@zhixuan92/multi-model-agent 3.0.0

package/dist/http/server.js

@@ -0,0 +1,235 @@
+import { createServer } from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { join, dirname } from 'node:path';
+import { Router } from './router.js';
+import { sendError } from './errors.js';
+import { readBody } from './middleware/body-reader.js';
+import { loadToken, validateAuthHeader } from './auth.js';
+import { validateCwd } from './cwd-validator.js';
+import { isLoopbackAddress } from './loopback.js';
+/** Server package version — read once at module load time from package.json. */
+function readServerVersion() {
+    try {
+        const thisDir = dirname(fileURLToPath(import.meta.url));
+        // Walk up from src/http/ to packages/server/
+        const pkgPath = join(thisDir, '..', '..', 'package.json');
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+        return pkg.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+const SERVER_VERSION = readServerVersion();
+/** Routes where the loopback guard is enforced. */
+const LOOPBACK_ONLY_PATHS = new Set(['/health', '/status']);
+/** Routes that do NOT require bearer auth. */
+const AUTH_EXEMPT_PATHS = new Set(['/health']);
+/** Routes that require a `cwd` query parameter (validated by cwd-validator middleware). */
+const CWD_REQUIRED_PATHS = new Set([
+    '/delegate', '/audit', '/review', '/verify', '/debug', '/execute-plan', '/retry',
+    '/context-blocks',
+]);
+/**
+ * Registers tool handlers (POST /delegate, /audit, /review, /verify, /debug, /execute-plan, /retry).
+ * Imported dynamically to avoid circular-dependency issues and to keep startServer lean.
+ */
+async function registerToolHandlers(router, config, batchRegistry, projectRegistry) {
+    const { buildDelegateHandler } = await import('./handlers/tools/delegate.js');
+    const { buildAuditHandler } = await import('./handlers/tools/audit.js');
+    const { buildReviewHandler } = await import('./handlers/tools/review.js');
+    const { buildVerifyHandler } = await import('./handlers/tools/verify.js');
+    const { buildDebugHandler } = await import('./handlers/tools/debug.js');
+    const { buildExecutePlanHandler } = await import('./handlers/tools/execute-plan.js');
+    const { buildRetryHandler } = await import('./handlers/tools/retry.js');
+    const { createDiagnosticLogger } = await import('@zhixuan92/multi-model-agent-core');
+    const logger = createDiagnosticLogger({ enabled: false });
+    // For tool handlers, we need MultiModelConfig which is part of ServerConfig only
+    // when the full mmagent.config.json is loaded. In test/minimal configs that only
+    // have `server:`, we create a stub config. Real CLI startup will load full config.
+    // Cast through unknown to avoid type gymnastics here; validation happens in schema.
+    const multiModelConfig = config.agents
+        ? config
+        : undefined;
+    if (!multiModelConfig) {
+        // Server started with server-only config (e.g. tests): register stubs that return 503
+        for (const [method, path] of [
+            ['POST', '/delegate'], ['POST', '/audit'], ['POST', '/review'],
+            ['POST', '/verify'], ['POST', '/debug'], ['POST', '/execute-plan'], ['POST', '/retry'],
+        ]) {
+            router.register(method, path, (_req, res, _params, _ctx) => {
+                sendError(res, 503, 'no_agent_config', 'Server started without agent configuration; provide a full mmagent.config.json');
+            });
+        }
+        return;
+    }
+    const deps = {
+        config: multiModelConfig,
+        logger,
+        projectRegistry,
+        batchRegistry,
+    };
+    router.register('POST', '/delegate', buildDelegateHandler(deps));
+    router.register('POST', '/audit', buildAuditHandler(deps));
+    router.register('POST', '/review', buildReviewHandler(deps));
+    router.register('POST', '/verify', buildVerifyHandler(deps));
