@nekzus/liop 2.0.0-alpha.1 → 2.0.0-alpha.3

package/README.md

@@ -58,7 +58,7 @@ npm install @nekzus/liop
 
 ## LIOP Agent (CLI)
 
-The SDK includes a zero-config agent (`liop-agent`) designed to bridge the Logic-Injection-on-Origin Protocol with local AI clients like **Claude Desktop**.
+The SDK includes a zero-config agent CLI (`liop`) designed to bridge the Logic-Injection-on-Origin Protocol with local AI clients like **Claude Desktop**.
 
 ### Installation & Run
 
@@ -70,19 +70,23 @@ npx @nekzus/liop
 
 # Or install globally
 npm install -g @nekzus/liop
-liop-agent
+liop
 ```
 
 ### 🤖 Claude Desktop Configuration
 
-To use the Neural Mesh inside Claude Desktop, update your `claude_desktop_config.json` (typically found in `%APPDATA%\Claude\claude_desktop_config.json` on Windows):
+To integrate LIOP into Claude Desktop, update your `claude_desktop_config.json` (typically found in `%APPDATA%\Claude\claude_desktop_config.json` on Windows):
 
 ```json
 {
   "mcpServers": {
-    "liop-agent": {
+    "liop": {
       "command": "npx",
-      "args": ["-y", "@nekzus/liop"]
+      "args": ["-y", "@nekzus/liop"],
+      "env": {
+        "LIOP_NEXUS_URL": "http://your-nexus-host:3000",
+        "LIOP_LOG_LEVEL": "info"
+      }
     }
   }
 }
@@ -198,7 +202,11 @@ new LiopServer(
       forbiddenKeys?: string[];    // Keys stripped from outgoing responses
       enableNerScanning?: boolean; // NLP entity detection via compromise (default: false)
       rateLimit?: {                // Sliding window rate limiter per tool
-        maxPerWindow?: number;     // Max calls per window (default: 30)
+        maxPerWindow?: number;     // Max calls per window (default: 15)
+        windowMs?: number;         // Window duration in ms (default: 60000)
+      };
+      globalRateLimit?: {           // Cross-tool aggregate rate limiter
+        maxPerWindow?: number;     // Max total calls per window (default: 40)
         windowMs?: number;         // Window duration in ms (default: 60000)
       };
     };
@@ -260,20 +268,21 @@ await bridge.connect();
 ```
 ┌───────────────────────────────────────────────────────────┐
 │  Layer 1: Guardian AST (Zero-Time Static Analysis)        │
-│  Blocks: require, import(), fs, eval, fetch, process,     │
-│  global, __proto__, XMLHttpRequest • 128 import cap       │
+│  14-function WASI allowlist • 128 import cap • Blocks     │
+│  require, import(), fs, eval, fetch, __proto__            │
 ├───────────────────────────────────────────────────────────┤
 │  Layer 2: WASI Sandbox (V8 Isolate)                       │
 │  25 poisoned globals (incl. Date, TypedArrays) •          │
 │  CPU Fuel limits • 5s timeout • maxHeapMb (64MB default)  │
+│  Object.freeze() on 6 core prototypes                     │
 ├───────────────────────────────────────────────────────────┤
-│  Layer 3: Prototype Pollution Defense                     │
-│  Object.freeze() on 6 core prototypes (Object, Array,     │
-│  String, Number, Boolean, Function) inside sandbox IIFE   │
+│  Layer 3: Taint Analyzer (IFC — Static)                   │
+│  Acorn AST 3-pass analysis blocks PII side-channels:      │
+│  charCodeAt, boolean inference, arithmetic derivation     │
 ├───────────────────────────────────────────────────────────┤
 │  Layer 4: PII Shield (Egress Filter)                      │
-│  Scans output for Email, SSN, Credit Card, IP, IBAN,      │
-│  Passport MRZ • Strips forbidden keys • NER opt-in        │
+│  4-stage pipeline: exact key → fuzzy key → pattern        │
+│  validators (Luhn, IBAN Mod-97) → NER (compromise)        │
 ├───────────────────────────────────────────────────────────┤
 │  Layer 5: Aggregation-First Policy                        │
 │  Blocks raw row export • maxOutputRows (default: 10) •    │
@@ -281,7 +290,7 @@ await bridge.connect();
 ├───────────────────────────────────────────────────────────┤
 │  Layer 6: ZK-Receipt (Integrity Verification)             │
 │  SHA-256 ImageID + HMAC-SHA256 Seal (Kyber768-derived)    │
-│  LiopMcpBridge verifies before forwarding to LLM          │
+│  Timing-safe verification • LiopMcpBridge auto-verifies   │
 └───────────────────────────────────────────────────────────┘
 ```
 
@@ -331,9 +340,10 @@ The following shows a complete Logic-Injection-on-Origin execution cycle (handle
 2. LiopServer receives the payload via tools/call (JSON-RPC or direct)
 3. Guardian AST inspects for sandbox escapes (zero-time heuristic analysis)
 4. Code executes inside a V8 isolate with CPU fuel limits (no Node.js globals)
-5. PII Shield scans output for forbidden data and keys
-6. ZK-Receipt generated (SHA-256 logic hash + SHA-512 seal)
-7. Result + receipt returned to the LLM (raw data never exposed)
+5. Taint Analyzer blocks PII side-channel derivation (charCodeAt, boolean inference)
+6. PII Shield scans output for forbidden data and keys
+7. ZK-Receipt generated (SHA-256 ImageID + HMAC-SHA256 seal)
+8. Result + receipt returned to the LLM (raw data never exposed)
 ```
 
 ### Data Dictionary & Zero-Shot Autonomy
@@ -414,11 +424,11 @@ await server.connectToMesh();
 
 This package is continuously tested across multiple platforms and Node.js versions via CI/CD:
 
-- **227+ tests** spanning unit, integration, conformance, adversarial, and crossnet suites
+- **259+ tests** spanning unit, integration, conformance, adversarial, and crossnet suites
 - **Multi-OS matrix:** Ubuntu, Windows, macOS
-- **Node.js versions:** 22.x, 24.x
+- **Node.js versions:** 20.x, 22.x
 - **Code quality:** Enforced by [Biome.js](https://biomejs.dev/) (linting + formatting)
-- **Security:** Verified defense-in-depth architecture — see [Security Architecture](https://nekzus-32.mintlify.app/typescript-sdk/security)
+- **Security:** Verified 6-layer defense-in-depth architecture — see [Security Architecture](https://nekzus-32.mintlify.app/typescript-sdk/security)
 
 > To run tests locally or contribute, clone the [repository](https://github.com/Nekzus/LIOP) and follow the [Contributing Guide](https://github.com/Nekzus/LIOP/blob/main/CONTRIBUTING.md).
 

package/dist/bin/agent.d.ts

@@ -1,2 +1 @@
 #!/usr/bin/env node
-export {};

package/dist/bin/agent.js

@@ -1,307 +1,6 @@
 #!/usr/bin/env node
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { multiaddr } from "@multiformats/multiaddr";
-import { LiopMcpRouter } from "../gateway/router.js";
-import { MeshNode } from "../mesh/index.js";
-import { LiopServer } from "../server/index.js";
-import { log } from "../utils/logger.js";
-/**
- * Resolves a full libp2p multiaddr (with PeerID) from a LIOP node's
- * HTTP health endpoint. This enables zero-config bootstrap — users
- * only need to provide a URL, not a cryptographic PeerID.
- *
- * @param url - HTTP URL of a LIOP node's health endpoint (e.g. "http://host:3000")
- * @returns Full multiaddr string with PeerID, or null if resolution fails
- */
-async function resolveBootstrapFromUrl(url) {
-    try {
-        const healthUrl = url.endsWith("/health") ? url : `${url}/health`;
-        const response = await fetch(healthUrl, {
-            headers: { Accept: "application/json" },
-            signal: AbortSignal.timeout(10000), // Increased to 10s
-        });
-        if (!response.ok)
-            return null;
-        const data = await response.json();
-        if (!data.mesh?.multiaddrs?.length || !data.mesh?.peerId)
-            return null;
-        // Find TCP multiaddr (prefer non-websocket for stability)
-        const tcpAddr = data.mesh.multiaddrs.find((a) => a.includes("/tcp/") &&
-            !a.includes("/ws") &&
-            !a.includes("/ip4/127.0.0.1/"));
-        if (!tcpAddr)
-            return null;
-        // Rewrite internal Docker IP using industrial mapper if available
-        let resolved = industrialAddressMapper(tcpAddr);
-        if (!resolved || resolved === tcpAddr) {
-            const urlHost = new URL(url).hostname;
-            resolved = tcpAddr.replace(/\/ip4\/[^/]+/, `/ip4/${urlHost}`);
-        }
-        if (!resolved)
-            return null;
-        resolved += resolved.includes("/p2p/") ? "" : `/p2p/${data.mesh.peerId}`;
-        return resolved;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Normalizes a bootstrap multiaddr string.
