@lifeaitools/clauth 1.30.1 → 1.30.2

package/cli/commands/serve/tools/fs.js

@@ -0,0 +1,1055 @@
+// cli/commands/serve/tools/fs.js
+// Extracted from serve.js — all fs_* MCP tool handlers + fs-only helpers.
+// Shared deps arrive via the `ctx` object; Node built-ins imported here.
+
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { appendFile, readdir, readFile, writeFile, rm, mkdir, stat, rename, cp } from "node:fs/promises";
+import fg from "fast-glob";
+import { rgPath } from "@vscode/ripgrep";
+import { execSync as execSyncTop, spawn as spawnProc, spawnSync } from "child_process";
+
+// ── fs-only constants ──────────────────────────────────────────────
+
+const FS_CACHE_TTL = 60000;
+let _fsMountsCache = null;
+let _fsMountsCacheTime = 0;
+
+const FS_UPLOAD_SESSIONS = new Map();
+const FS_UPLOAD_TTL_MS = 30 * 60 * 1000;
+const FS_MAX_CHUNKS = 500;
+const FS_MAX_CHUNK_BYTES = 128 * 1024;
+const FS_MAX_INGEST_BYTES = 25 * 1024 * 1024;
+const FS_GIT_IMPORT_ALLOWED_PREFIXES = [
+  "docs/",
+  ".rdc/plans/",
+  ".rdc/guides/",
+  ".claude/context/",
+  ".claude/rules/",
+  ".rdc/relay/from-claude-ai/",
+];
+
+// ── fs-only helpers ────────────────────────────────────────────────
+
+async function getFileserverMounts(vault, deriveToken, api) {
+  if (!vault.password) return { error: "Vault is locked — unlock first" };
+  const now = Date.now();
+  if (_fsMountsCache && now - _fsMountsCacheTime < FS_CACHE_TTL) return { mounts: _fsMountsCache };
+
+  try {
+    const { token, timestamp } = deriveToken(vault.password, vault.machineHash);
+    const result = await api.status(vault.password, vault.machineHash, token, timestamp);
+    if (result.error) return { error: result.error };
+    const mounts = [];
+    for (const s of (result.services || [])) {
+      if (s.key_type === "fileserver" && s.enabled) {
+        try {
+          const { token: t2, timestamp: ts2 } = deriveToken(vault.password, vault.machineHash);
+          const secret = await api.retrieve(vault.password, vault.machineHash, t2, ts2, s.name);
+          if (secret.value) {
+            const config = JSON.parse(secret.value);
+            mounts.push({ name: s.name, path: config.path, access: config.access || "r" });
+          }
+        } catch {}
+      }
+    }
+    _fsMountsCache = mounts;
+    _fsMountsCacheTime = now;
+    return { mounts };
+  } catch (err) {
+    return { error: `Mount lookup failed: ${err.message}` };
+  }
+}
+
+async function resolveInMount(requestedPath, mountName, vault, deriveToken, api) {
+  const { mounts, error } = await getFileserverMounts(vault, deriveToken, api);
+  if (error) return { error };
+  if (!mounts || mounts.length === 0) return { error: "No fileserver services configured. Add one with key_type='fileserver' and value: {\"path\": \"C:/Dev/regen-root\", \"access\": \"rwdg\"}  (access flags: r=read w=write d=delete g=git)" };
+  const mount = mountName ? mounts.find(m => m.name === mountName) : mounts[0];
+  if (!mount) return { error: `Mount '${mountName}' not found. Available: ${mounts.map(m => m.name).join(", ")}` };
+  if (!mount.path) return { error: `Fileserver '${mount.name}' has no path configured` };
+  const resolved = path.resolve(mount.path, requestedPath);
+  const normalized = path.normalize(resolved);
+  const relative = path.relative(path.normalize(mount.path), normalized);
+  if (relative.startsWith("..") || path.isAbsolute(relative)) {
+    return { error: `Path escapes mount: ${requestedPath}` };
+  }
+  return { resolved: normalized, mount };
+}
+
+function checkAccess(mount, flag) {
+  return mount.access.includes(flag);
+}
+
+function sha256Hex(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+
+async function atomicWriteText(filePath, content) {
+  await mkdir(path.dirname(filePath), { recursive: true });
+  const tempPath = path.join(
+    path.dirname(filePath),
+    `.${path.basename(filePath)}.tmp-${process.pid}-${Date.now()}-${crypto.randomBytes(4).toString("hex")}`
+  );
+  await writeFile(tempPath, content, "utf8");
+  await rename(tempPath, filePath);
+}
+
+async function fileInfo(filePath, requestedPath) {
+  const s = await stat(filePath);
+  const info = {
+    path: requestedPath,
+    type: s.isDirectory() ? "dir" : "file",
+    size: s.size,
+    modified: s.mtime.toISOString(),
+  };
+  if (s.isFile()) {
+    const content = await readFile(filePath);
+    info.sha256 = sha256Hex(content);
+  }
+  return info;
+}
+
+function cleanupFsUploadSessions() {
+  const cutoff = Date.now() - FS_UPLOAD_TTL_MS;
+  for (const [id, session] of FS_UPLOAD_SESSIONS) {
+    if (session.updatedAt < cutoff) FS_UPLOAD_SESSIONS.delete(id);
+  }
+}
+
+function runGit(cwd, args, opts = {}) {
+  const res = spawnSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    windowsHide: true,
+    maxBuffer: opts.maxBuffer || 10 * 1024 * 1024,
+  });
+  if (res.status !== 0) {
+    const detail = (res.stderr || res.stdout || "").trim();
+    throw new Error(`git ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`);
+  }
+  return (res.stdout || "").trim();
+}
+
+function runGitRaw(cwd, args, opts = {}) {
+  const res = spawnSync("git", args, {
+    cwd,
+    encoding: "buffer",
+    windowsHide: true,
+    maxBuffer: opts.maxBuffer || 10 * 1024 * 1024,
+  });
+  if (res.status !== 0) {
+    const detail = Buffer.concat([res.stderr || Buffer.alloc(0), res.stdout || Buffer.alloc(0)]).toString("utf8").trim();
+    throw new Error(`git ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`);
+  }
+  return res.stdout || Buffer.alloc(0);
+}
+
+async function vaultRetrieveValue(vault, service, deriveToken, api) {
+  if (!vault.password) return { error: "locked" };
+  if (vault.whitelist && !vault.whitelist.includes(service.toLowerCase())) return { error: "not_in_whitelist" };
+  const { token, timestamp } = deriveToken(vault.password, vault.machineHash);
+  return api.retrieve(vault.password, vault.machineHash, token, timestamp, service);
+}
+
+function normalizeRepoPath(p) {
+  if (!p || typeof p !== "string") return null;
+  const normalized = p.replace(/\\/g, "/").replace(/^\/+/, "");
+  const parts = normalized.split("/").filter(Boolean);
+  if (parts.length === 0 || parts.includes("..") || path.isAbsolute(p)) return null;
+  return parts.join("/");
+}
+
+function isAllowedGitImportPath(p, allowedPrefixes = FS_GIT_IMPORT_ALLOWED_PREFIXES) {
+  return allowedPrefixes.some((prefix) => p === prefix.replace(/\/$/, "") || p.startsWith(prefix));
+}
+
+// ── main dispatch ──────────────────────────────────────────────────
+
+/**
+ * Handle any fs_* MCP tool call.
