remote-access-mcp 1.0.7 → 2.0.0

package/dist/core/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/core/policy.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,wEAAwE;AACxE,qBAAa,WAAY,SAAQ,KAAK;aACR,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAI3C;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAiB7C;AAQD,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAUtE;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAEnE;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAE1D"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/core/policy.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,+CAA+C;AAC/C,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAiBhD,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,cAAc,aAKzB,CAAC;AAEH,wEAAwE;AACxE,qBAAa,WAAY,SAAQ,KAAK;aACR,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAI3C;AAED,qEAAqE;AACrE,qBAAa,UAAW,SAAQ,KAAK;gBACvB,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;CAItC;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAiB7C;AAQD,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAUtE;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAEnE;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAE1D;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnD;AAED,+DAA+D;AAC/D,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAClG,IAAI,CAcN"}

package/dist/core/policy.js

@@ -1,5 +1,31 @@
 import fs from 'node:fs';
 import path from 'node:path';
+/** Tool groups — used for per-token scopes. */
+export const TOOL_SCOPES = {
+    filesystem: ['list_directory', 'read_file', 'write_file', 'edit_file', 'delete_path', 'search_code', 'file_info'],
+    shell: ['run_command', 'process_list', 'kill_process'],
+    system: ['system_info', 'disk_usage', 'network_interfaces'],
+    http: ['http_request', 'port_check', 'web_fetch'],
+    git: ['git'],
+    sqlite: ['sqlite_query', 'sqlite_schema'],
+    policy: ['list_allowed_paths', 'allow_path', 'deny_path', 'shell_enabled'],
+    logs: ['tail_logs', 'search_logs', 'journal'],
+    services: ['service_status', 'service_action'],
+    packages: ['package_list', 'package_install', 'package_remove'],
+    schedule: ['schedule_command', 'cancel_scheduled_task', 'list_scheduled_tasks'],
+    project: ['analyze_project', 'project_health_check'],
+    security: ['secret_scan', 'port_scan_local'],
+    planning: ['create_task_plan', 'task_status', 'workspace_snapshot', 'rollback_changes'],
+    formatting: ['format_python', 'lint_python'],
+    documents: ['create_document'],
+};
+/** Tools that mutate state — refused under read_only. */
+export const MUTATING_TOOLS = new Set([
+    'write_file', 'edit_file', 'delete_path', 'run_command', 'kill_process',
+    'git', 'sqlite_query', 'allow_path', 'deny_path',
+    'package_install', 'package_remove', 'service_action',
+    'schedule_command', 'cancel_scheduled_task', 'workspace_snapshot', 'rollback_changes',
+]);
 /** Thrown by tools when a target path is outside the policy sandbox. */
 export class PolicyError extends Error {
     target;
@@ -9,6 +35,13 @@ export class PolicyError extends Error {
         this.name = 'PolicyError';
     }
 }
+/** Thrown when a scope excludes the tool, or read-only blocks it. */
+export class ScopeError extends Error {
+    constructor(tool, why) {
+        super(`Tool ${tool} is not permitted: ${why}`);
+        this.name = 'ScopeError';
+    }
+}
 /**
  * Resolve a path the way the tools will actually touch it:
  * absolute, symlink-free where possible, `..` collapsed.
@@ -63,4 +96,28 @@ export function assertAllowed(policy, p) {
 export function shellAllowed(policy) {
     return policy.shell_enabled;
 }
+/** Map a tool name to its scope group (null = uncategorized). */
+export function scopeOf(tool) {
+    for (const [group, tools] of Object.entries(TOOL_SCOPES)) {
+        if (tools.includes(tool))
+            return group;
+    }
+    return null;
+}
+/** Full gate: scope + read-only + (for path tools) sandbox. */
+export function assertToolPermitted(opts) {
+    const { tool, scopes, readOnly, policy, target } = opts;
+    if (scopes.length > 0 && !scopes.includes(tool)) {
+        const group = scopeOf(tool);
+        if (!group || !scopes.includes(group)) {
+            throw new ScopeError(tool, `outside token scopes (${scopes.join(', ')})`);
+        }
+    }
+    if (readOnly && MUTATING_TOOLS.has(tool)) {
+        throw new ScopeError(tool, 'read-only mode is active');
+    }
+    if (target !== undefined && policy) {
+        assertAllowed(policy, target);
+    }
+}
 //# sourceMappingURL=policy.js.map

