codesift-mcp 0.12.0 → 0.13.1

package/dist/cli/service.js

@@ -1,6 +1,8 @@
-import { mkdirSync, writeFileSync, readFileSync, existsSync, unlinkSync } from "node:fs";
+import { mkdirSync, readFileSync, existsSync, unlinkSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { join, dirname } from "node:path";
+import { isLoopbackHost } from "../utils/loopback.js";
+import { writeOwnerOnlyFileSync } from "./owner-only-file.js";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
 /**
@@ -55,10 +57,7 @@ export function escapeXml(value) {
  * user's entire source tree — and their indexed conversation history — to
  * anything that can reach the port. There is no authentication by default.
  */
-export function isLoopbackHost(host) {
-    const h = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
-    return h === "127.0.0.1" || h === "localhost" || h === "::1";
-}
+export { isLoopbackHost } from "../utils/loopback.js";
 /** Resolve the CLI entry point for the currently running codesift install. */
 export function resolveCliPath() {
     // dist/cli/service.js -> dist/cli.js
@@ -77,6 +76,8 @@ export function buildServicePlan(opts) {
         label: SERVICE_LABEL,
         port,
         host,
+        ...(opts.token ? { token: opts.token } : {}),
+        ...(opts.env ? { env: opts.env } : {}),
         execPath: opts.execPath ?? process.execPath,
         cliPath: opts.cliPath ?? resolveCliPath(),
         unitPath,
@@ -126,7 +127,11 @@ ${argLines}
     <key>PATH</key>
     <string>${escapeXml(SERVICE_PATH_ENTRIES.join(":"))}</string>
     <key>CODESIFT_DATA_DIR</key>
-    <string>${escapeXml(plan.dataDir)}</string>
+    <string>${escapeXml(plan.dataDir)}</string>${Object.entries(plan.env ?? {})
+        .map(([k, v]) => `\n    <key>${escapeXml(k)}</key>\n    <string>${escapeXml(v)}</string>`)
+        .join("")}${plan.token ? `
+    <key>CODESIFT_HTTP_TOKEN</key>
+    <string>${escapeXml(plan.token)}</string>` : ""}
   </dict>
   <key>StandardOutPath</key>
   <string>${escapeXml(plan.stdoutLog)}</string>
@@ -152,7 +157,9 @@ ExecStart=${exec}
 Restart=always
 RestartSec=10
 Environment=PATH=${SERVICE_PATH_ENTRIES.join(":")}
-Environment=CODESIFT_DATA_DIR=${plan.dataDir}
+Environment=CODESIFT_DATA_DIR=${plan.dataDir}${Object.entries(plan.env ?? {})
+        .map(([k, v]) => `\nEnvironment=${k}=${v}`)
+        .join("")}${plan.token ? `\nEnvironment=CODESIFT_HTTP_TOKEN=${plan.token}` : ""}
 StandardOutput=append:${plan.stdoutLog}
 StandardError=append:${plan.stderrLog}
 
@@ -199,10 +206,14 @@ export function installService(opts) {
         };
     }
     const plan = buildServicePlan({ ...opts, ...(opts.os ? { os: opts.os } : {}) });
-    if (!isLoopbackHost(plan.host)) {
-        throw new Error(`refusing to install a service bound to ${plan.host}: the daemon serves every indexed `
-            + `repository and has no authentication, so a non-loopback bind publishes your source `
-            + `tree to the network. Use 127.0.0.1.`);
+    // Same rule as the server itself: a routable bind is allowed only with a
+    // token, because the token is what turns "publishes every indexed repository"
+    // into "serves authenticated callers". Serving several machines from one host
+    // is the point of stateless serving; doing it unauthenticated is not.
+    if (!isLoopbackHost(plan.host) && !opts.token) {
+        throw new Error(`refusing to install a service bound to ${plan.host} without a token: the daemon serves `
+            + `every indexed repository, so an unauthenticated non-loopback bind publishes your `
+            + `source tree. Pass --token (stored in the unit's environment) or use 127.0.0.1.`);
     }
     if (existsSync(plan.unitPath) && opts.force !== true) {
         return {
@@ -215,7 +226,12 @@ export function installService(opts) {
     }
     mkdirSync(dirname(plan.unitPath), { recursive: true });
     mkdirSync(join(plan.dataDir, "logs"), { recursive: true });
-    writeFileSync(plan.unitPath, renderUnit(plan, os), "utf-8");
+    // 0600: the rendered unit embeds CODESIFT_HTTP_TOKEN, and a service file is
+    // world-readable by default — on the shared host this feature exists for, that
+    // hands the daemon credential to every other local account. Raises instead of
+    // installing a unit whose permissions it could not set; this is the exact file
+    // that was found at -rw-r--r-- on burst-i9.
+    writeOwnerOnlyFileSync(plan.unitPath, renderUnit(plan, os));
     let activated = false;
     let note;
     if (os === "darwin") {

