@paretools/shared 0.12.0 → 0.13.1

package/dist/runner.js

@@ -1,6 +1,49 @@
 import { spawn, execFileSync } from "node:child_process";
+import { normalize } from "node:path";
 import { stripAnsi } from "./ansi.js";
 import { sanitizeErrorOutput } from "./sanitize.js";
+/**
+ * Resolves a command name to its absolute path using `where` (Windows) or
+ * `which` (Unix). On Windows this is used to detect whether a command is a
+ * .cmd/.bat wrapper so the runner can invoke it via cmd.exe without using
+ * `shell: true` (which triggers CodeQL alert #16).
+ *
+ * Returns the original command string if resolution fails (e.g., the command
+ * is already an absolute path, or `which`/`where` is unavailable).
+ */
+function resolveCommand(cmd) {
+    // Skip resolution if cmd is already an absolute path
+    if (cmd.startsWith("/") || /^[A-Za-z]:[/\\]/.test(cmd)) {
+        return cmd;
+    }
+    try {
+        const resolver = process.platform === "win32" ? "where" : "which";
+        const output = execFileSync(resolver, [cmd], {
+            timeout: 5_000,
+            stdio: ["ignore", "pipe", "ignore"],
+            windowsHide: true,
+        }).toString("utf-8");
+        const lines = output
+            .split(/\r?\n/)
+            .map((l) => l.trim())
+            .filter(Boolean);
+        if (process.platform === "win32" && lines.length > 1) {
+            // On Windows, `where` returns multiple matches (e.g., `npx` and `npx.cmd`).
+            // Prefer .cmd/.bat entries so _buildSpawnConfig routes them through the
+            // cmd.exe wrapper path (Branch 2) instead of trying to execute an
+            // extensionless shell script with shell: false (which would fail).
+            const cmdLine = lines.find((l) => /\.(cmd|bat)$/i.test(l));
+            if (cmdLine)
+                return cmdLine;
+        }
+        return lines[0] || cmd;
+    }
+    catch {
+        // Resolution failed — fall back to the bare command name so existing
+        // behavior (PATH lookup by the shell/OS) is preserved.
+        return cmd;
+    }
+}
 /**
  * Kills an entire process group (Unix) or process tree (Windows).
  *
@@ -87,32 +130,117 @@ export function escapeCmdArg(arg) {
     escaped = escaped.replace(/!/g, "^!");
     return escaped;
 }
+// ---------------------------------------------------------------------------
+// Verbatim-mode escaping helpers (cross-spawn pattern)
+//
+// These are used when spawning .cmd/.bat files via cmd.exe with
+// windowsVerbatimArguments: true, where libuv performs NO quoting.
+// Algorithm ported from cross-spawn (https://github.com/moxystudio/node-cross-spawn).
+// ---------------------------------------------------------------------------
+/** cmd.exe metacharacters that need caret-escaping. */
+const META_CHARS_RE = /([()\][%!^"`<>&|;, *?])/g;
+/** Caret-escape cmd.exe metacharacters in a command path. */
+function escapeCommandForVerbatim(cmd) {
+    return cmd.replace(META_CHARS_RE, "^$1");
+}
+/**
+ * Escapes a single argument for cmd.exe in windowsVerbatimArguments mode.
+ *
+ * Based on https://qntm.org/cmd (same algorithm as cross-spawn):
+ * 1. Handle backslash+quote sequences for MSVC C runtime parsing
+ * 2. Wrap in double quotes
+ * 3. Caret-escape cmd.exe metacharacters on the quoted result
+ */
+function escapeArgForVerbatim(arg) {
+    // Sequence of backslashes followed by a double quote:
+    // double up all the backslashes and escape the double quote.
+    // The outer `?` makes the capture group optional so bare `"` (zero
+    // preceding backslashes) is also matched — matching cross-spawn exactly.
+    let escaped = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
+    // Sequence of backslashes at end of string (will be followed by our closing quote):
+    // double up all the backslashes
+    escaped = escaped.replace(/(?=(\\+?)?)\1$/, "$1$1");
+    // Wrap in double quotes, then caret-escape metacharacters
+    escaped = `"${escaped}"`;
+    escaped = escaped.replace(META_CHARS_RE, "^$1");
+    return escaped;
+}
+/**
+ * Determines how to spawn a command, handling Windows .cmd/.bat wrappers
+ * without using `shell: true` (which triggers CodeQL alert #16).
+ *
+ * @internal — Exported for unit testing only. Use `run()` instead.
+ *
+ * Branches:
+ *   1. Explicit `shell: true` — pass cmd directly, don't resolve (caller wants shell features)
+ *   2. Windows native .exe/.com — spawn resolved path directly
+ *   3. Windows non-exe (cmd/bat/extensionless/bare) — cmd.exe /d /s /c with windowsVerbatimArguments
+ *   4. Unix — spawn cmd directly, execvp handles PATH
+ */
