@znmin/claude-remote-cli 0.3.1 → 0.4.0

package/src/local/server.js

@@ -1,193 +1,201 @@
-import http from 'node:http';
-import os from 'node:os';
-import { randomBytes, timingSafeEqual } from 'node:crypto';
-import * as fs from 'node:fs/promises';
-import { readFileSync } from 'node:fs';
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { z } from 'zod';
-import { Workspace } from './workspace.js';
-import { Processes } from './processes.js';
-import { describeShell } from './shell.js';
-import { Browser } from './browser.js';
-
-const PACKAGE = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
-const MAX_RESULT = 40000;
-
-const shrink = (value, size) => {
-  if (typeof value === 'string')
-    return value.length > size ? value.slice(0, size) + `…[已截断 ${value.length - size} 字符]` : value;
-  if (Array.isArray(value)) return value.map(item => shrink(item, size));
-  if (value && typeof value === 'object')
-    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, shrink(item, size)]));
-  return value;
-};
-
-// Claude persists very large MCP results on the server, where local mode cannot
-// read them back. Keep the result structured and shorten its longest strings.
-export function boundedJSON(value) {
-  const output = JSON.stringify(value);
-  if (output.length <= MAX_RESULT) return output;
-  const message = '结果过大，已截断较长字段。请缩小查询范围或分页读取。';
-  for (let size = 16000; size >= 100; size = Math.floor(size / 2)) {
-    const shrunk = JSON.stringify({ ...shrink(value, size), truncated: true, message });
-    if (shrunk.length <= MAX_RESULT) return shrunk;
-  }
-  return JSON.stringify({ truncated: true, message, preview: output.slice(0, 16000) });
-}
-
-const text = value => ({ content: [{ type: 'text', text: boundedJSON(value) }] });
-const file = z.string().min(1).max(4096);
-const pageId = z.string().min(1);
-const selector = z.string().min(1).max(4000);
-
-export async function startLocalServer({ root, env = process.env, headless = false, browser, log = console.error } = {}) {
-  const workspace = new Workspace(await fs.realpath(root));
-  const processes = new Processes(workspace, env);
-  browser ||= new Browser({ headless, log });
-  const token = randomBytes(32).toString('hex');
-  const transports = new Set();
-  let closing = false;
-
-  function createServer() {
-    const server = new McpServer({ name: 'claude-local-tools', version: PACKAGE.version });
-    const register = (name, description, inputSchema, handler, readOnly = false) => {
-      server.registerTool(name, { description, inputSchema,
-        annotations: { readOnlyHint: readOnly, idempotentHint: readOnly } }, async (args, extra) => {
-        try {
-          const value = await handler(args, extra);
-          return Array.isArray(value?.content) ? value : text(value);
-        } catch (error) { return { isError: true, content: [{ type: 'text', text: error.message }] }; }
-      });
-    };
-    register('workspace_info', 'Describe the LOCAL computer and project. All tools execute on this computer, not the SSH server.', {},
-      async () => {
-        const shell = await processes.shell();
-        const windows = os.platform() === 'win32';
-        const shellNote = !windows ? '' : shell.kind === 'bash'
-          ? ' This is Windows: run_command uses Git Bash, so write bash; Windows programs (git, npm, node, python) are on PATH, and C:/path style paths work.'
