            }
+        }
+        // sizeLimit guard — check byte length of string params
+        for (const guard of param.guards.filter((g) => g.kind === 'sizeLimit')) {
+            const maxBytes = guard.maxBytes || guard.max || '1048576';
+            lines.push(`if (typeof ${accessor} === "string" && Buffer.byteLength(${accessor}) > ${maxBytes}) throw new Error("Input ${param.name} exceeds size limit of ${maxBytes} bytes");`);
         }
     }
     return lines;
 }
+/** Emit tool-level (non-param) guard lines — auth and rateLimit apply per-tool, not per-param. */
+function emitToolGuardLines(node) {
+    const guards = getChildren(node, 'guard');
+    const pre = [];
+    const helpers = new Set();
+    let sanitizeOutput = false;
+    for (const g of guards) {
+        const props = getProps(g);
+        const kind = str(props.name) || str(props.kind) || str(props.type);
+        if (kind === 'auth') {
+            const envVar = str(props.envVar) || str(props.env) || 'MCP_AUTH_TOKEN';
+            const header = str(props.header) || 'authorization';
+            helpers.add('auth');
+            pre.push(`checkAuth(${json(envVar)}, ${json(header)});`);
+        }
+        if (kind === 'rateLimit') {
+            const windowMs = str(props.windowMs) || str(props.window) || '60000';
+            const maxReqs = str(props.maxRequests) || str(props.requests) || '100';
+            helpers.add('rateLimit');
+            pre.push(`checkRateLimit(${json(str(getProps(node).name) || 'tool')}, ${windowMs}, ${maxReqs});`);
+        }
+        if (kind === 'sanitizeOutput') {
+            sanitizeOutput = true;
+            helpers.add('sanitizeOutput');
+        }
+    }
+    return { pre, helpers, sanitizeOutput };
+}
 // ── Tool / Resource / Prompt emission ───────────────────────────────────
-function emitTool(node, fallbackAllowlist) {
+function emitTool(node, fallbackAllowlist, requiredHelpers) {
     const name = str(getProps(node).name) || 'tool';
     const description = extractDescription(node) || `Run ${name}`;
     const params = collectParams(node, fallbackAllowlist);
     const handlerNode = getFirstChild(node, 'handler');
     const handlerCode = handlerNode ? str(getProps(handlerNode).code) || '' : '';
+    // Auto-inject guards based on handler effects (secure by construction)
+    const effects = detectHandlerEffects(handlerCode);
+    const parentGuards = getChildren(node, 'guard')
+        .map((g) => collectGuard(g, fallbackAllowlist))
+        .filter((g) => !!g);
+    autoInjectEffectGuards(params, parentGuards, effects, fallbackAllowlist);
+    // Auto-inject sanitizeOutput if handler calls external APIs and no sanitizeOutput guard exists
+    if (effects.network && !getChildren(node, 'guard').some((g) => str(getProps(g).type) === 'sanitizeOutput')) {
+        // Add sanitizeOutput as a tool-level guard node so emitToolGuardLines picks it up
+        const syntheticGuard = { type: 'guard', props: { type: 'sanitizeOutput' } };
+        if (!node.children)
+            node.children = [];
+        node.children.push(syntheticGuard);
+    }
+    const toolGuards = emitToolGuardLines(node);
+    for (const h of toolGuards.helpers)
+        requiredHelpers.add(h);
+    // Detect sampling/elicitation children — if present, handler gets extra context
+    const hasSampling = getFirstChild(node, 'sampling') !== undefined;
+    const hasElicitation = getFirstChild(node, 'elicitation') !== undefined;
+    const needsContext = hasSampling || hasElicitation;
     const lines = [];
     // Zod schema object
     if (params.length > 0) {
@@ -183,26 +339,76 @@ function emitTool(node, fallbackAllowlist) {
         lines.push(`};`);
         lines.push('');
     }
-    lines.push(`server.tool(${json(name)}, ${json(description)}, ${params.length > 0 ? `${camelKey(name)}Schema` : '{}'}, async (input) => {`);
+    lines.push(`server.tool(${json(name)}, ${json(description)}, ${params.length > 0 ? `${camelKey(name)}Schema` : '{}'}, async (input${needsContext ? ', extra' : ''}) => {`);
