mstro-app 0.4.17 → 0.4.20

package/server/services/websocket/plan-handlers.ts

@@ -24,7 +24,7 @@ export function handlePlanMessage(
   msg: WebSocketMessage,
   _tabId: string,
   workingDir: string,
-  permission?: 'control' | 'view',
+  permission?: 'view',
 ): void {
   const handlers: Record<string, () => void> = {
     planInit: () => handlePlanInit(ctx, ws, workingDir),

package/server/services/websocket/plan-helpers.ts

@@ -23,7 +23,7 @@ export function resolvePlanPath(workingDir: string, relativePath: string): strin
 }
 
 /** Guard for write operations — returns true if denied. */
-export function denyIfViewOnly(ctx: HandlerContext, ws: WSContext, permission?: 'control' | 'view'): boolean {
+export function denyIfViewOnly(ctx: HandlerContext, ws: WSContext, permission?: 'view'): boolean {
   if (permission === 'view') {
     ctx.send(ws, { type: 'planError', data: { error: 'Permission denied' } });
     return true;

package/server/services/websocket/plan-issue-handlers.ts

@@ -5,6 +5,7 @@ import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from '
 import { basename, join } from 'node:path';
 import { replaceFrontMatterField } from '../plan/front-matter.js';
 import { defaultPmDir, getNextId, parseBoardDirectory, parsePlanDirectory, parseSingleIssue, parseSingleMilestone, parseSingleSprint, planDirExists, resolvePmDir } from '../plan/parser.js';
+import { tryCompleteParentEpic } from '../plan/state-reconciler.js';
 import type { HandlerContext } from './handler-context.js';
 import { buildIssueMarkdown, denyIfViewOnly, formatYamlValue, getWatcher, resolvePlanPath, scaffoldPmDirectory } from './plan-helpers.js';
 import type { WebSocketMessage, WSContext } from './types.js';
@@ -108,7 +109,7 @@ function resolveBacklogContext(pmDir: string, workingDir: string, boardId?: stri
 
 export function handleCreateIssue(
   ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage,
-  workingDir: string, permission?: 'control' | 'view',
+  workingDir: string, permission?: 'view',
 ): void {
   if (denyIfViewOnly(ctx, ws, permission)) return;
 
@@ -135,7 +136,7 @@ export function handleCreateIssue(
 
 export function handleUpdateIssue(
   ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage,
-  workingDir: string, permission?: 'control' | 'view',
+  workingDir: string, permission?: 'view',
 ): void {
   if (denyIfViewOnly(ctx, ws, permission)) return;
 
@@ -166,11 +167,20 @@ export function handleUpdateIssue(
 
   const issue = parseSingleIssue(workingDir, path);
   ctx.broadcastToAll({ type: 'planIssueUpdated', data: issue });
+
+  // Auto-complete parent epic if all its children are now done
+  if (issue) {
+    const epicPath = tryCompleteParentEpic(workingDir, issue);
+    if (epicPath) {
+      const epic = parseSingleIssue(workingDir, epicPath);
+      if (epic) ctx.broadcastToAll({ type: 'planIssueUpdated', data: epic });
+    }
+  }
 }
 
 export function handleDeleteIssue(
   ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage,
-  workingDir: string, permission?: 'control' | 'view',
+  workingDir: string, permission?: 'view',
 ): void {
   if (denyIfViewOnly(ctx, ws, permission)) return;
 
@@ -192,7 +202,7 @@ export function handleDeleteIssue(
 
 export function handleScaffold(
   ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage,
-  workingDir: string, permission?: 'control' | 'view',
+  workingDir: string, permission?: 'view',
 ): void {
   if (denyIfViewOnly(ctx, ws, permission)) return;
 

package/server/services/websocket/plan-sprint-handlers.ts

@@ -60,7 +60,7 @@ function assignIssuesToSprint(workingDir: string, issues: Issue[], issueIds: str
 
 export function handleCreateSprint(
   ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage,
-  workingDir: string, permission?: 'control' | 'view',
+  workingDir: string, permission?: 'view',
 ): void {
   if (denyIfViewOnly(ctx, ws, permission)) return;
 