package/dist/cli/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/cli/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,mBAAmB;IACnB,gBAAgB;IAChB,UAAU;IACV,MAAM;IACN,WAAW;IACX,OAAO;CACR,CAAC;AAiBF,yDAAyD;AACzD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc;IAC5B,qCAAqC;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAQhC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,oBAAoB,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GACZ,EAAE,KAAK,QAAQ;QACb,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,aAAa,QAAQ,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAC1E,OAAO;QACL,KAAK,EAAE,aAAa;QACpB,IAAI;QACJ,IAAI;QACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;QAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE;QACzC,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC;QACzC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC;QACzC,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;SAClD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;;;;;YAKG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;;;EAG/B,QAAQ;;;;;;;;;;;;;cAaI,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;cAEzC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;;;YAGzB,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;;YAEzB,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;;;CAGpC,CAAC;AACF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC;SAClG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACtD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO;;;;;;;YAOG,IAAI;;;mBAGG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;gCACjB,IAAI,CAAC,OAAO;wBACpB,IAAI,CAAC,SAAS;uBACf,IAAI,CAAC,SAAS;;;;CAIpC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAiB,EAAE,EAAmB;IAC/D,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChF,CAAC;AAaD,MAAM,aAAa,GAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAA0C,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;IAC1F,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAQ9B;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;IACjC,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,EAAE;YACZ,GAAG,EAAE,EAAE;YACP,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,8BAA8B,EAAE,kCAAkC;SACzE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAEhF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,CAAC,IAAI,oCAAoC;cACnF,qFAAqF;cACrF,qCAAqC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACrD,OAAO;YACL,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;YAC3C,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,2BAA2B;SAClC,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAE5D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,IAAwB,CAAC;IAC7B,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,4DAA4D;kBAC/D,oCAAoC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,0EAA0E;YAC1E,GAAG,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjE,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,IAAI,GAAG,iDAAiD,CAAC,CAAC,OAAO,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACrF,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,IAAI,GAAG,8CAA8C,CAAC,CAAC,OAAO,EAAE,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,EAAE,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;QAC3C,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,MAAM;YAAE,GAAG,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAA8D;IAQ1F,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,GAAI,CAA2B,CAAC,IAAI,KAAK,OAAO,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO;QAClC,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,OAAO;YACP,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK;QACL,OAAO,EAAE,KAAK,KAAK,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;QACzB,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;KACxC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/cli/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,mBAAmB;IACnB,gBAAgB;IAChB,UAAU;IACV,MAAM;IACN,WAAW;IACX,OAAO;CACR,CAAC;AA6BF,yDAAyD;AACzD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,cAAc;IAC5B,qCAAqC;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAUhC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,oBAAoB,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GACZ,EAAE,KAAK,QAAQ;QACb,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,aAAa,QAAQ,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAC1E,OAAO;QACL,KAAK,EAAE,aAAa;QACpB,IAAI;QACJ,IAAI;QACJ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;QAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE;QACzC,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC;QACzC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC;QACzC,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;SAClD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;;;;;YAKG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;;;EAG/B,QAAQ;;;;;;;;;;;;;cAaI,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;cAEzC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;SACxE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,SAAS,CAAC,CAAC,CAAC,uBAAuB,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;SACzF,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;;cAEjB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;;;YAGvC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;;YAEzB,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;;;CAGpC,CAAC;AACF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC;SAClG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACtD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO;;;;;;;YAOG,IAAI;;;mBAGG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;gCACjB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;SACxE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;SAC1C,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAqC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;wBAC3D,IAAI,CAAC,SAAS;uBACf,IAAI,CAAC,SAAS;;;;CAIpC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAiB,EAAE,EAAmB;IAC/D,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChF,CAAC;AAaD,MAAM,aAAa,GAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAA0C,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;IAC1F,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAU9B;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;IACjC,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,EAAE;YACZ,GAAG,EAAE,EAAE;YACP,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,8BAA8B,EAAE,kCAAkC;SACzE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAEhF,yEAAyE;IACzE,8EAA8E;IAC9E,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,CAAC,IAAI,sCAAsC;cACrF,mFAAmF;cACnF,gFAAgF,CACrF,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACrD,OAAO;YACL,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;YAC3C,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,2BAA2B;SAClC,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,4CAA4C;IAC5C,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAE5D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,IAAwB,CAAC;IAC7B,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,4DAA4D;kBAC/D,oCAAoC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,0EAA0E;YAC1E,GAAG,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjE,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,IAAI,GAAG,iDAAiD,CAAC,CAAC,OAAO,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACrF,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,IAAI,GAAG,8CAA8C,CAAC,CAAC,OAAO,EAAE,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,EAAE,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;QAC3C,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,MAAM;YAAE,GAAG,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAA8D;IAQ1F,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,GAAI,CAA2B,CAAC,IAAI,KAAK,OAAO,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO;QAClC,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,OAAO;YACP,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK;QACL,OAAO,EAAE,KAAK,KAAK,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;QACzB,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;KACxC,CAAC;AACJ,CAAC"}

