claude-opencode-mcp 1.0.0

package/dist/workspace/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/workspace/context.ts"],"names":[],"mappings":"AAaA,SAAS,eAAe,CAAC,YAAiC;IACxD,OAAO;QACL,iBAAiB,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC9D,qBAAqB,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrE,sBAAsB,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;KAC7D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,YAAiC;IACzD,MAAM,KAAK,GAAG;QACZ,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,+FAA+F;KAChG,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,qFAAqF,CACtF,CAAC;QACF,KAAK,CAAC,IAAI,CACR,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CACR,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAuB;IACrD,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAClE,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,GAAG,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7C,CAAC,CAAC,uDAAuD,CAAC;IAE9D,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,cAAc,SAAS,CAAC,GAAG,EAAE;YAC7B,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;YAC3D,UAAU,SAAS,EAAE;YACrB,EAAE;YACF,OAAO;YACP,IAAI;YACJ,EAAE;YACF,cAAc;YACd,eAAe,CAAC,YAAY,CAAC;SAC9B;aACE,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAED,OAAO;QACL,YAAY;QACZ,SAAS,CAAC,GAAG;QACb,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,kCAAkC;QACzF,EAAE;QACF,UAAU,SAAS,EAAE;QACrB,EAAE;QACF,OAAO;QACP,IAAI;QACJ,EAAE;QACF,wDAAwD;QACxD,SAAS;QACT,EAAE;QACF,cAAc;QACd,eAAe,CAAC,YAAY,CAAC;QAC7B,EAAE;QACF,eAAe;QACf,gBAAgB,CAAC,YAAY,CAAC;KAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/workspace/resolver.d.ts

@@ -0,0 +1,35 @@
+import { type LoadedConfig, type ResolvedConfig } from "../config/config.js";
+import type { AgentWorkspace } from "../types/index.js";
+export interface ResolveWorkspaceInput {
+    /** Explicit cwd supplied to the MCP tool. */
+    cwd?: string | undefined;
+    env?: NodeJS.ProcessEnv;
+    /** Global config loaded before workspace resolution. */
+    globalConfig?: ResolvedConfig;
+    /** Override how per-workspace configuration is loaded (used for tests/embedding). */
+    loadProjectConfig?: (cwd: string) => Promise<LoadedConfig>;
+}
+export interface WorkspaceResolution {
+    workspace: AgentWorkspace;
+    config: ResolvedConfig;
+    configSources: string[];
+    warnings: string[];
+}
+export interface WorkspaceCandidate {
+    path: string;
+    required: boolean;
+    origin: "cwd" | "CLAUDE_PROJECT_DIR" | "process.cwd" | "workspace.defaultCwd";
+}
+/**
+ * Workspace resolution priority (PRD §4.1):
+ *   1. explicit `cwd`
+ *   2. `CLAUDE_PROJECT_DIR` (set by Claude Code for stdio MCP servers)
+ *   3. the MCP server process working directory
+ *   4. configured `workspace.defaultCwd`
+ *
+ * The first two are "required": when they are present and invalid the bridge
+ * fails loudly instead of silently delegating somewhere else.
+ */
+export declare function candidateWorkspacePaths(input: ResolveWorkspaceInput): WorkspaceCandidate[];
+export declare function resolveWorkspace(input?: ResolveWorkspaceInput): Promise<WorkspaceResolution>;
+export declare function resolveWorkspaceHints(cwd: string, hints: string[] | undefined): string[];

