negotium 0.1.7 → 0.1.9

package/dist/main.js

@@ -1,24 +1,136 @@
 #!/usr/bin/env bun
 // @bun
-var __create = Object.create;
-var __getProtoOf = Object.getPrototypeOf;
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __toESM = (mod, isNodeMode, target) => {
-  target = mod != null ? __create(__getProtoOf(mod)) : {};
-  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: () => mod[key],
-        enumerable: true
-      });
-  return to;
-};
-var __require = import.meta.require;
+import {
+  loadOtiumCli,
+  loadTelegramCli,
+  loadTerminalCli
+} from "./chunk-8g0c4as0.js";
+import {
+  __require,
+  __toESM
+} from "./chunk-hwy3n31w.js";
 
-// src/main.ts
-await import("@negotium/cli");
+// ../cli/src/main.ts
+var [, , command, ...args] = process.argv;
+function numericOption(values, name, fallback) {
+  const prefix = `--${name}=`;
+  const parsed = Number.parseInt(values.find((value) => value.startsWith(prefix))?.slice(prefix.length) ?? "", 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+switch (command) {
+  case "init": {
+    const { initCommand } = await import("./chunk-vefj3880.js");
+    initCommand();
+    break;
+  }
+  case "chat": {
+    const { chatCommand } = await import("./chunk-mmgh670x.js");
+    await chatCommand(args);
+    break;
+  }
+  case "serve": {
+    const { startDefaultNode } = await import("./chunk-rmyfmrrr.js");
+    const node = await startDefaultNode({
+      port: numericOption(args, "port", 7777),
+      advertise: true,
+      singleton: true
+    });
+    console.log(`negotium node listening on 127.0.0.1:${node.port} (ctrl-c to stop)`);
+    await node.completed;
+    break;
+  }
+  case "__node-daemon": {
+    const { runNodeDaemon } = await import("./chunk-rmyfmrrr.js");
+    await runNodeDaemon({ port: numericOption(args, "port", 0) });
+    break;
+  }
+  case "status": {
+    const { inspectNodeDaemon } = await import("./chunk-rmyfmrrr.js");
+    const status = await inspectNodeDaemon();
+    if (status.running && status.info) {
+      console.log(`negotium node running (pid ${status.info.pid}, 127.0.0.1:${status.info.port}, since ${status.info.startedAt})`);
+    } else if (status.info) {
+      console.log(`negotium node not responding (last pid ${status.info.pid}${status.error ? `: ${status.error}` : ""})`);
+      process.exitCode = 1;
+    } else {
+      console.log("negotium node is stopped");
+    }
+    break;
+  }
+  case "stop": {
+    const { stopNodeDaemon } = await import("./chunk-rmyfmrrr.js");
+    const stopped = await stopNodeDaemon();
+    console.log(stopped ? "negotium node shutdown requested" : "negotium node is not running");
+    break;
+  }
+  case "topics": {
+    const { topicsCommand } = await import("./chunk-3vn2vnj1.js");
+    topicsCommand();
+    break;
+  }
+  case "mcp": {
+    const { mcpCommand } = await import("./chunk-jzz91jwh.js");
+    mcpCommand(args);
+    break;
+  }
+  case "vault": {
+    const { vaultCommand } = await import("./chunk-f1pzh3xh.js");
+    vaultCommand(args);
+    break;
+  }
+  case "cron": {
+    const { cronCommand } = await import("./chunk-9spx3h9n.js");
+    await cronCommand(args);
+    break;
+  }
+  case "terminal": {
+    const { runTerminalCli } = await loadTerminalCli();
+    await runTerminalCli(args);
+    break;
+  }
