patchwork-os 0.2.0-beta.10.canary.136 → 0.2.0-beta.10.canary.139

package/README.md

@@ -118,7 +118,7 @@ The bridge runs without any flags. No recipes, no automation, no dashboard — j
 | Client | Protocol |
 |---|---|
 | Claude Code CLI | WebSocket `ws://127.0.0.1:<port>` |
-| Claude Desktop | stdio shim → WebSocket |
+| Claude Desktop, Grok Build (Grok CLI) | stdio shim → WebSocket |
 | Gemini CLI, Codex CLI, claude.ai | Streamable HTTP + Bearer token |
 
 **Connecting Gemini CLI:**
@@ -134,6 +134,25 @@ gemini mcp add patchwork http://127.0.0.1:<port>/mcp \
 
 The bridge auto-responds to the GET probe Gemini sends before initializing, so it shows as **Connected** immediately.
 
+**Connecting Grok Build (Grok CLI):**
+
+Grok Build connects over the same **stdio shim** as Claude Desktop. Add this block to `~/.grok/config.toml` (the `--workspace` arg is the important part):
+
+```toml
+[mcp_servers.patchwork]
+command = "claude-ide-bridge"
+args = ["shim", "--workspace", "/absolute/path/to/your/project"]
+enabled = true
+```
+
+Three gotchas that look like bugs but aren't:
+
+- **`--workspace` is required.** Without it the shim picks the newest bridge lock across *all* workspaces — in a multi-bridge setup (orchestrator, leftover dev bridges) that can be the wrong or a dead bridge, so tools act on the wrong project or hang. Always pin it to your project path.
+- **`grok mcp doctor` hangs — don't use it.** The shim is a long-lived relay that stays open for the session, so `doctor` waits forever for it to exit. Verify with the in-TUI **`/mcps`** instead, or run `claude-ide-bridge shim --ping` (one-shot: connects, lists tools, exits).
+- **The approval gate can park tool calls.** If `~/.patchwork/config.json` has `"approvalGate": "all"` (or `"high"`), tool calls queue for human approval in the dashboard and look like they're hanging to Grok. Set it to `"high"` (gate only risky writes) or `"off"`, or approve in the dashboard at `localhost:3000`.
+
+Grok Build can also connect over Streamable HTTP + Bearer (same as Gemini, above) if you'd rather not use the shim.
+
 **Tool modes:**
 
 | Mode | Tools | When to use |

package/dist/adapters/grok.js

@@ -4,7 +4,12 @@ import { OpenAIAdapter } from "./openai.js";
  * https://api.x.ai/v1 — same shape as OpenAI Chat Completions.
  */
 const API_URL = "https://api.x.ai/v1/chat/completions";
-const DEFAULT_MODEL = "grok-beta";
+// Keep in sync with the driver path (src/drivers/grok/index.ts), which already
+// defaults to grok-2-latest. grok-beta is a legacy alias; defaulting the two
+// Grok entry points to different models meant the effective model depended on
+// which path ran. grok-2-latest is a stable alias — verify the current model
+// at console.x.ai before bumping further (e.g. to grok-4.x).
+const DEFAULT_MODEL = "grok-2-latest";
 export function createGrokAdapter(opts) {
     const apiKey = opts.apiKey ?? process.env.XAI_API_KEY;
     if (!apiKey)

package/dist/adapters/grok.js.map

@@ -1 +1 @@
-{"version":3,"file":"grok.js","sourceRoot":"","sources":["../../src/adapters/grok.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;GAGG;AAEH,MAAM,OAAO,GAAG,sCAAsC,CAAC;AACvD,MAAM,aAAa,GAAG,WAAW,CAAC;AAElC,MAAM,UAAU,iBAAiB,CAAC,IAKjC;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACtD,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,OAAO,IAAI,aAAa,CAAC;QACvB,WAAW,EAAE,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO;QAChC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,aAAa;QAChD,MAAM;QACN,aAAa,EAAE,IAAI;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"grok.js","sourceRoot":"","sources":["../../src/adapters/grok.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;GAGG;AAEH,MAAM,OAAO,GAAG,sCAAsC,CAAC;AACvD,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,6DAA6D;AAC7D,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,MAAM,UAAU,iBAAiB,CAAC,IAKjC;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACtD,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,OAAO,IAAI,aAAa,CAAC;QACvB,WAAW,EAAE,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO;QAChC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,aAAa;QAChD,MAAM;QACN,aAAa,EAAE,IAAI;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;AACL,CAAC"}

