@paretools/shared 0.13.0 → 0.14.0

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { dualOutput, estimateTokens, compactDualOutput, strippedDualOutput, strippedCompactDualOutput, } from "./output.js";
-export { run, escapeCmdArg, type RunResult, type RunOptions } from "./runner.js";
+export { run, escapeCmdArg, _buildSpawnConfig, type RunResult, type RunOptions, type SpawnConfig, } from "./runner.js";
 export { stripAnsi } from "./ansi.js";
-export { assertNoFlagInjection, assertValidSortKey, assertValidLogOpts, assertAllowedCommand, } from "./validation.js";
+export { coerceJsonArray, assertNoFlagInjection, assertValidSortKey, assertValidLogOpts, assertAllowedCommand, } from "./validation.js";
 export { INPUT_LIMITS } from "./limits.js";
 export { compactInput, projectPathInput, repoPathInput, cwdPathInput, fixInput, pathInput, configInput, filePatternsInput, } from "./input-schemas.js";
 export { sanitizeErrorOutput } from "./sanitize.js";
@@ -16,4 +16,5 @@ export { PareErrorCategory, PareErrorSchema, classifyError, errorOutput, invalid
 export type { PareErrorCategoryType, PareError } from "./errors.js";
 export { createServer } from "./server.js";
 export type { CreateServerOptions } from "./server.js";
+export { readPackageVersion } from "./version.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC1F,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,EACf,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,GAAG,EACH,YAAY,EACZ,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC1F,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,EACf,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,7 +1,7 @@
 export { dualOutput, estimateTokens, compactDualOutput, strippedDualOutput, strippedCompactDualOutput, } from "./output.js";
-export { run, escapeCmdArg } from "./runner.js";
+export { run, escapeCmdArg, _buildSpawnConfig, } from "./runner.js";
 export { stripAnsi } from "./ansi.js";
-export { assertNoFlagInjection, assertValidSortKey, assertValidLogOpts, assertAllowedCommand, } from "./validation.js";
+export { coerceJsonArray, assertNoFlagInjection, assertValidSortKey, assertValidLogOpts, assertAllowedCommand, } from "./validation.js";
 export { INPUT_LIMITS } from "./limits.js";
 export { compactInput, projectPathInput, repoPathInput, cwdPathInput, fixInput, pathInput, configInput, filePatternsInput, } from "./input-schemas.js";
 export { sanitizeErrorOutput } from "./sanitize.js";
@@ -12,4 +12,5 @@ export { registerDiscoverTool } from "./discover-tool.js";
 export { assertAllowedByPolicy, assertAllowedRoot, assertNoPathQualifiedCommand, } from "./policy.js";
 export { PareErrorCategory, PareErrorSchema, classifyError, errorOutput, invalidInputError, isCommandNotFound, isPermissionDenied, isTimeout, isNetworkError, isAuthError, isConflict, isNotFound, isAlreadyExists, isConfigurationError, } from "./errors.js";
 export { createServer } from "./server.js";
+export { readPackageVersion } from "./version.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,GAAG,EAAE,YAAY,EAAmC,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAE1F,OAAO,EACL,qBAAqB,GAGtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,EACf,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,GAAG,EACH,YAAY,EACZ,iBAAiB,GAIlB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAE1F,OAAO,EACL,qBAAqB,GAGtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,EACf,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/output.d.ts

@@ -1,3 +1,4 @@
+import type { ZodType } from "zod";
 import type { ToolOutput } from "./types.js";
 /**
  * Creates the dual-output response that every pare tool returns.
@@ -27,8 +28,11 @@ export declare function estimateTokens(text: string): number;
  * @param compactMap - Projects full data into a compact shape.
  * @param compactFormat - Formatter for compact data.
  * @param forceFullSchema - When true, skip auto-detection and return full data.
+ * @param outputSchema - Optional Zod schema. In dev mode (NODE_ENV !== 'production' or PARE_DEBUG set),
+ *   the structured output is validated against this schema before returning. Mismatches throw a
+ *   descriptive error, catching compact-map bugs during development/testing rather than in production.
  */
-export declare function compactDualOutput<T, C>(data: T, rawStdout: string, humanFormat: (d: T) => string, compactMap: (d: T) => C, compactFormat: (d: C) => string, forceFullSchema: boolean): ToolOutput<T | C>;
+export declare function compactDualOutput<T, C>(data: T, rawStdout: string, humanFormat: (d: T) => string, compactMap: (d: T) => C, compactFormat: (d: C) => string, forceFullSchema: boolean, outputSchema?: ZodType): ToolOutput<T | C>;
 /**
  * Creates a dual-output response where the formatter receives the full internal
  * data (with extra fields for human-readable output) while structuredContent
@@ -54,6 +58,7 @@ export declare function strippedDualOutput<T, S>(data: T, humanFormat: (d: T) =>
  * @param compactMap - Projects full data into a compact shape (for compact mode).
  * @param compactFormat - Formatter for compact data.
  * @param forceFullSchema - When true, skip auto-detection and return full data.
+ * @param outputSchema - Optional Zod schema for dev-mode validation (see compactDualOutput).
  */
-export declare function strippedCompactDualOutput<T, S, C>(data: T, rawStdout: string, humanFormat: (d: T) => string, schemaMap: (d: T) => S, compactMap: (d: T) => C, compactFormat: (d: C) => string, forceFullSchema: boolean): ToolOutput<S | C>;
+export declare function strippedCompactDualOutput<T, S, C>(data: T, rawStdout: string, humanFormat: (d: T) => string, schemaMap: (d: T) => S, compactMap: (d: T) => C, compactFormat: (d: C) => string, forceFullSchema: boolean, outputSchema?: ZodType): ToolOutput<S | C>;
 //# sourceMappingURL=output.d.ts.map

