@mono-agent/agent-app 0.6.1 → 0.8.0

package/README.md

@@ -3,7 +3,7 @@
 Config-first mono-agent host. Reads one `mono-agent.config.json` in a folder,
 builds the configured responder, and starts every configured communication
 channel plus traceability. Ships the
-`mono-agent` CLI (`init`, `validate`, `memory`, `start`) so an agent folder works without
+`mono-agent` CLI (`init`, `auth`, `sandbox`, `validate`, `memory`, `tui`, `start`) so an agent folder works without
 hand-written composition code.
 
 ## Category
@@ -19,17 +19,25 @@ Turn a folder's `mono-agent.config.json` into a running agent host:
   external channel plugins from `channels.plugins[]`.
 - Build the shared runtime/responder/memory stack through app-owned configured
   composition
-  (including `runtime.fallbackModels` backup chains).
+  (including canonical `runtime.fallbacks` routes and legacy
+  `runtime.fallbackModels` compatibility).
+- Preserve completed blocking `AskUser` / `TelegramAskButtons` question,
+  options, and outcome in the assistant history copy so cold/stateless provider
+  replay does not lose the out-of-band exchange.
+- Expose the request-scoped read-only `RunHistory` tool for safe normalized
+  evidence from completed prior runs in the current conversation bucket.
 - Drive each channel through a uniform driver contract with per-channel
   `disabled` / `waiting_for_config` / `running` / `failed` status.
 - Register the host as a traceability source. Config edits are made directly in
-  `mono-agent.config.json` and take effect on the next `mono-agent restart`.
+  `mono-agent.config.json`, or proposed through the OS-owner-local configuration
+  TUI; direct edits take effect on the next `mono-agent restart`.
 - Resolve and surface any configured `observability.exporters` (the Phoenix
   preset): `start`/`status` report the configured endpoint and a note that JSONL
   artifacts remain local; `validate` performs the live reachability probe. Export
   is best-effort and never changes a run outcome.
-- Preview the configured memory backend from the same config/env resolution path
-  via `mono-agent memory` (`stats`, `today`, `show`, `search`, `top`).
+- Preview, strictly audit, and safely maintain the configured memory backend
+  from the same config/env resolution path via `mono-agent memory` (including
+  provider-free strict health and payload-free intake inspect/retry/resolve).
 - Scaffold (`mono-agent init`) and validate (`mono-agent validate`) agent
   folders non-destructively.
 
@@ -39,19 +47,198 @@ Turn a folder's `mono-agent.config.json` into a running agent host:
 # inside the workspace
 pnpm --filter @mono-agent/agent-app run build
 
-# scaffold and run an agent folder
+# guided, readiness-proven setup and run
 cd /path/to/agent-folder
-node <workspace>/packages/agent-app/dist/cli.js init --model claude:claude-sonnet-4-6
-node <workspace>/packages/agent-app/dist/cli.js validate
-node <workspace>/packages/agent-app/dist/cli.js start
+node <workspace>/packages/agent-app/dist/cli.js init
 ```
 
 On an interactive terminal, bare `mono-agent init` (no flags) runs a colourful,
-step-by-step wizard — powered by `@clack/prompts` — that composes the capability
-selection before writing anything and can opt in to provider auth/preflight
-commands before the scaffold is created. Any flag (or a piped/non-TTY invocation)
-takes the silent default/preset scaffold path instead; add `--auth` to run
-supported provider setup in that non-interactive path.
+step-by-step wizard — powered by `@clack/prompts` — that asks for the public
+agent name plus a concise purpose and composes the capability selection before writing anything. Escape
+moves back one logical step; Ctrl-C asks for exit confirmation. The final
+**Creation review** names the agent, routes/efforts, route safety, provider/SRT
+actions, exact files, secret destinations, and number of real model calls before
+offering **Run setup and readiness checks, then create agent** when setup is
+needed, or **Run readiness checks, then create agent** when credentials are
+already detected, alongside **Edit choices** and **Cancel without writing**.
+Status, sandbox, and route preflights accept Escape or Ctrl-C and enter the same
+resume/restart recovery flow without writing agent files. Interactive provider
+authentication uses Ctrl-C only so the parent never competes with the provider
+child for terminal input. This is the readiness-proven path;
+any flag or non-TTY invocation is scaffold-only and never claims the agent is
+ready. Presets seed the same model, channel,
+tool, and sandbox decisions as the custom path; they do not silently bypass
+safety choices. Searchable primary/fallback pickers combine every bundled model
+for the guided Pi providers (Anthropic, GitHub Copilot, OpenAI Codex, and
+OpenCode-Go), Codex's live account catalog, the Claude SDK catalog, and local
+discovery. The live Codex provider default leads when available; offline setup
+falls back to curated `codex:gpt-5.6-terra` without guessing effort metadata, so
+only **Provider default** is offered until live `model/list` succeeds. GPT-5.6 Sol is selectable as
+`codex:gpt-5.6-sol` or `pi:openai-codex:gpt-5.6-sol`.
