@ruifung/codemode-bridge 1.0.3-1 → 1.0.5

package/dist/cli/index.js

@@ -34,7 +34,7 @@ program
     await runServer(options.config, servers, options.debug);
 });
 // Config command group
-const config = program.command("config").description("Manage bridge configuration");
+const config = program.command("config").description("Manage bridge configuration").enablePositionalOptions();
 config
     .command("list")
     .description("List all configured servers")
@@ -51,7 +51,8 @@ config
 });
 config
     .command("add <name> [commandAndArgs...]")
-    .description("Add a new server configuration")
+    .description("Add a new server configuration (use -- before commands with flags, e.g. -- npx -y @some/pkg)")
+    .passThroughOptions()
     .requiredOption("-t, --type <type>", "Server type (stdio or http)")
     .option("--url <url>", "Server URL (required for http servers)")
     .option("--env <env...>", 'Environment variables as KEY=VALUE pairs')

package/dist/executor/executor-test-suite.js

@@ -135,6 +135,38 @@ export function createExecutorTestSuite(name, createExecutor, options) {
           `, { failingTool: mockTool });
                 expect(result.result).toContain('caught');
             });
+            testOrSkip('should handle parallel tool calls with Promise.all', async () => {
+                const mockTool = vi.fn(async (id) => ({ id, name: `Item ${id}` }));
+                const result = await executor.execute(`
+          const results = await Promise.all([
+            codemode.fetchItem(1),
+            codemode.fetchItem(2),
+            codemode.fetchItem(3),
+          ]);
+          return results;
+          `, { fetchItem: mockTool });
+                expect(result.error).toBeUndefined();
+                expect(Array.isArray(result.result)).toBe(true);
+                expect(result.result).toHaveLength(3);
+                expect(mockTool).toHaveBeenCalledTimes(3);
+                expect(result.result[0]).toEqual({ id: 1, name: 'Item 1' });
+                expect(result.result[2]).toEqual({ id: 3, name: 'Item 3' });
+            });
+            testOrSkip('should protect codemode from reassignment', async () => {
+                const mockTool = vi.fn(async () => 'original');
+                const result = await executor.execute(`
+          try {
+            codemode = { hijacked: true };
+          } catch (e) {
+            // Expected — codemode is non-configurable / non-writable
+          }
+          // The real codemode should still work
+          return await codemode.myTool();
+          `, { myTool: mockTool });
+                expect(result.error).toBeUndefined();
+                expect(result.result).toBe('original');
+                expect(mockTool).toHaveBeenCalled();
+            });
         });
         describe('Complex Code Patterns', () => {
             testOrSkip('should handle for loops', async () => {
@@ -193,6 +225,113 @@ export function createExecutorTestSuite(name, createExecutor, options) {
                 expect(result.result).toHaveLength(2);
                 expect(mockFetch).toHaveBeenCalledTimes(2);
             });
+            testOrSkip('should handle Promise.allSettled', async () => {
+                const result = await executor.execute(`
+          const results = await Promise.allSettled([
+            Promise.resolve('ok'),
+            Promise.reject(new Error('fail')),
+            Promise.resolve(42),
+          ]);
+          return results.map(r => ({
+            status: r.status,
+            value: r.status === 'fulfilled' ? r.value : undefined,
+            reason: r.status === 'rejected' ? r.reason.message : undefined,
+          }));
+          `, {});
+                expect(result.error).toBeUndefined();
+                const arr = result.result;
+                expect(arr).toHaveLength(3);
+                expect(arr[0]).toEqual({ status: 'fulfilled', value: 'ok', reason: undefined });
+                expect(arr[1]).toEqual({ status: 'rejected', value: undefined, reason: 'fail' });
+                expect(arr[2]).toEqual({ status: 'fulfilled', value: 42, reason: undefined });
+            });
+            testOrSkip('should handle Promise.withResolvers', async () => {
+                // Promise.withResolvers is ES2024 — available in Node 22+
+                const result = await executor.execute(`
+          if (typeof Promise.withResolvers !== 'function') {
+            return 'unsupported';
+          }
+          const { promise, resolve } = Promise.withResolvers();
+          resolve(99);
+          return await promise;
+          `, {});
+                expect(result.error).toBeUndefined();
+                if (result.result === 'unsupported') {
+                    // Engine doesn't support withResolvers, that's fine
+                    return;
+                }
+                expect(result.result).toBe(99);
+            });
+            testOrSkip('should handle async generators', async () => {
+                const result = await executor.execute(`
+          async function* gen() {
+            yield 1;
+            yield 2;
+            yield 3;
+          }
+          const values = [];
+          for await (const v of gen()) {
+            values.push(v);
+          }
+          return values;
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual([1, 2, 3]);
+            });
+            testOrSkip('should handle closures and currying', async () => {
+                const result = await executor.execute(`
+          function multiply(a) {
+            return function(b) {
+              return a * b;
+            };
+          }
+          const double = multiply(2);
+          const triple = multiply(3);
+          return [double(5), triple(5)];
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual([10, 15]);