package/dist/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAKnF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,CAAC,EACpC,IAAI,EAAE,CAAC,EACP,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC7B,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EACvB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC/B,eAAe,EAAE,OAAO,GACvB,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAcnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EACrC,IAAI,EAAE,CAAC,EACP,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC7B,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GACrB,UAAU,CAAC,CAAC,CAAC,CAKf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC/C,IAAI,EAAE,CAAC,EACP,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC7B,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EACtB,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EACvB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC/B,eAAe,EAAE,OAAO,GACvB,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAcnB"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA+B7C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAKnF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,CAAC,EACpC,IAAI,EAAE,CAAC,EACP,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC7B,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EACvB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC/B,eAAe,EAAE,OAAO,EACxB,YAAY,CAAC,EAAE,OAAO,GACrB,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAoBnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EACrC,IAAI,EAAE,CAAC,EACP,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC7B,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GACrB,UAAU,CAAC,CAAC,CAAC,CAKf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC/C,IAAI,EAAE,CAAC,EACP,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC7B,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EACtB,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EACvB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC/B,eAAe,EAAE,OAAO,EACxB,YAAY,CAAC,EAAE,OAAO,GACrB,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAoBnB"}

package/dist/output.js

@@ -1,3 +1,29 @@
+/**
+ * Returns true when dev-mode validation should run.
+ * Active when NODE_ENV is NOT 'production' or PARE_DEBUG is set.
+ */
+function isDevMode() {
+    return process.env.NODE_ENV !== "production" || !!process.env.PARE_DEBUG;
+}
+/**
+ * Validates `data` against a Zod `outputSchema` in dev mode.
+ * Throws a descriptive error when the data does not match the schema,
+ * helping developers catch compact-map / schema mismatches early.
+ *
+ * No-ops in production (NODE_ENV=production without PARE_DEBUG).
+ */
+function devValidate(data, outputSchema, label) {
+    if (!outputSchema || !isDevMode())
+        return;
+    const result = outputSchema.safeParse(data);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((i) => `  - ${i.path.join(".")}: ${i.message}`)
+            .join("\n");
+        throw new Error(`compactDualOutput (${label}): structured output does not match outputSchema.\n` +
+            `Validation errors:\n${issues}`);
+    }
+}
 /**
  * Creates the dual-output response that every pare tool returns.
  *
@@ -33,18 +59,27 @@ export function estimateTokens(text) {
  * @param compactMap - Projects full data into a compact shape.
  * @param compactFormat - Formatter for compact data.
  * @param forceFullSchema - When true, skip auto-detection and return full data.
+ * @param outputSchema - Optional Zod schema. In dev mode (NODE_ENV !== 'production' or PARE_DEBUG set),
+ *   the structured output is validated against this schema before returning. Mismatches throw a
+ *   descriptive error, catching compact-map bugs during development/testing rather than in production.
  */
-export function compactDualOutput(data, rawStdout, humanFormat, compactMap, compactFormat, forceFullSchema) {
+export function compactDualOutput(data, rawStdout, humanFormat, compactMap, compactFormat, forceFullSchema, outputSchema) {
     if (forceFullSchema) {
-        return dualOutput(data, humanFormat);
+        const out = dualOutput(data, humanFormat);
+        devValidate(out.structuredContent, outputSchema, "full");
+        return out;
     }
     const structuredTokens = estimateTokens(JSON.stringify(data));
     const rawTokens = estimateTokens(rawStdout);
     if (structuredTokens >= rawTokens) {
         const compact = compactMap(data);
-        return dualOutput(compact, compactFormat);
+        const out = dualOutput(compact, compactFormat);
+        devValidate(out.structuredContent, outputSchema, "compact");
+        return out;
     }
-    return dualOutput(data, humanFormat);
+    const out = dualOutput(data, humanFormat);
+    devValidate(out.structuredContent, outputSchema, "full");
+    return out;
 }
 /**
  * Creates a dual-output response where the formatter receives the full internal
@@ -76,17 +111,24 @@ export function strippedDualOutput(data, humanFormat, schemaMap) {
  * @param compactMap - Projects full data into a compact shape (for compact mode).
  * @param compactFormat - Formatter for compact data.
  * @param forceFullSchema - When true, skip auto-detection and return full data.
+ * @param outputSchema - Optional Zod schema for dev-mode validation (see compactDualOutput).
  */
-export function strippedCompactDualOutput(data, rawStdout, humanFormat, schemaMap, compactMap, compactFormat, forceFullSchema) {
+export function strippedCompactDualOutput(data, rawStdout, humanFormat, schemaMap, compactMap, compactFormat, forceFullSchema, outputSchema) {
     if (forceFullSchema) {
-        return strippedDualOutput(data, humanFormat, schemaMap);
+        const out = strippedDualOutput(data, humanFormat, schemaMap);
+        devValidate(out.structuredContent, outputSchema, "full");
+        return out;
     }
     const structuredTokens = estimateTokens(JSON.stringify(data));
     const rawTokens = estimateTokens(rawStdout);
     if (structuredTokens >= rawTokens) {
         const compact = compactMap(data);
-        return dualOutput(compact, compactFormat);
+        const out = dualOutput(compact, compactFormat);
+        devValidate(out.structuredContent, outputSchema, "compact");
+        return out;
     }
-    return strippedDualOutput(data, humanFormat, schemaMap);
+    const out = strippedDualOutput(data, humanFormat, schemaMap);
+    devValidate(out.structuredContent, outputSchema, "full");
+    return out;
 }
 //# sourceMappingURL=output.js.map