+ * @param {string} name - tool name (e.g. "fs_read")
+ * @param {object} args - tool arguments
+ * @param {object} ctx  - shared context from serve.js:
+ *   { vault, mcpResult, mcpError, deriveToken, api, webdavService, fsGit }
+ * @returns {object|null} MCP response, or null if name isn't an fs_ tool
+ */
+export async function handleFsTool(name, args, ctx) {
+  const { vault, mcpResult, mcpError, deriveToken, api, webdavService, fsGit } = ctx;
+
+  const resolve = (p, mount) => resolveInMount(p, mount, vault, deriveToken, api);
+
+  switch (name) {
+    case "fs_read": {
+      const r = await resolve(args.path, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied on this mount");
+      try {
+        const content = await readFile(r.resolved, "utf8");
+        const lines = content.split("\n");
+        const offset = args.offset || 0;
+        const limit = args.limit || 500;
+        const slice = lines.slice(offset, offset + limit);
+        const numbered = slice.map((line, i) => `${offset + i + 1}\t${line}`).join("\n");
+        const header = `${r.resolved} (${lines.length} lines${offset > 0 ? `, showing ${offset + 1}-${Math.min(offset + limit, lines.length)}` : ""})`;
+        return mcpResult(`${header}\n${numbered}`);
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`File not found: ${args.path}`);
+        return mcpError(`Read failed: ${err.message}`);
+      }
+    }
+
+    case "fs_write": {
+      const r = await resolve(args.path, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+      try {
+        await atomicWriteText(r.resolved, args.content);
+        return mcpResult(`Written: ${args.path} (${Buffer.byteLength(args.content)} bytes)`);
+      } catch (err) {
+        return mcpError(`Write failed: ${err.message}`);
+      }
+    }
+
+    case "fs_stat": {
+      const r = await resolve(args.path, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied on this mount");
+      try {
+        return mcpResult(JSON.stringify(await fileInfo(r.resolved, args.path), null, 2));
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`Not found: ${args.path}`);
+        return mcpError(`Stat failed: ${err.message}`);
+      }
+    }
+
+    case "fs_append": {
+      const r = await resolve(args.path, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+      try {
+        try {
+          const current = await readFile(r.resolved);
+          if (args.expected_sha256 && sha256Hex(current) !== args.expected_sha256) {
+            return mcpError("Append rejected: current file hash does not match expected_sha256");
+          }
+        } catch (err) {
+          if (err.code !== "ENOENT") throw err;
+          if (args.expected_sha256) return mcpError("Append rejected: file does not exist for expected_sha256 guard");
+        }
+        await mkdir(path.dirname(r.resolved), { recursive: true });
+        await appendFile(r.resolved, args.content, "utf8");
+        const info = await fileInfo(r.resolved, args.path);
+        return mcpResult(JSON.stringify({ appended_bytes: Buffer.byteLength(args.content), ...info }, null, 2));
+      } catch (err) {
+        return mcpError(`Append failed: ${err.message}`);
+      }
+    }
+
+    case "fs_write_chunk": {
+      cleanupFsUploadSessions();
+      const { upload_id, chunk_index, total_chunks, content } = args;
+      const index = Number(chunk_index);
+      const total = Number(total_chunks);
+      if (!Number.isInteger(index) || !Number.isInteger(total) || index < 0 || total < 1 || index >= total) {
+        return mcpError("Invalid chunk_index/total_chunks");
+      }
+      if (total > FS_MAX_CHUNKS) return mcpError(`Too many chunks: max ${FS_MAX_CHUNKS}`);
+      if (Buffer.byteLength(content, "utf8") > FS_MAX_CHUNK_BYTES) {
+        return mcpError(`Chunk too large: max ${FS_MAX_CHUNK_BYTES} bytes`);
+      }
+
+      const r = await resolve(args.path, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+
+      const key = `${r.mount.name}:${args.path}:${upload_id}`;
+      let session = FS_UPLOAD_SESSIONS.get(key);
+      if (!session) {
+        session = { path: args.path, resolved: r.resolved, total, chunks: new Map(), expectedSha256: args.expected_sha256 || null, updatedAt: Date.now() };
+        FS_UPLOAD_SESSIONS.set(key, session);
+      }
+      if (session.total !== total || session.path !== args.path || session.resolved !== r.resolved) {
+        return mcpError("Upload id collision: path or total_chunks differs from existing session");
+      }
+      if (args.expected_sha256 && session.expectedSha256 && args.expected_sha256 !== session.expectedSha256) {
+        return mcpError("Upload id collision: expected_sha256 differs from existing session");
+      }
+
+      session.chunks.set(index, content);
+      session.updatedAt = Date.now();
+
+      if (session.chunks.size < total) {
+        return mcpResult(JSON.stringify({ upload_id, status: "staged", received_chunks: session.chunks.size, total_chunks: total }, null, 2));
+      }
+
+      const assembled = Array.from({ length: total }, (_, i) => session.chunks.get(i)).join("");
+      const actualSha = sha256Hex(assembled);
+      if (session.expectedSha256 && actualSha !== session.expectedSha256) {
+        FS_UPLOAD_SESSIONS.delete(key);
+        return mcpError(`Final SHA-256 mismatch: expected ${session.expectedSha256}, got ${actualSha}`);
+      }
+
+      try {
+        await atomicWriteText(r.resolved, assembled);
+        FS_UPLOAD_SESSIONS.delete(key);
+        return mcpResult(JSON.stringify({ upload_id, status: "written", path: args.path, bytes: Buffer.byteLength(assembled), sha256: actualSha }, null, 2));
+      } catch (err) {
+        return mcpError(`Chunked write failed: ${err.message}`);
