remote-access-mcp 1.0.0

package/dist/core/config.js

@@ -0,0 +1,57 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import crypto from 'node:crypto';
+const CONFIG_DIR = path.join(os.homedir(), '.config', 'remote-access-mcp');
+const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
+export function configDir() {
+    return CONFIG_DIR;
+}
+export function configPath() {
+    return CONFIG_FILE;
+}
+function resolveEnvFile() {
+    // Back-compat: Dana-style .env next to cwd — only read explicitly, never write.
+    const legacy = path.join(process.cwd(), '.env');
+    if (fs.existsSync(legacy))
+        return legacy;
+    return '';
+}
+export function loadConfig() {
+    let cfg = {};
+    if (fs.existsSync(CONFIG_FILE)) {
+        cfg = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8'));
+    }
+    // Environment overrides (RAMCP_* / legacy DANA_* for parity with the old gateway)
+    const env = process.env;
+    const envToken = env.RAMCP_TOKEN || env.DANA_AUTH_TOKEN;
+    const envHost = env.RAMCP_HOST || env.DANA_HOST;
+    const envPort = env.RAMCP_PORT || env.DANA_PORT;
+    const envPublic = env.RAMCP_PUBLIC_HOST || env.DANA_PUBLIC_HOST;
+    const resolved = {
+        token: envToken || cfg.token || '',
+        host: envHost || cfg.host || '127.0.0.1',
+        port: envPort ? parseInt(envPort, 10) : (cfg.port || 8765),
+        public_host: envPublic || cfg.public_host || '',
+        mcp_path: cfg.mcp_path || '/mcp',
+        shell_enabled: cfg.shell_enabled ?? false,
+        allowed_paths: cfg.allowed_paths || [],
+        denied_paths: cfg.denied_paths || [],
+    };
+    return resolved;
+}
+export function saveConfig(cfg) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    fs.writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2) + '\n', { mode: 0o600 });
+}
+export function generateToken() {
+    return crypto.randomBytes(36).toString('base64url');
+}
+export function requireToken(cfg) {
+    if (!cfg.token) {
+        console.error('No token configured. Run `ramcp init` first.');
+        process.exit(1);
+    }
+    return cfg.token;
+}
+//# sourceMappingURL=config.js.map

package/dist/core/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,MAAM,MAAM,aAAa,CAAC;AAajC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAEzD,MAAM,UAAU,SAAS;IACvB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,cAAc;IACrB,gFAAgF;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,IAAI,GAAG,GAAyB,EAAE,CAAC;IACnC,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,kFAAkF;IAClF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,eAAe,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;IAChD,MAAM,SAAS,GAAG,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,gBAAgB,CAAC;IAEhE,MAAM,QAAQ,GAAgB;QAC5B,KAAK,EAAE,QAAQ,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,WAAW;QACxC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;QAC1D,WAAW,EAAE,SAAS,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE;QAC/C,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,MAAM;QAChC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,KAAK;QACzC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE;QACtC,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE;KACrC,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAgB;IACzC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAgB;IAC3C,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC;AACnB,CAAC"}

package/dist/core/policy.d.ts

@@ -0,0 +1,22 @@
+export interface PolicyConfig {
+    allowed_paths: string[];
+    denied_paths: string[];
+    shell_enabled: boolean;
+}
+/** Thrown by tools when a target path is outside the policy sandbox. */
+export declare class PolicyError extends Error {
+    readonly target: string;
+    constructor(target: string);
+}
+/**
+ * Resolve a path the way the tools will actually touch it:
+ * absolute, symlink-free where possible, `..` collapsed.
+ * For not-yet-existing targets (write case), the deepest existing ancestor
+ * is resolved and the remainder re-attached — symlinked parents still collapse.
+ */
+export declare function resolveReal(p: string): string;
+export declare function isPathAllowed(policy: PolicyConfig, p: string): boolean;
+/** Policy gate for filesystem tools — throws PolicyError when refused. */
+export declare function assertAllowed(policy: PolicyConfig, p: string): void;
+export declare function shellAllowed(policy: PolicyConfig): boolean;
+//# sourceMappingURL=policy.d.ts.map

package/dist/core/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/core/policy.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,wEAAwE;AACxE,qBAAa,WAAY,SAAQ,KAAK;aACR,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAI3C;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAiB7C;AAQD,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAUtE;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAEnE;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAE1D"}

