@ljwei-stak/dsh-model-route-bot 0.66.4 → 0.67.0

package/packages/bot-engines/src/claude-llm-turn.mjs

@@ -0,0 +1,292 @@
+// Pure request projection and chunk mapping for the Claude retained-session LLM route.
+//
+// This module holds no process, no session and no money. It answers three questions the
+// bridge in `claude-llm-adapter.mjs` must answer before it may touch a native CLI:
+//
+//   1. Is this request one this route can serve at all? (`assertRouteRequest`)
+//      The route is a text-only Claude subscription conversation session: it accepts one
+//      new user text per call and nothing else. A request naming tools, an output bound,
+//      a temperature, stop sequences, an auxiliary purpose, an unknown field, or a
+//      non-text block is refused with the offending names — never silently ignored.
+//   2. What is the NEW input for the retained session? (`projectRetainedTurn`)
+//      A retained CLI session already holds its own context. Re-sending the whole
+//      transcript would duplicate it, so only the trailing new user message is dispatched.
+//      Everything already delivered is verified by durable message id and by the SDK's own
+//      model provenance; a changed prefix, an unseen history, a different Bot, a different
+//      model, a changed persona or a repeated dispatch are refusals, not a quiet drop.
+//   3. How does a native turn become SDK chunks? (`usageChunkFromTurn`,
+//      `finishReasonFromTurn`) A turn the CLI did not report usage for emits no usage
+//      chunk — unknown stays unknown. Exactly one finish is derived per turn, and a
+//      missing, unknown or cancelled outcome is never mapped onto success.
+//
+// Errors are thrown as `{code, message}` errors; the adapter turns them into terminal
+// `finish` chunks so the SDK's own consumer contract sees one honest outcome.
+
+import { validTurnText } from './claude-protocol.mjs'
+
+/** What this route accepts, stated so a caller can read it instead of guessing. */
+export const CLAUDE_LLM_CAPABILITIES = Object.freeze({
+  input: Object.freeze(['one new user text message per call']),
+  output: Object.freeze(['assistant text', 'reasoning deltas surfaced as reasoning chunks']),
+  accepts: Object.freeze(['provider', 'model', 'messages', 'system', 'signal', 'sessionId']),
+  refuses: Object.freeze(['tools', 'toolHistory', 'maxTokens', 'reasoningEffort', 'temperature', 'stop', 'purpose']),
+  unsupportedContent: Object.freeze(['image', 'file', 'tool-call', 'tool-addition', 'tool-removal']),
+  funding: Object.freeze(['subscription']),
+  notes: Object.freeze([
+    'one retained native CLI session per Bot conversation, serial turns',
+    'usage the CLI does not report stays unknown; no cost is estimated or invented here',
+    'the model provenance of a reply proves the CLI-configured init, not the response backend',
+  ]),
+})
+
+/** Request fields this route refuses outright: it cannot honour them, so it will not pretend to. */
+const REFUSED_FIELDS = Object.freeze(['tools', 'toolHistory', 'maxTokens', 'reasoningEffort', 'temperature', 'stop', 'purpose'])
+/** The closed GenerateOptions field set; anything else is a trust-boundary violation. */
+const ALLOWED_FIELDS = Object.freeze(['provider', 'model', 'messages', 'system', 'signal', 'sessionId'])
+
+const fail = (code, message) => { throw Object.assign(new Error(message), { code }) }
+
+const idOf = message => (message && typeof message.id === 'string' && message.id ? message.id : null)
+
+/** Text of a text-only content value, or null when it carries anything else. */
+function textOf(content) {
+  if (typeof content === 'string') return content
+  if (!Array.isArray(content)) return null
+  let text = ''
+  for (const block of content) {
+    if (!block || block.type !== 'text' || typeof block.text !== 'string') return null
+    text += block.text
+  }
+  return text
+}
+
+/** The block types a content array carries, for a refusal that names what it saw. */
+function blockTypes(content) {
+  if (!Array.isArray(content)) return []
+  return content.map(block => (block && typeof block.type === 'string' ? block.type : 'unknown'))
+}
+
+/** True for an assistant message this very route produced (SDK model provenance). */
+const ownReply = (message, provider, model) => message?.role === 'assistant'
+  && message.source?.kind === 'model'
+  && message.source.provider === provider
+  && message.source.model === model
+
+/** One assistant history entry this route must be able to account for: text only. */
+const assertAssistantHistory = (message, provider, model) => {
+  if (!ownReply(message, provider, model)) {
+    fail('CLAUDE_SESSION_HISTORY_UNSEEN',
+      `这条会话里有不是本路由产生的历史（${message.source?.provider ?? 'unknown'}/${message.source?.model ?? 'unknown'}），保留会话无法安全继续，请为本路由开启新会话。`)
+  }
+  if (textOf(message.content) === null) {
+    fail('CLAUDE_SESSION_HISTORY_UNSUPPORTED',
+      `本路由的历史回复只能承载文本，实际带有：${blockTypes(message.content).join(', ')}。`)
+  }
+}
+
+/**
+ * Refuse a request this route cannot serve, before any session or process exists.