-          : ' This is Windows without Git Bash: run_command uses PowerShell, so write PowerShell commands (not bash or cmd syntax).';
-        return { root: workspace.root, platform: os.platform(), shell: shell.file, ...(windows ? { shell_kind: describeShell(shell) } : {}),
-          instructions: 'Use local absolute or project-relative paths. Use background=true for development servers, then process_status for logs. Browser selectors come from browser_snapshot. Terminal commands run as the local user.' + shellNote };
-      }, true);
-    register('read_file', 'Read a LOCAL project text file, with line numbers and a SHA-256 for safe replacement. Large reads stop early and return next_offset to continue from.', {
-      path: file, offset: z.number().int().min(1).default(1), limit: z.number().int().min(1).max(2000).default(200)
-    }, args => workspace.read(args.path, args.offset, args.limit), true);
-    register('write_file', 'Create a LOCAL file. Replacing an existing file requires its current SHA-256 from read_file.', {
-      path: file, content: z.string().max(1024 * 1024), expected_sha256: z.string().regex(/^[a-f0-9]{64}$/).optional()
-    }, args => workspace.write(args.path, args.content, args.expected_sha256));
-    register('edit_file', 'Edit a LOCAL file by exact text replacement. Include enough context for a unique match.', {
-      path: file, old_text: z.string().min(1).max(1024 * 1024), new_text: z.string().max(1024 * 1024), replace_all: z.boolean().default(false)
-    }, args => workspace.edit(args.path, args.old_text, args.new_text, args.replace_all));
-    register('list_directory', 'List LOCAL project files and directories, including hidden entries.', { path: file.default('.') },
-      args => workspace.list(args.path), true);
-    register('search_text', 'Search text in LOCAL project files. Literal by default; set regex=true for JavaScript regular expressions. glob filters files (e.g. "*.ts", "src/**/*.{js,jsx}"). Follows .gitignore inside Git repositories and skips .git, node_modules, .venv, binary and large files.', {
-      pattern: z.string().min(1).max(1000), path: file.default('.'), max_results: z.number().int().min(1).max(500).default(100),
-      case_sensitive: z.boolean().default(true), regex: z.boolean().default(false), glob: z.string().min(1).max(500).optional()
-    }, args => workspace.search(args.pattern, args.path, args.max_results, args.case_sensitive,
-      { regex: args.regex, glob: args.glob }), true);
-    register('run_command', 'Run a shell command on the LOCAL computer in the project. Git/npm/Docker and other installed CLI tools share this tool. For servers or long jobs set background=true; use process_status for output and stop_process to stop.', {
-      command: z.string().min(1).max(100000), cwd: file.default('.'), timeout_ms: z.number().int().min(100).max(120000).default(30000),
-      background: z.boolean().default(false)
-    }, (args, extra) => processes.run(args.command, args.cwd, args.timeout_ms, args.background, extra.signal));
-    register('process_status', 'Read status and output of a process started by this session. By default returns the last 8000 characters of stdout and stderr; pass stream with offset/limit to page through earlier output.', {
-      job_id: z.string(), stream: z.enum(['stdout', 'stderr']).optional(),
-      offset: z.number().int().min(0).optional(), limit: z.number().int().min(1).max(30000).default(8000)
-    }, args => processes.status(args.job_id, { stream: args.stream, offset: args.offset, limit: args.limit }), true);
-    register('list_processes', 'List processes owned by this tool session, not all system processes.', {}, () => processes.list(), true);
-    register('stop_process', 'Stop a process group started by this tool session, including a development server.', { job_id: z.string() },
-      args => processes.stop(args.job_id));
-    register('browser_open', 'Open a page in a dedicated LOCAL browser for local development, interactive UI testing, screenshots or interactive sign-in. For ordinary public research use server WebSearch/WebFetch; ask the user before falling back to this browser. localhost is the developer computer. Does not attach to existing browser profiles.', {
-      url: z.string().url().or(z.literal('about:blank')).default('about:blank')
-    }, args => browser.open(args.url));
-    register('browser_snapshot', 'Inspect a LOCAL browser page and get visible text and selectors for interactive elements.', { page_id: pageId },
-      args => browser.snapshot(args.page_id), true);
-    register('browser_click', 'Click a selector on a LOCAL browser page. Use selectors from browser_snapshot.', { page_id: pageId, selector },
-      args => browser.action(args.page_id, 'click', args.selector));
-    register('browser_fill', 'Fill an input on a LOCAL browser page.', { page_id: pageId, selector, value: z.string().max(100000) },
-      args => browser.action(args.page_id, 'fill', args.selector, args.value));
-    register('browser_press', 'Press a key such as Enter, Escape or ControlOrMeta+A in a LOCAL page.', {
-      page_id: pageId, selector: selector.optional(), key: z.string().min(1).max(100)
-    }, args => browser.action(args.page_id, 'press', args.selector, args.key));
-    register('browser_select', 'Choose option(s) of a <select> on a LOCAL page by value or label.', {
-      page_id: pageId, selector, values: z.union([z.string(), z.array(z.string()).max(50)])
-    }, args => browser.action(args.page_id, 'select', args.selector, args.values));
-    register('browser_hover', 'Hover over an element on a LOCAL page, e.g. to open a menu.', { page_id: pageId, selector },