package/dist/cli/setup/codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../src/cli/setup/codex.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAK5D,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,MAAM,GACd;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAUtC;AAED,wBAAgB,yCAAyC,CACvD,OAAO,EAAE,MAAM,GACd;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CA8BvC;AAqHD,wBAAsB,UAAU,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+B7E;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAerD"}
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../src/cli/setup/codex.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAK5D,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,MAAM,GACd;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAUtC;AAED,wBAAgB,yCAAyC,CACvD,OAAO,EAAE,MAAM,GACd;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CA8BvC;AA4HD,wBAAsB,UAAU,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+B7E;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAerD"}

package/dist/cli/setup/codex.js

@@ -1,9 +1,9 @@
 import { existsSync } from "node:fs";
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { ensureDir, writeJsonFile } from "./fs.js";
-import { daemonHttpUrl, resolveMcpServerEntry } from "./mcp.js";
+import { ensureDir, writeJsonFile, writeSecretFile } from "./fs.js";
+import { daemonHttpUrl, resolveMcpServerEntry, assertTokenTransportIsSafe } from "./mcp.js";
 import { hasCodesiftHook, loadHooksSection } from "./hooks.js";
 export function stripCodesiftToolApprovalOverrides(content) {
     const expression = /\[mcp_servers\.codesift\.tools\.[^\]]+\][\t ]*\r?\napproval_mode[\t ]*=[\t ]*"[^"]*"[\t ]*\r?\n?/g;
@@ -73,7 +73,14 @@ function jsonString(value) {
 }
 function getCodexServerEntryLines(options) {
     if (options?.http) {
-        return "url = " + jsonString(daemonHttpUrl(options.port, options.cwd));
+        // Same guard as the JSON path: a token on a plaintext non-loopback URL is refused.
+        assertTokenTransportIsSafe(options);
+        const lines = ["url = " + jsonString(daemonHttpUrl(options.port, options.cwd, options.host, options.scheme))];
+        if (options.token) {
+            lines.push("[mcp_servers.codesift.http_headers]");
+            lines.push("Authorization = " + jsonString(`Bearer ${options.token}`));
+        }
+        return lines.join("\n");
     }
     const entry = resolveMcpServerEntry();
     return ("command = " +
@@ -140,7 +147,7 @@ export async function setupCodex(options) {
     const configPath = join(configDir, "config.toml");
     await ensureDir(configDir);
     if (!existsSync(configPath)) {
-        await writeFile(configPath, getCodexTomlBlock(options).trimStart(), "utf-8");
+        await writeSecretFile(configPath, getCodexTomlBlock(options).trimStart());
         return { platform: "codex", config_path: configPath, status: "created" };
     }
     const original = await readFile(configPath, "utf-8");
@@ -154,12 +161,12 @@ export async function setupCodex(options) {
         : {};
     if (content.includes("[mcp_servers.codesift]")) {
         if (removed > 0 || normalized.changed || normalizedEntry.changed || required.changed) {
-            await writeFile(configPath, content, "utf-8");
+            await writeSecretFile(configPath, content);
             return { platform: "codex", config_path: configPath, status: "updated", ...noteFields };
         }
         return { platform: "codex", config_path: configPath, status: "already_configured" };
     }
-    await writeFile(configPath, content.trimEnd() + "\n" + getCodexTomlBlock(options), "utf-8");
+    await writeSecretFile(configPath, content.trimEnd() + "\n" + getCodexTomlBlock(options));
     return { platform: "codex", config_path: configPath, status: "updated", ...noteFields };
 }
 export async function setupCodexHooks() {

