@mecha.im/cli 0.3.4

package/dist/agent/tools/mecha-fleet.js

@@ -0,0 +1,144 @@
+/**
+ * Fleet management MCP tools for orchestrator bots.
+ * Only registered when config.permissions.fleet_control is true.
+ * All operations proxy to the daemon's /api/fleet/* endpoints.
+ */
+import { tool } from "@anthropic-ai/claude-agent-sdk";
+import { z } from "zod";
+const FLEET_URL = process.env.MECHA_FLEET_URL;
+const FLEET_SECRET = process.env.MECHA_FLEET_INTERNAL_SECRET;
+const BOT_NAME = process.env.MECHA_BOT_NAME;
+// Rate limiting (in-memory, best-effort)
+let spawnCount = 0;
+let opsCount = 0;
+let lastReset = Date.now();
+const MAX_SPAWNS_PER_HOUR = 5;
+const MAX_OPS_PER_HOUR = 20;
+function checkRateLimit(isSpawn) {
+    const now = Date.now();
+    if (now - lastReset > 3600_000) {
+        spawnCount = 0;
+        opsCount = 0;
+        lastReset = now;
+    }
+    opsCount++;
+    if (isSpawn)
+        spawnCount++;
+    if (spawnCount > MAX_SPAWNS_PER_HOUR)
+        return `Spawn rate limit exceeded (max ${MAX_SPAWNS_PER_HOUR}/hour)`;
+    if (opsCount > MAX_OPS_PER_HOUR)
+        return `Fleet operation rate limit exceeded (max ${MAX_OPS_PER_HOUR}/hour)`;
+    return null;
+}
+async function fleetApi(path, method = "GET", body) {
+    if (!FLEET_URL || !FLEET_SECRET)
+        throw new Error("Fleet API not configured (MECHA_FLEET_URL not set)");
+    const headers = { "Authorization": `Bearer ${FLEET_SECRET}` };
+    if (body)
+        headers["Content-Type"] = "application/json";
+    const resp = await fetch(`${FLEET_URL}/api/fleet${path}`, {
+        method, headers,
+        body: body ? JSON.stringify(body) : undefined,
+        signal: AbortSignal.timeout(30_000),
+    });
+    const text = await resp.text();
+    if (!resp.ok)
+        throw new Error(`Fleet API error ${resp.status}: ${text}`);
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function textResult(data) {
+    return { content: [{ type: "text", text: typeof data === "string" ? data : JSON.stringify(data, null, 2) }] };
+}
+export function createFleetTools() {
+    return [
+        tool("mecha_fleet_ls", "List all bots in the fleet with status, model, uptime, and cost.", {}, async () => {
+            const limit = checkRateLimit(false);
+            if (limit)
+                return textResult({ error: limit });
+            const data = await fleetApi("/bots");
+            return textResult(data);
+        }),
+        tool("mecha_fleet_spawn", "Spawn a new bot in the fleet.", {
+            name: z.string().min(1).max(32).describe("Bot name"),
+            system: z.string().min(1).describe("System prompt"),
+            model: z.string().optional().describe("Model (default: sonnet)"),
+            auth: z.string().optional().describe("Auth profile name"),
+        }, async (args) => {
+            const limit = checkRateLimit(true);
+            if (limit)
+                return textResult({ error: limit });
+            const data = await fleetApi("/bots", "POST", args);
+            return textResult(data);
+        }),
+        tool("mecha_fleet_stop", "Stop a running bot.", { name: z.string().min(1).max(32).describe("Bot name to stop") }, async (args) => {
+            if (args.name === BOT_NAME)
+                return textResult({ error: "Cannot stop self" });
+            const limit = checkRateLimit(false);
+            if (limit)
+                return textResult({ error: limit });
+            const data = await fleetApi(`/bots/${encodeURIComponent(args.name)}/stop`, "POST");
+            return textResult(data);
+        }),
+        tool("mecha_fleet_start", "Start a stopped bot.", { name: z.string().min(1).max(32).describe("Bot name to start") }, async (args) => {
+            const limit = checkRateLimit(false);
+            if (limit)
+                return textResult({ error: limit });
+            const data = await fleetApi(`/bots/${encodeURIComponent(args.name)}/start`, "POST");
+            return textResult(data);
+        }),
+        tool("mecha_fleet_restart", "Restart a running bot.", { name: z.string().min(1).max(32).describe("Bot name to restart") }, async (args) => {
+            if (args.name === BOT_NAME)
+                return textResult({ error: "Cannot restart self" });
+            const limit = checkRateLimit(false);
+            if (limit)
+                return textResult({ error: limit });
+            const data = await fleetApi(`/bots/${encodeURIComponent(args.name)}/restart`, "POST");
+            return textResult(data);
+        }),
+        tool("mecha_fleet_rm", "Remove a bot from the fleet (stops and deletes).", { name: z.string().min(1).max(32).describe("Bot name to remove") }, async (args) => {
+            if (args.name === BOT_NAME)
+                return textResult({ error: "Cannot remove self" });
+            const limit = checkRateLimit(false);
+            if (limit)
+                return textResult({ error: limit });
+            const data = await fleetApi(`/bots/${encodeURIComponent(args.name)}`, "DELETE");
+            return textResult(data);
+        }),
+        tool("mecha_fleet_costs", "Get cost breakdown for the fleet or a specific bot.", {
+            name: z.string().optional().describe("Bot name (omit for fleet total)"),
+            period: z.enum(["today", "week", "month"]).optional().describe("Time period"),
+        }, async (args) => {
+            const limit = checkRateLimit(false);
+            if (limit)
+                return textResult({ error: limit });
+            const path = args.name ? `/costs/${encodeURIComponent(args.name)}` : "/costs";
+            const query = args.period ? `?period=${args.period}` : "";
+            const data = await fleetApi(`${path}${query}`);
+            return textResult(data);
+        }),
+        tool("mecha_fleet_config", "View a bot's configuration (read-only).", {
+            name: z.string().min(1).max(32).describe("Bot name"),
+            field: z.string().optional().describe("Specific field to retrieve"),
+        }, async (args) => {
+            const limit = checkRateLimit(false);
+            if (limit)
+                return textResult({ error: limit });
+            const query = args.field ? `?field=${encodeURIComponent(args.field)}` : "";
+            const data = await fleetApi(`/bots/${encodeURIComponent(args.name)}/config${query}`);
+            return textResult(data);
+        }),
+        tool("mecha_fleet_status", "Get fleet health summary (running bots, costs, version).", {}, async () => {
+            const limit = checkRateLimit(false);
+            if (limit)
+                return textResult({ error: limit });
+            const data = await fleetApi("/health");
+            return textResult(data);
+        }),
+    ];
+}
+//# sourceMappingURL=mecha-fleet.js.map

