agenthub-multiagent-mcp 1.75.0 → 1.76.0

package/dist/goshtiChannel/credential.js

@@ -0,0 +1,160 @@
+// Where the Goshti channel keeps the person's token (add-goshti-claude-connector §2.6).
+//
+// In the OS credential store where there is one — Keychain on macOS, the
+// Secret Service on Linux (`secret-tool`), the Windows credential vault —
+// otherwise in `credentials.json` with owner-only permissions beside the
+// config. Never in an environment variable, because a variable is how a token
+// ends up committed in a project's `.mcp.json` env block.
+//
+// The token never goes on a command line: every process on the machine can
+// read another's arguments. Each store is driven with the secret on stdin.
+import { spawnSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+export const SERVICE = "goshti-channel";
+export const defaultRunner = (cmd, args, input) => {
+    const r = spawnSync(cmd, args, {
+        input,
+        encoding: "utf8",
+        timeout: 15_000,
+        windowsHide: true,
+    });
+    return { status: r.error ? null : r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+};
+function psEncoded(script) {
+    return Buffer.from(script, "utf16le").toString("base64");
+}
+const PS_VAULT = `$ErrorActionPreference='Stop'
+try { [void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime] } catch { exit 3 }
+$v = New-Object Windows.Security.Credentials.PasswordVault
+$a = [Console]::In.ReadLine()
+`;
+const PS_GET = `${PS_VAULT}try { $c = $v.Retrieve('${SERVICE}', $a); $c.RetrievePassword(); [Console]::Out.Write($c.Password) } catch { exit 1 }`;
+const PS_SET = `${PS_VAULT}$t = [Console]::In.ReadLine()
+try { $o = $v.Retrieve('${SERVICE}', $a); $v.Remove($o) } catch {}
+try { $v.Add((New-Object Windows.Security.Credentials.PasswordCredential('${SERVICE}', $a, $t))) } catch { exit 1 }`;
+const PS_DEL = `${PS_VAULT}try { $o = $v.Retrieve('${SERVICE}', $a); $v.Remove($o) } catch { exit 1 }`;
+function quoteForSecurity(s) {
+    return `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+/** The OS credential store for a platform, or null where there is none. */
+export function platformKeychain(platform, run = defaultRunner) {
+    const ok = (r) => r.status === 0;
+    const value = (r) => {
+        if (!ok(r))
+            return null;
+        const v = r.stdout.replace(/[\r\n]+$/, "");
+        return v === "" ? null : v;
+    };
+    switch (platform) {
+        case "darwin":
+            return {
+                name: "macos-keychain",
+                get: (a) => value(run("security", ["find-generic-password", "-s", SERVICE, "-a", a, "-w"])),
+                // `security -i` reads its commands from stdin, which keeps `-w <token>`
+                // off the process list.
+                set: (a, s) => ok(run("security", ["-i"], `add-generic-password -U -s ${SERVICE} -a ${quoteForSecurity(a)} -w ${quoteForSecurity(s)}\n`)),
+                remove: (a) => ok(run("security", ["delete-generic-password", "-s", SERVICE, "-a", a])),
+            };
+        case "linux":
+            return {
+                name: "secret-service",
+                get: (a) => value(run("secret-tool", ["lookup", "service", SERVICE, "account", a])),
+                set: (a, s) => ok(run("secret-tool", ["store", "--label", "Goshti channel", "service", SERVICE, "account", a], s)),
+                remove: (a) => ok(run("secret-tool", ["clear", "service", SERVICE, "account", a])),
+            };
+        case "win32": {
+            const ps = (script, input) => run("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", psEncoded(script)], input);
+            return {
+                name: "windows-credential-vault",
+                get: (a) => value(ps(PS_GET, `${a}\n`)),
+                set: (a, s) => ok(ps(PS_SET, `${a}\n${s}\n`)),
+                remove: (a) => ok(ps(PS_DEL, `${a}\n`)),
+            };
+        }
+        default:
+            return null;
+    }
+}
+function credFile(dir) {
+    return join(dir, "credentials.json");
+}
+function readFileStore(dir) {
+    const file = credFile(dir);
+    if (!existsSync(file))
+        return {};
+    if (process.platform !== "win32" && (statSync(file).mode & 0o077) !== 0) {
+        throw new Error(`${file} is readable by others; refusing to use it. Run \`chmod 600 ${file}\` or \`goshti-channel setup\` again.`);
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        const out = {};
+        for (const [k, v] of Object.entries(parsed.accounts ?? {}))
+            if (typeof v === "string")
+                out[k] = v;
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+function writeFileStore(dir, accounts) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const file = credFile(dir);
+    const tmp = `${file}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify({ accounts }, null, 2)}\n`, { mode: 0o600 });
+    try {
+        chmodSync(tmp, 0o600);
+    }
+    catch {
+        // Windows: the per-user profile ACL is the protection.
+    }
+    renameSync(tmp, file);
+}
+/** Store a token. Returns where: `os:<store>` or `file:<path>`. */
+export function storeCredential(account, token, stores) {
+    if (stores.keychain?.set(account, token)) {
+        // A copy left in the file from an earlier fallback would outlive a
+        // rotation and be the one an attacker reads.
+        dropFromFile(account, stores.dir);
+        return `os:${stores.keychain.name}`;
+    }
+    let accounts = {};
+    try {
+        accounts = readFileStore(stores.dir);
+    }
+    catch {
+        accounts = {}; // a file others could read is replaced, not merged into
+    }
+    accounts[account] = token;
+    writeFileStore(stores.dir, accounts);
+    return `file:${credFile(stores.dir)}`;
+}
+/** The stored token, or null. Throws when the file exists but others can read it. */
+export function loadCredential(account, stores) {
+    const fromStore = stores.keychain?.get(account);
+    if (fromStore)
+        return { token: fromStore, where: `os:${stores.keychain.name}` };
+    const token = readFileStore(stores.dir)[account];
+    return token ? { token, where: `file:${credFile(stores.dir)}` } : null;
+}
+function dropFromFile(account, dir) {
+    if (!existsSync(credFile(dir)))
+        return;
+    let accounts;
+    try {
+        accounts = readFileStore(dir);
+    }
+    catch {
+        accounts = {};
+    }
+    if (account in accounts || Object.keys(accounts).length === 0) {
+        delete accounts[account];
+        writeFileStore(dir, accounts);
+    }
+}
+export function removeCredential(account, stores) {
+    stores.keychain?.remove(account);
+    dropFromFile(account, stores.dir);
+}
+//# sourceMappingURL=credential.js.map