+OpenCode-Go Pi refs can save `OPENCODE_API_KEY` into
+the Pi auth store or remain environment-provided, and any number of fallback
+models are selected from the same discovered choices one at a time. Each route
+offers only its advertised effort values plus **Provider default**. Standalone
+`mono-agent auth login anthropic` keeps its localhost callback active while
+also reading a pasted final redirect URL through Pi's code/state-validating
+OAuth implementation. `mono-agent auth login opencode-go` uses a masked TTY prompt; headless callers
+must opt in to one-line redirected input with `--api-key-stdin`. Any flag (or a piped/non-TTY
+invocation) takes the silent default/preset scaffold path instead; add `--auth`
+to run supported provider setup in that non-interactive path. Required selected
+channel secrets are masked and never enter config JSON, examples, review output,
+or logs. Durable provider credentials already in `.env` are secured by the same
+preflight. POSIX persistence is owner-only (`0600`), preserves existing dotenv
+values/comments, and uses an external lock plus no-clobber promotion with exact
+ignore rules for `.env` and transaction artifacts. The canonical agent directory
+must be current-user-owned and not group/world-writable; existing `.env` and
+`.gitignore` files must be current-user-owned with one link, and the ignore guard
+loses group/world write access. Pathname competitors are
+protected; the claimed inode is rechecked and detected open-descriptor writes are
+retained in a reported recovery copy (writes after the final POSIX check remain
+non-cooperative); unsafe/tracked/foreign-owned/multiply-linked
+paths, stale locks, invalid dotenv, conflicts, and Windows fail closed to manual setup. Before the
+interactive wizard opens the local TUI it requires one disposable no-tool
+response from every selected runtime route and a complete validation report with
+every selected expectation ready. Cancellation, provider failure, timeout (90s
+cloud / 240s local per route), empty output, or any tool action fails the check.
+Escape or Ctrl-C interrupts preflight; recovery can resume verified routes when
+the non-secret plan fingerprint still matches, restart all checks, edit choices,
+or cancel. Authentication repair clears every prior route proof because it can
+replace credential bytes. Guided commit atomically
+creates the config and rechecks its exact snapshot after validation and before
+opening `mono-agent tui --local --configure`. This builds the current-folder
+responder in-process and never creates launchd state. Saving after failure is
+explicitly incomplete and never auto-starts.
+
+Every scaffold selects versioned `mono-agent-configure` and `mono-agent-memory`
+skills from `./skills` with index disclosure. `ReadSkill` remains separate from
+action-tool policy. `mono-agent install-skill --project --check|--update` reports
+version/hash drift and refreshes only unchanged managed copies with backups; a
+canonical owner-only non-symlink parent chain, per-project owner lock, and
+compare-and-swap activation prevent outside or concurrent
+operator edits from being overwritten, and a partial activation restores only
+files that still equal the managed bytes it wrote.
+
+In a marked local configuration turn only, the app injects proposal-only
+`ProposeAgentConfiguration`. The host accepts only a fail-closed low-risk
+allowlist: public name; effort, turn/session UX; selected project skills and
+disclosure; memory size or MemoryRecall enablement; semantic tool-policy
+tightening; and the separately validated Role body. Every path, memory-tier or
+capture-cost change, runtime/provider route, channel/proactive/plugin, MCP,
+exporter, embeddings/LLM endpoint, sandbox/network field, secret, and unknown
+future field is handed to the explicit guided flow. It canonicalizes
+config/Identity/state paths without following symlink parents, stages and
+fsyncs replacements, then performs the final source comparison and rename as
+one non-yielding commit step under an owner-only transaction lock. Separate TUI
+confirmation, failure-atomic config/Role rollback compensation, rollback
+evidence, and a fresh responder remain mandatory. Configuration turns replace
+the ordinary tool/MCP policy with `ReadSkill`, `MemoryRecall`, and the proposal
+tool only; direct providers that cannot project a finite list run in their
+native read-only plan posture. Fast follow-ups wait through responder rotation.
+Remote/proactive channels never receive this tool.
+
+Guided readiness uses a worker-reproducible environment rather than the launching
+shell: durable `.env` values, entered selected secrets, the resolved Pi auth path,
+and operational values such as `PATH`/`HOME`. Shell-only provider credentials and
+config overrides cannot create a success that launchd cannot reproduce; persisted
+non-secret `MONO_AGENT_*` overrides are rejected by name.