     lines.push(`  const requestId = nextRequestId();`);
     lines.push(`  logger.info("tool:call", { requestId, tool: ${json(name)} });`);
     lines.push(`  try {`);
+    // Tool-level guards (auth, rateLimit)
+    for (const line of toolGuards.pre) {
+        lines.push(`    ${line}`);
+    }
     if (params.length > 0) {
-        lines.push(`    const params = { ...input } as Record<string, unknown>;`);
-        for (const line of emitGuardLines(params)) {
-            lines.push(`    ${line}`);
+        const hasRuntimeGuards = params.some((p) => p.guards.some((g) => g.kind === 'sanitize' || g.kind === 'pathContainment' || g.kind === 'sizeLimit'));
+        if (hasRuntimeGuards) {
+            // Guards may mutate values — use Record<string, unknown> for mutation, then expose as args
+            lines.push(`    const params = { ...input } as Record<string, unknown>;`);
+            for (const line of emitGuardLines(params)) {
+                lines.push(`    ${line}`);
+            }
+            lines.push(`    const args = params as typeof input;`);
+        }
+        else {
+            // No runtime param mutations — preserve original types
+            lines.push(`    const args = input;`);
         }
     }
-    lines.push(`    const result = await (async () => {`);
-    if (handlerCode) {
-        lines.push(...indent(handlerCode, 6));
+    else {
+        lines.push(`    const args = input ?? {};`);
+    }
+    // Inject sampling/elicitation context helpers
+    if (hasSampling) {
+        const samplingNode = getFirstChild(node, 'sampling');
+        const sp = getProps(samplingNode);
+        const maxTokens = str(sp.maxTokens) || '500';
+        lines.push(`    // Sampling — request LLM completion from the client`);
+        lines.push(`    async function requestSampling(prompt: string): Promise<string> {`);
+        lines.push(`      const response = await server.server.createMessage({`);
+        lines.push(`        messages: [{ role: "user", content: { type: "text", text: prompt } }],`);
+        lines.push(`        maxTokens: ${maxTokens},`);
+        lines.push(`      });`);
+        lines.push(`      return response.content.type === "text" ? response.content.text : JSON.stringify(response.content);`);
+        lines.push(`    }`);
+    }
+    if (hasElicitation) {
+        const elicitNode = getFirstChild(node, 'elicitation');
+        const ep = getProps(elicitNode);
+        const elicitMessage = str(ep.message) || str(ep.text) || 'Please provide input';
+        lines.push(`    // Elicitation — request structured user input`);
+        lines.push(`    async function requestInput(message = ${json(elicitMessage)}): Promise<Record<string, unknown> | null> {`);
+        lines.push(`      const result = await server.server.elicitInput({ message, requestedSchema: { type: "object", properties: {} } });`);
+        lines.push(`      return result.action === "accept" ? (result.content || {}) : null;`);
+        lines.push(`    }`);
+    }
+    if (toolGuards.sanitizeOutput) {
+        // Wrap handler in output sanitization — strips prompt injection markers from responses
+        lines.push(`    const _rawResult = await (async () => {`);
+        if (handlerCode) {
+            lines.push(...indent(handlerCode, 6));
+        }
+        else {
+            lines.push(`      return { content: [{ type: "text" as const, text: ${json(`${name} completed`)} }] };`);
+        }
+        lines.push(`    })();`);
+        lines.push(`    return sanitizeToolOutput(_rawResult);`);
     }
     else {
-        lines.push(`      return { content: [{ type: "text" as const, text: ${json(`${name} completed`)} }] };`);
+        if (handlerCode) {
+            lines.push(...indent(handlerCode, 4));
+        }
+        else {
+            lines.push(`    return { content: [{ type: "text" as const, text: ${json(`${name} completed`)} }] };`);
+        }
     }
-    lines.push(`    })();`);
-    lines.push(`    logger.info("tool:ok", { requestId, tool: ${json(name)} });`);