- * If the address contains a Docker bridge IP (172.16-31.x.x) or Loopback (127.0.0.1),
- * rewrites it to the host accessible via LIOP_NEXUS_URL (e.g. WSL2 IP).
- * This is critical when WSL2 mirror-mode networking is broken.
- */
-function normalizeBootstrap(addr) {
-    const trimmed = addr.trim();
-    // Remap Docker bridge IPs and ANY external physical IPs to 127.0.0.1
-    // because Test-NetConnection confirmed 127.0.0.1 is the only reliable path to Docker ports.
-    const dockerIpRegex = /\/ip4\/172\.(1[6-9]|2[0-9]|3[0-1])\.[0-9]{1,3}\.[0-9]{1,3}/;
-    const loopbackRegex = /\/ip4\/127\.0\.0\.1/;
-    const physicalIpRegex = /\/ip4\/192\.168\.[0-9]{1,3}\.[0-9]{1,3}/;
-    if (dockerIpRegex.test(trimmed) ||
-        loopbackRegex.test(trimmed) ||
-        physicalIpRegex.test(trimmed)) {
-        const targetIp = "127.0.0.1";
-        const normalized = trimmed
-            .replace(dockerIpRegex, `/ip4/${targetIp}`)
-            .replace(loopbackRegex, `/ip4/${targetIp}`)
-            .replace(physicalIpRegex, `/ip4/${targetIp}`);
-        if (normalized !== trimmed) {
-            log.info(`[LIOP-Agent] 🔄 Local Routing Hack → Forced 127.0.0.1: ${normalized}`);
-        }
-        return normalized;
-    }
-    return trimmed;
-}
-/**
- * industrialAddressMapper
- *
- * Mapea IPs internas de Docker a puertos industriales mapeados en el Host.
- * Nexus (172.20.0.10) -> 13001
- * Vault (172.20.0.11) -> 13003
- * Bank  (172.20.0.12) -> 13004
- * Oracle(172.20.0.13) -> 13005
- */
-function industrialAddressMapper(addr) {
-    if (addr.includes("/ip4/172.20.0.10"))
-        return addr.replace(/\/ip4\/172\.20\.0\.10\/tcp\/[0-9]+/, "/ip4/127.0.0.1/tcp/13001");
-    if (addr.includes("/ip4/172.20.0.11"))
-        return addr.replace(/\/ip4\/172\.20\.0\.11\/tcp\/[0-9]+/, "/ip4/127.0.0.1/tcp/13003");
-    if (addr.includes("/ip4/172.20.0.12"))
-        return addr.replace(/\/ip4\/172\.20\.0\.12\/tcp\/[0-9]+/, "/ip4/127.0.0.1/tcp/13004");
-    if (addr.includes("/ip4/172.20.0.13"))
-        return addr.replace(/\/ip4\/172\.20\.0\.13\/tcp\/[0-9]+/, "/ip4/127.0.0.1/tcp/13005");
-    // Drop container-internal loopbacks to prevent the Host Agent from dialing itself or conflicting ports
-    if (addr.includes("/ip4/127.0.0.1/tcp/4000") ||
-        addr.includes("/ip4/127.0.0.1/tcp/3000")) {
-        return null;
-    }
-    return addr;
-}
-/**
- * LIOP Agent (Zero-Config CLI)
- *
- * Secure Logic-on-Origin gateway for Claude Desktop.
- * Communicates via STDIO / JSON-RPC.
- *
- * All tool discovery is DYNAMIC via the /liop/manifest/1.0.0 protocol.
- * No hardcoded tools, PeerIDs, or port mappings.
- */
-async function main() {
-    const buildTime = new Date().toISOString();
-    log.info(`[LIOP-Agent] 🚀 Version 1.2.0-alpha.9 | Build: ${buildTime}`);
-    const liopDir = path.join(os.homedir(), ".liop");
-    const identityPath = path.join(liopDir, "identity.json");
-    if (!fs.existsSync(liopDir)) {
-        fs.mkdirSync(liopDir, { recursive: true });
-    }
-    // 1. Determine Bootstrap Nodes (Zero-Config Discovery)
-    let bootstrapNodes = [];
-    // Command line arguments take precedence
-    const args = process.argv.slice(2);
-    if (args.length > 0) {
-        bootstrapNodes = args.filter((a) => a.startsWith("/"));
-    }
-    // Priority 1: Physical Beacons (Industrial Pattern) - DETERMINISTIC & INSTANT
-    if (bootstrapNodes.length === 0) {
-        const searchDirs = [];
-        // Priority 1.1: Explicit file from environment variable
-        if (process.env.LIOP_BOOTSTRAP_FILE) {
-            const filePath = path.resolve(process.env.LIOP_BOOTSTRAP_FILE);
-            if (fs.existsSync(filePath)) {
-                const addr = fs.readFileSync(filePath, "utf8").trim();
-                if (addr)
-                    bootstrapNodes.push(normalizeBootstrap(addr));
-            }
-        }
-        // Priority 1.2: Traditional locations (Scan for all *.multiaddr)
-        searchDirs.push(process.cwd(), path.join(process.cwd(), "tests/infra/nexus-data"), liopDir, path.join(path
-            .dirname(new URL(import.meta.url).pathname)
-            .replace(/^\/([A-Z]:)/, "$1"), "../../tests/infra/nexus-data"));
-        for (const dir of searchDirs) {
-            try {
-                if (fs.existsSync(dir)) {
-                    const files = fs.readdirSync(dir);
-                    const multiaddrFiles = files.filter((f) => f.endsWith(".multiaddr"));
-                    for (const file of multiaddrFiles) {
-                        const filePath = path.join(dir, file);
-                        const addr = fs.readFileSync(filePath, "utf8").trim();
-                        if (addr) {
-                            const normalized = normalizeBootstrap(addr);
-                            if (!bootstrapNodes.includes(normalized)) {
-                                bootstrapNodes.push(normalized);
-                                log.info(`[LIOP-Agent] ✅ Loaded beacon: ${file} from ${dir}`);
-                            }
-                        }
-                    }
-                    // If we found any beacons in this directory, we consider discovery successful for this layer
-                    if (bootstrapNodes.length > 0)
-                        break;
-                }
-            }
-            catch (_e) {
-                /* ignore */
-            }
-        }
-    }
-    // Priority 2: Auto-Discovery via NEXUS URL (Aggressive Parallel Discovery)
-    if (process.env.LIOP_NEXUS_URL) {
-        const nexusUrl = process.env.LIOP_NEXUS_URL;
-        log.info(`[LIOP-Agent] 🌐 Running parallel discovery from: ${nexusUrl} (Sources Found: ${bootstrapNodes.length})`);
-        const resolved = await resolveBootstrapFromUrl(nexusUrl);
-        if (resolved) {
-            const normalized = normalizeBootstrap(resolved);
-            if (!bootstrapNodes.includes(normalized)) {
-                bootstrapNodes.push(normalized);
-                log.info(`[LIOP-Agent] ✅ Added bootstrap from URL discovery: ${normalized}`);
-            }
-        }
-    }
-    // Priority 3: Environment variable (direct multiaddr)
-    if (bootstrapNodes.length === 0 && process.env.LIOP_BOOTSTRAP) {
-        bootstrapNodes.push(process.env.LIOP_BOOTSTRAP.trim());
-    }
-    // Final fallback: local Nexus bootstrap for demo environments.
-    // Avoid injecting stale static peer IDs when discovery already found valid peers.
-    if (bootstrapNodes.length === 0) {
-        bootstrapNodes.push("/ip4/127.0.0.1/tcp/13001/p2p/12D3KooWD8FUFdnLQzzLFNdicsaTknM5cpD7os9sK9NWVSVABJMD");
-    }
-    // Sanitize/validate all candidate multiaddrs so malformed PeerIDs don't crash startup.
-    bootstrapNodes = bootstrapNodes.filter((addr) => {
-        try {
-            multiaddr(addr);
-            return true;
-        }
-        catch {
-            log.warn(`[LIOP-Agent] Ignoring invalid bootstrap multiaddr: ${addr}`);
-            return false;
-        }
-    });
-    // If no bootstrap nodes found, the agent operates in standalone mode.
-    // It will only serve local tools until peers are discovered.