+
+Direct Codex discovery checks the executable, login status, and live app-server
+model catalog without equating catalog availability with authentication or a
+verified turn. Missing Codex setup points to the official instructions at
+<https://developers.openai.com/codex/cli/>; the app never auto-installs it. The
+wizard offers browser callback and headless device-code login. Detected credentials
+skip redundant authentication but remain unverified until the exact route call
+successfully runs. Guided Pi setup covers Anthropic, GitHub Copilot, OpenAI Codex,
+and OpenCode-Go; other hand-authored Pi and local-provider configs remain compatible
+without being advertised as guided cloud integrations. Supported OAuth methods and
+the OpenCode-Go key flow come from the bundled upstream catalog;
+stale auth locks are repaired only when the recorded process is securely proven
+gone. The
+wizard keeps **Allow all tools** as its default. Pi/Claude flows disclose
+shell/file/web/channel effects and reconfirm an unsandboxed choice. Direct Codex
+fixes policy to exact allow-all, uses its native network-off workspace sandbox,
+denies unattended escalations, and fails unexpected server requests promptly.
+Mixed chains are unrestricted only under explicit `runtime.routeSafety:
+"per-route-native"`, which isolates provider runtimes and applies a documented
+route-local contract. The default `uniform` mode keeps one common monotonic
+contract and rejects/skips routes that cannot represent it. Pi keeps mono-agent
+tool policy and optional SRT; Claude uses representable provider-native controls;
+direct Codex/OpenCode use provider-native safety plus exact allow-all. No route
+silently drops a required capability. Pi `pi:opencode-go:*` remains a Pi route.
+Direct OpenCode also requires exact allow-all; restrictive static policies fail
+validation/runtime and an incompatible dynamic override is warned and ignored.
+
+`RunHistory` requires no config key. It is automatically available under
+allow-all on MCP-capable routes; a restrictive `tools.allowedTools` must name
+`RunHistory` explicitly (`run_history` remains a deprecated input alias), and
+`disallowedTools` can remove it. Direct OpenCode and other MCP-incompatible
+routes suppress it. Its `list` and `inspect` actions can read only completed
+prior runs in the exact current conversation bucket and return bounded,
+redacted, normalized evidence. They exclude the current/running run, other
+conversations or rollover buckets, system prompts, reasoning, recalled memory,
+turn-context payloads, and raw artifact paths; historical text is marked
+untrusted.
+
+For missing context, the agent should use active conversation history first,
+`MemoryRecall` for intentionally captured durable facts, and `RunHistory` for
+exact prior-run/tool evidence. Completed blocking `AskUser` and
+`TelegramAskButtons` exchanges are written into the assistant history copy
+before the final response, explicitly labelled as untrusted historical data and
+bounded by newest whole interactions, without changing the outward message or
+long-term memory capture. `TelegramAskButtons` with `wait: false` continues to produce a
+synthetic next turn when the user taps later.
+
+The app publishes a cached, content-free `memoryHealth` snapshot in the primary
+trace-source heartbeat and any enabled best-effort global mirror. Built-in
+health is computed through a dynamic memory import so a native SQLite ABI
+failure becomes sanitized `unknown` health
+instead of crashing unrelated CLI startup. Concurrent refreshes coalesce; in
+steady state, ordinary trace events and the completion-based timer never run a
+full audit less than 30 seconds after the prior completion. Startup and reload
+make one explicit post-lifecycle exception so the registered snapshot reflects
+the newly started store. The timer is unreferenced and invalidated at
+stop/reconfigure entry, and the same
+snapshot is used for both registries. The shape is limited to backend/mode,
+closed status and issue vocabularies, ISO check time, and eight whitelisted
+counts—never paths, ids, content, payloads, or raw errors.
+
+Unexpected built-in audit failures use the stable `health_check_failed` issue,
+while durable work that exceeds its ownership grace uses `work_stalled`; both
+are fixed metadata-only classifications.
+
+Operator automation should use:
+
+```bash
+# One prose/ANSI-free {ok:boolean, sections, ...} object; exit 0 iff ok.
+mono-agent validate --json
+
+# Provider-free closed health; healthy/in_progress/not_configured exit 0.
+mono-agent memory audit --strict --json
+
+# Payload-free inventory; mutations require the matching agent to be stopped.
+mono-agent memory inspect --json
+mono-agent memory retry --json
+mono-agent memory retry <64-character-id> --json
+mono-agent memory resolve <64-character-id> <reason-slug> --json
+```
+
+Journal and BuJo always require a valid managed `.index/manifest.json`; only
+Lite may remain unmanaged. Missing/corrupt authority, active/configured
+tier-model-dimension mismatch, and native-module/ABI failure are validation
+errors with stop/rebuild/revalidate remediation. Provider reachability remains
+an operational `waiting` state. `retry` makes dead/delayed intake due for the
+next store start; `resolve` explicitly abandons one item without claiming
+capture succeeded, keeps permanent duplicate protection, and refuses a retained
+semantic plan.
