remote-access-mcp 3.0.2 → 3.1.1

package/dist/tools/monitoring.js

@@ -0,0 +1,141 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { z } from 'zod';
+import { assertToolPermitted } from '../core/policy.js';
+import { AuditLog } from '../core/audit.js';
+import { dataDir } from '../core/platform.js';
+import { notifyWebhooks } from '../core/webhooks.js';
+const MAX_WATCHES = 500;
+const LOCK_TIMEOUT_MS = 10_000;
+const STALE_LOCK_MS = 30_000;
+const timers = new Map();
+let restored = false;
+function storePath() { return path.join(dataDir(), 'health-watches.json'); }
+function lockPath() { return path.join(dataDir(), 'health-watches.lock'); }
+function isAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e?.code === 'EPERM';
+    }
+}
+function load() {
+    try {
+        const rows = JSON.parse(fs.readFileSync(storePath(), 'utf8'));
+        if (!Array.isArray(rows))
+            throw new Error('invalid health watcher store');
+        return rows.filter((r) => r && typeof r.id === 'string' && typeof r.tokenFingerprint === 'string' && Number.isInteger(r.intervalSeconds) && r.intervalSeconds >= 10 && r.intervalSeconds <= 3600 && typeof r.created === 'string');
+    }
+    catch (e) {
+        if (e?.code === 'ENOENT')
+            return [];
+        throw new Error(`failed to read health watcher store: ${e?.message || e}`);
+    }
+}
+function withLock(fn) {
+    fs.mkdirSync(dataDir(), { recursive: true, mode: 0o700 });
+    const started = Date.now();
+    while (true) {
+        try {
+            fs.mkdirSync(lockPath(), { mode: 0o700 });
+            try {
+                return fn();
+            }
+            finally {
+                fs.rmSync(lockPath(), { recursive: true, force: true });
+            }
+        }
+        catch (e) {
+            if (e?.code !== 'EEXIST')
+                throw e;
+            try {
+                if (Date.now() - fs.statSync(lockPath()).mtimeMs > STALE_LOCK_MS)
+                    fs.rmSync(lockPath(), { recursive: true, force: true });
+            }
+            catch { /* retry */ }
+            if (Date.now() - started > LOCK_TIMEOUT_MS)
+                throw new Error('timed out waiting for health watcher persistence lock');
+            const until = Date.now() + 20;
+            while (Date.now() < until) { /* synchronous lock acquisition */ }
+        }
+    }
+}
+function saveUnlocked(rows) {
+    const target = storePath();
+    const tmp = `${target}.tmp-${process.pid}-${crypto.randomUUID()}`;
+    fs.writeFileSync(tmp, JSON.stringify([...rows].sort((a, b) => a.created.localeCompare(b.created)).slice(-MAX_WATCHES), null, 2), { mode: 0o600 });
+    fs.renameSync(tmp, target);
+}
+function persist(mutator) {
+    return withLock(() => { const rows = load(); mutator(rows); saveUnlocked(rows); return rows; });
+}
+function current(id, fingerprint) {
+    return load().find(w => w.id === id && w.tokenFingerprint === fingerprint);
+}
+function stopLocal(key) {
+    const timer = timers.get(key);
+    if (timer)
+        clearInterval(timer);
+    timers.delete(key);
+}
+function startLocal(w, cfg) {
+    const key = `${w.tokenFingerprint}:${w.id}`;
+    stopLocal(key);
+    const timer = setInterval(() => {
+        const live = current(w.id, w.tokenFingerprint);
+        if (!live || live.ownerPid !== process.pid) {
+            stopLocal(key);
+            return;
+        }
+        const cpu = os.loadavg()[0] / Math.max(1, os.cpus().length) * 100;
+        const memory = (1 - os.freemem() / os.totalmem()) * 100;
+        if ((live.cpuPercent !== undefined && cpu >= live.cpuPercent) || (live.memoryPercent !== undefined && memory >= live.memoryPercent)) {
+            notifyWebhooks(cfg, { ts: Date.now(), token_fingerprint: w.tokenFingerprint, tool: 'health_watch', args_json: JSON.stringify({ cpu, memory }), ok: 0, is_error: 1, duration_ms: 0 });
+        }
+    }, w.intervalSeconds * 1000);
+    timers.set(key, timer);
+}
+function restoreForProcess(cfg) {
+    if (restored)
+        return;
+    restored = true;
+    persist(rows => {
+        for (const w of rows)
+            if (!isAlive(w.ownerPid))
+                w.ownerPid = process.pid;
+    }).filter(w => w.ownerPid === process.pid).forEach(w => startLocal(w, cfg));
+}
+export function registerMonitoringTools(server, ctx) {
+    restoreForProcess(ctx.cfg);
+    const tid = AuditLog.fingerprint(ctx.token.token);
+    server.registerTool('health_watch', { description: 'Start a persistent periodic health watcher for CPU/memory thresholds. Alerts are emitted through configured webhooks and survive gateway restart.', inputSchema: { interval_seconds: z.number().min(10).max(3600).default(60), cpu_percent: z.number().min(1).max(100).optional(), memory_percent: z.number().min(1).max(100).optional() } }, async ({ interval_seconds, cpu_percent, memory_percent }) => {
+        assertToolPermitted({ tool: 'health_watch', scopes: ctx.token.scopes, readOnly: ctx.readOnly });
+        const watcher = { id: crypto.randomUUID().slice(0, 12), tokenFingerprint: tid, intervalSeconds: interval_seconds, cpuPercent: cpu_percent, memoryPercent: memory_percent, created: new Date().toISOString(), ownerPid: process.pid };
+        persist(rows => rows.push(watcher));
+        startLocal(watcher, ctx.cfg);
+        return { content: [{ type: 'text', text: JSON.stringify({ id: watcher.id, interval_seconds }) }] };
+    });
+    server.registerTool('health_status', { description: 'List active persistent health watchers for the current token.', inputSchema: {} }, async () => {
+        assertToolPermitted({ tool: 'health_status', scopes: ctx.token.scopes, readOnly: ctx.readOnly });
+        const rows = load().filter(w => w.tokenFingerprint === tid && isAlive(w.ownerPid));
+        return { content: [{ type: 'text', text: JSON.stringify(rows.map(w => w.id)) }] };
+    });
+    server.registerTool('health_stop', { description: 'Stop a persistent health watcher.', inputSchema: { id: z.string() } }, async ({ id }) => {
+        assertToolPermitted({ tool: 'health_stop', scopes: ctx.token.scopes, readOnly: ctx.readOnly });
+        const key = `${tid}:${id}`;
+        const exists = current(id, tid);
+        if (!exists)
+            return { content: [{ type: 'text', text: 'Watcher not found.' }], isError: true };
+        persist(rows => { const i = rows.findIndex(w => w.id === id && w.tokenFingerprint === tid); if (i >= 0)
+            rows.splice(i, 1); });
+        stopLocal(key);
+        return { content: [{ type: 'text', text: `Stopped ${id}.` }] };
+    });
+}
+//# sourceMappingURL=monitoring.js.map