-    if (bootstrapNodes.length === 0) {
-        log.info("[LIOP-Agent] No bootstrap nodes configured. Operating in standalone mode.");
-        log.info("[LIOP-Agent] Pass a multiaddr as argument or create 'nexus.multiaddr' file.");
-    }
-    // Initialize local server node (lightweight, no tools registered locally)
-    const liopServer = new LiopServer({
-        name: "@nekzus/liop-agent",
-        version: "1.0.0",
-    });
-    // Enable Zero-Shot Autonomy (Industrial Prompt Injection)
-    liopServer.enableZeroShotAutonomy();
-    // 2. Mesh Node Configuration
-    const meshNode = new MeshNode({
-        identityPath: identityPath,
-        bootstrapNodes: bootstrapNodes,
-        addressMapper: industrialAddressMapper,
-    });
-    // Start P2P Mesh
-    await meshNode.start();
-    // 3. Initialize the Dynamic Router
-    // No hardcoded tools — all discovery happens via liop:manifest protocol
-    const router = new LiopMcpRouter(liopServer, meshNode);
-    // Proactive Notification to Claude Desktop when tools/resources are discovered dynamically
-    router.onToolsChanged = () => {
-        process.stdout.write(`{"jsonrpc":"2.0","method":"notifications/tools/list_changed"}\n`);
-        process.stdout.write(`{"jsonrpc":"2.0","method":"notifications/resources/list_changed"}\n`);
-    };
-    // Initial warming period (2s) then Adaptive Background Discovery
-    // Polls DHT for new nodes and triggers onToolsChanged when topology shifts.
-    // Uses exponential backoff to reduce polling load on stable meshes.
-    setTimeout(() => {
-        // biome-ignore lint/suspicious/noExplicitAny: access internal for telemetry
-        const rtSize = meshNode.getRoutingTableSize?.() || 0;
-        log.info(`[LIOP-Agent] Warm-up complete. Routing Table size: ${rtSize}`);
-        router.refreshManifestCache(true).catch(() => { });
-    }, 2000);
-    const POLL_BASE_MS = 10_000;
-    const POLL_MAX_MS = 120_000;
-    let pollIntervalMs = POLL_BASE_MS;
-    const scheduleAdaptivePoll = () => {
-        setTimeout(async () => {
-            const prevSize = router.getCacheSize();
-            await router.refreshManifestCache(true).catch(() => { });
-            const newSize = router.getCacheSize();
-            if (newSize !== prevSize) {
-                // Topology changed — reset to aggressive polling
-                pollIntervalMs = POLL_BASE_MS;
-                log.info(`[LIOP-Agent] Topology change detected (${prevSize} → ${newSize}). Resetting poll to ${POLL_BASE_MS / 1000}s.`);
-            }
-            else {
-                // Stable — relax polling interval (factor 1.5)
-                pollIntervalMs = Math.min(Math.round(pollIntervalMs * 1.5), POLL_MAX_MS);
-            }
-            scheduleAdaptivePoll();
-        }, pollIntervalMs);
-    };
-    scheduleAdaptivePoll();
-    // 4. STDIO Transport — Buffered Line Reader
-    // Uses readline to guarantee complete JSON-RPC messages before parsing.
-    // Raw stdin.on("data") can fragment large payloads across multiple chunks.
-    const readline = await import("node:readline");
-    const rl = readline.createInterface({
-        input: process.stdin,
-        terminal: false,
-    });
-    process.stdout.on("error", (err) => {
-        if (err.code === "EPIPE") {
-            process.exit(0); // Graceful exit when Claude Desktop disconnects
-        }
-    });
-    rl.on("line", async (line) => {
-        const trimmed = line.trim();
-        if (!trimmed)
-            return;
-        try {
-            const request = JSON.parse(trimmed);
-            if (request.method) {
-                const response = await router.dispatch(request);
-                if (response) {
-                    process.stdout.write(`${JSON.stringify(response)}\n`);
-                }
-            }
-        }
-        catch (_err) {
-            // Silent catch for binary noise or malformed lines
-        }
-    });
-    rl.on("close", () => {
-        process.exit(0);
-    });
-    // Status directed only to stderr
-    log.info(`[LIOP-Agent] Guarding Claude Desktop via STDIO.`);
-    log.info(`[LIOP-Agent] P2P Mesh: Joined (${bootstrapNodes.length} bootstraps)`);
-    log.info("[LIOP-Agent] Tool discovery: Dynamic via /liop/manifest/1.0.0");
-    process.on("SIGINT", async () => {
-        await meshNode.stop();
-        process.exit(0);
-    });
-}
-main().catch((err) => {
-    log.error(`[LIOP-Agent] Fatal Error: ${err.message}`);
-    process.exit(1);
-});
+import {f}from'../chunk-FW6CICSY.js';import {g}from'../chunk-7MAGL6ON.js';import'../chunk-UVTEJYHN.js';import'../chunk-ANFXJGMP.js';import'../chunk-DBXGYHKY.js';import'../chunk-HM77MWB6.js';import'../chunk-RWRRBYG4.js';import {a as a$1}from'../chunk-PPCOS2NU.js';import {a}from'../chunk-S6RJHZV2.js';import*as l from'fs';import*as w from'os';import*as d from'path';import {multiaddr}from'@multiformats/multiaddr';async function E(t){try{let r=t.endsWith("/health")?t:`${t}/health`,f=await fetch(r,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(1e4)});if(!f.ok)return null;let e=await f.json();if(!e.mesh?.multiaddrs?.length||!e.mesh?.peerId)return null;let p=e.mesh.multiaddrs.find(c=>c.includes("/tcp/")&&!c.includes("/ws")&&!c.includes("/ip4/127.0.0.1/"));if(!p)return null;let n=process.env.NODE_ENV==="development"||process.env.NODE_ENV==="test"?R(p):p;if(!n||n===p){let c=new URL(t).hostname;n=p.replace(/\/ip4\/[^/]+/,`/ip4/${c}`);}return n?(n+=n.includes("/p2p/")?"":`/p2p/${e.mesh.peerId}`,n):null}catch{return null}}function L(t){let r=t.trim(),f=/\/ip4\/172\.(1[6-9]|2[0-9]|3[0-1])\.[0-9]{1,3}\.[0-9]{1,3}/,e=/\/ip4\/127\.0\.0\.1/,p=/\/ip4\/192\.168\.[0-9]{1,3}\.[0-9]{1,3}/;if(f.test(r)||e.test(r)||p.test(r)){let u="127.0.0.1",n=r.replace(f,`/ip4/${u}`).replace(e,`/ip4/${u}`).replace(p,`/ip4/${u}`);return n!