enterprise-ssh-mcp-server 0.3.0 → 0.3.2

package/dist/ssh-target.js

@@ -0,0 +1,58 @@
+import { McpToolError } from "./tool-result.js";
+/** InstaBox SSH tokens are bearer credentials encoded as the SSH username. */
+export function redactSshUsername(username) {
+    return /^ibssh_/i.test(username) ? "ibssh_[REDACTED]" : username;
+}
+export function isInstaboxSshTokenTarget(target) {
+    return target.host.toLowerCase() === "ssh.instabox.sh" && /^ibssh_/i.test(target.username);
+}
+/** Reject option-like hosts and characters that could alter SSH config/CLI parsing. */
+export function validateSshHostname(host) {
+    if (host.length === 0
+        || host.startsWith("-")
+        || /\s/.test(host)
+        || host.includes("@")
+        || host.includes("/")
+        || host.includes("\\")
+        || host.includes("://")
+        || !/^[A-Za-z0-9._:-]+$/.test(host)) {
+        throw new McpToolError("ssh_target_invalid", "SSH host must be a hostname/IP without option prefixes, URL schemes, paths, whitespace, or shell/config metacharacters", { field: "host" });
+    }
+}
+/**
+ * Accept either separate host/username fields or the common SSH target form
+ * "username@hostname". This parses the target only; it does not authenticate
+ * the caller or establish trust in the remote host key.
+ */
+export function parseSshTarget(input) {
+    const rawHost = input.host.trim();
+    const suppliedUsername = input.username?.trim();
+    if (rawHost.length === 0) {
+        throw new McpToolError("ssh_target_invalid", "SSH host must not be empty", { field: "host" });
+    }
+    if (/\s/.test(rawHost) || rawHost.includes("://") || rawHost.includes("/") || rawHost.includes("\\")) {
+        throw new McpToolError("ssh_target_invalid", "SSH host must be a hostname/IP, optionally prefixed with username@; do not include a URL scheme, path, or whitespace", { field: "host" });
+    }
+    const firstAt = rawHost.indexOf("@");
+    if (firstAt >= 0) {
+        if (firstAt === 0 || firstAt === rawHost.length - 1 || rawHost.indexOf("@", firstAt + 1) >= 0) {
+            throw new McpToolError("ssh_target_invalid", "Expected SSH target in username@hostname format", { field: "host" });
+        }
+        const embeddedUsername = rawHost.slice(0, firstAt);
+        const hostname = rawHost.slice(firstAt + 1);
+        validateSshHostname(hostname);
+        if (suppliedUsername !== undefined && suppliedUsername.length > 0 && suppliedUsername !== embeddedUsername) {
+            throw new McpToolError("ssh_target_username_conflict", "The username in host does not match the separately supplied username", { embeddedUsername, suppliedUsername });
+        }
+        return { host: hostname, username: embeddedUsername };
+    }
+    if (suppliedUsername === undefined || suppliedUsername.length === 0) {
+        throw new McpToolError("ssh_target_username_required", "Provide username separately, or set host to username@hostname", { field: "username" });
+    }
+    validateSshHostname(rawHost);
+    if (suppliedUsername.includes("@") || /\s/.test(suppliedUsername)) {
+        throw new McpToolError("ssh_target_invalid", "SSH username must not contain @ or whitespace", { field: "username" });
+    }
+    return { host: rawHost, username: suppliedUsername };
+}
+//# sourceMappingURL=ssh-target.js.map

package/dist/ssh-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-target.js","sourceRoot":"","sources":["../src/ssh-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAYhD,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAiB;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,iBAAiB,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC7F,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IACE,IAAI,CAAC,MAAM,KAAK,CAAC;WACd,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;WACpB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;WACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;WAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;WAClB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;WACnB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;WACpB,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EACnC,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,wHAAwH,EACxH,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,gBAAgB,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAEhD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,4BAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,sHAAsH,EACtH,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,iDAAiD,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACrH,CAAC;QAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAC5C,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;YAC3G,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,sEAAsE,EACtE,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CACvC,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,+DAA+D,EAC/D,EAAE,KAAK,EAAE,UAAU,EAAE,CACtB,CAAC;IACJ,CAAC;IAED,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7B,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,+CAA+C,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;AACvD,CAAC"}