+  case "telegram": {
+    const { runTelegramCli } = await loadTelegramCli();
+    await runTelegramCli();
+    break;
+  }
+  case "otium": {
+    const { runOtiumCli } = await loadOtiumCli();
+    await runOtiumCli(args);
+    break;
+  }
+  case "start":
+  case "adapters": {
+    const { adaptersCommand } = await import("./chunk-3t4dtm26.js");
+    await adaptersCommand(args);
+    break;
+  }
+  default: {
+    console.log([
+      "negotium \u2014 turn this computer into an agent node",
+      "",
+      "usage: negotium <init|chat|serve|status|stop|topics|mcp|vault|cron|terminal|telegram|otium|start> [args]",
+      "",
+      "  init            bootstrap ~/.negotium and check agent auth",
+      "  chat [topic]    interactive chat (creates the topic if missing)",
+      "                  options: --agent=claude|codex|maestro",
+      "  serve           foreground long-lived node (default port 7777)",
+      "  status          show the local long-lived node status",
+      "  stop            stop the local long-lived node",
+      "  topics          list topics on this node",
+      "  mcp list|add|remove|enable|disable   manage node MCP manifest",
+      "  vault list|set|get|del               node secret store (encrypted at rest)",
+      "  cron list|create|inspect|logs|run|pause|resume|restart|kill|reset|delete",
+      "  terminal        TUI client; auto-starts and connects to the local node",
+      "                  options: --embedded, --connect=http://host:port, --port=N",
+      "  telegram        Telegram adapter (configured from environment)",
+      "  otium join|serve  join an Otium workspace or serve its worker routes",
+      "  start <terminal|telegram|otium>  run one channel process",
+      "                  Terminal clients may run more than once and share one node"
+    ].join(`
+`));
+    if (command && command !== "help" && command !== "--help")
+      process.exitCode = 1;
+  }
+}
 
-//# debugId=3DC0E0AF6AED4BA564756E2164756E21
+//# debugId=29B5A521D233AB8564756E2164756E21

package/dist/main.js.map

@@ -1,10 +1,10 @@
 {
   "version": 3,
-  "sources": ["../src/main.ts"],
+  "sources": ["../../cli/src/main.ts"],
   "sourcesContent": [
-    "#!/usr/bin/env bun\n\n// Keep the unscoped package functional rather than using it as a name-only\n// placeholder. The canonical implementation lives in @negotium/cli.\nawait import(\"@negotium/cli\");\n\nexport {};\n"
+    "#!/usr/bin/env bun\n\nimport { loadOtiumCli, loadTelegramCli, loadTerminalCli } from \"@/adapter-loader\";\n\nconst [, , command, ...args] = process.argv;\n\nfunction numericOption(values: string[], name: string, fallback: number): number {\n  const prefix = `--${name}=`;\n  const parsed = Number.parseInt(\n    values.find((value) => value.startsWith(prefix))?.slice(prefix.length) ?? \"\",\n    10,\n  );\n  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;\n}\n\nswitch (command) {\n  case \"init\": {\n    const { initCommand } = await import(\"@/commands/init\");\n    initCommand();\n    break;\n  }\n  case \"chat\": {\n    const { chatCommand } = await import(\"@/commands/chat\");\n    await chatCommand(args);\n    break;\n  }\n  case \"serve\": {\n    const { startDefaultNode } = await import(\"@negotium/node\");\n    const node = await