@n24q02m/mcp-core 1.9.0 → 1.11.0

package/build/lifecycle/lock.js

@@ -0,0 +1,318 @@
+/**
+ * Lock-file lifecycle helpers (D9 — hybrid TTL extension).
+ *
+ * The lock file written by `runLocalServer` may contain 4 lines (legacy
+ * v1) or 6 lines (D9 modern):
+ *
+ * ```
+ * {pid}
+ * {port}
+ * {token}
+ * {spawnedAt_iso8601_utc}
+ * {credState}                    # "configured" | "unconfigured" (D9)
+ * {lastActivityAt_iso8601_utc}   # bumped by daemon refresh loop (D9)
+ * ```
+ *
+ * Stale locks are detected when *any* of:
+ *  - file has legacy 3-line format (no timestamp) → migrate by deletion
+ *  - timestamp older than the applicable TTL
+ *      - configured credState → 24h
+ *      - unconfigured credState → 30 min
+ *  - writing PID does not exist on this host
+ *
+ * Dead-PID locks are reaped immediately. Past-TTL idle setup daemons
+ * (unconfigured) are terminated; configured daemons past TTL get their
+ * lock unlinked but the process is left alone (parity with pre-D9 sweep
+ * behavior so a long-running daemon never gets SIGKILL'd by a sweep
+ * race).
+ *
+ * TypeScript port of core-py's `mcp_core.lifecycle.lock`. Behaviour and
+ * TTL constants kept identical for cross-language parity.
+ */
+import { existsSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+// Self-import so `sweepStaleLocks` can resolve `lockDir`/`isAlive`/
+// `terminateDaemon` through the module namespace at call time. This
+// makes `vi.spyOn(lockModule, '<name>').mockReturnValue(...)` actually
+// intercept the helper from inside the sweep loop — without this
+// indirection, the closure-captured local binding ignores spies and
+// test mocks become silent no-ops.
+import * as self from './lock.js';
+export const DEFAULT_LOCK_TTL_HOURS = 24;
+/** D9 hybrid TTL constants — selected by `credState` in `sweepStaleLocks`. */
+export const LIFECYCLE_TTL_CONFIGURED_MS = 24 * 3600 * 1000;
+export const LIFECYCLE_TTL_UNCONFIGURED_MS = 30 * 60 * 1000;
+export function locksDir(root) {
+    return root ?? join(homedir(), '.config', 'mcp', 'locks');
+}
+/**
+ * No-arg lock-dir resolver — D9 sweep tests `vi.spyOn(lockModule, 'lockDir')`
+ * to redirect into a temp directory without threading a `root` arg.
+ */
+export function lockDir() {
+    return locksDir();
+}
+/**
+ * Serialize `LockMetadata` to the 6-line on-disk format. Trailing
+ * newline included so writes always end in `\n` and the parser's
+ * `lines.length` checks behave deterministically.
+ */
+export function serializeLock(meta) {
+    return [
+        String(meta.pid),
+        String(meta.port),
+        meta.token,
+        meta.spawnedAt.toISOString(),
+        meta.credState,
+        meta.lastActivityAt.toISOString(),
+        ''
+    ].join('\n');
+}
+/**
+ * Parse the textual lock payload into `LockMetadata`. Accepts 4-line
+ * legacy, 5-line transitional, and 6-line D9 modern formats. Throws on
+ * fewer than 4 lines or unparseable timestamp / pid / port.
+ */
+export function parseLock(raw) {
+    const lines = raw.replace(/\n+$/, '').split('\n');
+    if (lines.length < 4)
+        throw new Error(`lock file too few lines: ${lines.length}`);
+    const pid = Number(lines[0]);
+    const port = Number(lines[1]);
+    if (!Number.isInteger(pid) || !Number.isInteger(port)) {
+        throw new Error(`lock file has non-integer pid/port`);
+    }
+    const token = lines[2];
+    const spawnedAt = new Date(lines[3]);
+    if (Number.isNaN(spawnedAt.getTime())) {
+        throw new Error(`lock file has unparseable spawnedAt`);
+    }
+    let credState = 'configured';
+    let lastActivityAt = spawnedAt;
+    if (lines.length >= 6) {
+        credState = lines[4];
+        lastActivityAt = new Date(lines[5]);
+        if (Number.isNaN(lastActivityAt.getTime()))
+            lastActivityAt = spawnedAt;
+    }
+    else if (lines.length === 5) {
+        credState = lines[4];
+    }
+    return { pid, port, token, spawnedAt, credState, lastActivityAt, createdAt: spawnedAt };
+}
+export function parseLockMetadata(path) {
+    if (!existsSync(path))
+        return null;
+    let content;
+    try {
+        content = readFileSync(path, { encoding: 'utf-8' });
+    }
+    catch {
+        return null;
+    }
+    const lines = content.trim().split('\n');
+    // Pre-D9 callers expect null for legacy 3-line format. The new
+    // `parseLock` instead throws — adapter logic here keeps both
+    // contracts: legacy / corrupt -> null; valid 4/5/6-line -> populated.
+    if (lines.length < 4)
+        return null;
+    try {
+        return parseLock(content);
+    }
+    catch {
+        return null;
+    }
+}
+export function isLockExpired(path, ttlHours = DEFAULT_LOCK_TTL_HOURS) {
+    const md = parseLockMetadata(path);
+    if (md === null)
+        return true;
+    const ageMs = Date.now() - md.spawnedAt.getTime();
+    return ageMs > ttlHours * 3600 * 1000;
+}
+/**
+ * Cross-platform PID liveness check via `process.kill(pid, 0)`. Best-effort.
+ * Returns false on EPERM (different-user processes) so sweep does not steal
+ * locks owned by other users. Pre-D9 entry point — kept for backward compat.
+ */
+export function isPidAlive(pid) {
+    if (pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === 'EPERM')
+            return true; // exists but we lack permission
+        return false;
+    }