package/dist/cli/setup/codex.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../src/cli/setup/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,UAAU,kCAAkC,CAChD,OAAe;IAEf,MAAM,UAAU,GAAG,mGAAmG,CAAC;IACvH,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACjC,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;QACnE,OAAO,EAAE,OAAO,CAAC,MAAM;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,OAAe;IAEf,MAAM,MAAM,GAAG,wBAAwB,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAErD,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC;IACpF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,kBAAkB,GAAG,0DAA0D,CAAC;IACtF,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAChC,kBAAkB,EAClB,yCAAyC,CAC1C,CAAC;QACF,OAAO,YAAY,KAAK,KAAK;YAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;YAC7B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO;QACL,OAAO,EACL,MAAM;YACN,yCAAyC;YACzC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtD,MAAM;QACR,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAe;IAEf,MAAM,MAAM,GAAG,wBAAwB,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAErD,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC;IACpF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,kBAAkB,GAAG,8CAA8C,CAAC;IAC1E,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;QAC1E,OAAO,YAAY,KAAK,KAAK;YAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;YAC7B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO;QACL,OAAO,EACL,MAAM;YACN,iBAAiB;YACjB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtD,MAAM;QACR,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAsB;IACtD,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,OAAO,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;IACtC,OAAO,CACL,YAAY;QACZ,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;QACzB,YAAY;QACZ,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACnD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAsB;IAC/C,OAAO,CACL,4BAA4B;QAC5B,wBAAwB,CAAC,OAAO,CAAC;QACjC,sFAAsF,CACvF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAe;IAEf,MAAM,MAAM,GAAG,wBAAwB,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC;IACpF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,gCAAgC,CACvC,OAAe,EACf,OAAsB;IAEtB,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE/C,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,KAAK,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAErD,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,4EAA4E;IAC5E,kBAAkB;IAClB,MAAM,aAAa,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,aAAa,IAAI,CAAC,gBAAgB,CAAC;IAExD,MAAM,aAAa,GACjB,WAAW,KAAK,OAAO;QACvB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,YAAY,IAAI,aAAa,CAAC,CAAC;IACtE,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEvD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,0CAA0C,EAAE,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,YAAY;SACtB,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;SACrC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,EAAE,CAAC;IACb,MAAM,YAAY,GAChB,0BAA0B;QAC1B,wBAAwB,CAAC,OAAO,CAAC;QACjC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;IACP,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;QAChF,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAsB;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAE3B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;QAC7E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,kCAAkC,CAAC,QAAQ,CAAC,CAAC;IACnF,MAAM,eAAe,GAAG,gCAAgC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,yCAAyC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,UAAU,GACd,OAAO,GAAG,CAAC;QACT,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,6BAA6B,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,0BAA0B,EAAE;QAC1H,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrF,MAAM,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;QAC1F,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAE1D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;;YACtC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../src/cli/setup/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,UAAU,kCAAkC,CAChD,OAAe;IAEf,MAAM,UAAU,GAAG,mGAAmG,CAAC;IACvH,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACjC,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;QACnE,OAAO,EAAE,OAAO,CAAC,MAAM;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,OAAe;IAEf,MAAM,MAAM,GAAG,wBAAwB,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAErD,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC;IACpF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,kBAAkB,GAAG,0DAA0D,CAAC;IACtF,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAChC,kBAAkB,EAClB,yCAAyC,CAC1C,CAAC;QACF,OAAO,YAAY,KAAK,KAAK;YAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;YAC7B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO;QACL,OAAO,EACL,MAAM;YACN,yCAAyC;YACzC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtD,MAAM;QACR,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAe;IAEf,MAAM,MAAM,GAAG,wBAAwB,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAErD,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC;IACpF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,kBAAkB,GAAG,8CAA8C,CAAC;IAC1E,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;QAC1E,OAAO,YAAY,KAAK,KAAK;YAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;YAC7B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO;QACL,OAAO,EACL,MAAM;YACN,iBAAiB;YACjB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtD,MAAM;QACR,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAsB;IACtD,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,mFAAmF;QACnF,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9G,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,UAAU,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;IACtC,OAAO,CACL,YAAY;QACZ,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;QACzB,YAAY;QACZ,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACnD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAsB;IAC/C,OAAO,CACL,4BAA4B;QAC5B,wBAAwB,CAAC,OAAO,CAAC;QACjC,sFAAsF,CACvF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAe;IAEf,MAAM,MAAM,GAAG,wBAAwB,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC;IACpF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,gCAAgC,CACvC,OAAe,EACf,OAAsB;IAEtB,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE/C,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,KAAK,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAErD,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,4EAA4E;IAC5E,kBAAkB;IAClB,MAAM,aAAa,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,aAAa,IAAI,CAAC,gBAAgB,CAAC;IAExD,MAAM,aAAa,GACjB,WAAW,KAAK,OAAO;QACvB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,YAAY,IAAI,aAAa,CAAC,CAAC;IACtE,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEvD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,0CAA0C,EAAE,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,YAAY;SACtB,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;SACrC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,EAAE,CAAC;IACb,MAAM,YAAY,GAChB,0BAA0B;QAC1B,wBAAwB,CAAC,OAAO,CAAC;QACjC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;IACP,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;QAChF,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAsB;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAE3B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,eAAe,CAAC,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,kCAAkC,CAAC,QAAQ,CAAC,CAAC;IACnF,MAAM,eAAe,GAAG,gCAAgC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,yCAAyC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,UAAU,GACd,OAAO,GAAG,CAAC;QACT,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,6BAA6B,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,0BAA0B,EAAE;QAC1H,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrF,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;QAC1F,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAE1D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;;YACtC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC"}