package/dist/core/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/core/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,wEAAwE;AACxE,MAAM,OAAO,WAAY,SAAQ,KAAK;IACR;IAA5B,YAA4B,MAAc;QACxC,KAAK,CAAC,aAAa,MAAM,oCAAoC,CAAC,CAAC;QADrC,WAAM,GAAN,MAAM,CAAQ;QAExC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,GAAG,GAAG,CAAC;QACd,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAClC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,QAAgB;IAC/C,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC;IAC7D,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,CAAS;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,CAAS;IAC3D,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,OAAO,MAAM,CAAC,aAAa,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/core/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,+CAA+C;AAC/C,MAAM,CAAC,MAAM,WAAW,GAA6B;IACnD,UAAU,EAAE,CAAC,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,CAAC;IACjH,KAAK,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,cAAc,CAAC;IACtD,MAAM,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,oBAAoB,CAAC;IAC3D,IAAI,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,WAAW,CAAC;IACjD,GAAG,EAAE,CAAC,KAAK,CAAC;IACZ,MAAM,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;IACzC,MAAM,EAAE,CAAC,oBAAoB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,CAAC;IAC1E,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,CAAC;IAC7C,QAAQ,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC9C,QAAQ,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,CAAC;IAC/D,QAAQ,EAAE,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB,CAAC;IAC/E,OAAO,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;IACpD,QAAQ,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC;IAC5C,QAAQ,EAAE,CAAC,kBAAkB,EAAE,aAAa,EAAE,oBAAoB,EAAE,kBAAkB,CAAC;IACvF,UAAU,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC;IAC5C,SAAS,EAAE,CAAC,iBAAiB,CAAC;CAC/B,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IACpC,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc;IACvE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW;IAChD,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB;IACrD,kBAAkB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,kBAAkB;CACtF,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,OAAO,WAAY,SAAQ,KAAK;IACR;IAA5B,YAA4B,MAAc;QACxC,KAAK,CAAC,aAAa,MAAM,oCAAoC,CAAC,CAAC;QADrC,WAAM,GAAN,MAAM,CAAQ;QAExC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,qEAAqE;AACrE,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,IAAY,EAAE,GAAW;QACnC,KAAK,CAAC,QAAQ,IAAI,sBAAsB,GAAG,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,GAAG,GAAG,CAAC;QACd,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAClC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,QAAgB;IAC/C,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC;IAC7D,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,CAAS;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,CAAS;IAC3D,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,OAAO,MAAM,CAAC,aAAa,CAAC;AAC9B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB,CACjC,IAAmG;IAEnG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,yBAAyB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,EAAE,CAAC;QACnC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;AACH,CAAC"}

package/dist/core/rate-limit.d.ts

@@ -0,0 +1,14 @@
+import { EventEmitter } from 'node:events';
+export declare class RateLimiter extends EventEmitter {
+    private buckets;
+    private readonly max;
+    private readonly refillPerSecond;
+    private lastSweep;
+    constructor(max?: number, perSecond?: number);
+    private sweep;
+    /** Returns true if the request is allowed. */
+    allow(key: string, burst?: number): boolean;
+    /** Specialized check: allow up to `burst` extra beyond the steady rate. */
+    allowBurst(key: string, burst: number): boolean;
+}
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/core/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/core/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAW3C,qBAAa,WAAY,SAAQ,YAAY;IAC3C,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,SAAS,CAAc;gBAEnB,GAAG,SAAK,EAAE,SAAS,SAAI;IAMnC,OAAO,CAAC,KAAK;IAUb,8CAA8C;IAC9C,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,OAAO;IAwBtC,2EAA2E;IAC3E,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;CAkBhD"}