+}
+/**
+ * Liveness check on a parsed `LockMetadata`. D9 sweep tests
+ * `vi.spyOn(lockModule, 'isAlive')` to control the alive/dead branch
+ * without needing a real PID. Wraps `isPidAlive` so the underlying
+ * cross-platform logic stays in one place.
+ */
+export function isAlive(meta) {
+    return isPidAlive(meta.pid);
+}
+/**
+ * Kill the lock owner. D9 sweep tests `vi.spyOn(lockModule, 'terminateDaemon')`
+ * to assert the unconfigured-TTL branch invokes termination, without
+ * killing real PIDs. Used by `sweepStaleLocks` when an unconfigured
+ * daemon's idle TTL elapses.
+ */
+export function terminateDaemon(pid) {
+    if (pid <= 0)
+        return;
+    try {
+        process.kill(pid, 'SIGKILL');
+    }
+    catch {
+        /* ignore */
+    }
+}
+/**
+ * Refresh `spawnedAt` of an existing lock file. Silent no-op on legacy /
+ * malformed files so callers don't need try/except.
+ *
+ * Padded to 512 bytes so on-disk size stays stable while a Windows
+ * byte-range lock is held past the metadata region (parity with core-py).
+ * Preserves the on-disk line count: a 4-line legacy lock stays 4-line
+ * after refresh; a 6-line modern lock stays 6-line (with both `spawnedAt`
+ * and `lastActivityAt` bumped).
+ */
+export function refreshLockTimestamp(path) {
+    const md = parseLockMetadata(path);
+    if (md === null)
+        return;
+    let raw;
+    try {
+        raw = readFileSync(path, { encoding: 'utf-8' });
+    }
+    catch {
+        return;
+    }
+    const lineCount = raw.trim().split('\n').length;
+    const now = new Date().toISOString();
+    let payload;
+    if (lineCount >= 6) {
+        payload = `${md.pid}\n${md.port}\n${md.token}\n${now}\n${md.credState}\n${now}\n`;
+    }
+    else {
+        payload = `${md.pid}\n${md.port}\n${md.token}\n${now}\n`;
+    }
+    try {
+        writeFileSync(path, payload.padEnd(512, ' '), { encoding: 'utf-8' });
+    }
+    catch {
+        // Best-effort
+    }
+}
+/**
+ * Remove stale lock files for `serverName` (D9 hybrid TTL). Returns count removed.
+ *
+ * Called by `runLocalServer` at daemon startup before writing its own lock,
+ * preventing pile-up of dozens of `<server>-<port>.lock` files when daemons
+ * exit abnormally (Windows OOM, taskkill, signal).
+ *
+ * Backward-compat: the legacy signature `(serverName, ttlHours, root)` is
+ * preserved for pre-D9 callers. New D9 callers pass just `serverName` and
+ * rely on the hybrid TTL plus the `lockDir()` lookup (mockable in tests).
+ */
+export function sweepStaleLocks(serverName, ttlHours, root) {
+    const dir = root !== undefined ? root : self.lockDir();
+    if (!existsSync(dir))
+        return 0;
+    let removed = 0;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return 0;
+    }
+    const prefix = `${serverName}-`;
+    const suffix = '.lock';
+    const now = Date.now();
+    const configuredTtlMs = (ttlHours ?? DEFAULT_LOCK_TTL_HOURS) * 3600 * 1000;
+    for (const entry of entries) {
+        if (!entry.startsWith(prefix) || !entry.endsWith(suffix))
+            continue;
+        const full = join(dir, entry);
+        let raw;
+        try {
+            raw = readFileSync(full, { encoding: 'utf-8' });
+        }
+        catch {
+            try {
+                unlinkSync(full);
+                removed += 1;
+            }
+            catch {
+                /* ignore */
+            }
+            continue;
+        }
+        let meta;
+        try {
+            meta = parseLock(raw);
+        }
+        catch {
+            try {
+                unlinkSync(full);
+                removed += 1;
+            }
+            catch {
+                /* ignore */
+            }
+            continue;
+        }
+        if (!self.isAlive(meta)) {
+            try {
+                unlinkSync(full);
+                removed += 1;
+            }
+            catch {
+                /* ignore */
+            }
+            continue;
+        }
+        const ttlMs = meta.credState === 'configured' ? configuredTtlMs : LIFECYCLE_TTL_UNCONFIGURED_MS;
+        const lastActivityMs = meta.lastActivityAt.getTime();
+        if (now - lastActivityMs > ttlMs) {
+            // Only terminate idle setup daemons aggressively; preserve pre-D9
+            // behavior of unlink-only for configured daemons past TTL.
+            if (meta.credState === 'unconfigured') {
+                self.terminateDaemon(meta.pid);
+            }
+            try {
+                unlinkSync(full);
+                removed += 1;
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    return removed;
+}
+/**
+ * Write the 4-line lock payload (pid, port, token, ISO timestamp) padded
+ * to 512 bytes. Used by `runLocalServer` after the OS file lock is
+ * acquired. Continues to write 4-line for backward compat — D9 sweep
+ * treats 4-line as `credState='configured'` so behavior is equivalent.
+ *
+ * Returns the absolute path to the lock file.
+ */
+export function writeLockFile(serverName, port, token, root) {
+    const dir = locksDir(root);
+    const path = join(dir, `${serverName}-${port}.lock`);
+    const payload = `${process.pid}\n${port}\n${token}\n${new Date().toISOString()}\n`;
+    writeFileSync(path, payload.padEnd(512, ' '), { encoding: 'utf-8', mode: 0o600 });
+    return path;
+}
+//# sourceMappingURL=lock.js.map