package/dist/goshtiChannel/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../../src/goshtiChannel/credential.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,8EAA8E;AAC9E,0DAA0D;AAC1D,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAE3E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9G,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAgBxC,MAAM,CAAC,MAAM,aAAa,GAAW,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;IACxD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,KAAK;QACL,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AAC/F,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,QAAQ,GAAG;;;;CAIhB,CAAC;AAEF,MAAM,MAAM,GAAG,GAAG,QAAQ,2BAA2B,OAAO,qFAAqF,CAAC;AAClJ,MAAM,MAAM,GAAG,GAAG,QAAQ;0BACA,OAAO;4EAC2C,OAAO,iCAAiC,CAAC;AACrH,MAAM,MAAM,GAAG,GAAG,QAAQ,2BAA2B,OAAO,0CAA0C,CAAC;AAEvG,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAc,aAAa;IAC5E,MAAM,EAAE,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAE,EAAE;QACtC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC3F,wEAAwE;gBACxE,wBAAwB;gBACxB,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACZ,EAAE,CACA,GAAG,CACD,UAAU,EACV,CAAC,IAAI,CAAC,EACN,8BAA8B,OAAO,OAAO,gBAAgB,CAAC,CAAC,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAC9F,CACF;gBACH,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;aACxF,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnF,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACZ,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrG,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;aACnF,CAAC;QACJ,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,EAAE,CAC3C,GAAG,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACxG,OAAO;gBACL,IAAI,EAAE,0BAA0B;gBAChC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACvC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC7C,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;aACxC,CAAC;QACJ,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAOD,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,+DAA+D,IAAI,uCAAuC,CAClH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA2C,CAAC;QAChG,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAClG,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,QAAgC;IACnE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IACD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,KAAa,EAAE,MAAc;IAC5E,IAAI,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACzC,mEAAmE;QACnE,6CAA6C;QAC7C,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,QAAQ,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC,CAAC,wDAAwD;IACzE,CAAC;IACD,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IAC1B,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,OAAO,QAAQ,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,MAAc;IAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC,QAAS,CAAC,IAAI,EAAE,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,GAAW;IAChD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO;IACvC,IAAI,QAAgC,CAAC;IACrC,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzB,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,MAAc;IAC9D,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC"}