package/dist/tools/monitoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitoring.js","sourceRoot":"","sources":["../../src/tools/monitoring.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAYrD,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;AACjD,IAAI,QAAQ,GAAG,KAAK,CAAC;AAErB,SAAS,SAAS,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;AACpF,SAAS,QAAQ,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;AACnF,SAAS,OAAO,CAAC,GAAY;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAK,GAAc,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,GAAa,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC;IAAC,CAAC;AACrG,CAAC;AACD,SAAS,IAAI;IACX,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,IAAI,EAAE,IAAI,CAAC,CAAC,eAAe,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC;IACvP,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AACD,SAAS,QAAQ,CAAI,EAAW;IAC9B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC;gBAAC,OAAO,EAAE,EAAE,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC;gBAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,GAAG,aAAa;oBAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;YACxJ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACrH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,kCAAkC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AACD,SAAS,YAAY,CAAC,IAAmB;IACvC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,GAAG,MAAM,QAAQ,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAClE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClJ,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7B,CAAC;AACD,SAAS,OAAO,CAAC,OAAsC;IACrD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AACD,SAAS,OAAO,CAAC,EAAU,EAAE,WAAmB;IAC9C,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,gBAAgB,KAAK,WAAW,CAAC,CAAC;AAC7E,CAAC;AACD,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK;QAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AACD,SAAS,UAAU,CAAC,CAAc,EAAE,GAAuB;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5C,SAAS,CAAC,GAAG,CAAC,CAAC;IACf,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACvE,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC;QAClE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,GAAG,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACpI,cAAc,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACvL,CAAC;IACH,CAAC,EAAE,CAAC,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AACD,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,QAAQ;QAAE,OAAO;IACrB,QAAQ,GAAG,IAAI,CAAC;IAChB,OAAO,CAAC,IAAI,CAAC,EAAE;QACb,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,CAAC,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;IAC3E,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAiB,EAAE,GAAgB;IACzE,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,mJAAmJ,EAAE,WAAW,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE;QAC5b,mBAAmB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChG,MAAM,OAAO,GAAgB,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAClP,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACpC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACrG,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE,WAAW,EAAE,+DAA+D,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QACjJ,mBAAmB,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjG,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACzI,mBAAmB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC/F,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,gBAAgB,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9H,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/plugins.d.ts

@@ -0,0 +1,5 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ToolContext } from '../core/context.js';
+export declare function registerInstalledPlugins(server: McpServer, ctx: ToolContext): Promise<void>;
+export declare function registerPluginTools(server: McpServer, ctx: ToolContext): void;
+//# sourceMappingURL=plugins.d.ts.map

package/dist/tools/plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../src/tools/plugins.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAetD,wBAAsB,wBAAwB,CAAC,MAAM,EAAC,SAAS,EAAC,GAAG,EAAC,WAAW,GAAE,OAAO,CAAC,IAAI,CAAC,CAS7F;AACD,wBAAgB,mBAAmB,CAAC,MAAM,EAAC,SAAS,EAAC,GAAG,EAAC,WAAW,GAAE,IAAI,CAIzE"}