package/dist/agent/tools/mecha-fleet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mecha-fleet.js","sourceRoot":"","sources":["../../../agent/tools/mecha-fleet.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,gCAAgC,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;AAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;AAE5C,yCAAyC;AACzC,IAAI,UAAU,GAAG,CAAC,CAAC;AACnB,IAAI,QAAQ,GAAG,CAAC,CAAC;AACjB,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC3B,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC;QAAC,UAAU,GAAG,CAAC,CAAC;QAAC,QAAQ,GAAG,CAAC,CAAC;QAAC,SAAS,GAAG,GAAG,CAAC;IAAC,CAAC;IAClF,QAAQ,EAAE,CAAC;IACX,IAAI,OAAO;QAAE,UAAU,EAAE,CAAC;IAC1B,IAAI,UAAU,GAAG,mBAAmB;QAAE,OAAO,kCAAkC,mBAAmB,QAAQ,CAAC;IAC3G,IAAI,QAAQ,GAAG,gBAAgB;QAAE,OAAO,4CAA4C,gBAAgB,QAAQ,CAAC;IAC7G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAM,GAAG,KAAK,EAAE,IAAc;IAClE,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvG,MAAM,OAAO,GAA2B,EAAE,eAAe,EAAE,UAAU,YAAY,EAAE,EAAE,CAAC;IACtF,IAAI,IAAI;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,aAAa,IAAI,EAAE,EAAE;QACxD,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,IAAI,CACF,gBAAgB,EAChB,kEAAkE,EAClE,EAAE,EACF,KAAK,IAAI,EAAE;YACT,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CACF;QAED,IAAI,CACF,mBAAmB,EACnB,+BAA+B,EAC/B;YACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;YACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;YACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAChE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;SAC1D,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK;gBAAE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CACF;QAED,IAAI,CACF,kBAAkB,EAClB,qBAAqB,EACrB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,EAChE,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC7E,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CACF;QAED,IAAI,CACF,mBAAmB,EACnB,sBAAsB,EACtB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EACjE,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CACF;QAED,IAAI,CACF,qBAAqB,EACrB,wBAAwB,EACxB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,EACnE,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAChF,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACtF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CACF;QAED,IAAI,CACF,gBAAgB,EAChB,kDAAkD,EAClD,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,EAClE,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC/E,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAChF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CACF;QAED,IAAI,CACF,mBAAmB,EACnB,qDAAqD,EACrD;YACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACvE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;SAC9E,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC;YAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CACF;QAED,IAAI,CACF,oBAAoB,EACpB,yCAAyC,EACzC;YACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;YACpD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;SACpE,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;YACrF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CACF;QAED,IAAI,CACF,oBAAoB,EACpB,0DAA0D,EAC1D,EAAE,EACF,KAAK,IAAI,EAAE;YACT,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CACF;KACF,CAAC;AACJ,CAAC"}