-    lines.push(`    return normalizeToolResult(result);`);
     lines.push(`  } catch (error) {`);
     lines.push(`    logger.error("tool:error", { requestId, tool: ${json(name)}, error: fmtError(error) });`);
     lines.push(`    return { isError: true as const, content: [{ type: "text" as const, text: fmtError(error) }] };`);
@@ -221,9 +427,7 @@ function emitResource(node, fallbackAllowlist) {
     const hasTemplate = uri.includes('{');
     if (description)
         lines.push(`// ${description}`);
-    const uriArg = hasTemplate
-        ? `new ResourceTemplate(${json(uri)}, { list: undefined })`
-        : json(uri);
+    const uriArg = hasTemplate ? `new ResourceTemplate(${json(uri)}, { list: undefined })` : json(uri);
     lines.push(`server.resource(${json(name)}, ${uriArg}, async (uri${hasTemplate ? ', variables' : ''}) => {`);
     lines.push(`  logger.info("resource:read", { resource: ${json(name)}, uri: uri.href });`);
     lines.push(`  try {`);
@@ -232,16 +436,17 @@ function emitResource(node, fallbackAllowlist) {
         for (const line of emitGuardLines(params)) {
             lines.push(`    ${line}`);
         }
+        lines.push(`    const args = params;`);
+    }
+    else {
+        lines.push(`    const args = ${hasTemplate ? 'variables ?? {}' : '{}'};`);
     }
-    lines.push(`    const result = await (async () => {`);
     if (handlerCode) {
-        lines.push(...indent(handlerCode, 6));
+        lines.push(...indent(handlerCode, 4));
     }
     else {
-        lines.push(`      return { contents: [{ uri: uri.href, text: ${json(`${name} content`)} }] };`);
+        lines.push(`    return { contents: [{ uri: uri.href, text: ${json(`${name} content`)} }] };`);
     }
-    lines.push(`    })();`);
-    lines.push(`    return result;`);
     lines.push(`  } catch (error) {`);
     lines.push(`    logger.error("resource:error", { resource: ${json(name)}, error: fmtError(error) });`);
     lines.push(`    throw error;`);
@@ -249,26 +454,36 @@ function emitResource(node, fallbackAllowlist) {
     lines.push(`});`);
     return lines;
 }
-function emitPrompt(node) {
+function emitPrompt(node, fallbackAllowlist) {
     const name = str(getProps(node).name) || 'prompt';
     const description = extractDescription(node);
-    const paramNodes = getChildren(node, 'param');
+    const _paramNodes = getChildren(node, 'param');
+    const params = collectParams(node, fallbackAllowlist);
     const handlerNode = getFirstChild(node, 'handler');
     const handlerCode = handlerNode ? str(getProps(handlerNode).code) || '' : '';
     const lines = [];
     if (description)
         lines.push(`// ${description}`);
-    lines.push(`server.prompt(${json(name)}, ${json(description || name)}, [`);
-    for (const p of paramNodes) {
-        const pp = getProps(p);
-        const pName = str(pp.name) || 'input';
-        const required = str(pp.required) !== 'false';
-        lines.push(`  { name: ${json(pName)}, required: ${required} },`);
-    }
-    lines.push(`], async (args) => {`);
+    if (params.length > 0) {
+        lines.push(`server.prompt(${json(name)}, ${json(description || name)}, {`);
+        for (const param of params) {
+            lines.push(`  ${json(param.name)}: z.string()${param.optional ? '.optional()' : ''},`);
+        }
+        lines.push(`}, async (args) => {`);
+    }
+    else {
+        lines.push(`server.prompt(${json(name)}, ${json(description || name)}, async (args) => {`);
+    }
     lines.push(`  const requestId = nextRequestId();`);
     lines.push(`  logger.info("prompt:call", { requestId, prompt: ${json(name)} });`);
     lines.push(`  try {`);
+    lines.push(`    const params = args;`);
+    // Apply guards to prompt params (Bug 4 fix)
+    if (params.length > 0) {
+        for (const line of emitGuardLines(params)) {
+            lines.push(`    ${line}`);
+        }
+    }
     if (handlerCode) {
         lines.push(...indent(handlerCode, 4));
     }
@@ -305,12 +520,14 @@ function buildCode(root, _config) {
     }