package/dist/tools/register-config-profile-tools.d.ts

@@ -0,0 +1,2 @@
+import type { ToolContext } from "../app/tool-context.js";
+export declare function registerConfigProfileTools(ctx: Pick<ToolContext, "z" | "toToolResult" | "profiles" | "runtimeConfig" | "reloadEnvState" | "sessions" | "wireEncodingSchema" | "remoteCheckNameSchema" | "DEFAULT_REMOTE_CHECKS" | "REMOTE_CHECK_COMMANDS" | "registerTool" | "connectProfileSession" | "buildRemoteCommand" | "runRemoteCheck">): void;

package/dist/tools/register-config-profile-tools.js

@@ -0,0 +1,179 @@
+export function registerConfigProfileTools(ctx) {
+    const { z, toToolResult, profiles, runtimeConfig, reloadEnvState, sessions, wireEncodingSchema, remoteCheckNameSchema, DEFAULT_REMOTE_CHECKS, REMOTE_CHECK_COMMANDS, registerTool, connectProfileSession, buildRemoteCommand, runRemoteCheck } = ctx;
+    registerTool("ssh_get_config", {
+        title: "Get SSH MCP runtime config",
+        description: "Return non-secret runtime defaults loaded from the MCP .env file.",
+        inputSchema: {},
+    }, async () => toToolResult(async () => ({ ok: true, config: runtimeConfig.get() })));
+    registerTool("ssh_reload_config", {
+        title: "Reload SSH MCP runtime config",
+        description: "Atomically reload runtime defaults and SSH profiles from the MCP .env file without restarting. Tool visibility still reflects startup settings and may require an MCP restart.",
+        inputSchema: {},
+    }, async () => toToolResult(async () => {
+        const snapshot = reloadEnvState();
+        return {
+            ok: true,
+            config: snapshot.config,
+            profilesReloaded: snapshot.profiles.length,
+            restartRequiredForToolVisibility: snapshot.restartRequiredForToolVisibility,
+            note: "Runtime defaults and profiles were reloaded as one validated snapshot. If toolset or dangerous-tool visibility settings differ from startup, restart the MCP server to apply them.",
+        };
+    }));
+    registerTool("ssh_list_profiles", {
+        title: "List SSH profiles",
+        description: "List SSH server profiles loaded from the MCP server .env file. Secret values are never returned.",
+        inputSchema: {},
+    }, async () => toToolResult(async () => ({
+        ok: true,
+        envPath: profiles.sourcePath(),
+        profiles: profiles.list(),
+    })));
+    registerTool("ssh_reload_profiles", {
+        title: "Reload SSH profiles",
+        description: "Atomically reload SSH profiles and runtime defaults from the MCP server .env file without restarting the MCP server.",
+        inputSchema: {},
+    }, async () => toToolResult(async () => {
+        const snapshot = reloadEnvState();
+        return {
+            ok: true,
+            envPath: profiles.sourcePath(),
+            profiles: snapshot.profiles,
+            runtimeConfigReloaded: true,
+            restartRequiredForToolVisibility: snapshot.restartRequiredForToolVisibility,
+        };
+    }));
+    registerTool("ssh_connect_profile", {
+        title: "Open SSH profile session",
+        description: "Open a persistent SSH session using an SSH_MCP_SERVER_<N>_* profile from .env.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            sessionName: z.string().min(1).optional(),
+            tryKeyboard: z.boolean().optional(),
+            keyboardResponses: z.array(z.string()).default([]),
+            agentForward: z.boolean().optional(),
+            keepaliveIntervalMs: z.number().int().min(0).optional(),
+            keepaliveCountMax: z.number().int().min(1).optional(),
+            readyTimeoutMs: z.number().int().min(1_000).optional(),
+            connectionTimeoutMs: z.number().int().min(1_000).optional(),
+            hostHash: z.enum(["md5", "sha1", "sha256"]).optional(),
+            expectedHostHash: z.string().optional(),
+            strictVendor: z.boolean().default(true),
+            debug: z.boolean().default(false),