-      args => browser.action(args.page_id, 'hover', args.selector));
-    register('browser_navigate', 'Navigate an open LOCAL page to a URL, or go back, forward or reload.', {
-      page_id: pageId, url: z.string().url().optional(), action: z.enum(['back', 'forward', 'reload']).optional()
-    }, args => browser.navigate(args.page_id, args));
-    register('browser_scroll', 'Scroll a LOCAL page: bring a selector into view, or scroll by x/y pixels.', {
-      page_id: pageId, selector: selector.optional(), x: z.number().int().default(0), y: z.number().int().default(0)
-    }, args => browser.scroll(args.page_id, args));
-    register('browser_wait_for', 'Wait until a selector or text reaches a state (default visible) on a LOCAL page, or until the page has loaded.', {
-      page_id: pageId, selector: selector.optional(), text: z.string().min(1).max(1000).optional(),
-      state: z.enum(['visible', 'hidden', 'attached', 'detached']).default('visible'),
-      timeout_ms: z.number().int().min(100).max(60000).default(10000)
-    }, args => browser.waitFor(args.page_id, { selector: args.selector, text: args.text, state: args.state, timeout: args.timeout_ms }), true);
-    register('browser_evaluate', 'Evaluate a JavaScript expression in a LOCAL page and return its JSON-serializable result.', {
-      page_id: pageId, expression: z.string().min(1).max(100000)
-    }, args => browser.evaluate(args.page_id, args.expression));
-    register('browser_screenshot', 'Capture a LOCAL page as an image: the viewport by default, the full page, or one element.', {
-      page_id: pageId, full_page: z.boolean().default(false), selector: selector.optional()
-    }, args => browser.screenshot(args.page_id, { fullPage: args.full_page, selector: args.selector }), true);
-    register('browser_logs', 'Read recent browser console messages, page errors and failed network requests.', {
-      page_id: pageId, limit: z.number().int().min(1).max(200).default(20)
-    }, args => browser.readLogs(args.page_id, args.limit), true);
-    register('browser_close', 'Close a LOCAL browser tab opened by this session.', { page_id: pageId }, args => browser.closePage(args.page_id));
-    return server;
-  }
-
-  const httpServer = http.createServer(async (request, response) => {
-    const expected = Buffer.from('Bearer ' + token), actual = Buffer.from(request.headers.authorization || '');
-    if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
-      response.writeHead(401).end('Unauthorized'); return;
-    }
-    if (closing) { response.writeHead(503).end(); return; }
-    // Browser pages cannot invoke this privileged endpoint; native MCP clients do not send Origin.
-    if (request.headers.origin) { response.writeHead(403).end('Origin not allowed'); return; }
-    if (request.url !== '/mcp') { response.writeHead(404).end(); return; }
-    if (request.method !== 'POST') { response.writeHead(405, { Allow: 'POST' }).end(); return; }
-    let server, transport;
-    try {
-      const chunks = []; let bytes = 0;
-      for await (const chunk of request) {
-        bytes += chunk.length;
-        if (bytes > 2 * 1024 * 1024) { response.writeHead(413).end('Request too large'); return; }
-        chunks.push(chunk);
-      }
-      let body;
-      try { body = JSON.parse(Buffer.concat(chunks).toString('utf8')); }
-      catch { response.writeHead(400).end('Invalid JSON'); return; }
-      server = createServer();
-      transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
-      transports.add(transport);
-      response.on('close', () => {
-        transports.delete(transport);
-        transport.close().catch(() => {}); server.close().catch(() => {});
-      });
-      await server.connect(transport);
-      await transport.handleRequest(request, response, body);
-    } catch (error) {
-      await transport?.close().catch(() => {}); await server?.close().catch(() => {});
-      if (!response.headersSent) response.writeHead(500).end('MCP request failed');
-      else response.end();
-      log('本地工具请求失败：' + error.message);
-    }
-  });
-  httpServer.requestTimeout = 30000;
-  httpServer.headersTimeout = 10000;
-  await new Promise((resolve, reject) => {
-    httpServer.once('error', reject); httpServer.listen(0, '127.0.0.1', resolve);
-  });
-  const port = httpServer.address().port;
-  return { port, token, workspace, processes, browser,
-    async close() {
-      closing = true;
-      await Promise.allSettled([...transports].map(transport => transport.close()));
-      await Promise.allSettled([processes.close(), browser.close()]);
-      httpServer.closeAllConnections();
-      await new Promise(resolve => httpServer.close(resolve));
-    }
-  };
-}
+import http from 'node:http';
+import os from 'node:os';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { z } from 'zod';
+import { Workspace } from './workspace.js';
+import { Processes } from './processes.js';
+import { describeShell } from './shell.js';
+import { Browser } from './browser.js';
+import { MAX_RESULT } from './mcp-proxy.js';
+
+const PACKAGE = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
+
+const shrink = (value, size) => {
+  if (typeof value === 'string')
+    return value.length > size ? value.slice(0, size) + `…[已截断 ${value.length - size} 字符]` : value;
+  if (Array.isArray(value)) return value.map(item => shrink(item, size));
+  if (value && typeof value === 'object')
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, shrink(item, size)]));
+  return value;
+};
+
+// Claude persists very large MCP results on the server, where local mode cannot
+// read them back. Keep the result structured and shorten its longest strings.