startDefaultNode({\n      port: numericOption(args, \"port\", 7777),\n      advertise: true,\n      singleton: true,\n    });\n    console.log(`negotium node listening on 127.0.0.1:${node.port} (ctrl-c to stop)`);\n    await node.completed;\n    break;\n  }\n  case \"__node-daemon\": {\n    const { runNodeDaemon } = await import(\"@negotium/node\");\n    await runNodeDaemon({ port: numericOption(args, \"port\", 0) });\n    break;\n  }\n  case \"status\": {\n    const { inspectNodeDaemon } = await import(\"@negotium/node\");\n    const status = await inspectNodeDaemon();\n    if (status.running && status.info) {\n      console.log(\n        `negotium node running (pid ${status.info.pid}, 127.0.0.1:${status.info.port}, since ${status.info.startedAt})`,\n      );\n    } else if (status.info) {\n      console.log(\n        `negotium node not responding (last pid ${status.info.pid}${status.error ? `: ${status.error}` : \"\"})`,\n      );\n      process.exitCode = 1;\n    } else {\n      console.log(\"negotium node is stopped\");\n    }\n    break;\n  }\n  case \"stop\": {\n    const { stopNodeDaemon } = await import(\"@negotium/node\");\n    const stopped = await stopNodeDaemon();\n    console.log(stopped ? \"negotium node shutdown requested\" : \"negotium node is not running\");\n    break;\n  }\n  case \"topics\": {\n    const { topicsCommand } = await import(\"@/commands/topics\");\n    topicsCommand();\n    break;\n  }\n  case \"mcp\": {\n    const { mcpCommand } = await import(\"@/commands/mcp\");\n    mcpCommand(args);\n    break;\n  }\n  case \"vault\": {\n    const { vaultCommand } = await import(\"@/commands/vault\");\n    vaultCommand(args);\n    break;\n  }\n  case \"cron\": {\n    const { cronCommand } = await import(\"@/commands/cron\");\n    await cronCommand(args);\n    break;\n  }\n  case \"terminal\": {\n    const { runTerminalCli } = await loadTerminalCli();\n    await runTerminalCli(args);\n    break;\n  }\n  case \"telegram\": {\n    const { runTelegramCli } = await loadTelegramCli();\n    await runTelegramCli();\n    break;\n  }\n  case \"otium\": {\n    const { runOtiumCli } = await loadOtiumCli();\n    await runOtiumCli(args);\n    break;\n  }\n  case \"start\":\n  case \"adapters\": {\n    const { adaptersCommand } = await import(\"@/commands/adapters\");\n    await adaptersCommand(args);\n    break;\n  }\n  default: {\n    console.log(\n      [\n        \"negotium — turn this computer into an agent node\",\n        \"\",\n        \"usage: negotium <init|chat|serve|status|stop|topics|mcp|vault|cron|terminal|telegram|otium|start> [args]\",\n        \"\",\n        \"  init            bootstrap ~/.negotium and check agent auth\",\n        \"  chat [topic]    interactive chat (creates the topic if missing)\",\n        \"                  options: --agent=claude|codex|maestro\",\n        \"  serve           foreground long-lived node (default port 7777)\",\n        \"  status          show the local long-lived node status\",\n        \"  stop            stop the local long-lived node\",\n        \"  topics          list topics on this node\",\n        \"  mcp list|add|remove|enable|disable   manage node MCP manifest\",\n        \"  vault list|set|get|del               node secret store (encrypted at rest)\",\n        \"  cron