+            });
+            testOrSkip('should handle sync generators', async () => {
+                const result = await executor.execute(`
+          function* fibonacci() {
+            let a = 0, b = 1;
+            while (true) {
+              yield a;
+              [a, b] = [b, a + b];
+            }
+          }
+          const fib = fibonacci();
+          const values = [];
+          for (let i = 0; i < 8; i++) {
+            values.push(fib.next().value);
+          }
+          return values;
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual([0, 1, 1, 2, 3, 5, 8, 13]);
+            });
+            testOrSkip('should handle error cause chaining', async () => {
+                const result = await executor.execute(`
+          try {
+            try {
+              throw new Error('root cause');
+            } catch (e) {
+              throw new Error('wrapper', { cause: e });
+            }
+          } catch (e) {
+            return {
+              message: e.message,
+              causeMessage: e.cause?.message,
+            };
+          }
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual({
+                    message: 'wrapper',
+                    causeMessage: 'root cause',
+                });
+            });
         });
         describe('Isolation & Safety', () => {
             testOrSkip('should not allow access to require', async () => {
@@ -312,26 +451,105 @@ export function createExecutorTestSuite(name, createExecutor, options) {
                     expect(result.result).not.toBe('network allowed via dns');
                 }
             });
-            testOrSkip('should isolate prototype pollution to the current execution', async () => {
-                // NOTE: Prototype pollution IS possible within a single execution,
-                // but it is NOT a security risk because:
-                // 1. Each execution gets a fresh sandbox with clean prototypes
-                // 2. Pollution only affects that specific execution's globals
-                // 3. Host code is protected by serialization boundaries (JSON.stringify)
-                // 4. Next execution runs in a completely new sandbox
-                // Test 1: Pollution works within execution (expected)
-                const result1 = await executor.execute(`
-          Object.assign(Object.prototype, { polluted: true });
+            testOrSkip('should block prototype pollution', async () => {
+                // Prototypes are frozen — Object.assign(Object.prototype, ...) must
+                // either throw or silently fail, and the pollution must not take effect.
+                const result = await executor.execute(`
+          try {
+            Object.assign(Object.prototype, { polluted: true });
+          } catch (e) {
+            // Throws in strict mode — expected
+          }
           const obj = {};
           return obj.polluted;
           `, {});
-                expect(result1.result).toBe(true); // Pollution works within this execution
-                // Test 2: Next execution has clean prototypes (this proves isolation)
-                const result2 = await executor.execute(`
+                // Pollution must not have taken effect
+                expect(result.result).toBeUndefined();
+                expect(result.error).toBeUndefined();
+            });
+            testOrSkip('should freeze Array.prototype', async () => {
+                const result = await executor.execute(`
+          try {
+            Array.prototype.myCustomMethod = () => 'injected';
+          } catch (e) {
+            return 'blocked';
+          }
+          return typeof [].myCustomMethod === 'function' ? 'polluted' : 'blocked';
+          `, {});
+                expect(result.result).toBe('blocked');
+                expect(result.error).toBeUndefined();
+            });
+            testOrSkip('should freeze Function.prototype', async () => {
+                const result = await executor.execute(`
+          try {
+            Function.prototype.myCustomMethod = () => 'injected';
+          } catch (e) {
+            return 'blocked';
+          }
+          return typeof (function(){}).myCustomMethod === 'function' ? 'polluted' : 'blocked';
+          `, {});
+                expect(result.result).toBe('blocked');
+                expect(result.error).toBeUndefined();
+            });
+            testOrSkip('should prevent adding new globals when globalThis is sealed', async () => {
+                const result = await executor.execute(`
+          try {
+            globalThis.sneakyGlobal = 42;
+          } catch (e) {
+            return 'blocked';
+          }
+          return typeof globalThis.sneakyGlobal !== 'undefined' ? 'leaked' : 'blocked';
+          `, {});
+                expect(result.result).toBe('blocked');
+                expect(result.error).toBeUndefined();
+            });
+            testOrSkip('should prevent overwriting codemode namespace', async () => {
+                const result = await executor.execute(`
+          try {
+            codemode = { hijacked: true };
+          } catch (e) {
+            return 'blocked';
+          }
+          return typeof codemode.hijacked !== 'undefined' ? 'overwritten' : 'blocked';
+          `, {});
+                expect(result.result).toBe('blocked');
+                expect(result.error).toBeUndefined();
+            });
+            testOrSkip('should hide internal state from enumeration', async () => {
+                // Internal sandbox mechanisms should not be enumerable on globalThis
+                const result = await executor.execute(`
+          const keys = Object.keys(globalThis);
+          // Should not expose internal mechanisms like __resolveResult, __callTool, etc.
