starmux 0.13.0 → 0.14.0

package/dist/src/invocation.js

@@ -61,7 +61,7 @@ export function createInvocationPipeline(options) {
         catch (error) {
             const reason = errorCode(error) || 'DENY_RULE_CHECK_FAILED';
             audit({ event: 'TOOL_EXPLICITLY_DENIED', requestId: request.requestId, tool: invocation.name, reason });
-            return { isError: true, content: [{ type: 'text', text: reason + ': Review filters on the Mac owner Dashboard /filters' }] };
+            return { isError: true, content: [{ type: 'text', text: reason + ': Review filters on the local owner Dashboard /filters' }] };
         }
         const result = await options.dispatch(invocation, request);
         for (const hook of hooks) {
@@ -77,4 +77,3 @@ export function createInvocationPipeline(options) {
         return result; // original MCP result, including unknown extension fields
     };
 }
-//# sourceMappingURL=invocation.js.map

package/dist/src/local-desktop-read-probe.js

@@ -1,20 +1,13 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { windows, ownedByUser, childEnvKeys, systemNameCommand, commandOptions } from "./platform.js";
+import { windows, childEnvKeys } from "./platform.js";
 import { toolResult } from "./mcp-results.js";
-import { desktopCommanderEntry, fixtureRoot, packageRoot } from "./runtime-paths.js";
-import { errorCode } from "./validation.js";
-// Desktop Commander stdio MCP client for fixture tests and the private P1 bridge.
-// NOT imported into public P0 src/server.mjs; only explicitly approved operations.
-// This adapter exposes no arbitrary callTool capability.
+import { desktopCommanderEntry } from "./runtime-paths.js";
+// Embedded Desktop Commander transport. The dispatcher authorizes every invocation.
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { access, constants, lstat, readFile } from "node:fs/promises";
-import path from "node:path";
+import { access, constants } from "node:fs/promises";
 import { sandboxedDesktopSpawn } from "./home-write-sandbox.js";
-import { resolveScopedRead } from "./read-scope.js";
-const PROJECT = packageRoot;
-const FIXTURES = fixtureRoot;
 const DC_BIN = desktopCommanderEntry;
 // The embedded upstream must not launch browser onboarding on every Gateway
 // connection or after test/dev child restarts. Supported upstream CLI option.
@@ -22,8 +15,6 @@ export function desktopCommanderSpawnArgs(binary = DC_BIN) {
     return [binary, "--no-onboarding"];
 }
 const EXPOSED_LOCAL_TOOLS = Object.freeze(["read_file"]);
-const MAX_READ = 4096;
-const MAX_PROJECT_README_BYTES = 16384; // Project README may grow; synthetic fixture limit remains 4096.
 function sanitizedEnv() {
     const allow = childEnvKeys;
     const env = {};
@@ -67,7 +58,7 @@ export class LocalDesktopReadProbe {
         const transport = new StdioClientTransport({
             ...executable, env, stderr: "pipe"
         });
-        const client = new Client({ name: "mac-mcp-local-read-probe", version: "0.1.0" }, { capabilities: {} });
+        const client = new Client({ name: "starmux-local-read-probe", version: "0.1.0" }, { capabilities: {} });
         try {
             await client.connect(transport);
             const tools = await client.listTools();
@@ -113,77 +104,6 @@ export class LocalDesktopReadProbe {
             throw new Error("Unknown upstream tool");
         return toolResult(await this.#client.callTool(invocation));
     }
-    async callApprovedRead(pathToFile) {
-        if (!this.#client)
-            throw new Error("Not connected");
-        const { absolutePath } = await resolveScopedRead({
-            root: FIXTURES, relativePath: pathToFile,
-            allowedFiles: ["p1-fixture.txt", "dc-bridge-canary.txt"], maxBytes: MAX_READ
-        });
-        return toolResult(await this.#client.callTool({ name: "read_file", arguments: { path: absolutePath } }));
-    }
-    async callApprovedProjectRead() {
-        if (!this.#client)
-            throw new Error("Not connected");
-        const candidate = path.join(PROJECT, "README.md");
-        const st = await lstat(candidate);
-        if (!st.isFile() || st.isSymbolicLink() || st.nlink !== 1 ||
-            !ownedByUser(candidate, st) || st.size > MAX_PROJECT_README_BYTES)
-            throw new Error("Project file failed read approval");
-        return toolResult(await this.#client.callTool({ name: "read_file", arguments: { path: candidate } }));
-    }
-    async callApprovedCanaryWrite(content) {
-        if (!this.#client)
-            throw new Error("Not connected");
-        if (typeof content !== "string" || Buffer.byteLength(content) > 256)
-            throw new Error("Canary content exceeds approved bound");
-        const root = await lstat(FIXTURES);
-        if (!root.isDirectory() || root.isSymbolicLink() ||
-            !ownedByUser(FIXTURES, root))
-            throw new Error("Fixture directory denied");
-        const candidate = path.join(FIXTURES, "dc-bridge-canary.txt");
-        const existing = await lstat(candidate).catch(e => {
-            if (errorCode(e) === "ENOENT")
-                return null;
-            throw e;
-        });
-        if (existing && (!existing.isFile() || existing.isSymbolicLink() ||
-            existing.nlink !== 1 || !ownedByUser(candidate, existing)))
-            throw new Error("Canary target denied");
-        return toolResult(await this.#client.callTool({ name: "write_file", arguments: {
-                path: candidate, content, mode: "rewrite"
-            } }));
-    }
-    async callApprovedSystemName() {
-        if (!this.#client)
-            throw new Error("Not connected");
-        return toolResult(await this.#client.callTool({ name: "start_process", arguments: {
-                ...commandOptions(systemNameCommand), timeout_ms: 3000
-            } }));
-    }
-    async readFixture(basename = "p1-fixture.txt") {
-        if (!this.#client)
-            throw new Error("Not connected");
-        if (basename !== "p1-fixture.txt")
-            throw new Error("Only the synthetic fixture is approved");
-        const { absolutePath: candidate } = await resolveScopedRead({
-            root: FIXTURES, relativePath: basename,
-            allowedFiles: ["p1-fixture.txt"], maxBytes: MAX_READ
-        });
-        const expected = await readFile(candidate, "utf8");
-        const result = toolResult(await this.#client.callTool({
-            name: "read_file",
-            arguments: { path: candidate }
-        }));
-        if (result.isError)
-            throw new Error("Upstream read_file returned error");
-        const combined = (result.content || []).filter(x => x.type === "text").map(x => x.text).join("\n");
-        if (!combined.includes(expected.trim())) {
-            throw new Error("Unexpected tool result; refusing to display private content");
-        }
-        return { ok: true, fixture: basename, bytes: Buffer.byteLength(expected),
-            allowedToolNames: this.allowedToolNames };
-    }
     async close() {
         const client = this.#client;
         const pid = this.#transport?.pid;
@@ -197,6 +117,3 @@ export class LocalDesktopReadProbe {
             await client.close().catch(() => { });
     }
 }
-// No general-purpose remote forwarding. All interactions live inside this
-// explicitly opted-in local test, not the public HTTP MCP request handlers.
-//# sourceMappingURL=local-desktop-read-probe.js.map

