@ruifung/codemode-bridge 1.0.7 → 1.0.9

package/dist/cli/commands.js

@@ -4,12 +4,13 @@
  * Implements subcommands for managing and running the bridge
  */
 import chalk from "chalk";
-import * as fs from "fs";
-import * as path from "path";
+import * as fs from "node:fs";
+import * as path from "node:path";
 import { loadConfig, saveConfig, addServer, removeServer, updateServer, getServer, listServers, validateServer, getConfigFilePath, } from "./config-manager.js";
 import { startCodeModeBridgeServer } from "../mcp/server.js";
 import { getServerConfig } from "../mcp/config.js";
 import { initializeLogger, logInfo, logError, flushStderrBuffer } from "../utils/logger.js";
+import { getRuntimeName } from "../utils/env.js";
 import { tokenPersistence } from "../mcp/token-persistence.js";
 import { MCPClient } from "../mcp/mcp-client.js";
 /**
@@ -21,6 +22,7 @@ export async function runServer(configPath, servers, debug, executor) {
         initializeLogger(debug);
         console.error(chalk.cyan("\n🚀 Code Mode Bridge"));
         console.error(chalk.cyan("====================\n"));
+        logInfo(`Runtime: ${getRuntimeName()}`, { component: 'CLI' });
         // Load the bridge configuration
         const bridgeConfig = loadConfig(configPath);
         logInfo(`Loaded config from: ${getConfigFilePath(configPath)}`, { component: 'CLI' });

package/dist/cli/config-manager.js

@@ -4,8 +4,8 @@
  * Manages the bridge configuration stored in .config/codemode-bridge/mcp.json
  * Provides utilities to load, save, and manipulate the configuration
  */
-import * as fs from "fs";
-import * as path from "path";
+import * as fs from "node:fs";
+import * as path from "node:path";
 /**
  * Get the default config directory for the current platform
  */

package/dist/cli/index.js

@@ -19,14 +19,27 @@
 import { Command } from "commander";
 import { runServer, listServersCommand, showServerCommand, addServerCommand, removeServerCommand, editServerCommand, configInfoCommand, authLoginCommand, authLogoutCommand, authListCommand, } from "./commands.js";
 import { getConfigFilePath } from "./config-manager.js";
-import * as fs from "fs";
+import { getExecutorStatus } from "../mcp/executor-status.js";
+import * as fs from "node:fs";
 const pkg = JSON.parse(fs.readFileSync(new URL("../../package.json", import.meta.url), "utf-8"));
 const defaultConfigPath = getConfigFilePath();
 const program = new Command();
+// Add logic to get available executors for version output
+let versionString = pkg.version;
+if (process.argv.includes("-V") || process.argv.includes("--version")) {
+    const statuses = await getExecutorStatus();
+    const available = statuses
+        .filter((s) => s.isAvailable)
+        .map((s) => s.type)
+        .join(", ");
+    if (available) {
+        versionString = `${pkg.version} (executors: ${available})`;
+    }
+}
 program
     .name("codemode-bridge")
     .description("Code Mode Bridge CLI - Connects to multiple MCP servers and exposes them as a single tool")
-    .version(pkg.version);
+    .version(versionString);
 // Main 'run' command
 program
     .command("run", { isDefault: true })
@@ -34,7 +47,7 @@ program
     .option("-c, --config <path>", `Path to mcp.json configuration file (default: ${defaultConfigPath})`)
     .option("-s, --servers <names>", "Comma-separated list of servers to connect to")
     .option("-d, --debug", "Enable debug logging")
-    .option("-e, --executor <type>", "Executor type (isolated-vm, container, vm2)")
+    .option("-e, --executor <type>", "Executor type (isolated-vm, container, deno, vm2)")
     .action(async (options) => {
     const servers = options.servers ? options.servers.split(",").map((s) => s.trim()) : undefined;
     await runServer(options.config, servers, options.debug, options.executor);

package/dist/executor/container-executor.d.ts

@@ -18,8 +18,12 @@ import type { Executor, ExecuteResult } from '@cloudflare/codemode';
 export interface ContainerExecutorOptions {
     /** Execution timeout per call in ms (default 30000) */
     timeout?: number;
-    /** Container image (default 'node:22-slim') */
+    /** Container image (default 'node:24-slim') */
     image?: string;
+    /** Container user (default based on image) */
+    user?: string;
+    /** Container command to run the runner (default based on image) */
+    command?: string[];
     /** Container runtime command — 'docker' | 'podman' | auto-detect */
     runtime?: string;
     /** Memory limit (default '256m') */
@@ -30,6 +34,8 @@ export interface ContainerExecutorOptions {
 export declare class ContainerExecutor implements Executor {
     private runtime;
     private image;
+    private containerUser;
+    private containerCommand;
     private timeout;
     private memoryLimit;
     private cpuLimit;