package/dist/mcpRoutes.js

@@ -37,7 +37,7 @@ export function tryHandleMcpRoute(req, res, parsedUrl, deps) {
         const card = {
             name: "claude-ide-bridge",
             version: BRIDGE_PROTOCOL_VERSION,
-            description: "MCP bridge providing full IDE integration for Claude Code — LSP, diagnostics, file operations, terminal, debug adapters, and AI task orchestration",
+            description: "MCP bridge providing full IDE integration for AI coding assistants — LSP, diagnostics, file operations, terminal, debug adapters, and AI task orchestration",
             homepage: "https://github.com/Oolab-labs/claude-ide-bridge",
             transport: ["websocket", "stdio", "streamable-http"],
             capabilities: {

package/dist/mcpRoutes.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcpRoutes.js","sourceRoot":"","sources":["../src/mcpRoutes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAOxE;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAoB,EACpB,GAAmB,EACnB,SAAc,EACd,IAAkB;IAElB,IACE,GAAG,CAAC,GAAG,KAAK,mCAAmC;QAC/C,GAAG,CAAC,GAAG,KAAK,kBAAkB,EAC9B,CAAC;QACD,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,uBAAuB;YAChC,WAAW,EACT,oJAAoJ;YACtJ,QAAQ,EAAE,iDAAiD;YAC3D,SAAS,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,iBAAiB,CAAC;YACpD,YAAY,EAAE;gBACZ,KAAK,EAAE,IAAI;gBACX,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,IAAI;aAClB;YACD,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,iDAAiD;SAC9D,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,kBAAkB;YAClC,6BAA6B,EAAE,GAAG;SACnC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,iFAAiF;IACjF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACrE,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,4BAA4B,CAC7B,CAAC;YACF,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,6CAA6C,CAC9C,CAAC;YACF,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,gBAAgB,CAAC,CAAC;QACnE,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"mcpRoutes.js","sourceRoot":"","sources":["../src/mcpRoutes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAOxE;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAoB,EACpB,GAAmB,EACnB,SAAc,EACd,IAAkB;IAElB,IACE,GAAG,CAAC,GAAG,KAAK,mCAAmC;QAC/C,GAAG,CAAC,GAAG,KAAK,kBAAkB,EAC9B,CAAC;QACD,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,uBAAuB;YAChC,WAAW,EACT,6JAA6J;YAC/J,QAAQ,EAAE,iDAAiD;YAC3D,SAAS,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,iBAAiB,CAAC;YACpD,YAAY,EAAE;gBACZ,KAAK,EAAE,IAAI;gBACX,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,IAAI;aAClB;YACD,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,iDAAiD;SAC9D,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,kBAAkB;YAClC,6BAA6B,EAAE,GAAG;SACnC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,iFAAiF;IACjF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACrE,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,4BAA4B,CAC7B,CAAC;YACF,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,6CAA6C,CAC9C,CAAC;YACF,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,gBAAgB,CAAC,CAAC;QACnE,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchwork-os",
-  "version": "0.2.0-beta.10.canary.136",
+  "version": "0.2.0-beta.10.canary.139",
   "description": "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/mcp-stdio-shim.cjs

@@ -30,6 +30,27 @@ const { randomUUID } = require("node:crypto");
 // Resolve ws from the bridge's own node_modules (script lives in scripts/)
 const { WebSocket } = require(path.join(__dirname, "..", "node_modules", "ws"));
 