+export function boundedJSON(value) {
+  const output = JSON.stringify(value);
+  if (output.length <= MAX_RESULT) return output;
+  const message = '结果过大，已截断较长字段。请缩小查询范围或分页读取。';
+  for (let size = 16000; size >= 100; size = Math.floor(size / 2)) {
+    const shrunk = JSON.stringify({ ...shrink(value, size), truncated: true, message });
+    if (shrunk.length <= MAX_RESULT) return shrunk;
+  }
+  return JSON.stringify({ truncated: true, message, preview: output.slice(0, 16000) });
+}
+
+const text = value => ({ content: [{ type: 'text', text: boundedJSON(value) }] });
+const file = z.string().min(1).max(4096);
+const pageId = z.string().min(1);
+const selector = z.string().min(1).max(4000);
+
+// `upstreams` maps names to developer MCP servers (see mcp-proxy.js), served at
+// /mcp/<name>. The map may be filled after the gateway starts.
+export async function startLocalServer({ root, env = process.env, headless = false, browser, log = console.error,
+  upstreams = new Map() } = {}) {
+  const workspace = new Workspace(await fs.realpath(root));
+  const processes = new Processes(workspace, env);
+  browser ||= new Browser({ headless, log, env });
+  const token = randomBytes(32).toString('hex');
+  const transports = new Set();
+  let closing = false;
+
+  function createServer() {
+    const server = new McpServer({ name: 'claude-local-tools', version: PACKAGE.version });
+    const register = (name, description, inputSchema, handler, readOnly = false) => {
+      server.registerTool(name, { description, inputSchema,
+        annotations: { readOnlyHint: readOnly, idempotentHint: readOnly } }, async (args, extra) => {
+        try {
+          const value = await handler(args, extra);
+          return Array.isArray(value?.content) ? value : text(value);
+        } catch (error) { return { isError: true, content: [{ type: 'text', text: error.message }] }; }
+      });
+    };
+    register('workspace_info', 'Describe the LOCAL computer and project. All tools execute on this computer, not the SSH server.', {},
+      async () => {
+        const shell = await processes.shell();
+        const windows = os.platform() === 'win32';
+        const shellNote = !windows ? '' : shell.kind === 'bash'
+          ? ' This is Windows: run_command uses Git Bash, so write bash; Windows programs (git, npm, node, python) are on PATH, and C:/path style paths work.'
+          : ' This is Windows without Git Bash: run_command uses PowerShell, so write PowerShell commands (not bash or cmd syntax).';
+        return { root: workspace.root, platform: os.platform(), shell: shell.file, ...(windows ? { shell_kind: describeShell(shell) } : {}),
+          instructions: 'Use local absolute or project-relative paths. Use background=true for development servers, then process_status for logs. Browser selectors come from browser_snapshot. Terminal commands run as the local user.' + shellNote };
+      }, true);
+    register('read_file', 'Read a LOCAL project text file, with line numbers and a SHA-256 for safe replacement. Large reads stop early and return next_offset to continue from.', {
+      path: file, offset: z.number().int().min(1).default(1), limit: z.number().int().min(1).max(2000).default(200)
+    }, args => workspace.read(args.path, args.offset, args.limit), true);
+    register('write_file', 'Create a LOCAL file. Replacing an existing file requires its current SHA-256 from read_file.', {
+      path: file, content: z.string().max(1024 * 1024), expected_sha256: z.string().regex(/^[a-f0-9]{64}$/).optional()
+    }, args => workspace.write(args.path, args.content, args.expected_sha256));
+    register('edit_file', 'Edit a LOCAL file by exact text replacement. Include enough context for a unique match.', {
+      path: file, old_text: z.string().min(1).max(1024 * 1024), new_text: z.string().max(1024 * 1024), replace_all: z.boolean().default(false)
+    }, args => workspace.edit(args.path, args.old_text, args.new_text, args.replace_all));
+    register('list_directory', 'List LOCAL project files and directories, including hidden entries.', { path: file.default('.') },
+      args => workspace.list(args.path), true);
+    register('search_text', 'Search text in LOCAL project files. Literal by default; set regex=true for JavaScript regular expressions. glob filters files (e.g. "*.ts", "src/**/*.{js,jsx}"). Follows .gitignore inside Git repositories and skips .git, node_modules, .venv, binary and large files.', {
