jev-agent-tools 0.1.4 → 0.2.0

package/src/adapters/private-storage.ts

@@ -0,0 +1,143 @@
+import { execFile } from "node:child_process";
+import type { Stats } from "node:fs";
+import { join } from "node:path";
+import { PRIVATE_STORAGE_TIMEOUT_MS } from "../constants.ts";
+
+/**
+ * Owner-only storage, checked with each operating system's own model.
+ *
+ * POSIX: no group/other mode bits and owned by the current user.
+ * Windows: mode bits are synthesized (always 0o666), so the real ACL is read.
+ * Storage is private when every allow entry belongs to the current user,
+ * SYSTEM or the Administrators group (the Windows equivalent of root), and
+ * the owner is the current user or Administrators. Entries are compared as
+ * SIDs, so localized account names do not matter.
+ */
+export interface PrivateStorage {
+  /** True when every path is private. One check for all paths. */
+  isPrivate(
+    entries: readonly { path: string; stat: Stats }[],
+  ): Promise<boolean>;
+  /** Restrict a directory the current user owns so new files inherit privacy. */
+  restrictDirectory(path: string): Promise<void>;
+}
+
+const SYSTEM = "S-1-5-18";
+const ADMINISTRATORS = "S-1-5-32-544";
+const CREATOR_OWNER = "S-1-3-0";
+
+export const posixStorage: PrivateStorage = {
+  async isPrivate(entries) {
+    return entries.every(
+      ({ stat }) =>
+        (stat.mode & 0o077) === 0 &&
+        (!process.getuid || stat.uid === process.getuid()),
+    );
+  },
+  async restrictDirectory() {
+    // mkdir(..., { mode: 0o700 }) already creates POSIX directories privately.
+  },
+};
+
+// Paths arrive as JSON in an environment variable, never in the command text.
+const CHECK = `$ErrorActionPreference = 'Stop'
+$me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+$trusted = @($me, '${SYSTEM}', '${ADMINISTRATORS}')
+$sid = [System.Security.Principal.SecurityIdentifier]
+$results = foreach ($path in (ConvertFrom-Json $env:JEV_PRIVATE_PATHS)) {
+  try {
+    $acl = Get-Acl -LiteralPath $path
+    $owner = $acl.GetOwner($sid).Value
+    $private = ($owner -eq $me) -or ($owner -eq '${ADMINISTRATORS}')
+    foreach ($rule in $acl.GetAccessRules($true, $true, $sid)) {
+      if ($rule.AccessControlType -ne 'Allow') { continue }
+      $id = $rule.IdentityReference.Value
+      $inheritOnly = ($rule.PropagationFlags -band [System.Security.AccessControl.PropagationFlags]::InheritOnly) -ne 0
+      if ($id -eq '${CREATOR_OWNER}' -and $inheritOnly) { continue }
+      if ($trusted -notcontains $id) { $private = $false }
+    }
+    $private
+  } catch { $false }
+}
+ConvertTo-Json -Compress @($results)`;
+
+const RESTRICT = `$ErrorActionPreference = 'Stop'
+$path = $env:JEV_PRIVATE_PATH
+$me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$acl = Get-Acl -LiteralPath $path
+if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $me.Value) { throw 'not owner' }
+$acl.SetAccessRuleProtection($true, $false)
+foreach ($rule in @($acl.Access)) { [void]$acl.RemoveAccessRuleAll($rule) }
+$inherit = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+foreach ($id in @($me.Value, '${SYSTEM}', '${ADMINISTRATORS}')) {
+  $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
+    (New-Object System.Security.Principal.SecurityIdentifier($id)),
+    'FullControl', $inherit, 'None', 'Allow')
+  $acl.AddAccessRule($rule)
+}
+Set-Acl -LiteralPath $path -AclObject $acl`;
+
+function powershell(
+  script: string,
+  env: Record<string, string>,
+): Promise<string> {
+  const root = process.env.SystemRoot ?? "C:\\Windows";
+  // A fixed system path, so a powershell.exe earlier on PATH is never used.
+  const executable = join(
+    root,
+    "System32",
+    "WindowsPowerShell",
+    "v1.0",
+    "powershell.exe",
+  );
+  // PowerShell 7 parents export PSModulePath, which stops Windows PowerShell
+  // 5.1 from loading its own Get-Acl module; 5.1 rebuilds it when unset.
+  const childEnv: NodeJS.ProcessEnv = { ...process.env, ...env };
+  for (const key of Object.keys(childEnv))
+    if (key.toLowerCase() === "psmodulepath") delete childEnv[key];
+  const { promise, resolve, reject } = Promise.withResolvers<string>();
+  execFile(
+    executable,
+    [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      // UTF-16LE base64 runs the script as one unit; stdin runs line by line.
+      "-EncodedCommand",
+      Buffer.from(script, "utf16le").toString("base64"),
+    ],
+    { env: childEnv, windowsHide: true, timeout: PRIVATE_STORAGE_TIMEOUT_MS },
+    (error, stdout) => (error ? reject(error) : resolve(stdout)),
+  );
+  return promise;
+}
+
+export const windowsStorage: PrivateStorage = {
+  async isPrivate(entries) {
+    if (!entries.length) return true;
+    try {
+      const output = await powershell(CHECK, {
+        JEV_PRIVATE_PATHS: JSON.stringify(entries.map(({ path }) => path)),
+      });
+      const results: unknown = JSON.parse(output.trim());
+      return (
+        Array.isArray(results) &&
+        results.length === entries.length &&
+        results.every((result) => result === true)
+      );
+    } catch {
+      // An ACL that cannot be read is never treated as private.
+      return false;
+    }
+  },
+  async restrictDirectory(path) {
+    await powershell(RESTRICT, { JEV_PRIVATE_PATH: path });
+  },
+};
+
+export function privateStorage(
+  platform: NodeJS.Platform = process.platform,
+): PrivateStorage {
+  return platform === "win32" ? windowsStorage : posixStorage;
+}