package/dist/executor/container-executor.js

@@ -20,6 +20,7 @@ import { createInterface } from 'node:readline';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import { wrapCode } from './wrap-code.js';
+import { isBun, isDeno } from '../utils/env.js';
 // ── Runtime detection ───────────────────────────────────────────────
 function detectRuntime(requested) {
     if (requested)
@@ -56,23 +57,52 @@ function getScriptPaths() {
 }
 // ── ContainerExecutor ───────────────────────────────────────────────
 export class ContainerExecutor {
+    runtime;
+    image;
+    containerUser;
+    containerCommand;
+    timeout;
+    memoryLimit;
+    cpuLimit;
+    containerId = null;
+    process = null;
+    readline = null;
+    ready = false;
+    /** Resolved when the container sends { type: 'ready' } */
+    readyResolve = null;
+    /** Pending execution — only one at a time */
+    pendingExecution = null;
+    initPromise = null;
     constructor(options = {}) {
-        this.containerId = null;
-        this.process = null;
-        this.readline = null;
-        this.ready = false;
-        /** Resolved when the container sends { type: 'ready' } */
-        this.readyResolve = null;
-        /** Pending execution — only one at a time */
-        this.pendingExecution = null;
-        this.initPromise = null;
         this.timeout = options.timeout ?? 30000;
-        this.image = options.image ?? 'node:24-slim';
-        this.memoryLimit = options.memoryLimit ?? '256m';
+        this.memoryLimit = options.memoryLimit ?? '512M';
         this.cpuLimit = options.cpuLimit ?? 1.0;
         this.runtime = detectRuntime(options.runtime);
+        // Platform-specific defaults
+        if (options.image) {
+            this.image = options.image;
+            this.containerUser = options.user ?? '1000';
+            this.containerCommand = options.command ?? ['node'];
+        }
+        else if (isBun()) {
+            this.image = 'oven/bun:debian';
+            this.containerUser = options.user ?? '1000'; // bun user is 1000
+            this.containerCommand = ['bun', 'run'];
+        }
+        else if (isDeno()) {
+            this.image = 'denoland/deno:debian';
+            this.containerUser = options.user ?? '1000'; // deno:debian has no 'deno' user by default
+            this.containerCommand = ['deno', 'run', '-A'];
+        }
+        else {
+            this.image = 'node:24-slim';
+            this.containerUser = options.user ?? '1000'; // node user is 1000
+            this.containerCommand = ['node'];
+        }
         // Start initialization immediately to create the container before the first execution.
-        // Errors are caught and logged, but will also be thrown when execute() awaits this.init().
+        if (process.env.DEBUG || process.env.NODE_ENV === 'test') {
+            console.log(`[ContainerExecutor] Using image: ${this.image}, user: ${this.containerUser}, command: ${this.containerCommand.join(' ')}`);
+        }
         this.init().catch(err => {
             process.stderr.write(`[container-executor] Immediate initialization failed: ${err.message}\n`);
         });
@@ -145,15 +175,15 @@ export class ContainerExecutor {
             '--read-only', // immutable rootfs
             '--tmpfs', '/tmp:rw,noexec,nosuid,size=64m', // writable /tmp
             '--cap-drop=ALL', // drop all capabilities
-            '--user', 'node', // run as non-root user
+            '--user', this.containerUser,
             '--memory', this.memoryLimit,
             `--cpus=${this.cpuLimit}`,
-            '--pids-limit=64', // limit process spawning
+            '--pids-limit=128', // limit process spawning
             '-v', `${scripts.runner}:/app/container-runner.mjs:ro`, // mount runner script
             '-v', `${scripts.worker}:/app/container-worker.mjs:ro`, // mount worker script
             '-w', '/app',
             this.image,
-            'node', '/app/container-runner.mjs',
+            ...this.containerCommand, '/app/container-runner.mjs',
         ];
         this.process = spawn(this.runtime, args, {
             stdio: ['pipe', 'pipe', 'pipe'],