+        },
+    }, async (args) => toToolResult(async () => {
+        const connected = await connectProfileSession({
+            profileName: args.profileName,
+            sessionName: args.sessionName,
+            agentForward: args.agentForward,
+            tryKeyboard: args.tryKeyboard,
+            keyboardResponses: args.keyboardResponses,
+            keepaliveIntervalMs: args.keepaliveIntervalMs,
+            keepaliveCountMax: args.keepaliveCountMax,
+            readyTimeoutMs: args.readyTimeoutMs,
+            connectionTimeoutMs: args.connectionTimeoutMs,
+            strictVendor: args.strictVendor,
+            debug: args.debug,
+            hostHash: args.hostHash,
+            expectedHostHash: args.expectedHostHash,
+        });
+        return {
+            ok: true,
+            profile: connected.profile,
+            session: connected.session,
+        };
+    }));
+    registerTool("ssh_run_profile", {
+        title: "Run command on SSH profile",
+        description: "Use this first for one-shot remote commands on a configured SSH profile. Prefer this over connect + exec when the user only asks to run a command or inspect a server.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            command: z.string().min(1),
+            workingDirectory: z.string().min(1).optional(),
+            keepSession: z.boolean().default(false),
+            outputEncoding: wireEncodingSchema,
+            timeoutMs: z.number().int().min(1).optional(),
+            maxOutputBytes: z.number().int().min(1).max(64 * 1024 * 1024).optional(),
+        },
+    }, async (args) => toToolResult(async () => {
+        const config = runtimeConfig.get();
+        const connected = await connectProfileSession({
+            profileName: args.profileName,
+            keyboardResponses: [],
+            strictVendor: true,
+            debug: false,
+        });
+        const command = buildRemoteCommand(args.command, args.workingDirectory);
+        try {
+            const result = await sessions.get(connected.session.id).exec({
+                command,
+                stdinEncoding: "utf8",
+                outputEncoding: args.outputEncoding,
+                timeoutMs: args.timeoutMs ?? config.defaultExecTimeoutMs,
+                maxOutputBytes: args.maxOutputBytes ?? config.defaultMaxOutputBytes,
+            });
+            return {
+                ok: true,
+                profile: connected.profile,
+                session: connected.session,
+                keptSession: args.keepSession,
+                result,
+            };
+        }
+        finally {
+            if (!args.keepSession) {
+                await sessions.disconnect(connected.session.id);
+            }
+        }
+    }));
+    registerTool("ssh_check_profile", {
+        title: "Check SSH profile host",
+        description: "Agent-friendly one-shot remote health check: connect to a named profile, run safe built-in inspection commands, return structured results, and disconnect.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            checks: z.array(remoteCheckNameSchema).default(DEFAULT_REMOTE_CHECKS),
+            workingDirectory: z.string().min(1).optional(),
+            timeoutMs: z.number().int().min(1).optional(),
+            maxOutputBytes: z.number().int().min(1).max(64 * 1024 * 1024).optional(),
+        },
+    }, async (args) => toToolResult(async () => {
+        const config = runtimeConfig.get();
+        const connected = await connectProfileSession({
+            profileName: args.profileName,
+            keyboardResponses: [],
+            strictVendor: true,
+            debug: false,
+        });
+        const session = sessions.get(connected.session.id);
+        const selectedChecks = [...new Set(args.checks)];
+        try {
+            const checks = [];
+            for (const checkName of selectedChecks) {
+                const check = REMOTE_CHECK_COMMANDS[checkName];
+                checks.push(await runRemoteCheck({
+                    name: checkName,
+                    title: check.title,
+                    command: buildRemoteCommand(check.command, args.workingDirectory),
+                    timeoutMs: args.timeoutMs ?? config.defaultExecTimeoutMs,
+                    maxOutputBytes: args.maxOutputBytes ?? config.defaultMaxOutputBytes,
+                    execute: (command) => session.exec({
+                        command,
+                        stdinEncoding: "utf8",
+                        outputEncoding: "utf8",