+// process.kill(pid, 0) probes liveness without delivering a signal: it throws
+// ESRCH when the process is gone and EPERM when it exists but isn't ours (still
+// alive). A stale lock whose bridge has exited would otherwise be "selected"
+// (newest mtime within its tier) and every connect would hang on a refused port
+// until backoff gives up — the multi-bridge footgun. Mirrors the shared
+// src/bridgeLockDiscovery.ts isLive() check.
+function isAlive(pid) {
+  if (typeof pid !== "number" || !Number.isFinite(pid)) return true; // unknown pid → don't exclude
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+
+// Remembers the last lock we logged a selection for, so the diagnostic below
+// fires once at startup (and again only when the selection actually changes)
+// rather than on every poll tick.
+let lastSelectedLockPath = null;
+
 function findLockFile() {
   const lockDir = path.join(
     process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude"),
@@ -38,49 +59,40 @@ function findLockFile() {
   // Three-tier preference: orchestrator > bridge > any lock (each by newest mtime).
   // Orchestrator locks win because child bridge restarts produce newer lock files,
   // which would hijack the shim away from the orchestrator if we only used mtime.
-  let orchestratorLock = null;
-  let orchestratorMtime = 0;
-  let bridgeLock = null;
-  let bridgeMtime = 0;
-  let fallbackLock = null;
-  let fallbackMtime = 0;
+  const orchestrator = { path: null, mtime: 0, data: null };
+  const bridge = { path: null, mtime: 0, data: null };
+  const fallback = { path: null, mtime: 0, data: null };
   try {
     for (const f of fs.readdirSync(lockDir)) {
       if (!f.endsWith(".lock")) continue;
       const fullPath = path.join(lockDir, f);
       try {
         const stat = fs.statSync(fullPath);
-        let isBridge = false;
-        let isOrchestrator = false;
+        let data = null;
         try {
-          const data = JSON.parse(fs.readFileSync(fullPath, "utf8"));
-          isBridge = data.isBridge === true;
-          isOrchestrator = data.orchestrator === true;
-          // Skip locks that don't match the requested workspace
-          if (
-            workspaceFilter &&
-            data.workspace &&
-            data.workspace !== workspaceFilter
-          )
-            continue;
+          data = JSON.parse(fs.readFileSync(fullPath, "utf8"));
         } catch {
-          // unparseable — treat as non-bridge
+          // unparseable — treated as a fallback lock with no metadata
         }
-        if (isOrchestrator) {
-          if (stat.mtimeMs > orchestratorMtime) {
-            orchestratorMtime = stat.mtimeMs;
-            orchestratorLock = fullPath;
-          }
-        } else if (isBridge) {
-          if (stat.mtimeMs > bridgeMtime) {
-            bridgeMtime = stat.mtimeMs;
-            bridgeLock = fullPath;
-          }
-        } else {
-          if (stat.mtimeMs > fallbackMtime) {
-            fallbackMtime = stat.mtimeMs;
-            fallbackLock = fullPath;
-          }
+        // Skip locks whose owning bridge process has exited. Without this a
+        // wedged/stale lock can be picked and the connection hangs.
+        if (data && !isAlive(data.pid)) continue;
+        // When a workspace filter is set, require an EXACT workspace match — a
+        // lock with a missing/blank workspace field must not be picked under the
+        // filter (otherwise the shim can latch onto an unrelated bridge).
+        if (workspaceFilter && (!data || data.workspace !== workspaceFilter))
+          continue;
+        const isBridge = data ? data.isBridge === true : false;
+        const isOrchestrator = data ? data.orchestrator === true : false;
+        const tier = isOrchestrator
+          ? orchestrator
+          : isBridge
+            ? bridge
+            : fallback;
+        if (stat.mtimeMs > tier.mtime) {
+          tier.mtime = stat.mtimeMs;
+          tier.path = fullPath;
+          tier.data = data;
         }
       } catch {
         // skip unreadable files
@@ -90,7 +102,25 @@ function findLockFile() {
     // lock dir doesn't exist
   }
   // Prefer orchestrator > bridge > fallback (each newest mtime within tier)
-  return orchestratorLock ?? bridgeLock ?? fallbackLock;
+  const chosen = orchestrator.path
+    ? orchestrator
+    : bridge.path
+      ? bridge
+      : fallback.path
+        ? fallback
+        : null;
+  // One-line stderr diagnostic so operators can see which bridge/workspace the
+  // shim latched onto — silent wrong-bridge selection was a real footgun. stderr
+  // is not the JSON-RPC stream, so this never corrupts protocol traffic.
+  if (chosen && chosen.path !== lastSelectedLockPath) {
+    lastSelectedLockPath = chosen.path;
+    const wsName = chosen.data?.workspace || "(unknown workspace)";
+    const pid = chosen.data?.pid || "?";
+    process.stderr.write(
+      `mcp-stdio-shim: selected ${path.basename(chosen.path)} (workspace=${wsName}, pid=${pid})\n`,
+    );
+  }
+  return chosen ? chosen.path : null;
 }
 