package/dist/agent/tools/mecha-list.d.ts

@@ -0,0 +1,6 @@
+export declare function listBots(): Promise<Array<{
+    name: string;
+    ip: string;
+    status: string;
+}>>;
+//# sourceMappingURL=mecha-list.d.ts.map

package/dist/agent/tools/mecha-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mecha-list.d.ts","sourceRoot":"","sources":["../../../agent/tools/mecha-list.ts"],"names":[],"mappings":"AAYA,wBAAsB,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC,CAuCF"}

package/dist/agent/tools/mecha-list.js

@@ -0,0 +1,46 @@
+import { z } from "zod";
+import { isValidUrl } from "../../shared/validation.js";
+const headscaleResponseSchema = z.object({
+    machines: z.array(z.object({
+        name: z.string(),
+        ipAddresses: z.array(z.string()).default([]),
+        online: z.boolean().default(false),
+        forcedTags: z.array(z.string()).optional(),
+    })),
+});
+export async function listBots() {
+    const headscaleUrl = process.env.MECHA_HEADSCALE_URL;
+    const headscaleApiKey = process.env.MECHA_HEADSCALE_API_KEY;
+    if (!headscaleUrl || !headscaleApiKey) {
+        return [{ name: "(unknown)", ip: "(no headscale)", status: "error: MECHA_HEADSCALE_URL and MECHA_HEADSCALE_API_KEY required" }];
+    }
+    if (!isValidUrl(headscaleUrl)) {
+        return [{ name: "(error)", ip: "", status: "error: MECHA_HEADSCALE_URL is not a valid http(s) URL" }];
+    }
+    try {
+        const resp = await fetch(`${headscaleUrl}/api/v1/machine`, {
+            headers: { Authorization: `Bearer ${headscaleApiKey}` },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!resp.ok) {
+            return [{ name: "(error)", ip: "", status: `Headscale API returned ${resp.status}` }];
+        }
+        const raw = await resp.json();
+        const parsed = headscaleResponseSchema.safeParse(raw);
+        if (!parsed.success) {
+            return [{ name: "(error)", ip: "", status: "Headscale API returned unexpected response shape" }];
+        }
+        return parsed.data.machines
+            .filter((m) => m.forcedTags?.includes("tag:mecha-bot") || m.name.startsWith("mecha-"))
+            .map((m) => ({
+            name: m.name.replace(/^mecha-/, ""),
+            ip: m.ipAddresses[0] ?? "",
+            status: m.online ? "online" : "offline",
+        }));
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return [{ name: "(error)", ip: "", status: `Headscale unavailable: ${msg}` }];
+    }
+}
+//# sourceMappingURL=mecha-list.js.map

package/dist/agent/tools/mecha-list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mecha-list.js","sourceRoot":"","sources":["../../../agent/tools/mecha-list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAClC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,QAAQ;IAK5B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACrD,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAE5D,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC,CAAC;IAClI,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,iBAAiB,EAAE;YACzD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,eAAe,EAAE,EAAE;YACvD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,0BAA0B,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ;aACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;aACrF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACnC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACxC,CAAC,CAAC,CAAC;IACR,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,0BAA0B,GAAG,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/agent/tools/mecha-server.d.ts