+ *
+ * @param {object} options a GenerateOptions as the SDK passes it to an adapter
+ * @param {{provider: string, model: string, persona: string|null}} route the captured route snapshot
+ * @returns {{persona: string|null, messages: object[]}} the persona this call confirmed and the conversation messages
+ */
+export function assertRouteRequest(options, route) {
+  if (!options || typeof options !== 'object' || Array.isArray(options)) fail('CLAUDE_TURN_REQUEST_REQUIRED', '请求缺失。')
+  const refused = REFUSED_FIELDS.filter(field => options[field] !== undefined)
+  if (refused.length) {
+    fail('CLAUDE_ROUTE_CAPABILITY_REFUSED',
+      `本路由无法兑现这些能力，已拒绝而不是忽略：${refused.join(', ')}。接受的能力：${CLAUDE_LLM_CAPABILITIES.input.join('; ')}。`)
+  }
+  const unknown = Object.keys(options).filter(key => !ALLOWED_FIELDS.includes(key))
+  if (unknown.length) {
+    fail('CLAUDE_ROUTE_UNKNOWN_REQUEST_FIELD',
+      `请求带有本路由不接受的身份、路径、命令、凭据或引擎配置字段：${unknown.join(', ')}。`)
+  }
+  if (typeof options.provider !== 'string' || options.provider !== route.provider) fail('CLAUDE_ROUTE_PROVIDER_MISMATCH', 'provider 与已登记路由不一致。')
+  if (typeof options.model !== 'string' || options.model !== route.model) fail('CLAUDE_ROUTE_MODEL_MISMATCH', 'model 与已提交路由不一致。')
+  if (options.sessionId !== undefined && (typeof options.sessionId !== 'string' || !options.sessionId)) fail('CLAUDE_SESSION_ID_INVALID', 'sessionId 必须是非空字符串。')
+
+  // The persona seam: a leading system message is the loop's own projection of the
+  // Host-confirmed persona. It is compared, never invented, and never re-sent as a
+  // fake system authority — the engine has no system slot in this port.
+  let persona = null
+  let messages = options.messages
+  if (!Array.isArray(messages)) fail('CLAUDE_TURN_MESSAGES_REQUIRED', 'messages 缺失。')
+  if (messages.length && messages[0]?.role === 'system') {
+    persona = textOf(messages[0].content)
+    if (persona === null) fail('CLAUDE_PERSONA_UNSUPPORTED', `system 消息只能承载文本，实际带有：${blockTypes(messages[0].content).join(', ')}。`)
+    if (route.persona === null || route.persona === undefined) {
+      fail('CLAUDE_PERSONA_UNCONFIRMED', '宿主未确认本路由的人格设定，拒绝把请求里的 system 消息当作权威。')
+    }
+    if (persona !== route.persona) fail('CLAUDE_PERSONA_MISMATCH', '请求中的人格设定与宿主确认的不一致。')
+    messages = messages.slice(1)
+  }
+  if (options.system !== undefined) {
+    if (typeof options.system !== 'string') fail('CLAUDE_PERSONA_UNSUPPORTED', 'system 只能是字符串。')
+    if (route.persona === null || route.persona === undefined) fail('CLAUDE_PERSONA_UNCONFIRMED', '宿主未确认本路由的人格设定。')
+    if (options.system !== route.persona) fail('CLAUDE_PERSONA_MISMATCH', '请求中的 system 与宿主确认的人格设定不一致。')
+    persona = options.system
+  }
+  for (const message of messages) {
+    if (message?.role !== 'user' && message?.role !== 'assistant') {
+      fail('CLAUDE_ROUTE_CAPABILITY_REFUSED', `本路由不接受 ${String(message?.role)} 角色消息（工具更新等开发者消息无法兑现）。`)
+    }
+  }
+  return { persona, messages }
+}
+
+/** The empty projection state of a session that has dispatched nothing yet. */
