@muhaven/mcp 0.1.0

package/dist/broker.cjs

@@ -0,0 +1,1117 @@
+'use strict';
+
+var os = require('os');
+var child_process = require('child_process');
+var path = require('path');
+var net = require('net');
+var promises = require('fs/promises');
+var accounts = require('viem/accounts');
+
+// src/broker/cli.ts
+var DEFAULT_BACKEND_URL = "https://api.muhaven.app";
+var DEFAULT_DASHBOARD_URL = "https://muhaven.app";
+var DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
+var DEFAULT_BROKER_TIMEOUT_MS = 5e3;
+var DEFAULT_BROKER_MAX_BYTES = 64 * 1024;
+var DEFAULT_JWT_CACHE_TTL_SEC = 30;
+function defaultBrokerEndpoint() {
+  if (os.platform() === "win32") {
+    const user = process.env.USERNAME ?? "default";
+    const sanitized = user.replace(/[^A-Za-z0-9_-]/g, "_");
+    return `\\\\.\\pipe\\muhaven-broker-${sanitized}`;
+  }
+  return path.join(os.homedir(), ".muhaven", "broker.sock");
+}
+function readEnv(name, env) {
+  const value = env[name];
+  if (value === void 0 || value === "") return void 0;
+  return value;
+}
+function readEnvBool(name, defaultValue, env) {
+  const raw = readEnv(name, env);
+  if (raw === void 0) return defaultValue;
+  return /^(1|true|yes|on)$/i.test(raw);
+}
+function readEnvInt(name, defaultValue, env) {
+  const raw = readEnv(name, env);
+  if (raw === void 0) return defaultValue;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error(`${name} must be a positive integer (got "${raw}")`);
+  }
+  return parsed;
+}
+function deriveAllowedHosts(baseUrl) {
+  try {
+    const u = new URL(baseUrl);
+    return [u.host];
+  } catch {
+    throw new Error(`MUHAVEN_BACKEND_URL is not a valid URL (got "${baseUrl}")`);
+  }
+}
+function trimTrailingSlash(s) {
+  return s.endsWith("/") ? s.slice(0, -1) : s;
+}
+function loadMcpConfig(env = process.env) {
+  const backendBaseUrl = trimTrailingSlash(env.MUHAVEN_BACKEND_URL ?? DEFAULT_BACKEND_URL);
+  const dashboardBaseUrl = trimTrailingSlash(env.MUHAVEN_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL);
+  const brokerEndpoint = env.MUHAVEN_BROKER_ENDPOINT ?? defaultBrokerEndpoint();
+  const readOnly = readEnvBool("MUHAVEN_READ_ONLY", false, env);
+  const requestTimeoutMs = readEnvInt("MUHAVEN_REQUEST_TIMEOUT_MS", DEFAULT_REQUEST_TIMEOUT_MS, env);
+  const brokerTimeoutMs = readEnvInt("MUHAVEN_BROKER_TIMEOUT_MS", DEFAULT_BROKER_TIMEOUT_MS, env);
+  const jwtCacheTtlSec = readEnvInt("MUHAVEN_JWT_CACHE_TTL_SEC", DEFAULT_JWT_CACHE_TTL_SEC, env);
+  return {
+    backendBaseUrl,
+    dashboardBaseUrl,
+    brokerEndpoint,
+    readOnly,
+    requestTimeoutMs,
+    brokerTimeoutMs,
+    allowedBackendHosts: deriveAllowedHosts(backendBaseUrl),
+    jwtCacheTtlSec
+  };
+}
+var PRIVKEY_HEX_RE = /^0x[0-9a-fA-F]{64}$/;
+function loadBrokerConfig(env = process.env) {
+  const sessionKeyHex = env.MUHAVEN_BROKER_SESSION_KEY;
+  if (!sessionKeyHex) {
+    throw new Error(
+      "MUHAVEN_BROKER_SESSION_KEY is required (0x-prefixed 32-byte hex). Mint a session key via the dashboard policy-template install flow."