+          const internalKeys = keys.filter(k => k.startsWith('__'));
+          return internalKeys;
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual([]);
+            });
+            testOrSkip('should block dynamic import', async () => {
+                const result = await executor.execute(`
+          try {
+            const m = await import('fs');
+            return 'import allowed';
+          } catch (e) {
+            return 'blocked';
+          }
+          `, {});
+                expect(result.result).toBe('blocked');
+                expect(result.error).toBeUndefined();
+            });
+            testOrSkip('should not persist prototype pollution across executions', async () => {
+                // First execution: attempt to pollute
+                await executor.execute(`
+          try { Object.prototype.crossExecPollution = 'leaked'; } catch(e) {}
+          `, {});
+                // Second execution: check if pollution persists
+                const result = await executor.execute(`
           const obj = {};
-          return obj.polluted;
+          return typeof obj.crossExecPollution;
           `, {});
-                expect(result2.result).toBeUndefined(); // Fresh sandbox, no pollution
+                expect(result.result).toBe('undefined');
+                expect(result.error).toBeUndefined();
             });
         });
         describe('Concurrency', () => {
@@ -372,6 +590,272 @@ export function createExecutorTestSuite(name, createExecutor, options) {
                 expect(elapsed).toBeLessThan(500);
             });
         });
+        describe('Data Structures & Serialization', () => {
+            testOrSkip('should handle regex named groups', async () => {
+                const result = await executor.execute(`
+          const re = /(?<year>\\d{4})-(?<month>\\d{2})-(?<day>\\d{2})/;
+          const match = re.exec('2026-02-25');
+          return {
+            year: match.groups.year,
+            month: match.groups.month,
+            day: match.groups.day,
+          };
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual({ year: '2026', month: '02', day: '25' });
+            });
+            testOrSkip('should handle modern array methods', async () => {
+                const result = await executor.execute(`
+          const arr = [1, [2, [3, [4]]]];
+          const flat = arr.flat(Infinity);
+          const atResult = flat.at(-1);
+          const findLastResult = flat.findLast(x => x % 2 === 0);
+          return { flat, atResult, findLastResult };
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual({
+                    flat: [1, 2, 3, 4],
+                    atResult: 4,
+                    findLastResult: 4,
+                });
+            });
+            testOrSkip('should handle Object.groupBy', async () => {
+                const result = await executor.execute(`
+          if (typeof Object.groupBy !== 'function') {
+            return 'unsupported';
+          }
+          const items = [
+            { type: 'fruit', name: 'apple' },
+            { type: 'veg', name: 'carrot' },
+            { type: 'fruit', name: 'banana' },
+          ];
+          const grouped = Object.groupBy(items, item => item.type);
+          return {
+            fruitCount: grouped.fruit.length,
+            vegCount: grouped.veg.length,
+          };
+          `, {});
+                expect(result.error).toBeUndefined();
+                if (result.result === 'unsupported')
+                    return;
+                expect(result.result).toEqual({ fruitCount: 2, vegCount: 1 });
+            });
+            testOrSkip('should handle Map and Set', async () => {
+                const result = await executor.execute(`
+          const map = new Map();
+          map.set('a', 1);
+          map.set('b', 2);
+          map.set('c', 3);
+          const set = new Set([1, 2, 2, 3, 3, 3]);
+          return {
+            mapSize: map.size,
+            mapEntries: Array.from(map.entries()),
+            setSize: set.size,
+            setValues: Array.from(set.values()),
+          };
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual({
+                    mapSize: 3,
+                    mapEntries: [['a', 1], ['b', 2], ['c', 3]],
+                    setSize: 3,
+                    setValues: [1, 2, 3],
+                });
+            });
+            testOrSkip('should handle JSON replacer and reviver', async () => {
+                const result = await executor.execute(`