@@ -116,7 +116,7 @@ function updateFileField(filePath: string, field: string, value: string): void {
 
 export function handleActivateSprint(
   ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage,
-  workingDir: string, permission?: 'control' | 'view',
+  workingDir: string, permission?: 'view',
 ): void {
   if (denyIfViewOnly(ctx, ws, permission)) return;
 
@@ -162,7 +162,7 @@ export function handleActivateSprint(
 
 export function handleCompleteSprint(
   ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage,
-  workingDir: string, permission?: 'control' | 'view',
+  workingDir: string, permission?: 'view',
 ): void {
   if (denyIfViewOnly(ctx, ws, permission)) return;
 

package/server/services/websocket/quality-handlers.ts

@@ -10,7 +10,7 @@
  * - quality-fix-agent.ts     — AI fix prompt, progress tracking, handler
  */
 
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { validatePathWithinWorkingDir } from '../pathUtils.js';
 import type { HandlerContext } from './handler-context.js';
 import type { FindingForFix } from './quality-fix-agent.js';
@@ -36,8 +36,12 @@ function getPersistence(workingDir: string): QualityPersistence {
 
 function resolvePath(workingDir: string, dirPath?: string): string {
   if (!dirPath || dirPath === '.' || dirPath === './') return workingDir;
-  if (dirPath.startsWith('/')) return dirPath;
-  return join(workingDir, dirPath);
+  const resolved = dirPath.startsWith('/') ? dirPath : join(workingDir, dirPath);
+  // Ensure path is within working directory even for non-sandboxed users
+  const normalizedResolved = resolve(resolved);
+  const normalizedWorkingDir = resolve(workingDir);
+  if (!normalizedResolved.startsWith(normalizedWorkingDir)) return workingDir;
+  return normalizedResolved;
 }
 
 /**
@@ -68,9 +72,9 @@ export function handleQualityMessage(
   msg: WebSocketMessage,
   _tabId: string,
   workingDir: string,
-  permission?: 'control' | 'view',
+  permission?: 'view',
 ): void {
-  const isSandboxed = permission === 'control' || permission === 'view';
+  const isSandboxed = !!permission;
   const sendPathError = (path: string, error: string) => {
     ctx.send(ws, { type: 'qualityError', data: { path, error } });
   };

package/server/services/websocket/quality-review-agent.ts

@@ -571,8 +571,11 @@ function persistReviewResults(
 ): import('./quality-service.js').QualityResults | null {
   const persistence = getPersistence(workingDir);
   const existingReport = persistence.loadReport(reportPath);
+  // CodeReviewFinding is structurally compatible with QualityFinding (category is a narrower union)
+  const findings = reviewResult.findings as import('./quality-types.js').QualityFinding[];
+  const findingsRecord = reviewResult.findings as unknown[] as Record<string, unknown>[];
   if (!existingReport) {
-    persistence.saveCodeReview(reportPath, reviewResult.findings as unknown as Record<string, unknown>[], reviewResult.summary);
+    persistence.saveCodeReview(reportPath, findingsRecord, reviewResult.summary);
     return null;
   }
 
@@ -582,17 +585,17 @@ function persistReviewResults(
       ...existingReport,
       overall: reviewResult.score,
       grade: reviewResult.grade,
-      codeReview: reviewResult.findings as unknown as typeof existingReport.codeReview,
+      codeReview: findings,
       scoreRationale: reviewResult.scoreRationale ?? undefined,
     };
   } else {
     updatedResults = recomputeWithAiReview(existingReport, reviewResult.findings);
-    updatedResults = { ...updatedResults, codeReview: reviewResult.findings as unknown as typeof updatedResults.codeReview };
+    updatedResults = { ...updatedResults, codeReview: findings };
   }
 
   persistence.saveReport(reportPath, updatedResults);
   persistence.appendHistory(updatedResults, reportPath);
-  persistence.saveCodeReview(reportPath, reviewResult.findings as unknown as Record<string, unknown>[], reviewResult.summary);
+  persistence.saveCodeReview(reportPath, findingsRecord, reviewResult.summary);
   return updatedResults;
 }
 

package/server/services/websocket/session-handlers.ts

@@ -178,15 +178,20 @@ function mergePreUploadedAttachments(ctx: HandlerContext, tabId: string, inlineA
   return merged;
 }
 