package/build/lifecycle/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../src/lifecycle/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC1F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,oEAAoE;AACpE,oEAAoE;AACpE,uEAAuE;AACvE,iEAAiE;AACjE,oEAAoE;AACpE,mCAAmC;AACnC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAA;AAExC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAC3D,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAoB3D,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,OAAO,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO;IACrB,OAAO,QAAQ,EAAE,CAAA;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAkB;IAC9C,OAAO;QACL,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;QAC5B,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE;QACjC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACjF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,SAAS,GAAc,YAAY,CAAA;IACvC,IAAI,cAAc,GAAG,SAAS,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtB,SAAS,GAAG,KAAK,CAAC,CAAC,CAAc,CAAA;QACjC,cAAc,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACnC,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAAE,cAAc,GAAG,SAAS,CAAA;IACxE,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,SAAS,GAAG,KAAK,CAAC,CAAC,CAAc,CAAA;IACnC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AACzF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxC,+DAA+D;IAC/D,6DAA6D;IAC7D,sEAAsE;IACtE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,OAAO,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,WAAmB,sBAAsB;IACnF,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;IACjD,OAAO,KAAK,GAAG,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAA;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAA;QACjD,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA,CAAC,gCAAgC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAkB;IACxC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAM;IACpB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAM;IACvB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAM;IACR,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;IAC/C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,IAAI,OAAe,CAAA;IACnB,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,KAAK,KAAK,GAAG,KAAK,EAAE,CAAC,SAAS,KAAK,GAAG,IAAI,CAAA;IACnF,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,KAAK,KAAK,GAAG,IAAI,CAAA;IAC1D,CAAC;IACD,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,QAAiB,EAAE,IAAa;IAClF,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;IACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAA;IAE9B,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,CAAA;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAA;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,eAAe,GAAG,CAAC,QAAQ,IAAI,sBAAsB,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAE1E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAQ;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7B,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,CAAA;gBAChB,OAAO,IAAI,CAAC,CAAA;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,IAAkB,CAAA;QACtB,IAAI,CAAC;YACH,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,CAAA;gBAChB,OAAO,IAAI,CAAC,CAAA;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,CAAA;gBAChB,OAAO,IAAI,CAAC,CAAA;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,6BAA6B,CAAA;QAC/F,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAA;QACpD,IAAI,GAAG,GAAG,cAAc,GAAG,KAAK,EAAE,CAAC;YACjC,kEAAkE;YAClE,2DAA2D;YAC3D,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;gBACtC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAChC,CAAC;YACD,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,CAAA;gBAChB,OAAO,IAAI,CAAC,CAAA;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,IAAY,EAAE,KAAa,EAAE,IAAa;IAC1F,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,IAAI,IAAI,OAAO,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,KAAK,KAAK,KAAK,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAA;IAClF,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACjF,OAAO,IAAI,CAAA;AACb,CAAC"}