+          const data = { name: 'test', secret: 'hidden', count: 5 };
+          const filtered = JSON.stringify(data, (key, val) =>
+            key === 'secret' ? undefined : val
+          );
+          const parsed = JSON.parse('{"value":"42"}', (key, val) =>
+            key === 'value' ? Number(val) : val
+          );
+          return { filtered: JSON.parse(filtered), parsed };
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual({
+                    filtered: { name: 'test', count: 5 },
+                    parsed: { value: 42 },
+                });
+            });
+            testOrSkip('should handle JSON serialization edge cases', async () => {
+                const result = await executor.execute(`
+          return {
+            nan: Number.isNaN(NaN),
+            inf: !Number.isFinite(Infinity),
+            negZero: Object.is(-0, -0),
+            nullVal: null,
+            emptyStr: '',
+            emptyArr: [],
+            emptyObj: {},
+            nested: { a: { b: { c: 1 } } },
+          };
+          `, {});
+                expect(result.error).toBeUndefined();
+                const r = result.result;
+                expect(r.nan).toBe(true);
+                expect(r.inf).toBe(true);
+                expect(r.negZero).toBe(true);
+                expect(r.nullVal).toBeNull();
+                expect(r.emptyStr).toBe('');
+                expect(r.emptyArr).toEqual([]);
+                expect(r.emptyObj).toEqual({});
+                expect(r.nested).toEqual({ a: { b: { c: 1 } } });
+            });
+            testOrSkip('should handle Date operations', async () => {
+                const result = await executor.execute(`
+          const d = new Date('2026-02-25T12:00:00Z');
+          return {
+            iso: d.toISOString(),
+            year: d.getUTCFullYear(),
+            month: d.getUTCMonth() + 1,
+            day: d.getUTCDate(),
+          };
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual({
+                    iso: '2026-02-25T12:00:00.000Z',
+                    year: 2026,
+                    month: 2,
+                    day: 25,
+                });
+            });
+            testOrSkip('should handle BigInt arithmetic', async () => {
+                const result = await executor.execute(`
+          const a = BigInt('9007199254740993');
+          const b = BigInt('9007199254740993');
+          const sum = a + b;
+          return {
+            sumStr: sum.toString(),
+            isLarger: sum > BigInt(Number.MAX_SAFE_INTEGER),
+          };
+          `, {});
+                expect(result.error).toBeUndefined();
+                const r = result.result;
+                expect(r.sumStr).toBe('18014398509481986');
+                expect(r.isLarger).toBe(true);
+            });
+        });
+        describe('Stress & Edge Cases', () => {
+            testOrSkip('should handle deep nesting', async () => {
+                const result = await executor.execute(`
+          let obj = { value: 'deep' };
+          for (let i = 0; i < 50; i++) {
+            obj = { nested: obj };
+          }
+          let current = obj;
+          for (let i = 0; i < 50; i++) {
+            current = current.nested;
+          }
+          return current.value;
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toBe('deep');
+            });
+            testOrSkip('should handle memoization patterns', async () => {
+                const result = await executor.execute(`
+          function memoize(fn) {
+            const cache = new Map();
+            return function(...args) {
+              const key = JSON.stringify(args);
+              if (cache.has(key)) return cache.get(key);
+              const result = fn(...args);
+              cache.set(key, result);
+              return result;
+            };
+          }
+          let callCount = 0;
+          const expensiveFn = memoize((n) => {
+            callCount++;
+            return n * n;
+          });
+          const results = [expensiveFn(5), expensiveFn(5), expensiveFn(3), expensiveFn(3)];
+          return { results, callCount };
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual({
+                    results: [25, 25, 9, 9],
+                    callCount: 2, // Only 2 unique calls
+                });
+            });
+            testOrSkip('should survive deep recursion', async () => {
+                const result = await executor.execute(`
+          function sumTo(n) {
+            if (n <= 0) return 0;
+            return n + sumTo(n - 1);