-export function handleSessionMessage(ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage, tabId: string, permission?: 'control' | 'view'): void {
+const WRITE_OPS = new Set(['execute', 'cancel', 'new', 'approve', 'reject']);
+
+export function handleSessionMessage(ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage, tabId: string, permission?: 'view'): void {
+  if (permission === 'view' && WRITE_OPS.has(msg.type)) {
+    throw new Error('View-only users cannot perform write operations');
+  }
+
   switch (msg.type) {
     case 'execute': {
       if (!msg.data?.prompt) throw new Error('Prompt is required');
       const session = requireSession(ctx, ws, tabId);
-      const sandboxed = permission === 'control' || permission === 'view';
       const worktreeDir = ctx.gitDirectories.get(tabId);
       const attachments = mergePreUploadedAttachments(ctx, tabId, msg.data.attachments);
-      session.executePrompt(msg.data.prompt, attachments, { sandboxed, workingDir: worktreeDir });
+      session.executePrompt(msg.data.prompt, attachments, { workingDir: worktreeDir });
       break;
     }
     case 'cancel': {

package/server/services/websocket/terminal-handlers.ts

@@ -7,11 +7,11 @@ import { getPTYManager } from '../terminal/pty-manager.js';
 import type { HandlerContext } from './handler-context.js';
 import type { WebSocketMessage, WSContext } from './types.js';
 
-export function handleTerminalMessage(ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage, tabId: string, workingDir: string, permission?: 'control' | 'view'): void {
+export async function handleTerminalMessage(ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage, tabId: string, workingDir: string): Promise<void> {
   const termId = msg.terminalId || tabId;
   switch (msg.type) {
     case 'terminalInit':
-      handleTerminalInit(ctx, ws, termId, workingDir, msg.data?.shell, msg.data?.cols, msg.data?.rows, permission);
+      await handleTerminalInit(ctx, ws, termId, workingDir, msg.data?.shell, msg.data?.cols, msg.data?.rows);
       break;
     case 'terminalReconnect':
       handleTerminalReconnect(ctx, ws, termId);
@@ -31,7 +31,7 @@ export function handleTerminalMessage(ctx: HandlerContext, ws: WSContext, msg: W
   }
 }
 
-function handleTerminalInit(
+async function handleTerminalInit(
   ctx: HandlerContext,
   ws: WSContext,
   terminalId: string,
@@ -39,8 +39,7 @@ function handleTerminalInit(
   requestedShell?: string,
   cols?: number,
   rows?: number,
-  permission?: 'control' | 'view'
-): void {
+): Promise<void> {
   const ptyManager = getPTYManager();
 
   if (!ptyManager.isPtyAvailable()) {
@@ -59,13 +58,12 @@ function handleTerminalInit(
   setupTerminalBroadcastListeners(ctx, terminalId);
 
   try {
-    const { shell, cwd, isReconnect, platform } = ptyManager.create(
+    const { shell, cwd, isReconnect, platform } = await ptyManager.create(
       terminalId,
       workingDir,
       cols || 80,
       rows || 24,
       requestedShell,
-      { sandboxed: permission === 'control' || permission === 'view' }
     );
 