+      pattern: z.string().min(1).max(1000), path: file.default('.'), max_results: z.number().int().min(1).max(500).default(100),
+      case_sensitive: z.boolean().default(true), regex: z.boolean().default(false), glob: z.string().min(1).max(500).optional()
+    }, args => workspace.search(args.pattern, args.path, args.max_results, args.case_sensitive,
+      { regex: args.regex, glob: args.glob }), true);
+    register('run_command', 'Run a shell command on the LOCAL computer in the project. Git/npm/Docker and other installed CLI tools share this tool. For servers or long jobs set background=true; use process_status for output and stop_process to stop.', {
+      command: z.string().min(1).max(100000), cwd: file.default('.'), timeout_ms: z.number().int().min(100).max(120000).default(30000),
+      background: z.boolean().default(false)
+    }, (args, extra) => processes.run(args.command, args.cwd, args.timeout_ms, args.background, extra.signal));
+    register('process_status', 'Read status and output of a process started by this session. By default returns the last 8000 characters of stdout and stderr; pass stream with offset/limit to page through earlier output.', {
+      job_id: z.string(), stream: z.enum(['stdout', 'stderr']).optional(),
+      offset: z.number().int().min(0).optional(), limit: z.number().int().min(1).max(30000).default(8000)
+    }, args => processes.status(args.job_id, { stream: args.stream, offset: args.offset, limit: args.limit }), true);
+    register('list_processes', 'List processes owned by this tool session, not all system processes.', {}, () => processes.list(), true);
+    register('stop_process', 'Stop a process group started by this tool session, including a development server.', { job_id: z.string() },
+      args => processes.stop(args.job_id));
+    register('browser_open', 'Open a page in a dedicated LOCAL browser for local development, interactive UI testing, screenshots or interactive sign-in. For ordinary public research use server WebSearch/WebFetch; ask the user before falling back to this browser. localhost is the developer computer. Does not attach to existing browser profiles.', {
+      url: z.string().url().or(z.literal('about:blank')).default('about:blank')
+    }, args => browser.open(args.url));
+    register('browser_snapshot', 'Inspect a LOCAL browser page and get visible text and selectors for interactive elements.', { page_id: pageId },
+      args => browser.snapshot(args.page_id), true);
+    register('browser_click', 'Click a selector on a LOCAL browser page. Use selectors from browser_snapshot.', { page_id: pageId, selector },
+      args => browser.action(args.page_id, 'click', args.selector));
+    register('browser_fill', 'Fill an input on a LOCAL browser page.', { page_id: pageId, selector, value: z.string().max(100000) },
+      args => browser.action(args.page_id, 'fill', args.selector, args.value));
+    register('browser_press', 'Press a key such as Enter, Escape or ControlOrMeta+A in a LOCAL page.', {
+      page_id: pageId, selector: selector.optional(), key: z.string().min(1).max(100)
+    }, args => browser.action(args.page_id, 'press', args.selector, args.key));
+    register('browser_select', 'Choose option(s) of a <select> on a LOCAL page by value or label.', {
+      page_id: pageId, selector, values: z.union([z.string(), z.array(z.string()).max(50)])
+    }, args => browser.action(args.page_id, 'select', args.selector, args.values));
+    register('browser_hover', 'Hover over an element on a LOCAL page, e.g. to open a menu.', { page_id: pageId, selector },
+      args => browser.action(args.page_id, 'hover', args.selector));
+    register('browser_navigate', 'Navigate an open LOCAL page to a URL, or go back, forward or reload.', {
+      page_id: pageId, url: z.string().url().optional(), action: z.enum(['back', 'forward', 'reload']).optional()
+    }, args => browser.navigate(args.page_id, args));
+    register('browser_scroll', 'Scroll a LOCAL page: bring a selector into view, or scroll by x/y pixels.', {
+      page_id: pageId, selector: selector.optional(), x: z.number().int().default(0), y: z.number().int().default(0)
+    }, args => browser.scroll(args.page_id, args));
+    register('browser_wait_for', 'Wait until a selector or text reaches a state (default visible) on a LOCAL page, or until the page has loaded.', {