package/build/relay/session.d.ts

@@ -0,0 +1,12 @@
+export interface ActiveFormSession {
+    token: string;
+    clientId: string;
+    startedAt: Date;
+    expiresAt: Date;
+}
+export declare function claimSession(clientId: string): ActiveFormSession;
+export declare function releaseSession(): void;
+export declare function isSessionActive(): boolean;
+export declare function validateSessionToken(token: string): boolean;
+export declare function getActiveSession(): ActiveFormSession | null;
+//# sourceMappingURL=session.d.ts.map

package/build/relay/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/relay/session.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB;AAQD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAYhE;AAED,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED,wBAAgB,eAAe,IAAI,OAAO,CAOzC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAU3D;AAED,wBAAgB,gBAAgB,IAAI,iBAAiB,GAAG,IAAI,CAO3D"}

package/build/relay/session.js

@@ -0,0 +1,55 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+const SESSION_TTL_MS = 30 * 60 * 1000;
+const TOKEN_BYTES = 32;
+let state = null;
+function now() {
+    return new Date();
+}
+export function claimSession(clientId) {
+    if (state !== null && state.expiresAt > now()) {
+        return state;
+    }
+    const startedAt = now();
+    state = {
+        token: randomBytes(TOKEN_BYTES).toString('base64url'),
+        clientId,
+        startedAt,
+        expiresAt: new Date(startedAt.getTime() + SESSION_TTL_MS)
+    };
+    return state;
+}
+export function releaseSession() {
+    state = null;
+}
+export function isSessionActive() {
+    if (state === null)
+        return false;
+    if (state.expiresAt <= now()) {
+        state = null;
+        return false;
+    }
+    return true;
+}
+export function validateSessionToken(token) {
+    if (state === null)
+        return false;
+    if (state.expiresAt <= now()) {
+        state = null;
+        return false;
+    }
+    const a = Buffer.from(state.token);
+    const b = Buffer.from(token);
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+export function getActiveSession() {
+    if (state === null)
+        return null;
+    if (state.expiresAt <= now()) {
+        state = null;
+        return null;
+    }
+    return state;
+}
+//# sourceMappingURL=session.js.map

