gemini-mcp-bridge 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tim Birrell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,103 @@
+# gemini-mcp-bridge
+
+MCP server that wraps [Gemini CLI](https://github.com/google-gemini/gemini-cli) as a subprocess, exposing its best features as [Model Context Protocol](https://modelcontextprotocol.io/) tools.
+
+Works with any MCP client: Claude Code, Codex CLI, Cursor, Windsurf, VS Code, or any tool that speaks MCP.
+
+## Tools
+
+| Tool | Description |
+|------|-------------|
+| **query** | Send a prompt to Gemini with optional file context. The CLI reads your GEMINI.md for project context automatically. |
+| **review** | Code review via git diff. Computes the diff locally and asks Gemini for structured findings (severity, file, line, suggestion). |
+| **ping** | Health check. Verifies CLI is installed and authenticated, reports versions and capabilities. |
+
+## Prerequisites
+
+```bash
+npm i -g @google/gemini-cli
+gemini auth login
+```
+
+## Installation
+
+### Claude Code
+
+```bash
+claude mcp add gemini -s user -- npx -y gemini-mcp-bridge
+```
+
+### Codex CLI
+
+Add to `~/.codex/config.json`:
+```json
+{
+  "mcpServers": {
+    "gemini": {
+      "command": "npx",
+      "args": ["-y", "gemini-mcp-bridge"]
+    }
+  }
+}
+```
+
+### Cursor / Windsurf / VS Code
+
+Add to your MCP settings:
+```json
+{
+  "gemini": {
+    "command": "npx",
+    "args": ["-y", "gemini-mcp-bridge"]
+  }
+}
+```
+
+## Tool Reference
+
+### query
+
+Send a prompt to Gemini, optionally including file contents.
+
+| Parameter | Type | Default | Description |
+|-----------|------|---------|-------------|
+| `prompt` | string | *required* | The prompt to send |
+| `files` | string[] | `[]` | File paths (relative to workingDirectory) to include |
+| `model` | string | CLI default | Model to use (e.g. `gemini-2.5-flash`) |
+| `workingDirectory` | string | cwd | Working directory (CLI reads GEMINI.md from here) |
+| `timeout` | number | 60000 | Timeout in ms (max 600000) |
+
+### review
+
+Code review via git diff sent to Gemini.
+
+| Parameter | Type | Default | Description |
+|-----------|------|---------|-------------|
+| `uncommitted` | boolean | `true` | Review uncommitted changes (staged + unstaged) |
+| `base` | string | — | Base branch to diff against (e.g. `main`) |
+| `workingDirectory` | string | cwd | Repository directory (auto-resolves to git root) |
+| `timeout` | number | 120000 | Timeout in ms (max 600000) |
+
+### ping
+
+Health check with no parameters. Returns CLI version, auth status, and server info.
+
+## Configuration
+
+Environment variables:
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `GEMINI_CLI_PATH` | `gemini` | Path to gemini CLI binary |
+| `GEMINI_MAX_CONCURRENT` | `3` | Max concurrent subprocess spawns |
+
+## Security
+
+- **Environment isolation**: Subprocess receives a minimal env allowlist (HOME, PATH, GOOGLE_*, GEMINI_*). Your API keys, tokens, and credentials are not leaked.
+- **Path sandboxing**: All file paths are resolved via `realpath` and verified within the working directory. No path traversal via `..` or symlinks.
+- **No shell execution**: Subprocess spawned with `shell: false` and args as an array. No command injection.
+- **Resource limits**: Max 3 concurrent spawns (configurable), 600s hard timeout cap, 1MB per-file size limit, 20 files max.
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { executeQuery } from "./tools/query.js";
+import { executeReview } from "./tools/review.js";
+import { executePing } from "./tools/ping.js";
+const require = createRequire(import.meta.url);
+const { version: PKG_VERSION } = require("../package.json");
+const server = new McpServer({
+    name: "gemini-mcp-bridge",
+    version: PKG_VERSION,
+});
+// --- query tool ---
+server.tool("query", "Send a prompt to Gemini CLI with optional file context. The CLI reads GEMINI.md for project context automatically.", {
+    prompt: z.string().describe("The prompt to send to Gemini"),
+    files: z
+        .array(z.string())
+        .optional()
+        .describe("File paths (relative to workingDirectory) to include in the prompt"),
+    model: z.string().optional().describe("Gemini model to use (e.g. gemini-2.5-flash, gemini-2.5-pro)"),
+    workingDirectory: z
+        .string()
+        .optional()
+        .describe("Working directory for the CLI (reads GEMINI.md from here)"),
+    timeout: z
+        .number()
+        .optional()
+        .describe("Timeout in milliseconds (default: 60000, max: 600000)"),
+}, async (input) => {
+    try {
+        const result = await executeQuery(input);
+        const meta = [];
+        if (result.filesIncluded.length > 0) {
+            meta.push(`Files included: ${result.filesIncluded.join(", ")}`);
+        }
+        if (result.filesSkipped.length > 0) {
+            meta.push(`Files skipped: ${result.filesSkipped.join(", ")}`);
+        }
+        if (result.timedOut) {
+            meta.push("(timed out)");
+        }
+        if (result.model) {
+            meta.push(`Model: ${result.model}`);
+        }
+        const text = meta.length > 0
+            ? `${result.response}\n\n---\n${meta.join("\n")}`
+            : result.response;
+        return { content: [{ type: "text", text }] };
+    }
+    catch (e) {
+        return {
+            content: [{ type: "text", text: `Error: ${e.message}` }],
+            isError: true,
+        };
+    }
+});
+// --- review tool ---
+server.tool("review", "Code review via git diff sent to Gemini. Computes diff locally and asks Gemini for a structured review.", {
+    uncommitted: z
+        .boolean()
+        .optional()
+        .describe("Review uncommitted changes (staged + unstaged). Default: true"),
+    base: z
+        .string()
+        .optional()
+        .describe("Base branch/ref to diff against (e.g. 'main'). Overrides uncommitted."),
+    workingDirectory: z
+        .string()
+        .optional()
+        .describe("Repository directory (auto-resolves to git root)"),
+    timeout: z
+        .number()
+        .optional()
+        .describe("Timeout in milliseconds (default: 120000, max: 600000)"),
+}, async (input) => {
+    try {
+        const result = await executeReview(input);
+        const meta = [
+            `Diff source: ${result.diffSource}`,
+        ];
+        if (result.base)
+            meta.push(`Base: ${result.base}`);
+        if (result.timedOut)
+            meta.push("(timed out)");
+        return {
+            content: [{
+                    type: "text",
+                    text: `${result.response}\n\n---\n${meta.join("\n")}`,
+                }],
+        };
+    }
+    catch (e) {
+        return {
+            content: [{ type: "text", text: `Error: ${e.message}` }],
+            isError: true,
+        };
+    }
+});
+// --- ping tool ---
+server.tool("ping", "Health check: verifies gemini CLI is installed and authenticated, reports versions and capabilities.", {}, async () => {
+    try {
+        const result = await executePing();
+        const lines = [
+            `CLI found: ${result.cliFound ? "yes" : "NO — install with: npm i -g @google/gemini-cli"}`,
+            `CLI version: ${result.version ?? "unknown"}`,
+            `Auth status: ${result.authStatus}`,
+            `Server version: ${result.serverVersion}`,
+            `Node version: ${result.nodeVersion}`,
+            `Max concurrent: ${result.maxConcurrent}`,
+        ];
+        return {
+            content: [{ type: "text", text: lines.join("\n") }],
+        };
+    }
+    catch (e) {
+        return {
+            content: [{ type: "text", text: `Error: ${e.message}` }],
+            isError: true,
+        };
+    }
+});
+// --- Start server ---
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((e) => {
+    console.error("Fatal:", e);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAEnF,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,mBAAmB;IACzB,OAAO,EAAE,WAAW;CACrB,CAAC,CAAC;AAEH,qBAAqB;AAErB,MAAM,CAAC,IAAI,CACT,OAAO,EACP,oHAAoH,EACpH;IACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IAC3D,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,oEAAoE,CAAC;IACjF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;IACpG,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,2DAA2D,CAAC;IACxE,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,uDAAuD,CAAC;CACrE,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;IACd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAC1B,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACjD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAEpB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAW,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC,CACF,CAAC;AAEF,sBAAsB;AAEtB,MAAM,CAAC,IAAI,CACT,QAAQ,EACR,yGAAyG,EACzG;IACE,WAAW,EAAE,CAAC;SACX,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,uEAAuE,CAAC;IACpF,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,wDAAwD,CAAC;CACtE,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;IACd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAa;YACrB,gBAAgB,MAAM,CAAC,UAAU,EAAE;SACpC,CAAC;QACF,IAAI,MAAM,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAE9C,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACtD,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAW,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC,CACF,CAAC;AAEF,oBAAoB;AAEpB,MAAM,CAAC,IAAI,CACT,MAAM,EACN,sGAAsG,EACtG,EAAE,EACF,KAAK,IAAI,EAAE;IACT,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;QAEnC,MAAM,KAAK,GAAG;YACZ,cAAc,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gDAAgD,EAAE;YAC1F,gBAAgB,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE;YAC7C,gBAAgB,MAAM,CAAC,UAAU,EAAE;YACnC,mBAAmB,MAAM,CAAC,aAAa,EAAE;YACzC,iBAAiB,MAAM,CAAC,WAAW,EAAE;YACrC,mBAAmB,MAAM,CAAC,aAAa,EAAE;SAC1C,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAW,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC,CACF,CAAC;AAEF,uBAAuB;AAEvB,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/tools/ping.d.ts