+      }
+    }
+
+    case "fs_ingest_url": {
+      const r = await resolve(args.path, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+
+      let url;
+      try {
+        url = new URL(args.url);
+      } catch {
+        return mcpError("Invalid URL");
+      }
+      if (!["http:", "https:"].includes(url.protocol)) return mcpError("Only http(s) URLs are supported");
+
+      const maxBytes = Math.min(Number(args.max_bytes || 5 * 1024 * 1024), FS_MAX_INGEST_BYTES);
+      try {
+        const response = await fetch(url, { redirect: "follow" });
+        if (!response.ok) return mcpError(`Fetch failed: HTTP ${response.status}`);
+        const length = Number(response.headers.get("content-length") || 0);
+        if (length && length > maxBytes) return mcpError(`Fetch rejected: content-length ${length} exceeds max_bytes ${maxBytes}`);
+
+        const reader = response.body?.getReader();
+        if (!reader) return mcpError("Fetch failed: response body is not readable");
+
+        let received = 0;
+        const chunks = [];
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          received += value.byteLength;
+          if (received > maxBytes) return mcpError(`Fetch rejected: response exceeds max_bytes ${maxBytes}`);
+          chunks.push(Buffer.from(value));
+        }
+
+        const content = Buffer.concat(chunks).toString("utf8");
+        const actualSha = sha256Hex(content);
+        if (args.expected_sha256 && actualSha !== args.expected_sha256) {
+          return mcpError(`Fetched SHA-256 mismatch: expected ${args.expected_sha256}, got ${actualSha}`);
+        }
+        await atomicWriteText(r.resolved, content);
+        return mcpResult(JSON.stringify({ status: "written", path: args.path, bytes: Buffer.byteLength(content), sha256: actualSha, source: url.href }, null, 2));
+      } catch (err) {
+        return mcpError(`Ingest failed: ${err.message}`);
+      }
+    }
+
+    case "fs_import_git_files": {
+      if (!Array.isArray(args.paths) || args.paths.length === 0) return mcpError("paths must be a non-empty array");
+      if (args.paths.length > 25) return mcpError("Too many paths: max 25 per import");
+
+      const r = await resolve(".", args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+
+      const repoRoot = r.resolved;
+      const remote = args.remote || "origin";
+      const mode = args.mode || "new_only";
+      const doCommit = args.commit === true;
+      const allowedPrefixes = Array.isArray(args.allowed_prefixes) && args.allowed_prefixes.length > 0
+        ? args.allowed_prefixes.map((p) => normalizeRepoPath(p.endsWith("/") ? p : `${p}/`)).filter(Boolean)
+        : FS_GIT_IMPORT_ALLOWED_PREFIXES;
+
+      try {
+        const topLevel = path.normalize(runGit(repoRoot, ["rev-parse", "--show-toplevel"]));
+        if (topLevel.toLowerCase() !== path.normalize(repoRoot).toLowerCase()) {
+          return mcpError(`Mount root is not the git repo root: ${repoRoot} (repo root: ${topLevel})`);
+        }
+
+        const normalizedPaths = [];
+        for (const rawPath of args.paths) {
+          const normalized = normalizeRepoPath(rawPath);
+          if (!normalized) return mcpError(`Invalid repo path: ${rawPath}`);
+          if (!isAllowedGitImportPath(normalized, allowedPrefixes)) return mcpError(`Path not allowed for git import: ${normalized}`);
+          normalizedPaths.push(normalized);
+        }
+
+        if (mode === "new_only") {
+          for (const rel of normalizedPaths) {
+            const localPath = path.join(repoRoot, rel);
+            try {
+              await stat(localPath);
+              return mcpError(`Import refused: local path already exists in new_only mode: ${rel}`);
+            } catch (err) {
+              if (err.code !== "ENOENT") throw err;
+            }
+          }
+        }
+
+        if (doCommit) {
+          const staged = runGit(repoRoot, ["diff", "--cached", "--name-only"]);
+          if (staged) return mcpError(`Import refused: index already has staged files:\n${staged}`);
+          if (!args.message || !args.message.trim()) return mcpError("message is required when commit=true");
+        }
+
+        runGit(repoRoot, ["fetch", "--no-tags", remote, args.ref]);
+        const sourceCommit = runGit(repoRoot, ["rev-parse", "FETCH_HEAD"]);
+
+        for (const rel of normalizedPaths) {
+          runGit(repoRoot, ["cat-file", "-e", `${sourceCommit}:${rel}`]);
+        }
+
+        runGit(repoRoot, ["restore", `--source=${sourceCommit}`, "--", ...normalizedPaths]);
+
+        const imported = [];
+        for (const rel of normalizedPaths) {
+          const localPath = path.join(repoRoot, rel);
+          const info = await fileInfo(localPath, rel);
+          const sourceBlob = runGit(repoRoot, ["rev-parse", `${sourceCommit}:${rel}`]);
+          const sourceSize = Number(runGitRaw(repoRoot, ["cat-file", "-s", `${sourceCommit}:${rel}`]).toString("utf8").trim());
+          imported.push({ ...info, source_blob: sourceBlob, source_size: sourceSize });
+        }
+
+        let localCommit = null;
+        if (doCommit) {
+          runGit(repoRoot, ["add", "--", ...normalizedPaths]);
+          const body = [
+            args.message.trim(),
+            "",
+            "Imported from Claude.ai GitHub upload.",
+            "",
+            `Source remote: ${remote}`,
+            `Source ref: ${args.ref}`,
+            `Source commit: ${sourceCommit}`,
+            "",
+            "Paths:",
+            ...normalizedPaths.map((p) => `- ${p}`),
+          ].join("\n");
+          runGit(repoRoot, ["commit", "-m", body]);
+          localCommit = runGit(repoRoot, ["rev-parse", "HEAD"]);
+        }
