pr-checkmate 3.3.0 → 4.0.1

package/dist/cjs/mcp/dependency.js

@@ -0,0 +1,413 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lookalikeOf = lookalikeOf;
+exports.checkDependency = checkDependency;
+exports.formatDependency = formatDependency;
+// cspell:ignore beautifulsoup boto colorama lodahs lxml psycopg pyyaml scikit setuptools slopsquatting sqlalchemy tqdm
+/**
+ * Should this package be added at all? — answered at the moment an agent reaches
+ * for it, not weeks later in an audit.
+ *
+ * Language models invent package names that sound right, and attackers publish
+ * those names (slopsquatting). They also reach for whatever version they remember,
+ * which is often one with a known advisory. Both mistakes are cheap to catch with
+ * two public lookups — the registry and OSV — and expensive to catch after the
+ * package is in a lockfile and installed on a developer's machine.
+ *
+ * What is sent: the package name, and the version if one was asked about. Nothing
+ * from the repository leaves the machine.
+ *
+ * The honest-failure rule: if a lookup cannot be completed the verdict is
+ * `unknown`, never `ok`. A check that passes because it could not look is the
+ * exact failure this exists to prevent.
+ */
+const http_js_1 = require("../utils/http.js");
+const live = (url, init) => (0, http_js_1.request)(url, init, { timeoutMs: 8000, retries: 2, label: 'dependency' });
+const NPM_NAME = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+const PYPI_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const VERSION = /^[0-9A-Za-z][0-9A-Za-z.+_-]*$/;
+/** Newer than this, and nobody has had time to notice if it is malicious. */
+const NEW_PACKAGE_DAYS = 30;
+/** Fewer weekly downloads than this and the package is effectively unreviewed. */
+const LOW_DOWNLOADS = 100;
+/** No release for this long: not a vulnerability, but nobody is fixing one if it appears. */
+const STALE_DAYS = 365 * 2;
+const DAY_MS = 86400000;
+/** Names an attacker would imitate. Deliberately short: the point is the near miss, not coverage. */
+const POPULAR = {
+    npm: [
+        'react',
+        'react-dom',
+        'lodash',
+        'express',
+        'axios',
+        'moment',
+        'chalk',
+        'commander',
+        'debug',
+        'typescript',
+        'webpack',
+        'eslint',
+        'prettier',
+        'jest',
+        'mocha',
+        'vue',
+        'next',
+        'jquery',
+        'underscore',
+        'request',
+        'async',
+        'bluebird',
+        'uuid',
+        'dotenv',
+        'cors',
+        'body-parser',
+        'mongoose',
+        'mysql',
+        'redis',
+        'socket.io',
+        'rxjs',
+        'zod',
+        'yargs',
+        'glob',
+        'rimraf',
+        'minimist',
+        'semver',
+        'colors',
+        'tslib',
+        'vite',
+        'babel-core',
+        'cross-env',
+        'nodemon',
+        'passport',
+        'jsonwebtoken',
+        'bcrypt',
+        'puppeteer',
+        'playwright',
+        'cheerio',
+        'ws',
+    ],
+    pypi: [
+        'requests',
+        'numpy',
+        'pandas',
+        'django',
+        'flask',
+        'urllib3',
+        'boto3',
+        'setuptools',
+        'pytest',
+        'scipy',
+        'matplotlib',
+        'pillow',
+        'sqlalchemy',
+        'beautifulsoup4',
+        'fastapi',
+        'pydantic',
+        'cryptography',
+        'pyyaml',
+        'jinja2',
+        'click',
+        'tensorflow',
+        'torch',
+        'scikit-learn',
+        'selenium',
+        'httpx',
+        'aiohttp',
+        'lxml',
+        'psycopg2',
+        'redis',
+        'celery',
+        'openai',
+        'anthropic',
+        'langchain',
+        'transformers',
+        'colorama',
+        'tqdm',
+        'rich',
+        'black',
+        'mypy',
+        'ruff',
+    ],
+};
+/**
+ * Edit distance where swapping two neighbours counts as one edit (`lodahs` is one
+ * slip from `lodash`, not two). Transpositions are the commonest typo and the
+ * commonest squat. Capped: all that is asked is "within a couple of keystrokes".