@@ -0,0 +1,14 @@
+export interface PingResult {
+    cliFound: boolean;
+    version: string | null;
+    authStatus: "ok" | "expired" | "missing" | "unknown";
+    serverVersion: string;
+    nodeVersion: string;
+    maxConcurrent: number;
+}
+/**
+ * Health check and capability detection.
+ * Checks if gemini CLI is installed, authenticated, and reports versions.
+ */
+export declare function executePing(): Promise<PingResult>;
+//# sourceMappingURL=ping.d.ts.map

package/dist/tools/ping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ping.d.ts","sourceRoot":"","sources":["../../src/tools/ping.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,UAAU,CAAC,CA+DvD"}

package/dist/tools/ping.js

@@ -0,0 +1,66 @@
+import { execFileSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { findGeminiBinary } from "../utils/spawn.js";
+import { buildSubprocessEnv } from "../utils/env.js";
+const require = createRequire(import.meta.url);
+const PKG_VERSION = require("../../package.json").version;
+/**
+ * Health check and capability detection.
+ * Checks if gemini CLI is installed, authenticated, and reports versions.
+ */
+export async function executePing() {
+    const binary = findGeminiBinary();
+    const maxConcurrent = parseInt(process.env["GEMINI_MAX_CONCURRENT"] ?? "3", 10);
+    // Try to get CLI version
+    let cliFound = false;
+    let version = null;
+    try {
+        const output = execFileSync(binary, ["--version"], {
+            encoding: "utf8",
+            timeout: 10_000,
+        }).trim();
+        cliFound = true;
+        version = output;
+    }
+    catch (e) {
+        const err = e;
+        if (err.code === "ENOENT") {
+            return {
+                cliFound: false,
+                version: null,
+                authStatus: "missing",
+                serverVersion: PKG_VERSION,
+                nodeVersion: process.version,
+                maxConcurrent,
+            };
+        }
+        // CLI found but --version failed? Unusual but possible
+        cliFound = true;
+    }
+    // Check auth status by running a minimal prompt
+    let authStatus = "unknown";
+    try {
+        const result = execFileSync(binary, ["--output-format", "json", "Reply with exactly: OK"], {
+            encoding: "utf8",
+            timeout: 15_000,
+            env: buildSubprocessEnv(),
+        });
+        // If we got a response, auth is working
+        if (result && result.length > 0) {
+            authStatus = "ok";
+        }
+    }
+    catch {
+        // Auth check failed — could be expired or missing credentials
+        authStatus = "expired";
+    }
+    return {
+        cliFound,
+        version,
+        authStatus,
+        serverVersion: PKG_VERSION,
+        nodeVersion: process.version,
+        maxConcurrent,
+    };
+}
+//# sourceMappingURL=ping.js.map