+                        timeoutMs: args.timeoutMs ?? config.defaultExecTimeoutMs,
+                        maxOutputBytes: args.maxOutputBytes ?? config.defaultMaxOutputBytes,
+                    }),
+                }));
+            }
+            return {
+                ok: true,
+                profile: connected.profile,
+                session: connected.session,
+                checks,
+            };
+        }
+        finally {
+            await sessions.disconnect(connected.session.id);
+        }
+    }));
+}
+//# sourceMappingURL=register-config-profile-tools.js.map

package/dist/tools/register-config-profile-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-config-profile-tools.js","sourceRoot":"","sources":["../../src/tools/register-config-profile-tools.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,0BAA0B,CAAC,GAAqS;IAC9U,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,YAAY,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC;IAErP,YAAY,CACV,gBAAgB,EAChB;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,mEAAmE;QAChF,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAClF,CAAC;IAEF,YAAY,CACV,mBAAmB,EACnB;QACE,KAAK,EAAE,+BAA+B;QACtC,WAAW,EAAE,gLAAgL;QAC7L,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CACT,YAAY,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;YAC1C,gCAAgC,EAAE,QAAQ,CAAC,gCAAgC;YAC3E,IAAI,EAAE,oLAAoL;SAC3L,CAAC;IACJ,CAAC,CAAC,CACL,CAAC;IAEF,YAAY,CACV,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,kGAAkG;QAC/G,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CACT,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACxB,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE;QAC9B,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;KAC1B,CAAC,CAAC,CACN,CAAC;IAEF,YAAY,CACV,qBAAqB,EACrB;QACE,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,sHAAsH;QACnI,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CACT,YAAY,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE;YAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,qBAAqB,EAAE,IAAI;YAC3B,gCAAgC,EAAE,QAAQ,CAAC,gCAAgC;SAC5E,CAAC;IACJ,CAAC,CAAC,CACL,CAAC;IAEF,YAAY,CACV,qBAAqB,EACrB;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,gFAAgF;QAC7F,WAAW,EAAE;YACX,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;YACzC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACnC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACpC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;YACvD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;YACrD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;YACtD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;YAC3D,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;YACtD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACvC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YACvC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SAClC;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,YAAY,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC;YAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC;IACJ,CAAC,CAAC,CACL,CAAC;IAEF,YAAY,CACV,iBAAiB,EACjB;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,wKAAwK;QAC1K,WAAW,EAAE;YACX,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC9C,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;YACvC,cAAc,EAAE,kBAAkB;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;SACzE;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,YAAY,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC;YAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,iBAAiB,EAAE,EAAE;YACrB,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;gBAC3D,OAAO;gBACP,aAAa,EAAE,MAAM;gBACrB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,oBAAoB;gBACxD,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,qBAAqB;aACpE,CAAC,CAAC;YAEH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM;aACP,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CACL,CAAC;IAEF,YAAY,CACV,mBAAmB,EACnB;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,4JAA4J;QAC9J,WAAW,EAAE;YACX,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;YACrE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;SACzE;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,YAAY,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC;YAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,iBAAiB,EAAE,EAAE;YACrB,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE,CAAC;YAClB,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;gBAC/C,MAAM,CAAC,IAAI,CACT,MAAM,cAAc,CAAC;oBACnB,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC;oBACjE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,oBAAoB;oBACxD,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,qBAAqB;oBACnE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CACnB,OAAO,CAAC,IAAI,CAAC;wBACX,OAAO;wBACP,aAAa,EAAE,MAAM;wBACrB,cAAc,EAAE,MAAM;wBACtB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,oBAAoB;wBACxD,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,qBAAqB;qBACpE,CAAC;iBACL,CAAC,CACH,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,MAAM;aACP,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC,CACL,CAAC;AACJ,CAAC"}