package/dist/output.js.map

@@ -1 +1 @@
-{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAI,IAAO,EAAE,WAA6B;IAClE,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAO,EACP,SAAiB,EACjB,WAA6B,EAC7B,UAAuB,EACvB,aAA+B,EAC/B,eAAwB;IAExB,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,CAAsB,CAAC;IAC5D,CAAC;IAED,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAE5C,IAAI,gBAAgB,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC,OAAO,EAAE,aAAa,CAAsB,CAAC;IACjE,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,CAAsB,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAO,EACP,WAA6B,EAC7B,SAAsB;IAEtB,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,iBAAiB,EAAE,SAAS,CAAC,IAAI,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAO,EACP,SAAiB,EACjB,WAA6B,EAC7B,SAAsB,EACtB,UAAuB,EACvB,aAA+B,EAC/B,eAAwB;IAExB,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAsB,CAAC;IAC/E,CAAC;IAED,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAE5C,IAAI,gBAAgB,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC,OAAO,EAAE,aAAa,CAAsB,CAAC;IACjE,CAAC;IAED,OAAO,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAsB,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAI,IAAO,EAAE,YAAiC,EAAE,KAAa;IAC/E,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO;IAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,qDAAqD;YAC9E,uBAAuB,MAAM,EAAE,CAClC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAI,IAAO,EAAE,WAA6B;IAClE,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAO,EACP,SAAiB,EACjB,WAA6B,EAC7B,UAAuB,EACvB,aAA+B,EAC/B,eAAwB,EACxB,YAAsB;IAEtB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAsB,CAAC;QAC/D,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAE5C,IAAI,gBAAgB,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,aAAa,CAAsB,CAAC;QACpE,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAsB,CAAC;IAC/D,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAO,EACP,WAA6B,EAC7B,SAAsB;IAEtB,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,iBAAiB,EAAE,SAAS,CAAC,IAAI,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAO,EACP,SAAiB,EACjB,WAA6B,EAC7B,SAAsB,EACtB,UAAuB,EACvB,aAA+B,EAC/B,eAAwB,EACxB,YAAsB;IAEtB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAsB,CAAC;QAClF,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAE5C,IAAI,gBAAgB,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,aAAa,CAAsB,CAAC;QACpE,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAsB,CAAC;IAClF,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/runner.d.ts

@@ -7,9 +7,9 @@ export interface RunOptions {
      *  (e.g., `git commit --file -`) instead of passing it as a command arg,
      *  which avoids cmd.exe argument-length and newline limitations on Windows. */
     stdin?: string;
-    /** Override shell mode. Defaults to `true` on Windows (for .cmd/.bat wrappers)
-     *  and `false` elsewhere. Set to `false` for native executables (e.g., git)
-     *  whose args contain characters that cmd.exe would misinterpret (like `<>`). */
+    /** Override shell mode. Defaults to `false` on all platforms. On Windows,
+     *  .cmd/.bat wrappers are automatically handled via cmd.exe invocation without
+     *  shell mode. Set to `true` only when you need shell features (pipes, globs). */
     shell?: boolean;
     /** Maximum combined stdout+stderr buffer size in bytes. Defaults to 10 MB. */
     maxBuffer?: number;
@@ -45,14 +45,40 @@ export interface RunResult {
  * they are literal, and outside quotes they rarely appear in tool args.
  */
 export declare function escapeCmdArg(arg: string): string;
+/** Configuration for how to invoke `spawn()`. @internal — exported for testing only. */
+export interface SpawnConfig {
+    command: string;
+    args: string[];
+    shell: boolean;
+    windowsVerbatimArguments: boolean;
+}
+/**
+ * Determines how to spawn a command, handling Windows .cmd/.bat wrappers
+ * without using `shell: true` (which triggers CodeQL alert #16).
+ *
+ * @internal — Exported for unit testing only. Use `run()` instead.
+ *
+ * Branches:
+ *   1. Explicit `shell: true` — pass cmd directly, don't resolve (caller wants shell features)
+ *   2. Windows native .exe/.com — spawn resolved path directly
+ *   3. Windows non-exe (cmd/bat/extensionless/bare) — cmd.exe /d /s /c with windowsVerbatimArguments
+ *   4. Unix — spawn cmd directly, execvp handles PATH
+ */
+export declare function _buildSpawnConfig(cmd: string, args: string[], opts?: {
+    shell?: boolean;
+}, platform?: string, resolver?: (cmd: string) => string): SpawnConfig;
 /**
  * Executes a command and returns cleaned output with ANSI codes stripped.
  * Uses spawn (not exec) to avoid shell injection. The child is spawned in its
  * own process group (`detached: true` on Unix) so that on timeout we can kill
  * the entire group — preventing orphaned grandchild processes.
  *
- * On Windows, shell is enabled so that .cmd/.bat wrappers (like npx) can be
- * executed — args are still passed as an array so they remain properly escaped.
+ * Shell mode defaults to `false` on all platforms. On Windows, .cmd/.bat
+ * wrappers (like npm, npx) are automatically handled via cmd.exe invocation
+ * with windowsVerbatimArguments (cross-spawn pattern), avoiding shell injection.
+ *
+ * Callers can opt in to `shell: true` for shell features (pipes, globs),
+ * but this bypasses security protections — use only with trusted input.
  *
  * Throws on system-level errors (command not found, permission denied, timeout).
  * Normal non-zero exit codes are returned in the result, not thrown.

package/dist/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAIA,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;mFAE+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;qFAEiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;0FACsF;IACtF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAgCD,+FAA+F;AAC/F,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAqChD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA4JtF"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAiDA,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;mFAE+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;sFAEkF;IAClF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;0FACsF;IACtF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAgCD,+FAA+F;AAC/F,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAqChD;AAgDD,wFAAwF;AACxF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC1B,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAuB,GACjD,WAAW,CA2Cb;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAqJtF"}