+ */
+function distance(a, b) {
+    if (Math.abs(a.length - b.length) > 2)
+        return 3;
+    const d = Array.from({ length: a.length + 1 }, (_, i) => [i]);
+    for (let j = 1; j <= b.length; j++)
+        d[0][j] = j;
+    for (let i = 1; i <= a.length; i++) {
+        for (let j = 1; j <= b.length; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            d[i][j] = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + cost);
+            if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+                d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);
+            }
+        }
+    }
+    return d[a.length][b.length];
+}
+/** The famous package `name` is suspiciously close to, if any. A name that *is* the famous one is not a match. */
+function lookalikeOf(name, ecosystem) {
+    const bare = name.replace(/^@[^/]+\//, '').toLowerCase();
+    const list = POPULAR[ecosystem];
+    if (list.includes(bare))
+        return undefined;
+    // Very short names are within two edits of everything; only compare ones long enough to mean something.
+    return bare.length < 4
+        ? undefined
+        : list.find(p => distance(bare, p) <= (bare.length >= 8 ? 2 : 1));
+}
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const daysSince = (iso) => {
+    const t = typeof iso === 'string' ? Date.parse(iso) : NaN;
+    return Number.isNaN(t) ? undefined : Math.floor((Date.now() - t) / DAY_MS);
+};
+/**
+ * Record why a registry answer cannot be used: "no such package" is fatal, an answer
+ * that is missing or unreadable only leaves the report incomplete. Returns `true`
+ * when the lookup should stop; `false` means `res.body` is a JSON object.
+ */
+function rejectRegistryAnswer(out, res, registry) {
+    if (res.status === 404) {
+        out.fatal = true;
+        out.facts.exists = false;
+        out.reasons.push(`not on ${registry} — a name that sounds right but does not exist is how hallucinated packages get squatted; do not add it`);
+        return true;
+    }
+    if (!res.ok || !isRecord(res.body)) {
+        out.incomplete = true;
+        out.reasons.push(`could not read ${registry} (${res.error ?? res.status})`);
+        return true;
+    }
+    return false;
+}
+/** Fetch a registry document: a fresh `Collected` plus the JSON object, absent when it cannot be used. */
+async function openRegistry(url, get, registry) {
+    const out = { reasons: [], facts: {}, fatal: false, incomplete: false };
+    const res = await get(url);
+    if (rejectRegistryAnswer(out, res, registry))
+        return { out };
+    return { out, doc: res.body };
+}
+async function lookupNpm(name, requested, get) {
+    const { out, doc } = await openRegistry(`https://registry.npmjs.org/${name.replace('/', '%2f')}`, get, 'the npm registry');
+    if (!doc)
+        return out;
+    const tags = isRecord(doc['dist-tags']) ? doc['dist-tags'] : {};
+    const versions = isRecord(doc.versions) ? doc.versions : {};
+    const time = isRecord(doc.time) ? doc.time : {};
+    const target = requested ?? (typeof tags.latest === 'string' ? tags.latest : undefined);
+    out.facts.exists = true;
+    if (requested && !(requested in versions)) {
+        out.fatal = true;
+        out.reasons.push(`version ${requested} was never published — the latest is ${String(tags.latest)}`);
+        return out;
+    }
+    out.version = target;
+    if (target)
+        out.facts.version = target;
+    const info = target && isRecord(versions[target]) ? versions[target] : {};
+    const scripts = isRecord(info.scripts) ? info.scripts : {};
+    if (typeof info.deprecated === 'string') {
+        out.reasons.push(`deprecated by its maintainer: ${info.deprecated.slice(0, 160)}`);
+    }
+    if (info.hasInstallScript === true ||
+        ['preinstall', 'install', 'postinstall'].some(s => s in scripts)) {
+        out.facts.installScript = true;
+        out.reasons.push('runs a script at install time — the usual route for a malicious package; read it before adding');
+    }
+    if (typeof info.license === 'string')
+        out.facts.license = info.license;
+    const age = daysSince(time.created);
+    if (age !== undefined) {
+        out.facts.ageDays = age;
+        if (age < NEW_PACKAGE_DAYS)
+            out.reasons.push(`first published ${age} day(s) ago — too new to have been reviewed by anyone`);
+    }
+    // Only the newest release can be "abandoned"; for an older pinned version the
+    // useful fact is that a newer one exists, which the caller already chose to ignore.