package/dist/core/policy.js

@@ -0,0 +1,66 @@
+import fs from 'node:fs';
+import path from 'node:path';
+/** Thrown by tools when a target path is outside the policy sandbox. */
+export class PolicyError extends Error {
+    target;
+    constructor(target) {
+        super(`Access to ${target} is not allowed by the path policy`);
+        this.target = target;
+        this.name = 'PolicyError';
+    }
+}
+/**
+ * Resolve a path the way the tools will actually touch it:
+ * absolute, symlink-free where possible, `..` collapsed.
+ * For not-yet-existing targets (write case), the deepest existing ancestor
+ * is resolved and the remainder re-attached — symlinked parents still collapse.
+ */
+export function resolveReal(p) {
+    const abs = path.resolve(p);
+    try {
+        return fs.realpathSync(abs);
+    }
+    catch {
+        let dir = abs;
+        const parts = [];
+        while (dir !== '/' && !fs.existsSync(dir)) {
+            parts.unshift(path.basename(dir));
+            dir = path.dirname(dir);
+        }
+        try {
+            return path.join(fs.realpathSync(dir), ...parts);
+        }
+        catch {
+            return abs;
+        }
+    }
+}
+function isWithin(child, ancestor) {
+    if (child === ancestor)
+        return true;
+    const a = ancestor.endsWith('/') ? ancestor : ancestor + '/';
+    return child.startsWith(a);
+}
+export function isPathAllowed(policy, p) {
+    const real = resolveReal(p);
+    for (const deny of policy.denied_paths) {
+        if (isWithin(real, resolveReal(deny)))
+            return false;
+    }
+    if (policy.allowed_paths.length === 0)
+        return false;
+    for (const allow of policy.allowed_paths) {
+        if (isWithin(real, resolveReal(allow)))
+            return true;
+    }
+    return false;
+}
+/** Policy gate for filesystem tools — throws PolicyError when refused. */
+export function assertAllowed(policy, p) {
+    if (!isPathAllowed(policy, p))
+        throw new PolicyError(p);
+}
+export function shellAllowed(policy) {
+    return policy.shell_enabled;
+}
+//# sourceMappingURL=policy.js.map

package/dist/core/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/core/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,wEAAwE;AACxE,MAAM,OAAO,WAAY,SAAQ,KAAK;IACR;IAA5B,YAA4B,MAAc;QACxC,KAAK,CAAC,aAAa,MAAM,oCAAoC,CAAC,CAAC;QADrC,WAAM,GAAN,MAAM,CAAQ;QAExC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,GAAG,GAAG,CAAC;QACd,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAClC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,QAAgB;IAC/C,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC;IAC7D,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,CAAS;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,CAAS;IAC3D,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,OAAO,MAAM,CAAC,aAAa,CAAC;AAC9B,CAAC"}

package/dist/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":""}

package/dist/main.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { main } from './cli/main.js';
+main(process.argv.slice(2)).catch((e) => {
+    console.error(e);
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACtC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/server/app.d.ts

@@ -0,0 +1,7 @@
+import express from 'express';
+import { type RamcpConfig } from '../core/config.js';
+export declare function buildApp(): {
+    app: express.Express;
+    cfg: RamcpConfig;
+};
+//# sourceMappingURL=app.d.ts.map

package/dist/server/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/server/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAA2D,MAAM,SAAS,CAAC;AAIlF,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIjE,wBAAgB,QAAQ,IAAI;IAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CA4FrE"}