package/dist/runner.js

@@ -1,6 +1,49 @@
 import { spawn, execFileSync } from "node:child_process";
+import { normalize } from "node:path";
 import { stripAnsi } from "./ansi.js";
 import { sanitizeErrorOutput } from "./sanitize.js";
+/**
+ * Resolves a command name to its absolute path using `where` (Windows) or
+ * `which` (Unix). On Windows this is used to detect whether a command is a
+ * .cmd/.bat wrapper so the runner can invoke it via cmd.exe without using
+ * `shell: true` (which triggers CodeQL alert #16).
+ *
+ * Returns the original command string if resolution fails (e.g., the command
+ * is already an absolute path, or `which`/`where` is unavailable).
+ */
+function resolveCommand(cmd) {
+    // Skip resolution if cmd is already an absolute path
+    if (cmd.startsWith("/") || /^[A-Za-z]:[/\\]/.test(cmd)) {
+        return cmd;
+    }
+    try {
+        const resolver = process.platform === "win32" ? "where" : "which";
+        const output = execFileSync(resolver, [cmd], {
+            timeout: 5_000,
+            stdio: ["ignore", "pipe", "ignore"],
+            windowsHide: true,
+        }).toString("utf-8");
+        const lines = output
+            .split(/\r?\n/)
+            .map((l) => l.trim())
+            .filter(Boolean);
+        if (process.platform === "win32" && lines.length > 1) {
+            // On Windows, `where` returns multiple matches (e.g., `npx` and `npx.cmd`).
+            // Prefer .cmd/.bat entries so _buildSpawnConfig routes them through the
+            // cmd.exe wrapper path (Branch 2) instead of trying to execute an
+            // extensionless shell script with shell: false (which would fail).
+            const cmdLine = lines.find((l) => /\.(cmd|bat)$/i.test(l));
+            if (cmdLine)
+                return cmdLine;
+        }
+        return lines[0] || cmd;
+    }
+    catch {
+        // Resolution failed — fall back to the bare command name so existing
+        // behavior (PATH lookup by the shell/OS) is preserved.
+        return cmd;
+    }
+}
 /**
  * Kills an entire process group (Unix) or process tree (Windows).
  *
@@ -87,32 +130,117 @@ export function escapeCmdArg(arg) {
     escaped = escaped.replace(/!/g, "^!");
     return escaped;
 }
+// ---------------------------------------------------------------------------
+// Verbatim-mode escaping helpers (cross-spawn pattern)
+//
+// These are used when spawning .cmd/.bat files via cmd.exe with
+// windowsVerbatimArguments: true, where libuv performs NO quoting.
+// Algorithm ported from cross-spawn (https://github.com/moxystudio/node-cross-spawn).
+// ---------------------------------------------------------------------------
+/** cmd.exe metacharacters that need caret-escaping. */
+const META_CHARS_RE = /([()\][%!^"`<>&|;, *?])/g;
+/** Caret-escape cmd.exe metacharacters in a command path. */
+function escapeCommandForVerbatim(cmd) {
+    return cmd.replace(META_CHARS_RE, "^$1");
+}
+/**
+ * Escapes a single argument for cmd.exe in windowsVerbatimArguments mode.
+ *
+ * Based on https://qntm.org/cmd (same algorithm as cross-spawn):
+ * 1. Handle backslash+quote sequences for MSVC C runtime parsing
+ * 2. Wrap in double quotes
+ * 3. Caret-escape cmd.exe metacharacters on the quoted result
+ */
+function escapeArgForVerbatim(arg) {
+    // Sequence of backslashes followed by a double quote:
+    // double up all the backslashes and escape the double quote.
+    // The outer `?` makes the capture group optional so bare `"` (zero
+    // preceding backslashes) is also matched — matching cross-spawn exactly.
+    let escaped = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
+    // Sequence of backslashes at end of string (will be followed by our closing quote):
+    // double up all the backslashes
+    escaped = escaped.replace(/(?=(\\+?)?)\1$/, "$1$1");
+    // Wrap in double quotes, then caret-escape metacharacters
+    escaped = `"${escaped}"`;
+    escaped = escaped.replace(META_CHARS_RE, "^$1");
+    return escaped;
+}
+/**
+ * Determines how to spawn a command, handling Windows .cmd/.bat wrappers
+ * without using `shell: true` (which triggers CodeQL alert #16).
+ *
+ * @internal — Exported for unit testing only. Use `run()` instead.
+ *
+ * Branches:
+ *   1. Explicit `shell: true` — pass cmd directly, don't resolve (caller wants shell features)
+ *   2. Windows native .exe/.com — spawn resolved path directly
+ *   3. Windows non-exe (cmd/bat/extensionless/bare) — cmd.exe /d /s /c with windowsVerbatimArguments
+ *   4. Unix — spawn cmd directly, execvp handles PATH
+ */
+export function _buildSpawnConfig(cmd, args, opts, platform = process.platform, resolver = resolveCommand) {