package/dist/tools/plugins.js

@@ -0,0 +1,53 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { z } from 'zod';
+import { assertToolPermitted, assertAllowed } from '../core/policy.js';
+import { dataDir } from '../core/platform.js';
+const root = () => path.join(dataDir(), 'plugins');
+function manifests() { if (!fs.existsSync(root()))
+    return []; return fs.readdirSync(root(), { withFileTypes: true }).flatMap(d => { if (!d.isDirectory())
+    return []; try {
+    return [JSON.parse(fs.readFileSync(path.join(root(), d.name, 'manifest.json'), 'utf8'))];
+}
+catch {
+    return [];
+} }); }
+function pluginDir(name) { return path.join(root(), name.replace(/[^a-zA-Z0-9._-]/g, '_')); }
+function pluginEntry(m) {
+    if (!m.entry || !m.trusted)
+        return null;
+    const dir = pluginDir(m.name);
+    const resolved = path.resolve(dir, m.entry);
+    const rel = path.relative(dir, resolved);
+    if (!rel || rel.startsWith('..' + path.sep) || path.isAbsolute(rel))
+        return null;
+    return resolved;
+}
+export async function registerInstalledPlugins(server, ctx) {
+    for (const m of manifests()) {
+        const entry = pluginEntry(m);
+        if (!entry)
+            continue;
+        const dir = pluginDir(m.name);
+        const allowed = (m.permissions || []).every(p => !ctx.token.scopes.length || ctx.token.scopes.includes(p));
+        if (!allowed)
+            continue;
+        try {
+            const mod = await import(pathToFileURL(entry).href);
+            if (typeof mod.register === 'function')
+                await mod.register(server, ctx);
+        }
+        catch { /* a broken plugin must not prevent gateway startup */ }
+    }
+}
+export function registerPluginTools(server, ctx) {
+    server.registerTool('plugin_list', { description: 'List installed local Remote Access MCP plugins and their declared permissions.', inputSchema: {} }, async () => { assertToolPermitted({ tool: 'plugin_list', scopes: ctx.token.scopes, readOnly: ctx.readOnly }); return { content: [{ type: 'text', text: JSON.stringify(manifests(), null, 2) }] }; });
+    server.registerTool('plugin_install', { description: 'Install a trusted local plugin directory containing manifest.json. The source must already exist on the machine.', inputSchema: { source: z.string() } }, async ({ source }) => { assertToolPermitted({ tool: 'plugin_install', scopes: ctx.token.scopes, readOnly: ctx.readOnly }); const src = path.resolve(source); assertAllowed({ allowed_paths: ctx.token.allowed_paths, denied_paths: ctx.token.denied_paths, shell_enabled: ctx.token.shell_enabled }, src); const mf = path.join(src, 'manifest.json'); if (!fs.existsSync(mf))
+        return { content: [{ type: 'text', text: 'manifest.json not found.' }], isError: true }; const m = JSON.parse(fs.readFileSync(mf, 'utf8')); if (!m.name || !m.version)
+        return { content: [{ type: 'text', text: 'Invalid plugin manifest.' }], isError: true }; if (m.trusted !== true)
+        return { content: [{ type: 'text', text: 'Plugin manifest must explicitly set trusted=true before installation.' }], isError: true }; const dest = pluginDir(m.name); fs.mkdirSync(root(), { recursive: true }); fs.cpSync(src, dest, { recursive: true }); return { content: [{ type: 'text', text: `Plugin ${m.name}@${m.version} installed. Declared permissions: ${(m.permissions || []).join(', ') || 'none'}.` }] }; });
+    server.registerTool('plugin_remove', { description: 'Remove an installed local plugin.', inputSchema: { name: z.string().regex(/^[a-zA-Z0-9._-]+$/) } }, async ({ name }) => { assertToolPermitted({ tool: 'plugin_remove', scopes: ctx.token.scopes, readOnly: ctx.readOnly }); const p = path.join(root(), name); if (!fs.existsSync(p))
+        return { content: [{ type: 'text', text: 'Plugin not found.' }], isError: true }; fs.rmSync(p, { recursive: true, force: true }); return { content: [{ type: 'text', text: `Plugin ${name} removed.` }] }; });
+}
+//# sourceMappingURL=plugins.js.map

package/dist/tools/plugins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.js","sourceRoot":"","sources":["../../src/tools/plugins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,MAAM,IAAI,GAAC,GAAE,EAAE,CAAA,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAC,SAAS,CAAC,CAAC;AAC9C,SAAS,SAAS,KAAc,IAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAAC,OAAM,EAAE,CAAC,CAAA,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAC,EAAC,aAAa,EAAC,IAAI,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA,EAAE,GAAC,IAAG,CAAC,CAAC,CAAC,WAAW,EAAE;IAAC,OAAM,EAAE,CAAC,CAAA,IAAG,CAAC;IAAA,OAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAC,CAAC,CAAC,IAAI,EAAC,eAAe,CAAC,EAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAAA,CAAC;AAAA,MAAK,CAAC;IAAA,OAAM,EAAE,CAAA;AAAA,CAAC,CAAA,CAAC,CAAC,CAAA,CAAA,CAAC;AAC1Q,SAAS,SAAS,CAAC,IAAW,IAAS,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAA,CAAC;AACtG,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,GAAG,GAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAgB,EAAC,GAAe;IAC7E,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YAAC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,UAAU;gBAAE,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;IACxM,CAAC;AACH,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,MAAgB,EAAC,GAAe;IACnE,MAAM,CAAC,YAAY,CAAC,aAAa,EAAC,EAAC,WAAW,EAAC,gFAAgF,EAAC,WAAW,EAAC,EAAE,EAAC,EAAC,KAAK,IAAE,EAAE,GAAC,mBAAmB,CAAC,EAAC,IAAI,EAAC,aAAa,EAAC,MAAM,EAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAQ,EAAC,CAAC,CAAC,CAAA,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC,EAAC,CAAC,EAAC,CAAC,CAAA,CAAC,CAAC,CAAC;IAC7T,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAC,EAAC,WAAW,EAAC,kHAAkH,EAAC,WAAW,EAAC,EAAC,MAAM,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,EAAC,EAAC,KAAK,EAAC,EAAC,MAAM,EAAC,EAAC,EAAE,GAAC,mBAAmB,CAAC,EAAC,IAAI,EAAC,gBAAgB,EAAC,MAAM,EAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAQ,EAAC,CAAC,CAAC,CAAA,MAAM,GAAG,GAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA,aAAa,CAAC,EAAC,aAAa,EAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAC,YAAY,EAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAC,aAAa,EAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAC,EAAC,GAAG,CAAC,CAAC,CAAA,MAAM,EAAE,GAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,eAAe,CAAC,CAAC,CAAA,IAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAAC,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,0BAA0B,EAAC,CAAC,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC,CAAA,MAAM,CAAC,GAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAC,MAAM,CAAC,CAAa,CAAC,CAAA,IAAG,CAAC,CAAC,CAAC,IAAI,IAAE,CAAC,CAAC,CAAC,OAAO;QAAC,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,0BAA0B,EAAC,CAAC,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC,CAAA,IAAG,CAAC,CAAC,OAAO,KAAG,IAAI;QAAC,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,uEAAuE,EAAC,CAAC,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC,CAAA,MAAM,IAAI,GAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,CAAC,CAAC,CAAA,EAAE,CAAC,MAAM,CAAC,GAAG,EAAC,IAAI,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,CAAC,CAAC,CAAA,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,UAAU,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,qCAAqC,CAAC,CAAC,CAAC,WAAW,IAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAE,MAAM,GAAG,EAAC,CAAC,EAAC,CAAC,CAAA,CAAC,CAAC,CAAC;IAC3oC,MAAM,CAAC,YAAY,CAAC,eAAe,EAAC,EAAC,WAAW,EAAC,mCAAmC,EAAC,WAAW,EAAC,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAC,EAAC,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,EAAC,EAAE,GAAC,mBAAmB,CAAC,EAAC,IAAI,EAAC,eAAe,EAAC,MAAM,EAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAQ,EAAC,CAAC,CAAC,CAAA,MAAM,CAAC,GAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAC,IAAI,CAAC,CAAC,CAAA,IAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAAC,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,mBAAmB,EAAC,CAAC,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC,CAAA,EAAE,CAAC,MAAM,CAAC,CAAC,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC,CAAA,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,UAAU,IAAI,WAAW,EAAC,CAAC,EAAC,CAAC,CAAA,CAAC,CAAC,CAAC;AAC/d,CAAC"}