list|create|inspect|logs|run|pause|resume|restart|kill|reset|delete\",\n        \"  terminal        TUI client; auto-starts and connects to the local node\",\n        \"                  options: --embedded, --connect=http://host:port, --port=N\",\n        \"  telegram        Telegram adapter (configured from environment)\",\n        \"  otium join|serve  join an Otium workspace or serve its worker routes\",\n        \"  start <terminal|telegram|otium>  run one channel process\",\n        \"                  Terminal clients may run more than once and share one node\",\n      ].join(\"\\n\"),\n    );\n    if (command && command !== \"help\" && command !== \"--help\") process.exitCode = 1;\n  }\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;AAIA,MAAa;",
-  "debugId": "3DC0E0AF6AED4BA564756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;AAIA,SAAW,YAAY,QAAQ,QAAQ;AAEvC,SAAS,aAAa,CAAC,QAAkB,MAAc,UAA0B;AAAA,EAC/E,MAAM,SAAS,KAAK;AAAA,EACpB,MAAM,SAAS,OAAO,SACpB,OAAO,KAAK,CAAC,UAAU,MAAM,WAAW,MAAM,CAAC,GAAG,MAAM,OAAO,MAAM,KAAK,IAC1E,EACF;AAAA,EACA,OAAO,OAAO,UAAU,MAAM,KAAK,UAAU,IAAI,SAAS;AAAA;AAG5D,QAAQ;AAAA,OACD,QAAQ;AAAA,IACX,QAAQ,gBAAgB,MAAa;AAAA,IACrC,YAAY;AAAA,IACZ;AAAA,EACF;AAAA,OACK,QAAQ;AAAA,IACX,QAAQ,gBAAgB,MAAa;AAAA,IACrC,MAAM,YAAY,IAAI;AAAA,IACtB;AAAA,EACF;AAAA,OACK,SAAS;AAAA,IACZ,QAAQ,qBAAqB,MAAa;AAAA,IAC1C,MAAM,OAAO,MAAM,iBAAiB;AAAA,MAClC,MAAM,cAAc,MAAM,QAAQ,IAAI;AAAA,MACtC,WAAW;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AAAA,IACD,QAAQ,IAAI,wCAAwC,KAAK,uBAAuB;AAAA,IAChF,MAAM,KAAK;AAAA,IACX;AAAA,EACF;AAAA,OACK,iBAAiB;AAAA,IACpB,QAAQ,kBAAkB,MAAa;AAAA,IACvC,MAAM,cAAc,EAAE,MAAM,cAAc,MAAM,QAAQ,CAAC,EAAE,CAAC;AAAA,IAC5D;AAAA,EACF;AAAA,OACK,UAAU;AAAA,IACb,QAAQ,sBAAsB,MAAa;AAAA,IAC3C,MAAM,SAAS,MAAM,kBAAkB;AAAA,IACvC,IAAI,OAAO,WAAW,OAAO,MAAM;AAAA,MACjC,QAAQ,IACN,8BAA8B,OAAO,KAAK,kBAAkB,OAAO,KAAK,eAAe,OAAO,KAAK,YACrG;AAAA,IACF,EAAO,SAAI,OAAO,MAAM;AAAA,MACtB,QAAQ,IACN,0CAA0C,OAAO,KAAK,MAAM,OAAO,QAAQ,KAAK,OAAO,UAAU,KACnG;AAAA,MACA,QAAQ,WAAW;AAAA,IACrB,EAAO;AAAA,MACL,QAAQ,IAAI,0BAA0B;AAAA;AAAA,IAExC;AAAA,EACF;AAAA,OACK,QAAQ;AAAA,IACX,QAAQ,mBAAmB,MAAa;AAAA,IACxC,MAAM,UAAU,MAAM,eAAe;AAAA,IACrC,QAAQ,IAAI,UAAU,qCAAqC,8BAA8B;AAAA,IACzF;AAAA,EACF;AAAA,OACK,UAAU;AAAA,IACb,QAAQ,kBAAkB,MAAa;AAAA,IACvC,cAAc;AAAA,IACd;AAAA,EACF;AAAA,OACK,OAAO;AAAA,IACV,QAAQ,eAAe,MAAa;AAAA,IACpC,WAAW,IAAI;AAAA,IACf;AAAA,EACF;AAAA,OACK,SAAS;AAAA,IACZ,QAAQ,iBAAiB,MAAa;AAAA,IACtC,aAAa,IAAI;AAAA,IACjB;AAAA,EACF;AAAA,OACK,QAAQ;AAAA,IACX,QAAQ,gBAAgB,MAAa;AAAA,IACrC,MAAM,YAAY,IAAI;AAAA,IACtB;AAAA,EACF;AAAA,OACK,YAAY;AAAA,IACf,QAAQ,mBAAmB,MAAM,gBAAgB;AAAA,IACjD,MAAM,eAAe,IAAI;AAAA,IACzB;AAAA,EACF;AAAA,OACK,YAAY;AAAA,IACf,QAAQ,mBAAmB,MAAM,gBAAgB;AAAA,IACjD,MAAM,eAAe;AAAA,IACrB;AAAA,EACF;AAAA,OACK,SAAS;AAAA,IACZ,QAAQ,gBAAgB,MAAM,aAAa;AAAA,IAC3C,MAAM,YAAY,IAAI;AAAA,IACtB;AAAA,EACF;AAAA,OACK;AAAA,OACA,YAAY;AAAA,IACf,QAAQ,oBAAoB,MAAa;AAAA,IACzC,MAAM,gBAAgB,IAAI;AAAA,IAC1B;AAAA,EACF;AAAA,WACS;AAAA,IACP,QAAQ,IACN;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK;AAAA,CAAI,CACb;AAAA,IACA,IAAI,WAAW,YAAY,UAAU,YAAY;AAAA,MAAU,QAAQ,WAAW;AAAA,EAChF;AAAA;",
+  "debugId": "29B5A521D233AB8564756E2164756E21",
   "names": []
 }

package/dist/runtime/scripts/faster-whisper-wrapper.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""faster-whisper wrapper used by Otium media extraction.