package/dist/goshtiChannel/credential.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credential.test.d.ts.map

package/dist/goshtiChannel/credential.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.test.d.ts","sourceRoot":"","sources":["../../src/goshtiChannel/credential.test.ts"],"names":[],"mappings":""}

package/dist/goshtiChannel/credential.test.js

@@ -0,0 +1,127 @@
+// Rule: the credential lives in the OS store, else in a file only its owner can
+// read, and never in a project's MCP configuration (spec "keep its credential
+// out of project files").
+import { chmodSync, existsSync, mkdtempSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { loadCredential, platformKeychain, removeCredential, storeCredential, } from "./credential.js";
+const TOKEN = "s3cr3t-personal-access-token";
+const ACCOUNT = "https://chat.example.com";
+function dir() {
+    return mkdtempSync(join(tmpdir(), "goshti-cred-"));
+}
+function memoryKeychain() {
+    const items = new Map();
+    return {
+        name: "test-store",
+        items,
+        get: (a) => items.get(a) ?? null,
+        set: (a, s) => (items.set(a, s), true),
+        remove: (a) => items.delete(a),
+    };
+}
+describe("storing the credential", () => {
+    it("uses the OS store when there is one, and writes no file", () => {
+        const d = dir();
+        const kc = memoryKeychain();
+        const where = storeCredential(ACCOUNT, TOKEN, { keychain: kc, dir: d });
+        expect(where).toBe("os:test-store");
+        expect(kc.items.get(ACCOUNT)).toBe(TOKEN);
+        expect(existsSync(join(d, "credentials.json"))).toBe(false);
+        expect(loadCredential(ACCOUNT, { keychain: kc, dir: d })).toEqual({ token: TOKEN, where: "os:test-store" });
+    });
+    it("falls back to an owner-only file when the OS store refuses", () => {
+        const d = dir();
+        const broken = { name: "broken", get: () => null, set: () => false, remove: () => false };
+        const where = storeCredential(ACCOUNT, TOKEN, { keychain: broken, dir: d });
+        const file = join(d, "credentials.json");
+        expect(where).toBe(`file:${file}`);
+        expect(JSON.parse(readFileSync(file, "utf8")).accounts[ACCOUNT]).toBe(TOKEN);
+        if (process.platform !== "win32")
+            expect(statSync(file).mode & 0o077).toBe(0);
+        expect(loadCredential(ACCOUNT, { keychain: broken, dir: d })?.token).toBe(TOKEN);
+    });
+    it("falls back to the file when there is no OS store at all", () => {
+        const d = dir();
+        expect(storeCredential(ACCOUNT, TOKEN, { keychain: null, dir: d })).toMatch(/^file:/);
+        expect(loadCredential(ACCOUNT, { keychain: null, dir: d })?.token).toBe(TOKEN);
+    });
+    it.skipIf(process.platform === "win32")("refuses a credential file others can read", () => {
+        const d = dir();
+        storeCredential(ACCOUNT, TOKEN, { keychain: null, dir: d });
+        chmodSync(join(d, "credentials.json"), 0o644);
+        expect(() => loadCredential(ACCOUNT, { keychain: null, dir: d })).toThrow(/readable by others/);
+    });
+    it("reports nothing stored as null", () => {
+        expect(loadCredential(ACCOUNT, { keychain: memoryKeychain(), dir: dir() })).toBeNull();
+    });
+    it("removes it from both places", () => {
+        const d = dir();
+        const kc = memoryKeychain();
+        storeCredential(ACCOUNT, TOKEN, { keychain: kc, dir: d });
+        storeCredential(ACCOUNT, TOKEN, { keychain: null, dir: d });
+        removeCredential(ACCOUNT, { keychain: kc, dir: d });
+        expect(loadCredential(ACCOUNT, { keychain: kc, dir: d })).toBeNull();
+    });
+    it("ignores an environment variable holding a token", () => {
+        // A variable is how a token ends up in `.mcp.json`'s env block.
+        process.env.GOSHTI_TOKEN = TOKEN;
+        try {
+            expect(loadCredential(ACCOUNT, { keychain: null, dir: dir() })).toBeNull();
+        }
+        finally {
+            delete process.env.GOSHTI_TOKEN;
+        }
+    });
+    it("does not leave the file readable by others even if it existed before", () => {
+        if (process.platform === "win32")
+            return;
+        const d = dir();
+        const file = join(d, "credentials.json");
+        writeFileSync(file, JSON.stringify({ accounts: {} }), { mode: 0o644 });
+        storeCredential(ACCOUNT, TOKEN, { keychain: null, dir: d });
+        expect(statSync(file).mode & 0o077).toBe(0);
+    });
+});
+describe("the OS stores", () => {
+    function recorder(status = 0, stdout = "") {
+        const calls = [];
+        return {
+            calls,
+            run: (cmd, args, input) => {
+                calls.push({ cmd, args, input });
+                return { status, stdout, stderr: "" };
+            },
+        };
+    }
+    // A command line is visible to every process on the machine; stdin is not.
+    for (const platform of ["darwin", "linux", "win32"]) {
+        it(`${platform}: never puts the token on a command line`, () => {
+            const r = recorder();
+            const kc = platformKeychain(platform, r.run);
+            expect(kc).not.toBeNull();
+            kc.set(ACCOUNT, TOKEN);
+            expect(r.calls.length).toBeGreaterThan(0);
+            for (const c of r.calls) {
+                expect(c.args.join(" ")).not.toContain(TOKEN);
+                expect(c.cmd).not.toContain(TOKEN);
+            }
+            expect(r.calls.some((c) => c.input?.includes(TOKEN))).toBe(true);
+        });
+        it(`${platform}: reads the token from the store's output`, () => {
+            const r = recorder(0, `${TOKEN}\n`);
+            expect(platformKeychain(platform, r.run).get(ACCOUNT)).toBe(TOKEN);
+        });
+        it(`${platform}: a failing store reads as nothing stored`, () => {
+            const r = recorder(1, "");
+            const kc = platformKeychain(platform, r.run);
+            expect(kc.get(ACCOUNT)).toBeNull();
+            expect(kc.set(ACCOUNT, TOKEN)).toBe(false);
+        });
+    }
+    it("has no store on an unknown platform", () => {
+        expect(platformKeychain("aix", recorder().run)).toBeNull();
+    });
+});
+//# sourceMappingURL=credential.test.js.map