package/dist/tools/ping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ping.js","sourceRoot":"","sources":["../../src/tools/ping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,WAAW,GAAY,OAAO,CAAC,oBAAoB,CAAyB,CAAC,OAAO,CAAC;AAW3F;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,QAAQ,CAC5B,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,GAAG,EAC3C,EAAE,CACH,CAAC;IAEF,yBAAyB;IACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAkB,IAAI,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;YACjD,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAA0B,CAAC;QACvC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,SAAS;gBACrB,aAAa,EAAE,WAAW;gBAC1B,WAAW,EAAE,OAAO,CAAC,OAAO;gBAC5B,aAAa;aACd,CAAC;QACJ,CAAC;QACD,uDAAuD;QACvD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,gDAAgD;IAChD,IAAI,UAAU,GAA6B,SAAS,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CACzB,MAAM,EACN,CAAC,iBAAiB,EAAE,MAAM,EAAE,wBAAwB,CAAC,EACrD;YACE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,GAAG,EAAE,kBAAkB,EAAE;SAC1B,CACF,CAAC;QACF,wCAAwC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,OAAO;QACL,QAAQ;QACR,OAAO;QACP,UAAU;QACV,aAAa,EAAE,WAAW;QAC1B,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/tools/query.d.ts

@@ -0,0 +1,20 @@
+export interface QueryInput {
+    prompt: string;
+    files?: string[];
+    model?: string;
+    workingDirectory?: string;
+    timeout?: number;
+}
+export interface QueryResult {
+    response: string;
+    model?: string;
+    filesIncluded: string[];
+    filesSkipped: string[];
+    timedOut: boolean;
+}
+/**
+ * Execute a one-shot query against Gemini CLI.
+ * Optionally includes file contents in the prompt.
+ */
+export declare function executeQuery(input: QueryInput): Promise<QueryResult>;
+//# sourceMappingURL=query.d.ts.map

package/dist/tools/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/tools/query.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAQD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAoE1E"}

package/dist/tools/query.js

@@ -0,0 +1,67 @@
+import { spawnGemini } from "../utils/spawn.js";
+import { parseGeminiOutput } from "../utils/parse.js";
+import { readFiles, assemblePrompt } from "../utils/files.js";
+import { verifyDirectory } from "../utils/security.js";
+/**
+ * Prompt length threshold for using stdin vs positional arg.
+ * Positional args are subject to ARG_MAX (~2MB), so pipe large prompts via stdin.
+ */
+const STDIN_THRESHOLD = 4000;
+/**
+ * Execute a one-shot query against Gemini CLI.
+ * Optionally includes file contents in the prompt.
+ */
+export async function executeQuery(input) {
+    const { prompt, files = [], model, timeout } = input;
+    // Resolve working directory
+    const cwd = input.workingDirectory
+        ? await verifyDirectory(input.workingDirectory)
+        : process.cwd();
+    // Read and assemble files into prompt
+    const fileContents = files.length > 0 ? await readFiles(files, cwd) : [];
+    const fullPrompt = assemblePrompt(prompt, fileContents);
+    // Large prompts or file attachments: pipe via stdin
+    // Short prompts: pass as positional arg (gemini "prompt")
+    const useStdin = fullPrompt.length > STDIN_THRESHOLD || files.length > 0;
+    const args = [];
+    if (model) {
+        args.push("--model", model);
+    }
+    args.push("--output-format", "json");
+    if (!useStdin) {
+        args.push(fullPrompt); // positional prompt
+    }
+    const result = await spawnGemini({
+        args,
+        cwd,
+        stdin: useStdin ? fullPrompt : undefined,
+        timeout,
+    });
+    if (result.timedOut) {
+        return {
+            response: `Query timed out after ${(timeout ?? 60000) / 1000}s. Try a simpler prompt or increase the timeout.`,
+            filesIncluded: fileContents.filter((f) => !f.skipped).map((f) => f.path),
+            filesSkipped: fileContents.filter((f) => f.skipped).map((f) => `${f.path}: ${f.skipped}`),
+            timedOut: true,
+        };
+    }
+    // Check for common error patterns in stderr
+    if (result.exitCode !== 0 && result.stderr) {
+        const stderr = result.stderr.toLowerCase();
+        if (stderr.includes("auth") || stderr.includes("credential") || stderr.includes("login")) {
+            throw new Error(`Gemini CLI authentication error. Run: gemini auth login\n\nDetails: ${result.stderr.trim()}`);
+        }
+        if (stderr.includes("rate") || stderr.includes("429") || stderr.includes("quota")) {
+            throw new Error(`Gemini API rate limit hit. Wait and retry.\n\nDetails: ${result.stderr.trim()}`);
+        }
+    }
+    const parsed = parseGeminiOutput(result.stdout, result.stderr);
+    return {
+        response: parsed.response,
+        model,
+        filesIncluded: fileContents.filter((f) => !f.skipped).map((f) => f.path),
+        filesSkipped: fileContents.filter((f) => f.skipped).map((f) => `${f.path}: ${f.skipped}`),
+        timedOut: false,
+    };
+}
+//# sourceMappingURL=query.js.map