package/dist/workspace/resolver.js

@@ -0,0 +1,112 @@
+import path from "node:path";
+import { loadConfig } from "../config/config.js";
+import { BridgeError } from "../errors.js";
+import { resolvePathHint } from "../security/paths.js";
+import { validateWorkspace } from "./validator.js";
+/**
+ * Workspace resolution priority (PRD §4.1):
+ *   1. explicit `cwd`
+ *   2. `CLAUDE_PROJECT_DIR` (set by Claude Code for stdio MCP servers)
+ *   3. the MCP server process working directory
+ *   4. configured `workspace.defaultCwd`
+ *
+ * The first two are "required": when they are present and invalid the bridge
+ * fails loudly instead of silently delegating somewhere else.
+ */
+export function candidateWorkspacePaths(input) {
+    const env = input.env ?? process.env;
+    const candidates = [];
+    if (input.cwd?.trim()) {
+        candidates.push({ path: input.cwd.trim(), required: true, origin: "cwd" });
+    }
+    const claudeProjectDir = env.CLAUDE_PROJECT_DIR;
+    if (claudeProjectDir?.trim()) {
+        candidates.push({
+            path: claudeProjectDir.trim(),
+            required: true,
+            origin: "CLAUDE_PROJECT_DIR",
+        });
+    }
+    candidates.push({ path: process.cwd(), required: false, origin: "process.cwd" });
+    const defaultCwd = input.globalConfig?.workspace.defaultCwd;
+    if (defaultCwd?.trim()) {
+        candidates.push({ path: defaultCwd.trim(), required: false, origin: "workspace.defaultCwd" });
+    }
+    const seen = new Set();
+    const unique = [];
+    for (const candidate of candidates) {
+        const key = path.resolve(candidate.path);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        unique.push(candidate);
+    }
+    return unique;
+}
+export async function resolveWorkspace(input = {}) {
+    const env = input.env ?? process.env;
+    let baseConfig;
+    if (input.globalConfig) {
+        baseConfig = input.globalConfig;
+    }
+    else {
+        baseConfig = (await loadConfig({ env })).config;
+    }
+    const candidates = candidateWorkspacePaths({ ...input, env });
+    const failures = [];
+    for (const candidate of candidates) {
+        let validated;
+        try {
+            validated = await validateWorkspace({
+                requestedPath: candidate.path,
+                allowedRoots: baseConfig.workspace.allowedRoots,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (candidate.required)
+                throw error;
+            failures.push(`${candidate.origin} (${candidate.path}): ${message}`);
+            continue;
+        }
+        let loaded;
+        try {
+            loaded = input.loadProjectConfig
+                ? await input.loadProjectConfig(validated.cwd)
+                : await loadConfig({ cwd: validated.cwd, env });
+        }
+        catch (error) {
+            if (error instanceof BridgeError && error.code === "CONFIG_INVALID")
+                throw error;
+            loaded = { config: baseConfig, sources: [] };
+        }
+        let finalValidated = validated;
+        const rootsChanged = loaded.config.workspace.allowedRoots.join("\u0000") !==
+            baseConfig.workspace.allowedRoots.join("\u0000");
+        if (rootsChanged) {
+            finalValidated = await validateWorkspace({
+                requestedPath: validated.cwd,
+                allowedRoots: loaded.config.workspace.allowedRoots,
+            });
+        }
+        const workspace = {
+            cwd: validated.cwd,
+            requestedPath: validated.requestedPath,
+            readOnly: false,
+            ...(finalValidated.gitRoot ? { gitRoot: finalValidated.gitRoot } : {}),
+        };
+        return {
+            workspace,
+            config: loaded.config,
+            configSources: loaded.sources,
+            warnings: [...finalValidated.warnings],
+        };
+    }
+    throw new BridgeError("WORKSPACE_NOT_FOUND", "Unable to determine project workspace. Provide cwd explicitly.", { details: { candidates: candidates.map((c) => `${c.origin}:${c.path}`), failures } });
+}
+export function resolveWorkspaceHints(cwd, hints) {
+    if (!hints || hints.length === 0)
+        return [];
+    return hints.map((hint) => resolvePathHint(cwd, hint));
+}
+//# sourceMappingURL=resolver.js.map