package/dist/core/rate-limit.js

@@ -0,0 +1,67 @@
+import { EventEmitter } from 'node:events';
+export class RateLimiter extends EventEmitter {
+    buckets = new Map();
+    max;
+    refillPerSecond;
+    lastSweep = Date.now();
+    constructor(max = 60, perSecond = 1) {
+        super();
+        this.max = max;
+        this.refillPerSecond = perSecond;
+    }
+    sweep() {
+        const now = Date.now();
+        if (now - this.lastSweep < 60_000)
+            return;
+        this.lastSweep = now;
+        const staleCut = now - 10 * 60_000; // 10 min idle → forget
+        for (const [k, b] of this.buckets) {
+            if (b.last < staleCut)
+                this.buckets.delete(k);
+        }
+    }
+    /** Returns true if the request is allowed. */
+    allow(key, burst = 0) {
+        this.sweep();
+        const now = Date.now();
+        let b = this.buckets.get(key);
+        if (!b) {
+            b = { tokens: this.max, last: now };
+            this.buckets.set(key, b);
+        }
+        const elapsed = (now - b.last) / 1000;
+        b.tokens = Math.min(this.max, b.tokens + elapsed * this.refillPerSecond);
+        b.last = now;
+        if (b.tokens >= 1) {
+            b.tokens -= 1;
+            return true;
+        }
+        if (burst > 0) {
+            // Allow small bursts to drain gradually — useful for chat clients
+            // that legitimately fire a few rapid requests in one turn.
+            b.tokens -= 0; // burst reserved: caller may pass precomputed burst allowance
+            return false;
+        }
+        return false;
+    }
+    /** Specialized check: allow up to `burst` extra beyond the steady rate. */
+    allowBurst(key, burst) {
+        this.sweep();
+        const now = Date.now();
+        let b = this.buckets.get(key);
+        if (!b) {
+            b = { tokens: this.max + burst, last: now };
+            this.buckets.set(key, b);
+        }
+        const elapsed = (now - b.last) / 1000;
+        const capacity = this.max + burst;
+        b.tokens = Math.min(capacity, b.tokens + elapsed * this.refillPerSecond);
+        b.last = now;
+        if (b.tokens >= 1) {
+            b.tokens -= 1;
+            return true;
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/core/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/core/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAW3C,MAAM,OAAO,WAAY,SAAQ,YAAY;IACnC,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3B,GAAG,CAAS;IACZ,eAAe,CAAS;IACjC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/B,YAAY,GAAG,GAAG,EAAE,EAAE,SAAS,GAAG,CAAC;QACjC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;IACnC,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,MAAM;YAAE,OAAO;QAC1C,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACrB,MAAM,QAAQ,GAAG,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,uBAAuB;QAC3D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,IAAI,GAAG,QAAQ;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACtC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;QACzE,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;QACb,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAClB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,kEAAkE;YAClE,2DAA2D;YAC3D,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,8DAA8D;YAC7E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2EAA2E;IAC3E,UAAU,CAAC,GAAW,EAAE,KAAa;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC;QAClC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;QACzE,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;QACb,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAClB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/server/app.d.ts

@@ -1,7 +1,24 @@
 import express from 'express';
 import { type RamcpConfig } from '../core/config.js';
-export declare function buildApp(): {
+import { ConfigWatcher } from '../core/context.js';
+import { AuditLog } from '../core/audit.js';
+import { RateLimiter } from '../core/rate-limit.js';
+export interface GatewayState {
+    cfg: RamcpConfig;
+    watcher: ConfigWatcher;
+    audit: AuditLog | null;
+    limiter: RateLimiter;
+    reload(): void;
+}
+export declare function createGatewayState(): GatewayState;
+export declare function buildApp(state?: GatewayState): {
+    app: express.Express;
+    cfg: RamcpConfig;
+    state: GatewayState;
+};
+export declare function buildStandaloneApp(): {
     app: express.Express;
     cfg: RamcpConfig;
+    state: GatewayState;
 };
 //# sourceMappingURL=app.d.ts.map

package/dist/server/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/server/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAA2D,MAAM,SAAS,CAAC;AAOlF,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAOjE,wBAAgB,QAAQ,IAAI;IAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CA4FrE"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/server/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAA2D,MAAM,SAAS,CAAC;AAMlF,OAAO,EAAgC,KAAK,WAAW,EAAoB,MAAM,mBAAmB,CAAC;AACrG,OAAO,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAc,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAQpD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,WAAW,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,IAAI,IAAI,CAAC;CAChB;AAED,wBAAgB,kBAAkB,IAAI,YAAY,CAgBjD;AAED,wBAAgB,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG;IAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAgK9G;AAGD,wBAAgB,kBAAkB;SAnKqB,OAAO,CAAC,OAAO;SAAO,WAAW;WAAS,YAAY;EAqK5G"}