package/dist/cli/setup/fs.d.ts

@@ -1,5 +1,17 @@
 export declare function ensureDir(dir: string): Promise<void>;
 export declare function readJsonFile(path: string): Promise<Record<string, unknown>>;
+/**
+ * Owner-only. These files can carry a daemon bearer token, and the whole point of the
+ * shared-daemon feature is that the host is shared — so the default umask (commonly 0644,
+ * group- and world-readable) hands every other local account a credential that grants
+ * read access to every indexed repository on that daemon.
+ *
+ * The mode is enforced by `owner-only-file.ts`, which also decides what to do when it
+ * cannot be enforced — see the header there for why that is not best-effort.
+ */
+export declare const SECRET_FILE_MODE = 384;
+/** Write a text config that may embed a bearer token, owner-readable only. */
+export declare function writeSecretFile(path: string, content: string): Promise<void>;
 export declare function writeJsonFile(path: string, data: Record<string, unknown>): Promise<void>;
 export declare function resolvePackageFile(relativePath: string): string;
 export declare function sha256(content: string): string;

package/dist/cli/setup/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../src/cli/setup/fs.ts"],"names":[],"mappings":"AAMA,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI1D;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgBjF;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAS/D;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9C"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../src/cli/setup/fs.ts"],"names":[],"mappings":"AAOA,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI1D;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgBjF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,MAAkB,CAAC;AAEhD,8EAA8E;AAC9E,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAS/D;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9C"}

package/dist/cli/setup/fs.js

@@ -1,8 +1,9 @@
 import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { OWNER_ONLY_MODE, writeOwnerOnlyFile } from "../owner-only-file.js";
 export async function ensureDir(dir) {
     if (!existsSync(dir)) {
         await mkdir(dir, { recursive: true });
@@ -25,8 +26,22 @@ export async function readJsonFile(path) {
     }
     return parsed;
 }
+/**
+ * Owner-only. These files can carry a daemon bearer token, and the whole point of the
+ * shared-daemon feature is that the host is shared — so the default umask (commonly 0644,
+ * group- and world-readable) hands every other local account a credential that grants
+ * read access to every indexed repository on that daemon.
+ *
+ * The mode is enforced by `owner-only-file.ts`, which also decides what to do when it
+ * cannot be enforced — see the header there for why that is not best-effort.
+ */
+export const SECRET_FILE_MODE = OWNER_ONLY_MODE;
+/** Write a text config that may embed a bearer token, owner-readable only. */
+export async function writeSecretFile(path, content) {
+    await writeOwnerOnlyFile(path, content);
+}
 export async function writeJsonFile(path, data) {
-    await writeFile(path, JSON.stringify(data, null, 2) + "\n", "utf-8");
+    await writeOwnerOnlyFile(path, JSON.stringify(data, null, 2) + "\n");
 }
 export function resolvePackageFile(relativePath) {
     const thisDir = dirname(fileURLToPath(import.meta.url));

package/dist/cli/setup/fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/cli/setup/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,IAAI,GAAG,mCAAmC,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,IAAI,GAAG,QAAQ,GAAG,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,IAA6B;IAC7E,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,YAAoB;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC3C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,YAAY,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAAe;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC"}
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/cli/setup/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE5E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,IAAI,GAAG,mCAAmC,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,IAAI,GAAG,QAAQ,GAAG,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe;IACjE,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,IAA6B;IAC7E,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,YAAoB;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC3C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,YAAY,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAAe;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC"}

package/dist/cli/setup/mcp.d.ts

@@ -1,4 +1,5 @@
 import type { SetupOptions, SetupResult } from "./types.js";
+export { isLoopbackHost } from "../../utils/loopback.js";
 export interface JsonPlatformConfig {
     configDirName: string;
     configFileName: string;
@@ -30,7 +31,19 @@ export declare function resolveMcpServerEntry(): {
  * an HTTP entry is inherently PER-PROJECT — one shared URL cannot describe two
  * projects.
  */
-export declare function daemonHttpUrl(port?: number, cwd?: string): string;
+export declare function daemonHttpUrl(port?: number, cwd?: string, host?: string, scheme?: "http" | "https"): string;
+/**
+ * Refuse to write a reusable bearer token onto a plaintext URL that leaves the machine.
+ *
+ * Requiring a token does not make a routable plaintext endpoint safe: the token is static and
+ * replayable, and anything that captures it can call every tool — which exposes every indexed
+ * repository and conversation on the daemon. Loopback is exempt (nothing leaves the host).
+ *
+ * `insecureTransport` is the deliberate escape for the deployment this feature was built for: a
+ * tailnet or VPN where the transport is already encrypted below HTTP. It has to be stated, not
+ * assumed, because the code cannot tell a tailnet address from a public one.
+ */
+export declare function assertTokenTransportIsSafe(options: SetupOptions): void;
 export declare function buildJsonServerEntry(options?: SetupOptions): Record<string, unknown>;
 export declare function setupJsonPlatform(platform: string, config: JsonPlatformConfig, options?: SetupOptions): Promise<SetupResult>;
 //# sourceMappingURL=mcp.d.ts.map