package/dist/workspace/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/workspace/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAqB,UAAU,EAAuB,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAA2B,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAyB5E;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA4B;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;QACtB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAChD,IAAI,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE;YAC7B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,oBAAoB;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC,UAAU,CAAC;IAC5D,IAAI,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,IAAI,UAA0B,CAAC;IAC/B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,CAAC;IAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAA6B,CAAC;QAClC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,iBAAiB,CAAC;gBAClC,aAAa,EAAE,SAAS,CAAC,IAAI;gBAC7B,YAAY,EAAE,UAAU,CAAC,SAAS,CAAC,YAAY;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,SAAS,CAAC,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;QAED,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,KAAK,CAAC,iBAAiB;gBAC9B,CAAC,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC;gBAC9C,CAAC,CAAC,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACjF,MAAM,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC/C,CAAC;QAED,IAAI,cAAc,GAAG,SAAS,CAAC;QAC/B,MAAM,YAAY,GAChB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnD,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,YAAY,EAAE,CAAC;YACjB,cAAc,GAAG,MAAM,iBAAiB,CAAC;gBACvC,aAAa,EAAE,SAAS,CAAC,GAAG;gBAC5B,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY;aACnD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAmB;YAChC,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,QAAQ,EAAE,KAAK;YACf,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;QAEF,OAAO;YACL,SAAS;YACT,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,aAAa,EAAE,MAAM,CAAC,OAAO;YAC7B,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,gEAAgE,EAChE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CACtF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,KAA2B;IAC5E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/workspace/validator.d.ts

@@ -0,0 +1,13 @@
+export interface ValidateWorkspaceOptions {
+    /** Requested path (absolute or relative to process.cwd()). */
+    requestedPath: string;
+    /** When non-empty, the canonical workspace must live inside one of these roots. */
+    allowedRoots?: string[];
+}
+export interface ValidatedWorkspace {
+    cwd: string;
+    requestedPath: string;
+    gitRoot?: string;
+    warnings: string[];
+}
+export declare function validateWorkspace(options: ValidateWorkspaceOptions): Promise<ValidatedWorkspace>;

package/dist/workspace/validator.js

@@ -0,0 +1,102 @@
+import fs from "node:fs";
+import path from "node:path";
+import { BridgeError } from "../errors.js";
+import { isPathInside } from "../security/paths.js";
+import { findGitRoot } from "../util/git.js";
+async function canonicalizeRoots(roots) {
+    const canonical = [];
+    const warnings = [];
+    for (const root of roots) {
+        const resolved = path.resolve(root);
+        try {
+            const real = await fs.promises.realpath(resolved);
+            const stat = await fs.promises.stat(real);
+            if (!stat.isDirectory()) {