+    );
+  }
+  if (!PRIVKEY_HEX_RE.test(sessionKeyHex)) {
+    throw new Error("MUHAVEN_BROKER_SESSION_KEY must be a 0x-prefixed 32-byte hex string");
+  }
+  const endpoint = env.MUHAVEN_BROKER_ENDPOINT ?? defaultBrokerEndpoint();
+  const maxRequestBytes = readEnvInt("MUHAVEN_BROKER_MAX_BYTES", DEFAULT_BROKER_MAX_BYTES, env);
+  const requestTimeoutMs = readEnvInt("MUHAVEN_BROKER_TIMEOUT_MS", DEFAULT_BROKER_TIMEOUT_MS, env);
+  return {
+    endpoint,
+    sessionKeyHex,
+    maxRequestBytes,
+    requestTimeoutMs
+  };
+}
+var BrokerClientError = class extends Error {
+  constructor(code, message, cause) {
+    super(message);
+    this.code = code;
+    this.cause = cause;
+    this.name = "BrokerClientError";
+  }
+  code;
+  cause;
+};
+var BrokerClient = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  async hello() {
+    const res = await this.exchange({ type: "hello" });
+    if (res.type !== "hello") {
+      throw new BrokerClientError("protocol_error", `expected hello response, got ${res.type}`);
+    }
+    return res;
+  }
+  async signHash(hash, intent) {
+    const res = await this.exchange({
+      type: "sign_hash",
+      hash,
+      ...intent ? { intent } : {}
+    });
+    if (res.type !== "sign_hash") {
+      throw new BrokerClientError(
+        "protocol_error",
+        `expected sign_hash response, got ${res.type}`
+      );
+    }
+    return res;
+  }
+  async storeJwt(jwt, expiresAtSec) {
+    const res = await this.exchange({
+      type: "store_jwt",
+      jwt,
+      ...expiresAtSec === void 0 ? {} : { expiresAtSec }
+    });
+    if (res.type !== "store_jwt") {
+      throw new BrokerClientError(
+        "protocol_error",
+        `expected store_jwt response, got ${res.type}`
+      );
+    }
+    return res;
+  }
+  async getJwt() {
+    const res = await this.exchange({ type: "get_jwt" });
+    if (res.type !== "get_jwt") {
+      throw new BrokerClientError(
+        "protocol_error",
+        `expected get_jwt response, got ${res.type}`
+      );
+    }
+    return res;
+  }
+  async clearJwt() {
+    const res = await this.exchange({ type: "clear_jwt" });
+    if (res.type !== "clear_jwt") {
+      throw new BrokerClientError(
+        "protocol_error",
+        `expected clear_jwt response, got ${res.type}`
+      );
+    }
+  }
+  exchange(request) {
+    return new Promise((resolve, reject) => {
+      let socket;
+      let buffer = "";
+      let settled = false;
+      const settleErr = (err) => {
+        if (settled) return;
+        settled = true;
+        socket?.destroy();
+        reject(err);
+      };
+      const settleOk = (res) => {
+        if (settled) return;
+        settled = true;
+        socket?.destroy();
+        resolve(res);
+      };
+      const timer = setTimeout(() => {
+        settleErr(new BrokerClientError("timeout", "broker IPC timeout"));
+      }, this.options.timeoutMs);
+      try {
+        socket = net.connect(this.options.endpoint);
+      } catch (err) {
+        clearTimeout(timer);
+        settleErr(new BrokerClientError("connect_failed", "cannot connect to broker", err));
+        return;
+      }
+      socket.once("connect", () => {
+        socket.write(JSON.stringify(request) + "\n");
+      });
+      socket.on("data", (chunk) => {
+        buffer += chunk.toString("utf8");
+        const newlineIdx = buffer.indexOf("\n");
+        if (newlineIdx < 0) return;
+        const line = buffer.slice(0, newlineIdx);
+        clearTimeout(timer);
+        try {
+          const parsed = JSON.parse(line);
+          if (parsed.type === "error") {
+            settleErr(
+              new BrokerClientError("broker_error", `${parsed.code}: ${parsed.message}`)
+            );
+            return;
+          }
+          settleOk(parsed);
+        } catch (err) {
+          settleErr(new BrokerClientError("protocol_error", "invalid JSON from broker", err));
+        }
+      });
+      socket.on("error", (err) => {
+        clearTimeout(timer);
+        settleErr(new BrokerClientError("connect_failed", err.message, err));
+      });
+      socket.on("close", () => {
+        clearTimeout(timer);
+        if (!settled) {
+          settleErr(new BrokerClientError("protocol_error", "broker closed without response"));
+        }
+      });
+    });
+  }
+};
+
+// src/auth/device-flow.ts
+var DEFAULT_POLL_INTERVAL_MS = 2e3;
+var DEFAULT_OVERALL_TIMEOUT_MS = 5 * 60 * 1e3;
+var DeviceFlowAbortedError = class extends Error {
+  constructor(detail) {
+    super(`device flow aborted: ${detail.code}`);
+    this.detail = detail;
+    this.name = "DeviceFlowAbortedError";
+  }
+  detail;
+};
+var DeviceFlowClient = class {
+  constructor(options) {
+    this.options = options;
+    this.fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
+    this.sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    this.nowMs = options.nowMs ?? (() => Date.now());
+  }
+  options;
+  fetchImpl;
+  sleep;
+  nowMs;
+  /**
+   * Run the full ceremony: request a code, yield events for the caller
+   * to display the URL, then poll until authorized / denied / expired.
+   * Throws `DeviceFlowAbortedError` on terminal failure.