package/src/adapters/risk-callers.ts

@@ -1,5 +1,5 @@
 import { type FileHandle, lstat } from "node:fs/promises";
-import { resolve } from "node:path";
+import { posix } from "node:path";
 import type { SgNode } from "@ast-grep/napi";
 import { CONCURRENCY, STATE_MAX_CHARS, TIMEOUT_MS } from "../constants.ts";
 import type { GitExec } from "../core/git.ts";
@@ -460,8 +460,10 @@ export async function collectRiskCallers(
                   typeof source.beforePath === "string"
                     ? source.beforePath
                     : source.path;
+                // Repository paths are always "/"-separated; the platform
+                // resolve would yield "C:\\src\\..." on Windows.
                 const basePath = specifier.startsWith(".")
-                  ? resolve("/", sourcePath, "..", specifier).slice(1)
+                  ? posix.resolve("/", sourcePath, "..", specifier).slice(1)
                   : specifier.replaceAll(".", "/");
                 const runtimeSource = basePath.replace(
                   /\.(js|jsx|mjs|cjs)$/,

package/src/adapters/shell.ts

@@ -0,0 +1,97 @@
+import { accessSync, constants } from "node:fs";
+// Candidates are Windows paths whatever the host OS, so the helpers use win32
+// semantics explicitly; the host-native `node:path` splits PATH on ":" on POSIX.
+import { win32 } from "node:path";
+
+export interface ShellInvocation {
+  executable: string;
+  /** Arguments placed before the `-c` script. */
+  prefix: string[];
+  /** Exports prepended to the script when the launcher cannot set them. */
+  scriptPrefix: string;
+}
+
+export type ShellResolution =
+  | ({ ok: true } & ShellInvocation)
+  | { ok: false; error: string };
+
+function executable(path: string): boolean {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Windows ships `bash.exe` launchers for WSL in System32 (and SysWOW64,
+ * Sysnative) and in WindowsApps. They run in a Linux VM that cannot see Windows
+ * temporary paths, so they are never used for command evidence, including
+ * when named explicitly in JEV_TOOLS_BASH.
+ */
+export function isWslLauncher(path: string): boolean {
+  const lower = win32.normalize(path).toLowerCase();
+  return (
+    /\\windows\\(system32|syswow64|sysnative)\\/.test(lower) ||
+    lower.includes("\\microsoft\\windowsapps\\")
+  );
+}
+
+/** Permitted Git for Windows bash candidates, most specific first. */
+export function windowsBashCandidates(env: NodeJS.ProcessEnv): string[] {
+  const candidates: string[] = [];
+  if (env.JEV_TOOLS_BASH?.trim()) candidates.push(env.JEV_TOOLS_BASH.trim());
+  const pathEntries = (env.PATH ?? env.Path ?? "")
+    .split(win32.delimiter)
+    .filter(Boolean);
+  for (const entry of pathEntries) {
+    candidates.push(win32.join(entry, "bash.exe"));
+    // Git\cmd\git.exe or Git\bin\git.exe on PATH implies Git\bin\bash.exe.
+    if (/[\\/](cmd|bin)$/i.test(entry))
+      candidates.push(win32.join(win32.dirname(entry), "bin", "bash.exe"));
+  }
