@zoer7788/mcp-nexus-node 0.1.6 → 0.1.8

package/vendor/devspace/dist/server.js

@@ -0,0 +1,1204 @@
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { access, realpath } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+import { mcpAuthRouter, getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import { checkResourceAllowed, resourceUrlFromServerUrl } from "@modelcontextprotocol/sdk/shared/auth-utils.js";
+import { registerAppResource, registerAppTool, RESOURCE_MIME_TYPE, } from "@modelcontextprotocol/ext-apps/server";
+import express from "express";
+import * as z from "zod/v4";
+import { loadConfig } from "./config.js";
+import { dashboardConfigPayload, renderDashboardHtml, saveDashboardConfigFromBody, } from "./dashboard.js";
+import { logEvent, requestIp, requestPath, commandPreview, sessionIdPrefix, } from "./logger.js";
+import { editFileTool, findFilesTool, grepFilesTool, listDirectoryTool, readFileTool, runShellTool, writeFileTool, } from "./pi-tools.js";
+import { SingleUserOAuthProvider } from "./oauth-provider.js";
+import { createReviewCheckpointManager } from "./review-checkpoints.js";
+import { formatPathForPrompt } from "./skills.js";
+import { createWorkspaceStore } from "./workspace-store.js";
+import { formatAgentsPath, WorkspaceRegistry } from "./workspaces.js";
+const WORKSPACE_APP_URI = "ui://devspace/workspace-app.html";
+const WORKSPACE_APP_MANIFEST_ENTRY = "workspace-app.html";
+const WRITE_TOOL_ANNOTATIONS = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: false,
+};
+const EDIT_TOOL_ANNOTATIONS = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: false,
+};
+const SHELL_TOOL_ANNOTATIONS = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: true,
+};
+function shouldAttachWidget(mode, kind) {
+    switch (mode) {
+        case "off":
+            return false;
+        case "changes":
+            return kind === "workspace" || kind === "show_changes";
+        case "full":
+            return true;
+    }
+}
+function toolWidgetDescriptorMeta(config, kind) {
+    if (!shouldAttachWidget(config.widgets, kind))
+        return { _meta: {} };
+    return {
+        _meta: {
+            ui: {
+                resourceUri: WORKSPACE_APP_URI,
+                visibility: ["model"],
+            },
+        },
+    };
+}
+function toolNamesFor(config) {
+    return config.toolNaming === "short"
+        ? {
+            openWorkspace: "open_workspace",
+            read: "read",
+            write: "write",
+            edit: "edit",
+            grep: "grep",
+            glob: "glob",
+            ls: "ls",
+            shell: "bash",
+        }
+        : {
+            openWorkspace: "open_workspace",
+            read: "read_file",
+            write: "write_file",
+            edit: "edit_file",
+            grep: "grep_files",
+            glob: "find_files",
+            ls: "list_directory",
+            shell: "run_shell",
+        };
+}
+function serverInstructions(config, toolNames) {
+    const inspection = config.minimalTools
+        ? `In minimal tool mode, ${toolNames.grep}, ${toolNames.glob}, and ${toolNames.ls} are disabled; use ${toolNames.shell} with command-line tools such as grep, rg, find, ls, and tree for search and directory inspection. `
+        : `Prefer ${toolNames.read}, ${toolNames.grep}, ${toolNames.glob}, and ${toolNames.ls} for file inspection. `;
+    const skills = config.skillsEnabled
+        ? `When ${toolNames.openWorkspace} returns available skills and a task matches a skill, use ${toolNames.read} to read that skill's path before proceeding. Skill paths may be outside the workspace, but ${toolNames.read} only permits advertised SKILL.md files and files under already-loaded skill directories. `
+        : "";
+    const agentsMd = `Follow instructions returned by ${toolNames.openWorkspace}. Before working under a path listed in availableAgentsFiles, use ${toolNames.read} to inspect that instruction file and follow it. `;
+    const showChanges = config.widgets === "changes"
+        ? " After creating, editing, or overwriting files, call show_changes once after the related file changes are complete so the user can see the aggregate diff."