+   */
+  async *run(opts) {
+    const overallTimeout = opts?.overallTimeoutMs ?? DEFAULT_OVERALL_TIMEOUT_MS;
+    const code = await this.requestCode();
+    yield { type: "code_issued", code };
+    const startedAt = this.nowMs();
+    const pollMs = Math.max(1, code.pollIntervalSec) * 1e3;
+    let attempt = 0;
+    while (this.nowMs() - startedAt < overallTimeout) {
+      attempt += 1;
+      yield { type: "polling", attempt, nextPollMs: pollMs };
+      await this.sleep(pollMs);
+      const res = await this.pollOnce(code.deviceCode);
+      switch (res.state) {
+        case "pending":
+          continue;
+        case "authorized":
+          if (!res.jwt) {
+            throw new DeviceFlowAbortedError({
+              code: "invalid_response",
+              body: { reason: "authorized state missing jwt" }
+            });
+          }
+          yield {
+            type: "authorized",
+            jwt: res.jwt,
+            expiresAtSec: res.expiresAtSec ?? null,
+            scope: res.scope ?? null
+          };
+          return {
+            jwt: res.jwt,
+            expiresAtSec: res.expiresAtSec ?? null,
+            scope: res.scope ?? null
+          };
+        case "denied":
+          yield { type: "denied", reason: res.reason };
+          throw new DeviceFlowAbortedError({ code: "denied", reason: res.reason });
+        case "expired":
+          yield { type: "expired" };
+          throw new DeviceFlowAbortedError({ code: "expired" });
+      }
+    }
+    throw new DeviceFlowAbortedError({ code: "timeout" });
+  }
+  async requestCode() {
+    const url = new URL("/api/v1/auth/device/code", this.options.backendBaseUrl);
+    const requesterMetadata = {
+      processName: this.options.requesterMetadata?.processName ?? "muhaven-broker",
+      hostname: this.options.requesterMetadata?.hostname ?? "",
+      os: this.options.requesterMetadata?.os ?? ""
+    };
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({ requesterMetadata })
+      });
+    } catch (err) {
+      throw new DeviceFlowAbortedError({ code: "network", cause: err });
+    }
+    if (res.status === 429) {
+      throw new DeviceFlowAbortedError({ code: "rate_limited" });
+    }
+    if (res.status >= 400) {
+      const body2 = await safeJson(res);
+      throw new DeviceFlowAbortedError({ code: "invalid_response", status: res.status, body: body2 });
+    }
+    const body = await safeJson(res);
+    if (!body || !body.deviceCode || !body.userCode) {
+      throw new DeviceFlowAbortedError({ code: "invalid_response", status: res.status, body });
+    }
+    const verificationUri = `${trim(this.options.dashboardBaseUrl)}/link`;
+    const verificationUriComplete = `${verificationUri}?code=${encodeURIComponent(body.userCode)}`;
+    return {
+      deviceCode: body.deviceCode,
+      userCode: body.userCode,
+      verificationUri,
+      verificationUriComplete,
+      expiresInSec: body.expiresInSec ?? 300,
+      pollIntervalSec: body.pollIntervalSec ?? Math.floor(DEFAULT_POLL_INTERVAL_MS / 1e3)
+    };
+  }
+  async pollOnce(deviceCode) {
+    const url = new URL("/api/v1/auth/device/token", this.options.backendBaseUrl);
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({ deviceCode })
+      });
+    } catch (err) {
+      throw new DeviceFlowAbortedError({ code: "network", cause: err });
+    }
+    if (res.status === 429) {
+      return { state: "pending" };
+    }
+    const body = await safeJson(res);
+    if (!body || typeof body.state !== "string") {
+      throw new DeviceFlowAbortedError({ code: "invalid_response", status: res.status, body });
+    }
+    return body;
+  }
+};
+function trim(s) {
+  return s.endsWith("/") ? s.slice(0, -1) : s;
+}
+async function safeJson(res) {
+  try {
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+var KEYRING_SERVICE = "muhaven.mcp";
+var KEYRING_ACCOUNT = "jwt";
+async function loadKeyringModule() {
+  try {
+    const moduleName = "@napi-rs/keyring";
+    return await import(moduleName);
+  } catch {
+    return null;
+  }
+}
+var OsKeystore = class {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  constructor(entry) {
+    this.entry = entry;
+  }
+  entry;
+  backend = "os";
+  available = true;
+  async set(record) {
+    try {
+      this.entry.setPassword(JSON.stringify(record));
+    } catch (err) {
+      this.available = false;
+      throw new KeystoreError(
+        "os_keystore_unavailable",
+        `OS keychain rejected write \u2014 ${asMessage(err)}. Try MUHAVEN_KEYRING=file or run \`muhaven-broker doctor\`.`,
+        err
+      );
+    }
+  }
+  async get() {
+    try {
+      const raw = this.entry.getPassword();
+      if (!raw) return null;
+      return parseRecord(raw);
+    } catch (err) {
+      this.available = false;
+      throw new KeystoreError(
+        "os_keystore_unavailable",
+        `OS keychain read failed \u2014 ${asMessage(err)}. Try MUHAVEN_KEYRING=file or run \`muhaven-broker doctor\`.`,
+        err