==r&&a.info(`[LIOP-Agent] \u{1F504} Local Routing Hack \u2192 Forced 127.0.0.1: ${n}`),n}return r}function R(t){return t.includes("/ip4/172.20.0.10")?t.replace(/\/ip4\/172\.20\.0\.10\/tcp\/[0-9]+/,"/ip4/127.0.0.1/tcp/13001"):t.includes("/ip4/172.20.0.11")?t.replace(/\/ip4\/172\.20\.0\.11\/tcp\/[0-9]+/,"/ip4/127.0.0.1/tcp/13003"):t.includes("/ip4/172.20.0.12")?t.replace(/\/ip4\/172\.20\.0\.12\/tcp\/[0-9]+/,"/ip4/127.0.0.1/tcp/13004"):t.includes("/ip4/172.20.0.13")?t.replace(/\/ip4\/172\.20\.0\.13\/tcp\/[0-9]+/,"/ip4/127.0.0.1/tcp/13005"):t.includes("/ip4/127.0.0.1/tcp/4000")||t.includes("/ip4/127.0.0.1/tcp/3000")?null:t}async function M(){let t=new Date().toISOString();a.info(`[LIOP-Agent] \u{1F680} Version 1.2.0-alpha.9 | Build: ${t}`);let r=d.join(w.homedir(),".liop"),f$1=d.join(r,"identity.json");l.existsSync(r)||l.mkdirSync(r,{recursive:true});let e=[],p=process.argv.slice(2);if(p.length>0&&(e=p.filter(s=>s.startsWith("/"))),e.length===0){let s=[];if(process.env.LIOP_BOOTSTRAP_FILE){a.warn("LIOP_BOOTSTRAP_FILE is deprecated and will be removed in the next major version. Use LIOP_NEXUS_URL for Auto-Discovery instead.");let i=d.resolve(process.env.LIOP_BOOTSTRAP_FILE);if(l.existsSync(i)){let a=l.readFileSync(i,"utf8").trim();a&&e.push(L(a));}}s.push(process.cwd(),d.join(process.cwd(),"tests/infra/nexus-data"),r,d.join(d.dirname(new URL(import.meta.url).pathname).replace(/^\/([A-Z]:)/,"$1"),"../../tests/infra/nexus-data"));for(let i of s)try{if(l.existsSync(i)){let h=l.readdirSync(i).filter(g=>g.endsWith(".multiaddr"));for(let g of h){let N=d.join(i,g),v=l.readFileSync(N,"utf8").trim();if(v){let S=L(v);e.includes(S)||(e.push(S),a.info(`[LIOP-Agent] \u2705 Loaded beacon: ${g} from ${i}`));}}if(e.length>0)break}}catch{}}if(process.env.LIOP_NEXUS_URL){let s=process.env.LIOP_NEXUS_URL;a.info(`[LIOP-Agent] \u{1F310} Running parallel discovery from: ${s} (Sources Found: ${e.length})`);let i=await E(s);if(i){let a$1=L(i);e.includes(a$1)||(e.push(a$1),a.info(`[LIOP-Agent] \u2705 Added bootstrap from URL discovery: ${a$1}`));}}e.length===0&&process.env.LIOP_BOOTSTRAP&&e.push(process.env.LIOP_BOOTSTRAP.trim()),e.length===0&&e.push("/ip4/127.0.0.1/tcp/13001/p2p/12D3KooWD8FUFdnLQzzLFNdicsaTknM5cpD7os9sK9NWVSVABJMD"),e=e.filter(s=>{try{return multiaddr(s),!0}catch{return a.warn(`[LIOP-Agent] Ignoring invalid bootstrap multiaddr: ${s}`),false}}),e.length===0&&(a.info("[LIOP-Agent] No bootstrap nodes configured. Operating in standalone mode."),a.info("[LIOP-Agent] Pass a multiaddr as argument or create 'nexus.multiaddr' file."));let u=new f({name:"@nekzus/liop",version:"1.0.0"});u.enableZeroShotAutonomy();let n=new a$1({identityPath:f$1,bootstrapNodes:e,addressMapper:process.env.NODE_ENV==="development"||process.env.NODE_ENV==="test"?R:void 0});await n.start();let c=new g(u,n);c.onToolsChanged=()=>{process.stdout.write(`{"jsonrpc":"2.0","method":"notifications/tools/list_changed"}
+`),process.stdout.write(`{"jsonrpc":"2.0","method":"notifications/resources/list_changed"}
+`);},setTimeout(()=>{let s=n.getRoutingTableSize?.()||0;a.info(`[LIOP-Agent] Warm-up complete. Routing Table size: ${s}`),c.refreshManifestCache(true).catch(()=>{});},2e3);let O=1e4,$=12e4,m=O,P=()=>{setTimeout(async()=>{let s=c.getCacheSize();await c.refreshManifestCache(true).catch(()=>{});let i=c.getCacheSize();i!==s?(m=O,a.info(`[LIOP-Agent] Topology change detected (${s} \u2192 ${i}). Resetting poll to ${O/1e3}s.`)):m=Math.min(Math.round(m*1.5),$),P();},m);};P();let I=(await import('readline')).createInterface({input:process.stdin,terminal:false});process.stdout.on("error",s=>{s.code==="EPIPE"&&process.exit(0);}),I.on("line",async s=>{let i=s.trim();if(i)try{let a=JSON.parse(i);if(a.method){let h=await c.dispatch(a);h&&process.stdout.write(`${JSON.stringify(h)}
+`);}}catch{}}),I.on("close",()=>{process.exit(0);}),a.info("[LIOP-Agent] Guarding Claude Desktop via STDIO."),a.info(`[LIOP-Agent] P2P Mesh: Joined (${e.length} bootstraps)`),a.info("[LIOP-Agent] Tool discovery: Dynamic via /liop/manifest/1.0.0"),process.on("SIGINT",async()=>{await n.stop(),process.exit(0);});}M().catch(t=>{a.error(`[LIOP-Agent] Fatal Error: ${t.message}`),process.exit(1);});//# sourceMappingURL=agent.js.map
+//# sourceMappingURL=agent.js.map

package/dist/bin/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/bin/agent.ts"],"names":["resolveBootstrapFromUrl","url","healthUrl","response","data","tcpAddr","a","resolved","industrialAddressMapper","urlHost","normalizeBootstrap","addr","trimmed","dockerIpRegex","loopbackRegex","physicalIpRegex","targetIp","normalized","log","main","buildTime","liopDir","identityPath","bootstrapNodes","args","searchDirs","filePath","dir","multiaddrFiles","f","file","nexusUrl","multiaddr","liopServer","LiopServer","meshNode","MeshNode","router","LiopMcpRouter","rtSize","POLL_BASE_MS","POLL_MAX_MS","pollIntervalMs","scheduleAdaptivePoll","prevSize","newSize","rl","err","line","request"],"mappings":";6ZAmBA,eAAeA,CAAAA,CAAwBC,CAAAA,CAAqC,CAC3E,GAAI,CACH,IAAMC,CAAAA,CAAYD,EAAI,QAAA,CAAS,SAAS,CAAA,CAAIA,CAAAA,CAAM,GAAGA,CAAG,CAAA,OAAA,CAAA,CAClDE,CAAAA,CAAW,MAAM,MAAMD,CAAAA,CAAW,CACvC,OAAA,CAAS,CAAE,OAAQ,kBAAmB,CAAA,CACtC,MAAA,CAAQ,WAAA,CAAY,QAAQ,GAAK,CAClC,CAAC,CAAA,CACD,GAAI,CAACC,CAAAA,CAAS,EAAA,CAAI,OAAO,KAEzB,IAAMC,CAAAA,CAAO,MAAMD,CAAAA,CAAS,MAAK,CACjC,GAAI,CAACC,CAAAA,CAAK,MAAM,UAAA,EAAY,MAAA,EAAU,CAACA,CAAAA,CAAK,MAAM,MAAA,CAAQ,OAAO,IAAA,CAGjE,IAAMC,EAAUD,CAAAA,CAAK,IAAA,CAAK,UAAA,CAAW,IAAA,CACnCE,GACAA,CAAAA,CAAE,QAAA,CAAS,OAAO,CAAA,EAClB,CAACA,CAAAA,CAAE,QAAA,CAAS,KAAK,CAAA,EACjB,CAACA,CAAAA,CAAE,QAAA,CAAS,iBAAiB,CAC/B,EACA,GAAI,CAACD,CAAAA,CAAS,OAAO,KAKrB,IAAIE,CAAAA,CADH,OAAA,CAAQ,GAAA,CAAI,WAAa,aAAA,EAAiB,OAAA,CAAQ,GAAA,CAAI,QAAA,GAAa,OACzCC,CAAAA,CAAwBH,CAAO,CAAA,CAAIA,CAAAA,CAC9D,GAAI,CAACE,CAAAA,EAAYA,CAAAA,GAAaF,CAAAA,CAAS,CACtC,IAAMI,CAAAA,CAAU,IAAI,GAAA,CAAIR,CAAG,CAAA,CAAE,QAAA,CAC7BM,CAAAA,CAAWF,CAAAA,CAAQ,QAAQ,cAAA,CAAgB,CAAA,KAAA,EAAQI,CAAO,CAAA,CAAE,EAC7D,CAEA,OAAKF,CAAAA,EAELA,CAAAA,EAAYA,EAAS,QAAA,CAAS,OAAO,CAAA,CAAI,EAAA,CAAK,QAAQH,CAAAA,CAAK,IAAA,CAAK,MAAM,CAAA,CAAA,CAE/DG,GAJe,IAKvB,CAAA,KAAQ,CACP,OAAO,IACR,CACD,CAQA,SAASG,CAAAA,CAAmBC,CAAAA,CAAsB,CACjD,IAAMC,CAAAA,CAAUD,CAAAA,CAAK,IAAA,GAGfE,CAAAA,CACL,4DAAA,CACKC,CAAAA,CAAgB,qBAAA,CAChBC,EAAkB,yCAAA,CAExB,GACCF,CAAAA,CAAc,IAAA,CAAKD,CAAO,CAAA,EAC1BE,CAAAA,CAAc,IAAA,CAAKF,CAAO,GAC1BG,CAAAA,CAAgB,IAAA,CAAKH,CAAO,CAAA,CAC3B,CACD,IAAMI,CAAAA,CAAW,WAAA,CACXC,CAAAA,CAAaL,EACjB,OAAA,CAAQC,CAAAA,CAAe,CAAA,KAAA,EAAQG,CAAQ,EAAE,CAAA,CACzC,OAAA,CAAQF,CAAAA,CAAe,CAAA,KAAA,EAAQE,CAAQ,CAAA,CAAE,CAAA,CACzC,OAAA,CAAQD,CAAAA,CAAiB,QAAQC,CAAQ,CAAA,CAAE,CAAA,CAE7C,OAAIC,IAAeL,CAAAA,EAClBM,CAAAA,CAAI,IAAA,CACH,CAAA,mEAAA,EAA0DD,CAAU,CAAA,CACrE,CAAA,CAEMA,CACR,CAEA,OAAOL,CACR,CAcA,SAASJ,CAAAA,CAAwBG,EAA6B,CAC7D,OAAIA,CAAAA,CAAK,QAAA,CAAS,kBAAkB,CAAA,CAC5BA,CAAAA,CAAK,OAAA,CACX,oCAAA,CACA,0BACD,CAAA,CACGA,CAAAA,CAAK,QAAA,CAAS,kBAAkB,EAC5BA,CAAAA,CAAK,OAAA,CACX,oCAAA,CACA,0BACD,EACGA,CAAAA,CAAK,QAAA,CAAS,kBAAkB,CAAA,CAC5BA,EAAK,OAAA,CACX,oCAAA,CACA,0BACD,CAAA,CACGA,EAAK,QAAA,CAAS,kBAAkB,CAAA,CAC5BA,CAAAA,CAAK,QACX,oCAAA,CACA,0BACD,CAAA,CAIAA,CAAAA,CAAK,SAAS,yBAAyB,CAAA,EACvCA,CAAAA,CAAK,QAAA,CAAS,yBAAyB,CAAA,CAEhC,IAAA,CAGDA,CACR,CAWA,eAAeQ,CAAAA,EAAO,CACrB,IAAMC,CAAAA,CAAY,IAAI,IAAA,EAAK,CAAE,WAAA,EAAY,CACzCF,EAAI,IAAA,CAAK,CAAA,sDAAA,EAAkDE,CAAS,CAAA,CAAE,EAEtE,IAAMC,CAAAA,CAAe,CAAA,CAAA,IAAA,CAAQ,CAAA,CAAA,OAAA,GAAW,OAAO,CAAA,CACzCC,GAAAA,CAAoB,CAAA,CAAA,IAAA,CAAKD,EAAS,eAAe,CAAA,CAE/C,CAAA,CAAA,UAAA,CAAWA,CAAO,GACtB,CAAA,CAAA,SAAA,CAAUA,CAAAA,CAAS,CAAE,SAAA,CAAW,IAAK,CAAC,CAAA,CAI1C,IAAIE,CAAAA,CAA2B,EAAC,CAG1BC,CAAAA,CAAO,QAAQ,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,CAMjC,GALIA,CAAAA,CAAK,MAAA,CAAS,IACjBD,CAAAA,CAAiBC,CAAAA,CAAK,MAAA,CAAQlB,CAAAA,EAAMA,EAAE,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA,CAIlDiB,EAAe,MAAA,GAAW,CAAA,CAAG,CAChC,IAAME,EAAa,EAAC,CAGpB,GAAI,OAAA,CAAQ,IAAI,mBAAA,CAAqB,CACpCP,CAAAA,CAAI,IAAA,CACH,iIAED,CAAA,CACA,IAAMQ,CAAAA,CAAgB,CAAA,CAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,mBAAmB,CAAA,CAC7D,GAAO,aAAWA,CAAQ,CAAA,CAAG,CAC5B,IAAMf,EAAU,CAAA,CAAA,YAAA,CAAae,CAAAA,CAAU,MAAM,CAAA,CAAE,MAAK,CAChDf,CAAAA,EAAMY,CAAAA,CAAe,IAAA,CAAKb,EAAmBC,CAAI,CAAC,EACvD,CACD,CAGAc,CAAAA,CAAW,IAAA,CACV,OAAA,CAAQ,GAAA,GACH,CAAA,CAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAI,CAAG,wBAAwB,CAAA,CACjDJ,CAAAA,CACK,CAAA,CAAA,IAAA,CAEF,CAAA,CAAA,OAAA,CAAQ,IAAI,GAAA,CAAI,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA,CAAE,QAAQ,CAAA,CACzC,OAAA,CAAQ,aAAA,CAAe,IAAI,EAC7B,8BACD,CACD,CAAA,CAEA,IAAA,IAAWM,KAAOF,CAAAA,CACjB,GAAI,CACH,GAAO,aAAWE,CAAG,CAAA,CAAG,CAEvB,IAAMC,EADW,CAAA,CAAA,WAAA,CAAYD,CAAG,CAAA,CACH,MAAA,CAAQE,GAAMA,CAAAA,CAAE,QAAA,CAAS,YAAY,CAAC,EAEnE,IAAA,IAAWC,CAAAA,IAAQF,CAAAA,CAAgB,CAClC,IAAMF,CAAAA,CAAgB,CAAA,CAAA,IAAA,CAAKC,CAAAA,CAAKG,CAAI,EAC9BnB,CAAAA,CAAU,CAAA,CAAA,YAAA,CAAae,CAAAA,CAAU,MAAM,EAAE,IAAA,EAAK,CACpD,GAAIf,CAAAA,CAAM,CACT,IAAMM,CAAAA,CAAaP,CAAAA,CAAmBC,CAAI,EACrCY,CAAAA,CAAe,QAAA,CAASN,CAAU,CAAA,GACtCM,EAAe,IAAA,CAAKN,CAAU,CAAA,CAC9BC,CAAAA,CAAI,KAAK,CAAA,mCAAA,EAAiCY,CAAI,CAAA,MAAA,EAASH,CAAG,EAAE,CAAA,EAE9D,CACD,CAEA,GAAIJ,EAAe,MAAA,CAAS,CAAA,CAAG,KAChC,CACD,CAAA,KAAa,CAEb,CAEF,CAGA,GAAI,OAAA,CAAQ,IAAI,cAAA,CAAgB,CAC/B,IAAMQ,CAAAA,CAAW,QAAQ,GAAA,CAAI,cAAA,CAC7Bb,CAAAA,CAAI,IAAA,CACH,2DAAoDa,CAAQ,CAAA,iBAAA,EAAoBR,CAAAA,CAAe,MAAM,GACtG,CAAA,CAEA,IAAMhB,CAAAA,CAAW,MAAMP,EAAwB+B,CAAQ,CAAA,CACvD,GAAIxB,CAAAA,CAAU,CACb,IAAMU,GAAAA,CAAaP,CAAAA,CAAmBH,CAAQ,EACzCgB,CAAAA,CAAe,QAAA,CAASN,GAAU,CAAA,GACtCM,EAAe,IAAA,CAAKN,GAAU,CAAA,CAC9BC,CAAAA,CAAI,KACH,CAAA,wDAAA,EAAsDD,GAAU,CAAA,CACjE,CAAA,EAEF,CACD,CAGIM,CAAAA,CAAe,MAAA,GAAW,CAAA,EAAK,QAAQ,GAAA,CAAI,cAAA,EAC9CA,CAAAA,CAAe,IAAA,CAAK,QAAQ,GAAA,CAAI,cAAA,CAAe,IAAA,EAAM,EAKlDA,CAAAA,CAAe,MAAA,GAAW,CAAA,EAC7BA,CAAAA,CAAe,KACd,mFACD,CAAA,CAIDA,CAAAA,CAAiBA,CAAAA,CAAe,OAAQZ,CAAAA,EAAS,CAChD,GAAI,CACH,OAAAqB,SAAAA,CAAUrB,CAAI,CAAA,CACP,CAAA,CACR,MAAQ,CACP,OAAAO,CAAAA,CAAI,IAAA,CAAK,sDAAsDP,CAAI,CAAA,CAAE,CAAA,CAC9D,KACR,CACD,CAAC,CAAA,CAIGY,CAAAA,CAAe,MAAA,GAAW,IAC7BL,CAAAA,CAAI,IAAA,CACH,2EACD,CAAA,CACAA,EAAI,IAAA,CACH,6EACD,CAAA,CAAA,CAID,IAAMe,EAAa,IAAIC,CAAAA,CAAW,CACjC,IAAA,CAAM,eACN,OAAA,CAAS,OACV,CAAC,CAAA,CAGDD,EAAW,sBAAA,EAAuB,CAGlC,IAAME,CAAAA,CAAW,IAAIC,GAAAA,CAAS,CAC7B,YAAA,CAAcd,GAAAA,CACd,eAAgBC,CAAAA,CAChB,aAAA,CACC,OAAA,CAAQ,GAAA,CAAI,WAAa,aAAA,EAAiB,OAAA,CAAQ,GAAA,CAAI,QAAA,GAAa,OAChEf,CAAAA,CACA,MACL,CAAC,CAAA,CAGD,MAAM2B,CAAAA,CAAS,KAAA,EAAM,CAIrB,IAAME,EAAS,IAAIC,CAAAA,CAAcL,CAAAA,CAAYE,CAAQ,EAGrDE,CAAAA,CAAO,cAAA,CAAiB,IAAM,CAC7B,OAAA,CAAQ,OAAO,KAAA,CACd,CAAA;AAAA,CACD,CAAA,CACA,OAAA,CAAQ,MAAA,CAAO,KAAA,CACd,CAAA;AAAA,CACD,EACD,CAAA,CAKA,UAAA,CAAW,IAAM,CAEhB,IAAME,CAAAA,CAAUJ,CAAAA,CAAiB,mBAAA,IAAsB,EAAK,EAC5DjB,CAAAA,CAAI,IAAA,CAAK,sDAAsDqB,CAAM,CAAA,CAAE,EACvEF,CAAAA,CAAO,oBAAA,CAAqB,IAAI,CAAA,CAAE,MAAM,IAAM,CAAC,CAAC,EACjD,EAAG,GAAI,CAAA,CAEP,IAAMG,CAAAA,CAAe,IACfC,CAAAA,CAAc,IAAA,CAChBC,EAAiBF,CAAAA,CAEfG,CAAAA,CAAuB,IAAM,CAClC,UAAA,CAAW,SAAY,CACtB,IAAMC,CAAAA,CAAWP,CAAAA,CAAO,YAAA,EAAa,CACrC,MAAMA,CAAAA,CAAO,oBAAA,CAAqB,IAAI,CAAA,CAAE,MAAM,IAAM,CAAC,CAAC,CAAA,CACtD,IAAMQ,EAAUR,CAAAA,CAAO,YAAA,EAAa,CAEhCQ,CAAAA,GAAYD,GAEfF,CAAAA,CAAiBF,CAAAA,CACjBtB,CAAAA,CAAI,IAAA,CACH,0CAA0C0B,CAAQ,CAAA,QAAA,EAAMC,CAAO,CAAA,qBAAA,EAAwBL,EAAe,GAAI,CAAA,EAAA,CAC3G,GAGAE,CAAAA,CAAiB,IAAA,CAAK,IACrB,IAAA,CAAK,KAAA,CAAMA,CAAAA,CAAiB,GAAG,EAC/BD,CACD,CAAA,CAGDE,CAAAA,GACD,EAAGD,CAAc,EAClB,CAAA,CAEAC,CAAAA,GAMA,IAAMG,CAAAA,CAAAA,CADW,MAAM,OAAO,UAAe,GACzB,eAAA,CAAgB,CACnC,KAAA,CAAO,OAAA,CAAQ,MACf,QAAA,CAAU,KACX,CAAC,CAAA,CAED,QAAQ,MAAA,CAAO,EAAA,CAAG,OAAA,CAAUC,CAAAA,EAAmC,CAC1DA,CAAAA,CAAI,IAAA,GAAS,SAChB,OAAA,CAAQ,IAAA,CAAK,CAAC,EAEhB,CAAC,CAAA,CAEDD,CAAAA,CAAG,GAAG,MAAA,CAAQ,MAAOE,CAAAA,EAAS,CAC7B,IAAMpC,CAAAA,CAAUoC,CAAAA,CAAK,IAAA,EAAK,CAC1B,GAAKpC,CAAAA,CAEL,GAAI,CACH,IAAMqC,CAAAA,CAAU,KAAK,KAAA,CAAMrC,CAAO,CAAA,CAClC,GAAIqC,EAAQ,MAAA,CAAQ,CACnB,IAAM9C,CAAAA,CAAW,MAAMkC,EAAO,QAAA,CAASY,CAAO,CAAA,CAC1C9C,CAAAA,EACH,QAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,IAAA,CAAK,SAAA,CAAUA,CAAQ,CAAC;AAAA,CAAI,EAEtD,CACD,CAAA,KAAe,CAEf,CACD,CAAC,CAAA,CAED2C,CAAAA,CAAG,EAAA,CAAG,OAAA,CAAS,IAAM,CACpB,QAAQ,IAAA,CAAK,CAAC,EACf,CAAC,CAAA,CAGD5B,CAAAA,CAAI,IAAA,CAAK,iDAAiD,CAAA,CAC1DA,CAAAA,CAAI,IAAA,CACH,CAAA,+BAAA,EAAkCK,CAAAA,CAAe,MAAM,CAAA,YAAA,CACxD,CAAA,CACAL,EAAI,IAAA,CAAK,+DAA+D,CAAA,CAExE,OAAA,CAAQ,EAAA,CAAG,QAAA,CAAU,SAAY,CAChC,MAAMiB,CAAAA,CAAS,IAAA,EAAK,CACpB,OAAA,CAAQ,IAAA,CAAK,CAAC,EACf,CAAC,EACF,CAEAhB,CAAAA,EAAK,CAAE,KAAA,CAAO4B,CAAAA,EAAQ,CACrB7B,CAAAA,CAAI,MAAM,CAAA,0BAAA,EAA6B6B,CAAAA,CAAI,OAAO,CAAA,CAAE,CAAA,CACpD,OAAA,CAAQ,IAAA,CAAK,CAAC,EACf,CAAC,CAAA","file":"agent.js","sourcesContent":["#!/usr/bin/env node\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport { multiaddr } from \"@multiformats/multiaddr\";\nimport { LiopMcpRouter } from \"../gateway/router.js\";\nimport { MeshNode } from \"../mesh/index.js\";\nimport { LiopServer } from \"../server/index.js\";\nimport type { McpRequest } from \"../types.js\";\nimport { log } from \"../utils/logger.js\";\n\n/**\n * Resolves a full libp2p multiaddr (with PeerID) from a LIOP node's\n * HTTP health endpoint. This enables zero-config bootstrap — users\n * only need to provide a URL, not a cryptographic PeerID.\n *\n * @param url - HTTP URL of a LIOP node's health endpoint (e.g. \"http://host:3000\")\n * @returns Full multiaddr string with PeerID, or null if resolution fails\n */\nasync function resolveBootstrapFromUrl(url: string): Promise<string | null> {\n\ttry {\n\t\tconst healthUrl = url.endsWith(\"/health\") ? url : `${url}/health`;\n\t\tconst response = await fetch(healthUrl, {\n\t\t\theaders: { Accept: \"application/json\" },\n\t\t\tsignal: AbortSignal.timeout(10000), // Increased to 10s\n\t\t});\n\t\tif (!response.ok) return null;\n\n\t\tconst data = await response.json();\n\t\tif (!data.mesh?.multiaddrs?.length || !data.mesh?.peerId) return null;\n\n\t\t// Find TCP multiaddr (prefer non-websocket for stability)\n\t\tconst tcpAddr = data.mesh.multiaddrs.find(\n\t\t\t(a: string) =>\n\t\t\t\ta.includes(\"/tcp/\") &&\n\t\t\t\t!a.includes(\"/ws\") &&\n\t\t\t\t!a.includes(\"/ip4/127.0.0.1/\"),\n\t\t);\n\t\tif (!tcpAddr) return null;\n\n\t\t// Rewrite internal Docker IP using development mapper if available\n\t\tconst isDevMode =\n\t\t\tprocess.env.NODE_ENV === \"development\" || process.env.NODE_ENV === \"test\";\n\t\tlet resolved = isDevMode ? industrialAddressMapper(tcpAddr) : tcpAddr;\n\t\tif (!resolved || resolved === tcpAddr) {\n\t\t\tconst urlHost = new URL(url).hostname;\n\t\t\tresolved = tcpAddr.replace(/\\/ip4\\/[^/]+/, `/ip4/${urlHost}`);\n\t\t}\n\n\t\tif (!resolved) return null;\n\n\t\tresolved += resolved.includes(\"/p2p/\") ? \"\" : `/p2p/${data.mesh.peerId}`;\n\n\t\treturn resolved;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Normalizes a bootstrap multiaddr string.\n * If the address contains a Docker bridge IP (172.16-31.x.x) or Loopback (127.0.0.1),\n * rewrites it to the host accessible via LIOP_NEXUS_URL (e.g. WSL2 IP).\n * This is critical when WSL2 mirror-mode networking is broken.\n */\nfunction normalizeBootstrap(addr: string): string {\n\tconst trimmed = addr.trim();\n\t// Remap Docker bridge IPs and ANY external physical IPs to 127.0.0.1\n\t// because Test-NetConnection confirmed 127.0.0.1 is the only reliable path to Docker ports.\n\tconst dockerIpRegex =\n\t\t/\\/ip4\\/172\\.(1[6-9]|2[0-9]|3[0-1])\\.[0-9]{1,3}\\.[0-9]{1,3}/;\n\tconst loopbackRegex = /\\/ip4\\/127\\.0\\.0\\.1/;\n\tconst physicalIpRegex = /\\/ip4\\/192\\.168\\.[0-9]{1,3}\\.[0-9]{1,3}/;\n\n\tif (\n\t\tdockerIpRegex.test(trimmed) ||\n\t\tloopbackRegex.test(trimmed) ||\n\t\tphysicalIpRegex.test(trimmed)\n\t) {\n\t\tconst targetIp = \"127.0.0.1\";\n\t\tconst normalized = trimmed\n\t\t\t.replace(dockerIpRegex, `/ip4/${targetIp}`)\n\t\t\t.replace(loopbackRegex, `/ip4/${targetIp}`)\n\t\t\t.replace(physicalIpRegex, `/ip4/${targetIp}`);\n\n\t\tif (normalized !== trimmed) {\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Agent] 🔄 Local Routing Hack → Forced 127.0.0.1: ${normalized}`,\n\t\t\t);\n\t\t}\n\t\treturn normalized;\n\t}\n\n\treturn trimmed;\n}\n\n/**\n * industrialAddressMapper (DEVELOPMENT ONLY)\n *\n * Maps Docker-internal IPs to host-published ports for local demo environments.\n * This function is ONLY active when NODE_ENV is \"development\" or \"test\".\n * In production, it is completely bypassed.\n *\n * Nexus (172.20.0.10) -> 13001\n * Vault (172.20.0.11) -> 13003\n * Bank  (172.20.0.12) -> 13004\n * Oracle(172.20.0.13) -> 13005\n */\nfunction industrialAddressMapper(addr: string): string | null {\n\tif (addr.includes(\"/ip4/172.20.0.10\"))\n\t\treturn addr.replace(\n\t\t\t/\\/ip4\\/172\\.20\\.0\\.10\\/tcp\\/[0-9]+/,\n\t\t\t\"/ip4/127.0.0.1/tcp/13001\",\n\t\t);\n\tif (addr.includes(\"/ip4/172.20.0.11\"))\n\t\treturn addr.replace(\n\t\t\t/\\/ip4\\/172\\.20\\.0\\.11\\/tcp\\/[0-9]+/,\n\t\t\t\"/ip4/127.0.0.1/tcp/13003\",\n\t\t);\n\tif (addr.includes(\"/ip4/172.20.0.12\"))\n\t\treturn addr.replace(\n\t\t\t/\\/ip4\\/172\\.20\\.0\\.12\\/tcp\\/[0-9]+/,\n\t\t\t\"/ip4/127.0.0.1/tcp/13004\",\n\t\t);\n\tif (addr.includes(\"/ip4/172.20.0.13\"))\n\t\treturn addr.replace(\n\t\t\t/\\/ip4\\/172\\.20\\.0\\.13\\/tcp\\/[0-9]+/,\n\t\t\t\"/ip4/127.0.0.1/tcp/13005\",\n\t\t);\n\n\t// Drop container-internal loopbacks to prevent the Host Agent from dialing itself or conflicting ports\n\tif (\n\t\taddr.includes(\"/ip4/127.0.0.1/tcp/4000\") ||\n\t\taddr.includes(\"/ip4/127.0.0.1/tcp/3000\")\n\t) {\n\t\treturn null;\n\t}\n\n\treturn addr;\n}\n\n/**\n * LIOP Agent (Zero-Config CLI)\n *\n * Secure Logic-on-Origin gateway for Claude Desktop.