package/dist/tools/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../src/tools/query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAkBvD;;;GAGG;AACH,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAiB;IAClD,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAErD,4BAA4B;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB;QAChC,CAAC,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC/C,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAElB,sCAAsC;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAExD,oDAAoD;IACpD,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,eAAe,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAErC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAC/B,IAAI;QACJ,GAAG;QACH,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACxC,OAAO;KACR,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,yBAAyB,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,IAAI,kDAAkD;YAC9G,aAAa,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACxE,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YACzF,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAC9F,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/D,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK;QACL,aAAa,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACzF,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC"}

package/dist/tools/review.d.ts

@@ -0,0 +1,18 @@
+export interface ReviewInput {
+    uncommitted?: boolean;
+    base?: string;
+    workingDirectory?: string;
+    timeout?: number;
+}
+export interface ReviewResult {
+    response: string;
+    diffSource: "uncommitted" | "branch";
+    base?: string;
+    timedOut: boolean;
+}
+/**
+ * Execute a code review by computing a git diff and sending it to Gemini.
+ * Native mode only (no extension dependency).
+ */
+export declare function executeReview(input: ReviewInput): Promise<ReviewResult>;
+//# sourceMappingURL=review.d.ts.map

package/dist/tools/review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../src/tools/review.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,aAAa,GAAG,QAAQ,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;CACnB;AAwBD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAsE7E"}

package/dist/tools/review.js

@@ -0,0 +1,93 @@
+import { spawnGemini } from "../utils/spawn.js";
+import { parseGeminiOutput } from "../utils/parse.js";
+import { getGitRoot, getUncommittedDiff, getBranchDiff } from "../utils/git.js";
+import { verifyDirectory } from "../utils/security.js";
+const REVIEW_PROMPT = `You are an expert code reviewer. Review the following git diff carefully.
+
+For each issue found, provide:
+- **Severity**: critical / warning / suggestion
+- **File**: the file path
+- **Line**: approximate line number (from the diff)
+- **Issue**: clear description
+- **Suggestion**: how to fix it
+
+Focus on:
+- Bugs and logic errors
+- Security vulnerabilities
+- Performance issues
+- Missing error handling
+- Code style issues (only if significant)
+
+If the code looks good, say so briefly. Don't invent issues.
+
+---
+
+`;
+/**
+ * Execute a code review by computing a git diff and sending it to Gemini.
+ * Native mode only (no extension dependency).
+ */
+export async function executeReview(input) {
+    const { uncommitted = true, base, timeout = 120_000 } = input;
+    // Resolve to git root
+    const requestedDir = input.workingDirectory
+        ? await verifyDirectory(input.workingDirectory)
+        : process.cwd();
+    const cwd = getGitRoot(requestedDir);
+    // Get the diff
+    let diff;
+    let diffSource;
+    try {
+        if (base) {
+            diff = getBranchDiff(cwd, base);
+            diffSource = "branch";
+        }
+        else if (uncommitted) {
+            diff = getUncommittedDiff(cwd);
+            diffSource = "uncommitted";
+        }
+        else {
+            throw new Error("Either 'uncommitted' must be true or 'base' must be specified");
+        }
+    }
+    catch (e) {
+        if (e instanceof Error && (e.message.includes("No uncommitted changes") || e.message.includes("No diff found"))) {
+            return {
+                response: e.message,
+                diffSource: base ? "branch" : "uncommitted",
+                base,
+                timedOut: false,
+            };
+        }
+        throw e;
+    }
+    const fullPrompt = REVIEW_PROMPT + diff;
+    const result = await spawnGemini({
+        args: ["--output-format", "json"],
+        cwd,
+        stdin: fullPrompt,
+        timeout,
+    });
+    if (result.timedOut) {
+        return {
+            response: `Review timed out after ${timeout / 1000}s. The diff may be too large. Try reviewing a smaller scope.`,
+            diffSource,
+            base,
+            timedOut: true,
+        };
+    }
+    if (result.exitCode !== 0 && result.stderr) {
+        const stderr = result.stderr.toLowerCase();
+        if (stderr.includes("auth") || stderr.includes("credential")) {
+            throw new Error(`Gemini CLI authentication error. Run: gemini auth login\n\nDetails: ${result.stderr.trim()}`);
+        }
+    }
+    const parsed = parseGeminiOutput(result.stdout, result.stderr);
+    return {
+        response: parsed.response,
+        diffSource,
+        base,
+        timedOut: false,
+    };
+}
+//# sourceMappingURL=review.js.map

package/dist/tools/review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.js","sourceRoot":"","sources":["../../src/tools/review.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAgBvD,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;CAoBrB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAkB;IACpD,MAAM,EAAE,WAAW,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;IAE9D,sBAAsB;IACtB,MAAM,YAAY,GAAG,KAAK,CAAC,gBAAgB;QACzC,CAAC,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC/C,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAClB,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAErC,eAAe;IACf,IAAI,IAAY,CAAC;IACjB,IAAI,UAAsC,CAAC;IAE3C,IAAI,CAAC;QACH,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAChC,UAAU,GAAG,QAAQ,CAAC;QACxB,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACvB,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC/B,UAAU,GAAG,aAAa,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YAChH,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC,OAAO;gBACnB,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa;gBAC3C,IAAI;gBACJ,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,GAAG,IAAI,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAC/B,IAAI,EAAE,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACjC,GAAG;QACH,KAAK,EAAE,UAAU;QACjB,OAAO;KACR,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,0BAA0B,OAAO,GAAG,IAAI,8DAA8D;YAChH,UAAU;YACV,IAAI;YACJ,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/D,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU;QACV,IAAI;QACJ,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC"}

package/dist/utils/env.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Hardened subprocess environment builder.
+ * Never spreads process.env — uses an explicit allowlist.
+ */
+/** Build a minimal, safe environment for gemini CLI subprocesses. */
+export declare function buildSubprocessEnv(): Record<string, string>;
+//# sourceMappingURL=env.d.ts.map

package/dist/utils/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/utils/env.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,qEAAqE;AACrE,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiB3D"}