+      );
+    }
+  }
+  async clear() {
+    try {
+      this.entry.deletePassword();
+    } catch (err) {
+    }
+  }
+};
+var FileKeystore = class {
+  constructor(path) {
+    this.path = path;
+  }
+  path;
+  backend = "file";
+  available = true;
+  static defaultPath() {
+    return path.join(os.homedir(), ".muhaven", "jwt");
+  }
+  async set(record) {
+    const parent = path.dirname(this.path);
+    await promises.mkdir(parent, { recursive: true, mode: 448 });
+    await promises.chmod(parent, 448).catch(() => void 0);
+    await promises.writeFile(this.path, JSON.stringify(record), { mode: 384 });
+    await promises.chmod(this.path, 384).catch(() => void 0);
+  }
+  async get() {
+    try {
+      const raw = await promises.readFile(this.path, "utf8");
+      return parseRecord(raw);
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      throw new KeystoreError("file_read_failed", asMessage(err), err);
+    }
+  }
+  async clear() {
+    try {
+      await promises.unlink(this.path);
+    } catch (err) {
+      if (err.code === "ENOENT") return;
+      throw new KeystoreError("file_clear_failed", asMessage(err), err);
+    }
+  }
+};
+var KeystoreError = class extends Error {
+  constructor(code, message, cause) {
+    super(message);
+    this.code = code;
+    this.cause = cause;
+    this.name = "KeystoreError";
+  }
+  code;
+  cause;
+};
+function parseRecord(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed.jwt !== "string") return null;
+    return {
+      jwt: parsed.jwt,
+      expiresAtSec: typeof parsed.expiresAtSec === "number" ? parsed.expiresAtSec : null,
+      storedAtSec: typeof parsed.storedAtSec === "number" ? parsed.storedAtSec : 0
+    };
+  } catch {
+    throw new KeystoreError("malformed_record", "keystore record is not valid JSON");
+  }
+}
+function asMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function openKeystore(options = {}) {
+  const envPref = process.env.MUHAVEN_KEYRING?.toLowerCase();
+  const wantFile = options.preferred === "file" || envPref === "file";
+  const filePath = options.filePath ?? FileKeystore.defaultPath();
+  if (wantFile) {
+    return { keystore: new FileKeystore(filePath), fallbackReason: null };
+  }
+  const mod = await loadKeyringModule();
+  if (!mod) {
+    return {
+      keystore: new FileKeystore(filePath),
+      fallbackReason: "@napi-rs/keyring not installed for this platform"
+    };
+  }
+  const Entry = mod.Entry;
+  if (!Entry) {
+    return {
+      keystore: new FileKeystore(filePath),
+      fallbackReason: "@napi-rs/keyring loaded but Entry constructor missing"
+    };
+  }
+  let entry;
+  try {
+    entry = new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT);
+    const raw = entry.getPassword();
+    if (raw && typeof raw === "string") {
+      const parsed = parseRecord(raw);
+      if (parsed === null) {
+        return {
+          keystore: new FileKeystore(filePath),
+          fallbackReason: "OS keychain held a record that did not contain a recognizable JWT \u2014 falling back to file. Run `muhaven-broker logout` if you want to clean it up."
+        };
+      }
+    }
+  } catch (err) {
+    const isMalformed = err instanceof KeystoreError && err.code === "malformed_record";
+    return {
+      keystore: new FileKeystore(filePath),
+      fallbackReason: isMalformed ? `OS keychain held a malformed JWT record \u2014 falling back to file. ${asMessage(err)}` : `OS keychain probe failed: ${asMessage(err)}`
+    };
+  }
+  return { keystore: new OsKeystore(entry), fallbackReason: null };
+}
+
+// src/broker/protocol.ts
+var BROKER_PROTOCOL_VERSION = "0.2.0";
+var HASH_HEX_RE = /^0x[0-9a-fA-F]{64}$/;
+var JWT_RE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+function isHashHex(value) {
+  return typeof value === "string" && HASH_HEX_RE.test(value);
+}
+function isJwtShape(value) {
+  return typeof value === "string" && value.length <= 8192 && JWT_RE.test(value);
+}
+function parseBrokerRequest(line) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return { type: "error", code: "invalid_request", message: "request is not valid JSON" };
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return { type: "error", code: "invalid_request", message: "request must be a JSON object" };
+  }
+  const obj = parsed;
+  switch (obj.type) {
+    case "hello":
+      return { type: "hello" };
+    case "sign_hash": {
+      const hash = obj.hash;
+      if (!isHashHex(hash)) {
+        return {
+          type: "error",
+          code: "invalid_request",
+          message: "sign_hash.hash must be a 0x-prefixed 32-byte hex string"
+        };
+      }
+      const intent = obj.intent;
+      const intentValid = intent === void 0 || typeof intent === "object" && intent !== null && typeof intent.tool === "string";
+      if (!intentValid) {
+        return {
+          type: "error",
+          code: "invalid_request",
+          message: "sign_hash.intent.tool must be a string when provided"
+        };