+    router.register('POST', '/debug', buildDebugHandler(deps));
+    router.register('POST', '/execute-plan', buildExecutePlanHandler(deps));
+    router.register('POST', '/retry', buildRetryHandler(deps));
+}
+/**
+ * Registers control handlers (GET /batch/:batchId, POST/DELETE /context-blocks,
+ * POST /clarifications/confirm).
+ */
+async function registerControlHandlers(router, config, batchRegistry, projectRegistry) {
+    const { buildBatchHandler } = await import('./handlers/control/batch.js');
+    const { buildCreateContextBlockHandler, buildDeleteContextBlockHandler } = await import('./handlers/control/context-blocks.js');
+    const { buildClarificationsHandler } = await import('./handlers/control/clarifications.js');
+    router.register('GET', '/batch/:batchId', buildBatchHandler({ batchRegistry }));
+    router.register('POST', '/context-blocks', buildCreateContextBlockHandler({ projectRegistry, config }));
+    router.register('DELETE', '/context-blocks/:blockId', buildDeleteContextBlockHandler({ projectRegistry }));
+    router.register('POST', '/clarifications/confirm', buildClarificationsHandler({ batchRegistry }));
+}
+export async function startServer(config) {
+    const token = loadToken(config.server.auth.tokenFile);
+    const router = new Router();
+    // ── Create shared registries ───────────────────────────────────────────────
+    const { BatchRegistry } = await import('@zhixuan92/multi-model-agent-core');
+    const { ProjectRegistry } = await import('./project-registry.js');
+    const batchRegistry = new BatchRegistry({
+        batchTtlMs: config.server.limits.batchTtlMs,
+        clarificationTimeoutMs: config.server.limits.clarificationTimeoutMs,
+    });
+    const projectRegistry = new ProjectRegistry({
+        cap: config.server.limits.projectCap,
+        idleEvictionMs: config.server.limits.idleProjectTimeoutMs,
+        evictionIntervalMs: Math.min(config.server.limits.idleProjectTimeoutMs, 60_000),
+    });
+    // GET /health — lightweight liveness probe (extracted to handler module)
+    const { buildHealthHandler } = await import('./handlers/introspection/health.js');
+    router.register('GET', '/health', buildHealthHandler());
+    // Register tool handlers (Phase 6)
+    await registerToolHandlers(router, config, batchRegistry, projectRegistry);
+    // Register control handlers (Phase 7)
+    await registerControlHandlers(router, config, batchRegistry, projectRegistry);
+    // GET /status — operator introspection (registered after registries are ready)
+    // Capture serverStartedAt now (after all setup, before listen) so uptimeMs reflects
+    // time since the server was fully initialised.
+    const serverStartedAt = Date.now();
+    const { buildStatusHandler } = await import('./handlers/introspection/status.js');
+    router.register('GET', '/status', buildStatusHandler({
+        batchRegistry,
+        projectRegistry,
+        serverStartedAt,
+        bind: config.server.bind,
+        version: SERVER_VERSION,
+    }));
+    // GET /tools — OpenAPI 3.0 document (auth required, NOT loopback-gated)
+    const { buildToolsHandler } = await import('./handlers/introspection/tools-list.js');
+    router.register('GET', '/tools', buildToolsHandler());
+    const server = createServer((req, res) => {
+        void handleRequest(router, token, req, res, config);
+    });
+    await new Promise((resolve) => {
+        server.listen(config.server.port, config.server.bind, resolve);
+    });
+    const addr = server.address();
+    const port = addr.port;
+    const serverAddress = typeof addr === 'object' && addr !== null ? addr.address ?? null : null;
+    return {
+        port,
+        serverAddress,
+        stop: () => new Promise((resolve) => server.close(() => resolve())),
+        batchRegistry,
+        projectRegistry,
+        serverStartedAt,
+    };
+}