+export function _buildSpawnConfig(cmd, args, opts, platform = process.platform, resolver = resolveCommand) {
+    // Branch 1: Explicit shell: true — caller wants shell features (pipes, globs).
+    // Pass cmd directly to spawn with shell: true — do NOT call resolveCommand,
+    // which breaks the taint flow that CodeQL flags (environment → shell command).
+    if (opts?.shell === true) {
+        const safeArgs = platform === "win32" ? args.map(escapeCmdArg) : args;
+        return { command: cmd, args: safeArgs, shell: true, windowsVerbatimArguments: false };
+    }
+    // Branches 2+3: Windows without shell
+    if (platform === "win32") {
+        const resolved = resolver(cmd);
+        // Branch 2: Native .exe/.com — spawn resolved path directly.
+        // Only these extensions are true PE executables that CreateProcessW can run
+        // without a shell. This matches cross-spawn's isExecutableRegExp check.
+        if (/\.(exe|com)$/i.test(resolved)) {
+            return { command: resolved, args, shell: false, windowsVerbatimArguments: false };
+        }
+        // Branch 3: Everything else (.cmd, .bat, extensionless, bare names) needs
+        // cmd.exe to interpret it. Use cross-spawn pattern:
+        //   cmd.exe /d /s /c "escaped-command escaped-args"
+        // with windowsVerbatimArguments: true so libuv doesn't re-quote.
+        // shell: false ensures resolveCommand output never enters a shell command
+        // string from Node's perspective — satisfying CodeQL.
+        // Normalize posix slashes to Windows backslashes (cross-spawn does this too).
+        const normalizedCmd = normalize(resolved);
+        const escapedParts = [
+            escapeCommandForVerbatim(normalizedCmd),
+            ...args.map((a) => escapeArgForVerbatim(a)),
+        ];
+        return {
+            command: "cmd.exe",
+            args: ["/d", "/s", "/c", `"${escapedParts.join(" ")}"`],
+            shell: false,
+            windowsVerbatimArguments: true,
+        };
+    }
+    // Branch 4: Unix — spawn cmd directly with shell: false.
+    // execvp handles PATH lookup natively, no resolution needed.
+    return { command: cmd, args, shell: false, windowsVerbatimArguments: false };
+}
 /**
  * Executes a command and returns cleaned output with ANSI codes stripped.
  * Uses spawn (not exec) to avoid shell injection. The child is spawned in its
  * own process group (`detached: true` on Unix) so that on timeout we can kill
  * the entire group — preventing orphaned grandchild processes.
  *
- * On Windows, shell is enabled so that .cmd/.bat wrappers (like npx) can be
- * executed — args are still passed as an array so they remain properly escaped.
+ * Shell mode defaults to `false` on all platforms. On Windows, .cmd/.bat
+ * wrappers (like npm, npx) are automatically handled via cmd.exe invocation
+ * with windowsVerbatimArguments (cross-spawn pattern), avoiding shell injection.
+ *
+ * Callers can opt in to `shell: true` for shell features (pipes, globs),
+ * but this bypasses security protections — use only with trusted input.
  *
  * Throws on system-level errors (command not found, permission denied, timeout).
  * Normal non-zero exit codes are returned in the result, not thrown.
  */
 export function run(cmd, args, opts) {
     return new Promise((resolve, reject) => {
-        // Determine shell mode: default to true on Windows (for .cmd/.bat wrappers),
-        // but allow callers to override (e.g., git uses shell:false to avoid cmd.exe
-        // mangling format strings that contain < > characters).
-        const useShell = opts?.shell ?? process.platform === "win32";
-        // On Windows with shell mode, escape cmd.exe metacharacters to prevent
-        // environment variable expansion and command injection via special chars.
-        // See escapeCmdArg() for details on what is escaped and why.
-        const safeArgs = useShell && process.platform === "win32" ? args.map(escapeCmdArg) : args;
-        const child = spawn(cmd, safeArgs, {
+        const config = _buildSpawnConfig(cmd, args, { shell: opts?.shell });
+        const child = spawn(config.command, config.args, {
             cwd: opts?.cwd,
             env: opts?.env ? (opts.replaceEnv ? opts.env : { ...process.env, ...opts.env }) : undefined,
-            shell: useShell,
+            shell: config.shell,
+            windowsVerbatimArguments: config.windowsVerbatimArguments,
             // Unix: creates a new process group via setsid(2) so we can kill the
             // entire group on timeout (prevents orphaned grandchild processes).
             // Windows: skip — detached on Windows creates a visible console window,