package/build/relay/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/relay/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE1D,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACrC,MAAM,WAAW,GAAG,EAAE,CAAA;AAStB,IAAI,KAAK,GAA6B,IAAI,CAAA;AAE1C,SAAS,GAAG;IACV,OAAO,IAAI,IAAI,EAAE,CAAA;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAA;IACvB,KAAK,GAAG;QACN,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrD,QAAQ;QACR,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC;KAC1D,CAAA;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,KAAK,GAAG,IAAI,CAAA;AACd,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAChC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC;QAC7B,KAAK,GAAG,IAAI,CAAA;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAChC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC;QAC7B,KAAK,GAAG,IAAI,CAAA;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC;QAC7B,KAAK,GAAG,IAAI,CAAA;QACZ,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/build/relay/tool-helpers.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Helper to register `config__open_relay` MCP tool — D6 (Task 1.8).
+ *
+ * Each consumer server calls `registerOpenRelayTool(mcp, SERVER_NAME, SCHEMA)`
+ * to get the standard tool registered into its MCP server instance. The tool,
+ * when invoked by the LLM, returns the relay form URL and attempts to open
+ * the user's browser. If the daemon is dead it auto-respawns; if a relay
+ * session is already active in another Claude Code window, the handler
+ * returns `session_active` status without auto-opening a second browser tab.
+ */
+export interface OpenRelayResult {
+    url: string;
+    browserOpened: boolean;
+    status: 'configured' | 'unconfigured' | 'expired' | 'session_active';
+}
+export interface OpenRelaySchema {
+    server: string;
+    fields: Array<{
+        name: string;
+        label?: string;
+        required?: boolean;
+        secret?: boolean;
+        [key: string]: unknown;
+    }>;
+    [key: string]: unknown;
+}
+/**
+ * Build the `open_relay` handler closure. Separated out for testability —
+ * tests can call `buildOpenRelayHandler('demo', SCHEMA)` directly without
+ * needing a real MCP server instance.
+ */
+export declare function buildOpenRelayHandler(serverName: string, _schema: OpenRelaySchema | unknown): () => Promise<OpenRelayResult>;
+/**
+ * Minimal shape we require from the MCP server instance to register the
+ * tool. Both `@modelcontextprotocol/sdk`'s `McpServer.tool` and the
+ * FastMCP-style helpers used in consumer servers conform to this surface.
+ */
+export interface ToolRegistrar {
+    tool: (config: {
+        name: string;
+        description?: string;
+    }, handler: () => Promise<OpenRelayResult>) => void;
+}
+/**
+ * Register `config__open_relay` on the given MCP server instance.
+ *
+ * Consumer servers add this single line in their tool registry after the
+ * other `config__*` registrations:
+ *
+ * ```ts
+ * import { registerOpenRelayTool } from '@n24q02m/mcp-core'
+ * registerOpenRelayTool(mcp, SERVER_NAME, RELAY_SCHEMA)
+ * ```
+ */
+export declare function registerOpenRelayTool(mcp: ToolRegistrar, serverName: string, schema: OpenRelaySchema | unknown): void;
+//# sourceMappingURL=tool-helpers.d.ts.map