+
+For launchd fleet verification, invoke the deployed CLI with each plist's exact
+`ProgramArguments[0]` Node, `[1]` CLI, absolute `--config`/`--env-file`, and
+managed `PATH`. Probe children retain only launchd-safe operational environment
+values; shell-only `MONO_AGENT_*`, provider credentials, `NODE_OPTIONS`, and
+proxy overrides are not fleet evidence. The current fleet contract is Node
+`24.15.0`, modules ABI `137`; an ambient shell Node or environment is not
+evidence that the service can load the native memory modules.
 
 Programmatic:
 
@@ -65,8 +252,8 @@ await app.stop();
 
 ## Public API
 
-- `startMonoAgentApp(options)` → `MonoAgentApp` (statuses, `applyConfigChange`,
-  `startChannelIfConfigured`, `stop`).
+- `startMonoAgentApp(options)` → `MonoAgentApp` (statuses, cached typed
+  `memoryHealth`, `applyConfigChange`, `startChannelIfConfigured`, `stop`).
 - `defaultChannelDrivers(overrides)` plus built-in per-channel
   `create<Channel>ChannelDriver(overrides)` factories with test seams.
 - `createConfiguredAgentRuntime`, `createConfiguredAgentHarness`,
@@ -74,10 +261,16 @@ await app.stop();
   transport-free programmatic composition from a loaded `MonoAgentConfig`.
 - `createBroadcastRunRecorder` for publishing recorder lifecycle events to a
   live run-event sink.
-- `initMonoAgentFolder(options)` / `validateMonoAgentFolder(options)`.
+- `initMonoAgentFolder(options)` / `validateMonoAgentFolder(options)`. Init results
+  expose precise `changes` and `secretPersistence` outcomes; the compatibility
+  `secretsPersisted` flag is true only after a committed secret write.
 - `MONO_AGENT_APP_FIELD_GROUPS` and the `resolveApp*` traceability/artifact
   resolvers.
 - `runCli(argv)` / `parseCliArgs(argv)` backing the `mono-agent` bin.
+- Local configuration CLI lifecycle: `mono-agent tui --local [--configure]` and
+  managed project-skill drift/update through `install-skill --project`.
+- Managed SRT lifecycle: `sandboxRuntimeStatus`, `setupManagedSrt`, and
+  `checkSandboxRuntime` (also exposed as `mono-agent sandbox status|setup|check`).
 
 ## Dependency Boundary
 

package/dist/adapter-send-proxy.d.ts

@@ -0,0 +1,18 @@
+export interface AdapterSendProxy {
+    readonly fetchImpl: typeof fetch;
+    close(): Promise<void>;
+    destroy(error?: Error): Promise<void>;
+}
+export interface AdapterSendProxyOptions {
+    /** Explicit configured endpoints that may need SRT's coarse loopback capability. */
+    readonly directLoopbackUrls?: readonly string[];
+}
+export declare function safeAdapterSendProxyErrorMessage(error: unknown, env?: Record<string, string | undefined>): string;
+/**
+ * Build the adapter-send child's HTTP transport from its inherited proxy
+ * environment. The parent MCP spec deliberately does not copy these values:
+ * credentials stay in process environment state and never enter the serialized
+ * runtime/tool configuration.
+ */
+export declare function createAdapterSendProxy(env?: Record<string, string | undefined>, options?: AdapterSendProxyOptions): AdapterSendProxy | undefined;
+//# sourceMappingURL=adapter-send-proxy.d.ts.map

package/dist/adapter-send-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-send-proxy.d.ts","sourceRoot":"","sources":["../src/adapter-send-proxy.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,uBAAuB;IACtC,oFAAoF;IACpF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAeR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,OAAO,GAAE,uBAA4B,GACpC,gBAAgB,GAAG,SAAS,CAoE9B"}

package/dist/adapter-send-proxy.js

@@ -0,0 +1,229 @@
+import { isIP } from "node:net";
+import { Agent, Dispatcher, EnvHttpProxyAgent, fetch as undiciFetch, } from "undici";
+export function safeAdapterSendProxyErrorMessage(error, env = process.env) {
+    let message = error instanceof Error ? error.message : String(error);
+    // Redact the exact environment values first. This also covers malformed
+    // proxy strings that cannot be recognized as URLs.
+    for (const name of ["http_proxy", "HTTP_PROXY", "https_proxy", "HTTPS_PROXY"]) {
+        const value = env[name]?.trim();
+        if (value !== undefined && value.length > 0) {
+            message = message.split(value).join("[redacted-proxy]");
+        }
+    }
+    return message
+        // URL userinfo is the normal shape of SRT's authenticated proxy secret.
+        .replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+(?::[^\s/@]*)?@/giu, "$1[redacted]@")
+        // Defense in depth for diagnostics that spell the header rather than URL.