package/dist/cli/setup/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../../src/cli/setup/mcp.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG5D,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB;AAID,wBAAgB,qBAAqB,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAoB3E;AAID;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAIjE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKpF;AAqDD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAwBtB"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../../src/cli/setup/mcp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzD,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB;AAID,wBAAgB,qBAAqB,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAoB3E;AAID;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,wBAAgB,aAAa,CAC3B,IAAI,CAAC,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GACxB,MAAM,CAmBR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAYtE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAapF;AAqDD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAwBtB"}

package/dist/cli/setup/mcp.js

@@ -2,6 +2,8 @@ import { execSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { isLoopbackHost, assertPlainHost } from "../../utils/loopback.js";
+export { isLoopbackHost } from "../../utils/loopback.js";
 import { ensureDir, readJsonFile, writeJsonFile } from "./fs.js";
 const DEFAULT_DAEMON_PORT = 7077;
 export function resolveMcpServerEntry() {
@@ -49,14 +51,62 @@ const MCP_SERVER_ENTRY = resolveMcpServerEntry();
  * an HTTP entry is inherently PER-PROJECT — one shared URL cannot describe two
  * projects.
  */
-export function daemonHttpUrl(port, cwd) {
-    const base = "http://127.0.0.1:" + (port ?? DEFAULT_DAEMON_PORT) + "/mcp";
-    const dir = cwd ?? process.cwd();
-    return base + "?cwd=" + encodeURIComponent(dir);
+export function daemonHttpUrl(port, cwd, host, scheme) {
+    // Host is a parameter, not a constant. It was hardcoded to 127.0.0.1, which
+    // silently made `setup --http` a local-only feature: a SHARED daemon — the
+    // entire reason stateless serving exists — could not be configured without
+    // hand-editing every client's JSON. Adding a machine to a shared instance has
+    // to be one command, or nobody will do it twice.
+    const rawHost = host ?? "127.0.0.1";
+    assertPlainHost(rawHost);
+    // Bracket IPv6 literals. Plain concatenation produced `http://::1:7077/mcp`,
+    // which is not a parseable authority — a tailnet IPv6 daemon could not be
+    // configured at all.
+    const authorityHost = rawHost.includes(":") && !rawHost.startsWith("[")
+        ? `[${rawHost}]`
+        : rawHost;
+    const url = new URL(`${scheme ?? "http"}://${authorityHost}:${port ?? DEFAULT_DAEMON_PORT}/mcp`);
+    url.searchParams.set("cwd", cwd ?? process.cwd());
+    return url.toString();
+}
+/**
+ * Refuse to write a reusable bearer token onto a plaintext URL that leaves the machine.
+ *
+ * Requiring a token does not make a routable plaintext endpoint safe: the token is static and
+ * replayable, and anything that captures it can call every tool — which exposes every indexed
+ * repository and conversation on the daemon. Loopback is exempt (nothing leaves the host).
+ *
+ * `insecureTransport` is the deliberate escape for the deployment this feature was built for: a
+ * tailnet or VPN where the transport is already encrypted below HTTP. It has to be stated, not
+ * assumed, because the code cannot tell a tailnet address from a public one.
+ */
+export function assertTokenTransportIsSafe(options) {
+    const host = options.host ?? "127.0.0.1";
+    assertPlainHost(host);
+    if (!options.token)
+        return;
+    if (isLoopbackHost(host))
+        return;
+    if (options.scheme === "https")
+        return;
+    if (options.insecureTransport)
+        return;
+    throw new Error(`Refusing to write a bearer token for http://${host} — the token would travel in plaintext ` +
+        `and anyone who captures it can read every indexed repo on that daemon. Use --scheme https, ` +
+        `or pass --insecure-transport if the link is already encrypted (tailnet/VPN/SSH tunnel).`);
 }
 export function buildJsonServerEntry(options) {
     if (options?.http) {
-        return { type: "http", url: daemonHttpUrl(options.port, options.cwd) };
+        // A remote daemon requires a token (the server refuses a routable bind
+        // without one), so it travels with the URL in the client entry.
+        assertTokenTransportIsSafe(options);
+        const entry = {
+            type: "http",
+            url: daemonHttpUrl(options.port, options.cwd, options.host, options.scheme),
+        };
+        if (options.token)
+            entry["headers"] = { Authorization: `Bearer ${options.token}` };
+        return entry;
     }
     return { ...MCP_SERVER_ENTRY };
 }