+    const last = daysSince(target ? time[target] : undefined);
+    if (target && target === tags.latest && last !== undefined && last > STALE_DAYS) {
+        out.reasons.push(`no release in ${Math.floor(last / 365)} years — if a flaw turns up, nobody is likely to fix it`);
+    }
+    if (requested && typeof tags.latest === 'string' && requested !== tags.latest) {
+        out.facts.latest = tags.latest;
+    }
+    const dl = await get(`https://api.npmjs.org/downloads/point/last-week/${name.replace('/', '%2f')}`);
+    if (dl.ok && isRecord(dl.body) && typeof dl.body.downloads === 'number') {
+        out.facts.weeklyDownloads = dl.body.downloads;
+        if (dl.body.downloads < LOW_DOWNLOADS) {
+            out.reasons.push(`only ${dl.body.downloads} downloads last week — effectively unreviewed`);
+        }
+    }
+    return out;
+}
+async function lookupPypi(name, requested, get) {
+    const { out, doc } = await openRegistry(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`, get, 'PyPI');
+    if (!doc)
+        return out;
+    const info = isRecord(doc.info) ? doc.info : {};
+    const releases = isRecord(doc.releases) ? doc.releases : {};
+    out.facts.exists = true;
+    if (requested && !(requested in releases)) {
+        out.fatal = true;
+        out.reasons.push(`version ${requested} was never published — the latest is ${String(info.version)}`);
+        return out;
+    }
+    const target = requested ?? (typeof info.version === 'string' ? info.version : undefined);
+    out.version = target;
+    if (target)
+        out.facts.version = target;
+    if (typeof info.license === 'string' && info.license.length < 80)
+        out.facts.license = info.license;
+    const files = target && Array.isArray(releases[target]) ? releases[target] : [];
+    if (files.length > 0 && files.every(f => isRecord(f) && f.yanked === true)) {
+        out.reasons.push('this release was yanked by its maintainer');
+    }
+    const uploads = Object.values(releases)
+        .flatMap(r => (Array.isArray(r) ? r : []))
+        .map(f => isRecord(f) ? Date.parse(String(f.upload_time_iso_8601 ?? f.upload_time ?? '')) : NaN)
+        .filter(t => !Number.isNaN(t));
+    if (uploads.length > 0) {
+        const age = Math.floor((Date.now() - Math.min(...uploads)) / DAY_MS);
+        out.facts.ageDays = age;
+        if (age < NEW_PACKAGE_DAYS)
+            out.reasons.push(`first published ${age} day(s) ago — too new to have been reviewed by anyone`);
+    }
+    return out;
+}
+/** Advisories for one exact version, from OSV. Severity is taken from the advisory when it states one. */
+async function lookupAdvisories(name, version, ecosystem, get) {
+    const res = await get('https://api.osv.dev/v1/query', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            package: { name, ecosystem: ecosystem === 'npm' ? 'npm' : 'PyPI' },
+            version,
+        }),
+    });
+    if (!res.ok) {
+        return {
+            reasons: [`could not check advisories (${res.error ?? res.status})`],
+            fatal: false,
+            incomplete: true,
+            count: 0,
+        };
+    }
+    const vulns = isRecord(res.body) && Array.isArray(res.body.vulns) ? res.body.vulns : [];
+    if (vulns.length === 0)
+        return { reasons: [], fatal: false, incomplete: false, count: 0 };
+    const severities = vulns.map(v => {
+        const db = isRecord(v) && isRecord(v.database_specific) ? v.database_specific : {};
+        return typeof db.severity === 'string' ? db.severity.toUpperCase() : 'UNKNOWN';
+    });
+    const serious = severities.filter(s => s === 'CRITICAL' || s === 'HIGH').length;
+    // OSV files known malicious packages under `MAL-` ids. These are not "a bug with a
+    // fix": the package is the attack, and no version of it is safe to add.
+    const malware = vulns.filter(v => isRecord(v) && String(v.id).startsWith('MAL-')).length;
+    const ids = vulns
+        .slice(0, 4)
+        .map(v => (isRecord(v) ? String(v.id) : '?'))
+        .join(', ');
+    if (malware > 0) {
+        return {
+            reasons: [
+                `flagged as MALWARE in the advisory database (${ids}) — this package is the attack; do not add it`,
+            ],
+            fatal: true,
+            incomplete: false,
+            count: vulns.length,
+        };
+    }
+    return {
+        reasons: [
+            `${vulns.length} known advisor${vulns.length === 1 ? 'y' : 'ies'} for ${version}${serious ? ` (${serious} high or critical)` : ''}: ${ids}${vulns.length > 4 ? ', …' : ''}`,
+        ],
+        fatal: serious > 0,
+        incomplete: false,
+        count: vulns.length,
+    };
+}
+/** Is `name` safe to add? Never throws: every failure becomes part of the verdict. */
+async function checkDependency(name, opts = {}) {
+    const ecosystem = opts.ecosystem ?? 'npm';
+    const get = opts.fetchJson ?? live;
+    const base = { name, ecosystem, ...(opts.version && { version: opts.version }) };
+    // Names go into URLs, so a name that is not a valid package name is refused, not escaped and hoped for.