+                warnings.push(`allowed root is not a directory and was ignored: ${root}`);
+                continue;
+            }
+            canonical.push(real);
+        }
+        catch {
+            warnings.push(`allowed root does not exist and was ignored: ${root}`);
+        }
+    }
+    return { roots: canonical, warnings };
+}
+export async function validateWorkspace(options) {
+    const warnings = [];
+    const requestedPath = options.requestedPath;
+    if (!requestedPath?.trim()) {
+        throw new BridgeError("WORKSPACE_NOT_FOUND", "Unable to determine project workspace. Provide cwd explicitly.");
+    }
+    const absolute = path.isAbsolute(requestedPath)
+        ? path.resolve(requestedPath)
+        : path.resolve(process.cwd(), requestedPath);
+    let stat;
+    try {
+        stat = await fs.promises.stat(absolute);
+    }
+    catch (error) {
+        const errno = error.code;
+        if (errno === "ENOENT") {
+            throw new BridgeError("WORKSPACE_NOT_FOUND", `Workspace does not exist: ${absolute}`, {
+                details: { cwd: absolute },
+                cause: error,
+            });
+        }
+        if (errno === "EACCES" || errno === "EPERM") {
+            throw new BridgeError("WORKSPACE_NOT_READABLE", `Workspace is not readable: ${absolute}`, {
+                details: { cwd: absolute },
+                cause: error,
+            });
+        }
+        throw new BridgeError("WORKSPACE_NOT_FOUND", `Workspace cannot be accessed: ${absolute}`, {
+            details: { cwd: absolute, reason: errno },
+            cause: error,
+        });
+    }
+    if (!stat.isDirectory()) {
+        throw new BridgeError("INVALID_PATH", `Workspace is not a directory: ${absolute}`, {
+            details: { cwd: absolute },
+        });
+    }
+    let canonical;
+    try {
+        canonical = await fs.promises.realpath(absolute);
+    }
+    catch (error) {
+        throw new BridgeError("WORKSPACE_NOT_READABLE", `Workspace cannot be resolved: ${absolute}`, {
+            details: { cwd: absolute },
+            cause: error,
+        });
+    }
+    try {
+        await fs.promises.access(canonical, fs.constants.R_OK | fs.constants.X_OK);
+    }
+    catch (error) {
+        throw new BridgeError("WORKSPACE_NOT_READABLE", `Workspace is not readable: ${canonical}`, {
+            details: { cwd: canonical },
+            cause: error,
+        });
+    }
+    const allowedRoots = options.allowedRoots ?? [];
+    if (allowedRoots.length > 0) {
+        const { roots, warnings: rootWarnings } = await canonicalizeRoots(allowedRoots);
+        warnings.push(...rootWarnings);
+        if (roots.length === 0) {
+            throw new BridgeError("WORKSPACE_NOT_ALLOWED", "No configured workspace.allowedRoots entry exists; refusing to delegate.", { details: { allowedRoots } });
+        }
+        const inside = roots.some((root) => isPathInside(root, canonical));
+        if (!inside) {
+            throw new BridgeError("WORKSPACE_NOT_ALLOWED", `Workspace is outside the configured allowed roots: ${canonical}`, { details: { cwd: canonical, allowedRoots: roots } });
+        }
+    }
+    const gitRoot = await findGitRoot(canonical);
+    return {
+        cwd: canonical,
+        requestedPath,
+        ...(gitRoot ? { gitRoot } : {}),
+        warnings,
+    };
+}
+//# sourceMappingURL=validator.js.map