+        .replace(/(proxy-authorization\s*[:=]\s*)(?:\S+\s+)?\S+/giu, "$1[redacted]");
+}
+/**
+ * Build the adapter-send child's HTTP transport from its inherited proxy
+ * environment. The parent MCP spec deliberately does not copy these values:
+ * credentials stay in process environment state and never enter the serialized
+ * runtime/tool configuration.
+ */
+export function createAdapterSendProxy(env = process.env, options = {}) {
+    const httpProxy = proxyEnvValue(env.http_proxy) ?? proxyEnvValue(env.HTTP_PROXY);
+    const httpsProxy = proxyEnvValue(env.https_proxy) ?? proxyEnvValue(env.HTTPS_PROXY);
+    if (httpProxy === undefined && httpsProxy === undefined) {
+        return undefined;
+    }
+    const noProxy = normalizeNoProxyValue(env.no_proxy ?? env.NO_PROXY);
+    const proxyDispatcher = new EnvHttpProxyAgent({
+        // Empty values prevent EnvHttpProxyAgent from consulting ambient process.env
+        // when a caller supplies an explicit environment snapshot (notably tests).
+        httpProxy: httpProxy ?? "",
+        httpsProxy: httpsProxy ?? "",
+        noProxy,
+    });
+    // Managed SRT's NO_PROXY always includes loopback. Keep that behavior for
+    // configured endpoints, but retain a dispatcher that cannot silently bypass
+    // the policy proxy when a redirect changes to an unconfigured loopback origin.
+    const forcedProxyDispatcher = new EnvHttpProxyAgent({
+        httpProxy: httpProxy ?? "",
+        httpsProxy: httpsProxy ?? "",
+        noProxy: "",
+    });
+    const directLoopbackOrigins = collectDirectLoopbackOrigins(options.directLoopbackUrls ?? []);
+    const directDispatcher = directLoopbackOrigins.size === 0 ? undefined : new Agent();
+    const requestDispatcher = new DirectLoopbackRoutingDispatcher(proxyDispatcher, forcedProxyDispatcher, directDispatcher, directLoopbackOrigins);
+    let closePromise;
+    let destroyPromise;
+    const fetchImpl = (async (input, init) => {
+        const { requestInit, detachAbortListener } = adaptFetchInit(init);
+        try {
+            return await undiciFetch(input, {
+                ...requestInit,
+                // Undici invokes this dispatcher again for every redirect hop. The
+                // wrapper therefore evaluates the actual dispatch origin instead of
+                // granting the initial URL's direct capability to the whole chain.
+                dispatcher: requestDispatcher,
+            });
+        }
+        finally {
+            detachAbortListener();
+        }
+    });
+    return {
+        fetchImpl,
+        close() {
+            return closePromise ??= Promise.all([
+                proxyDispatcher.close(),
+                forcedProxyDispatcher.close(),
+                ...(directDispatcher === undefined ? [] : [directDispatcher.close()]),
+            ]).then(() => undefined);
+        },
+        destroy(error) {
+            return destroyPromise ??= Promise.all([
+                error === undefined ? proxyDispatcher.destroy() : proxyDispatcher.destroy(error),
+                error === undefined ? forcedProxyDispatcher.destroy() : forcedProxyDispatcher.destroy(error),
+                ...(directDispatcher === undefined
+                    ? []
+                    : [error === undefined ? directDispatcher.destroy() : directDispatcher.destroy(error)]),
+            ]).then(() => undefined);
+        },
+    };
+}
+function normalizeNoProxyValue(value) {
+    const entries = (value ?? "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+    // SRT 0.0.64 emits bare ::1, while Undici 8 expects the bracketed URL-host
+    // spelling. Preserve SRT's list and add the compatible equivalent.
+    if (entries.includes("::1") && !entries.includes("[::1]"))
+        entries.push("[::1]");
+    return entries.join(",");
+}
+function collectDirectLoopbackOrigins(urls) {
+    const origins = new Set();
+    for (const value of urls) {
+        try {
+            const url = new URL(value);
+            const host = stripIpv6Brackets(url.hostname.toLowerCase());
+            if (isLoopbackHost(host))
+                origins.add(url.origin);
+        }
+        catch {
+            // The config loader owns URL diagnostics; an invalid endpoint must not
+            // accidentally become a direct-routing exception here.