+  for (const root of [
+    env.ProgramFiles,
+    env["ProgramFiles(x86)"],
+    env.LOCALAPPDATA && win32.join(env.LOCALAPPDATA, "Programs"),
+  ])
+    if (root) candidates.push(win32.join(root, "Git", "bin", "bash.exe"));
+  // Filter every source, so no candidate can reintroduce a WSL launcher.
+  return [...new Set(candidates)].filter(
+    (candidate) => win32.isAbsolute(candidate) && !isWslLauncher(candidate),
+  );
+}
+
+const UNAVAILABLE =
+  "No permitted bash found: install Git for Windows or set JEV_TOOLS_BASH to the full path of a bash that is not the WSL launcher.";
+let cached: ShellResolution | undefined;
+
+/**
+ * POSIX hosts keep `env CI=1 bash -c`. Windows has no `env` and its default
+ * `bash` is the WSL launcher, so resolve Git for Windows bash (or
+ * JEV_TOOLS_BASH) to an absolute, permitted path and export CI inside the
+ * script. When none is found this fails closed: no bare name is returned,
+ * because spawning one would search PATH again without the WSL exclusion.
+ */
+export function resolveShell(
+  platform: NodeJS.Platform = process.platform,
+  env: NodeJS.ProcessEnv = process.env,
+  isExecutable: (path: string) => boolean = executable,
+): ShellResolution {
+  if (platform !== "win32")
+    return {
+      ok: true,
+      executable: "env",
+      prefix: ["CI=1", "bash"],
+      scriptPrefix: "",
+    };
+  const useCache = isExecutable === executable && env === process.env;
+  if (useCache && cached) return cached;
+  const found = windowsBashCandidates(env).find((path) => isExecutable(path));
+  const resolved: ShellResolution = found
+    ? { ok: true, executable: found, prefix: [], scriptPrefix: "export CI=1; " }
+    : { ok: false, error: UNAVAILABLE };
+  if (useCache && found) cached = resolved;
+  return resolved;
+}

package/src/configuration.ts

@@ -3,6 +3,10 @@ import { constants } from "node:fs";
 import { lstat, mkdir, open, rename, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import {
+  type PrivateStorage,
+  privateStorage,
+} from "./adapters/private-storage.ts";
 import { createJevClient } from "./jev/client.ts";
 import type { JevClient } from "./jev/types.ts";
 
@@ -56,11 +60,19 @@ export class ConfigController {
   private saved: SavedConfiguration = {};
   private session: SavedConfiguration = {};
   private readonly directory: string;
+  private readonly storage: PrivateStorage;
   private initialization: Promise<void> | undefined;
   private currentClient: JevClient | undefined;
 
-  constructor(options: { env?: NodeJS.ProcessEnv; directory?: string } = {}) {
+  constructor(
+    options: {
+      env?: NodeJS.ProcessEnv;
+      directory?: string;
+      storage?: PrivateStorage;
+    } = {},
+  ) {
     const env = options.env ?? process.env;
+    this.storage = options.storage ?? privateStorage();
     for (const [field, name] of [
       ["url", "JEV_TOOLS_URL"],
       ["apiKey", "JEV_TOOLS_API_KEY"],
@@ -163,19 +175,14 @@ export class ConfigController {
 