package/dist/executor/deno-executor.d.ts

@@ -0,0 +1,26 @@
+import type { Executor, ExecuteResult } from '@cloudflare/codemode';
+export interface DenoExecutorOptions {
+    /** Execution timeout per call in ms (default 30000) */
+    timeout?: number;
+    /** Deno executable path — 'deno' | auto-detect */
+    denoPath?: string;
+}
+export declare class DenoExecutor implements Executor {
+    private denoPath;
+    private timeout;
+    private process;
+    private readline;
+    private ready;
+    private readyResolve;
+    private pendingExecution;
+    private initPromise;
+    constructor(options?: DenoExecutorOptions);
+    private init;
+    private _init;
+    private handleMessage;
+    private handleToolCall;
+    private send;
+    execute(code: string, fns: Record<string, (...args: unknown[]) => Promise<unknown>>): Promise<ExecuteResult>;
+    dispose(): void;
+}
+export declare function createDenoExecutor(options?: DenoExecutorOptions): DenoExecutor;

package/dist/executor/deno-executor.js

@@ -0,0 +1,253 @@
+import { spawn, execSync } from 'node:child_process';
+import { createInterface } from 'node:readline';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { wrapCode } from './wrap-code.js';
+// ── Runtime detection ───────────────────────────────────────────────
+function detectDeno(requested) {
+    if (requested)
+        return requested;
+    // If we are already running on Deno, use the current executable path
+    if (typeof globalThis.Deno?.execPath === 'function') {
+        return globalThis.Deno.execPath();
+    }
+    // Try 'deno' command in PATH
+    try {
+        execSync('deno --version', { stdio: 'ignore' });
+        return 'deno';
+    }
+    catch {
+        // not available
+    }
+    throw new Error('Deno executable not found. Install Deno or set DENO_PATH environment variable.');
+}
+// ── Resolve runner script path ──────────────────────────────────────
+function getScriptPaths() {
+    let dir;
+    try {
+        dir = dirname(fileURLToPath(import.meta.url));
+    }
+    catch {
+        dir = __dirname;
+    }
+    return {
+        runner: join(dir, 'container-runner.mjs'),
+        worker: join(dir, 'container-worker.mjs'),
+    };
+}
+// ── DenoExecutor ────────────────────────────────────────────────────
+export class DenoExecutor {
+    denoPath;
+    timeout;
+    process = null;
+    readline = null;
+    ready = false;
+    readyResolve = null;
+    pendingExecution = null;
+    initPromise = null;
+    constructor(options = {}) {
+        this.timeout = options.timeout ?? 30000;
+        this.denoPath = detectDeno(options.denoPath);
+        this.init().catch(err => {
+            process.stderr.write(`[deno-executor] Immediate initialization failed: ${err.message}\n`);
+        });
+    }
+    async init() {
+        if (this.ready)
+            return;
+        if (this.initPromise)
+            return this.initPromise;
+        this.initPromise = this._init();
+        return this.initPromise;
+    }
+    async _init() {
+        const scripts = getScriptPaths();
+        // Start a long-lived Deno process with restricted permissions
+        const args = [
+            'run',
+            '--no-prompt',
+            '--no-config',
+            '--no-npm',
+            '--no-remote',
+            '--allow-read=' + scripts.runner + ',' + scripts.worker,
+            '--deny-net',
+            '--deny-write',
+            '--deny-run',
+            '--deny-env',
+            '--deny-sys',
+            '--deny-ffi',
+        ];
+        args.push(scripts.runner);
+        this.process = spawn(this.denoPath, args, {
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        this.process.stderr?.on('data', (data) => {
+            process.stderr.write(`[deno] ${data.toString()}`);
+        });
+        this.process.on('exit', (code) => {
+            this.ready = false;
+            if (this.pendingExecution) {
+                clearTimeout(this.pendingExecution.timeoutHandle);
+                this.pendingExecution.reject(new Error(`Deno process exited unexpectedly with code ${code}`));
+                this.pendingExecution = null;
+            }
+        });
+        this.readline = createInterface({
+            input: this.process.stdout,
+            terminal: false,
+        });
+        this.readline.on('line', (line) => this.handleMessage(line));
+        await new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => {
+                reject(new Error('Deno process failed to become ready within 10s'));
+            }, 10000);
+            this.readyResolve = () => {
+                clearTimeout(timeout);
+                this.ready = true;
+                this.readyResolve = null;
+                resolve();
+            };
+            this.process.on('error', (err) => {
+                clearTimeout(timeout);