package/dist/tools/register-project-tools.d.ts

@@ -0,0 +1,2 @@
+import type { ToolContext } from "../app/tool-context.js";
+export declare function registerProjectTools(ctx: Pick<ToolContext, "z" | "sftpStat" | "statsToJson" | "McpToolError" | "toToolResult" | "defaultTreeOptions" | "maxEditFileBytes" | "parseUnifiedPatch" | "publicSnapshot" | "readRemoteFileSnapshot" | "readRemoteTree" | "resolveSafeRemotePath" | "sha256" | "runtimeConfig" | "sessions" | "editHistory" | "projectRootSchema" | "fileEncodingSchema" | "expectedShaSchema" | "expectedFileSchema" | "projectPathSchema" | "registerTool" | "connectProjectWorkspace" | "inspectRemoteProject" | "projectProfileSummary" | "writeProjectFile" | "applySinglePatchFile" | "validateProjectPatch" | "applyProjectPatch" | "deleteProjectFile" | "moveProjectFile" | "rollbackEdit" | "resolveProjectPathArgs" | "assertPatchSize" | "compactTreeOptions" | "buildProjectSearchCommand" | "buildProjectDiffCommand" | "parseSearchMatches" | "normalizeProfileNameForHistory" | "buildRemoteCommand">): void;

package/dist/tools/register-project-tools.js

@@ -0,0 +1,377 @@
+export function registerProjectTools(ctx) {
+    const { z, sftpStat, statsToJson, McpToolError, toToolResult, defaultTreeOptions, maxEditFileBytes, parseUnifiedPatch, publicSnapshot, readRemoteFileSnapshot, readRemoteTree, resolveSafeRemotePath, sha256, runtimeConfig, sessions, editHistory, projectRootSchema, fileEncodingSchema, expectedShaSchema, expectedFileSchema, projectPathSchema, registerTool, connectProjectWorkspace, inspectRemoteProject, projectProfileSummary, writeProjectFile, applySinglePatchFile, validateProjectPatch, applyProjectPatch, deleteProjectFile, moveProjectFile, rollbackEdit, resolveProjectPathArgs, assertPatchSize, compactTreeOptions, buildProjectSearchCommand, buildProjectDiffCommand, parseSearchMatches, normalizeProfileNameForHistory, buildRemoteCommand } = ctx;
+    registerTool("ssh_project_open", {
+        title: "Open SSH project",
+        description: "Resolve and inspect the editable project root for a configured SSH profile.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            projectRoot: projectRootSchema,
+        },
+    }, async (args) => toToolResult(async () => {
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, false);
+        try {
+            return {
+                ok: true,
+                profile: projectProfileSummary(workspace.profile),
+                project: await inspectRemoteProject(workspace.session, workspace.rootPath),
+            };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_project_tree", {
+        title: "Read SSH project tree",
+        description: "Return a bounded remote project tree rooted inside the profile edit root/default directory.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            projectRoot: projectRootSchema,
+            maxDepth: z.number().int().min(1).max(12).optional(),
+            maxEntries: z.number().int().min(1).max(10_000).optional(),
+            includeHidden: z.boolean().optional(),
+            ignoreNames: z.array(z.string().min(1)).optional(),
+        },
+    }, async (args) => toToolResult(async () => {
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, false);
+        try {
+            return {
+                ok: true,
+                tree: await readRemoteTree(workspace.sftp, workspace.rootPath, defaultTreeOptions(compactTreeOptions(args.maxDepth, args.maxEntries, args.includeHidden, args.ignoreNames))),
+            };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_project_search", {
+        title: "Search SSH project",
+        description: "Search text in a remote project using rg when available, with grep fallback.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            query: z.string().min(1),
+            projectRoot: projectRootSchema,
+            paths: z.array(projectPathSchema).default([]),