+        : "";
+    return `Use DevSpace as a local coding workspace. Call ${toolNames.openWorkspace} once per project folder or worktree to obtain a workspaceId. Reuse that same workspaceId for all later file, search, edit, write, show-changes, and shell tools in that folder; do not call ${toolNames.openWorkspace} again unless switching folders/worktrees, changing checkout/worktree mode, the workspaceId is rejected as unknown, or the user explicitly asks to reopen. ${agentsMd}${skills}${inspection}Prefer ${toolNames.edit} for targeted modifications, ${toolNames.write} only for new files or complete rewrites, and ${toolNames.shell} for tests, builds, git inspection, package scripts, and commands that are better executed by the shell. Do not create or modify files with ${toolNames.shell}; avoid shell redirection, heredocs, tee, sed -i, perl -i, node/python/ruby scripts, or any command whose purpose is to write project files.${showChanges}`;
+}
+function resultOutputSchema(extra = {}) {
+    return {
+        result: z
+            .string()
+            .describe("Model-readable result text for follow-up reasoning and plain MCP hosts."),
+        ...extra,
+    };
+}
+const workspaceSkillOutputSchema = z.object({
+    name: z.string(),
+    description: z.string(),
+    path: z.string(),
+});
+const workspaceAgentsFileOutputSchema = z.object({
+    path: z.string(),
+    content: z.string(),
+});
+const workspaceAvailableAgentsFileOutputSchema = z.object({
+    path: z.string(),
+});
+const reviewFileOutputSchema = z.object({
+    path: z.string(),
+    previousPath: z.string().optional(),
+    type: z.enum(["change", "rename-pure", "rename-changed", "new", "deleted"]),
+    additions: z.number(),
+    removals: z.number(),
+});
+const reviewSummaryOutputSchema = z.object({
+    files: z.number(),
+    additions: z.number(),
+    removals: z.number(),
+});
+function sendJsonRpcError(res, status, code, message) {
+    res.status(status).json({
+        jsonrpc: "2.0",
+        error: { code, message },
+        id: null,
+    });
+}
+function requestLogFields(req, config) {
+    return {
+        ip: requestIp(req, config.logging.trustProxy),
+        host: req.header("host"),
+        userAgent: req.header("user-agent"),
+        origin: req.header("origin"),
+        referer: req.header("referer"),
+        contentLength: req.header("content-length"),
+    };
+}
+function logToolCall(config, fields) {
+    if (!config.logging.toolCalls)
+        return;
+    const { command, ...safeFields } = fields;
+    logEvent(config.logging, fields.success ? "info" : "warn", "tool_call", {
+        ...safeFields,
+        commandPreview: config.logging.shellCommands && command ? commandPreview(command) : undefined,
+    });
+}
+function contentText(content) {
+    return content
+        .filter((item) => item.type === "text")
+        .map((item) => item.text)
+        .join("\n");
+}
+function toolErrorPreview(content) {
+    const text = contentText(content).replace(/\s+/g, " ").trim();
+    if (!text)
+        return undefined;
+    return text.length > 240 ? `${text.slice(0, 237)}...` : text;
+}
+function logFailedToolResponse(config, fields, content, startedAt) {
+    logToolCall(config, {
+        ...fields,
+        success: false,
+        durationMs: Math.round(performance.now() - startedAt),
+        error: toolErrorPreview(content),
+    });
+}
+function textBlock(text) {
+    return { type: "text", text };
+}
+function textSummary(content) {
+    const text = contentText(content);
+    return {
+        lines: text.length === 0 ? 0 : text.split("\n").length,
+        characters: text.length,
+    };
+}
+function contentLineCount(content) {
+    if (content.length === 0)
+        return 0;
+    return content.endsWith("\n")
+        ? content.slice(0, -1).split("\n").length
+        : content.split("\n").length;
+}
+function countDiffStats(diff) {
+    if (!diff)
+        return { additions: 0, removals: 0 };
+    let additions = 0;
+    let removals = 0;
+    for (const line of diff.split("\n")) {
+        if (line.startsWith("+") && !line.startsWith("+++"))
+            additions++;
+        if (line.startsWith("-") && !line.startsWith("---"))
+            removals++;
+    }
+    return { additions, removals };
+}
+function newFilePatch(path, content) {
+    const lines = content.length === 0
+        ? []
+        : content.endsWith("\n")
+            ? content.slice(0, -1).split("\n")
+            : content.split("\n");
+    const hunkLength = lines.length;
+    const hunkRange = hunkLength === 0 ? "+0,0" : `+1,${hunkLength}`;
+    const body = lines.map((line) => `+${line}`).join("\n");
+    return [
+        `diff --git a/${path} b/${path}`,
+        "new file mode 100644",
+        "index 0000000..0000000",
+        "--- /dev/null",
+        `+++ b/${path}`,
+        `@@ -0,0 ${hunkRange} @@`,
+        body,
+    ]
+        .filter((line) => line.length > 0)
+        .join("\n");
+}
+function assetBaseUrl(config) {
+    return `${config.publicBaseUrl.replace(/\/+$/, "")}/mcp-app-assets`;
+}
+function uiManifestUrl() {
+    return new URL("../dist/ui/.vite/manifest.json", import.meta.url);
+}
+function readWorkspaceAppManifest() {
+    return JSON.parse(readFileSync(uiManifestUrl(), "utf8"));
+}
+function getWorkspaceAppManifestEntry() {
+    const manifest = readWorkspaceAppManifest();
+    const entry = manifest[WORKSPACE_APP_MANIFEST_ENTRY];
+    if (!entry?.file) {
+        throw new Error(`Missing ${WORKSPACE_APP_MANIFEST_ENTRY} in UI manifest.`);
+    }
+    return entry;
+}
+function assetUrl(baseUrl, assetPath) {
+    return `${baseUrl}/${assetPath.replace(/^\/+/, "")}`;
+}
+function workspaceAppHtml(config) {
+    const baseUrl = assetBaseUrl(config);
+    const entry = getWorkspaceAppManifestEntry();
+    const stylesheets = (entry.css ?? [])
+        .map((stylesheet) => `    <link rel="stylesheet" crossorigin href="${assetUrl(baseUrl, stylesheet)}" />`)
+        .join("\n");
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>DevSpace Workspace</title>
+    <script type="module" crossorigin src="${assetUrl(baseUrl, entry.file)}"></script>