+      page_id: pageId, selector: selector.optional(), text: z.string().min(1).max(1000).optional(),
+      state: z.enum(['visible', 'hidden', 'attached', 'detached']).default('visible'),
+      timeout_ms: z.number().int().min(100).max(60000).default(10000)
+    }, args => browser.waitFor(args.page_id, { selector: args.selector, text: args.text, state: args.state, timeout: args.timeout_ms }), true);
+    register('browser_evaluate', 'Evaluate a JavaScript expression in a LOCAL page and return its JSON-serializable result.', {
+      page_id: pageId, expression: z.string().min(1).max(100000)
+    }, args => browser.evaluate(args.page_id, args.expression));
+    register('browser_screenshot', 'Capture a LOCAL page as an image: the viewport by default, the full page, or one element.', {
+      page_id: pageId, full_page: z.boolean().default(false), selector: selector.optional()
+    }, args => browser.screenshot(args.page_id, { fullPage: args.full_page, selector: args.selector }), true);
+    register('browser_logs', 'Read recent browser console messages, page errors and failed network requests.', {
+      page_id: pageId, limit: z.number().int().min(1).max(200).default(20)
+    }, args => browser.readLogs(args.page_id, args.limit), true);
+    register('browser_close', 'Close a LOCAL browser tab opened by this session.', { page_id: pageId }, args => browser.closePage(args.page_id));
+    return server;
+  }
+
+  const httpServer = http.createServer(async (request, response) => {
+    const expected = Buffer.from('Bearer ' + token), actual = Buffer.from(request.headers.authorization || '');
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+      response.writeHead(401).end('Unauthorized'); return;
+    }
+    if (closing) { response.writeHead(503).end(); return; }
+    // Browser pages cannot invoke this privileged endpoint; native MCP clients do not send Origin.
+    if (request.headers.origin) { response.writeHead(403).end('Origin not allowed'); return; }
+    let upstream;
+    if (request.url !== '/mcp') {
+      const match = request.url.match(/^\/mcp\/([A-Za-z0-9_-]{1,64})$/);
+      upstream = match && upstreams.get(match[1]);
+      if (!upstream) { response.writeHead(404).end(); return; }
+    }
+    if (request.method !== 'POST') { response.writeHead(405, { Allow: 'POST' }).end(); return; }
+    let server, transport;
+    try {
+      const chunks = []; let bytes = 0;
+      for await (const chunk of request) {
+        bytes += chunk.length;
+        if (bytes > 2 * 1024 * 1024) { response.writeHead(413).end('Request too large'); return; }
+        chunks.push(chunk);
+      }
+      let body;
+      try { body = JSON.parse(Buffer.concat(chunks).toString('utf8')); }
+      catch { response.writeHead(400).end('Invalid JSON'); return; }
+      server = upstream ? upstream.createServer() : createServer();
+      transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
+      transports.add(transport);
+      response.on('close', () => {
+        transports.delete(transport);
+        transport.close().catch(() => {}); server.close().catch(() => {});
+      });
+      await server.connect(transport);
+      await transport.handleRequest(request, response, body);
+    } catch (error) {
+      await transport?.close().catch(() => {}); await server?.close().catch(() => {});
+      if (!response.headersSent) response.writeHead(500).end('MCP request failed');
+      else response.end();
+      log('本地工具请求失败：' + error.message);
+    }
+  });
+  httpServer.requestTimeout = 30000;
+  httpServer.headersTimeout = 10000;
+  await new Promise((resolve, reject) => {
+    httpServer.once('error', reject); httpServer.listen(0, '127.0.0.1', resolve);
+  });
+  const port = httpServer.address().port;
+  return { port, token, workspace, processes, browser,
+    async close() {
+      closing = true;
+      await Promise.allSettled([...transports].map(transport => transport.close()));
+      await Promise.allSettled([processes.close(), browser.close()]);
+      httpServer.closeAllConnections();
+      await new Promise(resolve => httpServer.close(resolve));
+    }
+  };
+}

package/src/local/shell.js

@@ -1,72 +1,72 @@
-import * as fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { exists, quote, which } from '../system.js';
-
-const win = path.win32;
-export const psQuote = value => "'" + String(value).replaceAll("'", "''") + "'";
-
-// Git Bash locations, in the order Claude Code itself looks for them.
