@zhixuan92/multi-model-agent 3.0.0

package/dist/cli/print-token.js

@@ -0,0 +1,60 @@
+/**
+ * print-token.ts — `mmagent print-token` subcommand.
+ *
+ * Reads the bearer auth token and prints it to stdout.
+ * Env override (MMAGENT_AUTH_TOKEN) wins over any file.
+ * Missing file → prints an error message to stderr and exits 1.
+ *
+ * Usage:
+ *   mmagent print-token [--config <path>]
+ */
+import * as os from 'node:os';
+import * as path from 'node:path';
+import * as fs from 'node:fs';
+/** Expand a leading '~/' to the home directory. */
+function expandHome(p, homeDir) {
+    if (p.startsWith('~/'))
+        return path.join(homeDir, p.slice(2));
+    return p;
+}
+/**
+ * Read the bearer token and print it to stdout.
+ * Returns 0 on success, 1 on error.
+ */
+export function printToken(deps = {}) {
+    const homeDir = deps.homeDir ?? os.homedir();
+    const env = deps.env ?? process.env;
+    const stdout = deps.stdout ?? process.stdout.write.bind(process.stdout);
+    const stderr = deps.stderr ?? process.stderr.write.bind(process.stderr);
+    // Env override wins
+    const envToken = (env['MMAGENT_AUTH_TOKEN'] ?? '').trim();
+    if (envToken.length > 0) {
+        stdout(envToken + '\n');
+        return 0;
+    }
+    // Fall back to token file
+    const rawTokenFile = deps.tokenFile ?? path.join(homeDir, '.multi-model', 'auth-token');
+    const tokenFile = expandHome(rawTokenFile, homeDir);
+    try {
+        const token = fs.readFileSync(tokenFile, 'utf-8').trim();
+        if (token.length === 0) {
+            stderr(`mmagent: token file is empty: ${tokenFile}\n`);
+            return 1;
+        }
+        stdout(token + '\n');
+        return 0;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === 'ENOENT') {
+            stderr(`mmagent: token file not found: ${tokenFile}\n` +
+                `Run 'mmagent serve' once to generate a token, or set MMAGENT_AUTH_TOKEN.\n`);
+        }
+        else {
+            const msg = err instanceof Error ? err.message : String(err);
+            stderr(`mmagent: cannot read token file ${tokenFile}: ${msg}\n`);
+        }
+        return 1;
+    }
+}
+//# sourceMappingURL=print-token.js.map

package/dist/cli/print-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"print-token.js","sourceRoot":"","sources":["../../src/cli/print-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,mDAAmD;AACnD,SAAS,UAAU,CAAC,CAAS,EAAE,OAAe;IAC5C,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC;AACX,CAAC;AAeD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,OAAuB,EAAE;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAExE,oBAAoB;IACpB,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0BAA0B;IAC1B,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,iCAAiC,SAAS,IAAI,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,CACJ,kCAAkC,SAAS,IAAI;gBAC/C,4EAA4E,CAC7E,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,CAAC,mCAAmC,SAAS,KAAK,GAAG,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/cli/serve.d.ts

@@ -0,0 +1,44 @@
+/**
+ * serve.ts — starts the HTTP server and manages its signal lifecycle.
+ *
+ * This module owns the complete serve lifecycle: starting the HTTP server,
+ * registering SIGTERM/SIGINT handlers, draining in-flight requests, and
+ * cleanly exiting the process. The CLI entry point (cli/index.ts) delegates
+ * to this module and does not manage signals directly.
+ *
+ * Usage (library):
+ *   const handle = await startServe(config);
+ *   // server is running on handle.port
+ *   await handle.stop(); // graceful shutdown; no process.exit
+ *
+ * Usage (CLI):
+ *   mmagent serve [--config <path>]
+ *   // this module owns signal handling and process.exit
+ */
+import type { MultiModelConfig } from '@zhixuan92/multi-model-agent-core';
+/** A running server handle returned by startServe(). */
+export interface ServeHandle {
+    /** The port the server is listening on (useful when port=0 for ephemeral). */
+    port: number;
+    /**
+     * Gracefully shut down the server.
+     * Removes any registered SIGTERM/SIGINT handlers to prevent leaks.
+     * After this resolves, the process is no longer listening and may exit safely.
+     */
+    stop(): Promise<void>;
+}
+/**
+ * Start the HTTP server with the given config.
+ *
+ * Registers SIGTERM and SIGINT handlers that drain in-flight requests and
+ * exit the process cleanly. If config includes `server.limits.shutdownDrainMs`,
+ * the server will wait up to that duration for in-flight requests to finish.
+ *
+ * @param config  Full MultiModelConfig (includes agents.*, defaults, diagnostics,
+ *                and server block).  startServer() inspects the agents.* field
+ *                and enables real tool handlers when present.
+ * @param exit    Process exit function — defaults to process.exit.
+ *                Exposed so tests can suppress actual exits.
+ */
+export declare function startServe(config: MultiModelConfig, exit?: (code: number) => never): Promise<ServeHandle>;
+//# sourceMappingURL=serve.d.ts.map