     if (!isReconnect) {
@@ -96,23 +94,11 @@ function handleTerminalInit(
   } catch (error: unknown) {
     const errorMsg = error instanceof Error ? error.message : String(error);
     console.error(`[WebSocketImproviseHandler] Failed to create terminal:`, error);
-
-    if (errorMsg.startsWith('SANDBOX_UNAVAILABLE:')) {
-      ctx.send(ws, {
-        type: 'terminalError',
-        terminalId,
-        data: {
-          error: 'SANDBOX_UNAVAILABLE',
-          message: 'Terminal requires bubblewrap (bwrap) to be installed on the host machine for shared app sessions. Ask the app owner to install it.',
-        }
-      });
-    } else {
-      ctx.send(ws, {
-        type: 'terminalError',
-        terminalId,
-        data: { error: errorMsg || 'Failed to create terminal' }
-      });
-    }
+    ctx.send(ws, {
+      type: 'terminalError',
+      terminalId,
+      data: { error: errorMsg || 'Failed to create terminal' }
+    });
     removeTerminalSubscriber(ctx, terminalId, ws);
   }
 }

package/server/services/websocket/types.ts

@@ -158,8 +158,8 @@ export interface WebSocketMessage {
   terminalId?: string;
   // biome-ignore lint/suspicious/noExplicitAny: message envelope carries heterogeneous payloads
   data?: any;
-  /** Injected by server relay for sandboxed shared users (control + view) */
-  _permission?: 'control' | 'view';
+  /** Injected by server relay for view-only shared users */
+  _permission?: 'view';
 }
 
 export interface WebSocketResponse {

package/server/utils/port.ts

@@ -59,44 +59,3 @@ export async function findAvailablePort(startPort: number, maxTries: number = 20
   }
   throw new Error(`No available ports found between ${startPort} and ${startPort + maxTries}`)
 }
-
-/**
- * Find an available port pair for frontend and backend
- * Frontend = EVEN port (3000, 3002, 3004...)
- * Backend = ODD port (3001, 3003, 3005...)
- *
- * Checks all candidate ports in parallel for fast detection.
- */
-export async function findAvailablePortPair(startPort: number = 3000, maxPairs: number = 20): Promise<{ frontend: number; backend: number }> {
-  // Ensure startPort is even
-  const basePort = startPort % 2 === 0 ? startPort : startPort + 1
-
-  // Generate all candidate pairs
-  const pairs: { frontend: number; backend: number }[] = []
-  for (let i = 0; i < maxPairs; i++) {
-    pairs.push({
-      frontend: basePort + (i * 2),      // 3000, 3002, 3004...
-      backend: basePort + (i * 2) + 1    // 3001, 3003, 3005...
-    })
-  }
-
-  // Check all ports in parallel (both frontend and backend ports)
-  const allPorts = pairs.flatMap(p => [p.frontend, p.backend])
-  const results = await Promise.all(
-    allPorts.map(async (port) => ({ port, available: await isPortAvailable(port) }))
-  )
-
-  // Build a set of available ports for O(1) lookup
-  const availablePorts = new Set(
-    results.filter(r => r.available).map(r => r.port)
-  )
-
-  // Find first pair where both ports are available
-  for (const pair of pairs) {
-    if (availablePorts.has(pair.frontend) && availablePorts.has(pair.backend)) {
-      return pair
-    }
-  }
-
-  throw new Error(`No available port pairs found starting from ${startPort}`)
-}