+
+        return mcpResult(JSON.stringify({
+          status: "ok",
+          mode,
+          committed: doCommit,
+          source_commit: sourceCommit,
+          local_commit: localCommit,
+          imported,
+        }, null, 2));
+      } catch (err) {
+        return mcpError(`Git import failed: ${err.message}`);
+      }
+    }
+
+    case "fs_list": {
+      const dirPath = args.path || ".";
+      const r = await resolve(dirPath, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied on this mount");
+      try {
+        const entries = await readdir(r.resolved, { withFileTypes: true });
+        const results = [];
+        for (const entry of entries) {
+          try {
+            const s = await stat(path.join(r.resolved, entry.name));
+            results.push({
+              name: entry.name,
+              type: entry.isDirectory() ? "dir" : "file",
+              size: s.size,
+              modified: s.mtime.toISOString(),
+            });
+          } catch {
+            results.push({ name: entry.name, type: entry.isDirectory() ? "dir" : "file" });
+          }
+        }
+        return mcpResult(JSON.stringify(results, null, 2));
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`Directory not found: ${dirPath}`);
+        return mcpError(`List failed: ${err.message}`);
+      }
+    }
+
+    case "fs_grep": {
+      const searchPath = args.path || ".";
+      const r = await resolve(searchPath, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied on this mount");
+
+      const maxResults = args.max_results || 50;
+      const rgArgs = [
+        "--no-heading", "--line-number", "--color", "never",
+        "--max-count", String(maxResults),
+      ];
+      if (args.context) rgArgs.push("-C", String(args.context));
+      if (args.glob) rgArgs.push("--glob", args.glob);
+      rgArgs.push(args.pattern, r.resolved);
+
+      return new Promise((resolvePromise) => {
+        let output = "";
+        let killed = false;
+        const proc = spawnProc(rgPath, rgArgs, { timeout: 15000, windowsHide: true });
+
+        proc.stdout.on("data", (chunk) => {
+          output += chunk.toString();
+          if (output.length > 65536) {
+            killed = true;
+            proc.kill();
+          }
+        });
+        proc.stderr.on("data", () => {});
+
+        proc.on("close", (code) => {
+          if (killed) {
+            resolvePromise(mcpResult(output.slice(0, 65536) + "\n... (output truncated at 64KB)"));
+          } else if (code === 1) {
+            resolvePromise(mcpResult("No matches found"));
+          } else if (output) {
+            const mountNorm = r.mount.path.replace(/\\/g, "/");
+            const cleaned = output.replace(new RegExp(mountNorm.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + "/?", "g"), "");
+            resolvePromise(mcpResult(cleaned));
+          } else {
+            resolvePromise(mcpResult("No matches found"));
+          }
+        });
+
+        proc.on("error", (err) => {
+          resolvePromise(mcpError(`Grep failed: ${err.message}`));
+        });
+      });
+    }
+
+    case "fs_glob": {
+      const basePath = args.path || ".";
+      const r = await resolve(basePath, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied on this mount");
+      try {
+        const matches = await fg(args.pattern, {
+          cwd: r.resolved,
+          dot: false,
+          onlyFiles: true,
+          ignore: ["**/node_modules/**", "**/.git/**"],
+        });
+        if (matches.length === 0) return mcpResult("No files matched");
+        return mcpResult(matches.sort().join("\n"));
+      } catch (err) {
+        return mcpError(`Glob failed: ${err.message}`);
+      }
+    }
+
+    case "fs_delete": {
+      const r = await resolve(args.path, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "d")) return mcpError("Delete access denied on this mount");
+      try {
+        const s = await stat(r.resolved);
+        await rm(r.resolved, { recursive: s.isDirectory() });
+        return mcpResult(`Deleted: ${args.path}`);
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`Not found: ${args.path}`);
+        return mcpError(`Delete failed: ${err.message}`);
+      }
+    }
+
+    case "fs_mkdir": {
+      const r = await resolve(args.path, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+      try {
+        await mkdir(r.resolved, { recursive: true });
+        return mcpResult(`Created: ${args.path}`);
+      } catch (err) {
+        return mcpError(`Mkdir failed: ${err.message}`);
+      }
+    }
+
+    case "fs_edit": {
+      if (typeof args.old_string !== "string" || typeof args.new_string !== "string") {
+        return mcpError("old_string and new_string must be strings");
+      }
+      if (args.old_string === args.new_string) {
+        return mcpError("old_string and new_string must differ");
+      }
+      if (args.old_string.length === 0) {
+        return mcpError("old_string must not be empty");
+      }
+      const r = await resolve(args.path, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+      try {
+        const current = await readFile(r.resolved, "utf8");
+        if (args.expected_sha256 && sha256Hex(current) !== args.expected_sha256) {
+          return mcpError("Edit rejected: current file hash does not match expected_sha256");
+        }
+        const parts = current.split(args.old_string);
+        const occurrences = parts.length - 1;
+        if (occurrences === 0) {
+          return mcpError(`Edit failed: old_string not found in ${args.path}`);
+        }
+        if (occurrences > 1 && !args.replace_all) {