+        }
+    }
+    return origins;
+}
+function loopbackOriginForDispatch(origin) {
+    try {
+        if (origin === undefined)
+            return undefined;
+        const url = new URL(String(origin));
+        const host = stripIpv6Brackets(url.hostname.toLowerCase());
+        return isLoopbackHost(host) ? url.origin : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+class DirectLoopbackRoutingDispatcher extends Dispatcher {
+    proxyDispatcher;
+    forcedProxyDispatcher;
+    directDispatcher;
+    directLoopbackOrigins;
+    constructor(proxyDispatcher, forcedProxyDispatcher, directDispatcher, directLoopbackOrigins) {
+        super();
+        this.proxyDispatcher = proxyDispatcher;
+        this.forcedProxyDispatcher = forcedProxyDispatcher;
+        this.directDispatcher = directDispatcher;
+        this.directLoopbackOrigins = directLoopbackOrigins;
+    }
+    dispatch(options, handler) {
+        const loopbackOrigin = loopbackOriginForDispatch(options.origin);
+        if (loopbackOrigin !== undefined
+            && this.directDispatcher !== undefined
+            && this.directLoopbackOrigins.has(loopbackOrigin)) {
+            return this.directDispatcher.dispatch(options, handler);
+        }
+        // An unconfigured loopback origin must not inherit SRT's broad NO_PROXY
+        // exception. Send it to the authenticated policy proxy, which applies the
+        // actual sandbox destination allowlist. Non-loopback origins retain the
+        // caller's complete NO_PROXY semantics through `proxyDispatcher`.
+        return loopbackOrigin === undefined
+            ? this.proxyDispatcher.dispatch(options, handler)
+            : this.forcedProxyDispatcher.dispatch(options, handler);
+    }
+}
+function stripIpv6Brackets(host) {
+    return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+function isLoopbackHost(host) {
+    return host === "localhost" || host === "::1" || (isIP(host) === 4 && host.split(".")[0] === "127");
+}
+function adaptFetchInit(init) {
+    const { 
+    // grammY's Node fetch configuration includes these node-fetch-only fields.
+    // undici owns proxying through `dispatcher`, so forwarding `agent` would be
+    // both incompatible and ambiguous.
+    agent: _agent, compress: _compress, signal, ...rest } = (init ?? {});
+    const normalized = normalizeAbortSignal(signal);
+    const body = rest.body;
+    const requestInit = {
+        ...rest,
+        ...(normalized.signal === undefined ? {} : { signal: normalized.signal }),
+        ...(isStreamingBody(body) && rest.duplex === undefined ? { duplex: "half" } : {}),
+    };
+    return { requestInit, detachAbortListener: normalized.detach };
+}
+function normalizeAbortSignal(signal) {
+    if (signal === null || signal === undefined) {
+        return { detach: () => { } };
+    }
+    if (signal instanceof AbortSignal) {
+        return { signal, detach: () => { } };
+    }
+    // grammY uses an abort-controller shim whose signal is EventTarget-like but
+    // fails undici's native AbortSignal Web IDL conversion on Node 22. Mirror it
+    // into a native controller for the lifetime of this request.
+    const controller = new AbortController();
+    const abort = () => {
+        controller.abort(signal.reason);
+    };
+    if (signal.aborted) {
+        abort();
+        return { signal: controller.signal, detach: () => { } };
+    }
+    signal.addEventListener?.("abort", abort, { once: true });
+    return {
+        signal: controller.signal,
+        detach: () => {
+            signal.removeEventListener?.("abort", abort);
+        },
+    };
+}
+function isStreamingBody(body) {
+    if (body === null || body === undefined || typeof body !== "object") {
+        return false;
+    }
+    const candidate = body;
+    return typeof candidate[Symbol.asyncIterator] === "function"
+        || typeof candidate.pipe === "function"
+        || typeof candidate.getReader === "function";
+}
+function proxyEnvValue(value) {
+    const normalized = value?.trim();
+    if (normalized === undefined || normalized.length === 0)
+        return undefined;
+    try {
+        const url = new URL(normalized);
+        // Managed SRT advertises its authenticated policy proxy on localhost, but
+        // an external-only sandbox need not make hostname resolution available.
+        // The proxy itself is IPv4 loopback; use its numeric spelling without
+        // changing credentials, port, path, or any destination/NO_PROXY policy.
+        if (url.hostname === "localhost")
+            url.hostname = "127.0.0.1";
+        return url.href;
+    }
+    catch {
+        // Preserve Undici's authoritative invalid-proxy diagnostic.