+      }
+      return {
+        type: "sign_hash",
+        hash,
+        ...intent === void 0 ? {} : { intent }
+      };
+    }
+    case "store_jwt": {
+      const jwt = obj.jwt;
+      if (!isJwtShape(jwt)) {
+        return {
+          type: "error",
+          code: "invalid_request",
+          message: "store_jwt.jwt must be a JWT-shaped string \u22648192 chars"
+        };
+      }
+      const expiresAtSec = obj.expiresAtSec;
+      const expiresValid = expiresAtSec === void 0 || typeof expiresAtSec === "number" && Number.isFinite(expiresAtSec) && expiresAtSec > 0;
+      if (!expiresValid) {
+        return {
+          type: "error",
+          code: "invalid_request",
+          message: "store_jwt.expiresAtSec must be a positive number when provided"
+        };
+      }
+      return {
+        type: "store_jwt",
+        jwt,
+        ...expiresAtSec === void 0 ? {} : { expiresAtSec }
+      };
+    }
+    case "get_jwt":
+      return { type: "get_jwt" };
+    case "clear_jwt":
+      return { type: "clear_jwt" };
+    default:
+      return {
+        type: "error",
+        code: "unsupported_type",
+        message: `unsupported request type: ${String(obj.type)}`
+      };
+  }
+}
+function serializeResponse(res) {
+  return JSON.stringify(res) + "\n";
+}
+var ViemSigner = class {
+  account;
+  constructor(privateKey) {
+    this.account = accounts.privateKeyToAccount(privateKey);
+  }
+  get address() {
+    return this.account.address;
+  }
+  async signHash(hash) {
+    return this.account.sign({ hash });
+  }
+};
+
+// src/broker/daemon.ts
+var noopLogger = (_e) => {
+};
+async function handleBrokerRequest(req, signer, keystore, nowSec = () => Math.floor(Date.now() / 1e3)) {
+  switch (req.type) {
+    case "hello": {
+      let hasJwt = false;
+      try {
+        const record = await keystore.get();
+        hasJwt = record !== null;
+      } catch {
+        hasJwt = false;
+      }
+      return {
+        type: "hello",
+        version: BROKER_PROTOCOL_VERSION,
+        sessionKeyAddress: signer.address,
+        hasJwt
+      };
+    }
+    case "sign_hash": {
+      const signature = await signer.signHash(req.hash);
+      return { type: "sign_hash", signature, signerAddress: signer.address };
+    }
+    case "store_jwt": {
+      try {
+        await keystore.set({
+          jwt: req.jwt,
+          expiresAtSec: req.expiresAtSec ?? null,
+          storedAtSec: nowSec()
+        });
+        return { type: "store_jwt", stored: true };
+      } catch (err) {
+        return errorResponse(
+          "keystore_unavailable",
+          err instanceof Error ? err.message : "keystore write failed"
+        );
+      }
+    }
+    case "get_jwt": {
+      try {
+        const record = await keystore.get();
+        return {
+          type: "get_jwt",
+          jwt: record?.jwt ?? null,
+          expiresAtSec: record?.expiresAtSec ?? null
+        };
+      } catch (err) {
+        return errorResponse(
+          "keystore_unavailable",
+          err instanceof Error ? err.message : "keystore read failed"
+        );
+      }
+    }
+    case "clear_jwt": {
+      try {
+        await keystore.clear();
+        return { type: "clear_jwt", cleared: true };
+      } catch (err) {
+        return errorResponse(
+          "keystore_unavailable",
+          err instanceof Error ? err.message : "keystore clear failed"
+        );
+      }
+    }
+  }
+}
+function errorResponse(code, message) {
+  return { type: "error", code, message };
+}
+async function prepareEndpoint(endpoint) {
+  if (os.platform() === "win32") return;
+  const parent = path.dirname(endpoint);
+  await promises.mkdir(parent, { recursive: true, mode: 448 });
+  await promises.chmod(parent, 448);
+  try {
+    const s = await promises.stat(endpoint);
+    if (s.isSocket() || s.isFIFO()) {
+      await promises.unlink(endpoint);
+    }
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+async function applySocketPermissions(endpoint) {
+  if (os.platform() === "win32") return;
+  await promises.chmod(endpoint, 384);
+}
+var BrokerDaemon = class {
+  server;
+  signer;
+  log;
+  config;
+  keystore;
+  constructor(options) {
+    this.config = options.config;
+    this.signer = options.signer ?? new ViemSigner(options.config.sessionKeyHex);
+    this.keystore = options.keystore ?? null;
+    this.log = options.logger ?? noopLogger;
+    this.server = net.createServer((socket) => this.onConnection(socket));
+  }
+  async start() {
+    if (!this.keystore) {
+      const { keystore, fallbackReason } = await openKeystore();
+      this.keystore = keystore;
+      if (fallbackReason) {
+        this.log({
+          level: "warn",
+          msg: "OS keychain unavailable \u2014 falling back to file-backed keystore",
+          meta: { reason: fallbackReason }
+        });
+      }
+    }
+    await prepareEndpoint(this.config.endpoint);
+    await new Promise((resolve, reject) => {
+      const onError = (err) => {