 function parseLock(lockPath) {
@@ -199,11 +229,16 @@ function scheduleBackoffReconnect(errorType) {
 // Parse named flags first so they don't pollute positional port/token detection.
 const args = process.argv.slice(2);
 let workspaceFilter = null;
+let pingMode = false;
 for (let i = 0; i < args.length; i++) {
-  if (args[i] === "--workspace" && args[i + 1]) {
+  if (args[i] === "--ping" || args[i] === "--probe") {
+    pingMode = true;
+    args.splice(i, 1);
+    i--;
+  } else if (args[i] === "--workspace" && args[i + 1] !== undefined) {
     workspaceFilter = args[i + 1];
     args.splice(i, 2);
-    break;
+    i--;
   }
 }
 const explicitPort = args[0] && args[1] ? Number(args[0]) : null;
@@ -369,8 +404,104 @@ function startPoll() {
   }, POLL_INTERVAL_MS);
 }
 
-// --- Initial connection ---
-if (explicitPort !== null) {
+// --- Ping mode: one-shot probe, then exit ---
+// `grok mcp doctor` (and similar stdio MCP verifiers) hang on this shim because
+// it is a long-lived relay that only exits on stdin EOF. `--ping` / `--probe`
+// gives those tools a clean check: connect, run initialize + tools/list, print a
+// one-line summary, and exit. It skips the relay, lock watcher, and reconnect
+// loops entirely.
+if (pingMode) {
+  let pingPort = explicitPort;
+  let pingToken = explicitToken;
+  if (pingPort === null) {
+    const lockFile = findLockFile();
+    if (!lockFile) {
+      process.stderr.write("mcp-stdio-shim: --ping: no bridge lock found.\n");
+      process.exit(1);
+    }
+    try {
+      const parsed = parseLock(lockFile);
+      pingPort = parsed.port;
+      pingToken = parsed.authToken;
+    } catch (err) {
+      process.stderr.write(
+        `mcp-stdio-shim: --ping: lock unreadable (${err.message}).\n`,
+      );
+      process.exit(1);
+    }
+  }
+  let pingDone = false;
+  const pingWs = new WebSocket(`ws://127.0.0.1:${pingPort}`, {
+    headers: {
+      "x-claude-code-ide-authorization": pingToken,
+      "x-claude-code-session-id": CLIENT_SESSION_ID,
+    },
+  });
+  const failPing = (msg) => {
+    if (pingDone) return;
+    pingDone = true;
+    process.stderr.write(`mcp-stdio-shim: --ping: ${msg}\n`);
+    try {
+      pingWs.terminate();
+    } catch {
+      /* ignore */
+    }
+    process.exit(1);
+  };
+  const pingTimer = setTimeout(
+    () => failPing(`timed out after 5s (port ${pingPort})`),
+    5000,
+  );
+  pingWs.on("open", () => {
+    pingWs.send(
+      JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion: "2025-06-18",
+          capabilities: {},
+          clientInfo: { name: "shim-ping", version: "1" },
+        },
+      }),
+    );
+  });
+  pingWs.on("message", (raw) => {
+    let msg;
+    try {
+      msg = JSON.parse(raw.toString());
+    } catch {
+      return;
+    }
+    if (msg.id === 1) {
+      pingWs.send(
+        JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
+      );
+      pingWs.send(
+        JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" }),
+      );
+    } else if (msg.id === 2) {
+      clearTimeout(pingTimer);
+      pingDone = true;
+      const n =
+        msg.result && Array.isArray(msg.result.tools)
+          ? msg.result.tools.length
+          : "?";
+      process.stdout.write(`bridge OK — port ${pingPort}, ${n} tools\n`);
+      try {
+        pingWs.close();
+      } catch {
+        /* ignore */
+      }
+      process.exit(0);
+    }
+  });
+  pingWs.on("error", (err) => failPing(`connect failed (${err.message})`));
+  pingWs.on("close", (code) =>
+    failPing(`closed before tools/list (code ${code})`),
+  );
+} else if (explicitPort !== null) {
+  // --- Initial connection ---
   connect(explicitPort, explicitToken);
 } else {
   const lockFile = findLockFile();
@@ -398,7 +529,7 @@ if (explicitPort !== null) {
 // Watches ~/.claude/ide/ for .lock file changes. When a new bridge lock appears
 // on a different port, reconnects automatically. This means Claude Desktop never
 // needs to be restarted when the bridge restarts on a new port.
-if (explicitPort === null) {
+if (!pingMode && explicitPort === null) {
   const lockDir = path.join(
     process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude"),
     "ide",
@@ -439,52 +570,38 @@ if (explicitPort === null) {
 
