harness-dispatch 0.4.0

package/dist/dispatchers/shared/subprocess.js

@@ -0,0 +1,110 @@
+/**
+ * Async subprocess runner.
+ *
+ * Wraps `child_process.spawn` with:
+ * - hard timeout (SIGTERM, then SIGKILL after grace period)
+ * - output byte cap (protects the agent from pathological CLI output)
+ * - DEVNULL stdin by default (prevents interactive auth prompts from hanging)
+ * - UTF-8 decoding with replacement on invalid sequences
+ */
+import spawn from "cross-spawn";
+import { killTree } from "./kill-tree.js";
+const DEFAULT_TIMEOUT_MS = 300_000;
+const DEFAULT_MAX_OUTPUT_BYTES = 10 * 1024 * 1024;
+const KILL_GRACE_MS = 2_000;
+export function runSubprocess(command, args, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxOutputBytes = opts.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
+    const start = Date.now();
+    return new Promise((resolve, reject) => {
+        const spawnOpts = {
+            stdio: [opts.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+            windowsHide: true,
+            env: opts.env ? { ...process.env, ...opts.env } : process.env,
+        };
+        if (opts.cwd !== undefined)
+            spawnOpts.cwd = opts.cwd;
+        let child;
+        try {
+            child = spawn(command, args, spawnOpts);
+        }
+        catch (err) {
+            reject(err instanceof Error ? err : new Error(String(err)));
+            return;
+        }
+        if (opts.stdin !== undefined) {
+            child.stdin?.end(opts.stdin);
+        }
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
+        let truncated = false;
+        let timedOut = false;
+        let settled = false;
+        const appendStdout = (chunk) => {
+            if (truncated)
+                return;
+            if (stdoutBytes + chunk.length > maxOutputBytes) {
+                const remaining = Math.max(0, maxOutputBytes - stdoutBytes);
+                if (remaining > 0)
+                    stdoutChunks.push(chunk.subarray(0, remaining));
+                stdoutBytes = maxOutputBytes;
+                truncated = true;
+                killTree(child, "SIGTERM");
+                return;
+            }
+            stdoutChunks.push(chunk);
+            stdoutBytes += chunk.length;
+        };
+        const appendStderr = (chunk) => {
+            if (truncated)
+                return;
+            if (stderrBytes + chunk.length > maxOutputBytes) {
+                const remaining = Math.max(0, maxOutputBytes - stderrBytes);
+                if (remaining > 0)
+                    stderrChunks.push(chunk.subarray(0, remaining));
+                stderrBytes = maxOutputBytes;
+                truncated = true;
+                killTree(child, "SIGTERM");
+                return;
+            }
+            stderrChunks.push(chunk);
+            stderrBytes += chunk.length;
+        };
+        child.stdout?.on("data", (chunk) => appendStdout(chunk));
+        child.stderr?.on("data", (chunk) => appendStderr(chunk));
+        const timer = setTimeout(() => {
+            timedOut = true;
+            killTree(child, "SIGTERM");
+            // Force-kill if the child ignores SIGTERM.
+            setTimeout(() => {
+                if (!settled)
+                    killTree(child, "SIGKILL");
+            }, KILL_GRACE_MS).unref();
+        }, timeoutMs);
+        timer.unref();
+        child.on("error", (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(err);
+        });
+        child.on("close", (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            const exitCode = code ?? (signal ? 128 : -1);
+            resolve({
+                stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+                stderr: Buffer.concat(stderrChunks).toString("utf8"),
+                exitCode,
+                durationMs: Date.now() - start,
+                timedOut,
+            });
+        });
+    });
+}
+//# sourceMappingURL=subprocess.js.map

package/dist/dispatchers/shared/subprocess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subprocess.js","sourceRoot":"","sources":["../../../src/dispatchers/shared/subprocess.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,MAAM,aAAa,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkB1C,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAClD,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,IAAuB,EACvB,OAA0B,EAAE;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,SAAS,GAAiB;YAC9B,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YACrE,WAAW,EAAE,IAAI;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;SAC9D,CAAC;QACF,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QAErD,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAqC,EAAE,SAAS,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,YAAY,GAAG,CAAC,KAAa,EAAQ,EAAE;YAC3C,IAAI,SAAS;gBAAE,OAAO;YACtB,IAAI,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;gBAChD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,WAAW,CAAC,CAAC;gBAC5D,IAAI,SAAS,GAAG,CAAC;oBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;gBACnE,WAAW,GAAG,cAAc,CAAC;gBAC7B,SAAS,GAAG,IAAI,CAAC;gBACjB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;QAC9B,CAAC,CAAC;QAEF,MAAM,YAAY,GAAG,CAAC,KAAa,EAAQ,EAAE;YAC3C,IAAI,SAAS;gBAAE,OAAO;YACtB,IAAI,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;gBAChD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,WAAW,CAAC,CAAC;gBAC5D,IAAI,SAAS,GAAG,CAAC;oBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;gBACnE,WAAW,GAAG,cAAc,CAAC;gBAC7B,SAAS,GAAG,IAAI,CAAC;gBACjB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;QAC9B,CAAC,CAAC;QAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC3B,2CAA2C;YAC3C,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,CAAC,OAAO;oBAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC3C,CAAC,EAAE,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACpD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACpD,QAAQ;gBACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/dispatchers/shared/which-available.d.ts