   private async checkDirectory(): Promise<boolean> {
     // Check ancestors too: recursive mkdir and path-based reads must not follow symlinks.
+    // Privacy of the directory itself is checked with its file in readSaved,
+    // using the operating system's own permission model.
     let path = this.directory;
     let exists = true;
     while (true) {
       try {
         const stat = await lstat(path);
         if (!stat.isDirectory() || stat.isSymbolicLink()) throw storageError();
-        if (
-          path === this.directory &&
-          ((stat.mode & 0o077) !== 0 ||
-            (process.getuid && stat.uid !== process.getuid()))
-        ) {
-          throw storageError();
-        }
       } catch (error) {
         if ((error as NodeJS.ErrnoException)?.code !== "ENOENT")
           throw storageError();
@@ -191,12 +198,20 @@ export class ConfigController {
   private async readSaved(): Promise<SavedConfiguration> {
     try {
       if (!(await this.checkDirectory())) return {};
+      const directory = {
+        path: this.directory,
+        stat: await lstat(this.directory),
+      };
       const path = join(this.directory, "config.json");
       try {
         const stat = await lstat(path);
         if (!stat.isFile() || stat.isSymbolicLink()) throw storageError();
       } catch (error) {
-        if ((error as NodeJS.ErrnoException)?.code === "ENOENT") return {};
+        if ((error as NodeJS.ErrnoException)?.code === "ENOENT") {
+          if (!(await this.storage.isPrivate([directory])))
+            throw storageError();
+          return {};
+        }
         throw error;
       }
       const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -205,8 +220,7 @@ export class ConfigController {
         if (
           !stat.isFile() ||
           stat.nlink !== 1 ||
-          (stat.mode & 0o077) !== 0 ||
-          (process.getuid && stat.uid !== process.getuid())
+          !(await this.storage.isPrivate([directory, { path, stat }]))
         ) {
           throw storageError();
         }
@@ -235,9 +249,22 @@ export class ConfigController {
   private async save(values: SavedConfiguration): Promise<void> {
     let temporary: string | undefined;
     try {
-      if (!(await this.checkDirectory())) {
+      const existed = await this.checkDirectory();
+      if (!existed) {
         await mkdir(this.directory, { recursive: true, mode: 0o700 });
       }
+      // Windows ignores mkdir's mode, so restrict the ACL before any secret is
+      // written: always for a new directory, and for an existing one only while
+      // it holds no configuration (e.g. left behind by an earlier failed save).
+      // Existing configuration is never re-permissioned; readSaved refuses it.
+      if (
+        !existed ||
+        !(await lstat(join(this.directory, "config.json")).then(
+          () => true,
+          () => false,
+        ))
+      )
+        await this.storage.restrictDirectory(this.directory);
       // Refuse to replace malformed, insecure or newly introduced storage.
       await this.readSaved();
       temporary = join(this.directory, `.config-${randomUUID()}.tmp`);

package/src/constants.ts

@@ -5,6 +5,17 @@ export const ASK_NOTE_MAX_CHARS = 8_000;
 export const ASK_MAX_FILES = 20;
 export const ASK_TIMEOUT_S = 60;
 export const ASK_TIMEOUT_MAX_S = 300;
+export const PROCESS_KILL_GRACE_MS = 2_000;
+export const PROCESS_PIPE_GRACE_MS = 1_000;
+export const PROCESS_TREE_TIMEOUT_MS = 5_000;
+export const MCP_SHUTDOWN_FLUSH_TIMEOUT_MS = 1_000;
+export const PRIVATE_STORAGE_TIMEOUT_MS = 20_000;
+export const MCP_VALIDATION_MAX_ERRORS = 5;
+export const MCP_PACKAGE_REPLY_TIMEOUT_MS = 20_000;
+export const MCP_PACKAGE_EXIT_TIMEOUT_MS = 10_000;
+export const MCP_PACKAGE_KILL_TIMEOUT_MS = 2_000;
+export const MCP_PACKAGE_INSTALL_TIMEOUT_MS = 300_000;
+export const MCP_PACKAGE_STDERR_MAX_CHARS = 2_000;
 export const OUTPUT_REPEAT_MIN = 5;
 export const OUTPUT_CHUNK_CHARS = 2_500;
 export const OUTPUT_FIND_MAX_CALLS = 40;