package/dist/cli/setup/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/cli/setup/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAOjE,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,MAAM,UAAU,qBAAqB;IACnC,+EAA+E;IAC/E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,QAAQ,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChF,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,+CAA+C,CAAC,CAAC;IAE3D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IAE1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,GAAY;IACvD,MAAM,IAAI,GAAG,mBAAmB,GAAG,CAAC,IAAI,IAAI,mBAAmB,CAAC,GAAG,MAAM,CAAC;IAC1E,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACjC,OAAO,IAAI,GAAG,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,gBAAgB,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IACE,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAE,KAAiC,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,KAAK,IAAK,KAAgB,CAAC,EACrF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;QACxE,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CACL,OAAO,KAAK,MAAM;QAClB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAiB,EAAE,OAAgC;IAClF,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,eAAe,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QACxC,OAAQ,QAAoC,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,kBAAkB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,MAAM,OAAO,GAAG,QAAmC,CAAC;IACpD,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,MAA0B,EAC1B,OAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE5C,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAE3B,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAwC,CAAC;QACjF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,QAAQ,IAAI,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC;QACA,QAAQ,CAAC,YAAY,CAA6B,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;QACxE,MAAM,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/cli/setup/mcp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAOjE,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,MAAM,UAAU,qBAAqB;IACnC,+EAA+E;IAC/E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,QAAQ,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChF,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,+CAA+C,CAAC,CAAC;IAE3D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IAE1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,UAAU,aAAa,CAC3B,IAAa,EACb,GAAY,EACZ,IAAa,EACb,MAAyB;IAEzB,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,iDAAiD;IACjD,MAAM,OAAO,GAAG,IAAI,IAAI,WAAW,CAAC;IACpC,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,6EAA6E;IAC7E,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACrE,CAAC,CAAC,IAAI,OAAO,GAAG;QAChB,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,GAAG,MAAM,IAAI,MAAM,MAAM,aAAa,IAAI,IAAI,IAAI,mBAAmB,MAAM,CAC5E,CAAC;IACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAqB;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO;IAC3B,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO;IACvC,IAAI,OAAO,CAAC,iBAAiB;QAAE,OAAO;IACtC,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,yCAAyC;QAC1F,6FAA6F;QAC7F,yFAAyF,CAC5F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,uEAAuE;QACvE,gEAAgE;QAChE,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,KAAK,GAA4B;YACrC,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;SAC5E,CAAC;QACF,IAAI,OAAO,CAAC,KAAK;YAAE,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,EAAE,GAAG,gBAAgB,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IACE,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAE,KAAiC,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,KAAK,IAAK,KAAgB,CAAC,EACrF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;QACxE,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CACL,OAAO,KAAK,MAAM;QAClB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAiB,EAAE,OAAgC;IAClF,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,eAAe,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QACxC,OAAQ,QAAoC,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,kBAAkB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,MAAM,OAAO,GAAG,QAAmC,CAAC;IACpD,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,MAA0B,EAC1B,OAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE5C,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAE3B,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAwC,CAAC;QACjF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,QAAQ,IAAI,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC;QACA,QAAQ,CAAC,YAAY,CAA6B,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;QACxE,MAAM,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC"}

package/dist/cli/setup/types.d.ts

@@ -23,7 +23,26 @@ export interface SetupOptions {
      * An HTTP entry is per-project by construction — see `daemonHttpUrl`.
      */
     cwd?: string;
+    /**
+     * Daemon host. Defaults to 127.0.0.1 (a local daemon). Point it at a shared
+     * instance to have several machines served by one process — the reason
+     * stateless serving exists.
+     */
+    host?: string;
+    /**
+     * Bearer token for a remote daemon. The server refuses a routable bind
+     * without one, so a remote setup needs it.
+     */
+    token?: string;
     /** Shared-daemon port; defaults to 7077. */
     port?: number;
+    /** URL scheme for the daemon endpoint. Defaults to http (correct for loopback). */
+    scheme?: "http" | "https";
+    /**
+     * Acknowledge that a plaintext link to a NON-loopback daemon is already encrypted below HTTP
+     * (tailnet, VPN, SSH tunnel). Without it, writing a bearer token onto such a URL is refused —
+     * the code cannot tell a tailnet address from a public one, so the operator has to say so.
+     */
+    insecureTransport?: boolean;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/cli/setup/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/cli/setup/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,oBAAoB,CAAC;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,OAAO,CAAC;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/cli/setup/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,oBAAoB,CAAC;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,OAAO,CAAC;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B"}

package/dist/register-tools/runtime.d.ts

@@ -19,12 +19,21 @@ export declare function setToolHandle(name: string, handle: unknown): void;
  */
 export declare const TIMEOUT_EXEMPT_TOOLS: ReadonlySet<string>;
 /**
- * Per-repo index-version token for cache keying. index_file rewrites the repo's
- * {hash}.index.json via saveIncremental (bumps updated_at + re-saves), so the
- * file's mtime and size move — a cheap, synchronous, per-repo signal that
- * changes exactly when the index changes (in- or out-of-process). Returns "" for
- * an unknown/unindexed repo (coarser key — acceptable, there is nothing indexed
- * to go stale). Exported for the wiring spike test.
+ * Per-repo index-version token for cache keying. An index write moves the mtime and size of
+ * whichever file backs the index — a cheap, synchronous, per-repo signal that changes
+ * exactly when the index changes, in- or out-of-process. Returns "" for an unknown or
+ * unindexed repo (coarser key — acceptable, there is nothing indexed to go stale).
+ * Exported for the wiring spike test.
+ *
+ * All three candidate paths are statted rather than just the active backend's, because:
+ *   - after ADR-003 the index may live in `{hash}.index.db` instead of `{hash}.index.json`,
+ *     and a migrated repo's `.json` is deliberately frozen — keying on it alone would pin
+ *     the token forever and serve cached tool responses over a changing index;
+ *   - SQLite runs in WAL mode, so a commit lands in `{hash}.index.db-wal` and need not
+ *     touch the main db file until a checkpoint. Ignoring the `-wal` would miss exactly the
+ *     recent writes this token exists to catch.
+ * Missing files contribute nothing, so this stays correct under either backend and during
+ * the migration window when both exist.
  */
 export declare function getRepoIndexVersion(repo: string): string;
 /**