-export async function gitBashCandidates(env = process.env) {
-  const candidates = [];
-  if (env.CLAUDE_CODE_GIT_BASH_PATH) candidates.push(env.CLAUDE_CODE_GIT_BASH_PATH);
-  const git = await which('git', env.PATH || env.Path || '', { platform: 'win32' });
-  if (git) {
-    // <Git>\cmd\git.exe, <Git>\bin\git.exe or <Git>\mingw64\bin\git.exe
-    let root = win.dirname(win.dirname(git));
-    if (/^mingw(32|64)$/i.test(win.basename(root))) root = win.dirname(root);
-    candidates.push(win.join(root, 'bin', 'bash.exe'));
-  }
-  for (const base of [env.ProgramFiles, env.ProgramW6432, env['ProgramFiles(x86)']]) if (base) candidates.push(win.join(base, 'Git', 'bin', 'bash.exe'));
-  if (env.LOCALAPPDATA) candidates.push(win.join(env.LOCALAPPDATA, 'Programs', 'Git', 'bin', 'bash.exe'));
-  return [...new Set(candidates)];
-}
-
-// The shell behind run_command. POSIX keeps the user's login shell. Windows
-// prefers Git Bash (the model writes bash most reliably), then PowerShell.
-// C:\Windows\System32\bash.exe is WSL, which would run in a different system,
-// so bash is never taken from PATH there.
-export async function findShell(env = process.env, platform = process.platform) {
-  if (platform !== 'win32') return { kind: 'posix', file: env.SHELL || '/bin/bash' };
-  const chosen = env.CLAUDE_REMOTE_SHELL;
-  if (chosen) return { kind: /(^|[\\/])(pwsh|powershell)(\.exe)?$/i.test(chosen) ? 'powershell' : 'bash', file: chosen };
-  for (const file of await gitBashCandidates(env)) if (await exists(file)) return { kind: 'bash', file };
-  const pwsh = await which('pwsh', env.PATH || env.Path || '', { platform });
-  if (pwsh) return { kind: 'powershell', file: pwsh };
-  return { kind: 'powershell',
-    file: win.join(env.SystemRoot || env.SYSTEMROOT || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe') };
-}
-
-export function describeShell(shell) {
-  if (shell.kind === 'bash') return 'Git Bash';
-  if (shell.kind === 'powershell') return 'PowerShell';
-  return path.basename(shell.file);
-}
-
-// Windows limits a command line to 32767 characters, so commands there are
-// written to a temporary script instead of being passed as an argument.
-export async function prepareCommand(shell, command, directory, env = process.env) {
-  if (shell.kind === 'posix')
-    return { file: shell.file, args: ['-lc', `cd -- ${quote(directory)} && ${command}`], env, cleanup: async () => {} };
-  const script = path.join(os.tmpdir(), `claude-remote-${randomUUID()}.${shell.kind === 'bash' ? 'sh' : 'ps1'}`);
-  const cleanup = () => fs.rm(script, { force: true }).catch(() => {});
-  if (shell.kind === 'bash') {
-    // MSYS accepts C:/x paths. CHERE_INVOKING stops the login profile from changing to $HOME.
-    await fs.writeFile(script, `cd -- ${quote(directory.replaceAll('\\', '/'))} || exit 1\n${command}\n`, { mode: 0o600 });
-    return { file: shell.file, args: ['-l', script.replaceAll('\\', '/')], env: { ...env, CHERE_INVOKING: '1' }, cleanup };
-  }
-  // A BOM makes Windows PowerShell 5.1 read the script as UTF-8. Mirror bash:
-  // the exit code follows the last statement, including native programs.
-  await fs.writeFile(script, '\uFEFF' + [
-    "$ProgressPreference = 'SilentlyContinue'",
-    'try { [Console]::OutputEncoding = [System.Text.Encoding]::UTF8 } catch {}',
-    '$OutputEncoding = [System.Text.Encoding]::UTF8',
-    'Set-Location -LiteralPath ' + psQuote(directory),
-    command,
-    'if (-not $?) { if ($LASTEXITCODE) { exit $LASTEXITCODE }; exit 1 }',
-    'exit 0', ''
-  ].join('\r\n'), { mode: 0o600 });
-  return { file: shell.file, args: ['-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', script],
-    env, cleanup };
-}
+import * as fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { exists, quote, which } from '../system.js';
+
+const win = path.win32;
+export const psQuote = value => "'" + String(value).replaceAll("'", "''") + "'";
+
+// Git Bash locations, in the order Claude Code itself looks for them.