+          }
+          return sumTo(1000);
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toBe(500500);
+            });
+            testOrSkip('should handle large array operations', async () => {
+                const result = await executor.execute(`
+          const size = 10000;
+          const arr = Array.from({ length: size }, (_, i) => i + 1);
+          const sum = arr.reduce((a, b) => a + b, 0);
+          const filtered = arr.filter(x => x % 2 === 0);
+          return { sum, evenCount: filtered.length, last: arr.at(-1) };
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual({
+                    sum: 50005000,
+                    evenCount: 5000,
+                    last: 10000,
+                });
+            });
+            testOrSkip('should handle Proxy and Reflect', async () => {
+                const result = await executor.execute(`
+          const handler = {
+            get(target, prop) {
+              if (prop in target) return target[prop];
+              return 'default';
+            },
+            set(target, prop, value) {
+              target[prop] = typeof value === 'string' ? value.toUpperCase() : value;
+              return true;
+            },
+          };
+          const obj = new Proxy({}, handler);
+          obj.name = 'hello';
+          return {
+            name: obj.name,
+            missing: obj.nonexistent,
+          };
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual({
+                    name: 'HELLO',
+                    missing: 'default',
+                });
+            });
+            testOrSkip('should handle Symbol.iterator', async () => {
+                const result = await executor.execute(`
+          class Range {
+            constructor(start, end) {
+              this.start = start;
+              this.end = end;
+            }
+            [Symbol.iterator]() {
+              let current = this.start;
+              const end = this.end;
+              return {
+                next() {
+                  if (current <= end) {
+                    return { value: current++, done: false };
+                  }
+                  return { done: true };
+                },
+              };
+            }
+          }
+          return [...new Range(1, 5)];
+          `, {});
+                expect(result.error).toBeUndefined();
+                expect(result.result).toEqual([1, 2, 3, 4, 5]);
+            });
+        });
     });
 }
 // Run the test suite against both executors if available

package/dist/executor/isolated-vm-executor.js

@@ -205,21 +205,29 @@ export class IsolatedVmExecutor {
             }
             await context.global.set('codemode', new ivm.ExternalCopy(codemodeSandbox).copyInto({ transferIn: true }));
             // Set up the tool wrapper in isolate - uses notification pattern
+            // Refactored: mutate codemode in-place instead of reassigning, so it can be
+            // made non-configurable/non-writable on globalThis.
             await context.eval(`
-        globalThis._pendingResolvers = {};
-        globalThis._toolResults = {};
-        globalThis._toolErrors = {};
-        
-        const _codemodeMethods = {};
-        for (const toolName of Object.keys(codemode)) {
-          _codemodeMethods[toolName] = (...args) => {
+        // Internal state — non-enumerable to hide from user code
+        Object.defineProperty(globalThis, '_pendingResolvers', { value: {}, writable: true, enumerable: false, configurable: true });
+        Object.defineProperty(globalThis, '_toolResults',      { value: {}, writable: true, enumerable: false, configurable: true });
+        Object.defineProperty(globalThis, '_toolErrors',       { value: {}, writable: true, enumerable: false, configurable: true });
+        Object.defineProperty(globalThis, '_hostExecuteTool',  {
+          value: globalThis._hostExecuteTool,
+          writable: false, enumerable: false, configurable: false
+        });
+
+        // Replace codemode entries in-place with async tool wrappers
+        const _toolNames = Object.keys(codemode);
+        for (const key of Object.keys(codemode)) { delete codemode[key]; }
+        for (const toolName of _toolNames) {
+          codemode[toolName] = (...args) => {
             return new Promise((resolve, reject) => {
               const callId = _hostExecuteTool(toolName, args);
               globalThis._pendingResolvers[callId] = { resolve, reject };
             });
           };
         }
-        codemode = _codemodeMethods;