package/dist/workspace/validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../src/workspace/validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAgB7C,KAAK,UAAU,iBAAiB,CAC9B,KAAe;IAEf,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;gBAC1E,SAAS;YACX,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC;IAEjC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IAE/C,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAI,KAA+B,CAAC,IAAI,CAAC;QACpD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,6BAA6B,QAAQ,EAAE,EAAE;gBACpF,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;gBAC1B,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YAC5C,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,8BAA8B,QAAQ,EAAE,EAAE;gBACxF,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;gBAC1B,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,iCAAiC,QAAQ,EAAE,EAAE;YACxF,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE;YACzC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,iCAAiC,QAAQ,EAAE,EAAE;YACjF,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,iCAAiC,QAAQ,EAAE,EAAE;YAC3F,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;YAC1B,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,8BAA8B,SAAS,EAAE,EAAE;YACzF,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;YAC3B,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAChD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,WAAW,CACnB,uBAAuB,EACvB,0EAA0E,EAC1E,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,CAC9B,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CACnB,uBAAuB,EACvB,sDAAsD,SAAS,EAAE,EACjE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;IAE7C,OAAO;QACL,GAAG,EAAE,SAAS;QACd,aAAa;QACb,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/docs/agent-configuration.md

@@ -0,0 +1,100 @@
+# Agent configuration
+
+The bridge ships four agents. Their prompts live in [`agents/`](../agents/) as
+markdown with YAML frontmatter, and they are injected into the OpenCode server
+configuration at startup.
+
+| Agent | Profile | read | edit | bash | Purpose |
+| --- | --- | --- | --- | --- | --- |
+| `deepseek-researcher` | `read` | allow | deny | deny | architecture, exploration, dependency analysis, recommendations |
+| `deepseek-reviewer` | `review` | allow | deny | deny | code review, bugs, regressions, security, architecture |
+| `deepseek-coder` | `code` | allow | allow | allow (no `git commit`/`git push`) | implementation, refactoring, tests |
+| `deepseek-tester` | `test` | allow | deny | allow (no `git commit`/`git push`) | run tests, diagnose failures, suggest fixes |
+
+Profiles also deny `external_directory`, `task`, `question` and `doom_loop`, and
+never emit `ask` rules (a headless bridge cannot answer them).
+
+## Customizing a built-in agent
+
+Create a project-local file with the same name:
+
+```markdown
+---
+description: My strict reviewer
+model: deepseek/deepseek-v4-pro
+temperature: 0
+---
+
+You are a security-focused reviewer. ...
+```
+
+Place it in `<project>/.claude-opencode/agents/deepseek-reviewer.md`. The file
+overrides the description, prompt, model and temperature. Permissions still come
+from the `review` profile — the frontmatter cannot widen them.
+
+## Adding a new agent
+
+```markdown
+---
+description: Database migration specialist
+mode: all
+profile: code
+model: deepseek/deepseek-v4-pro
+temperature: 0.1
+---
+
+You are a database migration specialist. ...
+```
+
+Save it as `<project>/.claude-opencode/agents/db-migrator.md`. It appears in
+`list_agents` and can be used with `delegate_task({ agent: "db-migrator" })`.
+
+Supported frontmatter keys:
+
+| Key | Values | Notes |
+| --- | --- | --- |
+| `description` | string | Shown by `list_agents`; required for usefulness. |
+| `mode` | `primary`, `subagent`, `all` | Defaults to `all`. |
+| `profile` | `read`, `review`, `code`, `test` | Selects the permission policy. Defaults by name heuristics; unknown names get `read` (safest). |
+| `model` | `provider/model` | Overrides the bridge default. |
+| `temperature` | number | Passed to the provider. |
+
+The prompt is the markdown body.
+
+## Overriding agents in config
+
+The same values can be set in JSON, which is handy for global defaults:
+
+```json
+{
+  "agents": {
+    "deepseek-coder": { "model": "deepseek/deepseek-v4-pro", "temperature": 0.1 },
+    "deepseek-tester": { "enabled": false }
+  }
+}
+```
+
+Precedence: config `agents` > project markdown > built-in markdown.
+
+## Writing a good prompt
+
+The bridge appends the workspace, task, path hints, and permission summary to
+every delegated message, and asks agents to finish with a structured response:
+
+- `## Summary`
+- `## Findings` for review agents, using
+  `- [severity: high] Title (path/to/file:42) — detail` so findings come back
+  as structured JSON
+- `## Changes`, `## Verification`, `## Follow-ups` for coder agents
+
+Keep custom prompts aligned with that contract: the orchestrator depends on the
+structure.
+
+## What the bridge does not do
+
+- It does not copy repository contents into prompts. Agents read files through
+  OpenCode's tools.
+- It does not restrict agents to the `paths` hints. Those are starting points;
+  agents may inspect anything inside the workspace.
+- It does not let a project agent override permissions from frontmatter. Edit
+  `security.*` or the bridge source if a policy change is needed.