package/dist/cli/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/cli/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAG1E,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAYD;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAkC,GACzD,OAAO,CAAC,WAAW,CAAC,CAuCtB"}

package/dist/cli/serve.js

@@ -0,0 +1,61 @@
+import { startServer } from '../http/server.js';
+/**
+ * Shared signal-state used to deduplicate shutdown if two signals arrive
+ * before stop() resolves.
+ */
+let stopInFlight = false;
+// Stored so they can be removed when stop() is called programmatically
+let onSigterm;
+let onSigint;
+/**
+ * Start the HTTP server with the given config.
+ *
+ * Registers SIGTERM and SIGINT handlers that drain in-flight requests and
+ * exit the process cleanly. If config includes `server.limits.shutdownDrainMs`,
+ * the server will wait up to that duration for in-flight requests to finish.
+ *
+ * @param config  Full MultiModelConfig (includes agents.*, defaults, diagnostics,
+ *                and server block).  startServer() inspects the agents.* field
+ *                and enables real tool handlers when present.
+ * @param exit    Process exit function — defaults to process.exit.
+ *                Exposed so tests can suppress actual exits.
+ */
+export async function startServe(config, exit = process.exit.bind(process)) {
+    const running = await startServer(config);
+    const stderr = process.stderr.write.bind(process.stderr);
+    const cleanupSignal = (sig) => {
+        if (stopInFlight)
+            return;
+        stopInFlight = true;
+        stderr(`[mmagent] received ${sig}, shutting down gracefully\u2026\n`);
+        running.stop().then(() => exit(0)).catch((err) => {
+            const msg = err instanceof Error ? err.message : String(err);
+            stderr(`[mmagent] shutdown failed: ${msg}\n`);
+            exit(1);
+        });
+    };
+    // Register handlers using named references so they can be removed correctly.
+    // Using anonymous wrappers (e.g. `process.once('SIGTERM', () => fn(sig))`)
+    // would make process.off(sig, fn) unable to find and remove the listener.
+    onSigterm = () => cleanupSignal('SIGTERM');
+    onSigint = () => cleanupSignal('SIGINT');
+    process.once('SIGTERM', onSigterm);
+    process.once('SIGINT', onSigint);
+    // Print the actual bound address so operators see what the kernel assigned
+    // (useful when port=0 selects an ephemeral port).
+    const host = running.serverAddress ?? config.server.bind;
+    stderr(`[mmagent] listening on ${host}:${running.port}\n`);
+    return {
+        port: running.port,
+        stop: async () => {
+            // Clean up signal listeners to prevent leaks when stop() is called
+            // programmatically (i.e. not via a signal).
+            if (onSigterm)
+                process.off('SIGTERM', onSigterm);
+            if (onSigint)
+                process.off('SIGINT', onSigint);
+            await running.stop();
+        },
+    };
+}
+//# sourceMappingURL=serve.js.map