package/dist/src/managed-workspace-policy.js

@@ -1,11 +1,12 @@
 import { windows, commandOptions, diskUsageCommand } from "./platform.js";
-import { GatewayError, isInteger, isSafeInteger } from "./validation.js";
+import { GatewayError, errorCode, isInteger, isSafeInteger } from "./validation.js";
 // Release 1 broad read-only inventory, narrow independent write grants.
 // No OS sandbox claim: trusted-project Shell remains same-UID privileged.
 import { lstat, realpath } from "node:fs/promises";
 import path from "node:path";
 import { createProjectPolicy } from "./project-workspace-policy.js";
 import { isInside } from "./workspace-grants.js";
+import { prepareBatchRead } from "./batch-read-policy.js";
 function fail(reason) { const e = new GatewayError(reason); throw e; }
 ;
 const fileTools = new Map([
@@ -29,9 +30,41 @@ async function broadPath(raw, kind) {
         path.normalize(raw) !== raw)
         fail("INVENTORY_ABSOLUTE_PATH_REQUIRED");
     safeSegments(raw);
-    const canonical = await realpath(raw);
+    // A read target may not exist yet. Resolve its nearest existing ancestor so
+    // the caller can still enforce grants on the canonical path before forwarding.
+    let current = raw, canonical;
+    const suffix = [];
+    for (;;) {
+        try {
+            canonical = path.join(await realpath(current), ...suffix.slice().reverse());
+            break;
+        }
+        catch (error) {
+            if (kind !== "file" || errorCode(error) !== "ENOENT")
+                throw error;
+            const entry = await lstat(current).catch(e => {
+                if (errorCode(e) === "ENOENT")
+                    return null;
+                throw e;
+            });
+            // Do not treat a dangling symlink as an ordinary missing path.
+            if (entry?.isSymbolicLink())
+                fail("INVENTORY_SYMLINK_DENIED");
+            const parent = path.dirname(current);
+            if (parent === current)
+                throw error;
+            suffix.push(path.basename(current));
+            current = parent;
+        }
+    }
     safeSegments(canonical);
-    const st = await lstat(canonical);
+    const st = await lstat(canonical).catch(error => {
+        if (kind === "file" && errorCode(error) === "ENOENT")
+            return null;
+        throw error;
+    });
+    if (!st)
+        return canonical;
     if (st.isSymbolicLink())
         fail("INVENTORY_SYMLINK_DENIED");
     if (kind === "file" && (!st.isFile() || st.nlink !== 1 || st.size > 1024 * 1024))
@@ -96,6 +129,8 @@ export function createManagedWorkspacePolicy({ basePolicy, grants }) {
         return { kind: "denied" };
     }
     async function prepare(name, args = {}) {
+        if (name === "read_multiple_files")
+            return prepareBatchRead(args, prepare);
         const target = await locate(name, args);
         if (!target)
             return basePolicy.prepare(name, args);
@@ -162,4 +197,3 @@ export function createManagedWorkspacePolicy({ basePolicy, grants }) {
         grantsSnapshot: () => grants.snapshot()
     });
 }
-//# sourceMappingURL=managed-workspace-policy.js.map