+${stylesheets}
+  </head>
+  <body>
+    <main id="app" class="shell">
+      <section class="empty">Waiting for a tool result.</section>
+    </main>
+  </body>
+</html>`;
+}
+function appCsp(config) {
+    const publicBaseUrl = config.publicBaseUrl.replace(/\/+$/, "");
+    return {
+        resourceDomains: [publicBaseUrl],
+        connectDomains: [publicBaseUrl],
+    };
+}
+function uiBuildDirectory() {
+    return fileURLToPath(new URL("../dist/ui", import.meta.url));
+}
+function setAssetHeaders(res) {
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Range");
+    res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
+}
+async function assertWorkspaceAppAssets() {
+    const entry = getWorkspaceAppManifestEntry();
+    const candidates = [entry.file, ...(entry.css ?? [])].map((assetPath) => new URL(`../dist/ui/${assetPath}`, import.meta.url));
+    for (const candidate of candidates) {
+        await access(candidate);
+    }
+}
+function createMcpServer(config, workspaces, reviewCheckpoints) {
+    const toolNames = toolNamesFor(config);
+    const server = new McpServer({
+        name: "devspace",
+        title: "DevSpace",
+        version: "0.1.0",
+        description: "Secure local coding workspace for MCP clients. Provides workspace-scoped file, search, edit, write, and shell tools.",
+    }, {
+        instructions: serverInstructions(config, toolNames),
+    });
+    registerAppResource(server, "DevSpace Diff Card", WORKSPACE_APP_URI, {
+        description: "Interactive card for viewing DevSpace file diffs.",
+        _meta: {
+            ui: {
+                csp: appCsp(config),
+            },
+        },
+    }, async () => {
+        await assertWorkspaceAppAssets();
+        return {
+            contents: [
+                {
+                    uri: WORKSPACE_APP_URI,
+                    mimeType: RESOURCE_MIME_TYPE,
+                    text: workspaceAppHtml(config),
+                    _meta: {
+                        ui: {
+                            csp: appCsp(config),
+                        },
+                    },
+                },
+            ],
+        };
+    });
+    registerAppTool(server, "open_workspace", {
+        title: "Open workspace",
+        description: "Open a local project directory as a coding workspace. Call this once per project folder or worktree before reading, editing, searching, writing, showing changes, or running commands. Reuse the returned workspaceId for later calls in the same folder; do not call open_workspace again unless switching folders/worktrees, changing checkout/worktree mode, the workspaceId is rejected as unknown, or the user explicitly asks to reopen. By default this opens the actual checkout; set mode=\"worktree\" when the user asks for an isolated or parallel coding session. Returns a workspaceId, loaded root project instructions, and nested instruction file paths the model should read before working in those directories.",
+        inputSchema: {
+            path: z
+                .string()
+                .describe("Absolute path, or a leading-tilde home path such as ~/project, to a local project directory inside an allowed root."),
+            mode: z
+                .enum(["checkout", "worktree"])
+                .optional()
+                .describe("Defaults to checkout. Use checkout to work in the actual directory. Use worktree to create an isolated managed Git worktree for parallel work."),
+            baseRef: z
+                .string()
+                .optional()
+                .describe("Git ref to base a worktree on. Only used with mode=\"worktree\". Defaults to HEAD."),
+        },
+        outputSchema: {
+            workspaceId: z.string(),
+            root: z.string(),
+            mode: z.enum(["checkout", "worktree"]),
+            sourceRoot: z.string().optional(),
+            worktree: z
+                .object({
+                path: z.string(),
+                baseRef: z.string(),
+                baseSha: z.string(),
+                dirtySource: z.boolean(),
+                detached: z.boolean(),
+                managed: z.boolean(),
+            })
+                .optional(),
+            agentsFiles: z.array(workspaceAgentsFileOutputSchema),
+            availableAgentsFiles: z.array(workspaceAvailableAgentsFileOutputSchema),
+            skills: z.array(workspaceSkillOutputSchema),
+            skillDiagnostics: z.array(z.unknown()),
+            instruction: z.string(),
+        },
+        ...toolWidgetDescriptorMeta(config, "workspace"),
+        annotations: { readOnlyHint: true },
+    }, async ({ path, mode, baseRef }) => {
+        const startedAt = performance.now();
+        const { workspace, agentsFiles, availableAgentsFiles } = await workspaces.openWorkspace({ path, mode, baseRef });
+        if (config.widgets === "changes") {
+            void reviewCheckpoints.initializeWorkspace({
+                workspaceId: workspace.id,
+                root: workspace.root,
+            });
+        }
+        const visibleSkills = workspace.skills
+            .filter((skill) => !skill.disableModelInvocation)
+            .map((skill) => ({
+            name: skill.name,
+            description: skill.description,
+            path: formatPathForPrompt(skill.filePath),
+        }));
+        const loadedAgentsFiles = agentsFiles.map((file) => ({
+            path: formatAgentsPath(file.path, workspace.root),
+            content: file.content,
+        }));
+        const availableAgentsFileOutputs = availableAgentsFiles.map((file) => ({
+            path: formatAgentsPath(file.path, workspace.root),
+        }));
+        const instruction = config.skillsEnabled
+            ? "Use this workspaceId in all subsequent tool calls for this project. Do not call open_workspace again for this same folder unless this workspaceId stops working, the user asks to reopen, or you switch to a different folder/worktree. Follow loaded agentsFiles instructions. Before working under a path listed in availableAgentsFiles, read that instruction file. When a task matches an available skill in skills, read its path before proceeding."