+            literal: z.boolean().default(true),
+            maxResults: z.number().int().min(1).max(1000).default(100),
+            contextLines: z.number().int().min(0).max(5).default(0),
+            timeoutMs: z.number().int().min(1).optional(),
+            maxOutputBytes: z.number().int().min(1).max(64 * 1024 * 1024).optional(),
+        },
+    }, async (args) => toToolResult(async () => {
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, false);
+        try {
+            const config = runtimeConfig.get();
+            const paths = await resolveProjectPathArgs(workspace, args.paths, true);
+            const result = await workspace.session.exec({
+                command: buildProjectSearchCommand(workspace.rootPath, args.query, paths, args.literal, args.maxResults, args.contextLines),
+                stdinEncoding: "utf8",
+                outputEncoding: "utf8",
+                timeoutMs: args.timeoutMs ?? config.defaultExecTimeoutMs,
+                maxOutputBytes: args.maxOutputBytes ?? config.defaultMaxOutputBytes,
+            });
+            return {
+                ok: true,
+                projectRoot: workspace.rootPath,
+                matches: parseSearchMatches(result.stdout.text ?? ""),
+                truncated: result.stdout.truncated,
+                result,
+            };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_project_stat", {
+        title: "Stat SSH project path",
+        description: "Return metadata for a file or directory inside the project root, with sha256 for editable files.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            path: projectPathSchema,
+            projectRoot: projectRootSchema,
+        },
+    }, async (args) => toToolResult(async () => {
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, false);
+        try {
+            const safePath = await resolveSafeRemotePath(workspace.sftp, workspace.profile, workspace.rootPath, args.path, true);
+            const stats = await sftpStat(workspace.sftp, safePath.remotePath, true);
+            const payload = {
+                ok: true,
+                path: args.path,
+                remotePath: safePath.remotePath,
+                stats: statsToJson(stats),
+            };
+            if (stats.isFile() && stats.size <= maxEditFileBytes(workspace.profile, runtimeConfig.get().defaultMaxEditFileBytes)) {
+                payload.sha256 = (await readRemoteFileSnapshot(workspace.sftp, safePath.remotePath, stats.size)).sha256;
+            }
+            return payload;
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_file_read", {
+        title: "Read SSH project file",
+        description: "Read a bounded file inside the project root and return content plus sha256 for safe edits.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            path: projectPathSchema,
+            projectRoot: projectRootSchema,
+            encoding: fileEncodingSchema,
+            maxBytes: z.number().int().min(1).max(64 * 1024 * 1024).optional(),
+        },
+    }, async (args) => toToolResult(async () => {
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, false);
+        try {
+            const safePath = await resolveSafeRemotePath(workspace.sftp, workspace.profile, workspace.rootPath, args.path, true);
+            const snapshot = await readRemoteFileSnapshot(workspace.sftp, safePath.remotePath, args.maxBytes ?? maxEditFileBytes(workspace.profile, runtimeConfig.get().defaultMaxEditFileBytes));
+            return { ok: true, file: publicSnapshot(snapshot, args.encoding) };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_file_patch", {
+        title: "Patch SSH project file",
+        description: "Apply a unified diff to one file inside the project root using sha256 concurrency protection and atomic write.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            path: projectPathSchema,
+            projectRoot: projectRootSchema,
+            unifiedPatch: z.string().min(1),
+            expectedSha256: expectedShaSchema,
+            createDirs: z.boolean().default(false),
+        },
+        annotations: { destructiveHint: true },
+    }, async (args) => toToolResult(async () => {
+        assertPatchSize(args.unifiedPatch);
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, true);
+        try {
+            const patchFiles = parseUnifiedPatch(args.unifiedPatch);
+            if (patchFiles.length !== 1) {
+                throw new McpToolError("ssh_file_patch_file_count_invalid", "ssh_file_patch expects exactly one file in unifiedPatch", {