+                this.readyResolve = null;
+                reject(new Error(`Failed to start Deno: ${err.message}`));
+            });
+        });
+    }
+    handleMessage(line) {
+        if (!line.trim())
+            return;
+        let msg;
+        try {
+            msg = JSON.parse(line);
+        }
+        catch {
+            process.stderr.write(`[deno-executor] bad JSON from deno: ${line}\n`);
+            return;
+        }
+        switch (msg.type) {
+            case 'tool-call':
+                this.handleToolCall(msg);
+                break;
+            case 'result':
+                if (this.pendingExecution && this.pendingExecution.id === msg.id) {
+                    clearTimeout(this.pendingExecution.timeoutHandle);
+                    this.pendingExecution.resolve({
+                        result: msg.result,
+                        logs: msg.logs,
+                    });
+                    this.pendingExecution = null;
+                }
+                break;
+            case 'error':
+                if (this.pendingExecution && this.pendingExecution.id === msg.id) {
+                    clearTimeout(this.pendingExecution.timeoutHandle);
+                    this.pendingExecution.resolve({
+                        result: undefined,
+                        error: msg.error,
+                        logs: msg.logs,
+                    });
+                    this.pendingExecution = null;
+                }
+                break;
+            case 'ready':
+                if (this.readyResolve) {
+                    this.readyResolve();
+                }
+                break;
+        }
+    }
+    async handleToolCall(msg) {
+        if (!this.pendingExecution) {
+            this.send({ type: 'tool-error', id: msg.id, error: 'No active execution context' });
+            return;
+        }
+        const fns = this.pendingExecution.fns;
+        const fn = fns[msg.name];
+        if (!fn) {
+            this.send({
+                type: 'tool-error',
+                id: msg.id,
+                error: `Tool '${msg.name}' not found. Available tools: ${Object.keys(fns).join(', ')}`,
+            });
+            return;
+        }
+        try {
+            const args = msg.args;
+            const result = await fn(...(Array.isArray(args) ? args : [args]));
+            this.send({ type: 'tool-result', id: msg.id, result });
+        }
+        catch (err) {
+            this.send({
+                type: 'tool-error',
+                id: msg.id,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    send(msg) {
+        if (!this.process?.stdin?.writable) {
+            throw new Error('Deno stdin is not writable');
+        }
+        this.process.stdin.write(JSON.stringify(msg) + '\n');
+    }
+    async execute(code, fns) {
+        await this.init();
+        if (this.pendingExecution) {
+            return {
+                result: undefined,
+                error: 'Another execution is already in progress',
+            };
+        }
+        const id = `exec-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        const wrappedCode = wrapCode(code);
+        return new Promise((resolve, reject) => {
+            const timeoutHandle = setTimeout(() => {
+                if (this.pendingExecution?.id === id) {
+                    this.pendingExecution = null;
+                    resolve({
+                        result: undefined,
+                        error: `Code execution timeout after ${this.timeout}ms`,
+                    });
+                }
+            }, this.timeout);
+            this.pendingExecution = { id, resolve, reject, fns, timeoutHandle };
+            this.send({ type: 'execute', id, code: wrappedCode });
+        });
+    }
+    dispose() {
+        if (this.pendingExecution) {
+            clearTimeout(this.pendingExecution.timeoutHandle);
+            this.pendingExecution.reject(new Error('Executor disposed'));
+            this.pendingExecution = null;
+        }
+        if (this.process?.stdin?.writable) {
+            try {
+                this.send({ type: 'shutdown' });
+            }
+            catch {
+                // ignore
+            }
+        }
+        if (this.readline) {
+            this.readline.close();
+            this.readline = null;
+        }
+        if (this.process) {
+            this.process.kill('SIGTERM');
+            const proc = this.process;
+            setTimeout(() => {
+                try {
+                    proc.kill('SIGKILL');
+                }
+                catch { /* already dead */ }
+            }, 2000);
+            this.process = null;
+        }
+        this.ready = false;
+        this.initPromise = null;
+    }
+}
+export function createDenoExecutor(options) {
+    return new DenoExecutor(options);
+}