+
+Usage:
+  faster-whisper-wrapper.py INPUT --model MODEL --language LANG --output-dir DIR --output-format txt
+
+Arguments are the subset used by the TypeScript media extractor:
+  --model          faster-whisper model size (e.g. medium, large-v3, turbo)
+  --language       ISO language code (e.g. ko)
+  --output-dir     Directory to write output files to
+  --output-format  Output format (txt supported)
+
+The script transcribes INPUT and writes {basename}.txt to --output-dir.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("input", help="Audio file path")
+    parser.add_argument("--model", default="medium", help="Whisper model size")
+    parser.add_argument("--language", default=None, help="Language code (e.g. ko)")
+    parser.add_argument("--output-dir", default=".", help="Output directory")
+    parser.add_argument("--output-format", default="txt", help="Output format")
+    return parser.parse_args()
+
+
+def main() -> None:
+    args = parse_args()
+
+    if args.output_format != "txt":
+        print(f"Unsupported output format: {args.output_format}", file=sys.stderr)
+        sys.exit(1)
+
+    try:
+        from faster_whisper import WhisperModel
+    except ImportError:
+        print(
+            "faster-whisper not installed. Run: uv pip install faster-whisper",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
+    compute_type = "int8"  # CPU-friendly
+    model_size = args.model
+    # Normalize common model aliases to faster-whisper size identifiers.
+    if "turbo" in model_size:
+        model_size = "turbo"
+    elif "large-v3" in model_size:
+        model_size = "large-v3"
+    elif "large-v2" in model_size:
+        model_size = "large-v2"
+    elif "medium" in model_size:
+        model_size = "medium"
+    elif "small" in model_size:
+        model_size = "small"
+    elif "tiny" in model_size:
+        model_size = "tiny"
+
+    os.makedirs(args.output_dir, exist_ok=True)
+
+    model = WhisperModel(model_size, device="cpu", compute_type=compute_type)
+
+    segments, info = model.transcribe(
+        args.input,
+        language=args.language,
+        beam_size=5,
+        vad_filter=True,
+    )
+
+    base = os.path.splitext(os.path.basename(args.input))[0]
+    out_path = os.path.join(args.output_dir, f"{base}.txt")
+
+    with open(out_path, "w", encoding="utf-8") as f:
+        for segment in segments:
+            f.write(segment.text.strip() + "\n")
+
+    print(f"Transcription written to {out_path}", file=sys.stderr)
+
+
+if __name__ == "__main__":
+    main()

package/dist/runtime/scripts/mcp-patchright-http.mjs

@@ -0,0 +1,349 @@
+#!/usr/bin/env node
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createRequire } from "node:module";
+import { dirname, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import {
+  CallToolRequestSchema,
+  isInitializeRequest,
+  ListToolsRequestSchema,
+} from "@modelcontextprotocol/sdk/types.js";
+
+function parseCli(argv = process.argv.slice(2)) {
+  const options = { host: "127.0.0.1" };
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    const [flag, inlineValue] = arg.includes("=") ? arg.split(/=(.*)/s, 2) : [arg, undefined];
+    const nextValue = () => inlineValue ?? argv[++index];
+    switch (flag) {
+      case "--host":
+        options.host = nextValue();
+        break;
+      case "--port": {
+        const value = Number(nextValue());
+        if (!Number.isInteger(value) || value <= 0) throw new Error(`Invalid --port: ${value}`);
+        options.port = value;
+        break;
