desktop-mcp 0.0.0-stage → 0.4.0

package/README.md

@@ -1,3 +1,213 @@
-# Temporary Holding Version
+# omcps — an MCP server that lets an AI use your computer
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`omcps` gives Claude Desktop, Claude Code, VS Code, Cursor or any MCP client controlled access to your machine:
+**shell, files, clipboard, mouse, keyboard, screen (OCR, image and colour search), windows.** Built on
+[nut.js](https://nutjs.dev). Windows, Linux and macOS.
+
+* **Everything runs on your device.** No cloud service, no API key, no model download. Only `web_search` and
+  `fetch_url` use the network, and they are off unless you pass `--allow-web`.
+* **Nothing is allowed unless you say so.** You grant features with flags: `--allow-all`, `--allow-mouse`,
+  `--allow-clipboard`, ... and scope them (`--allow-path`, `--region`, `--allow-window`, ...).
+
+```bash
+npx omcps@latest --allow-all                                   # everything (with safety nets, see below)
+npx omcps@latest --allow-mouse --allow-keyboard --allow-screen # drive the desktop, nothing else
+npx omcps@latest --allow-files --allow-path ~/projects --ask-shell
+npx omcps@latest --help
+```
+
+## Add it to your MCP client
+
+The same pattern as other npx-based MCP servers: the command is `npx`, the flags are the permissions.
+
+**Claude Desktop / Cursor** (`mcpServers` in the config file):
+
+```json
+{
+  "mcpServers": {
+    "omcps": { "command": "npx", "args": ["omcps@latest", "--allow-mouse", "--allow-keyboard", "--allow-screen", "--allow-windows"] }
+  }
+}
+```
+
+**Claude Code:** `claude mcp add omcps -- npx omcps@latest --allow-all`
+
+**VS Code:** `code --add-mcp '{"name":"omcps","command":"npx","args":["omcps@latest","--allow-all"]}'`
+
+Run it as an HTTP server instead of stdio: `npx omcps@latest --allow-all --transport streamable-http --port 8000`
+(`http://127.0.0.1:8000/mcp`; binds to localhost and rejects foreign `Host` headers).
+
+> The package is named `omcps`; until it is published to the npm registry, install from the tarball:
+> `npx --package=./omcps-0.4.0.tgz omcps --allow-all`.
+
+## Permissions
+
+With no flags nothing is allowed: the AI sees one tool, `permissions_describe`, and stderr tells you what to add.
+Every tool call passes through one engine that decides **allow / ask / deny** before anything runs; tools the AI is
+not allowed to use are **not even listed**.
+
+### Feature flags
+
+`--allow-<group>` grants a group; `--ask-<group>` makes every use need your approval (through MCP elicitation, when
+the client supports it). `allow` beats `ask` for the same feature.
+
+| flag | grants |
+|---|---|
+| `--allow-all` | every feature below |
+| `--allow-gui` | mouse + keyboard + screen + windows + clipboard |
+| `--allow-mouse` | move, click, drag, scroll |
+| `--allow-keyboard` | type text, press keys, hold keys |
+| `--allow-clipboard` / `--allow-clipboard-read` | clipboard read + write / read only |
+| `--allow-screen` | screenshots, OCR, image and colour search |
+| `--allow-record` | screen recording |
+| `--allow-windows` / `--allow-windows-list` | list, focus, move, resize, minimise, close / list only |
+| `--allow-files` / `--allow-files-read` | read + write files / read only |
+| `--allow-delete` | delete and move files |
+| `--allow-shell` | run shell commands |
+| `--allow-processes` / `--allow-processes-list` | list + kill / list only |
+| `--allow-system` | system information, environment variables |
+| `--allow-web` | `web_search`, `fetch_url` (the only network use) |
+| `--allow-open` | open files, folders and URLs with the default app |
+
+A few tools combine features, and need all of them: pasting needs clipboard **and** keyboard; `click_text` needs
+screen **and** mouse; `screenshot_save` and `screen_record` also need file-write permission.