+            : "Use this workspaceId in all subsequent tool calls for this project. Do not call open_workspace again for this same folder unless this workspaceId stops working, the user asks to reopen, or you switch to a different folder/worktree. Follow loaded agentsFiles instructions. Before working under a path listed in availableAgentsFiles, read that instruction file.";
+        const resultContent = [
+            {
+                type: "text",
+                text: [
+                    `Opened workspace ${workspace.id}`,
+                    `Root: ${workspace.root}`,
+                    `Mode: ${workspace.mode}`,
+                    loadedAgentsFiles.length > 0
+                        ? `Loaded project instructions: ${loadedAgentsFiles.map((file) => file.path).join(", ")}`
+                        : undefined,
+                    availableAgentsFileOutputs.length > 0
+                        ? `Available nested instructions: ${availableAgentsFileOutputs.map((file) => file.path).join(", ")}`
+                        : undefined,
+                    visibleSkills.length > 0
+                        ? `Available skills: ${visibleSkills.map((skill) => skill.name).join(", ")}`
+                        : undefined,
+                    instruction,
+                ].filter(Boolean).join("\n"),
+            },
+        ];
+        logToolCall(config, {
+            tool: "open_workspace",
+            workspaceId: workspace.id,
+            path: workspace.root,
+            success: true,
+            durationMs: Math.round(performance.now() - startedAt),
+        });
+        return {
+            content: resultContent,
+            _meta: {
+                tool: "open_workspace",
+                card: {
+                    workspaceId: workspace.id,
+                    root: workspace.root,
+                    path: workspace.root,
+                    summary: {
+                        agentsFiles: loadedAgentsFiles.length,
+                        availableAgentsFiles: availableAgentsFileOutputs.length,
+                        skills: visibleSkills.length,
+                        skillDiagnostics: workspace.skillDiagnostics.length,
+                    },
+                },
+            },
+            structuredContent: {
+                workspaceId: workspace.id,
+                root: workspace.root,
+                mode: workspace.mode,
+                sourceRoot: workspace.sourceRoot,
+                worktree: workspace.worktree,
+                agentsFiles: loadedAgentsFiles,
+                availableAgentsFiles: availableAgentsFileOutputs,
+                skills: visibleSkills,
+                skillDiagnostics: workspace.skillDiagnostics,
+                instruction,
+            },
+        };
+    });
+    registerAppTool(server, toolNames.read, {
+        title: "Read file",
+        description: [
+            "Read a file inside an open workspace. Use this for file inspection instead of shell commands like cat or sed. Call open_workspace first and pass workspaceId.",
+            "Use this tool to inspect relevant AGENTS.md or CLAUDE.md files listed by open_workspace before working in nested directories.",
+            config.skillsEnabled
+                ? "If available skills were returned and a task matches one, read that skill's path before proceeding. Skill paths may be outside the workspace; only advertised SKILL.md files and files under already-loaded skill directories are readable."
+                : "",
+        ]
+            .filter(Boolean)
+            .join(" "),
+        inputSchema: {
+            workspaceId: z
+                .string()
+                .describe("Workspace identifier returned by open_workspace."),
+            path: z
+                .string()
+                .describe(config.skillsEnabled
+                ? "File path to read, relative to the workspace root. May also be an advertised skill path from open_workspace skills."
+                : "File path to read, relative to the workspace root."),
+            offset: z
+                .number()
+                .int()
+                .positive()
+                .optional()
+                .describe("1-indexed line number to start reading from."),
+            limit: z
+                .number()
+                .int()
+                .positive()
+                .optional()
+                .describe("Maximum number of lines to read."),
+        },
+        outputSchema: resultOutputSchema(),
+        ...toolWidgetDescriptorMeta(config, "read"),
+        annotations: { readOnlyHint: true },
+    }, async ({ workspaceId, ...input }) => {
+        const startedAt = performance.now();
+        const workspace = workspaces.getWorkspace(workspaceId);
+        const readPath = workspaces.resolveReadPath(workspace, input.path);
+        const response = await readFileTool({ ...input, path: readPath.absolutePath }, {
+            cwd: workspace.root,
+            root: workspace.root,
+            readRoots: readPath.readRoots,
+        });
+        if (response.isError) {
+            logFailedToolResponse(config, {
+                tool: toolNames.read,
+                workspaceId,
+                path: input.path,
+            }, response.content, startedAt);
+            return response;
+        }
+        workspaces.markReadPathLoaded(workspace, readPath);
+        const summary = {
+            ...textSummary(response.content),
+            offset: input.offset ?? 1,
+            limited: input.limit !== undefined,
+        };
+        logToolCall(config, {
+            tool: toolNames.read,
+            workspaceId,
+            path: input.path,
+            success: true,
+            durationMs: Math.round(performance.now() - startedAt),
+        });
+        return {
+            ...response,
+            _meta: {
+                tool: toolNames.read,
+                card: {
+                    workspaceId,
+                    path: input.path,
+                    summary,
+                    payload: { content: response.content },
+                },
+            },
+            structuredContent: {
+                result: contentText(response.content),
+            },
+        };
+    });
+    registerAppTool(server, toolNames.write, {
+        title: "Write file",
+        description: `Create or completely overwrite a file inside an open workspace. Prefer ${toolNames.edit} for targeted changes to existing files. Call open_workspace first and pass workspaceId.`,
+        inputSchema: {
+            workspaceId: z
+                .string()
+                .describe("Workspace identifier returned by open_workspace."),
+            path: z
+                .string()
+                .describe("File path to write, relative to the workspace root."),
+            content: z.string().describe("Complete new file content."),
+        },
+        outputSchema: resultOutputSchema(),
+        ...toolWidgetDescriptorMeta(config, "write"),
+        annotations: WRITE_TOOL_ANNOTATIONS,