package/dist/server/app.js

@@ -0,0 +1,95 @@
+import express from 'express';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { loadConfig } from '../core/config.js';
+import { registerAllTools } from '../tools/index.js';
+export function buildApp() {
+    const cfg = loadConfig();
+    const policy = {
+        allowed_paths: cfg.allowed_paths,
+        denied_paths: cfg.denied_paths,
+        shell_enabled: cfg.shell_enabled,
+    };
+    const app = express();
+    // JSON bodies only. The MCP transport accepts a pre-parsed object —
+    // raw Buffers confuse it (it treats the Buffer itself as the message).
+    app.use(express.json({ limit: '64mb' }));
+    // ---- helpers --------------------------------------------------------------
+    function unauthorized(res, msg = 'Unauthorized') {
+        res.status(401).json({ error: msg });
+    }
+    function tokenFromAuthHeader(req) {
+        const h = req.headers.authorization;
+        if (!h)
+            return null;
+        const m = /^Bearer\s+(.+)$/i.exec(h);
+        return m ? m[1] : null;
+    }
+    // ---- health ----------------------------------------------------------------
+    app.get('/health', (_req, res) => {
+        res.json({ status: 'ok', service: 'remote-access-mcp', version: '1.0.0' });
+    });
+    // ---- connector -----------------------------------------------------------------
+    app.get('/connector', (req, res) => {
+        const token = tokenFromAuthHeader(req);
+        if (!token || token !== cfg.token)
+            return unauthorized(res);
+        const host = cfg.public_host || `127.0.0.1:${cfg.port}`;
+        const scheme = cfg.public_host ? 'https' : 'http';
+        res.json({
+            title: 'Chatbot Connection Link',
+            url: `${scheme}://${host}/${cfg.token}${cfg.mcp_path}`,
+        });
+    });
+    // ---- MCP handler (shared by both routes) ------------------------------------------
+    async function handleMcp(req, res) {
+        // Fresh server per request (stateless). Tools re-registered each time —
+        // policy mutation via tools takes effect on the very next request.
+        const server = new McpServer({ name: 'remote-access-mcp', version: '1.0.0' }, { capabilities: { tools: {} } });
+        registerAllTools(server, cfg, policy, () => { });
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: undefined, // stateless
+            enableJsonResponse: true,
+        });
+        res.on('close', () => {
+            transport.close().catch(() => { });
+            server.close().catch(() => { });
+        });
+        await server.connect(transport);
+        await transport.handleRequest(req, res, req.body);
+    }
+    // ---- canonical route: /mcp (Authorization header) ------------------------------------
+    app.all('/mcp', async (req, res, next) => {
+        try {
+            const token = tokenFromAuthHeader(req);
+            if (!token || token !== cfg.token)
+                return unauthorized(res);
+            await handleMcp(req, res);
+        }
+        catch (e) {
+            next(e);
+        }
+    });
+    // ---- token-in-path route: /<token>/mcp (ChatGPT-style) ----------------------------------
+    app.all('/:token/mcp', async (req, res, next) => {
+        try {
+            if (req.params.token !== cfg.token)
+                return unauthorized(res);
+            await handleMcp(req, res);
+        }
+        catch (e) {
+            next(e);
+        }
+    });
+    // ---- 404 + error -------------------------------------------------------------------
+    app.use((req, res) => {
+        res.status(404).json({ error: 'Not Found' });
+    });
+    app.use((err, _req, res, _next) => {
+        console.error('[gateway]', err);
+        if (!res.headersSent)
+            res.status(500).json({ error: 'Internal Server Error' });
+    });
+    return { app, cfg };
+}
+//# sourceMappingURL=app.js.map

package/dist/server/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/server/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAA2D,MAAM,SAAS,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,UAAU,EAAoB,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGrD,MAAM,UAAU,QAAQ;IACtB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,MAAM,GAAiB;QAC3B,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC;IAEF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,oEAAoE;IACpE,uEAAuE;IACvE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,8EAA8E;IAC9E,SAAS,YAAY,CAAC,GAAa,EAAE,GAAG,GAAG,cAAc;QACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,mBAAmB,CAAC,GAAY;QACvC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACpC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,+EAA+E;IAC/E,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,IAAI,aAAa,GAAG,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,yBAAyB;YAChC,GAAG,EAAE,GAAG,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE;SACvD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,KAAK,UAAU,SAAS,CAAC,GAAY,EAAE,GAAa;QAClD,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,EAC/C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QACF,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAA2C,CAAC,CAAC,CAAC;QAEzF,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS,EAAE,YAAY;YAC3C,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,yFAAyF;IACzF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,uFAAuF;IACvF,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,CAAC,GAAU,EAAE,IAAa,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QACxE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC"}

package/dist/server/run.d.ts

@@ -0,0 +1,2 @@
+export declare function runServer(): Promise<void>;
+//# sourceMappingURL=run.d.ts.map

package/dist/server/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/server/run.ts"],"names":[],"mappings":"AAIA,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAuB/C"}