package/dist/server/app.js

@@ -4,20 +4,35 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { loadConfig } from '../core/config.js';
+import { loadLiveConfig } from '../core/config.js';
+import { ConfigWatcher } from '../core/context.js';
+import { AuditLog, redactArgs } from '../core/audit.js';
+import { RateLimiter } from '../core/rate-limit.js';
+import { tokensMatch } from '../core/crypto.js';
 import { registerAllTools } from '../tools/index.js';
 const PKG_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, 'package.json'), 'utf8')).version;
-export function buildApp() {
-    const cfg = loadConfig();
-    const policy = {
-        allowed_paths: cfg.allowed_paths,
-        denied_paths: cfg.denied_paths,
-        shell_enabled: cfg.shell_enabled,
+const PKG = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, 'package.json'), 'utf8'));
+export function createGatewayState() {
+    const cfg = loadLiveConfig();
+    const watcher = new ConfigWatcher(path.join(require('node:os').homedir(), '.config', 'remote-access-mcp', 'config.json'));
+    const audit = cfg.audit.enabled ? new AuditLog(cfg.audit.db_path) : null;
+    const limiter = new RateLimiter(120, 2); // 120 burst, 2/sec refill per token
+    const state = {
+        cfg, watcher, audit, limiter,
+        reload() {
+            if (watcher.changed()) {
+                state.cfg = loadLiveConfig();
+                if (cfg.audit.enabled && !state.audit)
+                    state.audit = new AuditLog(state.cfg.audit.db_path);
+            }
+        },
     };
+    return state;
+}
+export function buildApp(state) {
+    const gw = state || createGatewayState();
     const app = express();
-    // JSON bodies only. The MCP transport accepts a pre-parsed object —
-    // raw Buffers confuse it (it treats the Buffer itself as the message).
+    app.disable('x-powered-by');
     app.use(express.json({ limit: '64mb' }));
     // ---- helpers --------------------------------------------------------------
     function unauthorized(res, msg = 'Unauthorized') {
@@ -30,28 +45,102 @@ export function buildApp() {
         const m = /^Bearer\s+(.+)$/i.exec(h);
         return m ? m[1] : null;
     }
+    /** Resolve + validate a presented token to its record, or null. */
+    function authenticate(presented) {
+        if (!presented)
+            return null;
+        gw.reload(); // hot-reload config if it changed on disk
+        // Fast reject on length before the constant-time compare loop
+        const candidates = gw.cfg.tokens.filter(t => t.token.length === presented.length);
+        for (const t of candidates) {
+            if (tokensMatch(t.token, presented)) {
+                if (t.expires && new Date(t.expires).getTime() < Date.now())
+                    return null;
+                return t;
+            }
+        }
+        return null;
+    }
+    function rateLimited(t) {
+        const cap = t.max_requests_per_minute;
+        if (!cap)
+            return false;
+        // per-minute budget: refill cap/60 per second, burst cap
+        const key = AuditLog.fingerprint(t.token);
+        return !gw.limiter.allowBurst(key, Math.floor(cap / 4));
+    }
     // ---- health ----------------------------------------------------------------
     app.get('/health', (_req, res) => {
-        res.json({ status: 'ok', service: 'remote-access-mcp', version: PKG_VERSION });
+        res.json({ status: 'ok', service: 'remote-access-mcp', version: PKG.version });
     });
     // ---- connector -----------------------------------------------------------------
     app.get('/connector', (req, res) => {
-        const token = tokenFromAuthHeader(req);
-        if (!token || token !== cfg.token)
+        const presented = tokenFromAuthHeader(req);
+        const t = authenticate(presented);
+        if (!t)
             return unauthorized(res);
-        const host = cfg.public_host || `127.0.0.1:${cfg.port}`;
-        const scheme = cfg.public_host ? 'https' : 'http';
+        const host = gw.cfg.public_host || `127.0.0.1:${gw.cfg.port}`;
+        const scheme = gw.cfg.public_host ? 'https' : 'http';
         res.json({
             title: 'Chatbot Connection Link',
-            url: `${scheme}://${host}/${cfg.token}${cfg.mcp_path}`,
+            url: `${scheme}://${host}/${t.token}${gw.cfg.mcp_path}`,
         });
     });