+    }, async ({ workspaceId, ...input }) => {
+        const startedAt = performance.now();
+        const workspace = workspaces.getWorkspace(workspaceId);
+        workspaces.resolvePath(workspace, input.path);
+        const response = await writeFileTool(input, {
+            cwd: workspace.root,
+            root: workspace.root,
+        });
+        if (response.isError) {
+            logFailedToolResponse(config, {
+                tool: toolNames.write,
+                workspaceId,
+                path: input.path,
+            }, response.content, startedAt);
+            return response;
+        }
+        const patch = newFilePatch(input.path, input.content);
+        const stats = countDiffStats(patch);
+        const summary = {
+            ...stats,
+            lines: contentLineCount(input.content),
+            characters: input.content.length,
+        };
+        logToolCall(config, {
+            tool: toolNames.write,
+            workspaceId,
+            path: input.path,
+            success: true,
+            durationMs: Math.round(performance.now() - startedAt),
+        });
+        return {
+            ...response,
+            _meta: {
+                tool: toolNames.write,
+                card: {
+                    workspaceId,
+                    path: input.path,
+                    summary,
+                    payload: {
+                        content: response.content,
+                        patch,
+                    },
+                },
+            },
+            structuredContent: {
+                result: contentText(response.content),
+            },
+        };
+    });
+    registerAppTool(server, toolNames.edit, {
+        title: "Edit file",
+        description: `Edit one file inside an open workspace by replacing exact text blocks. Prefer this over ${toolNames.write} for targeted changes. Each oldText must match a unique, non-overlapping region of the original file; merge nearby changes into one edit and keep oldText as small as possible while still unique. Call open_workspace first and pass workspaceId.`,
+        inputSchema: {
+            workspaceId: z
+                .string()
+                .describe("Workspace identifier returned by open_workspace."),
+            path: z
+                .string()
+                .describe("File path to edit, relative to the workspace root."),
+            edits: z
+                .array(z.object({
+                oldText: z
+                    .string()
+                    .describe("Exact text to replace. Must match uniquely in the original file."),
+                newText: z.string().describe("Replacement text."),
+            }))
+                .min(1),
+        },
+        outputSchema: resultOutputSchema({
+            status: z.literal("applied"),
+        }),
+        ...toolWidgetDescriptorMeta(config, "edit"),
+        annotations: EDIT_TOOL_ANNOTATIONS,
+    }, async ({ workspaceId, ...input }) => {
+        const startedAt = performance.now();
+        const workspace = workspaces.getWorkspace(workspaceId);
+        workspaces.resolvePath(workspace, input.path);
+        const response = await editFileTool(input, {
+            cwd: workspace.root,
+            root: workspace.root,
+        });
+        if (response.isError) {
+            logFailedToolResponse(config, {
+                tool: toolNames.edit,
+                workspaceId,
+                path: input.path,
+            }, response.content, startedAt);
+            return response;
+        }
+        const stats = countDiffStats(response.details?.patch ?? response.details?.diff);
+        const summary = {
+            ...stats,
+            editCount: input.edits.length,
+        };
+        const editResultText = `Edited ${input.path} (+${stats.additions} -${stats.removals}).`;
+        const editContent = [textBlock(editResultText)];
+        logToolCall(config, {
+            tool: toolNames.edit,
+            workspaceId,
+            path: input.path,
+            success: true,
+            durationMs: Math.round(performance.now() - startedAt),
+        });
+        return {
+            content: editContent,
+            _meta: {
+                tool: toolNames.edit,
+                card: {
+                    workspaceId,
+                    path: input.path,
+                    summary,
+                    payload: {
+                        diff: response.details?.diff,
+                        patch: response.details?.patch,
+                    },
+                },
+            },
+            structuredContent: {
+                status: "applied",
+                result: contentText(editContent),
+            },
+        };
+    });
+    if (config.widgets === "changes") {
+        registerAppTool(server, "show_changes", {
+            title: "Show changes",
+            description: "Show aggregate file changes in an open workspace since the last shown checkpoint or since the workspace was opened. After you create, edit, or overwrite files, call this once when the related file changes are complete so the user can inspect the combined diff.",
+            inputSchema: {
+                workspaceId: z
+                    .string()
+                    .describe("Workspace identifier returned by open_workspace."),
+                since: z
+                    .enum(["last_shown", "workspace_open"])
+                    .optional()
+                    .describe("Defaults to last_shown. Use workspace_open to compare against the initial open_workspace checkpoint."),
+                markReviewed: z
+                    .boolean()
+                    .optional()
+                    .describe("Defaults to true. When true, advances the last shown checkpoint to the current workspace state."),
+            },
+            outputSchema: resultOutputSchema(),
+            ...toolWidgetDescriptorMeta(config, "show_changes"),
+            annotations: { readOnlyHint: true },
+        }, async ({ workspaceId, since, markReviewed }) => {
+            const startedAt = performance.now();
+            const workspace = workspaces.getWorkspace(workspaceId);
+            const review = await reviewCheckpoints.reviewChanges({
+                workspaceId,
+                root: workspace.root,
+                since: since ?? "last_shown",
+                markReviewed: markReviewed ?? true,
+            });
+            const content = [textBlock(review.result)];
+            logToolCall(config, {
+                tool: "show_changes",
+                workspaceId,
+                success: true,
+                durationMs: Math.round(performance.now() - startedAt),
+            });
+            return {
+                content,
+                _meta: {
+                    tool: "show_changes",
+                    card: {
+                        workspaceId,
+                        summary: review.summary,
+                        files: review.files,
+                        payload: {
+                            patch: review.patch,