@@ -0,0 +1,4 @@
+import type { SessionManager } from "../session.js";
+import type { BotConfig } from "../types.js";
+export declare function createMechaToolServer(sessionManager: SessionManager, config?: BotConfig): import("@anthropic-ai/claude-agent-sdk").McpSdkServerConfigWithInstance;
+//# sourceMappingURL=mecha-server.d.ts.map

package/dist/agent/tools/mecha-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mecha-server.d.ts","sourceRoot":"","sources":["../../../agent/tools/mecha-server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAK7C,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,SAAS,2EA6DvF"}

package/dist/agent/tools/mecha-server.js

@@ -0,0 +1,49 @@
+import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
+import { z } from "zod";
+import { callBot } from "./mecha-call.js";
+import { listBots } from "./mecha-list.js";
+import { createFleetTools } from "./mecha-fleet.js";
+export function createMechaToolServer(sessionManager, config) {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const tools = [
+        tool("mecha_new_session", "Start a new task/session. Call this when you want to begin a fresh conversation or when the current task is complete.", { summary: z.string().optional().describe("Summary of the completed task") }, async (args) => {
+            const { newTask, previousTask } = sessionManager.newSession(args.summary);
+            return {
+                content: [{
+                        type: "text",
+                        text: JSON.stringify({
+                            new_task_id: newTask.id,
+                            previous_task: previousTask
+                                ? { id: previousTask.id, summary: previousTask.summary, status: "completed" }
+                                : null,
+                        }),
+                    }],
+            };
+        }),
+        tool("mecha_call", "Call another mecha bot on the network and get its response. Use this to delegate tasks or ask questions to other specialized bots.", {
+            bot: z.string().min(1).max(32).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/).describe("Target bot name"),
+            message: z.string().min(1).max(50_000).describe("Message to send to the bot"),
+        }, async (args) => {
+            const response = await callBot(args.bot, args.message);
+            return {
+                content: [{ type: "text", text: response }],
+            };
+        }),
+        tool("mecha_list", "List available mecha bots on the network. Shows bot names, IPs, and online status.", {}, async () => {
+            const bots = await listBots();
+            return {
+                content: [{ type: "text", text: JSON.stringify(bots, null, 2) }],
+            };
+        }),
+    ];
+    // Register fleet tools only for orchestrator bots with fleet_control permission
+    if (config?.permissions?.fleet_control) {
+        tools.push(...createFleetTools());
+    }
+    return createSdkMcpServer({
+        name: "mecha-tools",
+        version: "1.0.0",
+        tools,
+    });
+}
+//# sourceMappingURL=mecha-server.js.map

package/dist/agent/tools/mecha-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mecha-server.js","sourceRoot":"","sources":["../../../agent/tools/mecha-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,UAAU,qBAAqB,CAAC,cAA8B,EAAE,MAAkB;IACtF,8DAA8D;IAC9D,MAAM,KAAK,GAAU;QACnB,IAAI,CACF,mBAAmB,EACnB,uHAAuH,EACvH,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,EAC5E,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1E,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,WAAW,EAAE,OAAO,CAAC,EAAE;4BACvB,aAAa,EAAE,YAAY;gCACzB,CAAC,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE;gCAC7E,CAAC,CAAC,IAAI;yBACT,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC,CACF;QAED,IAAI,CACF,YAAY,EACZ,oIAAoI,EACpI;YACE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACnG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;SAC9E,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aACrD,CAAC;QACJ,CAAC,CACF;QAED,IAAI,CACF,YAAY,EACZ,oFAAoF,EACpF,EAAE,EACF,KAAK,IAAI,EAAE;YACT,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC1E,CAAC;QACJ,CAAC,CACF;KACF,CAAC;IAEF,gFAAgF;IAChF,IAAI,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,GAAG,gBAAgB,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,kBAAkB,CAAC;QACxB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,OAAO;QAChB,KAAK;KACN,CAAC,CAAC;AACL,CAAC"}

package/dist/agent/types.d.ts

@@ -0,0 +1,38 @@
+import { z } from "zod";
+export declare const botConfigSchema: z.ZodObject<{
+    name: z.ZodString;
+    system: z.ZodString;
+    model: z.ZodDefault<z.ZodString>;
+    auth: z.ZodOptional<z.ZodString>;
+    max_turns: z.ZodDefault<z.ZodNumber>;
+    max_budget_usd: z.ZodOptional<z.ZodNumber>;
+    permission_mode: z.ZodDefault<z.ZodEnum<{
+        default: "default";
+        acceptEdits: "acceptEdits";
+        bypassPermissions: "bypassPermissions";
+        plan: "plan";
+        dontAsk: "dontAsk";
+    }>>;
+    schedule: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        cron: z.ZodString;
+        prompt: z.ZodString;
+    }, z.core.$strip>>>;
+    webhooks: z.ZodOptional<z.ZodObject<{
+        accept: z.ZodArray<z.ZodString>;
+        secret: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    permissions: z.ZodOptional<z.ZodObject<{
+        fleet_control: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    workspace: z.ZodOptional<z.ZodString>;
+    workspace_writable: z.ZodDefault<z.ZodBoolean>;
+    expose: z.ZodOptional<z.ZodNumber>;
+    tailscale: z.ZodOptional<z.ZodObject<{
+        auth_key_profile: z.ZodOptional<z.ZodString>;
+        auth_key: z.ZodOptional<z.ZodString>;
+        login_server: z.ZodOptional<z.ZodString>;
+        tags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type BotConfig = z.infer<typeof botConfigSchema>;
+//# sourceMappingURL=types.d.ts.map