+                    fileCount: patchFiles.length,
+                });
+            }
+            return {
+                ok: true,
+                edit: await applySinglePatchFile(workspace, args.path, patchFiles[0], args.expectedSha256, args.createDirs),
+            };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_project_validate_patch", {
+        title: "Validate SSH project patch",
+        description: "Validate that a multi-file unified diff applies cleanly without modifying remote files.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            projectRoot: projectRootSchema,
+            unifiedPatch: z.string().min(1),
+            expectedFiles: z.array(expectedFileSchema).default([]),
+        },
+    }, async (args) => toToolResult(async () => {
+        assertPatchSize(args.unifiedPatch);
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, false);
+        try {
+            return {
+                ok: true,
+                validation: await validateProjectPatch(workspace, parseUnifiedPatch(args.unifiedPatch), args.expectedFiles),
+            };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_project_apply_patch", {
+        title: "Apply SSH project patch",
+        description: "Apply a multi-file unified diff inside the project root with backups, sha256 protection, and rollback on failure.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            projectRoot: projectRootSchema,
+            unifiedPatch: z.string().min(1),
+            expectedFiles: z.array(expectedFileSchema).min(1),
+            createDirs: z.boolean().default(false),
+        },
+        annotations: { destructiveHint: true },
+    }, async (args) => toToolResult(async () => {
+        assertPatchSize(args.unifiedPatch);
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, true);
+        try {
+            return {
+                ok: true,
+                edit: await applyProjectPatch(workspace, parseUnifiedPatch(args.unifiedPatch), args.expectedFiles, args.createDirs),
+            };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_file_write", {
+        title: "Write SSH project file",
+        description: "Overwrite or create one project file with sha256/absent protection and atomic write.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            path: projectPathSchema,
+            projectRoot: projectRootSchema,
+            data: z.string(),
+            encoding: fileEncodingSchema,
+            expectedSha256: expectedShaSchema.optional(),
+            createDirs: z.boolean().default(false),
+            mode: z.number().int().min(0).max(0o7777).optional(),
+        },
+        annotations: { destructiveHint: true },
+    }, async (args) => toToolResult(async () => {
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, true);
+        try {
+            return {
+                ok: true,
+                edit: await writeProjectFile(workspace, args.path, args.encoding === "base64" ? Buffer.from(args.data, "base64") : Buffer.from(args.data, "utf8"), args.expectedSha256, args.createDirs, args.mode),
+            };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_file_delete", {
+        title: "Delete SSH project file",
+        description: "Delete one project file after sha256 verification. Requires profile ALLOW_DELETE=true.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            path: projectPathSchema,
+            projectRoot: projectRootSchema,
+            expectedSha256: z.string().length(64),
+        },
+        annotations: { destructiveHint: true },
+    }, async (args) => toToolResult(async () => {
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, true);
+        try {
+            return { ok: true, edit: await deleteProjectFile(workspace, args.path, args.expectedSha256) };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_file_move", {
+        title: "Move SSH project file",
+        description: "Move or rename one project file inside the project root. Requires profile ALLOW_EDIT=true.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            fromPath: projectPathSchema,
+            toPath: projectPathSchema,
+            projectRoot: projectRootSchema,
+            expectedSha256: z.string().length(64),
+            createDirs: z.boolean().default(false),
+        },
+        annotations: { destructiveHint: true },
+    }, async (args) => toToolResult(async () => {
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, true);
+        try {
+            return {