package/dist/cli/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/cli/serve.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAchD;;;GAGG;AACH,IAAI,YAAY,GAAG,KAAK,CAAC;AAEzB,uEAAuE;AACvE,IAAI,SAAmC,CAAC;AACxC,IAAI,QAAkC,CAAC;AAEvC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAwB,EACxB,OAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAE1D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAA2C,CAAC,CAAC;IAE/E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzD,MAAM,aAAa,GAAG,CAAC,GAAyB,EAAE,EAAE;QAClD,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,sBAAsB,GAAG,oCAAoC,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACxD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,CAAC,CAAC;QACV,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,SAAS,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IAC3C,QAAQ,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACnC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEjC,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;IACzD,MAAM,CAAC,0BAA0B,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAE3D,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,mEAAmE;YACnE,4CAA4C;YAC5C,IAAI,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjD,IAAI,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/status.d.ts

@@ -0,0 +1,49 @@
+export interface StatusDeps {
+    /** Server URL (e.g. 'http://127.0.0.1:7337'). */
+    serverUrl: string;
+    /** Bearer auth token. */
+    token: string;
+    /** Output as raw JSON instead of pretty-printed summary. */
+    json?: boolean;
+    /** Write to stdout. */
+    stdout?: (s: string) => boolean;
+    /** Write to stderr. */
+    stderr?: (s: string) => boolean;
+    /** Inject fetch for testability. Defaults to global fetch. */
+    fetch?: typeof fetch;
+}
+/**
+ * Fetch GET /status and print a summary (or raw JSON).
+ * Returns an exit code: 0 on success, 1 on error.
+ */
+export declare function fetchStatus(deps: StatusDeps): Promise<number>;
+/**
+ * Build the server URL from a bind address and port.
+ * Handles '0.0.0.0' / '::' by converting to '127.0.0.1' since /status
+ * is loopback-only.
+ */
+export declare function buildServerUrl(bind: string, port: number): string;
+export interface RunStatusDeps {
+    /** Config with server.bind + server.port. */
+    serverUrl: string;
+    /** Token file path (already resolved). */
+    tokenFile: string;
+    /** Whether to output raw JSON. */
+    json?: boolean;
+    /** Environment variable accessor (for MMAGENT_AUTH_TOKEN override). */
+    env?: Record<string, string | undefined>;
+    /** Write to stdout. */
+    stdout?: (s: string) => boolean;
+    /** Write to stderr. */
+    stderr?: (s: string) => boolean;
+    /** Inject fetch for testability. */
+    fetch?: typeof fetch;
+    /** Home directory (used to expand token file paths). */
+    homeDir?: string;
+}
+/**
+ * Read the token and then call fetchStatus.
+ * Returns exit code.
+ */
+export declare function runStatus(deps: RunStatusDeps): Promise<number>;
+//# sourceMappingURL=status.d.ts.map

package/dist/cli/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/cli/status.ts"],"names":[],"mappings":"AA8BA,MAAM,WAAW,UAAU;IACzB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uBAAuB;IACvB,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,uBAAuB;IACvB,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,8DAA8D;IAC9D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAiBD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAuEnE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjE;AAED,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,uBAAuB;IACvB,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,uBAAuB;IACvB,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,oCAAoC;IACpC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCpE"}