+    const validName = ecosystem === 'npm' ? NPM_NAME.test(name) && name.length <= 214 : PYPI_NAME.test(name);
+    if (!validName) {
+        return {
+            ...base,
+            verdict: 'avoid',
+            reasons: [`"${name}" is not a valid ${ecosystem} package name`],
+            facts: {},
+        };
+    }
+    if (opts.version && !VERSION.test(opts.version)) {
+        return {
+            ...base,
+            verdict: 'avoid',
+            reasons: [`"${opts.version}" is not a valid version`],
+            facts: {},
+        };
+    }
+    const found = await (ecosystem === 'npm' ? lookupNpm : lookupPypi)(name, opts.version, get);
+    const reasons = [...found.reasons];
+    let fatal = found.fatal;
+    let incomplete = found.incomplete;
+    const twin = lookalikeOf(name, ecosystem);
+    if (twin)
+        reasons.push(`name is one edit away from the popular "${twin}" — check it is not a typo or an impersonation`);
+    if (!fatal && !incomplete && found.version) {
+        const adv = await lookupAdvisories(name, found.version, ecosystem, get);
+        reasons.push(...adv.reasons);
+        fatal || (fatal = adv.fatal);
+        incomplete || (incomplete = adv.incomplete);
+        found.facts.advisories = adv.count;
+    }
+    const verdict = fatal
+        ? 'avoid'
+        : incomplete
+            ? 'unknown'
+            : reasons.length > 0
+                ? 'review'
+                : 'ok';
+    return {
+        ...base,
+        ...(found.version && { version: found.version }),
+        verdict,
+        reasons,
+        facts: found.facts,
+    };
+}
+const LABEL = {
+    avoid: '❌ AVOID',
+    review: '⚠️ REVIEW',
+    ok: '✅ OK',
+    unknown: '❔ UNKNOWN',
+};
+/** The report as the text an agent reads. */
+function formatDependency(r) {
+    const head = `${LABEL[r.verdict]} — ${r.name}${r.version ? `@${r.version}` : ''} (${r.ecosystem})`;
+    const facts = Object.entries(r.facts)
+        .map(([k, v]) => `${k}=${String(v)}`)
+        .join(', ');
+    const advice = {
+        avoid: 'Do not add this dependency. Use an existing one, write the code, or ask the user.',
+        review: 'Tell the user about these points before adding it, or pick an alternative.',
+        ok: 'Nothing found. Pin the version you add.',
+        unknown: 'Nothing could be established. Do not treat this as safe; ask the user or retry.',
+    };
+    return [
+        head,
+        ...r.reasons.map(x => `- ${x}`),
+        ...(facts ? [`facts: ${facts}`] : []),
+        advice[r.verdict],
+    ].join('\n');
+}

package/dist/cjs/mcp/protocol.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The Model Context Protocol, reduced to what a read-only checking server needs.
+ *
+ * Written by hand instead of pulling in the official SDK, on purpose. This is a
+ * security tool installed globally with the user's own rights; the SDK brings an
+ * HTTP framework and a schema library along, none of which a stdio server uses.
+ * The surface here is JSON-RPC 2.0 over newline-delimited stdio plus five methods,
+ * which is small enough to read in one sitting — and `tests/mcp/protocol.test.ts`
+ * pins every one of them.
+ *
+ * Kept free of I/O so it can be tested by feeding it objects: `serve.ts` owns the
+ * streams, this file owns what a message means.