+        this.server.off("listening", onListening);
+        reject(err);
+      };
+      const onListening = () => {
+        this.server.off("error", onError);
+        resolve();
+      };
+      this.server.once("error", onError);
+      this.server.once("listening", onListening);
+      this.server.listen(this.config.endpoint);
+    });
+    await applySocketPermissions(this.config.endpoint);
+    this.log({
+      level: "info",
+      msg: "broker daemon listening",
+      meta: {
+        endpoint: this.config.endpoint,
+        signer: this.signer.address,
+        keystore: this.keystore.backend,
+        version: BROKER_PROTOCOL_VERSION
+      }
+    });
+    return this.config.endpoint;
+  }
+  async stop() {
+    await new Promise((resolve, reject) => {
+      this.server.close((err) => err ? reject(err) : resolve());
+    });
+    if (os.platform() !== "win32") {
+      try {
+        await promises.unlink(this.config.endpoint);
+      } catch (err) {
+        if (err.code !== "ENOENT") {
+          this.log({ level: "warn", msg: "failed to unlink socket on stop", meta: { err } });
+        }
+      }
+    }
+    this.log({ level: "info", msg: "broker daemon stopped" });
+  }
+  onConnection(socket) {
+    let buffer = "";
+    let bytesReceived = 0;
+    const timeout = setTimeout(() => {
+      this.log({ level: "warn", msg: "connection timeout \u2014 closing socket" });
+      socket.destroy();
+    }, this.config.requestTimeoutMs);
+    const cleanup = () => {
+      clearTimeout(timeout);
+      socket.removeAllListeners("data");
+      socket.removeAllListeners("end");
+      socket.removeAllListeners("error");
+    };
+    socket.on("data", (chunk) => {
+      bytesReceived += chunk.length;
+      if (bytesReceived > this.config.maxRequestBytes) {
+        const res = errorResponse("payload_too_large", "request exceeded maxRequestBytes");
+        socket.end(serializeResponse(res));
+        cleanup();
+        return;
+      }
+      buffer += chunk.toString("utf8");
+      const newlineIdx = buffer.indexOf("\n");
+      if (newlineIdx < 0) return;
+      const trailing = buffer.slice(newlineIdx + 1);
+      if (trailing.length > 0) {
+        const res = errorResponse(
+          "invalid_request",
+          "broker is single-shot \u2014 extra bytes after first newline"
+        );
+        socket.end(serializeResponse(res));
+        cleanup();
+        return;
+      }
+      const line = buffer.slice(0, newlineIdx);
+      const parsed = parseBrokerRequest(line);
+      void this.runAndRespond(parsed, socket).finally(() => {
+        cleanup();
+      });
+    });
+    socket.on("error", (err) => {
+      this.log({ level: "warn", msg: "socket error", meta: { err: err.message } });
+      cleanup();
+    });
+    socket.on("end", () => {
+      cleanup();
+    });
+  }
+  async runAndRespond(parsed, socket) {
+    if ("type" in parsed && parsed.type === "error") {
+      socket.end(serializeResponse(parsed));
+      return;
+    }
+    if (!this.keystore) {
+      socket.end(
+        serializeResponse(errorResponse("internal", "keystore not initialized"))
+      );
+      return;
+    }
+    try {
+      const res = await handleBrokerRequest(parsed, this.signer, this.keystore);
+      socket.end(serializeResponse(res));
+    } catch (err) {
+      this.log({
+        level: "error",
+        msg: "handler failed",
+        meta: { err: err instanceof Error ? err.message : String(err) }
+      });
+      socket.end(
+        serializeResponse(errorResponse("internal", "broker handler failed; check broker logs"))
+      );
+    }
+  }
+};
+async function runBrokerDaemonCli() {
+  const config = loadBrokerConfig();
+  const daemon = new BrokerDaemon({
+    config,
+    logger: (e) => {
+      const line = JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...e });
+      process.stderr.write(line + "\n");
+    }
+  });
+  await daemon.start();
+  const shutdown = async () => {
+    await daemon.stop();
+    process.exit(0);
+  };
+  process.on("SIGINT", () => void shutdown());
+  process.on("SIGTERM", () => void shutdown());
+  await new Promise(() => {
+  });
+}
+
+// src/broker/cli.ts
+function print(line) {
+  process.stdout.write(line + "\n");
+}
+function printErr(line) {
+  process.stderr.write(line + "\n");
+}
+function detectMcpHost() {
+  return process.env.MCP_HOST_NAME ?? process.env.CLAUDE_CODE_HOST ?? process.env.npm_lifecycle_event ?? "muhaven-broker-cli";
+}
+function detectEnvironment() {
+  const warnings = [];
+  const isWsl = os.platform() === "linux" && (process.env.WSL_DISTRO_NAME !== void 0 || /microsoft/i.test(os.release()));
+  if (isWsl) {
+    warnings.push("WSL2 detected \u2014 Secret Service is usually absent. Use MUHAVEN_KEYRING=file.");
+  }
+  if (process.env.REMOTE_CONTAINERS === "true" || process.env.CODESPACES === "true") {
+    warnings.push(
+      "devcontainer / Codespace detected \u2014 keystore in container FS is ephemeral on rebuild."