package/dist/server/run.js

@@ -0,0 +1,25 @@
+import { createServer } from 'node:http';
+import { loadConfig, requireToken } from '../core/config.js';
+import { buildApp } from './app.js';
+export async function runServer() {
+    const cfg = loadConfig();
+    requireToken(cfg);
+    const { app } = buildApp();
+    const httpServer = createServer(app);
+    httpServer.listen(cfg.port, cfg.host, () => {
+        const publicUrl = cfg.public_host
+            ? `https://${cfg.public_host}${cfg.mcp_path}`
+            : `http://${cfg.host}:${cfg.port}${cfg.mcp_path}`;
+        console.log(`remote-access-mcp listening on ${cfg.host}:${cfg.port}`);
+        console.log(`endpoint:  ${publicUrl}`);
+        console.log(`stateless MCP over streamable HTTP — token auth required`);
+    });
+    const shutdown = () => {
+        console.log('\nshutting down...');
+        httpServer.close(() => process.exit(0));
+        setTimeout(() => process.exit(0), 3000).unref();
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+}
+//# sourceMappingURL=run.js.map

package/dist/server/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/server/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,YAAY,CAAC,GAAG,CAAC,CAAC;IAElB,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAErC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE;QACzC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW;YAC/B,CAAC,CAAC,WAAW,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,QAAQ,EAAE;YAC7C,CAAC,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,kCAAkC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,cAAc,SAAS,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC"}

package/dist/tools/filesystem.d.ts

@@ -0,0 +1,5 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { PolicyConfig, PolicyError } from '../core/policy.js';
+export declare function registerFilesystemTools(server: McpServer, policy: PolicyConfig): void;
+export { PolicyError };
+//# sourceMappingURL=filesystem.d.ts.map

package/dist/tools/filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../src/tools/filesystem.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAiB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAkJrF;AAGD,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/tools/filesystem.js