package/dist/agent/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4B1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/agent/types.js

@@ -0,0 +1,32 @@
+import { z } from "zod";
+const VALID_CRON = /^(\S+\s+){4}\S+$/;
+export const botConfigSchema = z.object({
+    name: z.string().min(1).max(32),
+    system: z.string().min(1),
+    model: z.string().default("sonnet"),
+    auth: z.string().optional(),
+    max_turns: z.number().int().min(1).max(100).default(25),
+    max_budget_usd: z.number().positive().optional(),
+    permission_mode: z.enum(["default", "acceptEdits", "bypassPermissions", "plan", "dontAsk"]).default("default"),
+    schedule: z.array(z.object({
+        cron: z.string().refine((s) => VALID_CRON.test(s), { message: "Invalid cron expression (expected 5 fields)" }),
+        prompt: z.string().min(1).max(10_000),
+    })).optional(),
+    webhooks: z.object({
+        accept: z.array(z.string()),
+        secret: z.string().optional(),
+    }).optional(),
+    permissions: z.object({
+        fleet_control: z.boolean().default(false),
+    }).optional(),
+    workspace: z.string().optional(),
+    workspace_writable: z.boolean().default(false),
+    expose: z.number().int().min(1).max(65535).optional(),
+    tailscale: z.object({
+        auth_key_profile: z.string().optional(),
+        auth_key: z.string().optional(),
+        login_server: z.string().optional(),
+        tags: z.array(z.string()).default(["tag:mecha-bot"]),
+    }).optional(),
+});
+//# sourceMappingURL=types.js.map

package/dist/agent/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC9G,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;QAC9G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;KACtC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CAAC,QAAQ,EAAE;IACb,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KAC1C,CAAC,CAAC,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC;KACrD,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC"}

package/dist/agent/webhook.d.ts

@@ -0,0 +1,12 @@
+import { Hono } from "hono";
+import type { BotConfig } from "./types.js";
+export type WebhookHandler = (prompt: string) => Promise<boolean>;
+export interface WebhookState {
+    accept: string[];
+    secret: string | undefined;
+}
+export declare function createWebhookRoutes(config: BotConfig, handler: WebhookHandler, isBusy: () => boolean): {
+    app: Hono;
+    state: WebhookState;
+};
+//# sourceMappingURL=webhook.d.ts.map

package/dist/agent/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../agent/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAkBlE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,OAAO,GACpB;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CA6FpC"}