     // Determine if we need path import and ResourceTemplate — scan ALL node types, not just tools
     const allNodes = [...toolNodes, ...resourceNodes, ...promptNodes];
-    const allGuards = allNodes.flatMap(n => getChildren(n, 'guard'));
-    const allParams = allNodes.flatMap(n => collectParams(n, allowlist));
-    const needsPath = allGuards.some(g => str(getProps(g).type) === 'pathContainment' || str(getProps(g).kind) === 'pathContainment')
-        || allParams.some(p => p.guards.some(g => g.kind === 'pathContainment'));
-    const needsResourceTemplate = resourceNodes.some(r => (str(getProps(r).uri) || '').includes('{'));
-    const allowlistLiteral = `[${allowlist.map(v => v === 'process.cwd()' ? 'process.cwd()' : json(v)).join(', ')}]`;
+    const allGuards = allNodes.flatMap((n) => getChildren(n, 'guard'));
+    const allParams = allNodes.flatMap((n) => collectParams(n, allowlist));
+    const needsPath = allGuards.some((g) => str(getProps(g).type) === 'pathContainment' || str(getProps(g).kind) === 'pathContainment') ||
+        allParams.some((p) => p.guards.some((g) => g.kind === 'pathContainment'));
+    const needsResourceTemplate = resourceNodes.some((r) => (str(getProps(r).uri) || '').includes('{'));
+    const transportType = str(props.transport) || 'stdio';
+    const _needsSizeLimit = allParams.some((p) => p.guards.some((g) => g.kind === 'sizeLimit'));
+    const allowlistLiteral = `[${allowlist.map((v) => (v === 'process.cwd()' ? 'process.cwd()' : json(v))).join(', ')}]`;
     const sourceMap = [];
     const lines = [];
     // ── Imports
@@ -320,10 +537,13 @@ function buildCode(root, _config) {
     else {
         lines.push(`import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";`);
     }
-    lines.push(`import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";`);
+    if (transportType === 'stdio') {
+        lines.push(`import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";`);
+    }
     lines.push(`import { z } from "zod";`);
     if (needsPath) {
         lines.push(`import path from "node:path";`);
+        lines.push(`import { realpathSync as _realpathSync } from "node:fs";`);
     }
     lines.push('');
     // ── Server instance
@@ -334,7 +554,7 @@ function buildCode(root, _config) {
     lines.push('');
     // ── Runtime helpers (auto-injected — from Codex's structured approach)
     if (needsPath) {
-        lines.push(`const ALLOWED_PATHS = ${allowlistLiteral}.map(r => path.resolve(r));`);
+        lines.push(`const ALLOWED_PATHS = ${allowlistLiteral}.map(r => { try { return _realpathSync(r); } catch { return path.resolve(r); } });`);
         lines.push('');
     }
     lines.push(`const logger = {`);
@@ -354,45 +574,131 @@ function buildCode(root, _config) {
     lines.push(`  return error instanceof Error ? error.message : String(error);`);
     lines.push(`}`);
     lines.push('');
-    if (allParams.some(p => p.guards.some(g => g.kind === 'sanitize'))) {
+    if (allParams.some((p) => p.guards.some((g) => g.kind === 'sanitize'))) {
         lines.push(`function sanitizeValue(value: unknown, pattern: string, replacement: string): unknown {`);
         lines.push(`  if (typeof value !== "string") return value;`);
-        lines.push(`  return value.replace(new RegExp(pattern, "g"), replacement);`);
+        lines.push(`  try { return value.replace(new RegExp(pattern, "g"), replacement); }`);
+        lines.push(`  catch { return value; }`);
         lines.push(`}`);
         lines.push('');
     }
     if (needsPath) {
         lines.push(`function ensurePathContainment(candidate: string, allowlist: string[]): string {`);
-        lines.push(`  const resolved = path.resolve(candidate);`);
+        lines.push(`  let resolved: string;`);
+        lines.push(`  try { resolved = _realpathSync(candidate); } catch { resolved = path.resolve(candidate); }`);
         lines.push('  const ok = allowlist.some(root => resolved === root || resolved.startsWith(`${root}${path.sep}`));');
         lines.push(`  if (!ok) throw new Error("Path escapes allowed directories: " + candidate);`);