+
+### Scoping flags (all repeatable)
+
+`--allow-path DIR` `--deny-path P` `--readonly-path P` · `--allow-command REGEX` `--deny-command REGEX` ·
+`--allow-host REGEX` `--deny-host REGEX` · `--allow-window REGEX` · `--region x,y,w,h` · `--block-key ctrl+alt+delete`
+`--block-text REGEX` `--max-type-chars N` · `--rate-limit N` (per minute) `--max-actions N` ·
+`--audit-file PATH` `--audit-args` · `--ask-fallback allow|deny` · `--allow-tool NAME` `--deny-tool NAME` ·
+`--policy-show` (print what the AI may do and exit).
+
+### Safety nets for flag-only setups
+
+When you build permissions from flags alone, `omcps` also **denies credential locations** (`~/.ssh`, `~/.aws`,
+`~/.gnupg`, `~/.kube`, `~/.netrc`, `/etc/shadow`, ...) and **refuses dangerous shell patterns** (`rm -rf`, `sudo`,
+`mkfs`, `curl | sh`, ...). Opt out explicitly with `--allow-sensitive-paths` / `--allow-dangerous-commands`.
+
+### Bases: presets and policy files
+
+Flags can be layered on a base: `--preset locked|readonly|standard|desktop|safe|full`, or `--config policy.json`
+(alias `--policy`; legacy `--safe`, `--read-only`). A preset or file is trusted as written (no extra safety nets).
+
+```jsonc
+// policy.json
+{
+  "name": "notes-helper", "default": "deny",
+  "capabilities": { "fs.read": "allow", "fs.write": "ask", "shell.exec": "ask", "screen.capture": "allow" },
+  "tools": { "delete_path": "deny" },
+  "paths": { "allow": ["~/notes/**"], "deny": ["~/notes/private"], "readOnly": ["~/notes/archive"] },
+  "commands": { "allow": ["^git (status|log|diff)\\b"], "blockDangerous": true },
+  "gui": { "windows": ["^Notes"], "regions": [{ "x": 0, "y": 0, "width": 1280, "height": 720 }] },
+  "limits": { "maxActionsPerMinute": 60 }, "audit": { "file": "~/omcps-audit.jsonl" }
+}
+```
+
+### What the engine guarantees
+
+* **Paths** are checked on the real, symlink-resolved path: a link inside an allowed folder cannot escape it.
+* **Command allow-lists refuse chaining** (`; | & ` $( > <` newline) so `git status; rm -rf /` cannot pass `^git`.
+* **Denial comes before asking**; approval prompts never show file contents or typed text (only their size).
+* **Fail closed**: a tool without permission metadata is refused; an unwritable audit log refuses the call.
+* Keys and buttons the AI left held are released when the client disconnects.
+
+### What it does NOT do
+
+It controls the **tool interface**, not the operating system. It is **not a sandbox**.
+`run_command` can do anything your user can, and path rules do not apply to what a shell command touches
+(`cat ~/.ssh/id_rsa` is a shell command): keep `--allow-shell` off, use `--ask-shell` or a command allow-list.
+`--allow-window` checks the focused window at call time. `--region` limits pointer coordinates and
+captures, not what a keystroke does. Applications started with `--allow-open` run with your full rights.
+
+## Tools (62 with the desktop features)
+
+| area | tools |
+|---|---|
+| **Mouse** | `mouse_position` `move_mouse` `mouse_move_relative` `click` (any button, `clicks=2` = double) `mouse_press` `mouse_release` `mouse_drag` `scroll` (vertical + horizontal) |
+| **Keyboard** | `type_text` `press_key` (hotkeys, media keys, keypad) `key_down` `key_up` `list_keys` |
+| **Screen** | `screenshot` (full or region) `screenshot_save` `screen_size` `screen_color_at` `screen_highlight` |
+| **Windows** | `window_list` `window_active` `window_focus` `window_move` `window_resize` `window_minimize` `window_restore` `window_close` `window_wait_for` |
+| **Clipboard** | `clipboard_get` `clipboard_set` `clipboard_clear` `clipboard_copy` `clipboard_paste` |
+| **Image search** | `screen_find_image` `screen_find_images` `screen_wait_for_image` `click_image` (multi-scale, alpha-mask aware) |
+| **OCR** | `screen_read_text` `screen_find_text` (exact / contains / **fuzzy**) `screen_wait_for_text` `click_text` |
+| **Colour** | `screen_find_color` (regions of a colour, largest first) |
+| **Recording** | `screen_record` (PNG frames; MP4 too if `ffmpeg` is installed) |
+| **System** | `system_info` `get_env` `list_processes` `kill_process` `run_command` `open_path` `plugin_status` `permissions_describe` |
+| **Files / web** | `read_file` `write_file` `edit_file` `list_dir` `find_files` `search_in_files` `make_dir` `copy_path` `move_path` `delete_path` `web_search` `fetch_url` |
+
+Coordinates are in **logical** screen pixels (what clicks expect), also on HiDPI displays.