package/dist/executor/executor-test-suite.js

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
+import { getRuntimeName } from '../utils/env.js';
 export function createExecutorTestSuite(name, createExecutor, options) {
     const skipSet = new Set(options?.skipTests ?? []);
     /** Use it.skip for tests in the skip list, it otherwise */
@@ -11,6 +12,7 @@ export function createExecutorTestSuite(name, createExecutor, options) {
         }
     };
     describe(`Executor: ${name}`, () => {
+        console.log(`[Test] Runtime: ${getRuntimeName()}`);
         let executor;
         beforeAll(async () => {
             executor = createExecutor();
@@ -335,7 +337,7 @@ export function createExecutorTestSuite(name, createExecutor, options) {
         });
         describe('Isolation & Safety', () => {
             testOrSkip('should not allow access to require', async () => {
-                const result = await executor.execute('return require("fs");', {});
+                const result = await executor.execute('return require("node:fs");', {});
                 expect(result.error).toBeDefined();
             });
             testOrSkip('should not allow process access', async () => {
@@ -361,7 +363,7 @@ export function createExecutorTestSuite(name, createExecutor, options) {
             return 'network allowed via fetch';
           }
           if (typeof require === 'function') {
-            const http = require('http');
+            const http = require('node:http');
             await new Promise((resolve, reject) => {
               http.get('http://example.com', resolve).on('error', reject);
             });
@@ -389,7 +391,7 @@ export function createExecutorTestSuite(name, createExecutor, options) {
           if (typeof require === 'function') {
             // Try net.Socket (TCP)
             try {
-              const net = require('net');
+              const net = require('node:net');
               await new Promise((resolve, reject) => {
                 const sock = new net.Socket();
                 sock.setTimeout(2000);
@@ -402,7 +404,7 @@ export function createExecutorTestSuite(name, createExecutor, options) {
 
             // Try dgram (UDP)
             try {
-              const dgram = require('dgram');
+              const dgram = require('node:dgram');
               const sock = dgram.createSocket('udp4');
               await new Promise((resolve, reject) => {
                 sock.on('error', reject);
@@ -416,7 +418,7 @@ export function createExecutorTestSuite(name, createExecutor, options) {
 
             // Try tls.connect
             try {
-              const tls = require('tls');
+              const tls = require('node:tls');
               await new Promise((resolve, reject) => {
                 const sock = tls.connect(443, '1.1.1.1', {}, resolve);
                 sock.on('error', reject);
@@ -426,7 +428,7 @@ export function createExecutorTestSuite(name, createExecutor, options) {
 
             // Try dns.resolve
             try {
-              const dns = require('dns');
+              const dns = require('node:dns');
               await new Promise((resolve, reject) => {
                 dns.resolve('example.com', (err, addresses) => {
                   err ? reject(err) : resolve(addresses);
@@ -529,7 +531,7 @@ export function createExecutorTestSuite(name, createExecutor, options) {
             testOrSkip('should block dynamic import', async () => {
                 const result = await executor.execute(`
           try {
-            const m = await import('fs');
+            const m = await import('node:fs');
             return 'import allowed';
           } catch (e) {
             return 'blocked';

package/dist/executor/isolated-vm-executor.js

@@ -55,9 +55,11 @@ function stringify(value) {
  * - Explicit serialization boundaries
  */
 export class IsolatedVmExecutor {
+    isolate;
+    context = null;
+    metrics = null;
+    options;
     constructor(options = {}) {
-        this.context = null;
-        this.metrics = null;
         this.options = {
             memoryLimit: options.memoryLimit ?? 128,
             inspector: options.inspector ?? false,

package/dist/executor/vm2-executor.js

@@ -9,6 +9,7 @@ import { wrapCode } from "./wrap-code.js";
  * Runs LLM-generated code in an isolated sandbox with access to tools via codemode.* namespace
  */
 export class VM2Executor {
+    timeout;
     constructor(timeout = 30000) {
         this.timeout = timeout;
     }

package/dist/mcp/config.js

@@ -2,8 +2,8 @@
  * Config Loader - Load MCP server configurations from files
  * Supports VS Code's mcp.json format and other config files
  */
-import * as fs from "fs";
-import * as path from "path";
+import * as fs from "node:fs";
+import * as path from "node:path";
 /**
  * Load MCP server configurations from VS Code's mcp.json file
  * Default location: ~/.config/Code/User/mcp.json (Linux/Mac) or