package/dist/tools/resources-prompts.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ToolContext } from '../core/context.js';
+export declare function registerResourcesAndPrompts(server: McpServer, ctx: ToolContext): void;
+//# sourceMappingURL=resources-prompts.d.ts.map

package/dist/tools/resources-prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources-prompts.d.ts","sourceRoot":"","sources":["../../src/tools/resources-prompts.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItD,wBAAgB,2BAA2B,CAAC,MAAM,EAAC,SAAS,EAAC,GAAG,EAAC,WAAW,GAAE,IAAI,CAcjF"}

package/dist/tools/resources-prompts.js

@@ -0,0 +1,21 @@
+import os from 'node:os';
+import fs from 'node:fs';
+import { assertToolPermitted } from '../core/policy.js';
+import { dataDir } from '../core/platform.js';
+export function registerResourcesAndPrompts(server, ctx) {
+    const gate = (tool) => assertToolPermitted({ tool, scopes: ctx.token.scopes, readOnly: ctx.readOnly });
+    const json = (x) => JSON.stringify(x, null, 2);
+    server.registerResource('system_resource', 'ramcp://system', { description: 'Current local system information', mimeType: 'application/json' }, async () => ({ contents: [{ uri: 'ramcp://system', mimeType: 'application/json', text: json({ hostname: os.hostname(), platform: process.platform, release: os.release(), arch: os.arch(), cpus: os.cpus().length, totalMemory: os.totalmem(), freeMemory: os.freemem(), uptime: os.uptime() }) }] }));
+    server.registerResource('services_resource', 'ramcp://services', { description: 'Configured service and runtime overview', mimeType: 'application/json' }, async () => ({ contents: [{ uri: 'ramcp://services', mimeType: 'application/json', text: json({ platform: process.platform, pid: process.pid, uptime: process.uptime() }) }] }));
+    server.registerResource('network_resource', 'ramcp://network', { description: 'Local network interface information', mimeType: 'application/json' }, async () => ({ contents: [{ uri: 'ramcp://network', mimeType: 'application/json', text: json(os.networkInterfaces()) }] }));
+    server.registerResource('projects_resource', 'ramcp://projects', { description: 'Local Remote Access MCP data directory overview', mimeType: 'application/json' }, async () => ({ contents: [{ uri: 'ramcp://projects', mimeType: 'application/json', text: json({ dataDir: dataDir(), entries: fs.existsSync(dataDir()) ? fs.readdirSync(dataDir()) : [] }) }] }));
+    server.registerResource('audit_resource', 'ramcp://audit', { description: 'Recent audit entries for the authenticated operator', mimeType: 'application/json' }, async () => { gate('audit_resource'); if (!ctx.cfg.audit.enabled)
+        return { contents: [{ uri: 'ramcp://audit', mimeType: 'application/json', text: json([]) }] }; const { AuditLog } = await import('../core/audit.js'); const audit = new AuditLog(ctx.cfg.audit.db_path); const fingerprint = AuditLog.fingerprint(ctx.token.token); const rows = audit.query({ fingerprint, limit: 100 }); return { contents: [{ uri: 'ramcp://audit', mimeType: 'application/json', text: json(rows) }] }; });
+    const prompt = (name, title, description, text) => server.registerPrompt(name, { title, description }, async () => ({ description, messages: [{ role: 'user', content: { type: 'text', text } }] }));
+    prompt('diagnose_prompt', 'Diagnose Server', 'Systematic server diagnosis', 'Inspect system health, failed services, processes, ports, logs, disk and network. Prefer read-only diagnostics first and summarize evidence before proposing mutations.');
+    prompt('deploy_prompt', 'Deploy Project', 'Safe project deployment', 'Inspect the project, run tests/build, create a change snapshot, apply the smallest safe deployment steps, verify service health, and report rollback instructions.');
+    prompt('security_audit_prompt', 'Security Audit', 'Local security review', 'Audit exposed ports, permissions, secrets, services and configuration. Do not reveal secrets; report masked findings and prioritize remediation.');
+    prompt('inspect_project_prompt', 'Inspect Project', 'Developer project inspection', 'Analyze the project structure, framework, dependencies, Git state, tests and health. Return actionable findings with file paths.');
+    server.registerTool('system_resource', { description: 'Return the current system resource as structured JSON.', inputSchema: {} }, async () => { gate('system_resource'); return { content: [{ type: 'text', text: json({ hostname: os.hostname(), platform: process.platform, release: os.release(), cpus: os.cpus().length, totalMemory: os.totalmem(), freeMemory: os.freemem(), uptime: os.uptime() }) }] }; });
+}
+//# sourceMappingURL=resources-prompts.js.map