+
+## Runs locally — and how that is checked
+
+* OCR is `tesseract.js` (WebAssembly) with English data shipped in the package. **It never downloads models**: a
+  language that is not installed is an error telling you which `@tesseract.js-data/<lang>` to install (or set
+  `OSAGENT_OCR_LANG_PATH`). Image matching, colour search, recording and windows are pure local code.
+* There is **no cloud provider and no API key** anywhere in the MCP server. The standalone `osagent` agent (a
+  separate command in the same package) is the only part that talks to an LLM API; its SDK is an *optional peer
+  dependency* that `omcps` never installs or loads.
+* Tests prove it: a static test fails if any file other than the web tools and the standalone agent contains
+  network-client code or a cloud-SDK reference, and an end-to-end test runs the server with **every feature allowed
+  inside a network-less namespace** (real desktop, OCR, image/colour search, clipboard, files, shell: all work;
+  only `web_search` / `fetch_url` fail, cleanly).
+
+### nut.js plugins
+
+All ten plugins on nutjs.dev are sold behind a private registry and none is on public npm. Local equivalents are
+built in and registered with nut.js, so its own `screen.find(...)` works with them. `plugin_status` prints this table.
+
+| official plugin | here |
+|---|---|
+| nl-matcher, template-matcher | **built in**: pure-JS image matcher |
+| plugin-ocr | **built in**: tesseract.js, offline |
+| plugin-screenrecording | **built in**: frames, MP4 with ffmpeg |
+| window search | **built in** |
+| plugin-ai-sdk | **deliberately not included**: it needs a cloud LLM and an API key. Use `screen_find_text` (fuzzy), `screen_find_image`, `screen_find_color` |
+| plugin-azure | not available: a cloud OCR service |
+| element-inspector, playwright-bridge, selenium-bridge, plugin-rdp, bolt | not available: proprietary |
+
+## What was verified on a real X server, and what it changed
+
+Tested against Xvfb with a real window manager (openbox) and real X clients (`xev`, `xterm`, `xclip`). nut.js needed
+compensation:
+
+| finding (Linux / X11) | what omcps does |
+|---|---|
+| `keyboard.type` types shifted punctuation as the base key (`!`→`1`), drops other characters and all non-ASCII | never used on Linux: each character is an explicit key (+Shift); non-ASCII is pasted. All 95 printable ASCII characters verified in a real terminal |
+| `scrollRight` sends X button 6 (= wheel-**left**) | swapped on Linux |
+| `getWindows()` returns the WM's frames and 1×1 helpers with empty titles | lists real clients from `_NET_CLIENT_LIST` |
+| window geometry is frame-relative | reads absolute geometry with `xwininfo` |
+| `minimize`/`restore` not implemented in libnut | `xdotool`; `wmctrl` for a polite close |
+| `screen.grab(region)` ignores the region | crops itself |
+| `Key.Enter` is the keypad Enter | `enter` → `Key.Return` |
+| libnut **aborts the process** if the display can't be opened; needs `DISPLAY` in the *initial* environment | checks by connecting to the X socket on every call |
+
+Linux needs an X11 display (real or Xvfb) and, for window tools, an EWMH window manager plus `xprop`/`xwininfo`
+(x11-utils), `xdotool`, `wmctrl`. Wayland-only sessions are not supported by nut.js. macOS needs Screen Recording and
+Accessibility permission for the terminal. The mouse in a **screen corner** is a human fail-safe that blocks all
+input (an agent that parks the pointer there locks itself out until a person moves it).