package/dist/mcp/e2e-bridge-test-suite.js

@@ -26,6 +26,7 @@ import { createCodeTool } from '@cloudflare/codemode/ai';
 import { z } from 'zod';
 import { adaptAISDKToolToMCP } from './mcp-adapter.js';
 import { jsonSchemaToZod } from './server.js';
+import { getRuntimeName } from '../utils/env.js';
 // ── Helpers ─────────────────────────────────────────────────────────────────
 /**
  * Create a mock upstream MCP server with test tools and connect an MCP client
@@ -141,6 +142,7 @@ export function createE2EBridgeTestSuite(executorName, createExecutor, options)
         }
     };
     describe(`E2E Bridge Pipeline [${executorName}]`, () => {
+        console.log(`[Test] Runtime: ${getRuntimeName()}`);
         let upstreamState;
         let bridgeState;
         let client;
@@ -378,10 +380,10 @@ export function createE2EBridgeTestSuite(executorName, createExecutor, options)
             testOrSkip('should not allow require access', async () => {
                 const response = await client.callTool({
                     name: 'eval',
-                    arguments: { code: 'async () => { return require("fs"); }' },
+                    arguments: { code: 'async () => { return require("node:fs"); }' },
                 });
                 const text = response.content?.[0]?.text || '';
-                expect(text.toLowerCase()).toMatch(/error|not defined|not allowed/);
+                expect(text.toLowerCase()).toMatch(/error|not defined|not allowed|requires .* access|could not be cloned/);
             });
             testOrSkip('should not allow process access', async () => {
                 const response = await client.callTool({
@@ -389,7 +391,7 @@ export function createE2EBridgeTestSuite(executorName, createExecutor, options)
                     arguments: { code: 'async () => { return process.env; }' },
                 });
                 const text = response.content?.[0]?.text || '';
-                expect(text.toLowerCase()).toMatch(/error|not defined|not allowed/);
+                expect(text.toLowerCase()).toMatch(/error|not defined|not allowed|requires .* access|could not be cloned/);
             });
             testOrSkip('should isolate state between executions', async () => {
                 await callCodemode(client, 'async () => { globalThis.__test = 123; return "set"; }');

package/dist/mcp/executor-status.d.ts

@@ -0,0 +1,6 @@
+export type ExecutorType = 'isolated-vm' | 'container' | 'deno' | 'vm2';
+export interface ExecutorStatus {
+    type: ExecutorType;
+    isAvailable: boolean;
+}
+export declare function getExecutorStatus(): Promise<ExecutorStatus[]>;

package/dist/mcp/executor-status.js

@@ -0,0 +1,58 @@
+import { execFileSync } from "node:child_process";
+import { isNode, isDeno, isBun, getNodeMajorVersion } from "../utils/env.js";
+async function isDenoAvailable() {
+    return isDeno();
+}
+async function isIsolatedVmAvailable() {
+    const majorVersion = getNodeMajorVersion();
+    const isEvenVersion = majorVersion > 0 && majorVersion % 2 === 0;
+    if (!isNode() || !isEvenVersion) {
+        return false;
+    }
+    try {
+        const checkScript = `
+      import ivm from 'isolated-vm';
+      const isolate = new ivm.Isolate({ memoryLimit: 8 });
+      isolate.dispose();
+      process.exit(0);
+    `;
+        const { execSync } = await import('node:child_process');
+        execSync(`node -e "${checkScript.replace(/"/g, '\\"').replace(/\n/g, '')}"`, { stdio: 'ignore', timeout: 2000 });
+        return true;
+    }
+    catch (err) {
+        return false;
+    }
+}
+async function isContainerRuntimeAvailable() {
+    for (const cmd of ['docker', 'podman']) {
+        try {
+            execFileSync(cmd, ['ps'], { stdio: 'ignore', timeout: 2000 });
+            return true;
+        }
+        catch (err) {
+            // not available
+        }
+    }
+    return false;
+}
+async function isVM2Available() {
+    if (isBun())
+        return false;
+    try {
+        await import('vm2');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function getExecutorStatus() {
+    const statuses = [
+        { type: 'deno', isAvailable: await isDenoAvailable() },
+        { type: 'isolated-vm', isAvailable: await isIsolatedVmAvailable() },
+        { type: 'container', isAvailable: await isContainerRuntimeAvailable() },
+        { type: 'vm2', isAvailable: await isVM2Available() },
+    ];
+    return statuses;
+}