package/dist/tools/resources-prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources-prompts.js","sourceRoot":"","sources":["../../src/tools/resources-prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AAIzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,MAAM,UAAU,2BAA2B,CAAC,MAAgB,EAAC,GAAe;IAC3E,MAAM,IAAI,GAAC,CAAC,IAAW,EAAC,EAAE,CAAA,mBAAmB,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAQ,EAAC,CAAC,CAAC;IACpG,MAAM,IAAI,GAAC,CAAC,CAAS,EAAC,EAAE,CAAA,IAAI,CAAC,SAAS,CAAC,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,gBAAgB,CAAC,iBAAiB,EAAC,gBAAgB,EAAC,EAAC,WAAW,EAAC,kCAAkC,EAAC,QAAQ,EAAC,kBAAkB,EAAC,EAAC,KAAK,IAAE,EAAE,CAAA,CAAC,EAAC,QAAQ,EAAC,CAAC,EAAC,GAAG,EAAC,gBAAgB,EAAC,QAAQ,EAAC,kBAAkB,EAAC,IAAI,EAAC,IAAI,CAAC,EAAC,QAAQ,EAAC,EAAE,CAAC,QAAQ,EAAE,EAAC,QAAQ,EAAC,OAAO,CAAC,QAAQ,EAAC,OAAO,EAAC,EAAE,CAAC,OAAO,EAAE,EAAC,IAAI,EAAC,EAAE,CAAC,IAAI,EAAE,EAAC,IAAI,EAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAC,WAAW,EAAC,EAAE,CAAC,QAAQ,EAAE,EAAC,UAAU,EAAC,EAAE,CAAC,OAAO,EAAE,EAAC,MAAM,EAAC,EAAE,CAAC,MAAM,EAAE,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IACjZ,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,EAAC,kBAAkB,EAAC,EAAC,WAAW,EAAC,yCAAyC,EAAC,QAAQ,EAAC,kBAAkB,EAAC,EAAC,KAAK,IAAE,EAAE,CAAA,CAAC,EAAC,QAAQ,EAAC,CAAC,EAAC,GAAG,EAAC,kBAAkB,EAAC,QAAQ,EAAC,kBAAkB,EAAC,IAAI,EAAC,IAAI,CAAC,EAAC,QAAQ,EAAC,OAAO,CAAC,QAAQ,EAAC,GAAG,EAAC,OAAO,CAAC,GAAG,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAE,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IAChT,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,EAAC,iBAAiB,EAAC,EAAC,WAAW,EAAC,qCAAqC,EAAC,QAAQ,EAAC,kBAAkB,EAAC,EAAC,KAAK,IAAE,EAAE,CAAA,CAAC,EAAC,QAAQ,EAAC,CAAC,EAAC,GAAG,EAAC,iBAAiB,EAAC,QAAQ,EAAC,kBAAkB,EAAC,IAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IAC5P,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,EAAC,kBAAkB,EAAC,EAAC,WAAW,EAAC,iDAAiD,EAAC,QAAQ,EAAC,kBAAkB,EAAC,EAAC,KAAK,IAAE,EAAE,CAAA,CAAC,EAAC,QAAQ,EAAC,CAAC,EAAC,GAAG,EAAC,kBAAkB,EAAC,QAAQ,EAAC,kBAAkB,EAAC,IAAI,EAAC,IAAI,CAAC,EAAC,OAAO,EAAC,OAAO,EAAE,EAAC,OAAO,EAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAA,EAAE,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IACtU,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,EAAC,eAAe,EAAC,EAAC,WAAW,EAAC,qDAAqD,EAAC,QAAQ,EAAC,kBAAkB,EAAC,EAAC,KAAK,IAAE,EAAE,GAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAA,IAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO;QAAC,OAAM,EAAC,QAAQ,EAAC,CAAC,EAAC,GAAG,EAAC,eAAe,EAAC,QAAQ,EAAC,kBAAkB,EAAC,IAAI,EAAC,IAAI,CAAC,EAAE,CAAC,EAAC,CAAC,EAAC,CAAC,CAAA,MAAM,EAAC,QAAQ,EAAC,GAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAA,MAAM,KAAK,GAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA,MAAM,WAAW,GAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA,MAAM,IAAI,GAAC,KAAK,CAAC,KAAK,CAAC,EAAC,WAAW,EAAC,KAAK,EAAC,GAAG,EAAC,CAAC,CAAC,CAAA,OAAM,EAAC,QAAQ,EAAC,CAAC,EAAC,GAAG,EAAC,eAAe,EAAC,QAAQ,EAAC,kBAAkB,EAAC,IAAI,EAAC,IAAI,CAAC,IAAI,CAAC,EAAC,CAAC,EAAC,CAAC,CAAA,CAAC,CAAC,CAAC;IACzkB,MAAM,MAAM,GAAC,CAAC,IAAW,EAAC,KAAY,EAAC,WAAkB,EAAC,IAAW,EAAC,EAAE,CAAA,MAAM,CAAC,cAAc,CAAC,IAAI,EAAC,EAAC,KAAK,EAAC,WAAW,EAAC,EAAC,KAAK,IAAE,EAAE,CAAA,CAAC,EAAC,WAAW,EAAC,QAAQ,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IACrM,MAAM,CAAC,iBAAiB,EAAC,iBAAiB,EAAC,6BAA6B,EAAC,yKAAyK,CAAC,CAAC;IACpP,MAAM,CAAC,eAAe,EAAC,gBAAgB,EAAC,yBAAyB,EAAC,oKAAoK,CAAC,CAAC;IACxO,MAAM,CAAC,uBAAuB,EAAC,gBAAgB,EAAC,uBAAuB,EAAC,kJAAkJ,CAAC,CAAC;IAC5N,MAAM,CAAC,wBAAwB,EAAC,iBAAiB,EAAC,8BAA8B,EAAC,kIAAkI,CAAC,CAAC;IACrN,MAAM,CAAC,YAAY,CAAC,iBAAiB,EAAC,EAAC,WAAW,EAAC,wDAAwD,EAAC,WAAW,EAAC,EAAE,EAAC,EAAC,KAAK,IAAE,EAAE,GAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAA,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,IAAI,CAAC,EAAC,QAAQ,EAAC,EAAE,CAAC,QAAQ,EAAE,EAAC,QAAQ,EAAC,OAAO,CAAC,QAAQ,EAAC,OAAO,EAAC,EAAE,CAAC,OAAO,EAAE,EAAC,IAAI,EAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAC,WAAW,EAAC,EAAE,CAAC,QAAQ,EAAE,EAAC,UAAU,EAAC,EAAE,CAAC,OAAO,EAAE,EAAC,MAAM,EAAC,EAAE,CAAC,MAAM,EAAE,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,CAAA,CAAC,CAAC,CAAC;AAChX,CAAC"}