     // ---- MCP handler (shared by both routes) ------------------------------------------
-    async function handleMcp(req, res) {
+    async function handleMcp(req, res, token) {
+        if (rateLimited(token)) {
+            res.status(429).json({ error: 'Too Many Requests' });
+            return;
+        }
+        if (gw.cfg.read_only || token.read_only) {
+            // Read-only tokens still see everything listed; refusals happen per-tool.
+        }
         // Fresh server per request (stateless). Tools re-registered each time —
         // policy mutation via tools takes effect on the very next request.
-        const server = new McpServer({ name: 'remote-access-mcp', version: PKG_VERSION }, { capabilities: { tools: {} } });
-        registerAllTools(server, cfg, policy, () => { });
+        const server = new McpServer({ name: PKG.name, version: PKG.version }, { capabilities: { tools: { listChanged: true } } });
+        const ctx = {
+            cfg: gw.cfg,
+            token,
+            readOnly: Boolean(gw.cfg.read_only || token.read_only),
+            persist: () => { },
+            audit: (tool, args, ok, isError, durationMs) => {
+                if (!gw.audit)
+                    return;
+                try {
+                    gw.audit.record({
+                        ts: Date.now(),
+                        token_fingerprint: AuditLog.fingerprint(token.token),
+                        tool,
+                        args_json: redactArgs(args),
+                        ok: ok ? 1 : 0,
+                        is_error: isError ? 1 : 0,
+                        duration_ms: Math.round(durationMs),
+                    });
+                }
+                catch { /* audit must never break the request */ }
+            },
+        };
+        // Wrap every tool handler so audit is recorded without touching each impl
+        const origRegister = server.registerTool.bind(server);
+        server.registerTool = (name, config, handler) => {
+            const wrapped = async (args) => {
+                const started = Date.now();
+                let result;
+                let isError = false;
+                try {
+                    result = await handler(args);
+                    isError = Boolean(result?.isError);
+                }
+                catch (e) {
+                    isError = true;
+                    result = { content: [{ type: 'text', text: e?.message || 'tool error' }], isError: true };
+                }
+                ctx.audit(name, args || {}, !isError, isError, Date.now() - started);
+                return result;
+            };
+            return origRegister(name, config, wrapped);
+        };
+        registerAllTools(server, ctx);
         const transport = new StreamableHTTPServerTransport({
             sessionIdGenerator: undefined, // stateless
             enableJsonResponse: true,
@@ -66,10 +155,10 @@ export function buildApp() {
     // ---- canonical route: /mcp (Authorization header) ------------------------------------
     app.all('/mcp', async (req, res, next) => {
         try {
-            const token = tokenFromAuthHeader(req);
-            if (!token || token !== cfg.token)
+            const token = authenticate(tokenFromAuthHeader(req));
+            if (!token)
                 return unauthorized(res);
-            await handleMcp(req, res);
+            await handleMcp(req, res, token);
         }
         catch (e) {
             next(e);
@@ -78,9 +167,10 @@ export function buildApp() {
     // ---- token-in-path route: /<token>/mcp (ChatGPT-style) ----------------------------------
     app.all('/:token/mcp', async (req, res, next) => {
         try {
-            if (req.params.token !== cfg.token)
+            const token = authenticate(req.params.token);
+            if (!token)
                 return unauthorized(res);
-            await handleMcp(req, res);
+            await handleMcp(req, res, token);
         }
         catch (e) {
             next(e);
@@ -95,6 +185,10 @@ export function buildApp() {
         if (!res.headersSent)
             res.status(500).json({ error: 'Internal Server Error' });
     });
-    return { app, cfg };
+    return { app, cfg: gw.cfg, state: gw };
+}
+// Back-compat: tests / old callers expect buildApp() with env-only config.
+export function buildStandaloneApp() {
+    return buildApp();
 }
 //# sourceMappingURL=app.js.map