         lines.push(`  return resolved;`);
         lines.push(`}`);
         lines.push('');
     }
-    lines.push(`function normalizeToolResult(result: unknown): { content: Array<{ type: "text"; text: string }> } {`);
-    lines.push(`  if (result && typeof result === "object" && "content" in result) return result as { content: Array<{ type: "text"; text: string }> };`);
-    lines.push(`  return { content: [{ type: "text", text: typeof result === "string" ? result : JSON.stringify(result, null, 2) }] };`);
-    lines.push(`}`);
-    lines.push('');
-    // ── Registrations
+    // ── Registrations (collect required helpers from tool guards)
+    const requiredHelpers = new Set();
     for (const toolNode of toolNodes) {
-        sourceMap.push({ irLine: toolNode.loc?.line || 0, irCol: toolNode.loc?.col || 1, outLine: lines.length + 1, outCol: 1 });
-        lines.push(...emitTool(toolNode, allowlist), '');
+        sourceMap.push({
+            irLine: toolNode.loc?.line || 0,
+            irCol: toolNode.loc?.col || 1,
+            outLine: lines.length + 1,
+            outCol: 1,
+        });
+        lines.push(...emitTool(toolNode, allowlist, requiredHelpers), '');
     }
     for (const resourceNode of resourceNodes) {
-        sourceMap.push({ irLine: resourceNode.loc?.line || 0, irCol: resourceNode.loc?.col || 1, outLine: lines.length + 1, outCol: 1 });
+        sourceMap.push({
+            irLine: resourceNode.loc?.line || 0,
+            irCol: resourceNode.loc?.col || 1,
+            outLine: lines.length + 1,
+            outCol: 1,
+        });
         lines.push(...emitResource(resourceNode, allowlist), '');
     }
     for (const promptNode of promptNodes) {
-        sourceMap.push({ irLine: promptNode.loc?.line || 0, irCol: promptNode.loc?.col || 1, outLine: lines.length + 1, outCol: 1 });
-        lines.push(...emitPrompt(promptNode), '');
+        sourceMap.push({
+            irLine: promptNode.loc?.line || 0,
+            irCol: promptNode.loc?.col || 1,
+            outLine: lines.length + 1,
+            outCol: 1,
+        });
+        lines.push(...emitPrompt(promptNode, allowlist), '');
+    }
+    // ── Inject auth/rateLimit helpers if any tool uses them (after registrations so we know what's needed)
+    const helperBlock = [];
+    if (requiredHelpers.has('auth')) {
+        helperBlock.push(`// NOTE: checkAuth is a bootstrap check — it verifies the env var exists, not that`);
+        helperBlock.push(`// the caller is authenticated. For production, add real token verification logic.`);
+        helperBlock.push(`function checkAuth(envVar: string, _header: string): void {`);
+        helperBlock.push(`  const token = process.env[envVar];`);
+        helperBlock.push(`  if (!token) throw new Error("Authentication required: set " + envVar + " environment variable");`);
+        helperBlock.push(`}`);
+        helperBlock.push('');
+    }
+    if (requiredHelpers.has('rateLimit')) {
+        helperBlock.push(`const _rateLimitStore = new Map<string, { count: number; resetAt: number }>();`);
+        helperBlock.push(`function checkRateLimit(toolName: string, windowMs: number, maxRequests: number): void {`);
+        helperBlock.push(`  const now = Date.now();`);
+        helperBlock.push(`  const entry = _rateLimitStore.get(toolName);`);
+        helperBlock.push(`  if (!entry || now > entry.resetAt) {`);
+        helperBlock.push(`    _rateLimitStore.set(toolName, { count: 1, resetAt: now + windowMs });`);
+        helperBlock.push(`    return;`);
+        helperBlock.push(`  }`);
+        helperBlock.push(`  entry.count++;`);
+        helperBlock.push(`  if (entry.count > maxRequests) throw new Error(\`Rate limit exceeded for \${toolName}: \${maxRequests} requests per \${windowMs}ms\`);`);
+        helperBlock.push(`}`);
+        helperBlock.push('');
     }
-    // ── Main entrypoint (from Codex — proper async main + fatal handler)
+    if (requiredHelpers.has('sanitizeOutput')) {