package/src/core/command-output.ts

@@ -241,9 +241,25 @@ export function failureTargets(text: string): {
     // window when no failing-tests block exists (short outputs).
     if (node && (inSecondWindow || (secondAnchor < 0 && inFirstWindow)))
       targets.push({
-        path: node[1]?.replace(/^file:\/\//, "") ?? "",
+        path: nodeTestPath(node[1] ?? ""),
         assertion: true,
       });
   }
   return { assertion: signature === "assertion", signature, targets };
 }
+
+/**
+ * node:test reports absolute locations as file URLs: file:///repo/a.mjs on
+ * POSIX and file:///C:/repo/a%20b.mjs on Windows. Convert them to plain,
+ * decoded paths; other locations are returned unchanged.
+ */
+export function nodeTestPath(location: string): string {
+  if (!location.startsWith("file://")) return location;
+  let path = location.slice("file://".length);
+  if (/^\/[A-Za-z]:\//.test(path)) path = path.slice(1);
+  try {
+    return decodeURIComponent(path);
+  } catch {
+    return path;
+  }
+}

package/src/host.ts

@@ -20,3 +20,14 @@ export interface Names {
   byName: string;
   semantic: string;
 }
+/** MCP clients name their native tools differently; describe them generically. */
+export function mcpHost(): Host {
+  return {
+    isOmp: false,
+    names: {
+      grep: "your text search tool",
+      byName: "your file-name search tool",
+      semantic: "jev_find_files",
+    },
+  };
+}

package/src/jev/client.ts

@@ -259,6 +259,7 @@ export function createJevClient(
         });
         for (let attempt = 0; attempt < REQUEST_ATTEMPTS; attempt++) {
           let release: (() => void) | undefined;
+          let settle: (() => void) | undefined;
           const timeoutCancellation = new AbortController();
           let retryMs = Math.min(RETRY_MAX_MS, RETRY_BASE_MS * 2 ** attempt);
           try {
@@ -267,6 +268,13 @@ export function createJevClient(
               missing(ids, stopped);
               return;
             }
+            // The reservation is held from here on; `finally` releases it on
+            // every exit path (stopped, refused, failed, aborted, answered).
+            settle = await options.awaitAdmission?.(options.signal);
+            if (stopped) {
+              missing(ids, stopped);
+              return;
+            }
             const admission = options.beforeRequest?.(ids.length);
             if (admission && !admission.ok) {
               // A diagnostic denied admission supplies no judgment batch and
@@ -302,6 +310,9 @@ export function createJevClient(
               body = undefined;
             }
             addMetadata(body);
+            // Release the USD gate before any subdivision re-enters send().
+            settle?.();
+            settle = undefined;
             release();
             release = undefined;
             if (
@@ -438,6 +449,7 @@ export function createJevClient(
               return;
             }
           } finally {
+            settle?.();
             release?.();
             timeoutCancellation.abort();
           }

package/src/jev/types.ts

@@ -48,6 +48,12 @@ export interface JudgmentOptions {
   witnesses?: readonly string[];
   cache?: boolean;
   beforeRequest?: (questionCount: number) => Result<object>;
+  /**
+   * Awaited before each admission check. Resolves to a release function when
+   * it reserved a slot (a session under a USD limit), which the client calls
+   * exactly once on every exit path; rejects if `signal` aborts while waiting.
+   */
+  awaitAdmission?: (signal?: AbortSignal) => Promise<(() => void) | undefined>;
   onUsage?: (usage: { inputTokens: number; costUsd: number }) => void;
 }
 export interface JevClient {