+          return mcpError(`Edit failed: old_string is not unique (${occurrences} matches in ${args.path}). Set replace_all=true to replace all, or provide more surrounding context.`);
+        }
+        const updated = args.replace_all
+          ? parts.join(args.new_string)
+          : current.replace(args.old_string, args.new_string);
+        await atomicWriteText(r.resolved, updated);
+        const info = await fileInfo(r.resolved, args.path);
+        return mcpResult(JSON.stringify({ replacements: args.replace_all ? occurrences : 1, ...info }, null, 2));
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`File not found: ${args.path}`);
+        return mcpError(`Edit failed: ${err.message}`);
+      }
+    }
+
+    case "fs_move": {
+      const src = await resolve(args.from, args.mount);
+      if (src.error) return mcpError(src.error);
+      const dst = await resolve(args.to, args.mount);
+      if (dst.error) return mcpError(dst.error);
+      if (!checkAccess(src.mount, "w") || !checkAccess(src.mount, "d")) {
+        return mcpError("Move requires write+delete access on this mount");
+      }
+      try {
+        await stat(src.resolved);
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`Source not found: ${args.from}`);
+        return mcpError(`Stat failed: ${err.message}`);
+      }
+      let dstExists = false;
+      try {
+        await stat(dst.resolved);
+        dstExists = true;
+      } catch (err) {
+        if (err.code !== "ENOENT") return mcpError(`Stat failed: ${err.message}`);
+      }
+      if (dstExists && !args.overwrite) {
+        return mcpError(`Move refused: destination already exists: ${args.to} (use overwrite=true)`);
+      }
+      try {
+        await mkdir(path.dirname(dst.resolved), { recursive: true });
+        if (dstExists && args.overwrite) {
+          const dstStat = await stat(dst.resolved);
+          await rm(dst.resolved, { recursive: dstStat.isDirectory(), force: true });
+        }
+        try {
+          await rename(src.resolved, dst.resolved);
+        } catch (err) {
+          if (err.code === "EXDEV") {
+            await cp(src.resolved, dst.resolved, { recursive: true, errorOnExist: false, force: true });
+            const srcStat = await stat(src.resolved);
+            await rm(src.resolved, { recursive: srcStat.isDirectory(), force: true });
+          } else {
+            throw err;
+          }
+        }
+        return mcpResult(JSON.stringify({ status: "moved", from: args.from, to: args.to }, null, 2));
+      } catch (err) {
+        return mcpError(`Move failed: ${err.message}`);
+      }
+    }
+
+    case "fs_copy": {
+      const src = await resolve(args.from, args.mount);
+      if (src.error) return mcpError(src.error);
+      const dst = await resolve(args.to, args.mount);
+      if (dst.error) return mcpError(dst.error);
+      if (!checkAccess(src.mount, "r")) return mcpError("Read access denied on this mount");
+      if (!checkAccess(src.mount, "w")) return mcpError("Write access denied on this mount");
+      let srcStat;
+      try {
+        srcStat = await stat(src.resolved);
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`Source not found: ${args.from}`);
+        return mcpError(`Stat failed: ${err.message}`);
+      }
+      let dstExists = false;
+      try {
+        await stat(dst.resolved);
+        dstExists = true;
+      } catch (err) {
+        if (err.code !== "ENOENT") return mcpError(`Stat failed: ${err.message}`);
+      }
+      if (dstExists && !args.overwrite) {
+        return mcpError(`Copy refused: destination already exists: ${args.to} (use overwrite=true)`);
+      }
+      try {
+        await mkdir(path.dirname(dst.resolved), { recursive: true });
+        await cp(src.resolved, dst.resolved, {
+          recursive: true,
+          errorOnExist: false,
+          force: !!args.overwrite,
+        });
+        return mcpResult(JSON.stringify({
+          status: "copied",
+          from: args.from,
+          to: args.to,
+          type: srcStat.isDirectory() ? "dir" : "file",
+        }, null, 2));
+      } catch (err) {
+        return mcpError(`Copy failed: ${err.message}`);
+      }
+    }
+
+    case "fs_mounts": {
+      const { mounts, error } = await getFileserverMounts(vault, deriveToken, api);
+      if (error) return mcpError(error);
+      if (!mounts || mounts.length === 0) return mcpResult("No fileserver mounts configured. Create one:\n1. Use clauth dashboard or clauth_enable to add a service with key_type='fileserver'\n2. Set the secret value to JSON: {\"path\": \"C:/Dev/regen-root\", \"access\": \"rwdg\"}  (add 'g' to allow the git verbs: fs_commit, fs_use_branch, fs_repo_status)");
+      const decorated = mounts.map((m) => {
+        const a = String(m.access || "");
+        return { ...m, can: { read: a.includes("r"), write: a.includes("w"), delete: a.includes("d"), git: a.includes("g") } };
+      });
+      return mcpResult(JSON.stringify(decorated, null, 2));
+    }
+
+    case "fs_repo_status": {
+      const r = await resolve(".", args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "g")) return mcpError("Git access denied on this mount. Add 'g' to the mount's access string (e.g. 'rwdg') to enable the git verbs.");
+      try {
+        const { result, error } = await fsGit.repoStatus(r.resolved);
+        if (error) return mcpError(error);
+        return mcpResult(JSON.stringify(result, null, 2));
+      } catch (err) {
+        return mcpError(`Status failed: ${err.message}`);
+      }
+    }
+
+    case "fs_use_branch": {
+      const r = await resolve(".", args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "g")) return mcpError("Git access denied on this mount. Add 'g' to the mount's access string (e.g. 'rwdg') to enable the git verbs.");