+                ok: true,
+                edit: await moveProjectFile(workspace, args.fromPath, args.toPath, args.expectedSha256, args.createDirs),
+            };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_project_diff", {
+        title: "Read SSH project diff",
+        description: "Return git status and diff for the remote project when it is a git repository.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            projectRoot: projectRootSchema,
+            paths: z.array(projectPathSchema).default([]),
+            timeoutMs: z.number().int().min(1).optional(),
+            maxOutputBytes: z.number().int().min(1).max(64 * 1024 * 1024).optional(),
+        },
+    }, async (args) => toToolResult(async () => {
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, false);
+        try {
+            const config = runtimeConfig.get();
+            const paths = await resolveProjectPathArgs(workspace, args.paths, false);
+            const result = await workspace.session.exec({
+                command: buildProjectDiffCommand(workspace.rootPath, paths),
+                stdinEncoding: "utf8",
+                outputEncoding: "utf8",
+                timeoutMs: args.timeoutMs ?? config.defaultExecTimeoutMs,
+                maxOutputBytes: args.maxOutputBytes ?? config.defaultMaxOutputBytes,
+            });
+            return { ok: true, projectRoot: workspace.rootPath, result };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_project_run_checks", {
+        title: "Run SSH project checks",
+        description: "Run explicit project verification commands from the project root.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            projectRoot: projectRootSchema,
+            checks: z.array(z.string().min(1)).min(1),
+            timeoutMs: z.number().int().min(1).optional(),
+            maxOutputBytes: z.number().int().min(1).max(64 * 1024 * 1024).optional(),
+        },
+    }, async (args) => toToolResult(async () => {
+        const workspace = await connectProjectWorkspace(args.profileName, args.projectRoot, false);
+        try {
+            const config = runtimeConfig.get();
+            const results = [];
+            for (const check of args.checks) {
+                results.push(await workspace.session.exec({
+                    command: buildRemoteCommand(check, workspace.rootPath),
+                    stdinEncoding: "utf8",
+                    outputEncoding: "utf8",
+                    timeoutMs: args.timeoutMs ?? config.defaultExecTimeoutMs,
+                    maxOutputBytes: args.maxOutputBytes ?? config.defaultMaxOutputBytes,
+                }));
+            }
+            return {
+                ok: true,
+                projectRoot: workspace.rootPath,
+                passed: results.every((result) => result.exitCode === 0 && !result.timedOut),
+                results,
+            };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+    registerTool("ssh_edit_history", {
+        title: "List SSH edit history",
+        description: "List in-memory edit records created by this MCP server process.",
+        inputSchema: {
+            profileName: z.string().min(1).optional(),
+            limit: z.number().int().min(1).max(500).default(50),
+        },
+    }, async (args) => toToolResult(async () => ({
+        ok: true,
+        edits: [...editHistory.values()]
+            .filter((edit) => args.profileName === undefined || edit.profileName === normalizeProfileNameForHistory(args.profileName))
+            .slice(-args.limit),
+    })));
+    registerTool("ssh_edit_rollback", {
+        title: "Rollback SSH edit",
+        description: "Rollback an edit created by this MCP server process using stored backup paths.",
+        inputSchema: {
+            profileName: z.string().min(1),
+            editId: z.string().min(1),
+        },
+        annotations: { destructiveHint: true },
+    }, async (args) => toToolResult(async () => {
+        const edit = editHistory.get(args.editId);
+        if (edit === undefined) {
+            throw new McpToolError("ssh_edit_not_found", "SSH edit id was not found", { editId: args.editId });
+        }
+        const workspace = await connectProjectWorkspace(args.profileName, edit.projectRoot, true);
+        try {
+            return { ok: true, rollback: await rollbackEdit(workspace, edit) };
+        }
+        finally {
+            await sessions.disconnect(workspace.sessionId);
+        }
+    }));
+}
+//# sourceMappingURL=register-project-tools.js.map