+        helperBlock.push(`/** Strip prompt injection markers from tool output — defense against indirect injection. */`);
+        helperBlock.push(`function sanitizeToolOutput<T extends { content: Array<{ type: "text"; text: string }> }>(result: T): T {`);
+        helperBlock.push(`  const INJECTION_PATTERNS = [`);
+        helperBlock.push(`    /\\b(?:ignore|disregard|forget)\\s+(?:all\\s+)?(?:previous|above|prior)\\s+instructions?/gi,`);
+        helperBlock.push(`    /\\b(?:you\\s+are|act\\s+as|pretend\\s+to\\s+be|roleplay\\s+as)\\b/gi,`);
+        helperBlock.push(`    /\\b(?:system\\s*prompt|\\<\\/?(?:system|user|assistant)\\>)/gi,`);
+        helperBlock.push(`    /\\[(?:INST|SYS|\\/?SYSTEM)\\]/gi,`);
+        helperBlock.push(`  ];`);
+        helperBlock.push(`  return {`);
+        helperBlock.push(`    ...result,`);
+        helperBlock.push(`    content: result.content.map(c => {`);
+        helperBlock.push(`      if (c.type !== "text") return c;`);
+        helperBlock.push(`      let text = c.text;`);
+        helperBlock.push(`      for (const pattern of INJECTION_PATTERNS) text = text.replace(pattern, "[FILTERED]");`);
+        helperBlock.push(`      return { ...c, text };`);
+        helperBlock.push(`    }) as T["content"],`);
+        helperBlock.push(`  };`);
+        helperBlock.push(`}`);
+        helperBlock.push('');
+    }
+    // Insert helpers before registrations
+    if (helperBlock.length > 0) {
+        const insertIdx = lines.findIndex((l) => l.includes('server.tool(') || l.includes('server.resource(') || l.includes('server.prompt('));
+        if (insertIdx >= 0) {
+            lines.splice(insertIdx, 0, ...helperBlock);
+        }
+        else {
+            lines.push(...helperBlock);
+        }
+    }
+    // ── Transport detection — check mcp node for transport prop
+    const transport = str(props.transport) || 'stdio';
+    const port = str(props.port) || '3000';
+    // ── Main entrypoint
     lines.push(`async function main(): Promise<void> {`);
-    lines.push(`  logger.info("server:start", { server: ${json(serverName)}, version: ${json(serverVersion)} });`);
-    lines.push(`  const transport = new StdioServerTransport();`);
-    lines.push(`  await server.connect(transport);`);
+    lines.push(`  logger.info("server:start", { server: ${json(serverName)}, version: ${json(serverVersion)}, transport: ${json(transport)} });`);
+    if (transport === 'http' || transport === 'streamable-http') {
+        lines.push(`  const { StreamableHTTPServerTransport } = await import("@modelcontextprotocol/sdk/server/streamableHttp.js");`);
+        lines.push(`  const _express = (await import("express")).default;`);
+        lines.push(`  const app = _express();`);
+        lines.push(`  app.use(_express.json());`);
+        lines.push(`  const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });`);
+        lines.push(`  await server.connect(transport);`);
+        lines.push(`  app.post("/mcp", async (req, res) => {`);
+        lines.push(`    await transport.handleRequest(req, res, req.body);`);
+        lines.push(`  });`);
+        lines.push(`  app.listen(${port}, () => logger.info("server:listening", { port: ${port} }));`);
+    }
+    else {
+        lines.push(`  const transport = new StdioServerTransport();`);
+        lines.push(`  await server.connect(transport);`);
+    }
     lines.push(`}`);
     lines.push('');
     lines.push(`void main().catch((error) => {`);
@@ -414,7 +720,9 @@ export function transpileMCP(root, config) {
     const tsTokenCount = countTokens(code);
     return {
         code,
-        sourceMap: sourceMap.length > 0 ? sourceMap : [{ irLine: root.loc?.line || 0, irCol: root.loc?.col || 1, outLine: 1, outCol: 1 }],
+        sourceMap: sourceMap.length > 0
+            ? sourceMap
+            : [{ irLine: root.loc?.line || 0, irCol: root.loc?.col || 1, outLine: 1, outCol: 1 }],
         irTokenCount,
         tsTokenCount,
         tokenReduction: irTokenCount === 0 ? 0 : Math.round((1 - irTokenCount / tsTokenCount) * 100),