package/dist/runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAsBpD;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,YAAY,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;gBAC1D,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,GAAG,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAWD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,OAAO,GAAG,GAAG,CAAC;IAElB,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,iDAAiD;QACjD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,OAAO,GAAG,CAAC;IACxB,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,iCAAiC;IACjC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEtC,wDAAwD;IACxD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,IAAiB;IAChE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,6EAA6E;QAC7E,6EAA6E;QAC7E,wDAAwD;QACxD,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;QAE7D,uEAAuE;QACvE,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE1F,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE;YACjC,GAAG,EAAE,IAAI,EAAE,GAAG;YACd,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3F,KAAK,EAAE,QAAQ;YACf,qEAAqE;YACrE,oEAAoE;YACpE,wEAAwE;YACxE,mDAAmD;YACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACtC,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,8DAA8D;QAC9D,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;QAC/D,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,cAAc,GAAG,KAAK,CAAC;QAE3B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,IAAI,SAAS,GAAG,SAAS,GAAG,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzD,cAAc,GAAG,IAAI,CAAC;gBACtB,gBAAgB,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,cAAc;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,IAAI,SAAS,GAAG,SAAS,GAAG,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzD,cAAc,GAAG,IAAI,CAAC;gBACtB,gBAAgB,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,cAAc;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,yDAAyD;QACzD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,aAAiC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,IAAI,OAAO,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,aAAa,GAAG,SAAS,CAAC;YAC1B,gBAAgB,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;QAC/B,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,wEAAwE;QACxE,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,qEAAqE;QACrE,sEAAsE;QACtE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC/C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YAEf,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CACJ,IAAI,KAAK,CACP,uBAAuB,GAAG,uDAAuD,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,iDAAiD;QACjD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YAEf,IAAI,iBAAqC,CAAC;YAC1C,IAAI,mBAAuC,CAAC;YAC5C,MAAM,cAAc,GAAG,KAEtB,CAAC;YACF,IAAI,OAAO,cAAc,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;gBACvD,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;gBAC7C,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC;gBACtC,mBAAmB,GAAG,KAAK,CAAC,aAAa,CAAC;YAC5C,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAE7F,qEAAqE;YACrE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CACJ,IAAI,KAAK,CACP,YAAY,GAAG,qBAAqB,SAAS,sBAAsB,aAAa,IAAI,MAAM,IAAI,SAAS,IAAI,CAC5G,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,qBAAqB;YACrB,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,CACJ,IAAI,KAAK,CACP,YAAY,GAAG,gCAAgC,SAAS,yBAAyB,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,4DAA4D;YAC5D,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvD,MAAM,CACJ,IAAI,KAAK,CACP,uBAAuB,GAAG,uDAAuD,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,OAAO,CAAC;gBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;gBACnB,MAAM;gBACN,MAAM;gBACN,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,kEAAkE;QAClE,iEAAiE;QACjE,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;YACxB,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,qDAAqD;IACrD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAClE,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE;YAC3C,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAErB,MAAM,KAAK,GAAG,MAAM;aACjB,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,4EAA4E;YAC5E,wEAAwE;YACxE,kEAAkE;YAClE,mEAAmE;YACnE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;QAED,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,uDAAuD;QACvD,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAsBD;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,YAAY,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;gBAC1D,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,GAAG,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAWD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,OAAO,GAAG,GAAG,CAAC;IAElB,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,iDAAiD;QACjD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,OAAO,GAAG,CAAC;IACxB,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,iCAAiC;IACjC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEtC,wDAAwD;IACxD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,EAAE;AACF,gEAAgE;AAChE,mEAAmE;AACnE,sFAAsF;AACtF,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,6DAA6D;AAC7D,SAAS,wBAAwB,CAAC,GAAW;IAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,sDAAsD;IACtD,6DAA6D;IAC7D,mEAAmE;IACnE,yEAAyE;IACzE,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAExD,oFAAoF;IACpF,gCAAgC;IAChC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAEpD,0DAA0D;IAC1D,OAAO,GAAG,IAAI,OAAO,GAAG,CAAC;IACzB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAEhD,OAAO,OAAO,CAAC;AACjB,CAAC;AAcD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,IAAc,EACd,IAA0B,EAC1B,WAAmB,OAAO,CAAC,QAAQ,EACnC,WAAoC,cAAc;IAElD,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IACxF,CAAC;IAED,sCAAsC;IACtC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE/B,6DAA6D;QAC7D,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;QACpF,CAAC;QAED,0EAA0E;QAC1E,oDAAoD;QACpD,oDAAoD;QACpD,iEAAiE;QACjE,0EAA0E;QAC1E,sDAAsD;QACtD,8EAA8E;QAC9E,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG;YACnB,wBAAwB,CAAC,aAAa,CAAC;YACvC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;SAC5C,CAAC;QACF,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACvD,KAAK,EAAE,KAAK;YACZ,wBAAwB,EAAE,IAAI;SAC/B,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,6DAA6D;IAC7D,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,IAAiB;IAChE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;YAC/C,GAAG,EAAE,IAAI,EAAE,GAAG;YACd,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3F,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;YACzD,qEAAqE;YACrE,oEAAoE;YACpE,wEAAwE;YACxE,mDAAmD;YACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACtC,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,8DAA8D;QAC9D,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;QAC/D,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,cAAc,GAAG,KAAK,CAAC;QAE3B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,IAAI,SAAS,GAAG,SAAS,GAAG,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzD,cAAc,GAAG,IAAI,CAAC;gBACtB,gBAAgB,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,cAAc;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,IAAI,SAAS,GAAG,SAAS,GAAG,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzD,cAAc,GAAG,IAAI,CAAC;gBACtB,gBAAgB,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,cAAc;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,yDAAyD;QACzD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,aAAiC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,IAAI,OAAO,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,aAAa,GAAG,SAAS,CAAC;YAC1B,gBAAgB,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;QAC/B,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,wEAAwE;QACxE,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,qEAAqE;QACrE,sEAAsE;QACtE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC/C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YAEf,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CACJ,IAAI,KAAK,CACP,uBAAuB,GAAG,uDAAuD,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,iDAAiD;QACjD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YAEf,IAAI,iBAAqC,CAAC;YAC1C,IAAI,mBAAuC,CAAC;YAC5C,MAAM,cAAc,GAAG,KAEtB,CAAC;YACF,IAAI,OAAO,cAAc,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;gBACvD,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;gBAC7C,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC;gBACtC,mBAAmB,GAAG,KAAK,CAAC,aAAa,CAAC;YAC5C,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAE7F,qEAAqE;YACrE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CACJ,IAAI,KAAK,CACP,YAAY,GAAG,qBAAqB,SAAS,sBAAsB,aAAa,IAAI,MAAM,IAAI,SAAS,IAAI,CAC5G,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,qBAAqB;YACrB,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,CACJ,IAAI,KAAK,CACP,YAAY,GAAG,gCAAgC,SAAS,yBAAyB,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,4DAA4D;YAC5D,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvD,MAAM,CACJ,IAAI,KAAK,CACP,uBAAuB,GAAG,uDAAuD,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,OAAO,CAAC;gBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;gBACnB,MAAM;gBACN,MAAM;gBACN,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,kEAAkE;QAClE,iEAAiE;QACjE,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;YACxB,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server.d.ts