@@ -0,0 +1,2 @@
+export declare function commandAvailable(command: string): boolean;
+//# sourceMappingURL=which-available.d.ts.map

package/dist/dispatchers/shared/which-available.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"which-available.d.ts","sourceRoot":"","sources":["../../../src/dispatchers/shared/which-available.ts"],"names":[],"mappings":"AAEA,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAMzD"}

package/dist/dispatchers/shared/which-available.js

@@ -0,0 +1,8 @@
+import which from "which";
+export function commandAvailable(command) {
+    const candidate = which;
+    if (typeof candidate.sync !== "function")
+        return true;
+    return Boolean(candidate.sync(command, { nothrow: true }));
+}
+//# sourceMappingURL=which-available.js.map

package/dist/dispatchers/shared/which-available.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"which-available.js","sourceRoot":"","sources":["../../../src/dispatchers/shared/which-available.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,SAAS,GAAG,KAEjB,CAAC;IACF,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/dispatchers/shared/windows-cmd.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Cross-platform CLI binary resolution.
+ *
+ * On Windows, CLI tools installed via npm/scoop/winget are typically `.cmd` or
+ * `.bat` wrappers. Node's `spawn` cannot execute those directly without a
+ * shell — attempting to do so throws ENOENT.
+ *
+ * This used to hand back `{ command: "cmd", prefixArgs: ["/c", path] }` and
+ * let dispatchers spawn that directly via node:child_process. That's exactly
+ * the shape of a real Windows command-injection bug: Node's spawn() only
+ * safely escapes cmd.exe metacharacters in an argument when IT decides
+ * cmd.exe indirection is needed (i.e. when the target path itself ends in
+ * .bat/.cmd) — manually pre-constructing the "cmd /c <path>" invocation
+ * ourselves bypasses that. Confirmed empirically on Node 24.14.1: an
+ * argument containing a literal `"` character breaks out of the quoting and
+ * lets a subsequent `&`-chained command execute for real. `%ENV_VAR%`
+ * sequences also got expanded regardless (a separate info-leak/argument-
+ * splitting bug, since the CLI's own model/prompt text is never meant to be
+ * shell-interpreted at all).
+ *
+ * Fix: resolveCliCommand no longer constructs the cmd.exe wrapper itself.
+ * For the one case worth the extra step — npm's own generated .cmd shim,
+ * which just re-invokes `node <script>.js` — we skip cmd.exe entirely by
+ * spawning node directly on the underlying script (faster, and immune to
+ * shell metacharacters since there's no shell in the loop at all). For every
+ * other .cmd/.bat shape (pnpm, yarn, scoop, hand-rolled), we hand the
+ * resolved path straight to cross-spawn (see subprocess.ts/
+ * stream-subprocess.ts), which is a widely-used, purpose-built library for
+ * exactly this problem — it detects the .bat/.cmd target itself and applies
+ * correct, tested escaping, verified against the same injection payload
+ * above (no command execution, no %VAR% expansion).
+ */
+export interface ResolvedCommand {
+    command: string;
+    prefixArgs: string[];
+}
+export declare function resolveCliCommand(bin: string): Promise<ResolvedCommand>;
+//# sourceMappingURL=windows-cmd.d.ts.map

package/dist/dispatchers/shared/windows-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-cmd.d.ts","sourceRoot":"","sources":["../../../src/dispatchers/shared/windows-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAMH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAsCD,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAuB7E"}