+const BODY_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+async function handleRequest(router, token, req, res, cfg) {
+    const method = req.method ?? 'GET';
+    const rawUrl = req.url ?? '/';
+    // ── Step 1: Body size cap (for methods that carry a body) ──────────────────
+    let rawBody;
+    if (BODY_METHODS.has(method)) {
+        const result = await readBody(req, cfg.server.limits.maxBodyBytes);
+        if (!result.ok) {
+            // Send 413 then close; include Connection: close so the client knows
+            res.writeHead(413, { 'content-type': 'application/json', 'connection': 'close' });
+            res.end(JSON.stringify({ error: { code: 'payload_too_large', message: `Request body exceeds the ${cfg.server.limits.maxBodyBytes}-byte limit` } }), () => { req.socket?.destroy(); });
+            return;
+        }
+        rawBody = result.body;
+    }
+    // ── Step 2: Route match (404 not_found / 405 method_not_allowed) ──────────
+    const match = router.match(method, rawUrl);
+    if (!match) {
+        const allowed = router.methodsFor(rawUrl);
+        if (allowed.length > 0) {
+            sendError(res, 405, 'method_not_allowed', `Method ${method} not allowed`, { allowed });
+        }
+        else {
+            sendError(res, 404, 'not_found', `Unknown path ${rawUrl.split('?')[0]}`);
+        }
+        return;
+    }
+    // ── Step 3: Loopback guard for /health and /status ────────────────────────
+    const pathname = rawUrl.split('?')[0];
+    if (LOOPBACK_ONLY_PATHS.has(pathname)) {
+        const remoteAddr = req.socket?.remoteAddress;
+        if (!isLoopbackAddress(remoteAddr)) {
+            sendError(res, 403, 'loopback_only', 'This endpoint is only accessible from the loopback interface');
+            return;
+        }
+    }
+    // ── Step 4: Auth (bearer token) — skip for /health ───────────────────────
+    if (!AUTH_EXEMPT_PATHS.has(pathname)) {
+        const header = req.headers['authorization'];
+        const authResult = validateAuthHeader(header, token);
+        if (!authResult.ok) {
+            sendError(res, 401, 'unauthorized', 'Valid Bearer token required');
+            return;
+        }
+    }
+    // ── Step 5: JSON parse → ctx.body ────────────────────────────────────────
+    let parsedBody;
+    if (rawBody !== undefined && rawBody.length > 0) {
+        try {
+            parsedBody = JSON.parse(rawBody.toString('utf8'));
+        }
+        catch {
+            sendError(res, 400, 'invalid_json', 'Request body is not valid JSON');
+            return;
+        }
+    }
+    // ── Step 6: cwd query param → validate → ctx.cwd ─────────────────────────
+    // cwd is required for tool routes and context-block routes.
+    // /batch/:batchId and /clarifications/confirm do NOT require cwd.
+    let cwdValue;
+    const urlObj = new URL(rawUrl, 'http://localhost');
+    // Match against pathname prefix patterns for cwd-required routes
+    const requiresCwd = CWD_REQUIRED_PATHS.has(pathname) ||
+        pathname === '/context-blocks' ||
+        /^\/context-blocks\//.test(pathname);
+    if (requiresCwd) {
+        const cwdParam = urlObj.searchParams.get('cwd') ?? undefined;
+        const cwdResult = validateCwd(cwdParam);
+        if (!cwdResult.ok) {
+            const statusCode = cwdResult.error === 'forbidden_cwd' ? 403 : 400;
+            sendError(res, statusCode, cwdResult.error, cwdResult.message);
+            return;
+        }
+        cwdValue = cwdResult.canonicalCwd;
+    }
+    // ── Steps 7-9: Zod validation, project registry, and handler run ──────────
+    // These happen inside each handler (Phase 6+).
+    const ctx = {
+        url: urlObj,
+        cwd: cwdValue,
+        body: parsedBody,
+        authed: !AUTH_EXEMPT_PATHS.has(pathname),
+    };
+    await match.handler(req, res, match.params, ctx);
+}
+//# sourceMappingURL=server.js.map