package/dist/agent/webhook.js

@@ -0,0 +1,105 @@
+import { Hono } from "hono";
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { log } from "../shared/logger.js";
+const MAX_PAYLOAD_BYTES = 100_000;
+function safeExtractPayload(body) {
+    const { installation, sender, repository, ...rest } = body;
+    const safe = { ...rest };
+    if (repository && typeof repository === "object") {
+        const repo = repository;
+        safe.repository = { full_name: repo.full_name, html_url: repo.html_url };
+    }
+    if (sender && typeof sender === "object") {
+        const s = sender;
+        safe.sender = { login: s.login };
+    }
+    return safe;
+}
+export function createWebhookRoutes(config, handler, isBusy) {
+    const app = new Hono();
+    const state = {
+        accept: [...(config.webhooks?.accept ?? [])],
+        secret: config.webhooks?.secret,
+    };
+    if (!state.secret) {
+        log.warn("Webhook secret not configured — payloads will be accepted without signature verification. Set webhooks.secret for production use.");
+    }
+    app.post("/webhook", async (c) => {
+        // Payload size limit (check header as hint, enforce on body)
+        const contentLength = parseInt(c.req.header("content-length") ?? "0", 10);
+        if (contentLength > MAX_PAYLOAD_BYTES) {
+            return c.json({ error: "Payload too large" }, 413);
+        }
+        // Read secret from state each request (supports runtime updates)
+        const currentSecret = state.secret;
+        // Webhook signature verification (GitHub HMAC)
+        if (currentSecret) {
+            const signature = c.req.header("x-hub-signature-256");
+            if (!signature) {
+                return c.json({ error: "Missing signature" }, 401);
+            }
+            const body = await c.req.text();
+            if (Buffer.byteLength(body, "utf8") > MAX_PAYLOAD_BYTES) {
+                return c.json({ error: "Payload too large" }, 413);
+            }
+            const expected = "sha256=" + createHmac("sha256", currentSecret).update(body).digest("hex");
+            const sigBuf = Buffer.from(signature);
+            const expBuf = Buffer.from(expected);
+            if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) {
+                return c.json({ error: "Invalid signature" }, 401);
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(body);
+            }
+            catch {
+                return c.json({ error: "Invalid JSON" }, 400);
+            }
+            return handlePayload(c, parsed);
+        }
+        // Enforce size limit even without HMAC secret
+        const rawBody = await c.req.text();
+        if (Buffer.byteLength(rawBody, "utf8") > MAX_PAYLOAD_BYTES) {
+            return c.json({ error: "Payload too large" }, 413);
+        }
+        let body;
+        try {
+            body = JSON.parse(rawBody);
+        }
+        catch {
+            return c.json({ error: "Invalid JSON" }, 400);
+        }
+        return handlePayload(c, body);
+    });
+    async function handlePayload(c, body) {
+        // Extract event type
+        let eventType;
+        const githubEvent = c.req.header("x-github-event");
+        if (githubEvent) {
+            const action = body.action ?? "";
+            eventType = action ? `${githubEvent}.${action}` : githubEvent;
+        }
+        else {
+            eventType = body.type ?? "unknown";
+        }
+        // Check allowlist
+        if (!state.accept.includes(eventType)) {
+            return c.body(null, 204); // silently drop
+        }
+        // Busy check
+        if (isBusy()) {
+            c.header("Retry-After", "60");
+            return c.json({ error: "Bot is busy" }, 429);
+        }
+        // Forward to handler with redacted payload
+        const safePayload = safeExtractPayload(body);
+        const prompt = `Webhook event: ${eventType}\n\nPayload:\n${JSON.stringify(safePayload, null, 2)}`;
+        const accepted = await handler(prompt);
+        if (accepted) {
+            return c.json({ status: "accepted", event: eventType });
+        }
+        return c.json({ error: "Handler rejected" }, 500);
+    }
+    return { app, state };
+}
+//# sourceMappingURL=webhook.js.map

package/dist/agent/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../agent/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAK1C,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC,SAAS,kBAAkB,CAAC,IAA6B;IACvD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAC3D,MAAM,IAAI,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IAClD,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,UAAqC,CAAC;QACnD,IAAI,CAAC,UAAU,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,OAAuB,EACvB,MAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAiB;QAC1B,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM;KAChC,CAAC;IAEF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,mIAAmI,CAAC,CAAC;IAChJ,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,6DAA6D;QAC7D,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,aAAa,GAAG,iBAAiB,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,iEAAiE;QACjE,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC;QAEnC,+CAA+C;QAC/C,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;gBACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBACxE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,8CAA8C;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;YAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,aAAa,CAAC,CAAU,EAAE,IAA6B;QACpE,qBAAqB;QACrB,IAAI,SAAiB,CAAC;QACtB,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAI,IAAI,CAAC,MAAiB,IAAI,EAAE,CAAC;YAC7C,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,SAAS,GAAI,IAAI,CAAC,IAAe,IAAI,SAAS,CAAC;QACjD,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,gBAAgB;QAC5C,CAAC;QAED,aAAa;QACb,IAAI,MAAM,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,2CAA2C;QAC3C,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,kBAAkB,SAAS,iBAAiB,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAClG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC"}

package/dist/agent/ws-terminal.d.ts

@@ -0,0 +1,4 @@
+import type { PtyManager } from "./pty-manager.js";
+/** Attach WebSocket terminal server to an HTTP server. */
+export declare function attachTerminalWs(httpServer: any, ptyManager: PtyManager, botToken: string): void;
+//# sourceMappingURL=ws-terminal.d.ts.map

package/dist/agent/ws-terminal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-terminal.d.ts","sourceRoot":"","sources":["../../agent/ws-terminal.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAuBnD,0DAA0D;AAE1D,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,GAAG,EACf,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,MAAM,GACf,IAAI,CA4IN"}