package/dist/mcp/executor.d.ts

@@ -3,7 +3,7 @@
  * Selects the best available executor (isolated-vm → container → vm2)
  */
 import type { Executor } from "@cloudflare/codemode";
-export type ExecutorType = 'isolated-vm' | 'container' | 'vm2';
+export type ExecutorType = 'isolated-vm' | 'container' | 'deno' | 'vm2';
 /**
  * Metadata about the executor that was created.
  */

package/dist/mcp/executor.js

@@ -4,11 +4,27 @@
  */
 import { execFileSync } from "node:child_process";
 import { logInfo, logDebug } from "../utils/logger.js";
+import { isNode, isDeno, isBun, getNodeMajorVersion } from "../utils/env.js";
 // ── Availability checks (cached) ────────────────────────────────────
 let _isolatedVmAvailable = null;
+async function isDenoAvailable() {
+    // Only allow Deno executor if running on Deno
+    return isDeno();
+}
 async function isIsolatedVmAvailable() {
     if (_isolatedVmAvailable !== null)
         return _isolatedVmAvailable;
+    // isolated-vm is a native module specifically built for Node.js.
+    // While Bun and Deno provide compatibility layers, they often fail or
+    // exhibit unstable behavior with native Node modules like isolated-vm.
+    // Additionally, isolated-vm only supports LTS (even-numbered) Node.js versions.
+    const majorVersion = getNodeMajorVersion();
+    const isEvenVersion = majorVersion > 0 && majorVersion % 2 === 0;
+    if (!isNode() || !isEvenVersion) {
+        logDebug('isolated-vm is only supported on LTS (even-numbered) versions of native Node.js (not Bun, Deno, or odd-numbered Node versions)', { component: 'Executor' });
+        _isolatedVmAvailable = false;
+        return false;
+    }
     logDebug('Checking isolated-vm availability...', { component: 'Executor' });
     try {
         // We run the check in a separate process because isolated-vm can cause 
@@ -60,8 +76,17 @@ async function isContainerRuntimeAvailable() {
 // ── Executor registry (sorted by preference, lowest first) ─────────
 const executorRegistry = [
     {
-        type: 'isolated-vm',
+        type: 'deno',
         preference: 0,
+        isAvailable: isDenoAvailable,
+        async create(timeout) {
+            const { createDenoExecutor } = await import('../executor/deno-executor.js');
+            return createDenoExecutor({ timeout });
+        },
+    },
+    {
+        type: 'isolated-vm',
+        preference: 1,
         isAvailable: isIsolatedVmAvailable,
         async create(timeout) {
             const { createIsolatedVmExecutor } = await import('../executor/isolated-vm-executor.js');
@@ -70,7 +95,7 @@ const executorRegistry = [
     },
     {
         type: 'container',
-        preference: 1,
+        preference: 2,
         isAvailable: isContainerRuntimeAvailable,
         async create(timeout) {
             const { createContainerExecutor } = await import('../executor/container-executor.js');
@@ -79,8 +104,12 @@ const executorRegistry = [
     },
     {
         type: 'vm2',
-        preference: 2,
+        preference: 3,
         isAvailable: async () => {
+            // vm2 is fundamentally broken on Bun (prototype freezing issues)
+            // and Node.js built-in 'node:vm' is not safe for untrusted code.
+            if (isBun())
+                return false;
             try {
                 await import('vm2');
                 return true;

package/dist/mcp/mcp-client.js

@@ -19,6 +19,15 @@ import { logDebug, logInfo } from "../utils/logger.js";
  * Supports both pre-registered clients and dynamic client registration (RFC 7591)
  */
 class SimpleOAuthProvider {
+    config;
+    serverUrl;
+    static DEFAULT_REDIRECT_URL = 'http://localhost:3000/oauth/callback';
+    _tokens;
+    _codeVerifier;
+    _clientInfo;
+    _discoveryState;
+    _callbackServer;
+    _finishAuthCallback;
     constructor(config, serverUrl) {
         this.config = config;
         this.serverUrl = serverUrl;
@@ -196,15 +205,17 @@ class SimpleOAuthProvider {
         return undefined;
     }
 }
-SimpleOAuthProvider.DEFAULT_REDIRECT_URL = 'http://localhost:3000/oauth/callback';
 /**
  * MCP Client wrapper using official SDK
  */
 export class MCPClient {
+    config;
+    client;
+    transport = null;
+    connected = false;
+    oauthProvider;
     constructor(config) {
         this.config = config;
-        this.transport = null;
-        this.connected = false;
         this.client = new Client({
             name: `codemode-bridge-client-${config.name}`,
             version: "1.0.0",