package/dist/register-tools/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/register-tools/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAY9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AASxE,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,OAEzC;AASD,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EACvC,SAAS,EAAE,gBAAgB,GAC1B,IAAI,CAIN;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAEjE;AA0BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAGnD,CAAC;AA+DH;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUxD;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMxD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAQ1D;AAsHD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EACvC,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,gBAAgB,OA0G5B;AAeD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUtD;AAYD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAarE"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/register-tools/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAY9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAUxE,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,OAEzC;AASD,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EACvC,SAAS,EAAE,gBAAgB,GAC1B,IAAI,CAIN;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAEjE;AA0BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAGnD,CAAC;AA+DH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBxD;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMxD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAQ1D;AAsHD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EACvC,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,gBAAgB,OA0G5B;AAeD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUtD;AAYD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAarE"}

package/dist/register-tools/runtime.js

@@ -7,6 +7,7 @@ import { withTimeout, withCache, stableStringify } from "../register-tool-groups
 import { trackUsage, trackToolCall, getSessionId, getLocalHostTag } from "../storage/usage-tracker.js";
 import { recordCacheHit, scheduleSidecarFlush } from "../storage/session-state.js";
 import { TOOL_DEFINITION_MAP } from "./discovery.js";
+import { sqlitePathFor } from "../storage/index-store.js";
 // ---------------------------------------------------------------------------
 // Registered tool handles — populated by registerTools(), used by describe_tools reveal
 // ---------------------------------------------------------------------------
@@ -120,12 +121,21 @@ function repoRoots() {
     }
 }
 /**
- * Per-repo index-version token for cache keying. index_file rewrites the repo's
- * {hash}.index.json via saveIncremental (bumps updated_at + re-saves), so the
- * file's mtime and size move — a cheap, synchronous, per-repo signal that
- * changes exactly when the index changes (in- or out-of-process). Returns "" for
- * an unknown/unindexed repo (coarser key — acceptable, there is nothing indexed
- * to go stale). Exported for the wiring spike test.
+ * Per-repo index-version token for cache keying. An index write moves the mtime and size of
+ * whichever file backs the index — a cheap, synchronous, per-repo signal that changes
+ * exactly when the index changes, in- or out-of-process. Returns "" for an unknown or
+ * unindexed repo (coarser key — acceptable, there is nothing indexed to go stale).
+ * Exported for the wiring spike test.
+ *
+ * All three candidate paths are statted rather than just the active backend's, because:
+ *   - after ADR-003 the index may live in `{hash}.index.db` instead of `{hash}.index.json`,
+ *     and a migrated repo's `.json` is deliberately frozen — keying on it alone would pin
+ *     the token forever and serve cached tool responses over a changing index;
+ *   - SQLite runs in WAL mode, so a commit lands in `{hash}.index.db-wal` and need not
+ *     touch the main db file until a checkpoint. Ignoring the `-wal` would miss exactly the
+ *     recent writes this token exists to catch.
+ * Missing files contribute nothing, so this stays correct under either backend and during
+ * the migration window when both exist.
  */
 export function getRepoIndexVersion(repo) {
     if (!repo)
@@ -133,13 +143,21 @@ export function getRepoIndexVersion(repo) {
     const indexPath = repoIndexPaths().get(repo);
     if (!indexPath)
         return "";
-    try {
-        const st = statSync(indexPath);
-        return `${st.mtimeMs}:${st.size}`;
-    }
-    catch {
-        return "";
+    // Shared helper, not a second copy of the rule: this token exists to track whichever file
+    // backs the index, so a derivation that drifts from the storage layer silently pins the
+    // cache key while the real index keeps changing.
+    const dbPath = sqlitePathFor(indexPath);
+    const parts = [];
+    for (const candidate of [indexPath, dbPath, `${dbPath}-wal`]) {
+        try {
+            const st = statSync(candidate);
+            parts.push(`${st.mtimeMs}:${st.size}`);
+        }
+        catch {
+            /* absent — contributes nothing to the token */
+        }
     }
+    return parts.join("|");
 }
 /**
  * Resolve a repo root's git directory. Handles the plain `.git/` directory AND