package/docs/architecture.md

@@ -0,0 +1,115 @@
+# Architecture
+
+The bridge is intentionally thin. It owns workspace resolution, security
+policy, session bookkeeping, and the MCP surface. Everything else is OpenCode's
+job.
+
+```text
+┌────────────────────────────────────────────────────────────────────┐
+│ Claude Code                                                        │
+│  · understands the request, decomposes work, picks agents          │
+│  · calls mcp__opencode__* tools                                    │
+└───────────────────────────────┬────────────────────────────────────┘
+                                │ MCP over stdio
+┌───────────────────────────────▼────────────────────────────────────┐
+│ claude-opencode-mcp                                                │
+│                                                                    │
+│  mcp/server.ts ── tools/*.ts   seven tools, zod schemas            │
+│  workspace/*                  resolution, validation, context      │
+│  security/*                   path policy, permission profiles     │
+│  config/config.ts             layered configuration                │
+│  opencode/manager.ts          one server per workspace, LRU        │
+│  opencode/agents.ts           built-in + project agent definitions │
+│  opencode/run.ts              prompt, poll, timeout, abort         │
+│  opencode/sessions.ts         registry persisted to disk           │
+│  opencode/permission-watcher  auto-reject asks over SSE            │
+└───────────────┬────────────────────────────────────────────────────┘
+                │ @opencode-ai/sdk (v1 HTTP API) + OPENCODE_CONFIG_CONTENT
+┌───────────────▼────────────────────────────────────────────────────┐
+│ OpenCode server (one per workspace directory)                      │
+│  · tools: read, glob, grep, edit, write, apply_patch, bash, …      │
+│  · sessions, permissions, LSP, providers                           │
+└───────────────┬────────────────────────────────────────────────────┘
+                │ provider API (DeepSeek by default)
+                ▼
+        DeepSeek / any configured provider
+                │
+                ▼
+        the same project/worktree
+```
+
+## Components
+
+| Module | Responsibility |
+| --- | --- |
+| `src/index.ts` | CLI: default command runs the MCP stdio server; `init` subcommand. |
+| `src/mcp/server.ts` | Creates `McpServer`, registers tools, passes app context. |
+| `src/mcp/tools/*` | Thin validation + orchestration per tool. |
+| `src/mcp/execute.ts` | Run lifecycle: registry status, run, truncate, count files. |
+| `src/workspace/resolver.ts` | Resolution priority and project-config loading. |
+| `src/workspace/validator.ts` | Existence, readability, canonicalization, allowed roots, git root. |
+| `src/security/policy.ts` | Maps agent profiles to OpenCode permission configs. |
+| `src/opencode/manager.ts` | Server lifecycle, auth, health, LRU, crash detection. |
+| `src/opencode/run.ts` | `session.prompt` + polling progress + timeout/abort + result extraction. |
+| `src/opencode/agents.ts` | Loads prompts, merges overrides, emits OpenCode agent config. |
+| `src/opencode/sessions.ts` | Session registry with atomic persistence and pruning. |
+| `src/opencode/permission-watcher.ts` | SSE watcher that rejects stray permission asks. |
+| `src/util/git.ts` | Non-invasive baseline (`git stash create`) and diff since baseline. |
+
+## Request flow for `delegate_task`
+
+```text
+1. Resolve + validate workspace            (workspace/*)
+2. Load project config, merge agents       (config/, opencode/agents.ts)
+3. Ensure OpenCode server for the cwd      (opencode/manager.ts)
+   · spawn `opencode serve` with OPENCODE_CONFIG_CONTENT
+   · wait for "listening", poll /global/health
+4. Resolve model (request → config → provider default)
+5. Create session, capture git baseline    (opencode/sessions.ts, util/git.ts)
+6. POST /session/:id/message with agent + model + parts
+7. While pending: poll status/messages, emit MCP progress notifications
+8. On completion: read assistant message, map errors, extract findings
+9. Count files changed from the baseline, persist result, return JSON
+```
+
+## Why these choices
+
+- **One server per workspace** keeps OpenCode's project configuration, cwd and
+  snapshots honest, and avoids per-request directory routing bugs.
+  Per-request `x-opencode-directory` remains available in the SDK but the
+  bridge does not rely on it for isolation.
+- **Sync prompt + polling** instead of streaming: the v1 HTTP API returns the
+  final assistant message from `POST /session/:id/message`, which gives a
+  definitive completion signal. Progress is reported to Claude Code via MCP
+  notifications.
+- **Git baseline for diffs**: OpenCode 1.18's `GET /session/:id/diff` returns
+  empty for API-driven sessions in testing, so the bridge computes
+  `git diff` against a baseline captured at session creation
+  (`git stash create` for dirty trees) plus new untracked files. Pre-existing
+  uncommitted work is therefore not attributed to the agent.
+- **Inline agent config** (`OPENCODE_CONFIG_CONTENT`) instead of writing files
+  into the repository: permissions cannot be forgotten, and the project tree
+  stays untouched.
+- **No ask rules + SSE auto-reject**: a headless bridge must never block on
+  human approval.
+
+## Error model
+
+`BridgeError` carries a stable code, message, optional details, and a
+`retryable` flag. Tools catch it and return `isError: true` with
+`{ "error": { code, message, details?, retryable, request_id } }`. The codes are
+listed in [troubleshooting.md](troubleshooting.md#error-codes) and in
+`src/errors.ts`.
+
+## State on disk
+
+| Path | Contents |
+| --- | --- |
+| `~/.config/claude-opencode-mcp/config.json` | global configuration |
+| `<project>/.claude-opencode/config.json` | project configuration |
+| `<project>/.claude-opencode/agents/*.md` | optional project agents |
+| `~/.local/state/claude-opencode-mcp/sessions.json` | session registry |
+| `~/.local/state/claude-opencode-mcp/bridge.log` | rotating log (5 MB) |
+
+No state is written into the repository except what `init` creates inside
+`.claude-opencode/`.