package/dist/goshtiChannel/credential.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.test.js","sourceRoot":"","sources":["../../src/goshtiChannel/credential.test.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,8EAA8E;AAC9E,0BAA0B;AAE1B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAGhB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,KAAK,GAAG,8BAA8B,CAAC;AAC7C,MAAM,OAAO,GAAG,0BAA0B,CAAC;AAE3C,SAAS,GAAG;IACV,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK;QACL,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI;QAChC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC;QACtC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;IAC9G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,MAAM,MAAM,GAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QACpG,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACxF,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5D,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QAC5B,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1D,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5D,gBAAgB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,gEAAgE;QAChE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7E,CAAC;gBAAS,CAAC;YACT,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO;QACzC,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACzC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,SAAS,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,EAAE;QACvC,MAAM,KAAK,GAA2D,EAAE,CAAC;QACzE,OAAO;YACL,KAAK;YACL,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;gBACxB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACxC,CAAC;SACF,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,KAAK,MAAM,QAAQ,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QAC7D,EAAE,CAAC,GAAG,QAAQ,0CAA0C,EAAE,GAAG,EAAE;YAC7D,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;YACrB,MAAM,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1B,EAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACxB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC9C,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,GAAG,QAAQ,2CAA2C,EAAE,GAAG,EAAE;YAC9D,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,GAAG,QAAQ,2CAA2C,EAAE,GAAG,EAAE;YAC9D,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAE,CAAC;YAC9C,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/goshtiChannel/e2e.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=e2e.test.d.ts.map

package/dist/goshtiChannel/e2e.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e.test.d.ts","sourceRoot":"","sources":["../../src/goshtiChannel/e2e.test.ts"],"names":[],"mappings":""}