+      }
+      case "--user-data-dir":
+        options.userDataDir = nextValue();
+        break;
+      case "--headless":
+        options.headless = true;
+        break;
+      case "--headed":
+        options.headless = false;
+        break;
+      default:
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+  if (!options.port) throw new Error("--port is required");
+  return options;
+}
+
+const require = createRequire(import.meta.url);
+const packageRoot = dirname(require.resolve("mcp-patchright/package.json"));
+const [{ BrowserManager }, { handleTool }, { tools }] = await Promise.all([
+  import(pathToFileURL(resolve(packageRoot, "dist/browser/manager.js")).href),
+  import(pathToFileURL(resolve(packageRoot, "dist/tools/handlers.js")).href),
+  import(pathToFileURL(resolve(packageRoot, "dist/tools/registry.js")).href),
+]);
+
+function createMcpServer(defaultStartOptions, sharedManager, owner) {
+  const server = new Server(
+    { name: "mcp-patchright", version: "0.1.0" },
+    { capabilities: { tools: {} } },
+  );
+  const manager = sharedManager ?? new BrowserManager(defaultStartOptions);
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    try {
+      return await manager.runAsOwner(owner, () =>
+        handleTool(manager, request.params.name, request.params.arguments ?? {}),
+      );
+    } catch (error) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: error instanceof Error ? `${error.name}: ${error.message}` : String(error),
+          },
+        ],
+        isError: true,
+      };
+    }
+  });
+  return server;
+}
+
+function requestOwner(req) {
+  const owner = req.header("x-browser-owner");
+  if (!owner || owner.length > 256) return undefined;
+  return owner;
+}
+
+function sseRequestOwner(req) {
+  const owner = requestOwner(req) ?? (typeof req.query.owner === "string" ? req.query.owner : "");
+  if (!owner || owner.length > 256) return undefined;
+  return owner;
+}
+
+const expectedCapability = process.env.NEGOTIUM_BROWSER_CAPABILITY;
+if (!expectedCapability) throw new Error("NEGOTIUM_BROWSER_CAPABILITY is required");
+
+function safeCapabilityEqual(provided, expectedValue) {
+  if (!provided) return false;
+  const actual = Buffer.from(provided);
+  const expected = Buffer.from(expectedValue);
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+
+function hasCapability(req) {
+  const provided = req.header("x-browser-capability");
+  return safeCapabilityEqual(provided, expectedCapability);
+}
+
+function hasOwnerCapability(req, owner) {
+  const expected = createHmac("sha256", expectedCapability).update(owner).digest("hex");
+  return safeCapabilityEqual(req.header("x-browser-capability"), expected);
+}
+
+function requireCapability(req, res) {
+  if (hasCapability(req)) return true;
+  res.status(401).json({ ok: false, error: "invalid browser capability" });
+  return false;
+}
+
+function requireOwnerCapability(req, res, owner) {
+  const queryCapability =
+    req.path === "/sse" && typeof req.query.capability === "string"
+      ? req.query.capability
+      : undefined;
+  const expected = createHmac("sha256", expectedCapability).update(owner).digest("hex");
+  if (hasOwnerCapability(req, owner) || safeCapabilityEqual(queryCapability, expected)) return true;
+  res.status(401).json({ ok: false, error: "invalid browser owner capability" });
+  return false;
+}
+
+// Egress proxy is passed via env (not argv) so credentials stay out of `ps`.
+// The parent backend sets NEGOTIUM_BROWSER_PROXY_* from resolveBrowserProxy().