@@ -1,4 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type LazyToolManager } from "./lazy-tools.js";
 export interface CreateServerOptions {
     /** Package name, e.g. "@paretools/git" */
     name: string;
@@ -6,8 +7,15 @@ export interface CreateServerOptions {
     version: string;
     /** Human-readable server instructions for MCP clients */
     instructions: string;
-    /** Callback that registers all tools on the server */
-    registerTools: (server: McpServer) => void;
+    /**
+     * Callback that registers all tools on the server.
+     *
+     * When lazy mode is active (`PARE_LAZY=true`), the second argument is a
+     * `LazyToolManager` that the callback can use to defer non-core tools.
+     * When lazy mode is off, the second argument is `undefined` and all tools
+     * should be registered directly.
+     */
+    registerTools: (server: McpServer, lazyManager?: LazyToolManager) => void;
 }
 /**
  * Creates an MCP server with the standard Pare boilerplate:

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,aAAa,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC;CAC5C;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAWnF"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQpE,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAI9E,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,eAAe,KAAK,IAAI,CAAC;CAC3E;AA0BD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CA0BnF"}

package/dist/server.js

@@ -1,5 +1,31 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { ErrorCode, ListResourcesRequestSchema, McpError, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { createLazyToolManager } from "./lazy-tools.js";
+import { isLazyEnabled } from "./tool-filter.js";
+import { strictifyInputSchema } from "./strict-input.js";
+/**
+ * Wraps an McpServer so that every `registerTool` call automatically applies
+ * strict input validation (rejects unknown parameters) to the tool's
+ * inputSchema. This prevents AI agents from silently passing wrong-but-
+ * plausible parameter names (e.g. `branch` instead of `ref`).
+ */
+function applyStrictInputSchemas(server) {
+    const original = server.registerTool.bind(server);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    server.registerTool = function (...args) {
+        // The config-based overload: registerTool(name, config, callback)
+        // config is always the second argument and contains inputSchema
+        if (args.length >= 2 && typeof args[1] === "object" && args[1] !== null) {
+            const config = args[1];
+            if (config.inputSchema) {
+                config.inputSchema = strictifyInputSchema(config.inputSchema);
+            }
+        }
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
+        return original(...args);
+    };
+}
 /**
  * Creates an MCP server with the standard Pare boilerplate:
  * instantiates McpServer, registers tools via callback, connects StdioServerTransport.
@@ -9,7 +35,20 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 export async function createServer(options) {
     const { name, version, instructions, registerTools } = options;
     const server = new McpServer({ name, version }, { instructions });
-    registerTools(server);
+    applyStrictInputSchemas(server);
+    const lazy = isLazyEnabled();
+    const lazyManager = lazy ? createLazyToolManager(server) : undefined;
+    registerTools(server, lazyManager);
+    // Pare servers are tool-only and register no resources. Some MCP clients
+    // (e.g. OpenCode) fire `resources/read` after every structured tool call,
+    // which causes a -32603 InternalError because no resource handler exists.
+    // Register stub handlers so those requests receive a clean -32602 response
+    // ("Resource not found") instead of the confusing generic error.
+    server.server.registerCapabilities({ resources: {} });
+    server.server.setRequestHandler(ListResourcesRequestSchema, () => ({ resources: [] }));
+    server.server.setRequestHandler(ReadResourceRequestSchema, (request) => {
+        throw new McpError(ErrorCode.InvalidParams, `Resource not found: ${request.params.uri}`);
+    });
     const transport = new StdioServerTransport();
     await server.connect(transport);
     return server;

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAajF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAElE,aAAa,CAAC,MAAM,CAAC,CAAC;IAEtB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,SAAS,EACT,0BAA0B,EAC1B,QAAQ,EACR,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAwB,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAoBzD;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,MAAiB;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElD,8DAA8D;IAC7D,MAAc,CAAC,YAAY,GAAG,UAAU,GAAG,IAAW;QACrD,kEAAkE;QAClE,gEAAgE;QAChE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,CAAC,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QACD,iEAAiE;QACjE,OAAQ,QAAyC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAClE,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEhC,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAErE,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAEnC,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,CAAC,OAAO,EAAE,EAAE;QACrE,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,uBAAuB,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/strict-input.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Converts a raw Zod shape (used as `inputSchema` in tool registration) into
+ * a strict Zod object schema that rejects unrecognized properties.
+ *
+ * By default the MCP SDK wraps raw shapes with `z.object(shape)` which
+ * silently strips unknown keys. This causes confusing errors when an AI agent
+ * passes a wrong-but-plausible parameter name (e.g. `branch` instead of `ref`).
+ *
+ * Applying `z.strictObject(shape)` instead causes validation to fail with a
+ * clear error message listing the unrecognized key.
+ */
+/**
+ * If `schema` is a raw Zod shape, wraps it in `z.strictObject()` so that
+ * unknown parameters are rejected during validation. If the schema is already
+ * a Zod schema instance, applies `.strict()` if it's an object schema.
+ * Otherwise returns the schema unchanged.
+ */
+export declare function strictifyInputSchema<T>(schema: T): T;
+//# sourceMappingURL=strict-input.d.ts.map