package/dist/cli/status.js

@@ -0,0 +1,155 @@
+/**
+ * status.ts — `mmagent status` subcommand.
+ *
+ * Fetches GET /status from a running server and pretty-prints a summary.
+ * Supports --json to dump the raw JSON response.
+ * Exits 1 if the server is unreachable or returns an error status.
+ *
+ * Usage:
+ *   mmagent status [--config <path>] [--json]
+ */
+import * as os from 'node:os';
+import * as path from 'node:path';
+/**
+ * Format uptime in ms as a human-readable string.
+ */
+function formatUptime(ms) {
+    const seconds = Math.floor(ms / 1000);
+    const minutes = Math.floor(seconds / 60);
+    const hours = Math.floor(minutes / 60);
+    const days = Math.floor(hours / 24);
+    if (days > 0)
+        return `${days}d ${hours % 24}h ${minutes % 60}m`;
+    if (hours > 0)
+        return `${hours}h ${minutes % 60}m ${seconds % 60}s`;
+    if (minutes > 0)
+        return `${minutes}m ${seconds % 60}s`;
+    return `${seconds}s`;
+}
+/**
+ * Fetch GET /status and print a summary (or raw JSON).
+ * Returns an exit code: 0 on success, 1 on error.
+ */
+export async function fetchStatus(deps) {
+    const { serverUrl, token, json = false } = deps;
+    const stdout = deps.stdout ?? process.stdout.write.bind(process.stdout);
+    const stderr = deps.stderr ?? process.stderr.write.bind(process.stderr);
+    const fetcher = deps.fetch ?? fetch;
+    const url = `${serverUrl.replace(/\/$/, '')}/status`;
+    let res;
+    try {
+        res = await fetcher(url, {
+            method: 'GET',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: 'application/json',
+            },
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        stderr(`mmagent status: cannot reach server at ${serverUrl}: ${msg}\n`);
+        stderr(`Is the server running? Start it with 'mmagent serve'.\n`);
+        return 1;
+    }
+    if (!res.ok) {
+        stderr(`mmagent status: server returned HTTP ${res.status} ${res.statusText}\n`);
+        return 1;
+    }
+    let body;
+    try {
+        body = (await res.json());
+    }
+    catch (err) {
+        stderr(`mmagent status: invalid JSON response from server\n`);
+        return 1;
+    }
+    if (json) {
+        stdout(JSON.stringify(body, null, 2) + '\n');
+        return 0;
+    }
+    // Pretty-print summary
+    const lines = [];
+    lines.push(`mmagent server status`);
+    lines.push(`─────────────────────────────`);
+    if (body.version)
+        lines.push(`  version:        ${body.version}`);
+    if (body.pid !== undefined)
+        lines.push(`  pid:            ${body.pid}`);
+    if (body.bind)
+        lines.push(`  bind:           ${body.bind}`);
+    if (body.uptimeMs !== undefined)
+        lines.push(`  uptime:         ${formatUptime(body.uptimeMs)}`);
+    const c = body.counters;
+    if (c) {
+        lines.push(`  projects:       ${c.projectCount ?? 0}`);
+        lines.push(`  active batches: ${c.activeBatches ?? 0}`);
+        lines.push(`  active reqs:    ${c.activeRequests ?? 0}`);
+    }
+    const inflightCount = Array.isArray(body.inflight) ? body.inflight.length : 0;
+    lines.push(`  in-flight:      ${inflightCount}`);
+    if (body.skillVersion !== undefined) {
+        const sv = body.skillVersion ?? 'none';
+        const compat = body.skillCompatible === true ? ' (compatible)'
+            : body.skillCompatible === false ? ' (incompatible — run mmagent install-skill to update)'
+                : '';
+        lines.push(`  skill version:  ${sv}${compat}`);
+    }
+    stdout(lines.join('\n') + '\n');
+    return 0;
+}
+/**
+ * Build the server URL from a bind address and port.
+ * Handles '0.0.0.0' / '::' by converting to '127.0.0.1' since /status
+ * is loopback-only.
+ */
+export function buildServerUrl(bind, port) {
+    const host = (bind === '0.0.0.0' || bind === '::') ? '127.0.0.1' : bind;
+    return `http://${host}:${port}`;
+}
+/**
+ * Read the token and then call fetchStatus.
+ * Returns exit code.
+ */
+export async function runStatus(deps) {
+    const { serverUrl, tokenFile, json = false } = deps;
+    const env = deps.env ?? process.env;
+    const stderr = deps.stderr ?? process.stderr.write.bind(process.stderr);
+    const homeDir = deps.homeDir ?? os.homedir();
+    // Read the token (env wins)
+    let token;
+    const envToken = (env['MMAGENT_AUTH_TOKEN'] ?? '').trim();
+    if (envToken.length > 0) {
+        token = envToken;
+    }
+    else {
+        const { readFileSync } = await import('node:fs');
+        const resolvedTokenFile = tokenFile.startsWith('~/')
+            ? path.join(homeDir, tokenFile.slice(2))
+            : tokenFile;
+        try {
+            token = readFileSync(resolvedTokenFile, 'utf-8').trim();
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === 'ENOENT') {
+                stderr(`mmagent status: token file not found: ${resolvedTokenFile}\n`);
+                stderr(`Run 'mmagent print-token' or set MMAGENT_AUTH_TOKEN.\n`);
+            }
+            else {
+                const msg = err instanceof Error ? err.message : String(err);
+                stderr(`mmagent status: cannot read token file: ${msg}\n`);
+            }
+            return 1;
+        }
+    }
+    return fetchStatus({
+        serverUrl,
+        token,
+        json,
+        stdout: deps.stdout,
+        stderr: deps.stderr,
+        fetch: deps.fetch,
+    });
+}
+//# sourceMappingURL=status.js.map