package/dist/tools/shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/tools/shell.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAOtD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAqG5E"}
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/tools/shell.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAOtD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAgI5E"}

package/dist/tools/shell.js

@@ -1,7 +1,9 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { z } from 'zod';
-import { assertToolPermitted } from '../core/policy.js';
+import { assertToolPermitted, assertCommandPolicy } from '../core/policy.js';
+import { AuditLog } from '../core/audit.js';
+import { requestApproval, getApproval, decideApproval, consumeApproval } from '../core/approvals.js';
 import { shellCommand, childEnv, isWindows } from '../core/platform.js';
 const exec = promisify(execFile);
 const MAX_OUTPUT = 60_000;
@@ -20,12 +22,25 @@ export function registerShellTools(server, ctx) {
             command: z.string().describe('Command line to run'),
             cwd: z.string().optional().describe('Working directory (policy-checked when local)'),
             timeout_ms: z.number().optional().default(120_000).describe('Timeout in ms (max 600000)'),
+            approval_id: z.string().optional().describe('Approval id previously approved by an authorized operator'),
         },
-    }, async ({ command, cwd, timeout_ms }) => {
+    }, async ({ command, cwd, timeout_ms, approval_id }) => {
         if (!ctx.token.shell_enabled) {
             return { content: [{ type: 'text', text: 'Shell execution is disabled for this token. Enable with `ramcp policy shell on`.' }], isError: true };
         }
         assertToolPermitted({ tool: 'run_command', scopes: ctx.token.scopes, readOnly: ctx.readOnly, policy: policy(), target: cwd });
+        const tokenId = AuditLog.fingerprint(ctx.token.token);
+        const approval = approval_id ? getApproval(approval_id, tokenId) : undefined;
+        if (ctx.token.approval_mode === 'approval-required') {
+            if (!approval || approval.status !== 'approved' || approval.command !== command || approval.cwd !== cwd) {
+                const pending = requestApproval(tokenId, command, cwd);
+                return { content: [{ type: 'text', text: `Approval required. Ask an authorized operator to approve approval_id=${pending.id}, then retry with approval_id.` }], isError: true };
+            }
+            if (!consumeApproval(approval.id, tokenId, command, cwd)) {
+                return { content: [{ type: 'text', text: 'Approval is invalid, already consumed, or does not match this exact command/cwd.' }], isError: true };
+            }
+        }
+        assertCommandPolicy({ command_allowlist: ctx.token.command_allowlist, approval_mode: 'auto' }, command, true);
         const timeout = Math.min(timeout_ms, 600_000);
         const { file, args } = shellCommand(command);
         try {
@@ -54,6 +69,20 @@ export function registerShellTools(server, ctx) {
             return { content: [{ type: 'text', text: msg.slice(0, MAX_OUTPUT) }], isError: true };
         }
     });
+    server.registerTool('approval_decide', {
+        description: 'Approve or reject a pending shell command approval request.',
+        inputSchema: { id: z.string(), approved: z.boolean() },
+    }, async ({ id, approved }) => {
+        assertToolPermitted({ tool: 'approval_decide', scopes: ctx.token.scopes, readOnly: ctx.readOnly });
+        const actorId = AuditLog.fingerprint(ctx.token.token);
+        const privileged = ctx.token.role === 'admin' || ctx.token.role === 'deployer';
+        const requesterId = privileged ? undefined : actorId;
+        const a = getApproval(id, requesterId);
+        if (!a)
+            return { content: [{ type: 'text', text: 'Approval not found or not authorized.' }], isError: true };
+        decideApproval(id, requesterId, approved, actorId);
+        return { content: [{ type: 'text', text: `Approval ${id}: ${approved ? 'approved' : 'rejected'}.` }] };
+    });
     // ---- process_list ---------------------------------------------------------
     server.registerTool('process_list', {
         description: 'List running processes with CPU/memory. Uses ps on POSIX, Get-Process on Windows.',