+        return normalized;
+    }
+}
+//# sourceMappingURL=adapter-send-proxy.js.map

package/dist/adapter-send-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-send-proxy.js","sourceRoot":"","sources":["../src/adapter-send-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EACL,KAAK,EACL,UAAU,EACV,iBAAiB,EACjB,KAAK,IAAI,WAAW,GAGrB,MAAM,QAAQ,CAAC;AA4BhB,MAAM,UAAU,gCAAgC,CAC9C,KAAc,EACd,MAA0C,OAAO,CAAC,GAAG;IAErD,IAAI,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,wEAAwE;IACxE,mDAAmD;IACnD,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,CAAU,EAAE,CAAC;QACvF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,OAAO;QACZ,wEAAwE;SACvE,OAAO,CAAC,oDAAoD,EAAE,eAAe,CAAC;QAC/E,0EAA0E;SACzE,OAAO,CAAC,kDAAkD,EAAE,cAAc,CAAC,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA0C,OAAO,CAAC,GAAG,EACrD,UAAmC,EAAE;IAErC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpF,IAAI,SAAS,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,eAAe,GAAG,IAAI,iBAAiB,CAAC;QAC5C,6EAA6E;QAC7E,2EAA2E;QAC3E,SAAS,EAAE,SAAS,IAAI,EAAE;QAC1B,UAAU,EAAE,UAAU,IAAI,EAAE;QAC5B,OAAO;KACR,CAAC,CAAC;IACH,0EAA0E;IAC1E,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,qBAAqB,GAAG,IAAI,iBAAiB,CAAC;QAClD,SAAS,EAAE,SAAS,IAAI,EAAE;QAC1B,UAAU,EAAE,UAAU,IAAI,EAAE;QAC5B,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;IACH,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAC7F,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;IACpF,MAAM,iBAAiB,GAAG,IAAI,+BAA+B,CAC3D,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,CACtB,CAAC;IACF,IAAI,YAAuC,CAAC;IAC5C,IAAI,cAAyC,CAAC;IAE9C,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,KAAkC,EAAE,IAAkB,EAAqB,EAAE;QACrG,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CAAC,KAA0B,EAAE;gBACnD,GAAG,WAAW;gBACd,mEAAmE;gBACnE,oEAAoE;gBACpE,mEAAmE;gBACnE,UAAU,EAAE,iBAAiB;aAC9B,CAAwB,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,mBAAmB,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAiB,CAAC;IAEnB,OAAO;QACL,SAAS;QACT,KAAK;YACH,OAAO,YAAY,KAAK,OAAO,CAAC,GAAG,CAAC;gBAClC,eAAe,CAAC,KAAK,EAAE;gBACvB,qBAAqB,CAAC,KAAK,EAAE;gBAC7B,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC;aACtE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,KAAa;YACnB,OAAO,cAAc,KAAK,OAAO,CAAC,GAAG,CAAC;gBACpC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC;gBAChF,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC5F,GAAG,CAAC,gBAAgB,KAAK,SAAS;oBAChC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;aAC1F,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB;IACtD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;SAC1B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjF,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAuB;IAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3D,IAAI,cAAc,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,uDAAuD;QACzD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAgC;IAEhC,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,+BAAgC,SAAQ,UAAU;IAEnC;IACA;IACA;IACA;IAJnB,YACmB,eAA2B,EAC3B,qBAAiC,EACjC,gBAAwC,EACxC,qBAA0C;QAE3D,KAAK,EAAE,CAAC;QALS,oBAAe,GAAf,eAAe,CAAY;QAC3B,0BAAqB,GAArB,qBAAqB,CAAY;QACjC,qBAAgB,GAAhB,gBAAgB,CAAwB;QACxC,0BAAqB,GAArB,qBAAqB,CAAqB;IAG7D,CAAC;IAEQ,QAAQ,CAAC,OAAmC,EAAE,OAAmC;QACxF,MAAM,cAAc,GAAG,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,IACE,cAAc,KAAK,SAAS;eACzB,IAAI,CAAC,gBAAgB,KAAK,SAAS;eACnC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,EACjD,CAAC;YACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,kEAAkE;QAClE,OAAO,cAAc,KAAK,SAAS;YACjC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,cAAc,CAAC,IAA6B;IAInD,MAAM;IACJ,2EAA2E;IAC3E,4EAA4E;IAC5E,mCAAmC;IACnC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,SAAS,EACnB,MAAM,EACN,GAAG,IAAI,EACR,GAAG,CAAC,IAAI,IAAI,EAAE,CAA6B,CAAC;IAC7C,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,WAAW,GAAG;QAClB,GAAG,IAAI;QACP,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;QACzE,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IAClC,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA0C;IAItE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM,YAAY,WAAW,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,EAAE,CAAC;QACR,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,MAAM,EAAE,GAAG,EAAE;YACX,MAAM,CAAC,mBAAmB,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,IAIjB,CAAC;IACF,OAAO,OAAO,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU;WACvD,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;WACpC,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;YAAE,GAAG,CAAC,QAAQ,GAAG,WAAW,CAAC;QAC7D,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/adapter-send-tools-main.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createAdapterSendProxy, safeAdapterSendProxyErrorMessage, } from "./adapter-send-proxy.js";
 import { adapterSendToolsChildConfigFromEnv, createAdapterSendToolsClients, createAdapterSendToolsServer, resolveAdapterSendToolsSettings, } from "./adapter-send-tools.js";
 async function main() {
     const childConfig = adapterSendToolsChildConfigFromEnv(process.env, process.cwd());
@@ -9,12 +10,69 @@ async function main() {
     if (settings === undefined) {
         throw new Error("no adapter send tools configured.");