+export const emptyTurnState = () => Object.freeze({ sent: Object.freeze([]) })
+
+/** The exact Host prefix carried in a new process's private reference context. */
+export function seedTurnState(messages, prefixLength) {
+  if (!Number.isSafeInteger(prefixLength) || prefixLength < 1 || prefixLength >= messages.length) fail('CLAUDE_HOST_ROUTE_CONTEXT_INVALID', '宿主历史范围无效。')
+  return { sent: messages.slice(0, prefixLength).map(message => {
+    const id = idOf(message), text = textOf(message.content)
+    if (!id || text === null || !['user', 'assistant'].includes(message.role)) fail('CLAUDE_HOST_ROUTE_CONTEXT_INVALID', '原生切换只支持已确认的文本历史。')
+    return { id, text: message.role === 'user' ? text : null }
+  }) }
+}
+
+/**
+ * What the retained session has NOT already seen: only the trailing new user text.
+ *
+ * Continuity is proved per delivered message: the durable id, and for a dispatched user
+ * message also its exact text. An id that survives an edit, a shortened history or a
+ * message this route never produced are refusals — a retained CLI session must never be
+ * continued on a history it did not actually see.
+ *
+ * @param {object} input
+ * @param {object[]} input.messages conversation messages (the persona system message already removed)
+ * @param {string} input.provider this route's provider id
+ * @param {string} input.model this route's committed model id
+ * @param {{sent: readonly {id: string|null, text: string|null}[]}} input.state what this session already delivered
+ * @returns {{text: string, state: {sent: {id: string|null, text: string|null}[]}}}
+ */
+export function projectRetainedTurn({ messages, provider, model, state }) {
+  if (!Array.isArray(messages)) fail('CLAUDE_TURN_MESSAGES_REQUIRED', 'messages 缺失。')
+  const previous = state ?? emptyTurnState()
+  if (messages.length < previous.sent.length) {
+    fail('CLAUDE_SESSION_HISTORY_CHANGED', '会话历史比本会话已交付的更短：历史被改写，拒绝继续而不是重放。')
+  }
+  for (let index = 0; index < previous.sent.length; index++) {
+    // Durable ids are the only honest continuity proof; a positional hole is a change.
+    if (idOf(messages[index]) !== previous.sent[index].id) {
+      fail('CLAUDE_SESSION_HISTORY_CHANGED', `会话历史第 ${index + 1} 条与已交付的不一致：历史被改写，拒绝继续而不是重放。`)
+    }
+    // A user message we dispatched verbatim must still carry the text we dispatched.
+    if (previous.sent[index].text !== null && textOf(messages[index].content) !== previous.sent[index].text) {
+      fail('CLAUDE_SESSION_HISTORY_CHANGED', `会话历史第 ${index + 1} 条的用户文本已被改写，保留会话里的原文与它不再一致，拒绝继续而不是重放。`)
+    }
+  }
+  let cursor = previous.sent.length
+  while (cursor < messages.length && messages[cursor]?.role === 'assistant') {
+    assertAssistantHistory(messages[cursor], provider, model)
+    cursor++
+  }
+  const fresh = messages.slice(cursor)
+  if (fresh.length === 0) {
+    fail('CLAUDE_TURN_ALREADY_DISPATCHED', '这次提交没有新的用户输入：同一请求不重复投递给保留会话。')
+  }
+  if (fresh.length > 1) {
+    // Extra entries this session never delivered are unseen history, not a multi-message
+    // turn: the retained CLI cannot be told about them and must not be replayed into.