package/src/mcp/main.ts

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+import { readFileSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+import { createInterface } from "node:readline";
+import { canonicalPath } from "../adapters/canonical-path.ts";
+import { MCP_SHUTDOWN_FLUSH_TIMEOUT_MS } from "../constants.ts";
+import { type JsonRpcResponse, McpServer, PARSE_ERROR } from "./protocol.ts";
+import { createMcpTools } from "./tools.ts";
+
+const usage = `jev-agent-tools-mcp - MCP stdio server for the six jev_* tools
+
+Usage: jev-agent-tools-mcp [--root <repository-directory>]
+
+The repository directory is --root, else JEV_TOOLS_ROOT, else the current
+directory. Configuration uses the same JEV_TOOLS_* environment variables as
+the pi and omp extension. Protocol messages use stdout; diagnostics stderr.`;
+
+function packageVersion(): string {
+  try {
+    // src/mcp/main.ts and dist/mcp/main.js both sit two levels below the root.
+    const text = readFileSync(
+      new URL("../../package.json", import.meta.url),
+      "utf8",
+    );
+    const parsed = JSON.parse(text) as { version?: unknown };
+    return typeof parsed.version === "string" ? parsed.version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
+function parseArgs(argv: readonly string[]): { root?: string; exit?: string } {
+  let root: string | undefined;
+  for (let index = 0; index < argv.length; index++) {
+    const arg = argv[index];
+    if (arg === "--help" || arg === "-h") return { exit: usage };
+    if (arg === "--version") return { exit: packageVersion() };
+    if (arg === "--root") {
+      root = argv[++index];
+      if (!root) throw new Error("--root requires a directory");
+    } else if (arg?.startsWith("--root=")) root = arg.slice("--root=".length);
+    else throw new Error(`Unknown argument: ${arg}\n\n${usage}`);
+  }
+  return { root };
+}
+
+async function main(): Promise<void> {
+  const parsed = parseArgs(process.argv.slice(2));
+  if (parsed.exit !== undefined) {
+    process.stdout.write(`${parsed.exit}\n`);
+    return;
+  }
+  const root = await canonicalPath(
+    resolve(parsed.root ?? process.env.JEV_TOOLS_ROOT ?? process.cwd()),
+  );
+  if (!statSync(root, { throwIfNoEntry: false })?.isDirectory())
+    throw new Error(`Repository directory not found: ${root}`);
+  const { tools, instructions, configured, warning } = await createMcpTools({
+    root,
+  });
+  const server = new McpServer(
+    { name: "jev-agent-tools", version: packageVersion(), instructions },
+    tools,
+  );
+  if (warning) process.stderr.write(`jev-agent-tools MCP: ${warning}\n`);
+  process.stderr.write(
+    `jev-agent-tools MCP server ready (root ${root}; ${configured ? "endpoint configured" : "no endpoint: set JEV_TOOLS_URL and JEV_TOOLS_API_KEY, or save them with /jev-setup in pi or omp"})\n`,
+  );
+  let closing = false;
+  const send = (response: JsonRpcResponse | JsonRpcResponse[] | undefined) => {
+    if (
+      closing ||
+      response === undefined ||
+      (Array.isArray(response) && !response.length)
+    )
+      return;
+    // Newline-delimited JSON; JSON.stringify never emits raw newlines.
+    process.stdout.write(`${JSON.stringify(response)}\n`);
+  };
+  const pending = new Set<Promise<void>>();
+  const lines = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  const shutdown = async (code: number) => {
+    if (closing) return;
+    closing = true;
+    lines.close();
+    process.stdin.destroy();
+    server.abortAll();
+    // Tool promises include bounded process-tree escalation. Do not exit when
+    // only the direct shell has closed: descendants may still need SIGKILL.
+    await Promise.allSettled(pending);
+    if (process.stdout.destroyed) process.exit(code);
+    // A client may leave its stdout pipe open without draining it. Cleanup
+    // is already complete; never let that client's backpressure hold us alive.
+    setTimeout(() => process.exit(code), MCP_SHUTDOWN_FLUSH_TIMEOUT_MS);
+    process.stdout.end(() => process.exit(code));
+  };
+  process.on("SIGTERM", () => void shutdown(143));
+  process.on("SIGINT", () => void shutdown(130));
+  process.stdout.on("error", () => void shutdown(1));
+  lines.on("line", (line) => {
+    if (closing || !line.trim()) return;
+    let message: unknown;
+    try {
+      message = JSON.parse(line);
+    } catch {
+      send(server.error(null, PARSE_ERROR, "Parse error: invalid JSON."));
+      return;
+    }
+    const work = (async () => {
+      if (Array.isArray(message)) {
+        // JSON-RPC batches (protocol 2025-03-26) answer as one array.
+        const responses = await Promise.all(
+          message.map((item) => server.handle(item)),
+        );
+        send(
+          responses.filter(
+            (item): item is JsonRpcResponse => item !== undefined,
+          ),
+        );
+      } else send(await server.handle(message));
+    })().catch((error: unknown) => {
+      process.stderr.write(`jev-agent-tools MCP: ${String(error)}\n`);
+    });
+    pending.add(work);
+    void work.finally(() => pending.delete(work));
+  });
+  lines.on("close", () => void shutdown(0));
+}
+
+main().catch((error: unknown) => {
+  process.stderr.write(
+    `jev-agent-tools MCP: ${error instanceof Error ? error.message : String(error)}\n`,
+  );
+  process.exit(1);
+});