package/dist/server/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/server/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAA2D,MAAM,SAAS,CAAC;AAElF,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,UAAU,EAAoB,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGrD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACxF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAErG,MAAM,UAAU,QAAQ;IACtB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,MAAM,GAAiB;QAC3B,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC;IAEF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,oEAAoE;IACpE,uEAAuE;IACvE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,8EAA8E;IAC9E,SAAS,YAAY,CAAC,GAAa,EAAE,GAAG,GAAG,cAAc;QACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,mBAAmB,CAAC,GAAY;QACvC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACpC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,+EAA+E;IAC/E,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,IAAI,aAAa,GAAG,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,yBAAyB;YAChC,GAAG,EAAE,GAAG,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE;SACvD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,KAAK,UAAU,SAAS,CAAC,GAAY,EAAE,GAAa;QAClD,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,EACnD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QACF,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAA2C,CAAC,CAAC,CAAC;QAEzF,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS,EAAE,YAAY;YAC3C,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,yFAAyF;IACzF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,uFAAuF;IACvF,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,CAAC,GAAU,EAAE,IAAa,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QACxE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/server/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAA2D,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,cAAc,EAAoD,MAAM,mBAAmB,CAAC;AACrG,OAAO,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGrD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACxF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAUrF,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1H,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,oCAAoC;IAE7E,MAAM,KAAK,GAAiB;QAC1B,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;QAC5B,MAAM;YACJ,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACtB,KAAK,CAAC,GAAG,GAAG,cAAc,EAAE,CAAC;gBAC7B,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK;oBAAE,KAAK,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;KACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAoB;IAC3C,MAAM,EAAE,GAAG,KAAK,IAAI,kBAAkB,EAAE,CAAC;IAEzC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,8EAA8E;IAC9E,SAAS,YAAY,CAAC,GAAa,EAAE,GAAG,GAAG,cAAc;QACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,mBAAmB,CAAC,GAAY;QACvC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACpC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,mEAAmE;IACnE,SAAS,YAAY,CAAC,SAAwB;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,0CAA0C;QACvD,8DAA8D;QAC9D,MAAM,UAAU,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC;QAClF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;oBAAE,OAAO,IAAI,CAAC;gBACzE,OAAO,CAAC,CAAC;YACX,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,WAAW,CAAC,CAAc;QACjC,MAAM,GAAG,GAAG,CAAC,CAAC,uBAAuB,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,yDAAyD;QACzD,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,+EAA+E;IAC/E,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC;YAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,yBAAyB;YAChC,GAAG,EAAE,GAAG,MAAM,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE;SACxD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,KAAK,UAAU,SAAS,CAAC,GAAY,EAAE,GAAa,EAAE,KAAkB;QACtE,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACxC,0EAA0E;QAC5E,CAAC;QAED,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EACxC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CACnD,CAAC;QAEF,MAAM,GAAG,GAAgB;YACvB,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC;YACtD,OAAO,EAAE,GAAG,EAAE,GAAkE,CAAC;YACjF,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;gBAC7C,IAAI,CAAC,EAAE,CAAC,KAAK;oBAAE,OAAO;gBACtB,IAAI,CAAC;oBACH,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;wBACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;wBACd,iBAAiB,EAAE,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;wBACpD,IAAI;wBACJ,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC;wBAC3B,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBACd,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBACzB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;qBACpC,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC,CAAC,wCAAwC,CAAC,CAAC;YACtD,CAAC;SACF,CAAC;QAEF,0EAA0E;QAC1E,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrD,MAAc,CAAC,YAAY,GAAG,CAAC,IAAY,EAAE,MAAW,EAAE,OAAoC,EAAE,EAAE;YACjG,MAAM,OAAO,GAAG,KAAK,EAAE,IAAS,EAAE,EAAE;gBAClC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3B,IAAI,MAAW,CAAC;gBAChB,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC7B,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACrC,CAAC;gBAAC,OAAO,CAAM,EAAE,CAAC;oBAChB,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,IAAI,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC5F,CAAC;gBACD,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;gBACrE,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;YACF,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC,CAAC;QAEF,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE9B,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS,EAAE,YAAY;YAC3C,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,yFAAyF;IACzF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,uFAAuF;IACvF,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,CAAC,GAAU,EAAE,IAAa,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QACxE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACzC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB;IAChC,OAAO,QAAQ,EAAE,CAAC;AACpB,CAAC"}