package/build/relay/tool-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-helpers.d.ts","sourceRoot":"","sources":["../../src/relay/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,OAAO,CAAA;IACtB,MAAM,EAAE,YAAY,GAAG,cAAc,GAAG,SAAS,GAAG,gBAAgB,CAAA;CACrE;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAC,CAAA;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAeD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,eAAe,GAAG,OAAO,GACjC,MAAM,OAAO,CAAC,eAAe,CAAC,CAYhC;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,KAAK,IAAI,CAAA;CACxG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,GAAG,IAAI,CASrH"}

package/build/relay/tool-helpers.js

@@ -0,0 +1,60 @@
+/**
+ * Helper to register `config__open_relay` MCP tool — D6 (Task 1.8).
+ *
+ * Each consumer server calls `registerOpenRelayTool(mcp, SERVER_NAME, SCHEMA)`
+ * to get the standard tool registered into its MCP server instance. The tool,
+ * when invoked by the LLM, returns the relay form URL and attempts to open
+ * the user's browser. If the daemon is dead it auto-respawns; if a relay
+ * session is already active in another Claude Code window, the handler
+ * returns `session_active` status without auto-opening a second browser tab.
+ */
+import { daemonCredState, daemonIsAlive, daemonRelayUrl, daemonRespawn } from '../transport/smart-stdio.js';
+import { tryOpenBrowser } from './browser.js';
+import { isSessionActive } from './session.js';
+/**
+ * Per-server session probe.
+ *
+ * The current session module tracks one global active form session at a
+ * time (Task 1.5), so the server name is currently ignored. Kept as a
+ * one-arg helper to give vi.spyOn hooks a single, server-aware seam that
+ * future per-server session tracking can implement without refactoring
+ * callers.
+ */
+function isSessionActiveForServer(_serverName) {
+    return isSessionActive();
+}
+/**
+ * Build the `open_relay` handler closure. Separated out for testability —
+ * tests can call `buildOpenRelayHandler('demo', SCHEMA)` directly without
+ * needing a real MCP server instance.
+ */
+export function buildOpenRelayHandler(serverName, _schema) {
+    return async function openRelay() {
+        const url = daemonIsAlive(serverName) ? daemonRelayUrl(serverName) : daemonRespawn(serverName);
+        const credState = daemonCredState(serverName);
+        if (isSessionActiveForServer(serverName)) {
+            return { url, browserOpened: false, status: 'session_active' };
+        }
+        const opened = await tryOpenBrowser(url);
+        return { url, browserOpened: !!opened, status: credState };
+    };
+}
+/**
+ * Register `config__open_relay` on the given MCP server instance.
+ *
+ * Consumer servers add this single line in their tool registry after the
+ * other `config__*` registrations:
+ *
+ * ```ts
+ * import { registerOpenRelayTool } from '@n24q02m/mcp-core'
+ * registerOpenRelayTool(mcp, SERVER_NAME, RELAY_SCHEMA)
+ * ```
+ */
+export function registerOpenRelayTool(mcp, serverName, schema) {
+    const handler = buildOpenRelayHandler(serverName, schema);
+    mcp.tool({
+        name: 'config__open_relay',
+        description: `Open the relay configuration form for ${serverName} in the user's browser.`
+    }, handler);
+}
+//# sourceMappingURL=tool-helpers.js.map

package/build/relay/tool-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-helpers.js","sourceRoot":"","sources":["../../src/relay/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC3G,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAoB9C;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,WAAmB;IACnD,OAAO,eAAe,EAAE,CAAA;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,OAAkC;IAElC,OAAO,KAAK,UAAU,SAAS;QAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QAC9F,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAA8B,CAAA;QAE1E,IAAI,wBAAwB,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;QAChE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;QACxC,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC5D,CAAC,CAAA;AACH,CAAC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAkB,EAAE,UAAkB,EAAE,MAAiC;IAC7G,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACzD,GAAG,CAAC,IAAI,CACN;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,yCAAyC,UAAU,yBAAyB;KAC1F,EACD,OAAO,CACR,CAAA;AACH,CAAC"}