package/dist/cli/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/cli/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAkClC;;GAEG;AACH,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAEpC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,KAAK,OAAO,GAAG,EAAE,GAAG,CAAC;IAChE,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,KAAK,OAAO,GAAG,EAAE,KAAK,OAAO,GAAG,EAAE,GAAG,CAAC;IACpE,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,KAAK,OAAO,GAAG,EAAE,GAAG,CAAC;IACvD,OAAO,GAAG,OAAO,GAAG,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAgB;IAChD,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAEpC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC;IAErD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,0CAA0C,SAAS,KAAK,GAAG,IAAI,CAAC,CAAC;QACxE,MAAM,CAAC,yDAAyD,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,CAAC,wCAAwC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACjF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,qDAAqD,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,uBAAuB;IACvB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAEhG,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxB,IAAI,CAAC,EAAE,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,qBAAqB,aAAa,EAAE,CAAC,CAAC;IAEjD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe;YAC5D,CAAC,CAAC,IAAI,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,uDAAuD;gBACxF,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;AAClC,CAAC;AAqBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB;IACjD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAE7C,4BAA4B;IAC5B,IAAI,KAAa,CAAC;IAClB,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,GAAG,QAAQ,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,iBAAiB,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC;YACH,KAAK,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,CAAC,yCAAyC,iBAAiB,IAAI,CAAC,CAAC;gBACvE,MAAM,CAAC,wDAAwD,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,2CAA2C,GAAG,IAAI,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;QACjB,SAAS;QACT,KAAK;QACL,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;AACL,CAAC"}

package/dist/http/async-dispatch.d.ts

@@ -0,0 +1,32 @@
+import type { BatchRegistry, ProjectContext } from '@zhixuan92/multi-model-agent-core';
+import type { ExecutionContext } from '@zhixuan92/multi-model-agent-core/executors/types';
+import type { HandlerDeps } from './handler-deps.js';
+export interface AsyncDispatchOptions<TResult> {
+    tool: string;
+    projectCwd: string;
+    blockIds: string[];
+    batchRegistry: BatchRegistry;
+    projectContext: ProjectContext;
+    deps: HandlerDeps;
+    /**
+     * The async function that does the real work. Receives the ExecutionContext
+     * and the pre-allocated batchId.
+     */
+    executor: (ctx: ExecutionContext, batchId: string) => Promise<TResult>;
+}
+export interface AsyncDispatchResult {
+    batchId: string;
+    statusUrl: string;
+}
+/**
+ * Registers a new batch as 'pending', schedules the executor via setImmediate,
+ * and returns immediately with { batchId, statusUrl }.
+ *
+ * On success: calls batchRegistry.complete(batchId, result).
+ * On failure: calls batchRegistry.fail(batchId, { code, message, stack }).
+ *
+ * IMPORTANT: Does NOT maintain a manual activeBatches counter.
+ * Use BatchRegistry.countActiveForProject(cwd) as the truth source.
+ */
+export declare function asyncDispatch<TResult>(opts: AsyncDispatchOptions<TResult>): AsyncDispatchResult;
+//# sourceMappingURL=async-dispatch.d.ts.map

package/dist/http/async-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-dispatch.d.ts","sourceRoot":"","sources":["../../src/http/async-dispatch.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,MAAM,WAAW,oBAAoB,CAAC,OAAO;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,cAAc,CAAC;IAC/B,IAAI,EAAE,WAAW,CAAC;IAClB;;;OAGG;IACH,QAAQ,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EACnC,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAClC,mBAAmB,CAyCrB"}