       `);
             // Use Promise-based execution with async function
             const resultPromise = new Promise(async (resolve) => {
@@ -244,6 +252,45 @@ export class IsolatedVmExecutor {
                         resolve: resolveCallback,
                         reject: rejectCallback,
                     }).copyInto({ transferIn: true }));
+                    // Sandbox hardening — runs after ALL setup (including protocol), before user code
+                    await context.eval(`
+            // 1. Freeze prototypes to prevent prototype pollution
+            Object.freeze(Object.prototype);
+            Object.freeze(Array.prototype);
+            Object.freeze(Function.prototype);
+
+            // 2. Block eval and Function constructor
+            Object.defineProperty(globalThis, 'eval', {
+              value: function() { throw new Error("eval is not allowed"); },
+              writable: false, enumerable: false, configurable: false
+            });
+            (function() {
+              var OrigFunction = Function;
+              function BlockedFunction() { throw new Error("Function constructor is not allowed"); }
+              BlockedFunction.prototype = OrigFunction.prototype;
+              globalThis.Function = BlockedFunction;
+            })();
+
+            // 3. Make codemode non-configurable & non-writable
+            Object.defineProperty(globalThis, 'codemode', {
+              value: globalThis.codemode,
+              writable: false,
+              configurable: false,
+              enumerable: true,
+            });
+
+            // 4. Make protocol & internal state non-enumerable
+            Object.defineProperty(globalThis, 'protocol', {
+              value: globalThis.protocol,
+              writable: false,
+              enumerable: false,
+              configurable: false,
+            });
+            // _hostExecuteTool already non-configurable from tool setup
+
+            // 5. Seal globalThis to prevent adding/removing properties
+            Object.seal(globalThis);
+          `);
                     // Wrap code so it returns a Promise we can .then()
                     const wrappedCode = wrapCode(code, { alwaysAsync: true });
                     // Execute the async function and chain its Promise with .then()

package/dist/executor/vm2-executor.js

@@ -52,6 +52,29 @@ export class VM2Executor {
                     },
                 },
             });
+            // Sandbox hardening — runs before user code
+            vm.run(`
+        // 1. Freeze prototypes to prevent prototype pollution
+        Object.freeze(Object.prototype);
+        Object.freeze(Array.prototype);
+        Object.freeze(Function.prototype);
+
+        // 2. Block Function constructor (equivalent to eval)
+        (function() {
+          var OrigFunction = Function;
+          function BlockedFunction() { throw new Error("Function constructor is not allowed"); }
+          BlockedFunction.prototype = OrigFunction.prototype;
+          globalThis.Function = BlockedFunction;
+        })();
+
+        // 3. Make codemode non-configurable & non-writable
+        Object.defineProperty(globalThis, 'codemode', {
+          value: globalThis.codemode,
+          writable: false,
+          configurable: false,
+          enumerable: true,
+        });
+      `, "codemode-hardening.js");
             // vm.run() returns a Promise if the code returns a Promise
             const rawResult = vm.run(wrappedCode, "codemode-execution.js");
             // Await the result if it's a promise

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ruifung/codemode-bridge",
-  "version": "1.0.3-1",
+  "version": "1.0.5",
   "description": "MCP bridge that connects to upstream MCP servers and exposes tools via a single codemode tool for orchestration",
   "main": "dist/index.js",
   "bin": {
@@ -35,22 +35,23 @@
   "dependencies": {
     "@cloudflare/codemode": "^0.1.0",
     "@modelcontextprotocol/sdk": "^1.27.0",
-    "@types/node": "^25.3.0",
     "acorn": "^8.16.0",
     "chalk": "^5.6.2",
     "commander": "^12.1.0",
-    "isolated-vm": "^6.0.2",
     "open": "^10.1.0",
-    "ts-node": "^10.9.2",
-    "typescript": "^5.9.3",
     "uuid": "^13.0.0",
     "vm2": "^3.10.5",
     "winston": "^3.19.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "@types/node": "^25.3.0",
     "@vitest/ui": "^4.0.18",
     "tsx": "^4.21.0",
+    "typescript": "^5.9.3",
     "vitest": "^4.0.18"
+  },
+  "optionalDependencies": {
+    "isolated-vm": "^6.0.2"
   }
 }