package/dist/goshtiChannel/e2e.test.js

@@ -0,0 +1,163 @@
+// The real entry point, spawned the way Claude Code spawns it, against a local
+// stand-in for Goshti (REST + WebSocket). Covers what the unit tests cannot:
+// that a failure reaches the session as a channel notification rather than a
+// silent idle server, and that a trigger posted in Goshti arrives and can be
+// answered in its thread.
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { z } from "zod";
+import { WebSocketServer } from "ws";
+const ENTRY = resolve(__dirname, "..", "goshtiChannel.ts");
+const TOKEN = "e2e-token-not-real";
+const Note = z.object({
+    method: z.literal("notifications/claude/channel"),
+    params: z.object({ content: z.string(), meta: z.record(z.string(), z.string()) }),
+});
+const cleanups = [];
+afterEach(async () => {
+    for (const c of cleanups.splice(0).reverse())
+        await c();
+});
+function home(config, credential = true) {
+    const d = mkdtempSync(join(tmpdir(), "goshti-e2e-"));
+    if (config)
+        writeFileSync(join(d, "config.json"), JSON.stringify(config));
+    if (credential && config) {
+        writeFileSync(join(d, "credentials.json"), JSON.stringify({ accounts: { [String(config.url)]: TOKEN } }), {
+            mode: 0o600,
+        });
+    }
+    return d;
+}
+async function start(dir) {
+    const notes = [];
+    const client = new Client({ name: "e2e", version: "0" }, { capabilities: {} });
+    client.setNotificationHandler(Note, async (n) => {
+        notes.push(n.params);
+    });
+    const transport = new StdioClientTransport({
+        command: process.execPath,
+        args: ["--import", "tsx", ENTRY],
+        env: { ...process.env, GOSHTI_CHANNEL_HOME: dir },
+        stderr: "pipe",
+    });
+    await client.connect(transport);
+    cleanups.push(() => client.close());
+    return { client, notes };
+}
+async function until(cond, ms = 15_000) {
+    const t = Date.now();
+    while (!cond()) {
+        if (Date.now() - t > ms)
+            throw new Error("timed out");
+        await new Promise((r) => setTimeout(r, 25));
+    }
+}
+async function goshti(opts = {}) {
+    const posts = [];
+    const http = createServer((req, res) => {
+        if (req.headers.authorization !== `Bearer ${TOKEN}` || opts.refuse) {
+            res.writeHead(401).end("{}");
+            return;
+        }
+        if (req.url === "/api/v4/users/me") {
+            res.end(JSON.stringify({ id: "me1", username: "sumit", is_bot: false }));
+        }
+        else if (req.url === "/api/v4/posts" && req.method === "POST") {
+            let body = "";
+            req.on("data", (c) => (body += c));
+            req.on("end", () => {
+                posts.push(JSON.parse(body));
+                res.writeHead(201).end(JSON.stringify({ id: "reply1" }));
+            });
+        }
+        else {
+            res.writeHead(404).end("{}");
+        }
+    });
+    const wss = new WebSocketServer({ noServer: true });
+    let current;
+    http.on("upgrade", (req, sock, head) => {
+        wss.handleUpgrade(req, sock, head, (ws) => {
+            current = ws;
+            ws.on("message", (raw) => {
+                const f = JSON.parse(raw.toString());
+                if (f.action === "authentication_challenge") {
+                    ws.send(JSON.stringify({ seq_reply: f.seq, status: "OK" }));
+                    ws.send(JSON.stringify({ event: "hello", data: {} }));
+                }
+            });
+        });
+    });
+    await new Promise((r) => http.listen(0, "127.0.0.1", r));
+    cleanups.push(() => new Promise((r) => {
+        for (const c of wss.clients)
+            c.terminate();
+        http.close(() => r());
+    }));
+    return { url: `http://127.0.0.1:${http.address().port}`, posts, socket: () => current };
+}
+describe("goshti-channel as Claude Code runs it", { timeout: 30_000 }, () => {
+    it("declares the channel capability and the reply tool", async () => {
+        const { client } = await start(home(null));
+        expect(client.getServerCapabilities()?.experimental).toHaveProperty("claude/channel");
+        const tools = await client.listTools();
+        expect(tools.tools.map((t) => t.name)).toEqual(["goshti_reply"]);
+    });
+    it("tells the session it is not set up, rather than idling silently", async () => {
+        const { notes } = await start(home(null));
+        await until(() => notes.length > 0);
+        expect(notes[0].meta).toMatchObject({ source: "goshti", status: "offline", reason: "not_configured" });
+        expect(notes[0].content).toMatch(/goshti-channel setup/);
+    });
+    // Spec: "Token revoked".
+    it("tells the session the channel is offline when the token is refused", async () => {
+        const g = await goshti({ refuse: true });
+        const { notes } = await start(home({ url: g.url }));
+        await until(() => notes.length > 0);
+        expect(notes[0].meta).toMatchObject({ status: "offline", reason: "token_refused" });
+        expect(notes[0].content).toMatch(/revoked|expired/);
+    });
+    it("delivers the person's trigger and answers in its thread, marked", async () => {
+        const g = await goshti();
+        const { client, notes } = await start(home({ url: g.url }));
+        await until(() => g.socket() !== undefined);
+        // Give the hello a moment to land before posting.
+        await new Promise((r) => setTimeout(r, 200));
+        g.socket().send(JSON.stringify({
+            event: "posted",
+            data: {
+                post: JSON.stringify({ id: "p1", channel_id: "c1", user_id: "me1", root_id: "", message: "@claude hello", type: "", props: {} }),
+                channel_type: "O",
+                channel_name: "town-square",
+                sender_name: "@sumit",
+            },
+        }));
+        g.socket().send(JSON.stringify({
+            event: "posted",
+            data: {
+                post: JSON.stringify({ id: "p2", channel_id: "c1", user_id: "col1", root_id: "", message: "@claude rm -rf", type: "", props: {} }),
+                channel_type: "O",
+                channel_name: "town-square",
+                sender_name: "@alice",
+            },
+        }));
+        await until(() => notes.some((n) => n.meta.post_id === "p1"));
+        await new Promise((r) => setTimeout(r, 200));
+        expect(notes.filter((n) => n.meta.type === "post").map((n) => n.meta.post_id)).toEqual(["p1"]);
+        const refused = await client.callTool({ name: "goshti_reply", arguments: { post_id: "p2", text: "no" } });
+        expect(refused.isError).toBe(true);
+        expect(g.posts).toHaveLength(0);
+        const ok = await client.callTool({ name: "goshti_reply", arguments: { post_id: "p1", text: "Hi!" } });
+        expect(ok.isError).toBe(false);
+        expect(g.posts).toHaveLength(1);
+        expect(g.posts[0]).toMatchObject({ channel_id: "c1", root_id: "p1", props: { from_claude: "true" } });
+        expect(String(g.posts[0].message)).toMatch(/^Hi![\s\S]*via Claude, for @sumit/);
+    });
+});
+//# sourceMappingURL=e2e.test.js.map