package/dist/server/mcp/bouncer-sandbox.d.ts

@@ -1,60 +0,0 @@
-export interface SandboxExecResult {
-    /** The sandboxed command that was actually run */
-    wrappedCommand: string;
-    /** Whether sandbox-runtime is available on this platform */
-    sandboxAvailable: boolean;
-    /** Whether the sandbox contained the operation (no violations) */
-    contained: boolean;
-    /** List of violation descriptions if any escaped the sandbox */
-    violations: string[];
-}
-export interface CanaryCheckResult {
-    /** Whether the canary file still exists (should be true if sandbox contained the write) */
-    canaryIntact: boolean;
-    /** Whether a file was written outside the sandbox (should be false) */
-    escapeDetected: boolean;
-}
-/**
- * Test harness that wraps command execution in sandbox-runtime.
- * Provides canary files and violation tracking to verify containment.
- */
-export declare class BouncerSandboxHarness {
-    private sandboxManager;
-    private sandboxAvailable;
-    private tempDir;
-    private canaryDir;
-    constructor();
-    /**
-     * Initialize the sandbox. Falls back gracefully if bwrap/sandbox-exec not available.
-     */
-    initialize(): Promise<{
-        available: boolean;
-        reason?: string;
-    }>;
-    /**
-     * Execute a command inside the sandbox. Returns containment results.
-     * If sandbox is not available, validates the bouncer decision only (no actual execution).
-     */
-    executeInSandbox(command: string): Promise<SandboxExecResult>;
-    /**
-     * Place a canary file and return a checker to verify containment.
-     * If a sandboxed command can delete or modify the canary, containment failed.
-     */
-    placeCanary(name: string): {
-        path: string;
-        check: () => CanaryCheckResult;
-    };
-    /**
-     * Get the temp directory where sandboxed commands can write.
-     */
-    getSandboxWriteDir(): string;
-    /**
-     * Whether the sandbox is actually available and initialized.
-     */
-    isAvailable(): boolean;
-    /**
-     * Clean up temp dirs and reset sandbox state.
-     */
-    cleanup(): Promise<void>;
-}
-//# sourceMappingURL=bouncer-sandbox.d.ts.map

package/dist/server/mcp/bouncer-sandbox.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bouncer-sandbox.d.ts","sourceRoot":"","sources":["../../../server/mcp/bouncer-sandbox.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,cAAc,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAC;IACnB,gEAAgE;IAChE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,2FAA2F;IAC3F,YAAY,EAAE,OAAO,CAAC;IACtB,uEAAuE;IACvE,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,cAAc,CAA0F;IAChH,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAS;;IAQ1B;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAiDpE;;;OAGG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmDnE;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,iBAAiB,CAAA;KAAE;IAc3E;;OAEG;IACH,kBAAkB,IAAI,MAAM;IAI5B;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAc/B"}