package/dist/tools/shell.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/tools/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGxE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACjC,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,2EAA2E;AAC3E,gEAAgE;AAChE,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,GAAgB;IACpE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;QACpB,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa;QACtC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY;QACpC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa;KACvC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,CAAC,YAAY,CAAC,aAAa,EAC/B;QACE,WAAW,EAAE,sHAAsH;QACnI,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;YACpF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;SAC1F;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE;QACrC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kFAAkF,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClJ,CAAC;QACD,mBAAmB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9H,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;gBAChD,GAAG,EAAE,GAAG,IAAI,SAAS;gBACrB,OAAO;gBACP,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;gBAC3B,GAAG,EAAE,QAAQ,EAAE;gBACf,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,IAAI,MAAM;gBAAE,GAAG,IAAI,MAAM,CAAC;YAC1B,IAAI,MAAM;gBAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;YAC9D,IAAI,CAAC,GAAG;gBAAE,GAAG,GAAG,aAAa,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACzE,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG;gBACV,CAAC,CAAC,OAAO,IAAI,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;gBAC/C,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;aAChD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACxF,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAC9E,MAAM,CAAC,YAAY,CAAC,cAAc,EAChC;QACE,WAAW,EAAE,mFAAmF;QAChG,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE;QACT,mBAAmB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC;YACH,IAAI,SAAS,EAAE,EAAE,CAAC;gBAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,YAAY,CACjC,sJAAsJ,CACvJ,CAAC;gBACF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9G,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5E,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,8BAA8B,EAAE,cAAc,CAAC,CAAC,CAAC;YAC7F,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5E,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,8BAA8B;YAC9B,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC,CAAC;gBAC7E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,+EAA+E;IAC/E,MAAM,CAAC,YAAY,CAAC,cAAc,EAChC;QACE,WAAW,EAAE,qHAAqH;QAClI,WAAW,EAAE;YACX,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SAChG;KACF,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,6CAA6C,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7G,CAAC;QACD,mBAAmB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChG,kEAAkE;QAClE,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,GAAG,eAAe,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAa,CAAC,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,MAAM,OAAO,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3E,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/tools/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGxE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACjC,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,2EAA2E;AAC3E,gEAAgE;AAChE,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,GAAgB;IACpE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;QACpB,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa;QACtC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY;QACpC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa;KACvC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,CAAC,YAAY,CAAC,aAAa,EAC/B;QACE,WAAW,EAAE,sHAAsH;QACnI,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;YACpF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YACzF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;SACzG;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,EAAE;QAClD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kFAAkF,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClJ,CAAC;QACD,mBAAmB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9H,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,mBAAmB,EAAE,CAAC;YACpD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;gBACxG,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,wEAAwE,OAAO,CAAC,EAAE,gCAAgC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAClL,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;gBACzD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kFAAkF,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAClJ,CAAC;QACH,CAAC;QACD,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9G,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;gBAChD,GAAG,EAAE,GAAG,IAAI,SAAS;gBACrB,OAAO;gBACP,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;gBAC3B,GAAG,EAAE,QAAQ,EAAE;gBACf,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,IAAI,MAAM;gBAAE,GAAG,IAAI,MAAM,CAAC;YAC1B,IAAI,MAAM;gBAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;YAC9D,IAAI,CAAC,GAAG;gBAAE,GAAG,GAAG,aAAa,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACzE,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG;gBACV,CAAC,CAAC,OAAO,IAAI,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;gBAC/C,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;aAChD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACxF,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM,CAAC,YAAY,CAAC,iBAAiB,EAAE;QACrC,WAAW,EAAE,6DAA6D;QAC1E,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE;KACvD,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC5B,mBAAmB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnG,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;QAC/E,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QACrD,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7G,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,EAAE,CAAC;IACzG,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,MAAM,CAAC,YAAY,CAAC,cAAc,EAChC;QACE,WAAW,EAAE,mFAAmF;QAChG,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE;QACT,mBAAmB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC;YACH,IAAI,SAAS,EAAE,EAAE,CAAC;gBAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,YAAY,CACjC,sJAAsJ,CACvJ,CAAC;gBACF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9G,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5E,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,8BAA8B,EAAE,cAAc,CAAC,CAAC,CAAC;YAC7F,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5E,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,8BAA8B;YAC9B,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC,CAAC;gBAC7E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,+EAA+E;IAC/E,MAAM,CAAC,YAAY,CAAC,cAAc,EAChC;QACE,WAAW,EAAE,qHAAqH;QAClI,WAAW,EAAE;YACX,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SAChG;KACF,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,6CAA6C,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7G,CAAC;QACD,mBAAmB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChG,kEAAkE;QAClE,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,GAAG,eAAe,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAa,CAAC,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,MAAM,OAAO,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3E,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/tools/transfer.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ToolContext } from '../core/context.js';
+export declare function registerTransferTools(server: McpServer, ctx: ToolContext): void;
+//# sourceMappingURL=transfer.d.ts.map

package/dist/tools/transfer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer.d.ts","sourceRoot":"","sources":["../../src/tools/transfer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItD,wBAAgB,qBAAqB,CAAC,MAAM,EAAC,SAAS,EAAC,GAAG,EAAC,WAAW,GAAE,IAAI,CAI3E"}

package/dist/tools/transfer.js

@@ -0,0 +1,14 @@
+import fs from 'node:fs/promises';
+import crypto from 'node:crypto';
+import { z } from 'zod';
+import { assertToolPermitted } from '../core/policy.js';
+const MAX = 32 * 1024 * 1024;
+export function registerTransferTools(server, ctx) {
+    const policy = () => ({ allowed_paths: ctx.token.allowed_paths, denied_paths: ctx.token.denied_paths, shell_enabled: ctx.token.shell_enabled });
+    server.registerTool('download_file', { description: 'Download a local file as base64 with size and SHA-256 metadata. Binary-safe and path-policy checked.', inputSchema: { path: z.string() } }, async ({ path }) => { assertToolPermitted({ tool: 'download_file', scopes: ctx.token.scopes, readOnly: ctx.readOnly, policy: policy(), target: path }); const st = await fs.stat(path); if (st.size > MAX)
+        return { content: [{ type: 'text', text: `File exceeds ${MAX} bytes.` }], isError: true }; const b = await fs.readFile(path); return { content: [{ type: 'text', text: JSON.stringify({ path, size: b.length, sha256: crypto.createHash('sha256').update(b).digest('hex'), encoding: 'base64', data: b.toString('base64') }) }] }; });
+    server.registerTool('upload_file', { description: 'Upload base64 data to a local file. Binary-safe, size-limited and path-policy checked.', inputSchema: { path: z.string(), data: z.string().describe('Base64-encoded file content'), sha256: z.string().optional() } }, async ({ path, data, sha256 }) => { assertToolPermitted({ tool: 'upload_file', scopes: ctx.token.scopes, readOnly: ctx.readOnly, policy: policy(), target: path }); const b = Buffer.from(data, 'base64'); if (b.length > MAX)
+        return { content: [{ type: 'text', text: `Payload exceeds ${MAX} bytes.` }], isError: true }; const actual = crypto.createHash('sha256').update(b).digest('hex'); if (sha256 && sha256 !== actual)
+        return { content: [{ type: 'text', text: 'SHA-256 mismatch; file was not written.' }], isError: true }; await fs.writeFile(path, b, { mode: 0o600 }); return { content: [{ type: 'text', text: JSON.stringify({ path, size: b.length, sha256: actual }) }] }; });
+}
+//# sourceMappingURL=transfer.js.map