+    // Branch 1: Explicit shell: true — caller wants shell features (pipes, globs).
+    // Pass cmd directly to spawn with shell: true — do NOT call resolveCommand,
+    // which breaks the taint flow that CodeQL flags (environment → shell command).
+    if (opts?.shell === true) {
+        const safeArgs = platform === "win32" ? args.map(escapeCmdArg) : args;
+        return { command: cmd, args: safeArgs, shell: true, windowsVerbatimArguments: false };
+    }
+    // Branches 2+3: Windows without shell
+    if (platform === "win32") {
+        const resolved = resolver(cmd);
+        // Branch 2: Native .exe/.com — spawn resolved path directly.
+        // Only these extensions are true PE executables that CreateProcessW can run
+        // without a shell. This matches cross-spawn's isExecutableRegExp check.
+        if (/\.(exe|com)$/i.test(resolved)) {
+            return { command: resolved, args, shell: false, windowsVerbatimArguments: false };
+        }
+        // Branch 3: Everything else (.cmd, .bat, extensionless, bare names) needs
+        // cmd.exe to interpret it. Use cross-spawn pattern:
+        //   cmd.exe /d /s /c "escaped-command escaped-args"
+        // with windowsVerbatimArguments: true so libuv doesn't re-quote.
+        // shell: false ensures resolveCommand output never enters a shell command
+        // string from Node's perspective — satisfying CodeQL.
+        // Normalize posix slashes to Windows backslashes (cross-spawn does this too).
+        const normalizedCmd = normalize(resolved);
+        const escapedParts = [
+            escapeCommandForVerbatim(normalizedCmd),
+            ...args.map((a) => escapeArgForVerbatim(a)),
+        ];
+        return {
+            command: "cmd.exe",
+            args: ["/d", "/s", "/c", `"${escapedParts.join(" ")}"`],
+            shell: false,
+            windowsVerbatimArguments: true,
+        };
+    }
+    // Branch 4: Unix — spawn cmd directly with shell: false.
+    // execvp handles PATH lookup natively, no resolution needed.
+    return { command: cmd, args, shell: false, windowsVerbatimArguments: false };
+}
 /**
  * Executes a command and returns cleaned output with ANSI codes stripped.
  * Uses spawn (not exec) to avoid shell injection. The child is spawned in its
  * own process group (`detached: true` on Unix) so that on timeout we can kill
  * the entire group — preventing orphaned grandchild processes.
  *
- * On Windows, shell is enabled so that .cmd/.bat wrappers (like npx) can be
- * executed — args are still passed as an array so they remain properly escaped.
+ * Shell mode defaults to `false` on all platforms. On Windows, .cmd/.bat
+ * wrappers (like npm, npx) are automatically handled via cmd.exe invocation
+ * with windowsVerbatimArguments (cross-spawn pattern), avoiding shell injection.
+ *
+ * Callers can opt in to `shell: true` for shell features (pipes, globs),
+ * but this bypasses security protections — use only with trusted input.
  *
  * Throws on system-level errors (command not found, permission denied, timeout).
  * Normal non-zero exit codes are returned in the result, not thrown.
  */
 export function run(cmd, args, opts) {
     return new Promise((resolve, reject) => {
-        // Determine shell mode: default to true on Windows (for .cmd/.bat wrappers),
-        // but allow callers to override (e.g., git uses shell:false to avoid cmd.exe
-        // mangling format strings that contain < > characters).
-        const useShell = opts?.shell ?? process.platform === "win32";
-        // On Windows with shell mode, escape cmd.exe metacharacters to prevent
-        // environment variable expansion and command injection via special chars.
-        // See escapeCmdArg() for details on what is escaped and why.
-        const safeArgs = useShell && process.platform === "win32" ? args.map(escapeCmdArg) : args;
-        const child = spawn(cmd, safeArgs, {
+        const config = _buildSpawnConfig(cmd, args, { shell: opts?.shell });
+        const child = spawn(config.command, config.args, {
             cwd: opts?.cwd,
             env: opts?.env ? (opts.replaceEnv ? opts.env : { ...process.env, ...opts.env }) : undefined,
-            shell: useShell,
+            shell: config.shell,
+            windowsVerbatimArguments: config.windowsVerbatimArguments,
             // Unix: creates a new process group via setsid(2) so we can kill the
             // entire group on timeout (prevents orphaned grandchild processes).
             // Windows: skip — detached on Windows creates a visible console window,