 // --- stdin → bridge (newline-delimited JSON-RPC) ---
 // Messages that arrive before the WebSocket is open are queued and flushed on connect.
-process.stdin.setEncoding("utf8");
-process.stdin.on("data", (chunk) => {
-  buffer += chunk;
-  const lines = buffer.split("\n");
-  buffer = lines.pop() ?? "";
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    if (ws && ws.readyState === WebSocket.OPEN) {
-      try {
-        ws.send(trimmed);
-      } catch (sendErr) {
+// Skipped in --ping mode — the one-shot probe manages its own lifecycle and exits.
+if (!pingMode) {
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (chunk) => {
+    buffer += chunk;
+    const lines = buffer.split("\n");
+    buffer = lines.pop() ?? "";
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      if (ws && ws.readyState === WebSocket.OPEN) {
+        try {
+          ws.send(trimmed);
+        } catch (sendErr) {
+          process.stderr.write(
+            `mcp-stdio-shim: ws.send failed (${sendErr.message}) — queuing message.\n`,
+          );
+          if (pendingLines.length < MAX_PENDING_LINES) {
+            pendingLines.push(trimmed);
+          }
+        }
+      } else if (pendingLines.length < MAX_PENDING_LINES) {
+        pendingLines.push(trimmed);
+      } else {
         process.stderr.write(
-          `mcp-stdio-shim: ws.send failed (${sendErr.message}) — queuing message.\n`,
+          `mcp-stdio-shim: pendingLines overflow (${MAX_PENDING_LINES}) — dropping message (bridge not connected)\n`,
         );
-        if (pendingLines.length < MAX_PENDING_LINES) {
-          pendingLines.push(trimmed);
-        }
       }
-    } else if (pendingLines.length < MAX_PENDING_LINES) {
-      pendingLines.push(trimmed);
-    } else {
-      process.stderr.write(
-        `mcp-stdio-shim: pendingLines overflow (${MAX_PENDING_LINES}) — dropping message (bridge not connected)\n`,
-      );
     }
-  }
-});
-
-process.stdin.on("end", () => {
-  if (ws) {
-    try {
-      ws.close();
-    } catch {
-      /* ignore */
-    }
-  }
-  process.exit(0);
-});
+  });
 
-process.stdin.on("error", (err) => {
-  // EPIPE / ERR_STREAM_DESTROYED means the MCP host closed the pipe — clean shutdown.
-  if (err.code === "EPIPE" || err.code === "ERR_STREAM_DESTROYED") {
-    process.stderr.write(
-      `mcp-stdio-shim: stdin closed (${err.code}) — shutting down.\n`,
-    );
+  process.stdin.on("end", () => {
     if (ws) {
       try {
         ws.close();
@@ -493,6 +610,23 @@ process.stdin.on("error", (err) => {
       }
     }
     process.exit(0);
-  }
-  process.stderr.write(`mcp-stdio-shim: stdin error: ${err.message}\n`);
-});
+  });
+
+  process.stdin.on("error", (err) => {
+    // EPIPE / ERR_STREAM_DESTROYED means the MCP host closed the pipe — clean shutdown.
+    if (err.code === "EPIPE" || err.code === "ERR_STREAM_DESTROYED") {
+      process.stderr.write(
+        `mcp-stdio-shim: stdin closed (${err.code}) — shutting down.\n`,
+      );
+      if (ws) {
+        try {
+          ws.close();
+        } catch {
+          /* ignore */
+        }
+      }
+      process.exit(0);
+    }
+    process.stderr.write(`mcp-stdio-shim: stdin error: ${err.message}\n`);
+  });
+}