@@ -0,0 +1,155 @@
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { z } from 'zod';
+import { assertAllowed, PolicyError } from '../core/policy.js';
+export function registerFilesystemTools(server, policy) {
+    // ---- list_directory ---------------------------------------------------
+    server.registerTool('list_directory', {
+        description: 'List a directory. Policy-checked.',
+        inputSchema: { path: z.string().describe('Directory path') },
+    }, async ({ path: dir }) => {
+        assertAllowed(policy, dir);
+        const entries = await fsp.readdir(dir, { withFileTypes: true });
+        const lines = entries.map(e => {
+            const suffix = e.isDirectory() ? '/' : e.isSymbolicLink() ? '@' : '';
+            return `${e.name}${suffix}`;
+        });
+        return { content: [{ type: 'text', text: lines.length ? lines.join('\n') : '(empty)' }] };
+    });
+    // ---- read_file ---------------------------------------------------------
+    server.registerTool('read_file', {
+        description: 'Read a UTF-8 text file. Policy-checked.',
+        inputSchema: { path: z.string().describe('File path') },
+    }, async ({ path: file }) => {
+        assertAllowed(policy, file);
+        const data = await fsp.readFile(file, 'utf8');
+        return { content: [{ type: 'text', text: data }] };
+    });
+    // ---- write_file --------------------------------------------------------
+    server.registerTool('write_file', {
+        description: 'Create or overwrite a file with UTF-8 text content. Policy-checked.',
+        inputSchema: {
+            path: z.string().describe('File path'),
+            content: z.string().describe('Full file content'),
+        },
+    }, async ({ path: file, content }) => {
+        assertAllowed(policy, file);
+        await fsp.mkdir(path.dirname(file), { recursive: true });
+        await fsp.writeFile(file, content, 'utf8');
+        return { content: [{ type: 'text', text: `Wrote ${Buffer.byteLength(content)} bytes to ${file}` }] };
+    });
+    // ---- edit_file ---------------------------------------------------------
+    server.registerTool('edit_file', {
+        description: 'Replace exact text inside a file. Policy-checked.',
+        inputSchema: {
+            path: z.string().describe('File path'),
+            old_text: z.string().describe('Exact text to find'),
+            new_text: z.string().describe('Replacement text'),
+            all: z.boolean().optional().default(false).describe('Replace every occurrence'),
+        },
+    }, async ({ path: file, old_text, new_text, all }) => {
+        assertAllowed(policy, file);
+        const data = await fsp.readFile(file, 'utf8');
+        if (!data.includes(old_text)) {
+            return { content: [{ type: 'text', text: `old_text not found in ${file}` }], isError: true };
+        }
+        const updated = all ? data.split(old_text).join(new_text) : data.replace(old_text, new_text);
+        await fsp.writeFile(file, updated, 'utf8');
+        return { content: [{ type: 'text', text: `Edited ${file}` }] };
+    });
+    // ---- delete_path -------------------------------------------------------
+    server.registerTool('delete_path', {
+        description: 'Delete a file or a directory tree. Policy-checked. Destructive.',
+        inputSchema: { path: z.string().describe('Path to delete') },
+    }, async ({ path: target }) => {
+        assertAllowed(policy, target);
+        const st = fs.lstatSync(target);
+        if (st.isDirectory()) {
+            await fsp.rm(target, { recursive: true });
+        }
+        else {
+            await fsp.unlink(target);
+        }
+        return { content: [{ type: 'text', text: `Deleted ${target}` }] };
+    });
+    // ---- search_code --------------------------------------------------------
+    server.registerTool('search_code', {
+        description: 'Recursive regex search under a directory. Policy-checked. Returns file:line:match.',
+        inputSchema: {
+            path: z.string().describe('Directory to search'),
+            pattern: z.string().describe('JavaScript regex, e.g. "TODO|FIXME"'),
+            include: z.string().optional().describe('Glob filter for file names, e.g. "*.ts"'),
+            max_results: z.number().optional().default(100).describe('Cap on matches'),
+        },
+    }, async ({ path: dir, pattern, include, max_results }) => {
+        assertAllowed(policy, dir);
+        const re = new RegExp(pattern);
+        const results = [];
+        const walk = async (d) => {
+            if (results.length >= max_results)
+                return;
+            let entries;
+            try {
+                entries = await fsp.readdir(d, { withFileTypes: true });
+            }
+            catch {
+                return;
+            }
+            for (const e of entries) {
+                if (results.length >= max_results)
+                    return;
+                if (e.name === '.git' || e.name === 'node_modules')
+                    continue;
+                const full = path.join(d, e.name);
+                if (e.isDirectory()) {
+                    await walk(full);
+                    continue;
+                }
+                if (!e.isFile())
+                    continue;
+                if (include) {
+                    try {
+                        if (!new RegExp(include.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*')).test(e.name))
+                            continue;
+                    }
+                    catch { /* bad glob → no filter */ }
+                }
+                let content;
+                try {
+                    content = await fsp.readFile(full, 'utf8');
+                }
+                catch {
+                    continue;
+                }
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length && results.length < max_results; i++) {
+                    if (re.test(lines[i]))
+                        results.push(`${full}:${i + 1}:${lines[i].trim().slice(0, 200)}`);
+                }
+            }
+        };
+        await walk(dir);
+        return { content: [{ type: 'text', text: results.length ? results.join('\n') : 'No matches' }] };
+    });
+    // ---- file_info -----------------------------------------------------------
+    server.registerTool('file_info', {
+        description: 'Stat a file or directory: size, timestamps, permissions, owner. Policy-checked.',
+        inputSchema: { path: z.string().describe('Path') },
+    }, async ({ path: target }) => {
+        assertAllowed(policy, target);
+        const st = await fsp.stat(target);
+        const out = [
+            `path: ${target}`,
+            `type: ${st.isDirectory() ? 'directory' : 'file'}`,
+            `size: ${st.size}`,
+            `mode: ${(st.mode & 0o777).toString(8)}`,
+            `mtime: ${st.mtime.toISOString()}`,
+            `atime: ${st.atime.toISOString()}`,
+        ].join('\n');
+        return { content: [{ type: 'text', text: out }] };
+    });
+}
+// Re-export so tool modules share the same error surface.
+export { PolicyError };
+//# sourceMappingURL=filesystem.js.map