+
+## Standalone agent
+
+`osagent "task"` is a small agent loop (plan → act → verify) that uses the same tools and permission flags. It is the
+only component that needs an LLM API: `npm install @anthropic-ai/sdk` and set `ANTHROPIC_API_KEY`.
+
+## Testing
+
+```bash
+npm test      # builds, then vitest with coverage; thresholds are 100% for statements, branches, functions, lines
+```
+
+Tests run against a private Xvfb + openbox started once in `tests/globalSetup.ts` (never your real desktop). Real,
+not mocked, where it matters: subprocesses and process-tree kills, files and symlink escapes, a local HTTP server, MCP
+clients over in-memory/stdio/HTTP, MCP elicitation approvals, the real `main()` with real flags, real windows, real
+key/mouse events observed by `xev`, typed text checked in a real `xterm`, real OCR, pixel and colour matching, the
+real clipboard, a network-less namespace, and `npx` installing the packed tarball.
+
+Coverage notes: `src/bin/*` (two-line launchers) and `src/index.ts` (re-export barrel) are excluded, and one line in
+`policy/engine.ts` carries a `v8 ignore` (the filesystem root always resolves).
+
+**Not verified here:** Windows and macOS themselves (their paths are tested against a fake nut.js and fake
+`powershell`/`cmd`: that checks omcps's logic, not those platforms); the proprietary nut.js plugins (not obtainable);
+`screen_highlight`'s overlay (the call is
+tested; the overlay can't be observed headlessly); publishing to the npm registry.

package/dist/agent.d.ts

@@ -0,0 +1,81 @@
+import { DANGEROUS } from "./safety.js";
+import { type PermissionEngine } from "./policy/engine.js";
+import { type Tool, type ToolResult } from "./tools/base.js";
+export { DANGEROUS };
+/**
+ *
+ * @param fn - Loader to install, or `undefined` to restore the default.
+ */
+export declare function __setSdkLoader(fn: (() => Promise<typeof import("@anthropic-ai/sdk")>) | undefined): void;
+export declare const DEFAULT_MODEL = "claude-sonnet-5-5";
+export declare const SYSTEM_PROMPT = "You are an autonomous operator of the user's computer. You act through tools: a shell, files, web search, and (when enabled) screenshots, mouse and keyboard.\n\nHost environment:\n{platform}\n\nWork step by step:\n1. PLAN - call `think` first with a short numbered plan.\n2. ACT - take one small action at a time with the most appropriate tool. Prefer the shell and files over GUI clicking when both can do the job; use the GUI for things only a GUI can do.\n3. VERIFY - after every action check the result (exit codes, file contents, a fresh screenshot). Test your work in this real environment: run the code, run the tests, open the file. Never claim success without evidence.\n4. ADAPT - if something fails, read the error, update the plan with `think`, and try a different approach.\n5. SEARCH - when you lack current or specific knowledge, use web_search and fetch_url instead of guessing.\n6. FINISH - reply with a short summary of what you did and the evidence it worked.\n\nUse commands that match the host OS. Do not run destructive or irreversible commands unless the user asked for them.";
+export type Args = Record<string, unknown>;
+export type ConfirmFn = (tool: string, args: Args) => boolean | Promise<boolean>;
+export type EventFn = (kind: string, data: unknown) => void;
+/** Minimal slice of the Anthropic client the loop needs (lets tests script the model). */
+export interface MessagesClient {
+    messages: {
+        create(params: Record<string, unknown>): Promise<{
+            content: ContentBlock[];
+        }>;
+    };
+}
+export interface ContentBlock {
+    type: string;
+    text?: string;
+    id?: string;
+    name?: string;
+    input?: unknown;
+}
+export interface AgentOptions {
+    model?: string;
+    gui?: boolean;
+    search?: boolean;
+    confirm?: ConfirmFn;
+    confirmAll?: boolean;
+    maxSteps?: number;
+    onEvent?: EventFn;
+    client?: MessagesClient;
+    /** Permission policy; approvals (`ask`) are routed to `confirm`. */
+    policy?: PermissionEngine;
+}
+/**
+ *
+ * @param tool - Tool definition to inspect.