+                        },
+                    },
+                },
+                structuredContent: {
+                    result: contentText(content),
+                },
+            };
+        });
+    }
+    if (!config.minimalTools) {
+        registerAppTool(server, toolNames.grep, {
+            title: config.toolNaming === "short" ? "Grep" : "Grep files",
+            description: "Search file contents inside an open workspace. Use this before broad reads when looking for symbols, text, or usage sites. Respects project ignore rules. Call open_workspace first and pass workspaceId.",
+            inputSchema: {
+                workspaceId: z
+                    .string()
+                    .describe("Workspace identifier returned by open_workspace."),
+                pattern: z.string().describe("Search pattern."),
+                path: z
+                    .string()
+                    .optional()
+                    .describe("Optional path or glob scope relative to the workspace root."),
+                include: z.string().optional().describe("Optional include glob."),
+            },
+            outputSchema: resultOutputSchema(),
+            ...toolWidgetDescriptorMeta(config, "search"),
+            annotations: { readOnlyHint: true },
+        }, async ({ workspaceId, ...input }) => {
+            const startedAt = performance.now();
+            const workspace = workspaces.getWorkspace(workspaceId);
+            if (input.path)
+                workspaces.resolvePath(workspace, input.path);
+            const response = await grepFilesTool(input, {
+                cwd: workspace.root,
+                root: workspace.root,
+            });
+            if (response.isError) {
+                logFailedToolResponse(config, {
+                    tool: toolNames.grep,
+                    workspaceId,
+                    path: input.path,
+                }, response.content, startedAt);
+                return response;
+            }
+            const summary = {
+                pattern: input.pattern,
+                scope: input.path ?? ".",
+                ...textSummary(response.content),
+            };
+            logToolCall(config, {
+                tool: toolNames.grep,
+                workspaceId,
+                path: input.path,
+                success: true,
+                durationMs: Math.round(performance.now() - startedAt),
+            });
+            return {
+                ...response,
+                _meta: {
+                    tool: toolNames.grep,
+                    card: {
+                        workspaceId,
+                        path: input.path,
+                        summary,
+                        payload: { content: response.content },
+                    },
+                },
+                structuredContent: {
+                    result: contentText(response.content),
+                },
+            };
+        });
+        registerAppTool(server, toolNames.glob, {
+            title: config.toolNaming === "short" ? "Glob" : "Find files",
+            description: "Find files by glob pattern inside an open workspace. Use this to discover filenames or narrow file sets before reading. Respects project ignore rules. Call open_workspace first and pass workspaceId.",
+            inputSchema: {
+                workspaceId: z
+                    .string()
+                    .describe("Workspace identifier returned by open_workspace."),
+                pattern: z.string().describe("File glob pattern."),
+                path: z
+                    .string()
+                    .optional()
+                    .describe("Optional path scope relative to the workspace root."),
+            },
+            outputSchema: resultOutputSchema(),
+            ...toolWidgetDescriptorMeta(config, "search"),
+            annotations: { readOnlyHint: true },
+        }, async ({ workspaceId, ...input }) => {
+            const startedAt = performance.now();
+            const workspace = workspaces.getWorkspace(workspaceId);
+            if (input.path)
+                workspaces.resolvePath(workspace, input.path);
+            const response = await findFilesTool(input, {
+                cwd: workspace.root,
+                root: workspace.root,
+            });
+            if (response.isError) {
+                logFailedToolResponse(config, {
+                    tool: toolNames.glob,
+                    workspaceId,
+                    path: input.path,
+                }, response.content, startedAt);
+                return response;
+            }
+            const summary = {
+                pattern: input.pattern,
+                scope: input.path ?? ".",
+                ...textSummary(response.content),
+            };
+            logToolCall(config, {
+                tool: toolNames.glob,
+                workspaceId,
+                path: input.path,
+                success: true,
+                durationMs: Math.round(performance.now() - startedAt),
+            });
+            return {
+                ...response,
+                _meta: {
+                    tool: toolNames.glob,
+                    card: {
+                        workspaceId,
+                        path: input.path,
+                        summary,
+                        payload: { content: response.content },
+                    },
+                },
+                structuredContent: {
+                    result: contentText(response.content),
+                },
+            };
+        });
+        registerAppTool(server, toolNames.ls, {
+            title: config.toolNaming === "short" ? "Ls" : "List directory",
+            description: "List a directory inside an open workspace. Use this for directory inspection before reading files. Call open_workspace first and pass workspaceId.",
+            inputSchema: {
+                workspaceId: z
+                    .string()
+                    .describe("Workspace identifier returned by open_workspace."),
+                path: z
+                    .string()
+                    .describe("Directory path to list, relative to the workspace root."),
+            },
+            outputSchema: resultOutputSchema(),
+            ...toolWidgetDescriptorMeta(config, "directory"),
+            annotations: { readOnlyHint: true },
+        }, async ({ workspaceId, ...input }) => {
+            const startedAt = performance.now();
+            const workspace = workspaces.getWorkspace(workspaceId);
+            workspaces.resolvePath(workspace, input.path);
+            const response = await listDirectoryTool(input, {
+                cwd: workspace.root,
+                root: workspace.root,
+            });
+            if (response.isError) {
+                logFailedToolResponse(config, {
+                    tool: toolNames.ls,
+                    workspaceId,
+                    path: input.path,
+                }, response.content, startedAt);
+                return response;