package/dist/server/mcp/bouncer-sandbox.js

@@ -1,182 +0,0 @@
-// Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
-/**
- * Sandbox Harness for Bouncer Testing
- *
- * Wraps command execution in Anthropic's sandbox-runtime (bubblewrap on Linux,
- * sandbox-exec on macOS) to safely test what happens when the bouncer FAILS —
- * i.e., when a malicious tool call gets through.
- *
- * Usage in tests:
- *   const harness = new BouncerSandboxHarness();
- *   await harness.initialize();
- *   const result = await harness.executeInSandbox('rm -rf /tmp/test-canary');
- *   expect(result.violations).toContain(...)
- *   await harness.cleanup();
- */
-import { execSync } from 'node:child_process';
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-/**
- * Test harness that wraps command execution in sandbox-runtime.
- * Provides canary files and violation tracking to verify containment.
- */
-export class BouncerSandboxHarness {
-    sandboxManager = null;
-    sandboxAvailable = false;
-    tempDir;
-    canaryDir;
-    constructor() {
-        this.tempDir = mkdtempSync(join(tmpdir(), 'bouncer-sandbox-'));
-        this.canaryDir = join(this.tempDir, 'canaries');
-        mkdirSync(this.canaryDir, { recursive: true });
-    }
-    /**
-     * Initialize the sandbox. Falls back gracefully if bwrap/sandbox-exec not available.
-     */
-    async initialize() {
-        try {
-            const { SandboxManager } = await import('@anthropic-ai/sandbox-runtime');
-            if (!SandboxManager.isSupportedPlatform()) {
-                return { available: false, reason: 'Platform not supported by sandbox-runtime' };
-            }
-            const deps = SandboxManager.checkDependencies();
-            if (deps.errors.length > 0) {
-                return {
-                    available: false,
-                    reason: `Missing dependencies: ${deps.errors.join(', ')}`,
-                };
-            }
-            await SandboxManager.initialize({
-                network: {
-                    allowedDomains: [], // Block ALL network access
-                    deniedDomains: ['*'],
-                },
-                filesystem: {
-                    denyRead: [
-                        '/home/*/.ssh',
-                        '/home/*/.aws',
-                        '/home/*/.gnupg',
-                        '/etc/shadow',
-                        '/etc/passwd',
-                    ],
-                    allowWrite: [this.tempDir], // Only allow writes to our temp dir
-                    denyWrite: [
-                        '/',
-                        '/home',
-                        '/etc',
-                        '/usr',
-                        '/var',
-                    ],
-                },
-            });
-            this.sandboxManager = SandboxManager;
-            this.sandboxAvailable = true;
-            return { available: true };
-        }
-        catch (error) {
-            const msg = error instanceof Error ? error.message : String(error);
-            return { available: false, reason: `Failed to initialize sandbox: ${msg}` };
-        }
-    }
-    /**
-     * Execute a command inside the sandbox. Returns containment results.
-     * If sandbox is not available, validates the bouncer decision only (no actual execution).
-     */
-    async executeInSandbox(command) {
-        if (!this.sandboxAvailable || !this.sandboxManager) {
-            return {
-                wrappedCommand: command,
-                sandboxAvailable: false,
-                contained: true,
-                violations: ['Sandbox not available — decision-only testing mode'],
-            };
-        }
-        const violations = [];
-        try {
-            const wrappedCommand = await this.sandboxManager.wrapWithSandbox(command);
-            // Execute the wrapped command and capture violations
-            try {
-                execSync(wrappedCommand, {
-                    timeout: 5000,
-                    stdio: 'pipe',
-                    cwd: this.tempDir,
-                });
-            }
-            catch {
-                // Command failure inside sandbox is expected for malicious ops
-            }
-            // Check violation store
-            const stderr = this.sandboxManager.annotateStderrWithSandboxFailures(command, '');
-            if (stderr) {
-                violations.push(stderr);
-            }
-            this.sandboxManager.cleanupAfterCommand();
-            return {
-                wrappedCommand,
-                sandboxAvailable: true,
-                contained: violations.length === 0,
-                violations,
-            };
-        }
-        catch (error) {
-            const msg = error instanceof Error ? error.message : String(error);
-            violations.push(`Sandbox execution error: ${msg}`);
-            return {
-                wrappedCommand: command,
-                sandboxAvailable: true,
-                contained: true, // Error means the command didn't execute
-                violations,
-            };
-        }
-    }
-    /**
-     * Place a canary file and return a checker to verify containment.
-     * If a sandboxed command can delete or modify the canary, containment failed.
-     */
-    placeCanary(name) {
-        const canaryPath = join(this.canaryDir, name);
-        const escapePath = join(this.canaryDir, `${name}.escaped`);
-        writeFileSync(canaryPath, `canary-${Date.now()}`, 'utf-8');
-        return {
-            path: canaryPath,
-            check: () => ({
-                canaryIntact: existsSync(canaryPath),
-                escapeDetected: existsSync(escapePath),
-            }),
-        };
-    }
-    /**
-     * Get the temp directory where sandboxed commands can write.
-     */
-    getSandboxWriteDir() {
-        return this.tempDir;
-    }
-    /**
-     * Whether the sandbox is actually available and initialized.
-     */
-    isAvailable() {
-        return this.sandboxAvailable;
-    }
-    /**
-     * Clean up temp dirs and reset sandbox state.
-     */
-    async cleanup() {
-        try {
-            if (this.sandboxManager) {
-                await this.sandboxManager.reset();
-            }
-        }
-        catch {
-            // Ignore cleanup errors
-        }
-        try {
-            rmSync(this.tempDir, { recursive: true, force: true });
-        }
-        catch {
-            // Ignore cleanup errors
-        }
-    }
-}
-//# sourceMappingURL=bouncer-sandbox.js.map