package/docs/claude-code-setup.md

@@ -0,0 +1,116 @@
+# Claude Code setup
+
+## Add the MCP server
+
+### Project scope (recommended)
+
+Create `.mcp.json` at your project root:
+
+```json
+{
+  "mcpServers": {
+    "opencode": {
+      "command": "npx",
+      "args": ["-y", "claude-opencode-mcp"],
+      "type": "stdio",
+      "timeout": 600000
+    }
+  }
+}
+```
+
+Claude Code asks for approval the first time it loads a project-scoped server in
+an interactive session. Commit `.mcp.json` to share the setup with your team.
+
+### CLI
+
+```bash
+# project scope (writes/updates .mcp.json)
+claude mcp add opencode --scope project -- npx -y claude-opencode-mcp
+
+# user scope (all projects, private to you)
+claude mcp add opencode --scope user -- npx -y claude-opencode-mcp
+```
+
+The `--` separator is required: everything after it is the command Claude Code
+runs.
+
+### Global install without npx
+
+```bash
+npm install -g claude-opencode-mcp
+claude mcp add opencode --scope user -- claude-opencode-mcp
+```
+
+For a local checkout:
+
+```bash
+npm install && npm run build
+claude mcp add opencode --scope local -- node /absolute/path/to/dist/index.js
+```
+
+## Verify
+
+```bash
+claude mcp list
+# opencode: npx -y claude-opencode-mcp - ✔ Connected
+```
+
+Inside Claude Code, `/mcp` shows the server and the seven tools with the
+`mcp__opencode__` prefix.
+
+## Important timeout settings
+
+Delegated runs are long. Three independent limits matter:
+
+1. **Per-tool timeout** — the `timeout` field in `.mcp.json` (milliseconds) or
+   `MCP_TOOL_TIMEOUT`. Set it to at least your `timeouts.execution`
+   (default 10 minutes).
+2. **Automatic backgrounding** — after two minutes Claude Code moves a
+   main-conversation tool call to a background task and continues working; the
+   result arrives as a task notification. No configuration needed.
+3. **Idle timeout** — 30 minutes for stdio servers: a tool call that produces
+   no response and no progress notification for that long is aborted. The
+   bridge sends MCP progress notifications during runs, so this does not fire
+   for active work.
+
+## How the workspace is chosen
+
+Claude Code sets `CLAUDE_PROJECT_DIR` for stdio MCP servers. The bridge uses:
+
+1. an explicit `cwd` argument,
+2. `CLAUDE_PROJECT_DIR`,
+3. the server process working directory,
+4. `workspace.defaultCwd`.
+
+The first two must be valid when present, so delegation cannot silently switch
+projects.
+
+## Example prompts
+
+```text
+Use delegate_task with deepseek-researcher to find where authentication is
+implemented and list the relevant files.
+
+Have deepseek-coder fix the bug in src/auth/session.ts, run the tests, and
+report the changes. Then call get_diff on that session.
+
+Create a session with deepseek-researcher, ask it to inspect the payments
+module, then send follow-up messages about dependencies it found.
+
+Ask the reviewer to check the diff, then the tester to run the suite.
+```
+
+## Multiple projects
+
+Each workspace gets its own lazily started OpenCode server, so you can delegate
+into more than one repository from the same Claude Code session by passing
+`cwd`. Use `workspace.allowedRoots` to bound which directories are acceptable.
+
+## Uninstalling
+
+```bash
+claude mcp remove opencode --scope project
+```
+
+and remove the `.mcp.json` entry if you added one manually.