+            }
+            const summary = textSummary(response.content);
+            logToolCall(config, {
+                tool: toolNames.ls,
+                workspaceId,
+                path: input.path,
+                success: true,
+                durationMs: Math.round(performance.now() - startedAt),
+            });
+            return {
+                ...response,
+                _meta: {
+                    tool: toolNames.ls,
+                    card: {
+                        workspaceId,
+                        path: input.path,
+                        summary,
+                        payload: { content: response.content },
+                    },
+                },
+                structuredContent: {
+                    result: contentText(response.content),
+                },
+            };
+        });
+    }
+    registerAppTool(server, toolNames.shell, {
+        title: config.toolNaming === "short" ? "Bash" : "Run shell",
+        description: config.minimalTools
+            ? `Run a shell command inside an open workspace. Use only for tests, builds, git inspection, package scripts, search, file discovery, and directory inspection. In minimal tool mode, ${toolNames.grep}, ${toolNames.glob}, and ${toolNames.ls} are disabled; use command-line tools such as grep, rg, find, ls, and tree for those read-only inspection actions. Do not use ${toolNames.shell} to create or modify files. Do not use shell redirection, heredocs, tee, sed -i, perl -i, node/python/ruby scripts, or generated scripts to write project files; use ${toolNames.edit} for targeted changes and ${toolNames.write} for new files or full rewrites. Prefer ${toolNames.read} for direct file reads. Call open_workspace first and pass workspaceId. This is powerful local execution and should only be exposed behind strong authentication.`
+            : `Run a shell command inside an open workspace. Use only for tests, builds, git inspection, package scripts, and commands that are better executed by the shell. Do not use ${toolNames.shell} to create or modify files. Do not use shell redirection, heredocs, tee, sed -i, perl -i, node/python/ruby scripts, or generated scripts to write project files; use ${toolNames.edit} for targeted changes and ${toolNames.write} for new files or full rewrites. Prefer ${toolNames.read}, ${toolNames.grep}, ${toolNames.glob}, and ${toolNames.ls} for file inspection. Call open_workspace first and pass workspaceId. This is powerful local execution and should only be exposed behind strong authentication.`,
+        inputSchema: {
+            workspaceId: z
+                .string()
+                .describe("Workspace identifier returned by open_workspace."),
+            command: z
+                .string()
+                .describe(`Shell command to run. Must not create or modify project files; use ${toolNames.edit} or ${toolNames.write} for file changes.`),
+            workingDirectory: z
+                .string()
+                .optional()
+                .describe("Optional working directory relative to the workspace root. Defaults to the workspace root."),
+            timeout: z
+                .number()
+                .positive()
+                .max(300)
+                .optional()
+                .describe("Timeout in seconds. Defaults to 30, max 300."),
+        },
+        outputSchema: resultOutputSchema(),
+        ...toolWidgetDescriptorMeta(config, "shell"),
+        annotations: SHELL_TOOL_ANNOTATIONS,
+    }, async ({ workspaceId, workingDirectory, ...input }) => {
+        const startedAt = performance.now();
+        const workspace = workspaces.getWorkspace(workspaceId);
+        const cwd = workspaces.resolveWorkingDirectory(workspace, workingDirectory);
+        const response = await runShellTool(input, {
+            cwd,
+            root: workspace.root,
+        });
+        if (response.isError) {
+            logFailedToolResponse(config, {
+                tool: toolNames.shell,
+                workspaceId,
+                workingDirectory: workingDirectory ?? ".",
+                command: input.command,
+                commandLength: input.command.length,
+            }, response.content, startedAt);
+            return response;
+        }
+        const summary = {
+            command: input.command,
+            workingDirectory: workingDirectory ?? ".",
+            ...textSummary(response.content),
+        };
+        logToolCall(config, {
+            tool: toolNames.shell,
+            workspaceId,
+            workingDirectory: workingDirectory ?? ".",
+            command: input.command,
+            commandLength: input.command.length,
+            success: true,
+            durationMs: Math.round(performance.now() - startedAt),
+        });
+        return {
+            ...response,
+            _meta: {
+                tool: toolNames.shell,
+                card: {
+                    workspaceId,
+                    path: workingDirectory,
+                    summary,
+                    payload: { content: response.content },
+                },
+            },
+            structuredContent: {
+                result: contentText(response.content),
+            },
+        };
+    });
+    return server;
+}
+export function createServer(config = loadConfig()) {
+    const allowedHosts = config.allowedHosts.includes("*")
+        ? undefined
+        : Array.from(new Set([config.host, ...config.allowedHosts]));
+    const app = createMcpExpressApp({
+        host: config.host,
+        ...(allowedHosts ? { allowedHosts } : {}),
+    });
+    const transports = new Map();
+    const mcpUrl = new URL("/mcp", config.publicBaseUrl);
+    const resourceServerUrl = resourceUrlFromServerUrl(mcpUrl);
+    const oauthProvider = new SingleUserOAuthProvider(config.oauth, mcpUrl, config.stateDir);
+    const bearerAuth = requireBearerAuth({
+        verifier: oauthProvider,
+        requiredScopes: [config.oauth.scopes[0] ?? "devspace"],
+        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(resourceServerUrl),
+    });
+    const workspaceStore = createWorkspaceStore(config.stateDir);
+    const workspaces = new WorkspaceRegistry(config, workspaceStore);
+    const reviewCheckpoints = createReviewCheckpointManager();
+    if (config.logging.trustProxy) {
+        app.set("trust proxy", true);
+    }
+    app.use((req, res, next) => {
+        const requestId = randomUUID();
+        const startedAt = performance.now();
+        res.locals.requestId = requestId;
+        res.on("finish", () => {
+            const path = requestPath(req);
+            if (!config.logging.requests)
+                return;
+            if (!config.logging.assets && path.startsWith("/mcp-app-assets"))
+                return;
+            logEvent(config.logging, "info", "http_request", {
+                requestId,
+                method: req.method,
+                path,
+                status: res.statusCode,
+                durationMs: Math.round(performance.now() - startedAt),