+ */
+/** Revisions we can speak, newest first. A client asking for another gets the newest. */
+export declare const SUPPORTED_PROTOCOLS: readonly string[];
+type JsonRpcId = string | number | null;
+interface JsonRpcResponse {
+    jsonrpc: '2.0';
+    id: JsonRpcId;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+    };
+}
+export declare const ERR: {
+    readonly parse: -32700;
+    readonly invalidRequest: -32600;
+    readonly methodNotFound: -32601;
+    readonly invalidParams: -32602;
+    readonly internal: -32603;
+};
+/** What a tool hands back; mirrored to the client as `content` plus `structuredContent`. */
+export interface ToolResult {
+    text: string;
+    structured?: Record<string, unknown>;
+    /** The tool ran and reported a problem with its input or environment, not a finding. */
+    isError?: boolean;
+}
+export interface ToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    /** The tool changes files. Everything else is advertised as read-only. */
+    writes?: boolean;
+    /** The tool talks to services outside the machine (package registries, advisories). */
+    network?: boolean;
+    run(args: Record<string, unknown>): Promise<ToolResult>;
+}
+export interface ResourceDefinition {
+    uri: string;
+    name: string;
+    description: string;
+    mimeType: string;
+    read(): Promise<string>;
+}
+/** A ready-made request the client offers the user (a slash command in Claude Code). */
+export interface PromptDefinition {
+    name: string;
+    description: string;
+    arguments?: Array<{
+        name: string;
+        description: string;
+        required?: boolean;
+    }>;
+    /** The text the agent is asked to act on, with the arguments filled in. */
+    render(args: Record<string, string>): string;
+}
+export interface ServerDefinition {
+    name: string;
+    version: string;
+    /** Shown to the model on connect — the place to say *when* to call the tools. */
+    instructions: string;
+    tools: ToolDefinition[];
+    resources: ResourceDefinition[];
+    prompts?: PromptDefinition[];
+}
+/**
+ * Pick the protocol revision for a session: the client's own if we speak it,
+ * otherwise our newest, which the client may then accept or hang up on.
+ */
+export declare function negotiateProtocol(requested: unknown): string;
+/**
+ * Answer one decoded message. Returns `null` for notifications, which by the
+ * JSON-RPC rules must not be answered — replying to `notifications/initialized`
+ * is a protocol violation some clients treat as fatal.
+ */
+export declare function handleMessage(server: ServerDefinition, message: unknown): Promise<JsonRpcResponse | null>;
+/** Decode one stdio line. A line that is not JSON gets a parse error, never a crash. */
+export declare function handleLine(server: ServerDefinition, line: string): Promise<JsonRpcResponse | null>;
+export {};

package/dist/cjs/mcp/protocol.js

@@ -0,0 +1,181 @@
+"use strict";
+/**
+ * The Model Context Protocol, reduced to what a read-only checking server needs.
+ *
+ * Written by hand instead of pulling in the official SDK, on purpose. This is a
+ * security tool installed globally with the user's own rights; the SDK brings an
+ * HTTP framework and a schema library along, none of which a stdio server uses.
+ * The surface here is JSON-RPC 2.0 over newline-delimited stdio plus five methods,
+ * which is small enough to read in one sitting — and `tests/mcp/protocol.test.ts`
+ * pins every one of them.
+ *
+ * Kept free of I/O so it can be tested by feeding it objects: `serve.ts` owns the
+ * streams, this file owns what a message means.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ERR = exports.SUPPORTED_PROTOCOLS = void 0;
+exports.negotiateProtocol = negotiateProtocol;
+exports.handleMessage = handleMessage;
+exports.handleLine = handleLine;
+/** Revisions we can speak, newest first. A client asking for another gets the newest. */
+exports.SUPPORTED_PROTOCOLS = ['2025-06-18', '2025-03-26', '2024-11-05'];
+exports.ERR = {
+    parse: -32700,
+    invalidRequest: -32600,
+    methodNotFound: -32601,
+    invalidParams: -32602,
+    internal: -32603,
+};
+function reply(id, result) {
+    return { jsonrpc: '2.0', id, result };
+}
+function failure(id, code, message) {
+    return { jsonrpc: '2.0', id, error: { code, message } };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Pick the protocol revision for a session: the client's own if we speak it,
+ * otherwise our newest, which the client may then accept or hang up on.
+ */
+function negotiateProtocol(requested) {
+    return typeof requested === 'string' && exports.SUPPORTED_PROTOCOLS.includes(requested)
+        ? requested
+        : exports.SUPPORTED_PROTOCOLS[0];
+}
+async function callTool(server, id, params) {
+    const tool = server.tools.find(t => t.name === params.name);
+    if (!tool)
+        return failure(id, exports.ERR.invalidParams, `Unknown tool: ${String(params.name)}`);
+    const args = isRecord(params.arguments) ? params.arguments : {};
+    try {
+        const out = await tool.run(args);
+        return reply(id, {
+            content: [{ type: 'text', text: out.text }],
+            ...(out.structured && { structuredContent: out.structured }),
+            ...(out.isError && { isError: true }),
+        });
+    }
+    catch (err) {
+        // A tool that throws is a tool-level failure the model can read and react to,
+        // not a protocol error that would end the turn with an opaque message.