+      try {
+        const { result, error } = await fsGit.useBranch(r.resolved, args.branch, args.create === true);
+        if (error) return mcpError(error);
+        return mcpResult(JSON.stringify(result, null, 2));
+      } catch (err) {
+        return mcpError(`Branch switch failed: ${err.message}`);
+      }
+    }
+
+    case "fs_commit": {
+      const r = await resolve(".", args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "g")) return mcpError("Git access denied on this mount. Add 'g' to the mount's access string (e.g. 'rwdg') to enable the git verbs.");
+      const push = args.push !== false;
+      const dryRun = args.dry_run === true;
+      let token = null, tokenError = null;
+      if (push && !dryRun) {
+        const sec = await vaultRetrieveValue(vault, "github", deriveToken, api);
+        if (sec.error || !sec.value) tokenError = `could not read the 'github' token (${sec.error || "empty"})`;
+        else token = sec.value;
+      }
+      try {
+        const { result, error } = await fsGit.commit(r.resolved, {
+          message: args.message,
+          paths: args.paths,
+          push,
+          dryRun,
+          expectedHead: args.expected_head,
+          remote: args.remote,
+          token,
+          tokenError,
+          authorName: args.author_name,
+          authorEmail: args.author_email,
+        });
+        if (error) return mcpError(error);
+        return mcpResult(JSON.stringify(result, null, 2));
+      } catch (err) {
+        return mcpError(`Commit failed: ${err.message}`);
+      }
+    }
+
+    case "fs_diff": {
+      const r = await resolve(".", args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "g")) return mcpError("Git access denied on this mount. Add 'g' to the mount's access string (e.g. 'rwdg') to enable the git verbs.");
+      try {
+        const { result, error } = await fsGit.diff(r.resolved, { paths: args.paths, ref: args.ref, staged: args.staged === true });
+        if (error) return mcpError(error);
+        return mcpResult(JSON.stringify(result, null, 2));
+      } catch (err) {
+        return mcpError(`Diff failed: ${err.message}`);
+      }
+    }
+
+    case "fs_exec": {
+      const r = await resolve(args.cwd || ".", args.mount);
+      if (r.error) return mcpError(r.error);
+      const EXEC_ALLOWLIST = [
+        "git","pnpm","npx","node","python","python3","rclone","bash",
+        "cat","grep","find","wc","sha256sum","date","echo","tsc","eslint",
+        "ping","where","which","ls","dir","head","tail","sort","uniq","diff","curl",
+        "pip","docker","docker-compose","pm2","cloudflared",
+        "ssh-keygen","tar","netstat",
+        "get-filehash","get-content","select-string","test-path",
+        "get-childitem","measure-object","certutil","pwsh",
+        "copy-item","move-item","remove-item","new-item",
+        "rename-item","set-content","add-content","out-file",
+        "convertto-json","convertfrom-json","select-xml",
+        "invoke-webrequest",
+        "format-table","format-list",
+        "sort-object","where-object","group-object",
+        "write-output","out-string",
+        "get-nettcpconnection","get-process","stop-process",
+        "get-service","get-eventlog","get-date",
+        "compress-archive","expand-archive",
+      ];
+      const EXEC_BLOCKED = ["invoke-expression","iex","start-process","set-executionpolicy","reg","regedit","format","shutdown","restart-computer","reboot","mkfs","dd","cmd","del"];
+      const MAX_STDOUT = 102400;
+      if (!Array.isArray(args.command) || args.command.length === 0) return mcpError("command must be a non-empty array");
+      const cmd0 = path.basename(args.command[0]).replace(/\.exe$/i, "").toLowerCase();
+      if (EXEC_BLOCKED.includes(cmd0)) return mcpError(`Blocked command: ${cmd0}`);
+      if (!EXEC_ALLOWLIST.includes(cmd0)) return mcpError(`Command not in allowlist: ${cmd0}. Allowed: ${EXEC_ALLOWLIST.join(", ")}`);
+      if (args.command.includes("--force") && cmd0 === "git" && args.command.includes("push")) return mcpError("Force-push blocked");
+      if (cmd0 === "git" && args.command.includes("push") && (args.command.includes("main") || args.command.includes("master"))) return mcpError("Push to main/master blocked");
+      const timeout = Math.min(Number(args.timeout_seconds || 30), 300) * 1000;
+      const startTime = Date.now();
+      try {
+        const { execFile: execFileChild, exec: execChild } = await import("child_process");
+        const result = await new Promise((resolveExec, reject) => {
+          const execEnv = { ...process.env, ...(args.env || {}) };
+          if (os.platform() === "win32") {
+            const extra = ["C:\\Program Files\\PowerShell\\7", "C:\\Program Files\\Git\\cmd", "C:\\Program Files\\Git\\bin", "C:\\Program Files\\nodejs", process.env.APPDATA ? process.env.APPDATA + "\\npm" : ""].filter(Boolean).join(";");
+            const pathKey = Object.keys(execEnv).find(k => k.toUpperCase() === "PATH") || "Path";
+            execEnv[pathKey] = extra + ";" + (execEnv[pathKey] || "");
+          }
+          const useShell = args.shell || os.platform() === "win32";
+          const resolveWinShell = () => {
+            const candidates = [
+              "C:\\Program Files\\PowerShell\\7\\pwsh.exe",
+              process.env.LOCALAPPDATA ? process.env.LOCALAPPDATA + "\\Microsoft\\WindowsApps\\pwsh.exe" : "",
+              (process.env.SystemRoot || "C:\\Windows") + "\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
+            ].filter(Boolean);
+            for (const c of candidates) { try { if (fs.existsSync(c)) return c; } catch {} }
+            return "pwsh.exe";
+          };