+ * @param args - Arguments supplied to the tool.
+ * @returns Whether confirmation is required.
+ */
+export declare function needsConfirmation(tool: Tool, args: Args): boolean;
+export declare class Agent {
+    private client?;
+    readonly model: string;
+    readonly confirm?: ConfirmFn;
+    readonly confirmAll: boolean;
+    readonly maxSteps: number;
+    readonly onEvent: EventFn;
+    readonly system: string;
+    readonly messages: {
+        role: "user" | "assistant";
+        content: unknown;
+    }[];
+    private tools?;
+    private readonly gui;
+    private readonly search;
+    private readonly engine?;
+    constructor(opts?: AgentOptions);
+    private toolset;
+    /**
+     * The model client. The standalone agent is the ONLY part of this package that talks to an LLM API, so the
+     * Anthropic SDK is an optional peer dependency, loaded here on first use (never by the omcps MCP server).
+     * @returns The resulting value.
+     */
+    private clientFor;
+    /**
+     * Run one tool call. Returns [result, isError].
+     * @param name - Tool name to execute.
+     * @param args - Arguments supplied to the tool.
+     * @returns The tool result and whether it represents an error.
+     */
+    execute(name: string, args: Args): Promise<[ToolResult, boolean]>;
+    run(task: string): Promise<string>;
+}

package/dist/agent.js

@@ -0,0 +1,160 @@
+/** The agent loop: plan step by step, act with OS tools, verify, repeat. */
+import { describePlatform } from "./platform.js";
+import { DANGEROUS } from "./safety.js";
+import { PermissionDenied } from "./policy/engine.js";
+import { buildToolset } from "./tools/index.js";
+import { defineTool } from "./tools/base.js";
+import { callTool, toApi } from "./tools/base.js";
+export { DANGEROUS };
+/**
+ * Test hook: where the optional Anthropic SDK comes from.
+ * @returns The optional Anthropic SDK module.
+ */
+let loadSdk = () => import("@anthropic-ai/sdk");
+/**
+ *
+ * @param fn - Loader to install, or `undefined` to restore the default.
+ */
+export function __setSdkLoader(fn) {
+    loadSdk = fn ?? (() => import("@anthropic-ai/sdk"));
+}
+export const DEFAULT_MODEL = "claude-sonnet-5-5";
+export const SYSTEM_PROMPT = `You are an autonomous operator of the user's computer. You act through tools: a shell, \
+files, web search, and (when enabled) screenshots, mouse and keyboard.
+
+Host environment:
+{platform}
+
+Work step by step:
+1. PLAN - call \`think\` first with a short numbered plan.
+2. ACT - take one small action at a time with the most appropriate tool. Prefer the shell and files over \
+GUI clicking when both can do the job; use the GUI for things only a GUI can do.
+3. VERIFY - after every action check the result (exit codes, file contents, a fresh screenshot). Test your \
+work in this real environment: run the code, run the tests, open the file. Never claim success without evidence.
+4. ADAPT - if something fails, read the error, update the plan with \`think\`, and try a different approach.
+5. SEARCH - when you lack current or specific knowledge, use web_search and fetch_url instead of guessing.
+6. FINISH - reply with a short summary of what you did and the evidence it worked.
+
+Use commands that match the host OS. Do not run destructive or irreversible commands unless the user asked for them.`;
+/**
+ *
+ * @param tool - Tool definition to inspect.
+ * @param args - Arguments supplied to the tool.
+ * @returns Whether confirmation is required.