+    if (fresh.slice(0, -1).some(message => message.role !== 'user')) {
+      fail('CLAUDE_SESSION_HISTORY_UNSEEN',
+        '这条会话里有本路由没有交付过的历史，保留会话无法安全继续，请为本路由开启新会话。')
+    }
+    fail('CLAUDE_TURN_INPUT_UNSUPPORTED', `一次调用只能携带一条新的用户消息，实际有 ${fresh.length} 条。`)
+  }
+  const incoming = fresh[0]
+  if (incoming.role !== 'user') {
+    fail('CLAUDE_TURN_INPUT_UNSUPPORTED', `新的输入必须是 user 消息，实际是 ${String(incoming.role)}。`)
+  }
+  const text = textOf(incoming.content)
+  if (text === null) {
+    fail('CLAUDE_TURN_INPUT_UNSUPPORTED', `本路由只接受文本输入，实际带有：${blockTypes(incoming.content).join(', ')}。`)
+  }
+  if (!validTurnText(text)) fail('CLAUDE_TURN_TEXT_INVALID', '输入文本为空、含 NUL 或超过 64000 字节。')
+  return {
+    text,
+    state: {
+      sent: messages.map(message => (message.role === 'user'
+        ? { id: idOf(message), text: textOf(message.content) }
+        : { id: idOf(message), text: null })),
+    },
+  }
+}
+
+/**
+ * The usage chunk one native turn earns. A turn the CLI reported no usage for earns
+ * none: the SDK consumer then records an incomplete usage instead of a fabricated one.
+ */
+export function usageChunkFromTurn(result) {
+  const usage = result?.usage
+  if (!usage || typeof usage.input !== 'number' || typeof usage.output !== 'number') return null
+  return {
+    inputTokens: usage.input,
+    outputTokens: usage.output,
+    ...(typeof usage.cachedInput === 'number' ? { cacheReadTokens: usage.cachedInput } : {}),
+  }
+}
+
+/** Native stop reasons mapped onto stable, provider-neutral refusal codes. */
+const STOP_REASON_CODES = Object.freeze({
+  'resume-refused': 'CLAUDE_SESSION_RESUME_REFUSED',
+  'model-identity-mismatch': 'CLAUDE_MODEL_IDENTITY_MISMATCH',
+  'grant-revoked': 'CLAUDE_GRANT_REVOKED',
+  'exit-before-result': 'CLAUDE_PROCESS_EXIT_BEFORE_RESULT',
+  'spawn-failed': 'CLAUDE_LAUNCH_FAILED',
+  'launch-failed': 'CLAUDE_LAUNCH_FAILED',
+  'stdin-write-failed': 'CLAUDE_DISPATCH_WRITE_FAILED',
+  'turn-timeout': 'CLAUDE_TURN_TIMEOUT',
+  'engine-stopped': 'CLAUDE_ENGINE_STOPPED',
+  cancelled: 'CLAUDE_TURN_CANCELLED',
+})
+
+/**
+ * Exactly one finish reason per native turn.
+ *
+ * A turn is a success only when the CLI completed it, the session identity was
+ * confirmed by the init handshake, and the turn actually produced assistant text.
+ * An `unknown` outcome (the CLI may have run), a cancelled turn, a turn with no
+ * output at all and any failure are refusals — never a success with a missing answer.