package/dist/dispatchers/shared/windows-cmd.js

@@ -0,0 +1,91 @@
+/**
+ * Cross-platform CLI binary resolution.
+ *
+ * On Windows, CLI tools installed via npm/scoop/winget are typically `.cmd` or
+ * `.bat` wrappers. Node's `spawn` cannot execute those directly without a
+ * shell — attempting to do so throws ENOENT.
+ *
+ * This used to hand back `{ command: "cmd", prefixArgs: ["/c", path] }` and
+ * let dispatchers spawn that directly via node:child_process. That's exactly
+ * the shape of a real Windows command-injection bug: Node's spawn() only
+ * safely escapes cmd.exe metacharacters in an argument when IT decides
+ * cmd.exe indirection is needed (i.e. when the target path itself ends in
+ * .bat/.cmd) — manually pre-constructing the "cmd /c <path>" invocation
+ * ourselves bypasses that. Confirmed empirically on Node 24.14.1: an
+ * argument containing a literal `"` character breaks out of the quoting and
+ * lets a subsequent `&`-chained command execute for real. `%ENV_VAR%`
+ * sequences also got expanded regardless (a separate info-leak/argument-
+ * splitting bug, since the CLI's own model/prompt text is never meant to be
+ * shell-interpreted at all).
+ *
+ * Fix: resolveCliCommand no longer constructs the cmd.exe wrapper itself.
+ * For the one case worth the extra step — npm's own generated .cmd shim,
+ * which just re-invokes `node <script>.js` — we skip cmd.exe entirely by
+ * spawning node directly on the underlying script (faster, and immune to
+ * shell metacharacters since there's no shell in the loop at all). For every
+ * other .cmd/.bat shape (pnpm, yarn, scoop, hand-rolled), we hand the
+ * resolved path straight to cross-spawn (see subprocess.ts/
+ * stream-subprocess.ts), which is a widely-used, purpose-built library for
+ * exactly this problem — it detects the .bat/.cmd target itself and applies
+ * correct, tested escaping, verified against the same injection payload
+ * above (no command execution, no %VAR% expansion).
+ */
+import path from "node:path";
+import fs from "node:fs/promises";
+import which from "which";
+async function resolveWindowsCandidate(bin, first) {
+    try {
+        const all = (await which(bin, {
+            all: true,
+            nothrow: true,
+        }));
+        if (Array.isArray(all)) {
+            const native = all.find((candidate) => path.extname(candidate).toLowerCase() === ".exe" &&
+                !candidate.toLowerCase().includes("\\windowsapps\\"));
+            if (native)
+                return native;
+        }
+    }
+    catch {
+        // Fall back to the first candidate resolved by which.
+    }
+    return first;
+}
+async function resolveNpmCmdShim(cmdPath) {
+    try {
+        const text = await fs.readFile(cmdPath, "utf8");
+        const match = text.match(/"%dp0%\\([^"]+?\.js)"/i);
+        if (!match?.[1])
+            return null;
+        const scriptPath = path.join(path.dirname(cmdPath), match[1].replace(/\\/g, path.sep));
+        await fs.access(scriptPath);
+        return { command: process.execPath, prefixArgs: [scriptPath] };
+    }
+    catch {
+        return null;
+    }
+}
+export async function resolveCliCommand(bin) {
+    const resolved = await which(bin, { nothrow: true });
+    if (!resolved) {
+        // Let spawn surface the ENOENT — caller may be running in a sandbox where
+        // PATH resolution is deliberately stubbed.
+        return { command: bin, prefixArgs: [] };
+    }
+    if (process.platform !== "win32") {
+        return { command: resolved, prefixArgs: [] };
+    }
+    const windowsResolved = await resolveWindowsCandidate(bin, resolved);
+    const ext = path.extname(windowsResolved).toLowerCase();
+    if (ext === ".cmd") {
+        const npmShim = await resolveNpmCmdShim(windowsResolved);
+        if (npmShim)
+            return npmShim;
+    }
+    // Any other .cmd/.bat shape (pnpm, yarn, scoop, hand-rolled) — or a native
+    // .exe — is handed straight to cross-spawn as prefixArgs: []. It detects
+    // .bat/.cmd targets itself and applies correct escaping; native binaries
+    // pass through unchanged, same as before.
+    return { command: windowsResolved, prefixArgs: [] };
+}
+//# sourceMappingURL=windows-cmd.js.map

package/dist/dispatchers/shared/windows-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-cmd.js","sourceRoot":"","sources":["../../../src/dispatchers/shared/windows-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,KAAK,MAAM,OAAO,CAAC;AAO1B,KAAK,UAAU,uBAAuB,CAAC,GAAW,EAAE,KAAa;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE;YAC5B,GAAG,EAAE,IAAI;YACT,OAAO,EAAE,IAAI;SACiC,CAAC,CAAY,CAAC;QAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CACrB,CAAC,SAAS,EAAE,EAAE,CACZ,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;gBAChD,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CACvD,CAAC;YACF,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAe;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EACrB,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAClC,CAAC;QACF,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAW;IACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,0EAA0E;QAC1E,2CAA2C;QAC3C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,0CAA0C;IAC1C,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AACtD,CAAC"}

package/dist/http/server.d.ts

@@ -0,0 +1,15 @@
+import { type BuildMcpOptions, type McpHandle } from "../mcp/server.js";
+export interface HttpServerHandle extends McpHandle {
+    port: number;
+    host: string;
+    token: string | null;
+}
+export interface StartHttpOptions extends BuildMcpOptions {
+    port?: number;
+    host?: string;
+    mcpRoute?: string;
+    token?: string | null;
+}
+export declare function startHttpServer(opts?: StartHttpOptions): Promise<HttpServerHandle>;
+export declare const startMcpHttpServer: typeof startHttpServer;
+//# sourceMappingURL=server.d.ts.map

package/dist/http/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAO1B,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AA4ND,wBAAsB,eAAe,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyX5F;AAED,eAAO,MAAM,kBAAkB,wBAAkB,CAAC"}