package/dist/runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAsBpD;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,YAAY,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;gBAC1D,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,GAAG,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAWD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,OAAO,GAAG,GAAG,CAAC;IAElB,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,iDAAiD;QACjD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,OAAO,GAAG,CAAC;IACxB,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,iCAAiC;IACjC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEtC,wDAAwD;IACxD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,IAAiB;IAChE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,6EAA6E;QAC7E,6EAA6E;QAC7E,wDAAwD;QACxD,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;QAE7D,uEAAuE;QACvE,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE1F,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE;YACjC,GAAG,EAAE,IAAI,EAAE,GAAG;YACd,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3F,KAAK,EAAE,QAAQ;YACf,qEAAqE;YACrE,oEAAoE;YACpE,wEAAwE;YACxE,mDAAmD;YACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACtC,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,8DAA8D;QAC9D,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;QAC/D,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,cAAc,GAAG,KAAK,CAAC;QAE3B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,IAAI,SAAS,GAAG,SAAS,GAAG,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzD,cAAc,GAAG,IAAI,CAAC;gBACtB,gBAAgB,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,cAAc;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,IAAI,SAAS,GAAG,SAAS,GAAG,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzD,cAAc,GAAG,IAAI,CAAC;gBACtB,gBAAgB,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,cAAc;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,yDAAyD;QACzD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,aAAiC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,IAAI,OAAO,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,aAAa,GAAG,SAAS,CAAC;YAC1B,gBAAgB,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;QAC/B,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,wEAAwE;QACxE,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,qEAAqE;QACrE,sEAAsE;QACtE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC/C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YAEf,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CACJ,IAAI,KAAK,CACP,uBAAuB,GAAG,uDAAuD,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,iDAAiD;QACjD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YAEf,IAAI,iBAAqC,CAAC;YAC1C,IAAI,mBAAuC,CAAC;YAC5C,MAAM,cAAc,GAAG,KAEtB,CAAC;YACF,IAAI,OAAO,cAAc,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;gBACvD,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;gBAC7C,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC;gBACtC,mBAAmB,GAAG,KAAK,CAAC,aAAa,CAAC;YAC5C,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAE7F,qEAAqE;YACrE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CACJ,IAAI,KAAK,CACP,YAAY,GAAG,qBAAqB,SAAS,sBAAsB,aAAa,IAAI,MAAM,IAAI,SAAS,IAAI,CAC5G,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,qBAAqB;YACrB,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,CACJ,IAAI,KAAK,CACP,YAAY,GAAG,gCAAgC,SAAS,yBAAyB,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,4DAA4D;YAC5D,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvD,MAAM,CACJ,IAAI,KAAK,CACP,uBAAuB,GAAG,uDAAuD,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,OAAO,CAAC;gBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;gBACnB,MAAM;gBACN,MAAM;gBACN,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,kEAAkE;QAClE,iEAAiE;QACjE,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;YACxB,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,qDAAqD;IACrD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAClE,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE;YAC3C,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAErB,MAAM,KAAK,GAAG,MAAM;aACjB,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,4EAA4E;YAC5E,wEAAwE;YACxE,kEAAkE;YAClE,mEAAmE;YACnE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;QAED,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,uDAAuD;QACvD,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAsBD;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,YAAY,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;gBAC1D,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,GAAG,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAWD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,OAAO,GAAG,GAAG,CAAC;IAElB,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,iDAAiD;QACjD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,OAAO,GAAG,CAAC;IACxB,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,iCAAiC;IACjC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEtC,wDAAwD;IACxD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,EAAE;AACF,gEAAgE;AAChE,mEAAmE;AACnE,sFAAsF;AACtF,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,6DAA6D;AAC7D,SAAS,wBAAwB,CAAC,GAAW;IAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,sDAAsD;IACtD,6DAA6D;IAC7D,mEAAmE;IACnE,yEAAyE;IACzE,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAExD,oFAAoF;IACpF,gCAAgC;IAChC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAEpD,0DAA0D;IAC1D,OAAO,GAAG,IAAI,OAAO,GAAG,CAAC;IACzB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAEhD,OAAO,OAAO,CAAC;AACjB,CAAC;AAcD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,IAAc,EACd,IAA0B,EAC1B,WAAmB,OAAO,CAAC,QAAQ,EACnC,WAAoC,cAAc;IAElD,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IACxF,CAAC;IAED,sCAAsC;IACtC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE/B,6DAA6D;QAC7D,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;QACpF,CAAC;QAED,0EAA0E;QAC1E,oDAAoD;QACpD,oDAAoD;QACpD,iEAAiE;QACjE,0EAA0E;QAC1E,sDAAsD;QACtD,8EAA8E;QAC9E,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG;YACnB,wBAAwB,CAAC,aAAa,CAAC;YACvC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;SAC5C,CAAC;QACF,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACvD,KAAK,EAAE,KAAK;YACZ,wBAAwB,EAAE,IAAI;SAC/B,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,6DAA6D;IAC7D,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,IAAiB;IAChE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;YAC/C,GAAG,EAAE,IAAI,EAAE,GAAG;YACd,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3F,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;YACzD,qEAAqE;YACrE,oEAAoE;YACpE,wEAAwE;YACxE,mDAAmD;YACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACtC,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,8DAA8D;QAC9D,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;QAC/D,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,cAAc,GAAG,KAAK,CAAC;QAE3B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,IAAI,SAAS,GAAG,SAAS,GAAG,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzD,cAAc,GAAG,IAAI,CAAC;gBACtB,gBAAgB,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,cAAc;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,IAAI,SAAS,GAAG,SAAS,GAAG,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzD,cAAc,GAAG,IAAI,CAAC;gBACtB,gBAAgB,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,cAAc;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,yDAAyD;QACzD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,aAAiC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,IAAI,OAAO,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,aAAa,GAAG,SAAS,CAAC;YAC1B,gBAAgB,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;QAC/B,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,wEAAwE;QACxE,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,qEAAqE;QACrE,sEAAsE;QACtE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC/C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YAEf,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CACJ,IAAI,KAAK,CACP,uBAAuB,GAAG,uDAAuD,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,iDAAiD;QACjD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YAEf,IAAI,iBAAqC,CAAC;YAC1C,IAAI,mBAAuC,CAAC;YAC5C,MAAM,cAAc,GAAG,KAEtB,CAAC;YACF,IAAI,OAAO,cAAc,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;gBACvD,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;gBAC7C,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC;gBACtC,mBAAmB,GAAG,KAAK,CAAC,aAAa,CAAC;YAC5C,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAE7F,qEAAqE;YACrE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CACJ,IAAI,KAAK,CACP,YAAY,GAAG,qBAAqB,SAAS,sBAAsB,aAAa,IAAI,MAAM,IAAI,SAAS,IAAI,CAC5G,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,qBAAqB;YACrB,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,CACJ,IAAI,KAAK,CACP,YAAY,GAAG,gCAAgC,SAAS,yBAAyB,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,4DAA4D;YAC5D,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvD,MAAM,CACJ,IAAI,KAAK,CACP,uBAAuB,GAAG,uDAAuD,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,OAAO,CAAC;gBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;gBACnB,MAAM;gBACN,MAAM;gBACN,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,kEAAkE;QAClE,iEAAiE;QACjE,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;YACxB,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAG9E,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,eAAe,KAAK,IAAI,CAAC;CAC3E;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAcnF"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQpE,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAI9E,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,eAAe,KAAK,IAAI,CAAC;CAC3E;AA0BD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CA0BnF"}