package/dist/server/mcp/bouncer-sandbox.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bouncer-sandbox.js","sourceRoot":"","sources":["../../../server/mcp/bouncer-sandbox.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAEhE;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAoBjC;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IACxB,cAAc,GAAqF,IAAI,CAAC;IACxG,gBAAgB,GAAG,KAAK,CAAC;IACzB,OAAO,CAAS;IAChB,SAAS,CAAS;IAE1B;QACE,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAChD,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAEzE,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,EAAE,CAAC;gBAC1C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;YACnF,CAAC;YAED,MAAM,IAAI,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,yBAAyB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC1D,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,CAAC,UAAU,CAAC;gBAC9B,OAAO,EAAE;oBACP,cAAc,EAAE,EAAE,EAAE,2BAA2B;oBAC/C,aAAa,EAAE,CAAC,GAAG,CAAC;iBACrB;gBACD,UAAU,EAAE;oBACV,QAAQ,EAAE;wBACR,cAAc;wBACd,cAAc;wBACd,gBAAgB;wBAChB,aAAa;wBACb,aAAa;qBACd;oBACD,UAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,oCAAoC;oBAChE,SAAS,EAAE;wBACT,GAAG;wBACH,OAAO;wBACP,MAAM;wBACN,MAAM;wBACN,MAAM;qBACP;iBACF;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YACrC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,GAAG,EAAE,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACnD,OAAO;gBACL,cAAc,EAAE,OAAO;gBACvB,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,CAAC,oDAAoD,CAAC;aACnE,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAE1E,qDAAqD;YACrD,IAAI,CAAC;gBACH,QAAQ,CAAC,cAAc,EAAE;oBACvB,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,MAAM;oBACb,GAAG,EAAE,IAAI,CAAC,OAAO;iBAClB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;YAED,wBAAwB;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,iCAAiC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAClF,IAAI,MAAM,EAAE,CAAC;gBACX,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;YAED,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,CAAC;YAE1C,OAAO;gBACL,cAAc;gBACd,gBAAgB,EAAE,IAAI;gBACtB,SAAS,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;gBAClC,UAAU;aACX,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,UAAU,CAAC,IAAI,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;YACnD,OAAO;gBACL,cAAc,EAAE,OAAO;gBACvB,gBAAgB,EAAE,IAAI;gBACtB,SAAS,EAAE,IAAI,EAAE,yCAAyC;gBAC1D,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,IAAY;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC;QAC3D,aAAa,CAAC,UAAU,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAE3D,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBACZ,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC;gBACpC,cAAc,EAAE,UAAU,CAAC,UAAU,CAAC;aACvC,CAAC;SACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;CACF"}

package/dist/server/services/credentials.d.ts

@@ -1,39 +0,0 @@
-export interface Credentials {
-    token: string;
-    userId: string;
-    email: string;
-    name?: string;
-    deviceId?: string;
-    clientId: string;
-    createdAt: string;
-    lastRefreshedAt?: string;
-}
-/**
- * Get stored credentials, or null if not logged in
- */
-export declare function getCredentials(): Credentials | null;
-/**
- * Save credentials after successful login
- */
-export declare function saveCredentials(credentials: Credentials): void;
-/**
- * Update the token (used during refresh)
- */
-export declare function updateToken(newToken: string): void;
-/**
- * Delete credentials (logout)
- */
-export declare function deleteCredentials(): boolean;
-/**
- * Check if user is logged in
- */
-export declare function isLoggedIn(): boolean;
-/**
- * Get the credentials file path (for display)
- */
-export declare function getCredentialsPath(): string;
-/**
- * Get the mstro directory path
- */
-export declare function getMstroDir(): string;
-//# sourceMappingURL=credentials.d.ts.map

package/dist/server/services/credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../server/services/credentials.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAWD;;GAEG;AACH,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAoBnD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAK9D;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CASlD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAY3C;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}