package/build/storage/config-file.d.ts

@@ -12,6 +12,23 @@ export declare function scheduleReloadExit(): void;
 export declare function readConfig(serverName: string): Promise<Record<string, string> | null>;
 export declare function writeConfig(serverName: string, config: Record<string, string>): Promise<void>;
 export declare function deleteConfig(serverName: string): Promise<void>;
+/**
+ * Metadata flag set by `markSetupComplete` after a successful relay-form
+ * submission (POST /authorize). `runLocalServer`/`isSchemaComplete` read this
+ * to distinguish "user has submitted the form" from "config.enc has values
+ * written by a peer-share or partial bootstrap path". Lives alongside the
+ * user's normal credential keys in the same per-server config dict.
+ */
+export declare const SETUP_COMPLETE_KEY = "_setup_complete";
+/**
+ * Set the `_setup_complete` flag in `serverName`'s config. Idempotent.
+ * Creates a new entry with just the flag if no prior config exists (useful
+ * for all-optional schemas where the user may submit an empty form).
+ *
+ * Strict equality semantics in `isSchemaComplete` rely on this writing the
+ * literal string `"true"`.
+ */
+export declare function markSetupComplete(serverName: string): Promise<void>;
 export declare function listConfigs(): Promise<string[]>;
 export declare function exportConfig(passphrase: string): Promise<Buffer>;
 export declare function importConfig(passphrase: string, data: Buffer): Promise<void>;

package/build/storage/config-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-file.d.ts","sourceRoot":"","sources":["../../src/storage/config-file.ts"],"names":[],"mappings":"AAkDA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAEvD;AA0BD,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAsDD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAIzC;AAED,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAG3F;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAInG;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYpE;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAGrD;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAItE;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBlF"}
+{"version":3,"file":"config-file.d.ts","sourceRoot":"","sources":["../../src/storage/config-file.ts"],"names":[],"mappings":"AAkDA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAEvD;AA0BD,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAsDD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAIzC;AAED,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAG3F;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAInG;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYpE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,oBAAoB,CAAA;AAEnD;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAGrD;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAItE;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBlF"}

package/build/storage/config-file.js

@@ -108,7 +108,7 @@ async function saveStore(store) {
     }
     const key = await getKey();
     const encrypted = await encryptData(key, JSON.stringify(store));
-    await withRetry(() => writeFile(configPath, encrypted));
+    await withRetry(() => writeFile(configPath, encrypted, { mode: 0o600 }));
 }
 /**
  * Schedule a process exit so an MCP client can respawn the server and pick up
@@ -145,6 +145,27 @@ export async function deleteConfig(serverName) {
         await saveStore(store);
     }
 }
+/**
+ * Metadata flag set by `markSetupComplete` after a successful relay-form
+ * submission (POST /authorize). `runLocalServer`/`isSchemaComplete` read this
+ * to distinguish "user has submitted the form" from "config.enc has values
+ * written by a peer-share or partial bootstrap path". Lives alongside the
+ * user's normal credential keys in the same per-server config dict.
+ */
+export const SETUP_COMPLETE_KEY = '_setup_complete';
+/**
+ * Set the `_setup_complete` flag in `serverName`'s config. Idempotent.
+ * Creates a new entry with just the flag if no prior config exists (useful
+ * for all-optional schemas where the user may submit an empty form).
+ *
+ * Strict equality semantics in `isSchemaComplete` rely on this writing the
+ * literal string `"true"`.
+ */
+export async function markSetupComplete(serverName) {
+    const existing = (await readConfig(serverName)) ?? {};
+    existing[SETUP_COMPLETE_KEY] = 'true';
+    await writeConfig(serverName, existing);
+}
 export async function listConfigs() {
     const store = await loadStore();
     return Object.keys(store.servers);