package/dist/server.js

@@ -1,7 +1,31 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { ErrorCode, ListResourcesRequestSchema, McpError, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { createLazyToolManager } from "./lazy-tools.js";
 import { isLazyEnabled } from "./tool-filter.js";
+import { strictifyInputSchema } from "./strict-input.js";
+/**
+ * Wraps an McpServer so that every `registerTool` call automatically applies
+ * strict input validation (rejects unknown parameters) to the tool's
+ * inputSchema. This prevents AI agents from silently passing wrong-but-
+ * plausible parameter names (e.g. `branch` instead of `ref`).
+ */
+function applyStrictInputSchemas(server) {
+    const original = server.registerTool.bind(server);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    server.registerTool = function (...args) {
+        // The config-based overload: registerTool(name, config, callback)
+        // config is always the second argument and contains inputSchema
+        if (args.length >= 2 && typeof args[1] === "object" && args[1] !== null) {
+            const config = args[1];
+            if (config.inputSchema) {
+                config.inputSchema = strictifyInputSchema(config.inputSchema);
+            }
+        }
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
+        return original(...args);
+    };
+}
 /**
  * Creates an MCP server with the standard Pare boilerplate:
  * instantiates McpServer, registers tools via callback, connects StdioServerTransport.
@@ -11,9 +35,20 @@ import { isLazyEnabled } from "./tool-filter.js";
 export async function createServer(options) {
     const { name, version, instructions, registerTools } = options;
     const server = new McpServer({ name, version }, { instructions });
+    applyStrictInputSchemas(server);
     const lazy = isLazyEnabled();
     const lazyManager = lazy ? createLazyToolManager(server) : undefined;
     registerTools(server, lazyManager);
+    // Pare servers are tool-only and register no resources. Some MCP clients
+    // (e.g. OpenCode) fire `resources/read` after every structured tool call,
+    // which causes a -32603 InternalError because no resource handler exists.
+    // Register stub handlers so those requests receive a clean -32602 response
+    // ("Resource not found") instead of the confusing generic error.
+    server.server.registerCapabilities({ resources: {} });
+    server.server.setRequestHandler(ListResourcesRequestSchema, () => ({ resources: [] }));
+    server.server.setRequestHandler(ReadResourceRequestSchema, (request) => {
+        throw new McpError(ErrorCode.InvalidParams, `Resource not found: ${request.params.uri}`);
+    });
     const transport = new StdioServerTransport();
     await server.connect(transport);
     return server;

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAwB,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAoBjD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAElE,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAErE,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAEnC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,SAAS,EACT,0BAA0B,EAC1B,QAAQ,EACR,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAwB,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAoBzD;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,MAAiB;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElD,8DAA8D;IAC7D,MAAc,CAAC,YAAY,GAAG,UAAU,GAAG,IAAW;QACrD,kEAAkE;QAClE,gEAAgE;QAChE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,CAAC,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QACD,iEAAiE;QACjE,OAAQ,QAAyC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAClE,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEhC,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAErE,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAEnC,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,CAAC,OAAO,EAAE,EAAE;QACrE,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,uBAAuB,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/strict-input.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Converts a raw Zod shape (used as `inputSchema` in tool registration) into
+ * a strict Zod object schema that rejects unrecognized properties.
+ *
+ * By default the MCP SDK wraps raw shapes with `z.object(shape)` which
+ * silently strips unknown keys. This causes confusing errors when an AI agent
+ * passes a wrong-but-plausible parameter name (e.g. `branch` instead of `ref`).
+ *
+ * Applying `z.strictObject(shape)` instead causes validation to fail with a
+ * clear error message listing the unrecognized key.
+ */
+/**
+ * If `schema` is a raw Zod shape, wraps it in `z.strictObject()` so that
+ * unknown parameters are rejected during validation. If the schema is already
+ * a Zod schema instance, applies `.strict()` if it's an object schema.
+ * Otherwise returns the schema unchanged.
+ */
+export declare function strictifyInputSchema<T>(schema: T): T;
+//# sourceMappingURL=strict-input.d.ts.map

package/dist/strict-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-input.d.ts","sourceRoot":"","sources":["../src/strict-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA2BH;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAiBpD"}

package/dist/strict-input.js

@@ -0,0 +1,59 @@
+/**
+ * Converts a raw Zod shape (used as `inputSchema` in tool registration) into
+ * a strict Zod object schema that rejects unrecognized properties.
+ *
+ * By default the MCP SDK wraps raw shapes with `z.object(shape)` which
+ * silently strips unknown keys. This causes confusing errors when an AI agent
+ * passes a wrong-but-plausible parameter name (e.g. `branch` instead of `ref`).
+ *
+ * Applying `z.strictObject(shape)` instead causes validation to fail with a
+ * clear error message listing the unrecognized key.
+ */
+import { z } from "zod";
+/**
+ * Checks whether a value is a Zod schema instance (has `_zod` for v4).
+ */
+function isZodSchema(value) {
+    return typeof value === "object" && value !== null && ("_zod" in value || "_def" in value);
+}
+/**
+ * Checks whether a value is a "raw shape" — a plain object whose values are
+ * Zod schemas. This is the shorthand form used by all Pare tools:
+ * `{ path: z.string(), maxCount: z.number() }`.
+ */
+function isRawShape(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    // If it's already a Zod schema instance, it's NOT a raw shape
+    if (isZodSchema(value))
+        return false;
+    const entries = Object.values(value);
+    // Empty shape is valid (tools with no parameters)
+    if (entries.length === 0)
+        return true;
+    // A raw shape has values that are Zod schemas
+    return entries.some((v) => isZodSchema(v));
+}
+/**
+ * If `schema` is a raw Zod shape, wraps it in `z.strictObject()` so that
+ * unknown parameters are rejected during validation. If the schema is already
+ * a Zod schema instance, applies `.strict()` if it's an object schema.
+ * Otherwise returns the schema unchanged.
+ */
+export function strictifyInputSchema(schema) {
+    if (!schema)
+        return schema;
+    if (isRawShape(schema)) {
+        // Convert raw shape to strict object schema.
+        // The MCP SDK's normalizeObjectSchema will recognize this as a pre-built
+        // Zod v4 schema and use it directly instead of wrapping in z.object().
+        return z.strictObject(schema);
+    }
+    // If it's already a Zod object schema, apply .strict()
+    const schemaObj = schema;
+    if (isZodSchema(schema) && typeof schemaObj.strict === "function") {
+        return schemaObj.strict();
+    }
+    return schema;
+}
+//# sourceMappingURL=strict-input.js.map

package/dist/strict-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-input.js","sourceRoot":"","sources":["../src/strict-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,8DAA8D;IAC9D,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,kDAAkD;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,8CAA8C;IAC9C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAI,MAAS;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAE3B,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,6CAA6C;QAC7C,yEAAyE;QACzE,uEAAuE;QACvE,OAAO,CAAC,CAAC,YAAY,CAAC,MAAmC,CAAiB,CAAC;IAC7E,CAAC;IAED,uDAAuD;IACvD,MAAM,SAAS,GAAG,MAAiC,CAAC;IACpD,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAClE,OAAQ,SAAS,CAAC,MAAwB,EAAO,CAAC;IACpD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/validation.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Preprocess function for Zod schemas that coerces a JSON string to an array.
+ * Handles the case where MCP clients serialize array parameters as JSON strings
+ * before the tool schema is fully loaded.
+ *
+ * Usage: `z.preprocess(coerceJsonArray, z.array(z.string()))`
+ */
+export declare function coerceJsonArray(val: unknown): unknown;
 /**
  * Validates that a string argument is safe to pass as a positional argument to a CLI tool.
  * Prevents flag injection attacks (e.g., passing "--output=/etc/passwd" as a ref name).