package/dist/strict-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-input.d.ts","sourceRoot":"","sources":["../src/strict-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA2BH;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAiBpD"}

package/dist/strict-input.js

@@ -0,0 +1,59 @@
+/**
+ * Converts a raw Zod shape (used as `inputSchema` in tool registration) into
+ * a strict Zod object schema that rejects unrecognized properties.
+ *
+ * By default the MCP SDK wraps raw shapes with `z.object(shape)` which
+ * silently strips unknown keys. This causes confusing errors when an AI agent
+ * passes a wrong-but-plausible parameter name (e.g. `branch` instead of `ref`).
+ *
+ * Applying `z.strictObject(shape)` instead causes validation to fail with a
+ * clear error message listing the unrecognized key.
+ */
+import { z } from "zod";
+/**
+ * Checks whether a value is a Zod schema instance (has `_zod` for v4).
+ */
+function isZodSchema(value) {
+    return typeof value === "object" && value !== null && ("_zod" in value || "_def" in value);
+}
+/**
+ * Checks whether a value is a "raw shape" — a plain object whose values are
+ * Zod schemas. This is the shorthand form used by all Pare tools:
+ * `{ path: z.string(), maxCount: z.number() }`.
+ */
+function isRawShape(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    // If it's already a Zod schema instance, it's NOT a raw shape
+    if (isZodSchema(value))
+        return false;
+    const entries = Object.values(value);
+    // Empty shape is valid (tools with no parameters)
+    if (entries.length === 0)
+        return true;
+    // A raw shape has values that are Zod schemas
+    return entries.some((v) => isZodSchema(v));
+}
+/**
+ * If `schema` is a raw Zod shape, wraps it in `z.strictObject()` so that
+ * unknown parameters are rejected during validation. If the schema is already
+ * a Zod schema instance, applies `.strict()` if it's an object schema.
+ * Otherwise returns the schema unchanged.
+ */
+export function strictifyInputSchema(schema) {
+    if (!schema)
+        return schema;
+    if (isRawShape(schema)) {
+        // Convert raw shape to strict object schema.
+        // The MCP SDK's normalizeObjectSchema will recognize this as a pre-built
+        // Zod v4 schema and use it directly instead of wrapping in z.object().
+        return z.strictObject(schema);
+    }
+    // If it's already a Zod object schema, apply .strict()
+    const schemaObj = schema;
+    if (isZodSchema(schema) && typeof schemaObj.strict === "function") {
+        return schemaObj.strict();
+    }
+    return schema;
+}
+//# sourceMappingURL=strict-input.js.map

package/dist/strict-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-input.js","sourceRoot":"","sources":["../src/strict-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,8DAA8D;IAC9D,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,kDAAkD;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,8CAA8C;IAC9C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAI,MAAS;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAE3B,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,6CAA6C;QAC7C,yEAAyE;QACzE,uEAAuE;QACvE,OAAO,CAAC,CAAC,YAAY,CAAC,MAAmC,CAAiB,CAAC;IAC7E,CAAC;IAED,uDAAuD;IACvD,MAAM,SAAS,GAAG,MAAiC,CAAC;IACpD,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAClE,OAAQ,SAAS,CAAC,MAAwB,EAAO,CAAC;IACpD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/tool-filter.d.ts