+ *
+ * @param {object} result the engine's settled turn result
+ * @param {{textChars?: number}} [observed] what the turn actually streamed
+ */
+export function finishReasonFromTurn(result, observed = {}) {
+  if (result?.cancelled === true) {
+    return { kind: 'aborted', failure: { code: 'CLAUDE_TURN_CANCELLED', message: '本轮在原生会话中被取消。' } }
+  }
+  if (!result || result.ok !== true) {
+    const code = STOP_REASON_CODES[result?.stopReason] ?? 'CLAUDE_TURN_FAILED'
+    if (result?.outcome === 'unknown') {
+      return { kind: 'error', failure: { code: 'CLAUDE_TURN_OUTCOME_UNKNOWN', message: `原生会话结果未知（${String(result.stopReason)}），不当作成功。` } }
+    }
+    return { kind: 'error', failure: { code, message: result?.errorText ?? String(result?.stopReason ?? 'native turn failed') } }
+  }
+  if (result.outcome !== 'succeeded') {
+    return { kind: 'error', failure: { code: 'CLAUDE_SESSION_UNCONFIRMED', message: '原生会话未通过 init 握手确认，结果不当作成功。' } }
+  }
+  if (!(typeof observed.textChars === 'number' && observed.textChars > 0)) {
+    return { kind: 'error', failure: { code: 'CLAUDE_TURN_NO_OUTPUT', message: '原生会话本轮没有给出任何文本，不当作成功。' } }
+  }
+  return { kind: 'stop' }
+}
+
+/** Turn facts a bridge records for the Host; never a monetary amount. */
+export function turnFacts(result) {
+  return Object.freeze({
+    turnId: result?.turnId ?? null,
+    nativeOutcome: result?.outcome ?? null,
+    nativeStopReason: result?.stopReason ?? null,
+    usageStatus: result?.usageStatus ?? 'unknown',
+    costStatus: 'unknown',
+    note: 'usage and cost come from the native result only; this bridge holds no second ledger and issues no receipt',
+  })
+}
+
+/** The session key: one retained native CLI session per Bot conversation. */
+export const sessionKeyOf = (botId, sessionId) => `${botId}\u0000${typeof sessionId === 'string' && sessionId ? sessionId : '-'}`

package/packages/bot-engines/src/claude-permission-broker.mjs

@@ -0,0 +1,130 @@
+// Host-side permission/question broker for the Claude conversation engine.
+//
+// Adapted from OpenMausBot server/drivers/claude.ts createPermissionBroker at pin
+// 1bc4749aa8307d7d6998bf86de4ef6478460dd93 (Apache-2.0); see licenses/NOTICE.md.
+// Wire protocol (newline-delimited JSON on a local pipe, engine side is the server):
+//   child -> {t:'ask', id, kind:'permission'|'question', tool, input}
+//   host  -> {t:'answer', id, behavior:'allow'|'deny'|'answer', message, source, always?}
+// Duplicate ask ids, asks after close and unanswered permission asks all fail CLOSED.
+
+import { createServer } from 'node:net'
+import { randomBytes } from 'node:crypto'
+import { chmod, unlink } from 'node:fs/promises'
+import { join } from 'node:path'
+import { parseBrokerAsk, brokerAnswer } from './claude-protocol.mjs'
+
+const DENY_TIMEOUT_NOTE = 'Host: nobody answered this permission request in time. Skip this action and finish what you can without it.'
+const DUPLICATE_ASK_ID_NOTE = 'Host: duplicate ask id — skipping this request.'
+const SYSTEM_ENDED_QUESTION = 'Host: the turn is ending — wrap up.'
+const SYSTEM_ENDED_DENY = 'Host: the turn ended'
+
+export function brokerPipeCandidates(home) {
+  if (process.platform === 'win32') {
+    const base = `\\\\.\\pipe\\dsh-claude-${randomBytes(9).toString('hex')}`
+    return [base, `${base}-r`]
+  }
+  return [join(home, 'tmp', `broker-${randomBytes(6).toString('hex')}.sock`)]
+}
+
+/**
+ * @param {object} options
+ * @param {string[]} options.pipeCandidates bind order
+ * @param {(ask: {id, kind, tool, input}) => void} options.onAsk
+ * @param {(resolved: {id, kind, tool, behavior, source}) => void} options.onResolve
+ * @param {() => boolean} [options.isActive] late asks fail closed when false
+ * @param {number} [options.timeoutMs] unanswered permission asks deny after this
+ */
+export async function createPermissionBroker({ pipeCandidates, onAsk, onResolve, isActive, timeoutMs = 15 * 60_000 }) {
+  if (!Array.isArray(pipeCandidates) || !pipeCandidates.length) throw new TypeError('BROKER_PIPES_REQUIRED')
+  const pending = new Map()
+  let closed = false
+  let boundPath = null
+  let server = null
+  const connections = new Set()
+
+  const connectionHandler = connection => {
+    connections.add(connection)
+    connection.on('error', () => {})
+    connection.setEncoding('utf8')
+    let buffer = ''
+    connection.on('data', chunk => {
+      buffer += chunk
+      let end
+      while ((end = buffer.indexOf('\n')) >= 0) {