package/dist/tools/transfer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer.js","sourceRoot":"","sources":["../../src/tools/transfer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,mBAAmB,EAAiB,MAAM,mBAAmB,CAAC;AAEvE,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7B,MAAM,UAAU,qBAAqB,CAAC,MAAgB,EAAC,GAAe;IACrE,MAAM,MAAM,GAAC,GAAE,EAAE,CAAA,CAAC,EAAC,aAAa,EAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAC,YAAY,EAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAC,aAAa,EAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAC,CAAC,CAAC;IACrI,MAAM,CAAC,YAAY,CAAC,eAAe,EAAC,EAAC,WAAW,EAAC,sGAAsG,EAAC,WAAW,EAAC,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,EAAC,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,EAAC,EAAE,GAAC,mBAAmB,CAAC,EAAC,IAAI,EAAC,eAAe,EAAC,MAAM,EAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAQ,EAAC,MAAM,EAAC,MAAM,EAAE,EAAC,MAAM,EAAC,IAAI,EAAC,CAAC,CAAC,CAAA,MAAM,EAAE,GAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,IAAG,EAAE,CAAC,IAAI,GAAC,GAAG;QAAC,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,gBAAgB,GAAG,SAAS,EAAC,CAAC,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC,CAAA,MAAM,CAAC,GAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAC,MAAM,EAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAC,QAAQ,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,CAAA,CAAC,CAAC,CAAC;IAC5oB,MAAM,CAAC,YAAY,CAAC,aAAa,EAAC,EAAC,WAAW,EAAC,wFAAwF,EAAC,WAAW,EAAC,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAC,EAAC,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,MAAM,EAAC,EAAC,EAAE,GAAC,mBAAmB,CAAC,EAAC,IAAI,EAAC,aAAa,EAAC,MAAM,EAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAQ,EAAC,MAAM,EAAC,MAAM,EAAE,EAAC,MAAM,EAAC,IAAI,EAAC,CAAC,CAAC,CAAA,MAAM,CAAC,GAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAC,QAAQ,CAAC,CAAC,CAAA,IAAG,CAAC,CAAC,MAAM,GAAC,GAAG;QAAC,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,mBAAmB,GAAG,SAAS,EAAC,CAAC,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC,CAAA,MAAM,MAAM,GAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA,IAAG,MAAM,IAAE,MAAM,KAAG,MAAM;QAAC,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,yCAAyC,EAAC,CAAC,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC,CAAA,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAC,CAAC,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC,CAAA,OAAM,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,CAAA,CAAC,CAAC,CAAC;AAC70B,CAAC"}

package/docs/ai/security-model.md

@@ -112,3 +112,10 @@ pass them as `target:` to the gate; (4) think about injection (quotes,
 metacharacters, second-order effects) and add a guard, not a regex hope;
 (5) never log secrets; the audit wrapper redacts args but your *output* is
 on you.
+
+
+## Approval security
+
+Approval records are durable and protected by a filesystem lock. A granted approval is cryptographically unrelated to the shell command, so the implementation binds the approval to the exact command and working directory and atomically marks it consumed before execution. This prevents approval replay and command substitution.
+
+Plugins are a trusted in-process extension mechanism. Entrypoints cannot escape their plugin directory, but JavaScript executed by an installed trusted plugin has the gateway process privileges; plugin installation is therefore an administrative trust boundary, not a sandbox.

package/docs/ai/tools-and-cli.md

@@ -105,6 +105,29 @@ Snapshot/rollback are in `MUTATING_TOOLS`.
 `list_allowed_paths` · `allow_path` · `deny_path` · `shell_enabled`. Mutations
 persist via `saveConfig` and hot-reload; they cannot touch other tokens.
 
+## New operational tools
+
+### Jobs / workers
+- `run_background` — asynchronous shell execution through a bounded worker pool
+- `run_parallel` — queue multiple commands for bounded parallel execution
+- `job_status` / `job_output` / `job_list` / `job_cancel` — inspect and control jobs
+
+### Transfers / safety
+- `upload_file` / `download_file` — binary-safe transfer with SHA-256
+- `approval_decide` — approve or reject sensitive shell operations
+- `change_set_begin` / `change_set_add` / `change_set_status` / `change_set_commit` / `change_set_rollback` — managed filesystem change sets; pass `change_set_id` to `write_file`, `edit_file`, and `delete_path` to capture mutations automatically. Rollback tracks missing paths (created later), restores deleted/modified paths, and can resume after partial failure.
+
+### Diagnostics / data
+- `system_diagnostics` / `diagnose_service`
+- `health_watch` / `health_status` / `health_stop` — persistent application-level watchers with single-process ownership and restart recovery.
+- `health_watch` / `health_status` / `health_stop`
+- `database_query` / `database_schema`
+
+### MCP context / extensibility
+- Resources: system, services, network, projects and audit
+- Prompts: diagnose, deploy, security audit and project inspection
+- `plugin_list` / `plugin_install` / `plugin_remove`
+
 ## CLI (`ramcp`)
 
 | Command | Subcommands / flags | Notes |
@@ -150,3 +173,12 @@ persist via `saveConfig` and hot-reload; they cannot touch other tokens.
 Env overrides (tests, minimal deploys): `RAMCP_TOKEN RAMCP_HOST RAMCP_PORT
 RAMCP_PUBLIC_HOST RAMCP_SHELL RAMCP_ALLOWED_PATHS RAMCP_DENIED_PATHS`
 (legacy `DANA_*` still honored). `SSH_BIN` existed for fleet tests — gone.
+
+
+### Approvals
+
+Shell approvals are persisted under the data directory, survive gateway restarts, are bound to the exact command and working directory, record the approving token fingerprint, and are atomically consumed after one execution. An approval cannot be reused for another command.
+
+### Plugins
+
+Installed plugins must explicitly set `trusted: true`. Plugin entrypoints are constrained to remain inside their own plugin directory. Plugins are intentionally a trusted in-process extension point, not a security sandbox; do not install untrusted code.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "remote-access-mcp",
-  "version": "3.0.2",
+  "version": "3.1.1",
   "description": "Turn any machine into a secure AI-agent-accessible endpoint via MCP. Connect ChatGPT, Claude, Grok, and other MCP clients to files, shell, git, services, and more.",
   "type": "module",
   "bin": {
@@ -82,5 +82,8 @@
     "better-sqlite3@12.11.1": true,
     "esbuild@0.28.2": true,
     "esbuild@0.21.5": true
+  },
+  "overrides": {
+    "qs": ">=6.16.0"
   }
 }