package/dist/goshtiChannel/e2e.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e.test.js","sourceRoot":"","sources":["../../src/goshtiChannel/e2e.test.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,0BAA0B;AAE1B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,YAAY,EAA6B,MAAM,WAAW,CAAC;AAEpE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAkB,MAAM,IAAI,CAAC;AAErD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AAC3D,MAAM,KAAK,GAAG,oBAAoB,CAAC;AAEnC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;CAClF,CAAC,CAAC;AAGH,MAAM,QAAQ,GAAsC,EAAE,CAAC;AACvD,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,SAAS,IAAI,CAAC,MAAsC,EAAE,UAAU,GAAG,IAAI;IACrE,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACrD,IAAI,MAAM;QAAE,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QACzB,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE;YACxG,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAW;IAC9B,MAAM,KAAK,GAAY,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;QACzC,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC;QAChC,GAAG,EAAE,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE,mBAAmB,EAAE,GAAG,EAAE;QAC7E,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAmB,EAAE,EAAE,GAAG,MAAM;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACf,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,MAAM,CAAC,OAA6B,EAAE;IACnD,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,MAAM,IAAI,GAAe,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACjD,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,UAAU,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACnE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,KAAK,kBAAkB,EAAE,CAAC;YACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC;aAAM,IAAI,GAAG,CAAC,GAAG,KAAK,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChE,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,OAA8B,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACrC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YACxC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;oBAC5C,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBAC5D,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,IAAI,CACX,GAAG,EAAE,CACH,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE;QACtB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO;YAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CACL,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,oBAAqB,IAAI,CAAC,OAAO,EAAkB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;AAC3G,CAAC;AAED,QAAQ,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE;IAC1E,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,YAAY,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACvG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,yBAAyB;IACzB,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,SAAS,CAAC,CAAC;QAC5C,kDAAkD;QAClD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,MAAM,EAAG,CAAC,IAAI,CACd,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE;gBACJ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;gBAChI,YAAY,EAAE,GAAG;gBACjB,YAAY,EAAE,aAAa;gBAC3B,WAAW,EAAE,QAAQ;aACtB;SACF,CAAC,CACH,CAAC;QACF,CAAC,CAAC,MAAM,EAAG,CAAC,IAAI,CACd,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE;gBACJ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;gBAClI,YAAY,EAAE,GAAG;gBACjB,YAAY,EAAE,aAAa;gBAC3B,WAAW,EAAE,QAAQ;aACtB;SACF,CAAC,CACH,CAAC;QACF,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC;QAC9D,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1G,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEhC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACtG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}