package/dist/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAM5E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAMzE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASzE;AAiCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAwB1D"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAOrD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAM5E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAMzE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASzE;AAiCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAwB1D"}

package/dist/validation.js

@@ -1,3 +1,20 @@
+/**
+ * Preprocess function for Zod schemas that coerces a JSON string to an array.
+ * Handles the case where MCP clients serialize array parameters as JSON strings
+ * before the tool schema is fully loaded.
+ *
+ * Usage: `z.preprocess(coerceJsonArray, z.array(z.string()))`
+ */
+export function coerceJsonArray(val) {
+    if (typeof val !== "string")
+        return val;
+    try {
+        return JSON.parse(val);
+    }
+    catch {
+        return val;
+    }
+}
 /**
  * Validates that a string argument is safe to pass as a positional argument to a CLI tool.
  * Prevents flag injection attacks (e.g., passing "--output=/etc/passwd" as a ref name).

package/dist/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,SAAiB;IACpE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,MAAM,KAAK,kEAAkE,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,MAAM,KAAK,yDAAyD,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,YAAY,KAAK,kEAAkE,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,SAAS;IACT,KAAK;IACL,KAAK;IACL,OAAO;IACP,IAAI;IACJ,QAAQ;IACR,SAAS;IACT,KAAK;IACL,SAAS;IACT,MAAM;IACN,SAAS;IACT,QAAQ;IACR,OAAO;IACP,IAAI;IACJ,OAAO;CACR,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,+EAA+E;IAC/E,MAAM,IAAI,GACR,OAAO;SACJ,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,EAAE;QACN,EAAE,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,+CAA+C;YAChE,YAAY,CAAC,GAAG,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CACV,8CAA8C,OAAO,KAAK;YACxD,sBAAsB,IAAI,yCAAyC;YACnE,8CAA8C,CACjD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,SAAiB;IACpE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,MAAM,KAAK,kEAAkE,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,MAAM,KAAK,yDAAyD,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,YAAY,KAAK,kEAAkE,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,SAAS;IACT,KAAK;IACL,KAAK;IACL,OAAO;IACP,IAAI;IACJ,QAAQ;IACR,SAAS;IACT,KAAK;IACL,SAAS;IACT,MAAM;IACN,SAAS;IACT,QAAQ;IACR,OAAO;IACP,IAAI;IACJ,OAAO;CACR,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,+EAA+E;IAC/E,MAAM,IAAI,GACR,OAAO;SACJ,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,EAAE;QACN,EAAE,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,+CAA+C;YAChE,YAAY,CAAC,GAAG,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CACV,8CAA8C,OAAO,KAAK;YACxD,sBAAsB,IAAI,yCAAyC;YACnE,8CAA8C,CACjD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Reads the `version` field from the nearest `package.json` relative to
+ * the calling module's `import.meta.url`.
+ *
+ * Walks up directory tree from the given module URL until it finds a
+ * `package.json` with a `version` field, or returns `"0.0.0"` as a
+ * fallback.
+ *
+ * @example
+ * ```ts
+ * import { readPackageVersion } from "@paretools/shared";
+ * const version = readPackageVersion(import.meta.url);
+ * ```
+ */
+export declare function readPackageVersion(importMetaUrl: string): string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAwBhE"}

package/dist/version.js

@@ -0,0 +1,42 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * Reads the `version` field from the nearest `package.json` relative to
+ * the calling module's `import.meta.url`.
+ *
+ * Walks up directory tree from the given module URL until it finds a
+ * `package.json` with a `version` field, or returns `"0.0.0"` as a
+ * fallback.
+ *
+ * @example
+ * ```ts
+ * import { readPackageVersion } from "@paretools/shared";
+ * const version = readPackageVersion(import.meta.url);
+ * ```
+ */
+export function readPackageVersion(importMetaUrl) {
+    let dir = dirname(fileURLToPath(importMetaUrl));
+    // Walk up to find the nearest package.json with a version field
+    for (;;) {
+        try {
+            const pkgPath = join(dir, "package.json");
+            const raw = readFileSync(pkgPath, "utf-8");
+            const pkg = JSON.parse(raw);
+            if (pkg.version) {
+                return pkg.version;
+            }
+        }
+        catch {
+            // No package.json in this directory, keep walking up
+        }
+        const parent = dirname(dir);
+        if (parent === dir) {
+            // Reached filesystem root
+            break;
+        }
+        dir = parent;
+    }
+    return "0.0.0";
+}
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,IAAI,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;IAEhD,gEAAgE;IAChE,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;YACpD,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChB,OAAO,GAAG,CAAC,OAAO,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,0BAA0B;YAC1B,MAAM;QACR,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paretools/shared",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Shared utilities for Pare MCP servers",
   "license": "MIT",
   "keywords": [
@@ -40,11 +40,11 @@
     "dist"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.0",
+    "@modelcontextprotocol/sdk": "^1.27.1",
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@types/node": "^25.3.0",
+    "@types/node": "^25.3.3",
     "typescript": "^5.7.0",
     "vitest": "^4.0.18",
     "@paretools/tsconfig": "0.0.0"