package/dist/utils/env.js

@@ -0,0 +1,34 @@
+/**
+ * Hardened subprocess environment builder.
+ * Never spreads process.env — uses an explicit allowlist.
+ */
+const ALLOWED_ENV_PREFIXES = ["GOOGLE_", "GEMINI_", "CLOUDSDK_"];
+const ALLOWED_ENV_KEYS = [
+    "HOME",
+    "PATH",
+    "USER",
+    "SHELL",
+    "LANG",
+    "TERM",
+    "XDG_CONFIG_HOME",
+];
+/** Build a minimal, safe environment for gemini CLI subprocesses. */
+export function buildSubprocessEnv() {
+    const env = {
+        NO_COLOR: "1",
+        FORCE_COLOR: "0",
+        NODE_OPTIONS: "--max-old-space-size=8192",
+    };
+    for (const [key, val] of Object.entries(process.env)) {
+        if (!val)
+            continue;
+        if (ALLOWED_ENV_KEYS.includes(key)) {
+            env[key] = val;
+        }
+        else if (ALLOWED_ENV_PREFIXES.some((p) => key.startsWith(p))) {
+            env[key] = val;
+        }
+    }
+    return env;
+}
+//# sourceMappingURL=env.js.map

package/dist/utils/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/utils/env.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AACjE,MAAM,gBAAgB,GAAG;IACvB,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,iBAAiB;CAClB,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAA2B;QAClC,QAAQ,EAAE,GAAG;QACb,WAAW,EAAE,GAAG;QAChB,YAAY,EAAE,2BAA2B;KAC1C,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACjB,CAAC;aAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/utils/files.d.ts

@@ -0,0 +1,15 @@
+export interface FileContent {
+    path: string;
+    content: string;
+    skipped?: string;
+}
+/**
+ * Read multiple files with path sandboxing and size limits.
+ * Returns file contents assembled for prompt inclusion.
+ */
+export declare function readFiles(files: string[], rootDir: string): Promise<FileContent[]>;
+/**
+ * Assemble a prompt with file contents for Gemini.
+ */
+export declare function assemblePrompt(prompt: string, fileContents: FileContent[]): string;
+//# sourceMappingURL=files.d.ts.map

package/dist/utils/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/utils/files.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,WAAW,EAAE,CAAC,CAyBxB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,CAWlF"}

package/dist/utils/files.js

@@ -0,0 +1,42 @@
+import { readFile } from "node:fs/promises";
+import { resolveAndVerify, checkFileSize, MAX_FILE_SIZE, MAX_FILES, } from "./security.js";
+/**
+ * Read multiple files with path sandboxing and size limits.
+ * Returns file contents assembled for prompt inclusion.
+ */
+export async function readFiles(files, rootDir) {
+    if (files.length > MAX_FILES) {
+        throw new Error(`Too many files: ${files.length} (max ${MAX_FILES})`);
+    }
+    const results = [];
+    for (const f of files) {
+        const resolved = await resolveAndVerify(f, rootDir);
+        const size = await checkFileSize(resolved);
+        if (size > MAX_FILE_SIZE) {
+            results.push({
+                path: f,
+                content: "",
+                skipped: `${(size / 1024).toFixed(0)}KB exceeds ${(MAX_FILE_SIZE / 1024).toFixed(0)}KB limit`,
+            });
+            continue;
+        }
+        const content = await readFile(resolved, "utf8");
+        results.push({ path: f, content });
+    }
+    return results;
+}
+/**
+ * Assemble a prompt with file contents for Gemini.
+ */
+export function assemblePrompt(prompt, fileContents) {
+    if (fileContents.length === 0)
+        return prompt;
+    const parts = fileContents.map((f) => {
+        if (f.skipped) {
+            return `--- ${f.path} ---\n[SKIPPED: ${f.skipped}]`;
+        }
+        return `--- ${f.path} ---\n${f.content}`;
+    });
+    return `${prompt}\n\n${parts.join("\n\n")}`;
+}
+//# sourceMappingURL=files.js.map

package/dist/utils/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/utils/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAQvB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAe,EACf,OAAe;IAEf,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,SAAS,SAAS,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,CAAC;gBACP,OAAO,EAAE,EAAE;gBACX,OAAO,EAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;aAC9F,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,YAA2B;IACxE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAE7C,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACnC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,OAAO,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,OAAO,GAAG,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,MAAM,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AAC9C,CAAC"}

package/dist/utils/git.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Find the git repository root for a given directory.
+ * Throws if not inside a git repo.
+ */
+export declare function getGitRoot(cwd: string): string;
+/**
+ * Get a unified diff of uncommitted changes (staged + unstaged).
+ */
+export declare function getUncommittedDiff(cwd: string, contextLines?: number): string;
+/**
+ * Get a diff between the current branch and a base branch/ref.
+ */
+export declare function getBranchDiff(cwd: string, base: string, contextLines?: number): string;
+//# sourceMappingURL=git.d.ts.map

package/dist/utils/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/utils/git.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAS9C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,SAAI,GAAG,MAAM,CA2BxE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,SAAI,GAAG,MAAM,CAkBjF"}