package/dist/mcp/oauth-handler.js

@@ -6,15 +6,17 @@
  * to our loopback server with the authorization code, which we capture and use
  * to complete the authorization flow.
  */
-import { createServer } from 'http';
-import { URL } from 'url';
+import { createServer } from 'node:http';
+import { URL } from 'node:url';
 /**
  * Loopback HTTP server that listens for OAuth2 redirect callbacks
  */
 export class OAuthCallbackServer {
+    server;
+    port = 0; // 0 means OS will assign an available port
+    host = 'localhost';
+    pendingAuthorization;
     constructor(redirectUrl) {
-        this.port = 0; // 0 means OS will assign an available port
-        this.host = 'localhost';
         // Parse redirect URL to extract host and port
         if (redirectUrl) {
             try {

package/dist/mcp/token-persistence.js

@@ -4,15 +4,17 @@
  * Persists OAuth tokens and client information to disk for reuse across sessions.
  * Stored in ~/.config/codemode-bridge/mcp-tokens.json
  */
-import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
+import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
 /**
  * Manages OAuth token storage for MCP server connections
  */
 export class TokenPersistence {
+    configDir;
+    tokenFile;
+    storage = {};
     constructor() {
-        this.storage = {};
         this.configDir = join(homedir(), '.config', 'codemode-bridge');
         this.tokenFile = join(this.configDir, 'mcp-tokens.json');
         this.loadStorage();

package/dist/utils/env.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Environment detection utilities
+ */
+/**
+ * Returns true if the current runtime is Node.js
+ */
+export declare function isNode(): boolean;
+/**
+ * Returns the Node.js major version, or 0 if not running on Node.js
+ */
+export declare function getNodeMajorVersion(): number;
+/**
+ * Returns true if the current runtime is Bun
+ */
+export declare function isBun(): boolean;
+/**
+ * Returns true if the current runtime is Deno
+ */
+export declare function isDeno(): boolean;
+/**
+ * Returns the name of the current runtime (Node.js, Bun, or Deno)
+ */
+export declare function getRuntimeName(): string;

package/dist/utils/env.js

@@ -0,0 +1,47 @@
+/**
+ * Environment detection utilities
+ */
+/**
+ * Returns true if the current runtime is Node.js
+ */
+export function isNode() {
+    return (typeof process !== 'undefined' &&
+        !!process.versions?.node &&
+        !isBun() &&
+        !isDeno());
+}
+/**
+ * Returns the Node.js major version, or 0 if not running on Node.js
+ */
+export function getNodeMajorVersion() {
+    if (typeof process === 'undefined' || !process.versions?.node) {
+        return 0;
+    }
+    return parseInt(process.versions.node.split('.')[0], 10);
+}
+/**
+ * Returns true if the current runtime is Bun
+ */
+export function isBun() {
+    return (typeof process !== 'undefined' &&
+        !!process.versions?.bun);
+}
+/**
+ * Returns true if the current runtime is Deno
+ */
+export function isDeno() {
+    return ((typeof globalThis !== 'undefined' && !!globalThis.Deno) ||
+        (typeof process !== 'undefined' && !!process.versions?.deno));
+}
+/**
+ * Returns the name of the current runtime (Node.js, Bun, or Deno)
+ */
+export function getRuntimeName() {
+    if (isBun())
+        return "Bun";
+    if (isDeno())
+        return "Deno";
+    if (isNode())
+        return "Node.js";
+    return "Unknown";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ruifung/codemode-bridge",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "MCP bridge that connects to upstream MCP servers and exposes tools via a single codemode tool for orchestration",
   "main": "dist/index.js",
   "bin": {
@@ -14,8 +14,11 @@
     "build": "tsc",
     "prepare": "npm run build",
     "dev": "tsx src/cli/index.ts",
+    "dev:bun": "bun run src/cli/index.ts",
+    "dev:deno": "deno run --allow-net --allow-read src/cli/index.ts",
     "test": "vitest",
-    "test:e2e": "vitest run src/mcp/e2e-bridge-runner.test.ts"
+    "test:bun": "bun test",
+    "test:deno": "deno run -A npm:vitest"
   },
   "keywords": [
     "mcp",