package/dist/http/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,SAAS,EAAY,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIlD,gFAAgF;AAChF,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,6CAA6C;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC9E,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;AAe3C,mDAAmD;AACnD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAE5D,8CAA8C;AAC9C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAE/C,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ;IAChF,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;GAGG;AACH,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,MAAoB,EACpB,aAA4B,EAC5B,eAAgC;IAEhC,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAC9E,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACxE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAC1E,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAC1E,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACxE,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IACrF,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACxE,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;IAErF,MAAM,MAAM,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAE1D,iFAAiF;IACjF,iFAAiF;IACjF,mFAAmF;IACnF,oFAAoF;IACpF,MAAM,gBAAgB,GAAI,MAA0C,CAAC,MAAM;QACzE,CAAC,CAAE,MAAuE;QAC1E,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,sFAAsF;QACtF,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI;YAC3B,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9D,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;SACjE,EAAE,CAAC;YACxB,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBACzD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,gFAAgF,CAAC,CAAC;YAC3H,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAA4C;QACpD,MAAM,EAAE,gBAAgB;QACxB,MAAM;QACN,eAAe;QACf,aAAa;KACd,CAAC;IAEF,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,MAAoB,EACpB,aAA4B,EAC5B,eAAgC;IAEhC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC1E,MAAM,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,GAAG,MAAM,MAAM,CAAC,sCAAsC,CAAC,CAAC;IAChI,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,sCAAsC,CAAC,CAAC;IAE5F,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,EAAE,8BAA8B,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACxG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IAC3G,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,EAAE,0BAA0B,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAoB;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAE5B,8EAA8E;IAC9E,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;IAC5E,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAElE,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU;QAC3C,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB;KACpE,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC;QAC1C,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU;QACpC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB;QACzD,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC;KAChF,CAAC,CAAC;IAEH,yEAAyE;IACzE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;IAClF,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAExD,mCAAmC;IACnC,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;IAE3E,sCAAsC;IACtC,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;IAE9E,+EAA+E;IAC/E,oFAAoF;IACpF,+CAA+C;IAC/C,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;IAClF,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,kBAAkB,CAAC;QACnD,aAAa;QACb,eAAe;QACf,eAAe;QACf,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QACxB,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC,CAAC;IAEJ,wEAAwE;IACxE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;IACrF,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,KAAK,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAI,IAAyB,CAAC,IAAI,CAAC;IAC7C,MAAM,aAAa,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAE,IAA6B,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAExH,OAAO;QACL,IAAI;QACJ,aAAa;QACb,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,aAAa;QACb,eAAe;QACf,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjE,KAAK,UAAU,aAAa,CAC1B,MAAc,EACd,KAAa,EACb,GAAoB,EACpB,GAAmB,EACnB,GAAiB;IAEjB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IAE9B,8EAA8E;IAC9E,IAAI,OAA2B,CAAC;IAChC,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,qEAAqE;YACrE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;YAClF,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,4BAA4B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,aAAa,EAAE,EAAE,CAAC,EAC1I,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CACjC,CAAC;YACF,OAAO;QACT,CAAC;QACD,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,6EAA6E;IAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,UAAU,MAAM,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO;IACT,CAAC;IAED,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC;QAC7C,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,8DAA8D,CAAC,CAAC;YACrG,OAAO;QACT,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,6BAA6B,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,IAAI,UAAmB,CAAC;IACxB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,gCAAgC,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,4DAA4D;IAC5D,kEAAkE;IAClE,IAAI,QAA4B,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAEnD,iEAAiE;IACjE,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClD,QAAQ,KAAK,iBAAiB;QAC9B,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEvC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;QAC7D,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACnE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC;IACpC,CAAC;IAED,6EAA6E;IAC7E,+CAA+C;IAC/C,MAAM,GAAG,GAAmB;QAC1B,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,QAAQ;QACb,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;KACzC,CAAC;IAEF,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC"}