+        const line = buffer.slice(0, end)
+        buffer = buffer.slice(end + 1)
+        let message
+        try { message = JSON.parse(line) } catch { continue }
+        const ask = parseBrokerAsk(message)
+        if (!ask) continue
+        const reply = value => { try { connection.write(`${JSON.stringify(value)}\n`) } catch {} }
+        if (closed) { reply(brokerAnswer(ask.id, ask.kind === 'question' ? 'answer' : 'deny', ask.kind === 'question' ? SYSTEM_ENDED_QUESTION : SYSTEM_ENDED_DENY, 'system')); continue }
+        if (isActive && !isActive()) { reply(brokerAnswer(ask.id, ask.kind === 'question' ? 'answer' : 'deny', ask.kind === 'question' ? SYSTEM_ENDED_QUESTION : SYSTEM_ENDED_DENY, 'system')); continue }
+        if (pending.has(ask.id)) { reply(brokerAnswer(ask.id, 'deny', DUPLICATE_ASK_ID_NOTE, 'system')); continue }
+        const finish = (behavior, message, source, always = false) => {
+          if (!pending.delete(ask.id)) return
+          if (timer) clearTimeout(timer)
+          reply(brokerAnswer(ask.id, behavior, message, source, always))
+          onResolve({ ...ask, behavior, source })
+        }
+        const timer = ask.kind === 'question' ? null : setTimeout(() => finish('deny', DENY_TIMEOUT_NOTE, 'timeout'), timeoutMs)
+        timer?.unref()
+        pending.set(ask.id, { ask, finish })
+        onAsk(ask)
+      }
+    })
+    connection.on('close', () => connections.delete(connection))
+  }
+
+  for (const candidate of pipeCandidates) {
+    const attempt = createServer(connectionHandler)
+    await unlink(candidate).catch(() => {})
+    const outcome = await new Promise(resolve => {
+      attempt.once('listening', () => resolve('listening'))
+      attempt.once('error', error => resolve(error))
+      attempt.listen(candidate)
+    })
+    if (outcome === 'listening' && process.platform !== 'win32') {
+      try { await chmod(candidate, 0o600) } catch (error) {
+        attempt.close()
+        await unlink(candidate).catch(() => {})
+        if (candidate === pipeCandidates[pipeCandidates.length - 1]) { server = null; boundPath = null; break }
+        continue
+      }
+    }
+    if (outcome === 'listening') { server = attempt; boundPath = candidate; break }
+    if (candidate === pipeCandidates[pipeCandidates.length - 1]) break
+  }
+  // Fail closed: an unbound broker must never look usable.
+  if (!server) throw new Error('PERMISSION_BROKER_UNBOUND')
+
+  const drain = () => {
+    for (const value of Array.from(pending.values())) {
+      const { ask } = value
+      value.finish(ask.kind === 'question' ? 'answer' : 'deny', ask.kind === 'question' ? SYSTEM_ENDED_QUESTION : SYSTEM_ENDED_DENY, 'system')
+    }
+  }
+
+  return Object.freeze({
+    pipePath: boundPath,
+    /** Host-side decision. Returns false when the ask is unknown or the behavior does not fit its kind. */
+    answer(askId, behavior, message, always = false) {
+      const value = pending.get(askId)
+      if (!value) return false
+      if (value.ask.kind === 'question' ? behavior !== 'answer' : behavior === 'answer') return false
+      value.finish(behavior, message, 'user', always && behavior === 'allow')
+      return true
+    },
+    pause() { drain() },
+    close() {
+      if (closed) return
+      closed = true
+      drain()
+      for (const connection of connections) connection.destroy()
+      try { server.close() } catch {}
+      if (process.platform !== 'win32') void unlink(boundPath).catch(() => {})
+    },
+    get pendingCount() { return pending.size },
+    get closed() { return closed },
+  })
+}

package/packages/bot-engines/src/claude-permission-proxy.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+// MCP stdio permission proxy for the Claude conversation engine.
+//
+// Claude Code is launched with --permission-prompt-tool mcp__dsh__approve and an
+// --mcp-config that runs this script. It implements the minimum MCP surface Claude needs
+// (initialize / notifications/initialized / tools/list / tools/call) and forwards each
+// approve call to the engine's permission broker pipe as newline-delimited JSON:
+//   -> {t:'ask', id, kind, tool, input}
+//   <- {t:'answer', id, behavior, message, source, always?}
+//
+// Adapted from the OpenMausBot permission-proxy concept (server/drivers/claude.ts,
+// --permission-prompt-tool mcp__ogb__approve) at pin
+// 1bc4749aa8307d7d6998bf86de4ef6478460dd93 (Apache-2.0); see licenses/NOTICE.md.