     }
-    const clients = await createAdapterSendToolsClients(settings);
-    const server = await createAdapterSendToolsServer(settings, clients, childConfig.indexing);
-    await server.connect(new StdioServerTransport());
+    const proxy = createAdapterSendProxy(process.env, {
+        directLoopbackUrls: [
+            settings.telegram?.apiRoot,
+            settings.telegram?.askBridge?.bridgeUrl,
+            settings.askUser?.bridgeUrl,
+        ].filter((value) => value !== undefined),
+    });
+    const removeProxyLifecycle = proxy === undefined ? () => { } : installProxyLifecycle(proxy);
+    try {
+        const httpOptions = proxy === undefined ? {} : { fetchImpl: proxy.fetchImpl };
+        const clients = await createAdapterSendToolsClients(settings, httpOptions);
+        const server = await createAdapterSendToolsServer(settings, clients, childConfig.indexing, httpOptions);
+        await server.connect(new StdioServerTransport());
+    }
+    catch (error) {
+        removeProxyLifecycle();
+        await proxy?.destroy().catch((closeError) => {
+            logProxyShutdownError(closeError);
+        });
+        throw error;
+    }
+}
+function installProxyLifecycle(proxy) {
+    let gracefulShutdown;
+    let forcedShutdown;
+    const shutdown = (force, exitAfter) => {
+        const operation = force
+            ? (forcedShutdown ??= proxy.destroy())
+            : (gracefulShutdown ??= proxy.close());
+        void operation
+            .catch((error) => {
+            logProxyShutdownError(error);
+        })
+            .finally(() => {
+            if (exitAfter)
+                process.exit(0);
+        });
+    };
+    const onStdinEnd = () => {
+        shutdown(false, false);
+    };
+    const onSignal = () => {
+        // Installing signal handlers replaces Node's default termination behavior,
+        // so destroy active requests and exit explicitly once the dispatcher drains.
+        shutdown(true, true);
+    };
+    process.stdin.once("end", onStdinEnd);
+    process.once("SIGINT", onSignal);
+    process.once("SIGTERM", onSignal);
+    return () => {
+        process.stdin.off("end", onStdinEnd);
+        process.off("SIGINT", onSignal);
+        process.off("SIGTERM", onSignal);
+    };
+}
+function logProxyShutdownError(error) {
+    void error;
+    // Dispatcher errors can include the proxy URL. Keep credentials out of MCP
+    // stderr even when the underlying client reports an unsafe diagnostic.
+    process.stderr.write("mono-agent-adapter-send-tools: proxy shutdown failed.\n");
 }
 main().catch((error) => {
-    process.stderr.write(`mono-agent-adapter-send-tools: fatal: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.stderr.write(`mono-agent-adapter-send-tools: fatal: ${safeAdapterSendProxyErrorMessage(error)}\n`);
     process.exitCode = 1;
 });
 //# sourceMappingURL=adapter-send-tools-main.js.map

package/dist/adapter-send-tools-main.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-send-tools-main.js","sourceRoot":"","sources":["../src/adapter-send-tools-main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AAEjC,KAAK,UAAU,IAAI;IACjB,MAAM,WAAW,GAAG,kCAAkC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC,WAAW,CAAC,KAAK,EAAE;QACxE,YAAY,EAAE,WAAW,CAAC,YAAY;KACvC,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC3F,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1H,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"adapter-send-tools-main.js","sourceRoot":"","sources":["../src/adapter-send-tools-main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EACL,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AAEjC,KAAK,UAAU,IAAI;IACjB,MAAM,WAAW,GAAG,kCAAkC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC,WAAW,CAAC,KAAK,EAAE;QACxE,YAAY,EAAE,WAAW,CAAC,YAAY;KACvC,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE;QAChD,kBAAkB,EAAE;YAClB,QAAQ,CAAC,QAAQ,EAAE,OAAO;YAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS;YACvC,QAAQ,CAAC,OAAO,EAAE,SAAS;SAC5B,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;KAC1D,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC3F,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QAC9E,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACxG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oBAAoB,EAAE,CAAC;QACvB,MAAM,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,UAAmB,EAAE,EAAE;YACnD,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAA6D;IAC1F,IAAI,gBAA2C,CAAC;IAChD,IAAI,cAAyC,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,SAAkB,EAAQ,EAAE;QAC5D,MAAM,SAAS,GAAG,KAAK;YACrB,CAAC,CAAC,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACtC,CAAC,CAAC,CAAC,gBAAgB,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,KAAK,SAAS;aACX,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,2EAA2E;QAC3E,6EAA6E;QAC7E,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClC,OAAO,GAAG,EAAE;QACV,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,KAAK,KAAK,CAAC;IACX,2EAA2E;IAC3E,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;AAClF,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,gCAAgC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3G,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}