package/build/storage/config-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-file.js","sourceRoot":"","sources":["../../src/storage/config-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,QAAQ,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAE3D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;AAO5D,SAAS,YAAY,CAAC,MAA+B;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAA;AAC1E,CAAC;AAED,SAAS,cAAc,CAAC,MAAe;IACrC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACvD,OAAO,YAAY,CAAC,MAAiC,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAA;IACzC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACjC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE7D,MAAM,OAAO,GAAG,CAAC,CAAC,OAAkC,CAAA;IACpD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,2CAA2C;AAC3C,IAAI,kBAAkB,GAAkB,IAAI,CAAA;AAE5C,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,kBAAkB,GAAG,IAAI,CAAA;AAC3B,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,kBAAkB,IAAI,mBAAmB,CAAA;AAClD,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB,KAAK,UAAU,SAAS,CAAI,EAAoB;IAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAA;QACnB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAA;YACzG,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,WAAW,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAA;YACvD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;AAChC,CAAC;AAED,8FAA8F;AAC9F,0FAA0F;AAC1F,IAAI,SAAS,GAAqB,IAAI,CAAA;AAEtC,MAAM,UAAU,uBAAuB;IACrC,SAAS,GAAG,IAAI,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,IAAI,SAAS;QAAE,OAAO,SAAS,CAAA;IAC/B,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IAChF,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACpD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACpC,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IAChF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;IAEvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAA;QAC1B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC1C,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAA;YACpF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;YAC1C,CAAC;YACD,qCAAqC;YACrC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;YACtB,OAAO,KAAK,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAkB;IACzC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAA;IAC1B,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/D,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAClE,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IACjD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,MAA8B;IAClF,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,CAAA;IAClC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAEhC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,UAAU,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAA;IACjD,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,IAAY;IACjE,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAA;QACpE,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAA;YACjF,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,2CAA2C;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAA;IAC9B,CAAC;IACD,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC"}
+{"version":3,"file":"config-file.js","sourceRoot":"","sources":["../../src/storage/config-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,QAAQ,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAE3D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;AAO5D,SAAS,YAAY,CAAC,MAA+B;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAA;AAC1E,CAAC;AAED,SAAS,cAAc,CAAC,MAAe;IACrC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACvD,OAAO,YAAY,CAAC,MAAiC,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAA;IACzC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACjC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE7D,MAAM,OAAO,GAAG,CAAC,CAAC,OAAkC,CAAA;IACpD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,2CAA2C;AAC3C,IAAI,kBAAkB,GAAkB,IAAI,CAAA;AAE5C,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,kBAAkB,GAAG,IAAI,CAAA;AAC3B,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,kBAAkB,IAAI,mBAAmB,CAAA;AAClD,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB,KAAK,UAAU,SAAS,CAAI,EAAoB;IAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAA;QACnB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAA;YACzG,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,WAAW,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAA;YACvD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;AAChC,CAAC;AAED,8FAA8F;AAC9F,0FAA0F;AAC1F,IAAI,SAAS,GAAqB,IAAI,CAAA;AAEtC,MAAM,UAAU,uBAAuB;IACrC,SAAS,GAAG,IAAI,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,IAAI,SAAS;QAAE,OAAO,SAAS,CAAA;IAC/B,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IAChF,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACpD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACpC,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IAChF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;IAEvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAA;QAC1B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC1C,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAA;YACpF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;YAC1C,CAAC;YACD,qCAAqC;YACrC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;YACtB,OAAO,KAAK,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAkB;IACzC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAA;IAC1B,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/D,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAClE,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IACjD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,MAA8B;IAClF,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,CAAA;IAClC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAEhC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,UAAU,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,QAAQ,GAAG,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;IACrD,QAAQ,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAA;IACrC,MAAM,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAA;IACjD,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,IAAY;IACjE,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAA;QACpE,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAA;YACjF,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,2CAA2C;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAA;IAC9B,CAAC;IACD,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC"}

package/build/storage/session-lock.js

@@ -77,7 +77,7 @@ export async function writeSessionLock(serverName, info) {
     };
     // Write atomically via temp file + rename
     const tmpPath = `${path}.tmp`;
-    await writeFile(tmpPath, JSON.stringify(data), 'utf-8');
+    await writeFile(tmpPath, JSON.stringify(data), { encoding: 'utf-8', mode: 0o600 });
     await rename(tmpPath, path);
 }
 export async function releaseSessionLock(serverName) {