\n * Communicates via STDIO / JSON-RPC.\n *\n * All tool discovery is DYNAMIC via the /liop/manifest/1.0.0 protocol.\n * No hardcoded tools, PeerIDs, or port mappings.\n */\nasync function main() {\n\tconst buildTime = new Date().toISOString();\n\tlog.info(`[LIOP-Agent] 🚀 Version 1.2.0-alpha.9 | Build: ${buildTime}`);\n\n\tconst liopDir = path.join(os.homedir(), \".liop\");\n\tconst identityPath = path.join(liopDir, \"identity.json\");\n\n\tif (!fs.existsSync(liopDir)) {\n\t\tfs.mkdirSync(liopDir, { recursive: true });\n\t}\n\n\t// 1. Determine Bootstrap Nodes (Zero-Config Discovery)\n\tlet bootstrapNodes: string[] = [];\n\n\t// Command line arguments take precedence\n\tconst args = process.argv.slice(2);\n\tif (args.length > 0) {\n\t\tbootstrapNodes = args.filter((a) => a.startsWith(\"/\"));\n\t}\n\n\t// Priority 1: Physical Beacons (Industrial Pattern) - DETERMINISTIC & INSTANT\n\tif (bootstrapNodes.length === 0) {\n\t\tconst searchDirs = [];\n\n\t\t// Priority 1.1: Explicit file from environment variable\n\t\tif (process.env.LIOP_BOOTSTRAP_FILE) {\n\t\t\tlog.warn(\n\t\t\t\t\"LIOP_BOOTSTRAP_FILE is deprecated and will be removed in the next major version. \" +\n\t\t\t\t\t\"Use LIOP_NEXUS_URL for Auto-Discovery instead.\",\n\t\t\t);\n\t\t\tconst filePath = path.resolve(process.env.LIOP_BOOTSTRAP_FILE);\n\t\t\tif (fs.existsSync(filePath)) {\n\t\t\t\tconst addr = fs.readFileSync(filePath, \"utf8\").trim();\n\t\t\t\tif (addr) bootstrapNodes.push(normalizeBootstrap(addr));\n\t\t\t}\n\t\t}\n\n\t\t// Priority 1.2: Traditional locations (Scan for all *.multiaddr)\n\t\tsearchDirs.push(\n\t\t\tprocess.cwd(),\n\t\t\tpath.join(process.cwd(), \"tests/infra/nexus-data\"),\n\t\t\tliopDir,\n\t\t\tpath.join(\n\t\t\t\tpath\n\t\t\t\t\t.dirname(new URL(import.meta.url).pathname)\n\t\t\t\t\t.replace(/^\\/([A-Z]:)/, \"$1\"),\n\t\t\t\t\"../../tests/infra/nexus-data\",\n\t\t\t),\n\t\t);\n\n\t\tfor (const dir of searchDirs) {\n\t\t\ttry {\n\t\t\t\tif (fs.existsSync(dir)) {\n\t\t\t\t\tconst files = fs.readdirSync(dir);\n\t\t\t\t\tconst multiaddrFiles = files.filter((f) => f.endsWith(\".multiaddr\"));\n\n\t\t\t\t\tfor (const file of multiaddrFiles) {\n\t\t\t\t\t\tconst filePath = path.join(dir, file);\n\t\t\t\t\t\tconst addr = fs.readFileSync(filePath, \"utf8\").trim();\n\t\t\t\t\t\tif (addr) {\n\t\t\t\t\t\t\tconst normalized = normalizeBootstrap(addr);\n\t\t\t\t\t\t\tif (!bootstrapNodes.includes(normalized)) {\n\t\t\t\t\t\t\t\tbootstrapNodes.push(normalized);\n\t\t\t\t\t\t\t\tlog.info(`[LIOP-Agent] ✅ Loaded beacon: ${file} from ${dir}`);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\t// If we found any beacons in this directory, we consider discovery successful for this layer\n\t\t\t\t\tif (bootstrapNodes.length > 0) break;\n\t\t\t\t}\n\t\t\t} catch (_e) {\n\t\t\t\t/* ignore */\n\t\t\t}\n\t\t}\n\t}\n\n\t// Priority 2: Auto-Discovery via NEXUS URL (Aggressive Parallel Discovery)\n\tif (process.env.LIOP_NEXUS_URL) {\n\t\tconst nexusUrl = process.env.LIOP_NEXUS_URL;\n\t\tlog.info(\n\t\t\t`[LIOP-Agent] 🌐 Running parallel discovery from: ${nexusUrl} (Sources Found: ${bootstrapNodes.length})`,\n\t\t);\n\n\t\tconst resolved = await resolveBootstrapFromUrl(nexusUrl);\n\t\tif (resolved) {\n\t\t\tconst normalized = normalizeBootstrap(resolved);\n\t\t\tif (!bootstrapNodes.includes(normalized)) {\n\t\t\t\tbootstrapNodes.push(normalized);\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Agent] ✅ Added bootstrap from URL discovery: ${normalized}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t// Priority 3: Environment variable (direct multiaddr)\n\tif (bootstrapNodes.length === 0 && process.env.LIOP_BOOTSTRAP) {\n\t\tbootstrapNodes.push(process.env.LIOP_BOOTSTRAP.trim());\n\t}\n\n\t// Final fallback: local Nexus bootstrap for demo environments.\n\t// Avoid injecting stale static peer IDs when discovery already found valid peers.\n\tif (bootstrapNodes.length === 0) {\n\t\tbootstrapNodes.push(\n\t\t\t\"/ip4/127.0.0.1/tcp/13001/p2p/12D3KooWD8FUFdnLQzzLFNdicsaTknM5cpD7os9sK9NWVSVABJMD\",\n\t\t);\n\t}\n\n\t// Sanitize/validate all candidate multiaddrs so malformed PeerIDs don't crash startup.\n\tbootstrapNodes = bootstrapNodes.filter((addr) => {\n\t\ttry {\n\t\t\tmultiaddr(addr);\n\t\t\treturn true;\n\t\t} catch {\n\t\t\tlog.warn(`[LIOP-Agent] Ignoring invalid bootstrap multiaddr: ${addr}`);\n\t\t\treturn false;\n\t\t}\n\t});\n\n\t// If no bootstrap nodes found, the agent operates in standalone mode.\n\t// It will only serve local tools until peers are discovered.\n\tif (bootstrapNodes.length === 0) {\n\t\tlog.info(\n\t\t\t\"[LIOP-Agent] No bootstrap nodes configured. Operating in standalone mode.\",\n\t\t);\n\t\tlog.info(\n\t\t\t\"[LIOP-Agent] Pass a multiaddr as argument or create 'nexus.multiaddr' file.\",\n\t\t);\n\t}\n\n\t// Initialize local server node (lightweight, no tools registered locally)\n\tconst liopServer = new LiopServer({\n\t\tname: \"@nekzus/liop\",\n\t\tversion: \"1.0.0\",\n\t});\n\n\t// Enable Zero-Shot Autonomy (Industrial Prompt Injection)\n\tliopServer.enableZeroShotAutonomy();\n\n\t// 2. Mesh Node Configuration\n\tconst meshNode = new MeshNode({\n\t\tidentityPath: identityPath,\n\t\tbootstrapNodes: bootstrapNodes,\n\t\taddressMapper:\n\t\t\tprocess.env.NODE_ENV === \"development\" || process.env.NODE_ENV === \"test\"\n\t\t\t\t? industrialAddressMapper\n\t\t\t\t: undefined,\n\t});\n\n\t// Start P2P Mesh\n\tawait meshNode.start();\n\n\t// 3. Initialize the Dynamic Router\n\t// No hardcoded tools — all discovery happens via liop:manifest protocol\n\tconst router = new LiopMcpRouter(liopServer, meshNode);\n\n\t// Proactive Notification to Claude Desktop when tools/resources are discovered dynamically\n\trouter.onToolsChanged = () => {\n\t\tprocess.stdout.write(\n\t\t\t`{\"jsonrpc\":\"2.0\",\"method\":\"notifications/tools/list_changed\"}\\n`,\n\t\t);\n\t\tprocess.stdout.write(\n\t\t\t`{\"jsonrpc\":\"2.0\",\"method\":\"notifications/resources/list_changed\"}\\n`,\n\t\t);\n\t};\n\n\t// Initial warming period (2s) then Adaptive Background Discovery\n\t// Polls DHT for new nodes and triggers onToolsChanged when topology shifts.