+export async function gitBashCandidates(env = process.env) {
+  const candidates = [];
+  if (env.CLAUDE_CODE_GIT_BASH_PATH) candidates.push(env.CLAUDE_CODE_GIT_BASH_PATH);
+  const git = await which('git', env.PATH || env.Path || '', { platform: 'win32' });
+  if (git) {
+    // <Git>\cmd\git.exe, <Git>\bin\git.exe or <Git>\mingw64\bin\git.exe
+    let root = win.dirname(win.dirname(git));
+    if (/^mingw(32|64)$/i.test(win.basename(root))) root = win.dirname(root);
+    candidates.push(win.join(root, 'bin', 'bash.exe'));
+  }
+  for (const base of [env.ProgramFiles, env.ProgramW6432, env['ProgramFiles(x86)']]) if (base) candidates.push(win.join(base, 'Git', 'bin', 'bash.exe'));
+  if (env.LOCALAPPDATA) candidates.push(win.join(env.LOCALAPPDATA, 'Programs', 'Git', 'bin', 'bash.exe'));
+  return [...new Set(candidates)];
+}
+
+// The shell behind run_command. POSIX keeps the user's login shell. Windows
+// prefers Git Bash (the model writes bash most reliably), then PowerShell.
+// C:\Windows\System32\bash.exe is WSL, which would run in a different system,
+// so bash is never taken from PATH there.
+export async function findShell(env = process.env, platform = process.platform) {
+  if (platform !== 'win32') return { kind: 'posix', file: env.SHELL || '/bin/bash' };
+  const chosen = env.CLAUDE_REMOTE_SHELL;
+  if (chosen) return { kind: /(^|[\\/])(pwsh|powershell)(\.exe)?$/i.test(chosen) ? 'powershell' : 'bash', file: chosen };
+  for (const file of await gitBashCandidates(env)) if (await exists(file)) return { kind: 'bash', file };
+  const pwsh = await which('pwsh', env.PATH || env.Path || '', { platform });
+  if (pwsh) return { kind: 'powershell', file: pwsh };
+  return { kind: 'powershell',
+    file: win.join(env.SystemRoot || env.SYSTEMROOT || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe') };
+}
+
+export function describeShell(shell) {
+  if (shell.kind === 'bash') return 'Git Bash';
+  if (shell.kind === 'powershell') return 'PowerShell';
+  return path.basename(shell.file);
+}
+
+// Windows limits a command line to 32767 characters, so commands there are
+// written to a temporary script instead of being passed as an argument.
+export async function prepareCommand(shell, command, directory, env = process.env) {
+  if (shell.kind === 'posix')
+    return { file: shell.file, args: ['-lc', `cd -- ${quote(directory)} && ${command}`], env, cleanup: async () => {} };
+  const script = path.join(os.tmpdir(), `claude-remote-${randomUUID()}.${shell.kind === 'bash' ? 'sh' : 'ps1'}`);
+  const cleanup = () => fs.rm(script, { force: true }).catch(() => {});
+  if (shell.kind === 'bash') {
+    // MSYS accepts C:/x paths. CHERE_INVOKING stops the login profile from changing to $HOME.
+    await fs.writeFile(script, `cd -- ${quote(directory.replaceAll('\\', '/'))} || exit 1\n${command}\n`, { mode: 0o600 });
+    return { file: shell.file, args: ['-l', script.replaceAll('\\', '/')], env: { ...env, CHERE_INVOKING: '1' }, cleanup };
+  }
+  // A BOM makes Windows PowerShell 5.1 read the script as UTF-8. Mirror bash:
+  // the exit code follows the last statement, including native programs.
+  await fs.writeFile(script, '\uFEFF' + [
+    "$ProgressPreference = 'SilentlyContinue'",
+    'try { [Console]::OutputEncoding = [System.Text.Encoding]::UTF8 } catch {}',
+    '$OutputEncoding = [System.Text.Encoding]::UTF8',
+    'Set-Location -LiteralPath ' + psQuote(directory),
+    command,
+    'if (-not $?) { if ($LASTEXITCODE) { exit $LASTEXITCODE }; exit 1 }',
+    'exit 0', ''
+  ].join('\r\n'), { mode: 0o600 });
+  return { file: shell.file, args: ['-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', script],
+    env, cleanup };
+}