+function proxyFromEnv() {
+  const server = process.env.NEGOTIUM_BROWSER_PROXY_SERVER;
+  if (!server) return undefined;
+  const proxy = { server };
+  if (process.env.NEGOTIUM_BROWSER_PROXY_USERNAME)
+    proxy.username = process.env.NEGOTIUM_BROWSER_PROXY_USERNAME;
+  if (process.env.NEGOTIUM_BROWSER_PROXY_PASSWORD)
+    proxy.password = process.env.NEGOTIUM_BROWSER_PROXY_PASSWORD;
+  if (process.env.NEGOTIUM_BROWSER_PROXY_BYPASS)
+    proxy.bypass = process.env.NEGOTIUM_BROWSER_PROXY_BYPASS;
+  return proxy;
+}
+
+const options = parseCli();
+const proxy = proxyFromEnv();
+const defaultStartOptions = {
+  ...(options.userDataDir ? { userDataDir: options.userDataDir } : {}),
+  ...(options.headless !== undefined ? { headless: options.headless } : {}),
+  ...(proxy ? { proxy } : {}),
+};
+const sharedManager = new BrowserManager(defaultStartOptions);
+const app = createMcpExpressApp({ host: options.host });
+
+const transports = {};
+const servers = {};
+const sessionOwners = {};
+const sseTransports = {};
+const sseServers = {};
+const sseMessageTokens = {};
+let httpServer;
+
+app.get("/health", (_req, res) => {
+  res.json({
+    ok: true,
+    name: "mcp-patchright",
+  });
+});
+
+// Claude Code and Maestro use the legacy two-endpoint SSE transport. The
+// initial connection is authenticated with the owner capability. A fresh,
+// per-session token embedded in the advertised message endpoint prevents
+// another loopback process from injecting JSON-RPC messages by session ID.
+app.get("/sse", async (req, res) => {
+  const owner = sseRequestOwner(req);
+  if (!owner) {
+    res.status(400).json({ ok: false, error: "browser owner is required in SSE mode" });
+    return;
+  }
+  if (!requireOwnerCapability(req, res, owner)) return;
+
+  const messageToken = randomBytes(32).toString("hex");
+  const transport = new SSEServerTransport(
+    `/message?token=${encodeURIComponent(messageToken)}`,
+    res,
+  );
+  const server = createMcpServer(defaultStartOptions, sharedManager, owner);
+  sseTransports[transport.sessionId] = transport;
+  sseServers[transport.sessionId] = server;
+  sseMessageTokens[transport.sessionId] = messageToken;
+  transport.onclose = () => {
+    const sessionId = transport.sessionId;
+    delete sseTransports[sessionId];
+    delete sseMessageTokens[sessionId];
+    const managedServer = sseServers[sessionId];
+    delete sseServers[sessionId];
+    void managedServer?.close().catch(() => undefined);
+  };
+  await server.connect(transport);
+});
+
+app.post("/message", async (req, res) => {
+  const sessionId = typeof req.query.sessionId === "string" ? req.query.sessionId : "";
+  const messageToken = typeof req.query.token === "string" ? req.query.token : "";
+  const transport = sseTransports[sessionId];
+  const expectedMessageToken = sseMessageTokens[sessionId];
+  if (!transport) {
+    res.status(404).send("SSE session not found");
+    return;
+  }
+  if (!expectedMessageToken || !safeCapabilityEqual(messageToken, expectedMessageToken)) {
+    res.status(401).send("invalid SSE message token");
+    return;
+  }
+  await transport.handlePostMessage(req, res, req.body);
+});
+
+app.all("/mcp", async (req, res) => {
+  try {
+    const owner = requestOwner(req);
+    if (!owner) {
+      res.status(400).json({
+        jsonrpc: "2.0",
+        error: { code: -32600, message: "browser owner is required in HTTP mode" },
+        id: null,
+      });
+      return;
+    }
+    if (!requireOwnerCapability(req, res, owner)) return;
+    const sessionId = req.headers["mcp-session-id"];
+    const normalizedSessionId = Array.isArray(sessionId)
+      ? sessionId[0]
+      : typeof sessionId === "string"
+        ? sessionId
+        : undefined;
+    let transport;
+    if (normalizedSessionId && transports[normalizedSessionId]) {
+      const existingTransport = transports[normalizedSessionId];