+    );
+  }
+  if (process.env.SSH_CONNECTION) {
+    warnings.push("SSH session detected \u2014 D-Bus / Secret Service is typically unavailable.");
+  }
+  return {
+    kind: isWsl ? "linux/wsl2" : process.env.REMOTE_CONTAINERS === "true" ? "devcontainer" : process.env.CODESPACES === "true" ? "codespace" : `${os.platform()}/${os.release()}`,
+    warnings
+  };
+}
+function parseLoginFlags(argv) {
+  let noLaunchBrowser = false;
+  let brokerEndpoint;
+  let backendBaseUrl;
+  let dashboardBaseUrl;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--no-launch-browser") noLaunchBrowser = true;
+    else if (a === "--broker-endpoint" && i + 1 < argv.length) {
+      brokerEndpoint = argv[++i];
+    } else if (a === "--backend-base-url" && i + 1 < argv.length) {
+      backendBaseUrl = argv[++i];
+    } else if (a === "--dashboard-base-url" && i + 1 < argv.length) {
+      dashboardBaseUrl = argv[++i];
+    } else {
+      throw new Error(`unknown flag: ${a}`);
+    }
+  }
+  return { noLaunchBrowser, brokerEndpoint, backendBaseUrl, dashboardBaseUrl };
+}
+async function tryLaunchBrowser(url) {
+  return new Promise((resolve) => {
+    const cmd = os.platform() === "win32" ? `cmd /c start "" "${url}"` : os.platform() === "darwin" ? `open "${url}"` : `xdg-open "${url}"`;
+    child_process.exec(cmd, (err) => resolve(err == null));
+  });
+}
+async function runLogin(argv) {
+  let flags;
+  try {
+    flags = parseLoginFlags(argv);
+  } catch (err) {
+    printErr(`error: ${err.message}`);
+    printErr("usage: muhaven-broker login [--no-launch-browser] [--broker-endpoint PATH] [--backend-base-url URL] [--dashboard-base-url URL]");
+    return 2;
+  }
+  const env = process.env;
+  const config = loadMcpConfig({
+    ...env,
+    ...flags.brokerEndpoint ? { MUHAVEN_BROKER_ENDPOINT: flags.brokerEndpoint } : {},
+    ...flags.backendBaseUrl ? { MUHAVEN_BACKEND_URL: flags.backendBaseUrl } : {},
+    ...flags.dashboardBaseUrl ? { MUHAVEN_DASHBOARD_URL: flags.dashboardBaseUrl } : {}
+  });
+  const broker = new BrokerClient({
+    endpoint: config.brokerEndpoint,
+    timeoutMs: config.brokerTimeoutMs
+  });
+  try {
+    await broker.hello();
+  } catch (err) {
+    printErr(
+      `cannot reach muhaven-broker daemon at ${config.brokerEndpoint}: ${err.message}`
+    );
+    printErr("hint: start the daemon first (`muhaven-broker` with no subcommand).");
+    return 1;
+  }
+  const flow = new DeviceFlowClient({
+    backendBaseUrl: config.backendBaseUrl,
+    dashboardBaseUrl: config.dashboardBaseUrl,
+    requesterMetadata: {
+      processName: detectMcpHost(),
+      hostname: os.hostname(),
+      os: `${os.platform()}/${os.release()}`
+    }
+  });
+  let lastIssuedSec = 0;
+  try {
+    const generator = flow.run();
+    let result;
+    while (true) {
+      const next = await generator.next();
+      if (next.done) {
+        result = next.value;
+        break;
+      }
+      const event = next.value;
+      switch (event.type) {
+        case "code_issued":
+          lastIssuedSec = Date.now();
+          print("");
+          print(`To link this Claude / Cursor / Claude Code install to MuHaven:`);
+          print("");
+          print(`  1. Open ${event.code.verificationUriComplete}`);
+          print(`  2. Verify the device fingerprint shown on that page`);
+          print(`  3. Authorize with your passkey`);
+          print("");
+          print(`Code expires in ${event.code.expiresInSec}s.`);
+          if (!flags.noLaunchBrowser) {
+            await tryLaunchBrowser(event.code.verificationUriComplete);
+          }
+          print("Waiting for authorization\u2026");
+          break;
+        case "polling":
+          void event;
+          break;
+        case "denied":
+          printErr(`device authorization DENIED${event.reason ? `: ${event.reason}` : ""}`);
+          break;
+        case "expired":
+          printErr("device code expired \u2014 re-run `muhaven-broker login` to issue a new one");
+          break;
+        case "authorized":
+          print(`Authorized in ${Math.round((Date.now() - lastIssuedSec) / 1e3)}s.`);