package/dist/utils/git.js

@@ -0,0 +1,57 @@
+import { execFileSync } from "node:child_process";
+/**
+ * Find the git repository root for a given directory.
+ * Throws if not inside a git repo.
+ */
+export function getGitRoot(cwd) {
+    try {
+        return execFileSync("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
+            encoding: "utf8",
+            timeout: 5000,
+        }).trim();
+    }
+    catch {
+        throw new Error(`Not a git repository: ${cwd}`);
+    }
+}
+/**
+ * Get a unified diff of uncommitted changes (staged + unstaged).
+ */
+export function getUncommittedDiff(cwd, contextLines = 5) {
+    try {
+        // Staged changes
+        const staged = execFileSync("git", ["-C", cwd, "diff", "--cached", `-U${contextLines}`], { encoding: "utf8", timeout: 30000 }).trim();
+        // Unstaged changes
+        const unstaged = execFileSync("git", ["-C", cwd, "diff", `-U${contextLines}`], { encoding: "utf8", timeout: 30000 }).trim();
+        const parts = [staged, unstaged].filter(Boolean);
+        if (parts.length === 0) {
+            throw new Error("No uncommitted changes found");
+        }
+        return parts.join("\n");
+    }
+    catch (e) {
+        if (e instanceof Error && e.message === "No uncommitted changes found") {
+            throw e;
+        }
+        throw new Error(`Failed to get git diff: ${e}`);
+    }
+}
+/**
+ * Get a diff between the current branch and a base branch/ref.
+ */
+export function getBranchDiff(cwd, base, contextLines = 5) {
+    try {
+        const diff = execFileSync("git", ["-C", cwd, "diff", `${base}...HEAD`, `-U${contextLines}`], { encoding: "utf8", timeout: 30000 }).trim();
+        if (!diff) {
+            throw new Error(`No diff found between ${base} and HEAD`);
+        }
+        return diff;
+    }
+    catch (e) {
+        if (e instanceof Error && e.message.startsWith("No diff found")) {
+            throw e;
+        }
+        throw new Error(`Failed to get branch diff against "${base}": ${e}`);
+    }
+}
+//# sourceMappingURL=git.js.map

package/dist/utils/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/utils/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE;YACtE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,YAAY,GAAG,CAAC;IAC9D,IAAI,CAAC;QACH,iBAAiB;QACjB,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,YAAY,EAAE,CAAC,EACpD,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CACrC,CAAC,IAAI,EAAE,CAAC;QAET,mBAAmB;QACnB,MAAM,QAAQ,GAAG,YAAY,CAC3B,KAAK,EACL,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,CAAC,EACxC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CACrC,CAAC,IAAI,EAAE,CAAC;QAET,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,8BAA8B,EAAE,CAAC;YACvE,MAAM,CAAC,CAAC;QACV,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAY,EAAE,YAAY,GAAG,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CACvB,KAAK,EACL,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,KAAK,YAAY,EAAE,CAAC,EAC1D,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CACrC,CAAC,IAAI,EAAE,CAAC;QAET,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,WAAW,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,CAAC;QACV,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC"}

package/dist/utils/parse.d.ts

@@ -0,0 +1,15 @@
+export interface GeminiJsonOutput {
+    /** The main text response from Gemini. */
+    response: string;
+    /** Raw parsed JSON (full structure from CLI). */
+    raw?: unknown;
+}
+/**
+ * Parse Gemini CLI output, handling JSON and plain text modes.
+ *
+ * Strategy:
+ * 1. Try parsing as JSON (--output-format json)
+ * 2. Fall back to ANSI-stripped plain text
+ */
+export declare function parseGeminiOutput(stdout: string, stderr: string): GeminiJsonOutput;
+//# sourceMappingURL=parse.d.ts.map

package/dist/utils/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/utils/parse.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAuBlF"}

package/dist/utils/parse.js

@@ -0,0 +1,77 @@
+import stripAnsi from "strip-ansi";
+/**
+ * Parse Gemini CLI output, handling JSON and plain text modes.
+ *
+ * Strategy:
+ * 1. Try parsing as JSON (--output-format json)
+ * 2. Fall back to ANSI-stripped plain text
+ */
+export function parseGeminiOutput(stdout, stderr) {
+    const cleaned = stripAnsi(stdout).trim();
+    // Try JSON parse first
+    try {
+        const parsed = JSON.parse(cleaned);
+        return extractFromJson(parsed);
+    }
+    catch {
+        // Not JSON — treat as plain text response
+    }
+    // Plain text fallback
+    if (cleaned.length > 0) {
+        return { response: cleaned };
+    }
+    // No stdout — check stderr for useful info
+    const cleanedStderr = stripAnsi(stderr).trim();
+    if (cleanedStderr.length > 0) {
+        throw new Error(`Gemini CLI produced no output. stderr: ${cleanedStderr}`);
+    }
+    throw new Error("Gemini CLI produced no output");
+}
+/**
+ * Extract the response text from Gemini's JSON output.
+ * The schema is undocumented, so we parse defensively.
+ */
+function extractFromJson(parsed) {
+    if (typeof parsed === "string") {
+        return { response: parsed };
+    }
+    if (parsed && typeof parsed === "object") {
+        const obj = parsed;
+        // Try common response fields
+        for (const key of ["response", "text", "content", "message", "output"]) {
+            if (typeof obj[key] === "string") {
+                return { response: obj[key], raw: parsed };
+            }
+        }
+        // Nested: result.response or result.text
+        if (obj["result"] && typeof obj["result"] === "object") {
+            const result = obj["result"];
+            for (const key of ["response", "text", "content"]) {
+                if (typeof result[key] === "string") {
+                    return { response: result[key], raw: parsed };
+                }
+            }
+        }
+        // If it's an array (stream-json collected), join text parts
+        if (Array.isArray(parsed)) {
+            const texts = parsed
+                .map((item) => {
+                if (typeof item === "string")
+                    return item;
+                if (item && typeof item === "object") {
+                    const i = item;
+                    return (i["text"] ?? i["response"] ?? i["content"] ?? "");
+                }
+                return "";
+            })
+                .filter(Boolean);
+            if (texts.length > 0) {
+                return { response: texts.join(""), raw: parsed };
+            }
+        }
+        // Last resort: stringify the whole thing
+        return { response: JSON.stringify(parsed, null, 2), raw: parsed };
+    }
+    return { response: String(parsed) };
+}
+//# sourceMappingURL=parse.js.map