package/dist/http/async-dispatch.js

@@ -0,0 +1,53 @@
+// packages/server/src/http/async-dispatch.ts
+import { randomUUID } from 'node:crypto';
+import { buildExecutionContext } from './execution-context.js';
+/**
+ * Registers a new batch as 'pending', schedules the executor via setImmediate,
+ * and returns immediately with { batchId, statusUrl }.
+ *
+ * On success: calls batchRegistry.complete(batchId, result).
+ * On failure: calls batchRegistry.fail(batchId, { code, message, stack }).
+ *
+ * IMPORTANT: Does NOT maintain a manual activeBatches counter.
+ * Use BatchRegistry.countActiveForProject(cwd) as the truth source.
+ */
+export function asyncDispatch(opts) {
+    const batchId = randomUUID();
+    const { batchRegistry, projectContext, deps, tool, projectCwd, blockIds } = opts;
+    // Register entry as 'pending' before scheduling executor
+    batchRegistry.register({
+        batchId,
+        projectCwd,
+        tool,
+        state: 'pending',
+        startedAt: Date.now(),
+        stateChangedAt: Date.now(),
+        blockIds,
+        blocksReleased: false,
+    });
+    // Build execution context for this batch
+    const ctx = buildExecutionContext(deps, projectContext, batchId);
+    // Schedule executor asynchronously — do not await here
+    setImmediate(() => {
+        void (async () => {
+            try {
+                const result = await opts.executor(ctx, batchId);
+                batchRegistry.complete(batchId, result);
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                const stack = err instanceof Error ? err.stack : undefined;
+                batchRegistry.fail(batchId, {
+                    code: 'executor_error',
+                    message,
+                    ...(stack !== undefined && { stack }),
+                });
+            }
+        })();
+    });
+    return {
+        batchId,
+        statusUrl: `/batch/${batchId}`,
+    };
+}
+//# sourceMappingURL=async-dispatch.js.map

package/dist/http/async-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-dispatch.js","sourceRoot":"","sources":["../../src/http/async-dispatch.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAqB/D;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAmC;IAEnC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAEjF,yDAAyD;IACzD,aAAa,CAAC,QAAQ,CAAC;QACrB,OAAO;QACP,UAAU;QACV,IAAI;QACJ,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE;QAC1B,QAAQ;QACR,cAAc,EAAE,KAAK;KACtB,CAAC,CAAC;IAEH,yCAAyC;IACzC,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IAEjE,uDAAuD;IACvD,YAAY,CAAC,GAAG,EAAE;QAChB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACjD,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3D,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE;oBAC1B,IAAI,EAAE,gBAAgB;oBACtB,OAAO;oBACP,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,SAAS,EAAE,UAAU,OAAO,EAAE;KAC/B,CAAC;AACJ,CAAC"}

package/dist/http/auth.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Load or generate the bearer token from a file path.
+ * Respects the MMAGENT_AUTH_TOKEN env override via coreLoadAuthToken when the
+ * file already exists. Falls back to generating a new token if the file does not exist.
+ */
+export declare function loadToken(tokenPath: string): string;
+/**
+ * Validate an Authorization header value (including "Bearer " prefix).
+ * Uses crypto.timingSafeEqual to prevent timing attacks.
+ *
+ * Returns { ok: true } on success.
+ * Returns { ok: false, reason } on failure without leaking which check failed.
+ */
+export declare function validateAuthHeader(header: string | undefined, expected: string): {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'missing' | 'malformed' | 'mismatch';
+};
+/**
+ * Convenience wrapper with boolean return — used by the server pipeline.
+ * Accepts the raw Authorization header value (e.g. "Bearer abc123") and
+ * the expected token string (without "Bearer " prefix).
+ */
+export declare function validateBearerHeader(header: string | undefined, expectedToken: string): boolean;
+//# sourceMappingURL=auth.d.ts.map

package/dist/http/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/http/auth.ts"],"names":[],"mappings":"AAWA;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAkBnD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,MAAM,GACf;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,CAAA;CAAE,CAU5E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAE/F"}