package/dist/tools/filesystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.js","sourceRoot":"","sources":["../../src/tools/filesystem.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAgB,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE7E,MAAM,UAAU,uBAAuB,CAAC,MAAiB,EAAE,MAAoB;IAC7E,0EAA0E;IAC1E,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAClC;QACE,WAAW,EAAE,mCAAmC;QAChD,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;KAC7D,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;QACtB,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEL,2EAA2E;IAC3E,MAAM,CAAC,YAAY,CAAC,WAAW,EAC7B;QACE,WAAW,EAAE,yCAAyC;QACtD,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;KACxD,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;QACvB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEL,2EAA2E;IAC3E,MAAM,CAAC,YAAY,CAAC,YAAY,EAC9B;QACE,WAAW,EAAE,qEAAqE;QAClF,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;SAClD;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAChC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;IACvG,CAAC,CAAC,CAAC;IAEL,2EAA2E;IAC3E,MAAM,CAAC,YAAY,CAAC,WAAW,EAC7B;QACE,WAAW,EAAE,mDAAmD;QAChE,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACnD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACjD,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;SAChF;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE;QAChD,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAI,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC/F,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7F,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;IAEL,2EAA2E;IAC3E,MAAM,CAAC,YAAY,CAAC,aAAa,EAC/B;QACE,WAAW,EAAE,iEAAiE;QAC9E,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;KAC7D,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QACzB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,MAAM,CAAC,YAAY,CAAC,aAAa,EAC/B;QACE,WAAW,EAAE,oFAAoF;QACjG,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YACnE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YAClF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;SAC3E;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE;QACrD,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,EAAE,CAAS,EAAiB,EAAE;YAC9C,IAAI,OAAO,CAAC,MAAM,IAAI,WAAW;gBAAE,OAAO;YAC1C,IAAI,OAAoB,CAAC;YACzB,IAAI,CAAC;gBAAC,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAChE,MAAM,CAAC;gBAAC,OAAO;YAAC,CAAC;YACjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO,CAAC,MAAM,IAAI,WAAW;oBAAE,OAAO;gBAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;oBAAE,SAAS;gBAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACpD,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;oBAAE,SAAS;gBAC1B,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC;wBAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;4BAAE,SAAS;oBAAC,CAAC;oBAClH,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACtC,CAAC;gBACD,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBAAC,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAAC,CAAC;gBACnD,MAAM,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACnB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtE,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3F,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;IACnG,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAC7E,MAAM,CAAC,YAAY,CAAC,WAAW,EAC7B;QACE,WAAW,EAAE,iFAAiF;QAC9F,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;KACnD,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QACzB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG;YACV,SAAS,MAAM,EAAE;YACjB,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE;YAClD,SAAS,EAAE,CAAC,IAAI,EAAE;YAClB,SAAS,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YACxC,UAAU,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;YAClC,UAAU,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;SACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACP,CAAC;AAED,0DAA0D;AAC1D,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/tools/git.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { PolicyConfig } from '../core/policy.js';
+export declare function registerGitTools(server: McpServer, policy: PolicyConfig): void;
+//# sourceMappingURL=git.d.ts.map

package/dist/tools/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/tools/git.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAiB,MAAM,mBAAmB,CAAC;AAIhE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CA0B9E"}

package/dist/tools/git.js

@@ -0,0 +1,33 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { z } from 'zod';
+import { assertAllowed } from '../core/policy.js';
+const exec = promisify(execFile);
+export function registerGitTools(server, policy) {
+    // ---- git ------------------------------------------------------------------------
+    server.registerTool('git', {
+        description: 'Run git commands in a repository. Policy-checked.',
+        inputSchema: {
+            repo_path: z.string().describe('Path to the git repository'),
+            args: z.array(z.string()).describe('Arguments to git, e.g. ["status", "--short"]'),
+        },
+    }, async ({ repo_path, args }) => {
+        assertAllowed(policy, repo_path);
+        try {
+            const { stdout, stderr } = await exec('git', args, {
+                cwd: repo_path,
+                timeout: 60_000,
+                maxBuffer: 10 * 1024 * 1024,
+            });
+            let out = stdout;
+            if (stderr)
+                out += (out ? '\n' : '') + stderr;
+            return { content: [{ type: 'text', text: out || '(no output)' }] };
+        }
+        catch (e) {
+            const msg = [e.message, e.stdout, e.stderr].filter(Boolean).join('\n');
+            return { content: [{ type: 'text', text: msg || e.message }], isError: true };
+        }
+    });
+}
+//# sourceMappingURL=git.js.map

package/dist/tools/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/tools/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAgB,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEhE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAoB;IACtE,oFAAoF;IACpF,MAAM,CAAC,YAAY,CAAC,KAAK,EACvB;QACE,WAAW,EAAE,mDAAmD;QAChE,WAAW,EAAE;YACX,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YAC5D,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,8CAA8C,CAAC;SACnF;KACF,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;QAC5B,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;gBACjD,GAAG,EAAE,SAAS;gBACd,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;aAC5B,CAAC,CAAC;YACH,IAAI,GAAG,GAAG,MAAM,CAAC;YACjB,IAAI,MAAM;gBAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC,EAAE,CAAC;QACrE,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChF,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/tools/http.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerHttpTools(server: McpServer): void;
+//# sourceMappingURL=http.d.ts.map

package/dist/tools/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/tools/http.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIzE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAqEzD"}