@@ -22,6 +22,18 @@
  */
 import { _resetProfileCache } from "./profiles.js";
 export { _resetProfileCache };
+/**
+ * Returns `true` when lazy tool loading is enabled.
+ *
+ * Lazy mode is activated by setting `PARE_LAZY=true` (case-insensitive).
+ * When active, only core tools are registered at startup; extended tools
+ * are deferred and discoverable via the `discover-tools` meta-tool.
+ *
+ * Lazy mode is NOT active when `PARE_PROFILE=full` is explicitly set,
+ * or when any explicit tool filter (`PARE_TOOLS`, `PARE_{SERVER}_TOOLS`)
+ * is in use — those filters already provide precise control.
+ */
+export declare function isLazyEnabled(): boolean;
 /**
  * Determines whether a tool should be registered based on environment variables.
  *

package/dist/tool-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-filter.d.ts","sourceRoot":"","sources":["../src/tool-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAkB,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CA0BhF"}
+{"version":3,"file":"tool-filter.d.ts","sourceRoot":"","sources":["../src/tool-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAkB,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAWvC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CA0BhF"}

package/dist/tool-filter.js

@@ -22,6 +22,30 @@
  */
 import { resolveProfile, _resetProfileCache } from "./profiles.js";
 export { _resetProfileCache };
+/**
+ * Returns `true` when lazy tool loading is enabled.
+ *
+ * Lazy mode is activated by setting `PARE_LAZY=true` (case-insensitive).
+ * When active, only core tools are registered at startup; extended tools
+ * are deferred and discoverable via the `discover-tools` meta-tool.
+ *
+ * Lazy mode is NOT active when `PARE_PROFILE=full` is explicitly set,
+ * or when any explicit tool filter (`PARE_TOOLS`, `PARE_{SERVER}_TOOLS`)
+ * is in use — those filters already provide precise control.
+ */
+export function isLazyEnabled() {
+    // Explicit tool filters take precedence — no lazy behavior.
+    if (process.env.PARE_TOOLS !== undefined)
+        return false;
+    // Explicit "full" profile means load everything.
+    const profile = process.env.PARE_PROFILE;
+    if (profile !== undefined && profile.trim().toLowerCase() === "full")
+        return false;
+    const raw = process.env.PARE_LAZY;
+    if (raw === undefined)
+        return false;
+    return raw.trim().toLowerCase() === "true";
+}
 /**
  * Determines whether a tool should be registered based on environment variables.
  *

package/dist/tool-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-filter.js","sourceRoot":"","sources":["../src/tool-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,QAAgB;IACrE,qDAAqD;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,2CAA2C;IAC3C,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,8CAA8C;IAC9C,MAAM,MAAM,GAAG,QAAQ,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;IAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,2BAA2B;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"tool-filter.js","sourceRoot":"","sources":["../src/tool-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa;IAC3B,4DAA4D;IAC5D,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEvD,iDAAiD;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAEnF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,QAAgB;IACrE,qDAAqD;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,2CAA2C;IAC3C,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,8CAA8C;IAC9C,MAAM,MAAM,GAAG,QAAQ,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;IAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,2BAA2B;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/validation.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Preprocess function for Zod schemas that coerces a JSON string to an array.
+ * Handles the case where MCP clients serialize array parameters as JSON strings
+ * before the tool schema is fully loaded.
+ *
+ * Usage: `z.preprocess(coerceJsonArray, z.array(z.string()))`
+ */
+export declare function coerceJsonArray(val: unknown): unknown;
 /**
  * Validates that a string argument is safe to pass as a positional argument to a CLI tool.
  * Prevents flag injection attacks (e.g., passing "--output=/etc/passwd" as a ref name).

package/dist/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAM5E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAMzE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASzE;AAiCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAwB1D"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAOrD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAM5E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAMzE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASzE;AAiCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAwB1D"}

package/dist/validation.js

@@ -1,3 +1,20 @@
+/**
+ * Preprocess function for Zod schemas that coerces a JSON string to an array.
+ * Handles the case where MCP clients serialize array parameters as JSON strings
+ * before the tool schema is fully loaded.
+ *
+ * Usage: `z.preprocess(coerceJsonArray, z.array(z.string()))`
+ */
+export function coerceJsonArray(val) {
+    if (typeof val !== "string")
+        return val;
+    try {
+        return JSON.parse(val);
+    }
+    catch {
+        return val;
+    }
+}
 /**
  * Validates that a string argument is safe to pass as a positional argument to a CLI tool.
  * Prevents flag injection attacks (e.g., passing "--output=/etc/passwd" as a ref name).