package/dist/http/types.d.ts

@@ -0,0 +1,9 @@
+import type { ServerResponse } from 'node:http';
+export interface RequestContext {
+    url: URL;
+    cwd?: string;
+    body?: unknown;
+    authed: boolean;
+}
+export type Handler = (ctx: RequestContext, res: ServerResponse, params: Record<string, string>) => Promise<void> | void;
+//# sourceMappingURL=types.d.ts.map

package/dist/http/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/http/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,GAAG,CAAC;IACT,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC"}

package/dist/http/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/http/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/http/types.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/install/claude-code.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Options for installing a Claude Code skill.
+ */
+export interface ClaudeCodeInstallOpts {
+    /** Human-readable name of the skill (used in file path). */
+    skillName: string;
+    /**
+     * Raw skill content. May contain `@include _shared/<file>.md` directives
+     * which are inlined before writing.
+     */
+    content: string;
+    /**
+     * Home directory — replaces `os.homedir()` in all file operations.
+     * Must NOT default to `os.homedir()`.
+     */
+    homeDir: string;
+    /** Root of the skills directory for @include resolution. */
+    skillsRoot: string;
+}
+/**
+ * Write (or overwrite) the SKILL.md file for a Claude Code skill.
+ *
+ * Target path: `<homeDir>/.claude/skills/<skillName>/SKILL.md`
+ *
+ * @param opts  Installation options (see `ClaudeCodeInstallOpts`).
+ */
+export declare function installClaudeCode(opts: ClaudeCodeInstallOpts): void;
+/**
+ * Uninstall a Claude Code skill by removing its directory.
+ *
+ * Target: `<homeDir>/.claude/skills/<skillName>/`
+ *
+ * Security: `skillName` is validated against the expected skills directory
+ * boundary to prevent path traversal (e.g. `../other-dir`). If `skillName`
+ * resolves outside the skills directory, the function is a no-op.
+ *
+ * This is also a no-op when the directory does not exist (no error is thrown).
+ *
+ * @param skillName  Name of the skill to uninstall.
+ * @param homeDir    Home directory where the skill directory lives.
+ */
+export declare function uninstallClaudeCode(skillName: string, homeDir: string): void;
+//# sourceMappingURL=claude-code.d.ts.map

package/dist/install/claude-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../src/install/claude-code.ts"],"names":[],"mappings":"AAsBA;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAUnE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAe5E"}