package/dist/utils/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../src/utils/parse.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,YAAY,CAAC;AASnC;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAEzC,uBAAuB;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IAED,sBAAsB;IACtB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,2CAA2C;IAC3C,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0CAA0C,aAAa,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAiC,CAAC;QAE9C,6BAA6B;QAC7B,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACvE,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACjC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAW,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YACvD,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAA4B,CAAC;YACxD,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBAClD,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAW,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM;iBACjB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBACZ,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAC1C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,MAAM,CAAC,GAAG,IAA+B,CAAC;oBAC1C,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAW,CAAC;gBACtE,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;iBACD,MAAM,CAAC,OAAO,CAAC,CAAC;YACnB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YACnD,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;AACtC,CAAC"}

package/dist/utils/security.d.ts

@@ -0,0 +1,18 @@
+/** Maximum file size in bytes (1MB). */
+export declare const MAX_FILE_SIZE = 1000000;
+/** Maximum number of files that can be attached to a query. */
+export declare const MAX_FILES = 20;
+/**
+ * Resolve a path and verify it's within the allowed root directory.
+ * Prevents path traversal attacks via symlinks, `..`, etc.
+ */
+export declare function resolveAndVerify(filePath: string, rootDir: string): Promise<string>;
+/**
+ * Verify a directory exists and is actually a directory.
+ */
+export declare function verifyDirectory(dir: string): Promise<string>;
+/**
+ * Check if a file is within size limits.
+ */
+export declare function checkFileSize(filePath: string): Promise<number>;
+//# sourceMappingURL=security.d.ts.map

package/dist/utils/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/utils/security.ts"],"names":[],"mappings":"AAGA,wCAAwC;AACxC,eAAO,MAAM,aAAa,UAAY,CAAC;AAEvC,+DAA+D;AAC/D,eAAO,MAAM,SAAS,KAAK,CAAC;AAE5B;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOlE;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrE"}

package/dist/utils/security.js

@@ -0,0 +1,37 @@
+import { realpath, stat } from "node:fs/promises";
+import path from "node:path";
+/** Maximum file size in bytes (1MB). */
+export const MAX_FILE_SIZE = 1_000_000;
+/** Maximum number of files that can be attached to a query. */
+export const MAX_FILES = 20;
+/**
+ * Resolve a path and verify it's within the allowed root directory.
+ * Prevents path traversal attacks via symlinks, `..`, etc.
+ */
+export async function resolveAndVerify(filePath, rootDir) {
+    const resolved = await realpath(path.resolve(rootDir, filePath));
+    const resolvedRoot = await realpath(rootDir);
+    if (!resolved.startsWith(resolvedRoot + path.sep) && resolved !== resolvedRoot) {
+        throw new Error(`Path traversal blocked: "${filePath}" resolves outside allowed root "${rootDir}"`);
+    }
+    return resolved;
+}
+/**
+ * Verify a directory exists and is actually a directory.
+ */
+export async function verifyDirectory(dir) {
+    const resolved = await realpath(dir);
+    const s = await stat(resolved);
+    if (!s.isDirectory()) {
+        throw new Error(`Not a directory: ${dir}`);
+    }
+    return resolved;
+}
+/**
+ * Check if a file is within size limits.
+ */
+export async function checkFileSize(filePath) {
+    const s = await stat(filePath);
+    return s.size;
+}
+//# sourceMappingURL=security.js.map

package/dist/utils/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/utils/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,wCAAwC;AACxC,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAE5B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,OAAe;IAEf,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,oCAAoC,OAAO,GAAG,CACnF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC"}

package/dist/utils/spawn.d.ts

@@ -0,0 +1,26 @@
+export interface SpawnOptions {
+    args: string[];
+    cwd: string;
+    stdin?: string;
+    timeout?: number;
+}
+export interface SpawnResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number | null;
+    timedOut: boolean;
+}
+/**
+ * Find the gemini CLI binary path.
+ */
+export declare function findGeminiBinary(): string;
+/**
+ * Spawn a gemini CLI subprocess with hardened environment,
+ * timeout management, and concurrency limiting.
+ */
+export declare function spawnGemini(options: SpawnOptions): Promise<SpawnResult>;
+/**
+ * Reset concurrency state (for testing).
+ */
+export declare function resetConcurrency(): void;
+//# sourceMappingURL=spawn.d.ts.map

package/dist/utils/spawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.d.ts","sourceRoot":"","sources":["../../src/utils/spawn.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;CACnB;AA6CD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAU7E;AA6GD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAGvC"}