+          const shellBin = os.platform() === "win32" ? resolveWinShell() : true;
+          const opts = { cwd: r.resolved, timeout, maxBuffer: MAX_STDOUT, windowsHide: true, env: execEnv, shell: useShell ? shellBin : false };
+          const cb = (err, stdout, stderr) => {
+            const duration = Date.now() - startTime;
+            const truncated = (stdout?.length || 0) >= MAX_STDOUT || (stderr?.length || 0) >= MAX_STDOUT;
+            if (err && !err.killed) resolveExec({ stdout: stdout || "", stderr: stderr || err.message, exit_code: err.code || 1, duration_ms: duration, truncated });
+            else if (err?.killed) resolveExec({ stdout: stdout || "", stderr: "Process killed (timeout)", exit_code: 137, duration_ms: duration, truncated: true });
+            else resolveExec({ stdout: stdout || "", stderr: stderr || "", exit_code: 0, duration_ms: duration, truncated });
+          };
+          const psEscape = (s) => "'" + s.replace(/'/g, "''") + "'";
+          if (os.platform() === "win32") {
+            const psCmd = args.shell
+              ? args.command.join(" ")
+              : "& " + args.command.map(psEscape).join(" ");
+            execChild(psCmd, opts, cb);
+          } else if (useShell) {
+            execChild(args.command.join(" "), opts, cb);
+          } else {
+            execFileChild(args.command[0], args.command.slice(1), opts, cb);
+          }
+        });
+        const auditLine = JSON.stringify({ ts: new Date().toISOString(), mount: r.mount.name, command: args.command, cwd: args.cwd || ".", exit_code: result.exit_code, duration_ms: result.duration_ms }) + "\n";
+        try { await appendFile(path.join(os.tmpdir(), "fs-exec-audit.jsonl"), auditLine); } catch {}
+        return mcpResult(JSON.stringify(result));
+      } catch (err) {
+        return mcpError(`exec failed: ${err.message}`);
+      }
+    }
+
+    case "fs_hash": {
+      const r = await resolve(".", args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied");
+      if (!Array.isArray(args.paths) || args.paths.length === 0) return mcpError("paths must be a non-empty array");
+      if (args.paths.length > 50) return mcpError("Max 50 paths per call");
+      const algo = args.algorithm || "sha256";
+      if (!["sha256", "md5", "sha1"].includes(algo)) return mcpError("algorithm must be sha256, md5, or sha1");
+      const results = [];
+      for (const p of args.paths) {
+        const fp = await resolve(p, args.mount);
+        if (fp.error) { results.push({ path: p, error: fp.error }); continue; }
+        try {
+          const content = await readFile(fp.resolved);
+          const hash = crypto.createHash(algo).update(content).digest("hex");
+          results.push({ path: p, hash, bytes: content.length });
+        } catch (err) {
+          results.push({ path: p, error: err.message });
+        }
+      }
+      return mcpResult(JSON.stringify({ results }));
+    }
+
+    case "fs_cat_lines": {
+      const r = await resolve(args.path, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied");
+      try {
+        const content = await readFile(r.resolved, "utf8");
+        const allLines = content.split("\n");
+        const start = Math.max(1, Math.floor(args.start_line)) - 1;
+        const end = args.end_line ? Math.min(Math.floor(args.end_line), allLines.length) : allLines.length;
+        const selected = allLines.slice(start, end);
+        return mcpResult(JSON.stringify({ path: args.path, start: start + 1, end, total_lines: allLines.length, content: selected.join("\n") }));
+      } catch (err) {
+        return mcpError(`Read failed: ${err.message}`);
+      }
+    }
+
+    case "fs_grep_json": {
+      const searchPath = args.path || ".";
+      const r = await resolve(searchPath, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied");
+      const maxResults = Math.min(Number(args.max_results || 50), 200);
+      const ctxLines = Math.min(Number(args.context_lines || 0), 10);
+      try {
+        const rgArgs = ["--json", "-e", args.pattern, "--max-count", String(maxResults)];
+        if (ctxLines > 0) rgArgs.push("-C", String(ctxLines));
+        if (args.glob) rgArgs.push("-g", args.glob);
+        rgArgs.push(r.resolved);
+        const raw = execSyncTop(`"${rgPath}" ${rgArgs.map(a => `"${a}"`).join(" ")}`, { encoding: "utf8", timeout: 30000, windowsHide: true, maxBuffer: 1024 * 1024 });
+        const matches = [];
+        for (const line of raw.split("\n").filter(Boolean)) {
+          try {
+            const obj = JSON.parse(line);
+            if (obj.type === "match") {
+              const rel = path.relative(r.resolved, obj.data.path.text).replace(/\\/g, "/");
+              matches.push({ file: rel, line: obj.data.line_number, match: obj.data.lines.text.trimEnd() });
+            }
+          } catch {}
+        }
+        return mcpResult(JSON.stringify({ matches, total_matches: matches.length, truncated: matches.length >= maxResults }));
+      } catch (err) {
+        if (err.status === 1) return mcpResult(JSON.stringify({ matches: [], total_matches: 0, truncated: false }));
+        return mcpError(`grep failed: ${err.message}`);
+      }
+    }
+
+    case "fs_search": {
+      const searchBase = args.path || ".";
+      const r = await resolve(searchBase, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied");
+      const maxResults = Math.min(Number(args.max_results || 50), 200);
+      try {
+        const globPattern = args.query || (args.file_types ? `**/*{${args.file_types.join(",")}}` : "**/*");
+        const files = await fg(globPattern, { cwd: r.resolved, absolute: true, stats: true, dot: false, ignore: ["**/node_modules/**", "**/.next/**", "**/.git/**"] });