package/dist/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,SAAiB;IACpE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,MAAM,KAAK,kEAAkE,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,MAAM,KAAK,yDAAyD,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,YAAY,KAAK,kEAAkE,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,SAAS;IACT,KAAK;IACL,KAAK;IACL,OAAO;IACP,IAAI;IACJ,QAAQ;IACR,SAAS;IACT,KAAK;IACL,SAAS;IACT,MAAM;IACN,SAAS;IACT,QAAQ;IACR,OAAO;IACP,IAAI;IACJ,OAAO;CACR,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,+EAA+E;IAC/E,MAAM,IAAI,GACR,OAAO;SACJ,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,EAAE;QACN,EAAE,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,+CAA+C;YAChE,YAAY,CAAC,GAAG,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CACV,8CAA8C,OAAO,KAAK;YACxD,sBAAsB,IAAI,yCAAyC;YACnE,8CAA8C,CACjD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,SAAiB;IACpE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,MAAM,KAAK,kEAAkE,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,MAAM,KAAK,yDAAyD,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,YAAY,KAAK,kEAAkE,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,SAAS;IACT,KAAK;IACL,KAAK;IACL,OAAO;IACP,IAAI;IACJ,QAAQ;IACR,SAAS;IACT,KAAK;IACL,SAAS;IACT,MAAM;IACN,SAAS;IACT,QAAQ;IACR,OAAO;IACP,IAAI;IACJ,OAAO;CACR,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,+EAA+E;IAC/E,MAAM,IAAI,GACR,OAAO;SACJ,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,EAAE;QACN,EAAE,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,+CAA+C;YAChE,YAAY,CAAC,GAAG,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CACV,8CAA8C,OAAO,KAAK;YACxD,sBAAsB,IAAI,yCAAyC;YACnE,8CAA8C,CACjD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Reads the `version` field from the nearest `package.json` relative to
+ * the calling module's `import.meta.url`.
+ *
+ * Walks up directory tree from the given module URL until it finds a
+ * `package.json` with a `version` field, or returns `"0.0.0"` as a
+ * fallback.
+ *
+ * @example
+ * ```ts
+ * import { readPackageVersion } from "@paretools/shared";
+ * const version = readPackageVersion(import.meta.url);
+ * ```
+ */
+export declare function readPackageVersion(importMetaUrl: string): string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAwBhE"}

package/dist/version.js

@@ -0,0 +1,42 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * Reads the `version` field from the nearest `package.json` relative to
+ * the calling module's `import.meta.url`.
+ *
+ * Walks up directory tree from the given module URL until it finds a
+ * `package.json` with a `version` field, or returns `"0.0.0"` as a
+ * fallback.
+ *
+ * @example
+ * ```ts
+ * import { readPackageVersion } from "@paretools/shared";
+ * const version = readPackageVersion(import.meta.url);
+ * ```
+ */
+export function readPackageVersion(importMetaUrl) {
+    let dir = dirname(fileURLToPath(importMetaUrl));
+    // Walk up to find the nearest package.json with a version field
+    for (;;) {
+        try {
+            const pkgPath = join(dir, "package.json");
+            const raw = readFileSync(pkgPath, "utf-8");
+            const pkg = JSON.parse(raw);
+            if (pkg.version) {
+                return pkg.version;
+            }
+        }
+        catch {
+            // No package.json in this directory, keep walking up
+        }
+        const parent = dirname(dir);
+        if (parent === dir) {
+            // Reached filesystem root
+            break;
+        }
+        dir = parent;
+    }
+    return "0.0.0";
+}
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,IAAI,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;IAEhD,gEAAgE;IAChE,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;YACpD,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChB,OAAO,GAAG,CAAC,OAAO,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,0BAA0B;YAC1B,MAAM;QACR,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paretools/shared",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "Shared utilities for Pare MCP servers",
   "license": "MIT",
   "keywords": [
@@ -40,11 +40,11 @@
     "dist"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.27.1",
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@types/node": "^25.2.3",
+    "@types/node": "^25.3.3",
     "typescript": "^5.7.0",
     "vitest": "^4.0.18",
     "@paretools/tsconfig": "0.0.0"