+ */
+export function needsConfirmation(tool, args) {
+    if (tool.name === "run_command")
+        return DANGEROUS.test(String(args.command ?? ""));
+    return false;
+}
+export class Agent {
+    client;
+    model;
+    confirm;
+    confirmAll;
+    maxSteps;
+    onEvent;
+    system;
+    messages = [];
+    tools;
+    gui;
+    search;
+    engine;
+    constructor(opts = {}) {
+        this.client = opts.client;
+        this.model = opts.model ?? DEFAULT_MODEL;
+        this.gui = opts.gui ?? false;
+        this.search = opts.search ?? true;
+        this.confirm = opts.confirm;
+        this.engine = opts.policy;
+        this.engine?.setAsk(async (req) => (this.confirm ? this.confirm(req.tool, req.args) : undefined));
+        this.confirmAll = opts.confirmAll ?? false;
+        this.maxSteps = opts.maxSteps ?? 40;
+        this.onEvent = opts.onEvent ?? (() => { });
+        this.system = SYSTEM_PROMPT.replace("{platform}", describePlatform());
+    }
+    async toolset() {
+        if (!this.tools) {
+            const all = await buildToolset(this.gui, this.search);
+            const e = this.engine;
+            if (e) {
+                const visible = [...all.values()].filter((t) => e.isVisible(t.name));
+                visible.push(defineTool({ name: "permissions_describe", description: "Describe what you are and are not allowed to do on this computer.", shape: {}, run: () => e.describe(visible), readOnly: true }));
+                this.tools = new Map(visible.map((t) => [t.name, e.wrap(t)]));
+            }
+            else
+                this.tools = all;
+        }
+        return this.tools;
+    }
+    /**
+     * The model client. The standalone agent is the ONLY part of this package that talks to an LLM API, so the
+     * Anthropic SDK is an optional peer dependency, loaded here on first use (never by the omcps MCP server).
+     * @returns The resulting value.
+     */
+    async clientFor() {
+        if (!this.client) {
+            const sdk = await loadSdk().catch(() => {
+                throw new Error("the standalone agent needs the Anthropic SDK: npm install @anthropic-ai/sdk (the omcps MCP server does not)");
+            });
+            this.client = new sdk.default();
+        }
+        return this.client;
+    }
+    /**
+     * Run one tool call. Returns [result, isError].
+     * @param name - Tool name to execute.
+     * @param args - Arguments supplied to the tool.
+     * @returns The tool result and whether it represents an error.
+     */
+    async execute(name, args) {
+        const tool = (await this.toolset()).get(name);
+        if (!tool)
+            return [`[error] unknown tool ${name}`, true];
+        const gated = (this.confirmAll && tool.risky) || needsConfirmation(tool, args);
+        if (gated && (!this.confirm || !(await this.confirm(name, args)))) {
+            return ["[denied] the user did not approve this action; choose a safer approach or explain.", true];
+        }
+        try {
+            return [await callTool(tool, args), false];
+        }
+        catch (e) {
+            if (e instanceof PermissionDenied)
+                return [e.message, true];
+            // report to the model so it can adapt
+            const err = e;
+            return [`[error] ${err.name}: ${err.message}`, true];
+        }
+    }
+    async run(task) {
+        const tools = [...(await this.toolset()).values()].map(toApi);
+        this.messages.push({ role: "user", content: task });
+        for (let step = 0; step < this.maxSteps; step++) {
+            const resp = await (await this.clientFor()).messages.create({
+                model: this.model,
+                max_tokens: 4096,
+                system: this.system,
+                tools,
+                messages: this.messages,
+            });
+            this.messages.push({ role: "assistant", content: resp.content });
+            for (const b of resp.content)
+                if (b.type === "text" && b.text?.trim())
+                    this.onEvent("text", b.text);
+            const calls = resp.content.filter((b) => b.type === "tool_use");
+            if (calls.length === 0)
+                return resp.content.filter((b) => b.type === "text").map((b) => b.text ?? "").join("");
+            const results = [];
+            for (const call of calls) {
+                const args = (call.input ?? {});
+                this.onEvent("tool_call", [call.name, args]);
+                const [out, isError] = await this.execute(call.name, { ...args });
+                this.onEvent("tool_result", [call.name, out]);
+                results.push({ type: "tool_result", tool_use_id: call.id, content: out, is_error: isError });
+            }
+            this.messages.push({ role: "user", content: results });