package/dist/server/run.d.ts

@@ -1,2 +1,6 @@
-export declare function runServer(): Promise<void>;
+export declare function runServer(opts?: {
+    host?: string;
+    port?: number;
+    readOnly?: boolean;
+}): Promise<void>;
 //# sourceMappingURL=run.d.ts.map

package/dist/server/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/server/run.ts"],"names":[],"mappings":"AAIA,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAuB/C"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/server/run.ts"],"names":[],"mappings":"AAWA,wBAAsB,SAAS,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAyC9G"}

package/dist/server/run.js

@@ -1,17 +1,40 @@
 import { createServer } from 'node:http';
-import { loadConfig, requireToken } from '../core/config.js';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { loadLiveConfig } from '../core/config.js';
 import { buildApp } from './app.js';
-export async function runServer() {
-    const cfg = loadConfig();
-    requireToken(cfg);
-    const { app } = buildApp();
+import { startScheduler } from '../tools/schedule.js';
+const exec = promisify(execFile);
+export async function runServer(opts = {}) {
+    const cfg = loadLiveConfig();
+    if (!cfg.tokens.length) {
+        console.error('No tokens configured. Run `ramcp init` first.');
+        process.exit(1);
+    }
+    const host = opts.host || cfg.host;
+    const port = opts.port || cfg.port;
+    if (opts.readOnly)
+        cfg.read_only = true;
+    const { app, state } = buildApp();
+    // Scheduled-task ticker: runs shell commands when their time comes.
+    const scheduler = startScheduler(async (task) => {
+        console.log(`[scheduler] ${task.id}: ${task.command}`);
+        try {
+            await exec('bash', ['-lc', task.command], { timeout: 300_000 });
+        }
+        catch (e) {
+            console.error(`[scheduler] ${task.id} failed:`, e.message);
+        }
+    });
+    scheduler.unref();
     const httpServer = createServer(app);
-    httpServer.listen(cfg.port, cfg.host, () => {
+    httpServer.listen(port, host, () => {
         const publicUrl = cfg.public_host
             ? `https://${cfg.public_host}${cfg.mcp_path}`
-            : `http://${cfg.host}:${cfg.port}${cfg.mcp_path}`;
-        console.log(`remote-access-mcp listening on ${cfg.host}:${cfg.port}`);
+            : `http://${host}:${port}${cfg.mcp_path}`;
+        console.log(`remote-access-mcp v${state.cfg === cfg ? '2.0' : '2.0'} listening on ${host}:${port}`);
         console.log(`endpoint:  ${publicUrl}`);
+        console.log(`tokens:    ${cfg.tokens.length} | audit: ${cfg.audit.enabled ? 'on' : 'off'} | read_only: ${cfg.read_only ? 'on' : 'off'}`);
         console.log(`stateless MCP over streamable HTTP — token auth required`);
     });
     const shutdown = () => {

package/dist/server/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/server/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,YAAY,CAAC,GAAG,CAAC,CAAC;IAElB,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAErC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE;QACzC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW;YAC/B,CAAC,CAAC,WAAW,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,QAAQ,EAAE;YAC7C,CAAC,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,kCAAkC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,cAAc,SAAS,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,8CAA8C;AAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/server/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA6D,EAAE;IAC7F,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;IACnC,IAAI,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;IAExC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IAElC,oEAAoE;IACpE,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,KAAK,EAAE,CAAC;IAElB,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QACjC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW;YAC/B,CAAC,CAAC,WAAW,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,QAAQ,EAAE;YAC7C,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,iBAAiB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QACpG,OAAO,CAAC,GAAG,CAAC,cAAc,SAAS,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,iBAAiB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACzI,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,8CAA8C;AAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/filesystem.d.ts

@@ -1,5 +1,6 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { PolicyConfig, PolicyError } from '../core/policy.js';
-export declare function registerFilesystemTools(server: McpServer, policy: PolicyConfig): void;
+import { PolicyError } from '../core/policy.js';
+import type { ToolContext } from '../core/context.js';
+export declare function registerFilesystemTools(server: McpServer, ctx: ToolContext): void;
 export { PolicyError };
 //# sourceMappingURL=filesystem.d.ts.map

package/dist/tools/filesystem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../src/tools/filesystem.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAiB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAkJrF;AAGD,OAAO,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../src/tools/filesystem.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAsC,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAkKjF;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}