package/dist/install/claude-code.js

@@ -0,0 +1,65 @@
+/**
+ * Claude Code skill writer for install-skill.
+ *
+ * Writes each skill's SKILL.md to `<homeDir>/.claude/skills/<skillName>/SKILL.md`.
+ *
+ * Before writing, inlines any `@include _shared/<file>.md` directives found in
+ * the content. The directive line is replaced with the full content of the
+ * corresponding shared file sourced from `<skillsRoot>/_shared/<file>.md`.
+ * The `@include` directive is NOT preserved in the written file.
+ *
+ * If a referenced shared file is missing (ENOENT):
+ * - A warning is logged to stderr.
+ * - The include line is removed from the output (not preserved).
+ * - Processing continues for remaining content.
+ *
+ * @module
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { inlineIncludes } from './include-utils.js';
+/**
+ * Write (or overwrite) the SKILL.md file for a Claude Code skill.
+ *
+ * Target path: `<homeDir>/.claude/skills/<skillName>/SKILL.md`
+ *
+ * @param opts  Installation options (see `ClaudeCodeInstallOpts`).
+ */
+export function installClaudeCode(opts) {
+    const { skillName, content, homeDir, skillsRoot } = opts;
+    // Inline @include directives before writing
+    const inlinedContent = inlineIncludes('Claude Code skill writer', content, skillsRoot);
+    // Determine target path: <homeDir>/.claude/skills/<skillName>/SKILL.md
+    const skillDir = path.join(homeDir, '.claude', 'skills', skillName);
+    fs.mkdirSync(skillDir, { recursive: true });
+    fs.writeFileSync(path.join(skillDir, 'SKILL.md'), inlinedContent, 'utf-8');
+}
+/**
+ * Uninstall a Claude Code skill by removing its directory.
+ *
+ * Target: `<homeDir>/.claude/skills/<skillName>/`
+ *
+ * Security: `skillName` is validated against the expected skills directory
+ * boundary to prevent path traversal (e.g. `../other-dir`). If `skillName`
+ * resolves outside the skills directory, the function is a no-op.
+ *
+ * This is also a no-op when the directory does not exist (no error is thrown).
+ *
+ * @param skillName  Name of the skill to uninstall.
+ * @param homeDir    Home directory where the skill directory lives.
+ */
+export function uninstallClaudeCode(skillName, homeDir) {
+    const skillsBase = path.resolve(homeDir, '.claude', 'skills');
+    // Security: validate skillName does not escape the skills directory.
+    // Normalize skillName and verify the resolved path stays within the base.
+    const normalizedName = path.normalize(skillName);
+    const resolvedSkillDir = path.resolve(skillsBase, normalizedName);
+    const baseResolved = skillsBase + path.sep;
+    if (!resolvedSkillDir.startsWith(baseResolved)) {
+        // skillName traversal attempt — no-op rather than throwing, matching
+        // the "no error when directory does not exist" behaviour.
+        return;
+    }
+    fs.rmSync(resolvedSkillDir, { recursive: true, force: true });
+}
+//# sourceMappingURL=claude-code.js.map

package/dist/install/claude-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/install/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAsBpD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA2B;IAC3D,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAEzD,4CAA4C;IAC5C,MAAM,cAAc,GAAG,cAAc,CAAC,0BAA0B,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAEvF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,OAAe;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE9D,qEAAqE;IACrE,0EAA0E;IAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC;IAC3C,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,qEAAqE;QACrE,0DAA0D;QAC1D,OAAO;IACT,CAAC;IAED,EAAE,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC"}

package/dist/install/codex-cli.d.ts

@@ -0,0 +1,39 @@
+export interface CodexCliInstallOpts {
+    /** Human-readable name of the skill (used in warning messages). */
+    skillName: string;
+    /** Raw skill content (may contain @include directives). */
+    content: string;
+    /**
+     * Home directory — replaces `os.homedir()` in all file operations.
+     * Must NOT default to `os.homedir()`.
+     */
+    homeDir: string;
+    /** Root of the skills directory for @include resolution. */
+    skillsRoot: string;
+}
+/**
+ * Write (or overwrite) the managed block in the Codex CLI's AGENTS.md.
+ *
+ * The algorithm:
+ *   1. Inline @include directives.
+ *   2. Read existing file if present.
+ *   3. Determine new content: create / append / replace.
+ *   4. Write to disk.
+ *
+ * @throws If the AGENTS.md file exists but cannot be read.
+ * @throws If the AGENTS.md path is a directory.
+ */
+export declare function installCodexCli(opts: CodexCliInstallOpts): void;
+/**
+ * Remove the managed block (including markers) from AGENTS.md.
+ *
+ * Behaviour:
+ *   - File does not exist → no-op.
+ *   - File has no managed block markers → no-op (file unchanged).
+ *   - File has managed block → remove it; write remaining content back.
+ *   - Remaining content is empty or whitespace-only → delete the file.
+ *
+ * @throws On filesystem errors other than ENOENT when reading/writing.
+ */
+export declare function uninstallCodexCli(homeDir: string): void;
+//# sourceMappingURL=codex-cli.d.ts.map

package/dist/install/codex-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-cli.d.ts","sourceRoot":"","sources":["../../src/install/codex-cli.ts"],"names":[],"mappings":"AAgDA,MAAM,WAAW,mBAAmB;IAClC,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAmLD;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAiE/D;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CA2CvD"}