+//
+// Usage: node claude-permission-proxy.mjs <brokerPipePath>
+
+import { connect } from 'node:net'
+import { randomBytes } from 'node:crypto'
+import { createInterface } from 'node:readline'
+
+const APPROVE_TOOL = 'approve'
+const ASK_TIMEOUT_MS = Number(process.env.DSH_APPROVE_TIMEOUT_MS ?? 15 * 60_000)
+
+const pipePath = process.argv[2]
+if (!pipePath || pipePath.startsWith('-')) {
+  process.stderr.write('claude-permission-proxy: broker pipe path argument required\n')
+  process.exit(2)
+}
+
+const send = message => process.stdout.write(`${JSON.stringify(message)}\n`)
+const rpcResult = (id, result) => send({ jsonrpc: '2.0', id, result })
+const rpcError = (id, code, message) => send({ jsonrpc: '2.0', id, error: { code, message } })
+
+function askBroker({ kind, tool, input }) {
+  return new Promise(resolve => {
+    const id = randomBytes(12).toString('hex')
+    let socket
+    const finish = value => {
+      clearTimeout(timer)
+      try { socket?.destroy() } catch {}
+      resolve(value)
+    }
+    const timer = setTimeout(() => finish({ behavior: 'deny', message: 'Host: permission broker timed out.', source: 'timeout' }), ASK_TIMEOUT_MS)
+    try { socket = connect(pipePath) } catch (error) { finish({ behavior: 'deny', message: `Host: broker unreachable (${error.message}).`, source: 'system' }); return }
+    socket.on('error', error => finish({ behavior: 'deny', message: `Host: broker unreachable (${error.message}).`, source: 'system' }))
+    socket.on('connect', () => {
+      socket.write(`${JSON.stringify({ t: 'ask', id, kind, tool, input })}\n`)
+      const lines = createInterface({ input: socket })
+      lines.on('line', line => {
+        try {
+          const message = JSON.parse(line)
+          if (message.t === 'answer' && message.id === id) finish(message)
+        } catch { /* not for us */ }
+      })
+    })
+  })
+}
+
+const input = createInterface({ input: process.stdin })
+input.on('line', line => {
+  let request
+  try { request = JSON.parse(line) } catch { return }
+  if (request.method === 'initialize') {
+    rpcResult(request.id, { protocolVersion: '2024-11-05', serverInfo: { name: 'dsh-permission-proxy', version: '1.0.0' }, capabilities: { tools: {} } })
+    return
+  }
+  if (request.method === 'notifications/initialized') return
+  if (request.method === 'tools/list') {
+    rpcResult(request.id, { tools: [{ name: APPROVE_TOOL, description: 'Ask the DSH host whether a tool use is allowed.', inputSchema: { type: 'object', properties: { kind: { type: 'string', enum: ['permission', 'question'] }, tool: { type: 'string' }, input: { type: 'object' } }, required: ['kind', 'tool'] } }] })
+    return
+  }
+  if (request.method === 'tools/call') {
+    if (request.params?.name !== APPROVE_TOOL) { rpcError(request.id, -32602, `Unknown tool ${request.params?.name}`); return }
+    const args = request.params.arguments ?? {}
+    void askBroker({ kind: args.kind === 'question' ? 'question' : 'permission', tool: typeof args.tool === 'string' ? args.tool : 'tool', input: args.input && typeof args.input === 'object' ? args.input : {} })
+      .then(answer => {
+        // The tool result is what Claude turns into its allow/deny decision; a refused
+        // ask must read as a denial, never as an error Claude might retry.
+        rpcResult(request.id, { content: [{ type: 'text', text: JSON.stringify({ behavior: answer.behavior, message: typeof answer.message === 'string' ? answer.message : '', source: answer.source, always: answer.always === true }) }], isError: false })
+      })
+    return
+  }
+  if (request.id !== undefined) rpcError(request.id, -32601, `Method not found: ${request.method}`)
+})
+
+process.stdin.on('close', () => process.exit(0))
+process.stdin.on('end', () => process.exit(0))