+        const message = err instanceof Error ? err.message : String(err);
+        return reply(id, {
+            content: [{ type: 'text', text: `${tool.name} failed: ${message}` }],
+            isError: true,
+        });
+    }
+}
+async function readResource(server, id, params) {
+    const resource = server.resources.find(r => r.uri === params.uri);
+    if (!resource)
+        return failure(id, exports.ERR.invalidParams, `Unknown resource: ${String(params.uri)}`);
+    return reply(id, {
+        contents: [{ uri: resource.uri, mimeType: resource.mimeType, text: await resource.read() }],
+    });
+}
+function getPrompt(server, id, params) {
+    const prompt = (server.prompts ?? []).find(p => p.name === params.name);
+    if (!prompt)
+        return failure(id, exports.ERR.invalidParams, `Unknown prompt: ${String(params.name)}`);
+    const given = isRecord(params.arguments) ? params.arguments : {};
+    const args = {};
+    for (const [key, value] of Object.entries(given))
+        args[key] = String(value);
+    const missing = (prompt.arguments ?? [])
+        .filter(a => a.required && !args[a.name])
+        .map(a => a.name);
+    if (missing.length > 0) {
+        return failure(id, exports.ERR.invalidParams, `Missing argument(s): ${missing.join(', ')}`);
+    }
+    return reply(id, {
+        description: prompt.description,
+        messages: [{ role: 'user', content: { type: 'text', text: prompt.render(args) } }],
+    });
+}
+/**
+ * Answer one decoded message. Returns `null` for notifications, which by the
+ * JSON-RPC rules must not be answered — replying to `notifications/initialized`
+ * is a protocol violation some clients treat as fatal.
+ */
+async function handleMessage(server, message) {
+    if (!isRecord(message) || message.jsonrpc !== '2.0' || typeof message.method !== 'string') {
+        return failure(null, exports.ERR.invalidRequest, 'Not a JSON-RPC 2.0 request');
+    }
+    const request = message;
+    const isNotification = request.id === undefined;
+    const id = request.id ?? null;
+    const params = isRecord(request.params) ? request.params : {};
+    if (isNotification)
+        return null;
+    switch (request.method) {
+        case 'initialize':
+            return reply(id, {
+                protocolVersion: negotiateProtocol(params.protocolVersion),
+                capabilities: { tools: {}, resources: {}, prompts: {} },
+                serverInfo: { name: server.name, version: server.version },
+                instructions: server.instructions,
+            });
+        case 'ping':
+            return reply(id, {});
+        case 'tools/list':
+            return reply(id, {
+                tools: server.tools.map(({ name, description, inputSchema, writes, network }) => ({
+                    name,
+                    description,
+                    inputSchema,
+                    // Said explicitly so a client can approve the harmless calls without
+                    // asking every time, and still ask for the one that edits files or the
+                    // one that reaches the network.
+                    annotations: {
+                        readOnlyHint: writes !== true,
+                        destructiveHint: false,
+                        openWorldHint: network === true,
+                    },
+                })),
+            });
+        case 'tools/call':
+            return callTool(server, id, params);
+        case 'resources/list':
+            return reply(id, {
+                resources: server.resources.map(({ uri, name, description, mimeType }) => ({
+                    uri,
+                    name,
+                    description,
+                    mimeType,
+                })),
+            });
+        case 'resources/read':
+            return readResource(server, id, params);
+        case 'prompts/list':
+            return reply(id, {
+                prompts: (server.prompts ?? []).map(({ name, description, arguments: args }) => ({
+                    name,
+                    description,
+                    ...(args && { arguments: args }),
+                })),
+            });
+        case 'prompts/get':
+            return getPrompt(server, id, params);
+        default:
+            return failure(id, exports.ERR.methodNotFound, `Method not found: ${request.method}`);
+    }
+}
+/** Decode one stdio line. A line that is not JSON gets a parse error, never a crash. */
+async function handleLine(server, line) {
+    let message;
+    try {
+        message = JSON.parse(line);
+    }
+    catch {
+        return failure(null, exports.ERR.parse, 'Parse error');
+    }
+    try {
+        return await handleMessage(server, message);
+    }
+    catch (err) {
+        const id = isRecord(message) && message.id !== undefined ? message.id : null;
+        return failure(id, exports.ERR.internal, err instanceof Error ? err.message : String(err));
+    }
+}