+      if (!(existingTransport instanceof StreamableHTTPServerTransport)) {
+        res.status(400).json({
+          jsonrpc: "2.0",
+          error: { code: -32000, message: "Session uses a different transport protocol" },
+          id: null,
+        });
+        return;
+      }
+      if (sessionOwners[normalizedSessionId] !== owner) {
+        res.status(403).json({
+          jsonrpc: "2.0",
+          error: { code: -32001, message: "Browser owner does not match this session" },
+          id: null,
+        });
+        return;
+      }
+      transport = existingTransport;
+    } else if (!normalizedSessionId && req.method === "POST" && isInitializeRequest(req.body)) {
+      let server;
+      transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: () => randomUUID(),
+        onsessioninitialized: (newSessionId) => {
+          if (!transport || !server) return;
+          transports[newSessionId] = transport;
+          servers[newSessionId] = server;
+          sessionOwners[newSessionId] = owner;
+        },
+      });
+      server = createMcpServer(defaultStartOptions, sharedManager, owner);
+      transport.onclose = () => {
+        const sid = transport?.sessionId;
+        if (sid) {
+          delete transports[sid];
+          delete sessionOwners[sid];
+          const managedServer = servers[sid];
+          delete servers[sid];
+          void managedServer?.close().catch(() => undefined);
+        }
+      };
+      await server.connect(transport);
+    } else {
+      res.status(400).json({
+        jsonrpc: "2.0",
+        error: { code: -32000, message: "Bad Request: No valid session ID provided" },
+        id: null,
+      });
+      return;
+    }
+    await transport.handleRequest(req, res, req.body);
+  } catch (error) {
+    console.error("Error handling /mcp request:", error);
+    if (!res.headersSent) {
+      res.status(500).json({
+        jsonrpc: "2.0",
+        error: { code: -32603, message: "Internal server error" },
+        id: null,
+      });
+    }
+  }
+});
+
+app.delete("/owners", async (req, res) => {
+  if (!requireCapability(req, res)) return;
+  const owner = requestOwner(req);
+  if (!owner) {
+    res.status(400).json({ ok: false, error: "owner is required" });
+    return;
+  }
+  const closed = await sharedManager.closeOwnerPages(owner);
+  res.json({ ok: true, owner, closed });
+});
+
+async function shutdown() {
+  for (const [sessionId, transport] of Object.entries(sseTransports)) {
+    await transport.close().catch(() => undefined);
+    delete sseTransports[sessionId];
+    delete sseMessageTokens[sessionId];
+  }
+  for (const [sessionId, server] of Object.entries(sseServers)) {
+    await server.close().catch(() => undefined);
+    delete sseServers[sessionId];
+  }
+  for (const [sessionId, transport] of Object.entries(transports)) {
+    await transport.close().catch(() => undefined);
+    delete transports[sessionId];
+    delete sessionOwners[sessionId];
+  }
+  for (const [sessionId, server] of Object.entries(servers)) {
+    await server.close().catch(() => undefined);
+    delete servers[sessionId];
+  }
+  await sharedManager.close().catch(() => undefined);
+  await new Promise((resolveClose) => httpServer?.close(() => resolveClose()));
+  process.exit(0);
+}
+
+httpServer = app.listen(options.port, options.host, () => {
+  console.error(`mcp-patchright listening on http://${options.host}:${options.port}`);
+  console.error(`  SSE:        http://${options.host}:${options.port}/sse`);
+  console.error(`  Streamable: http://${options.host}:${options.port}/mcp`);
+});
+httpServer.on("error", (error) => {
+  console.error("mcp-patchright HTTP server error:", error);
+  process.exit(1);
+});
+
+process.on("SIGINT", () => void shutdown());
+process.on("SIGTERM", () => void shutdown());