+          break;
+      }
+    }
+    if (!result) return 1;
+    await broker.storeJwt(result.jwt, result.expiresAtSec ?? void 0);
+    print("JWT stored in keystore. MuHaven MCP tools will use it on next call.");
+    return 0;
+  } catch (err) {
+    if (err instanceof DeviceFlowAbortedError) {
+      printErr(`device flow aborted: ${err.detail.code}`);
+      return 1;
+    }
+    printErr(`unexpected error: ${err.message}`);
+    return 1;
+  }
+}
+async function runLogout() {
+  const config = loadMcpConfig();
+  const broker = new BrokerClient({
+    endpoint: config.brokerEndpoint,
+    timeoutMs: config.brokerTimeoutMs
+  });
+  try {
+    await broker.clearJwt();
+    print("JWT cleared from keystore.");
+    return 0;
+  } catch (err) {
+    printErr(`logout failed: ${err.message}`);
+    return 1;
+  }
+}
+async function runDoctor() {
+  print("muhaven-broker doctor");
+  print("=====================");
+  const env = detectEnvironment();
+  print(`Environment       : ${env.kind}`);
+  for (const w of env.warnings) print(`  warning: ${w}`);
+  print(`Default endpoint  : ${defaultBrokerEndpoint()}`);
+  print(`Configured endpoint: ${process.env.MUHAVEN_BROKER_ENDPOINT ?? defaultBrokerEndpoint()}`);
+  print(`Backend URL       : ${process.env.MUHAVEN_BACKEND_URL ?? "(default https://api.muhaven.app)"}`);
+  print(`Dashboard URL     : ${process.env.MUHAVEN_DASHBOARD_URL ?? "(default https://muhaven.app)"}`);
+  const wantFile = process.env.MUHAVEN_KEYRING?.toLowerCase() === "file";
+  print(`Keystore preference: ${wantFile ? "file (env override)" : "auto (OS keychain \u2192 file fallback)"}`);
+  const { keystore, fallbackReason } = await openKeystore();
+  print(`Keystore backend  : ${keystore.backend}${fallbackReason ? ` (fell back: ${fallbackReason})` : ""}`);
+  try {
+    const original = await keystore.get();
+    if (original) {
+      print(`Keystore round-trip: ok (existing JWT not disturbed)`);
+    } else {
+      const sentinel = { jwt: "__doctor_sentinel__.x.y", expiresAtSec: null, storedAtSec: 0 };
+      await keystore.set(sentinel);
+      const read = await keystore.get();
+      await keystore.clear();
+      if (read?.jwt !== sentinel.jwt) {
+        print(`Keystore round-trip: FAILED (wrote sentinel, read back ${read?.jwt ?? "null"})`);
+      } else {
+        print(`Keystore round-trip: ok`);
+      }
+    }
+  } catch (err) {
+    print(`Keystore round-trip: FAILED (${err instanceof Error ? err.message : String(err)})`);
+  }
+  const config = loadMcpConfig();
+  const broker = new BrokerClient({
+    endpoint: config.brokerEndpoint,
+    timeoutMs: config.brokerTimeoutMs
+  });
+  try {
+    const h = await broker.hello();
+    print(`Broker daemon     : reachable (proto v${h.version}, signer ${h.sessionKeyAddress}, hasJwt=${h.hasJwt})`);
+    return 0;
+  } catch (err) {
+    print(`Broker daemon     : NOT reachable (${err.message})`);
+    print("  hint: start it with `muhaven-broker` (no subcommand)");
+    return 1;
+  }
+}
+function printUsage() {
+  print("usage: muhaven-broker [<subcommand>] [options]");
+  print("");
+  print("  (no subcommand)    Run the daemon (production mode)");
+  print("  login              Acquire a JWT via the device-code flow + store in keystore");
+  print("  logout             Clear the JWT from the keystore");
+  print("  doctor             Print environment + keystore + reachability report");
+  print("  -h, --help         Show this help");
+}
+async function runCli(argv) {
+  const [sub, ...rest] = argv;
+  switch (sub) {
+    case void 0:
+      await runBrokerDaemonCli();
+      return 0;
+    case "login":
+      return runLogin(rest);
+    case "logout":
+      return runLogout();
+    case "doctor":
+      return runDoctor();
+    case "-h":
+    case "--help":
+      printUsage();
+      return 0;
+    default:
+      printErr(`unknown subcommand: ${sub}`);
+      printUsage();
+      return 2;
+  }
+}
+
+exports.runCli = runCli;
+exports.runDoctor = runDoctor;
+exports.runLogin = runLogin;
+exports.runLogout = runLogout;