package/dist/http/auth.js

@@ -0,0 +1,64 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { loadAuthToken as coreLoadAuthToken } from '@zhixuan92/multi-model-agent-core';
+function expandHome(p) {
+    if (p.startsWith('~/'))
+        return path.join(os.homedir(), p.slice(2));
+    return p;
+}
+/**
+ * Load or generate the bearer token from a file path.
+ * Respects the MMAGENT_AUTH_TOKEN env override via coreLoadAuthToken when the
+ * file already exists. Falls back to generating a new token if the file does not exist.
+ */
+export function loadToken(tokenPath) {
+    const resolved = expandHome(tokenPath);
+    if (fs.existsSync(resolved)) {
+        const stat = fs.statSync(resolved);
+        // Warn (do not fail) if the existing file has group/other read/write bits set.
+        if ((stat.mode & 0o077) !== 0) {
+            process.stderr.write(`[multi-model-agent] warning: token file ${resolved} has insecure permissions (mode ${(stat.mode & 0o777).toString(8)}); recommend 'chmod 0600 ${resolved}'\n`);
+        }
+        // Use core's loadAuthToken so the MMAGENT_AUTH_TOKEN env override is respected.
+        return coreLoadAuthToken({ tokenFile: resolved });
+    }
+    const dir = path.dirname(resolved);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const token = randomBytes(32).toString('base64url');
+    fs.writeFileSync(resolved, token + '\n', { mode: 0o600 });
+    return token;
+}
+/**
+ * Validate an Authorization header value (including "Bearer " prefix).
+ * Uses crypto.timingSafeEqual to prevent timing attacks.
+ *
+ * Returns { ok: true } on success.
+ * Returns { ok: false, reason } on failure without leaking which check failed.
+ */
+export function validateAuthHeader(header, expected) {
+    if (!header)
+        return { ok: false, reason: 'missing' };
+    const parts = header.split(/\s+/);
+    if (parts.length !== 2)
+        return { ok: false, reason: 'malformed' };
+    if (parts[0].toLowerCase() !== 'bearer')
+        return { ok: false, reason: 'malformed' };
+    const presented = Buffer.from(parts[1]);
+    const expectedBuf = Buffer.from(expected);
+    if (presented.length !== expectedBuf.length)
+        return { ok: false, reason: 'mismatch' };
+    if (!timingSafeEqual(presented, expectedBuf))
+        return { ok: false, reason: 'mismatch' };
+    return { ok: true };
+}
+/**
+ * Convenience wrapper with boolean return — used by the server pipeline.
+ * Accepts the raw Authorization header value (e.g. "Bearer abc123") and
+ * the expected token string (without "Bearer " prefix).
+ */
+export function validateBearerHeader(header, expectedToken) {
+    return validateAuthHeader(header, expectedToken).ok;
+}
+//# sourceMappingURL=auth.js.map

package/dist/http/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/http/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEvF,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiB;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C,QAAQ,mCAAmC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,4BAA4B,QAAQ,KAAK,CAC/J,CAAC;QACJ,CAAC;QACD,gFAAgF;QAChF,OAAO,iBAAiB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA0B,EAC1B,QAAgB;IAEhB,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACnF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACtF,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B,EAAE,aAAqB;IACpF,OAAO,kBAAkB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC"}

package/dist/http/cwd-validator.d.ts

@@ -0,0 +1,11 @@
+export type CwdValidationError = 'missing_cwd' | 'invalid_cwd' | 'cwd_not_dir' | 'forbidden_cwd';
+export type CwdValidationResult = {
+    ok: true;
+    canonicalCwd: string;
+} | {
+    ok: false;
+    error: CwdValidationError;
+    message: string;
+};
+export declare function validateCwd(cwd: string | undefined): CwdValidationResult;
+//# sourceMappingURL=cwd-validator.d.ts.map

package/dist/http/cwd-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwd-validator.d.ts","sourceRoot":"","sources":["../../src/http/cwd-validator.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,aAAa,GAAG,aAAa,GAAG,eAAe,CAAC;AAEjG,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAiF9D,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAiCxE"}