\n\t// Uses exponential backoff to reduce polling load on stable meshes.\n\tsetTimeout(() => {\n\t\t// biome-ignore lint/suspicious/noExplicitAny: access internal for telemetry\n\t\tconst rtSize = (meshNode as any).getRoutingTableSize?.() || 0;\n\t\tlog.info(`[LIOP-Agent] Warm-up complete. Routing Table size: ${rtSize}`);\n\t\trouter.refreshManifestCache(true).catch(() => {});\n\t}, 2000);\n\n\tconst POLL_BASE_MS = 10_000;\n\tconst POLL_MAX_MS = 120_000;\n\tlet pollIntervalMs = POLL_BASE_MS;\n\n\tconst scheduleAdaptivePoll = () => {\n\t\tsetTimeout(async () => {\n\t\t\tconst prevSize = router.getCacheSize();\n\t\t\tawait router.refreshManifestCache(true).catch(() => {});\n\t\t\tconst newSize = router.getCacheSize();\n\n\t\t\tif (newSize !== prevSize) {\n\t\t\t\t// Topology changed — reset to aggressive polling\n\t\t\t\tpollIntervalMs = POLL_BASE_MS;\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Agent] Topology change detected (${prevSize} → ${newSize}). Resetting poll to ${POLL_BASE_MS / 1000}s.`,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\t// Stable — relax polling interval (factor 1.5)\n\t\t\t\tpollIntervalMs = Math.min(\n\t\t\t\t\tMath.round(pollIntervalMs * 1.5),\n\t\t\t\t\tPOLL_MAX_MS,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tscheduleAdaptivePoll();\n\t\t}, pollIntervalMs);\n\t};\n\n\tscheduleAdaptivePoll();\n\n\t// 4. STDIO Transport — Buffered Line Reader\n\t// Uses readline to guarantee complete JSON-RPC messages before parsing.\n\t// Raw stdin.on(\"data\") can fragment large payloads across multiple chunks.\n\tconst readline = await import(\"node:readline\");\n\tconst rl = readline.createInterface({\n\t\tinput: process.stdin,\n\t\tterminal: false,\n\t});\n\n\tprocess.stdout.on(\"error\", (err: Error & { code?: string }) => {\n\t\tif (err.code === \"EPIPE\") {\n\t\t\tprocess.exit(0); // Graceful exit when Claude Desktop disconnects\n\t\t}\n\t});\n\n\trl.on(\"line\", async (line) => {\n\t\tconst trimmed = line.trim();\n\t\tif (!trimmed) return;\n\n\t\ttry {\n\t\t\tconst request = JSON.parse(trimmed) as McpRequest;\n\t\t\tif (request.method) {\n\t\t\t\tconst response = await router.dispatch(request);\n\t\t\t\tif (response) {\n\t\t\t\t\tprocess.stdout.write(`${JSON.stringify(response)}\\n`);\n\t\t\t\t}\n\t\t\t}\n\t\t} catch (_err) {\n\t\t\t// Silent catch for binary noise or malformed lines\n\t\t}\n\t});\n\n\trl.on(\"close\", () => {\n\t\tprocess.exit(0);\n\t});\n\n\t// Status directed only to stderr\n\tlog.info(`[LIOP-Agent] Guarding Claude Desktop via STDIO.`);\n\tlog.info(\n\t\t`[LIOP-Agent] P2P Mesh: Joined (${bootstrapNodes.length} bootstraps)`,\n\t);\n\tlog.info(\"[LIOP-Agent] Tool discovery: Dynamic via /liop/manifest/1.0.0\");\n\n\tprocess.on(\"SIGINT\", async () => {\n\t\tawait meshNode.stop();\n\t\tprocess.exit(0);\n\t});\n}\n\nmain().catch((err) => {\n\tlog.error(`[LIOP-Agent] Fatal Error: ${err.message}`);\n\tprocess.exit(1);\n});\n"]}

package/dist/{bridge/stream.d.ts → bridge.d.ts}

@@ -1,8 +1,13 @@
-import type { LiopServer } from "../server/index.js";
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { LiopServer, LiopServerOptions } from './server.js';
+import 'zod';
+import './mesh.js';
+import './types.js';
+
 /**
  * Configuration options for LiopStreamBridge.
  */
-export interface LiopStreamBridgeOptions {
+interface LiopStreamBridgeOptions {
     /** Port to listen on (default: 3000) */
     port?: number;
     /** Max concurrent sessions per IP (default: 5) */
@@ -24,7 +29,7 @@ export interface LiopStreamBridgeOptions {
  * - Per-IP rate limiting on session creation
  * - Automatic eviction of idle sessions (TTL)
  */
-export declare class LiopStreamBridge {
+declare class LiopStreamBridge {
     private options;
     private app;
     private httpServer;
@@ -60,3 +65,39 @@ export declare class LiopStreamBridge {
      */
     stop(): Promise<void>;
 }
+
+interface LiopBridgeOptions {
+    publishToMesh?: boolean;
+    meshIdentity?: string;
+    serverInfo?: {
+        name: string;
+        version: string;
+    };
+    security?: LiopServerOptions["security"];
+}
+/**
+ * LIOP MCP Bridge
+ * A bi-directional bridge that allows legacy MCP servers to join the LIOP mesh,
+ * or exposes a LIOP server as an MCP-compatible stdio process for tools like Claude Desktop.
+ */
+declare class LiopMcpBridge {
+    private options;
+    private liopServer;
+    private legacyMcpServer;
+    constructor(source: LiopServer | McpServer | any, options?: LiopBridgeOptions);
+    /**
+     * Handles an incoming standard MCP JSON-RPC 2.0 payload.
+     * Pipes it to the underlying server (LIOP or Legacy MCP).
+     */
+    handleJsonRpcRequest(payload: Record<string, unknown>): Promise<unknown>;
+    private handleLiopToMcp;
+    private successResponse;
+    private errorResponse;
+    private verifyZkReceipt;
+    /**
+     * Connects the bridge via stdio or Mesh depending on mode.
+     */
+    connect(): Promise<void>;
+}
+
+export { type LiopBridgeOptions, LiopMcpBridge, LiopStreamBridge, type LiopStreamBridgeOptions };

package/dist/bridge.js

@@ -0,0 +1,2 @@
+export{b as LiopMcpBridge,a as LiopStreamBridge}from'./chunk-LYULZHZO.js';import'./chunk-S6RJHZV2.js';//# sourceMappingURL=bridge.js.map
+//# sourceMappingURL=bridge.js.map

package/dist/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"bridge.js"}