+                ...requestLogFields(req, config),
+            });
+        });
+        next();
+    });
+    app.use(mcpAuthRouter({
+        provider: oauthProvider,
+        issuerUrl: new URL(config.publicBaseUrl),
+        baseUrl: new URL(config.publicBaseUrl),
+        resourceServerUrl,
+        scopesSupported: config.oauth.scopes,
+        resourceName: "DevSpace",
+    }));
+    app.get("/.well-known/oauth-protected-resource", (_req, res) => {
+        res.setHeader("Access-Control-Allow-Origin", "*");
+        res.json({
+            resource: resourceServerUrl.href,
+            authorization_servers: [config.publicBaseUrl],
+            scopes_supported: config.oauth.scopes,
+            resource_name: "DevSpace",
+        });
+    });
+    app.options("/mcp-app-assets/{*asset}", (_req, res) => {
+        setAssetHeaders(res);
+        res.sendStatus(204);
+    });
+    app.use("/mcp-app-assets", express.static(uiBuildDirectory(), {
+        immutable: true,
+        maxAge: "1y",
+        fallthrough: false,
+        setHeaders: setAssetHeaders,
+    }));
+    app.get("/", (_req, res) => {
+        res.redirect(302, "/dashboard");
+    });
+    app.get("/dashboard", (_req, res) => {
+        res.type("html").send(renderDashboardHtml());
+    });
+    app.use("/dashboard/api", express.json({ limit: "64kb" }));
+    app.get("/dashboard/api/config", (req, res) => {
+        res.json({ ok: true, ...dashboardConfigPayload(config) });
+    });
+    app.put("/dashboard/api/config", (req, res) => {
+        try {
+            const saved = saveDashboardConfigFromBody(req.body);
+            res.json({
+                ok: true,
+                configPath: saved.configPath,
+                persisted: saved.config,
+                restartRequired: true,
+            });
+        }
+        catch (error) {
+            res.status(400).json({
+                ok: false,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    });
+    app.get("/healthz", (_req, res) => {
+        res.json({ ok: true, name: "devspace", dashboard: "/dashboard" });
+    });
+    app.all("/mcp", async (req, res) => {
+        const requestId = res.locals.requestId;
+        const sessionId = req.header("mcp-session-id");
+        const initializeRequest = req.method === "POST" && isInitializeRequest(req.body);
+        await new Promise((resolve, reject) => {
+            bearerAuth(req, res, (error) => {
+                if (error)
+                    reject(error);
+                else
+                    resolve();
+            });
+        });
+        if (res.headersSent)
+            return;
+        if (!req.auth?.resource || !checkResourceAllowed({ requestedResource: req.auth.resource, configuredResource: resourceServerUrl })) {
+            logEvent(config.logging, "warn", "auth_denied", {
+                requestId,
+                method: req.method,
+                path: requestPath(req),
+                reason: "invalid_oauth_resource",
+                ...requestLogFields(req, config),
+            });
+            sendJsonRpcError(res, 401, -32001, "Unauthorized");
+            return;
+        }
+        logEvent(config.logging, "debug", "mcp_request", {
+            requestId,
+            method: req.method,
+            sessionIdPresent: Boolean(sessionId),
+            sessionIdPrefix: sessionIdPrefix(sessionId),
+            isInitialize: initializeRequest,
+        });
+        try {
+            let transport;
+            if (sessionId) {
+                transport = transports.get(sessionId);
+                if (!transport) {
+                    sendJsonRpcError(res, 404, -32000, "Unknown MCP session");
+                    return;
+                }
+            }
+            else if (initializeRequest) {
+                transport = new StreamableHTTPServerTransport({
+                    sessionIdGenerator: () => randomUUID(),
+                    onsessioninitialized: (newSessionId) => {
+                        if (transport)
+                            transports.set(newSessionId, transport);
+                        logEvent(config.logging, "info", "mcp_session_created", {
+                            requestId,
+                            sessionIdPrefix: sessionIdPrefix(newSessionId),
+                            ...requestLogFields(req, config),
+                        });
+                    },
+                });
+                transport.onclose = () => {
+                    const closedSessionId = transport?.sessionId;
+                    if (closedSessionId) {
+                        transports.delete(closedSessionId);
+                        logEvent(config.logging, "info", "mcp_session_closed", {
+                            sessionIdPrefix: sessionIdPrefix(closedSessionId),
+                        });
+                    }
+                };
+                const server = createMcpServer(config, workspaces, reviewCheckpoints);
+                await server.connect(transport);
+            }
+            else {
+                sendJsonRpcError(res, 400, -32000, "No valid MCP session");
+                return;
+            }
+            await transport.handleRequest(req, res, req.body);
+        }
+        catch (error) {
+            logEvent(config.logging, "error", "mcp_request_error", {
+                requestId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            if (!res.headersSent) {
+                sendJsonRpcError(res, 500, -32603, "Internal server error");
+            }
+        }
+    });
+    let closed = false;
+    return {
+        app,
+        config,
+        close: () => {
+            if (closed)
+                return;
+            closed = true;
+            oauthProvider.close();
+            workspaceStore.close?.();
+        },
+    };
+}
+async function isMainModule() {
+    if (!process.argv[1])
+        return false;
+    const modulePath = await realpath(fileURLToPath(import.meta.url));
+    const entrypointPath = await realpath(process.argv[1]);
+    return modulePath === entrypointPath;
+}
+if (await isMainModule()) {
+    const { app, config, close } = createServer();
+    const httpServer = app.listen(config.port, config.host, () => {
+        console.log(`devspace listening on http://${config.host}:${config.port}/mcp`);
+        console.log(`allowed roots: ${config.allowedRoots.join(", ")}`);
+        console.log("auth: oauth owner-token flow required");
+        console.log(`logging: ${config.logging.level} ${config.logging.format}`);
+        console.log(`request logging: ${config.logging.requests ? "enabled" : "disabled"}`);
+        console.log(`asset logging: ${config.logging.assets ? "enabled" : "disabled"}`);
+        console.log(`trust proxy: ${config.logging.trustProxy ? "enabled" : "disabled"}`);
+    });
+    const shutdown = () => {
+        httpServer.close(() => {
+            close();
+            process.exit(0);
+        });
+    };
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
+}