+        let results = [];
+        for (const f of files) {
+          const st = f.stats || {};
+          const mtime = st.mtime ? new Date(st.mtime) : null;
+          if (args.modified_after && mtime && mtime < new Date(args.modified_after)) continue;
+          if (args.modified_before && mtime && mtime > new Date(args.modified_before)) continue;
+          const rel = path.relative(r.resolved, f.path).replace(/\\/g, "/");
+          const entry = { path: rel, size: st.size || 0, modified: mtime?.toISOString() || null };
+          if (args.content_pattern) {
+            try {
+              const text = await readFile(f.path, "utf8");
+              const match = text.match(new RegExp(args.content_pattern));
+              if (!match) continue;
+              const lineIdx = text.substring(0, match.index).split("\n").length;
+              entry.match_line = lineIdx;
+              entry.match_text = match[0].slice(0, 200);
+            } catch { continue; }
+          }
+          results.push(entry);
+          if (results.length >= maxResults) break;
+        }
+        return mcpResult(JSON.stringify({ results, total: results.length }));
+      } catch (err) {
+        return mcpError(`search failed: ${err.message}`);
+      }
+    }
+
+    case "fs_put": {
+      const r = await resolve(args.path, args.mount);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied");
+      try {
+        const exists = await stat(r.resolved).then(() => true).catch(() => false);
+        if (exists && !args.overwrite) return mcpError(`File exists: ${args.path} (set overwrite=true)`);
+        const buf = Buffer.from(args.content_base64, "base64");
+        const dir = path.dirname(r.resolved);
+        await mkdir(dir, { recursive: true });
+        await atomicWriteText(r.resolved, buf);
+        const hash = crypto.createHash("sha256").update(buf).digest("hex");
+        return mcpResult(JSON.stringify({ path: args.path, bytes: buf.length, sha256: hash }));
+      } catch (err) {
+        return mcpError(`Put failed: ${err.message}`);
+      }
+    }
+
+    case "fs_dav_setup": {
+      if (!vault.password) return mcpError("Vault is locked — call clauth_unlock first");
+      const ttl = Math.min(Number(args.ttl_seconds || 14400), 86400);
+
+      const startResult = await webdavService.ensureRunning(() => vault);
+      if (startResult.error) return mcpError(`WebDAV setup failed: ${startResult.error}`);
+
+      const wdStatus = webdavService.getStatus();
+      if (wdStatus.status === "error") {
+        return mcpError(
+          `WebDAV child error: ${wdStatus.error}\n` +
+          `Restarts so far: ${wdStatus.restart_count}. Retry or check clauth logs.`
+        );
+      }
+
+      let plainPass = "";
+      try {
+        const { token, timestamp } = deriveToken(vault.password, vault.machineHash);
+        const cr = await api.retrieve(vault.password, vault.machineHash, token, timestamp, "webdav-claude");
+        if (cr.value) plainPass = cr.value;
+      } catch {}
+
+      const expiresAt = new Date(Date.now() + ttl * 1000).toISOString();
+
+      const setupScript = [
+        "#!/usr/bin/env bash",
+        "# WebDAV setup — generated by fs_dav_setup (clauth)",
+        `# Expires hint: ${expiresAt}`,
+        "set -e",
+        "",
+        "# Configure rclone WebDAV remote via env vars (no config file, no mount, no daemon)",
+        "export RCLONE_CONFIG_DAV_TYPE=webdav",
+        "export RCLONE_CONFIG_DAV_URL=https://dav.regendevcorp.com",
+        "export RCLONE_CONFIG_DAV_VENDOR=rclone",
+        "export RCLONE_CONFIG_DAV_USER=claude",
+        plainPass
+          ? `export RCLONE_CONFIG_DAV_PASS=$(rclone obscure "${plainPass}")`
+          : "# RCLONE_CONFIG_DAV_PASS — no credential found in vault",
+        "",
+        "# Verify connectivity",
+        "rclone lsd dav: --quiet",
+        'echo "DAV ready — use rclone commands directly:"',
+        'echo "  rclone lsd dav:corpus/         # list dirs"',
+        'echo "  rclone cat dav:corpus/file.md   # read file"',
+        'echo "  rclone rcat dav:dev/file.txt <<< content  # write file"',
+        'echo "  rclone copy local/ dav:dev/path/  # upload"',
+        'echo "  rclone cat dav:file | grep pattern  # search"',
+      ].join("\n");
+
+      return mcpResult(JSON.stringify({
+        status:      wdStatus.status,
+        url:         "https://dav.regendevcorp.com",
+        setup_script: setupScript,
+        expires_at:  expiresAt,
+        ttl_seconds: ttl,
+        webdav_user: "claude",
+        started_at:  wdStatus.started_at,
+        mounts: (webdavService.loadConfig().upstreams || []).map(u => ({
+          rclone_path: `dav:${u.name}/`,
+          host_path: u.path,
+          description: u.name === "corpus" ? "Global corpus ($CORPUS_ROOT on host — Google Drive)" : `Local filesystem (${u.path} on host)`,
+        })),
+        deprecated_tools: ["fs_read", "fs_list", "fs_stat", "fs_edit", "fs_mkdir", "fs_use_branch"],
+        deprecated_note: "Use WebDAV (rclone cat/ls/lsd) instead — 37-56x faster. These tools remain as fallback.",
+        exec_enabled: true,
+        exec_allowlist: ["git", "pnpm", "npx", "node", "python3", "rclone", "bash", "cat", "grep", "find", "wc", "sha256sum", "tsc", "eslint"],
+        new_tools: ["fs_exec", "fs_hash", "fs_cat_lines", "fs_grep_json", "fs_search", "fs_put"],
+        note: "Run setup_script once per session to configure rclone env vars. Then use rclone commands: lsd (list), cat (read), rcat (write), copy (upload). Each command is stateless — no mount, no daemon, survives across turns. Use fs_exec for git/build/test commands on the host.",
+      }, null, 2));
+    }
+
+    default:
+      return null;
+  }
+}