package/dist/utils/spawn.js

@@ -0,0 +1,166 @@
+import { spawn } from "node:child_process";
+import { buildSubprocessEnv } from "./env.js";
+/** Hard maximum timeout — no request can exceed this. */
+const HARD_TIMEOUT_CAP = 600_000; // 10 minutes
+/** Default max concurrent subprocess spawns. */
+const DEFAULT_MAX_CONCURRENT = 3;
+/** Queue timeout — how long a request waits for a slot. */
+const QUEUE_TIMEOUT = 30_000;
+// Concurrency management
+let activeCount = 0;
+const maxConcurrent = parseInt(process.env["GEMINI_MAX_CONCURRENT"] ?? String(DEFAULT_MAX_CONCURRENT), 10);
+const waitQueue = [];
+function acquireSlot() {
+    if (activeCount < maxConcurrent) {
+        activeCount++;
+        return Promise.resolve();
+    }
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            const idx = waitQueue.findIndex((w) => w.resolve === resolve);
+            if (idx !== -1)
+                waitQueue.splice(idx, 1);
+            reject(new Error(`Concurrency queue timeout after ${QUEUE_TIMEOUT}ms — ${activeCount} processes active`));
+        }, QUEUE_TIMEOUT);
+        waitQueue.push({
+            resolve: () => {
+                clearTimeout(timer);
+                activeCount++;
+                resolve();
+            },
+            reject,
+        });
+    });
+}
+function releaseSlot() {
+    activeCount--;
+    const next = waitQueue.shift();
+    if (next) {
+        next.resolve();
+    }
+}
+/**
+ * Find the gemini CLI binary path.
+ */
+export function findGeminiBinary() {
+    return process.env["GEMINI_CLI_PATH"] ?? "gemini";
+}
+/**
+ * Spawn a gemini CLI subprocess with hardened environment,
+ * timeout management, and concurrency limiting.
+ */
+export async function spawnGemini(options) {
+    const timeout = Math.min(options.timeout ?? 60_000, HARD_TIMEOUT_CAP);
+    await acquireSlot();
+    try {
+        return await doSpawn(options, timeout);
+    }
+    finally {
+        releaseSlot();
+    }
+}
+async function doSpawn(options, timeout) {
+    const binary = findGeminiBinary();
+    const env = buildSubprocessEnv();
+    return new Promise((resolve, reject) => {
+        let child;
+        const detached = process.platform !== "win32";
+        try {
+            child = spawn(binary, options.args, {
+                cwd: options.cwd,
+                env,
+                shell: false,
+                stdio: ["pipe", "pipe", "pipe"],
+                detached,
+            });
+        }
+        catch (e) {
+            reject(new Error(`Failed to spawn gemini CLI: ${e}`));
+            return;
+        }
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        let settled = false;
+        let killTimer;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            killTimer = killProcessGroup(child);
+        }, timeout);
+        child.stdout?.on("data", (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            if (killTimer)
+                clearTimeout(killTimer);
+            if (!settled) {
+                settled = true;
+                if (err.code === "ENOENT") {
+                    reject(new Error("gemini CLI not found. Install with: npm i -g @google/gemini-cli"));
+                }
+                else {
+                    reject(new Error(`Failed to run gemini CLI: ${err.message}`));
+                }
+            }
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            if (killTimer)
+                clearTimeout(killTimer);
+            if (!settled) {
+                settled = true;
+                resolve({ stdout, stderr, exitCode: code, timedOut });
+            }
+        });
+        // Write stdin if provided, then close
+        if (options.stdin) {
+            child.stdin?.write(options.stdin);
+        }
+        child.stdin?.end();
+    });
+}
+/**
+ * Kill a process and its children. SIGTERM first, SIGKILL after grace period.
+ * Only uses process group kill (-pid) when the child was spawned with detached: true,
+ * which gives it its own process group. Without detached, -pid would target the
+ * parent's process group and kill the MCP server itself.
+ */
+function killProcessGroup(child) {
+    const pid = child.pid;
+    if (!pid)
+        return undefined;
+    const useGroupKill = process.platform !== "win32";
+    const kill = (signal) => {
+        try {
+            if (useGroupKill) {
+                process.kill(-pid, signal);
+            }
+            else {
+                child.kill(signal);
+            }
+        }
+        catch {
+            try {
+                child.kill(signal);
+            }
+            catch {
+                // Already dead
+            }
+        }
+    };
+    kill("SIGTERM");
+    // Force kill after 5s grace
+    return setTimeout(() => kill("SIGKILL"), 5000);
+}
+/**
+ * Reset concurrency state (for testing).
+ */
+export function resetConcurrency() {
+    activeCount = 0;
+    waitQueue.length = 0;
+}
+//# sourceMappingURL=spawn.js.map

package/dist/utils/spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../src/utils/spawn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAE9C,yDAAyD;AACzD,MAAM,gBAAgB,GAAG,OAAO,CAAC,CAAC,aAAa;AAE/C,gDAAgD;AAChD,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,2DAA2D;AAC3D,MAAM,aAAa,GAAG,MAAM,CAAC;AAgB7B,yBAAyB;AACzB,IAAI,WAAW,GAAG,CAAC,CAAC;AACpB,MAAM,aAAa,GAAG,QAAQ,CAC5B,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC,sBAAsB,CAAC,EACtE,EAAE,CACH,CAAC;AACF,MAAM,SAAS,GAGV,EAAE,CAAC;AAER,SAAS,WAAW;IAClB,IAAI,WAAW,GAAG,aAAa,EAAE,CAAC;QAChC,WAAW,EAAE,CAAC;QACd,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YAC9D,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,aAAa,QAAQ,WAAW,mBAAmB,CAAC,CAAC,CAAC;QAC5G,CAAC,EAAE,aAAa,CAAC,CAAC;QAElB,SAAS,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,GAAG,EAAE;gBACZ,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,WAAW,EAAE,CAAC;gBACd,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW;IAClB,WAAW,EAAE,CAAC;IACd,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;IAC/B,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAqB;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAEtE,MAAM,WAAW,EAAE,CAAC;IAEpB,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAqB,EAAE,OAAe;IAC3D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IAEjC,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,IAAI,KAAmB,CAAC;QACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC9C,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE;gBAClC,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG;gBACH,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAqC,CAAC;QAE1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrD,MAAM,CACJ,IAAI,KAAK,CACP,iEAAiE,CAClE,CACF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,sCAAsC;QACtC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAmB;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAElD,MAAM,IAAI,GAAG,CAAC,MAAsB,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,SAAS,CAAC,CAAC;IAEhB,4BAA4B;IAC5B,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,WAAW,GAAG,CAAC,CAAC;IAChB,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "gemini-mcp-bridge",
+  "version": "0.1.0",
+  "description": "MCP server that wraps Gemini CLI for query, code review, and health checks",
+  "author": "Tim Birrell",
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "gemini-mcp-bridge": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "lint": "eslint src/ tests/",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:integration": "GEMINI_INTEGRATION=1 vitest run tests/integration/",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "gemini",
+    "gemini-cli",
+    "claude-code",
+    "codex",
+    "code-review",
+    "ai-tools",
+    "model-context-protocol"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hampsterx/gemini-mcp-bridge.git"
+  },
+  "bugs": {
+    "url": "https://github.com/hampsterx/gemini-mcp-bridge/issues"
+  },
+  "homepage": "https://github.com/hampsterx/gemini-mcp-bridge#readme",
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "strip-ansi": "^7.1.0",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "eslint": "^9.0.0",
+    "typescript": "^5.7.0",
+    "typescript-eslint": "^8.0.0",
+    "vitest": "^3.0.0"
+  }
+}