+        }
+        return `[stopped after ${this.maxSteps} steps without finishing]`;
+    }
+}
+//# sourceMappingURL=agent.js.map

package/dist/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAyB,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAA8B,MAAM,iBAAiB,CAAC;AAE9E,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB;;;GAGG;AACH,IAAI,OAAO,GAAsD,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;AACnG;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,EAAmE;IAChG,OAAO,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;qHAgBwF,CAAC;AAgCtH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAU,EAAE,IAAU;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,KAAK;IACR,MAAM,CAAkB;IACvB,KAAK,CAAS;IACd,OAAO,CAAa;IACpB,UAAU,CAAU;IACpB,QAAQ,CAAS;IACjB,OAAO,CAAU;IACjB,MAAM,CAAS;IACf,QAAQ,GAAuD,EAAE,CAAC;IACnE,KAAK,CAAqB;IACjB,GAAG,CAAU;IACb,MAAM,CAAU;IAChB,MAAM,CAAoB;IAE3C,YAAY,OAAqB,EAAE;QACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACxE,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;YACtB,IAAI,CAAC,EAAE,CAAC;gBACN,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,WAAW,EAAE,mEAAmE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxM,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,CAAC;;gBAAM,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBACrC,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;YACjI,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,EAA+B,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAU;QACpC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,wBAAwB,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/E,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,oFAAoF,EAAE,IAAI,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,gBAAgB;gBAAE,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,sCAAsC;YACtC,MAAM,GAAG,GAAG,CAAU,CAAC;YACvB,OAAO,CAAC,WAAW,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC1D,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK;gBACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAEpG,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;YAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAE/G,MAAM,OAAO,GAAc,EAAE,CAAC;YAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAS,CAAC;gBACxC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC7C,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAc,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC5E,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,kBAAkB,IAAI,CAAC,QAAQ,2BAA2B,CAAC;IACpE,CAAC;CACF"}

package/dist/bin/omcps.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/omcps.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { main } from "../mcpServer.js";
+process.exitCode = await main();
+//# sourceMappingURL=omcps.js.map

package/dist/bin/omcps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"omcps.js","sourceRoot":"","sources":["../../src/bin/omcps.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEvC,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC"}

package/dist/bin/osagent.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/osagent.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { main } from "../cli.js";
+process.exitCode = await main();
+//# sourceMappingURL=osagent.js.map

package/dist/bin/osagent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"osagent.js","sourceRoot":"","sources":["../../src/bin/osagent.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,39 @@
+import type { Readable, Writable } from "node:stream";
+import { type AgentOptions } from "./agent.js";
+export interface Runnable {
+    run(task: string): Promise<string>;
+}
+export interface CliIo {
+    /** Print a line to stdout. */
+    out: (s: string) => void;
+    /** Ask a question; resolves null on EOF / Ctrl-D. */
+    prompt: (q: string) => Promise<string | null>;
+    createAgent: (opts: AgentOptions) => Runnable;
+    /** Streams for the default line reader (tests). */
+    input?: Readable;
+    output?: Writable;
+}
+/**
+ * Queue-based line reader: works for a TTY and for piped stdin, and survives EOF.
+ * @param input - Readable input stream.
+ * @param output - Writable output stream.
+ * @returns A line reader with an `ask` method.
+ */
+export declare function makeLineReader(input?: Readable, output?: Writable): {
+    ask: (q: string) => Promise<string | null>;
+    close: () => void;
+};
+/**
+ *
+ * @param kind - Event kind.
+ * @param data - Event payload to display.
+ * @param out - Output writer.
+ */
+export declare function show(kind: string, data: unknown, out?: (s: string) => void): void;
+/**
+ *
+ * @param argv - Command-line arguments.
+ * @param io - I/O overrides.
+ * @returns The process exit code.
+ */
+export declare function main(argv?: string[], io?: Partial<CliIo>): Promise<number>;