package/dist/src/mcp-results.js

@@ -9,4 +9,3 @@ function assertToolResult(value) {
     if (!checked.success)
         throw checked.error;
 }
-//# sourceMappingURL=mcp-results.js.map

package/dist/src/mcp-upstream-router.js

@@ -78,4 +78,3 @@ export function createMCPUpstreamRouter({ routes, defaultRoute = "desktop" }) {
         }
     });
 }
-//# sourceMappingURL=mcp-upstream-router.js.map

package/dist/src/oauth-keycloak.js

@@ -23,4 +23,3 @@ export function keycloakRealm(resource, callback, development = false) {
                 attributes: { 'pkce.code.challenge.method': 'S256' }, optionalClientScopes: ['gateway:access'], defaultClientScopes: [] }]
     };
 }
-//# sourceMappingURL=oauth-keycloak.js.map

package/dist/src/oauth-resource.js

@@ -156,4 +156,3 @@ export function createOAuthVerifier(c, key) {
             clientId: c.clientId, scopes };
     };
 }
-//# sourceMappingURL=oauth-resource.js.map

package/dist/src/ops-dashboard.js

@@ -1,129 +1,7 @@
-import { gitBinary } from "./platform.js";
-import { packageRoot } from "./runtime-paths.js";
-import { errorCode } from "./validation.js";
-// Read-only, loopback-only Mac MCP Gateway operations dashboard.
-// No service control, arbitrary command, file content, credentials or extra port.
-import { execFile } from "node:child_process";
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { promisify } from "node:util";
-const execute = promisify(execFile);
-const root = packageRoot;
-const home = process.env.HOME;
-export const MODULES = Object.freeze([
-    { id: "workspace", label: "Project Workspace Gateway", service: "ai.home.mac-mcp-project-workspace", ports: [8793], phase: "active", role: "当前 ChatGPT 文件读写编辑服务", transport: "loopback" },
-    { id: "tunnel", label: "OpenAI Secure MCP Tunnel", service: "ai.home.mac-mcp-tunnel", ports: [18891], phase: "active", role: "云端出站接入；18891 为本地管理端口", transport: "outbound" },
-    { id: "dc-standby", label: "Desktop Commander P1 Bridge", service: "ai.home.mac-mcp-dc-bridge", ports: [8792], phase: "standby", role: "已验收旧版本、可回滚", transport: "loopback" },
-    { id: "p0", label: "Gateway P0 / health_check", service: "ai.home.mac-mcp-gateway-p0", ports: [8787], phase: "legacy", role: "历史 P0，仅健康检查", transport: "loopback" },
-    { id: "canary", label: "Synthetic Canary", service: "ai.home.mac-mcp-private-pilot", ports: [8790], phase: "paused", role: "历史合成读写测试；冷备份", transport: "loopback" },
-    { id: "caddy", label: "Caddy / Direct URL HTTPS", service: "ai.home.mac-mcp-caddy", ports: [80, 443], phase: "paused", role: "未来公网 URL 直连；保留证书与配置", transport: "inbound" },
-    { id: "uid450", label: "UID450 Isolated Worker v2", service: "ai.home.mac-mcp-worker-v2", ports: [], phase: "research", role: "系统级 Unix Socket Worker；不在当前 DC 主链", transport: "unix" }
-]);
-const env = process.env;
-async function cmd(exe, args) {
-    try {
-        const v = await execute(exe, args, { timeout: 3000, maxBuffer: 130000, env });
-        return { ok: true, stdout: v.stdout };
-    }
-    catch (e) {
-        return { ok: false, error: errorCode(e) === "ETIMEDOUT" ? "timeout" : "unavailable" };
-    }
-}
-function launched(stdout) {
-    return new Map(stdout.split("\n").map(line => line.trim().split(/\s+/))
-        .filter(p => p.length >= 3 && p[2]?.startsWith("ai.home.mac-mcp"))
-        .map(p => [p[2], { pid: /^\d+$/.test(p[0] ?? "") ? Number(p[0]) : null, lastExit: p[1] }]));
-}
-function disabledLabels(stdout) {
-    const names = new Set();
-    for (const m of stdout.matchAll(/"(ai\.home\.mac-mcp-[^"]+)"\s*=>\s*disabled/g))
-        names.add(m[1]);
-    return names;
-}
-function listening(stdout) {
-    const known = new Set(MODULES.flatMap(x => x.ports));
-    const ports = new Map();
-    for (const line of stdout.split("\n")) {
-        const cols = line.trim().split(/\s+/);
-        const match = line.match(/TCP\s+(\S+):(\d+)\s+\(LISTEN\)/);
-        if (!match)
-            continue;
-        const port = Number(match[2]);
-        if (known.has(port))
-            ports.set(port, { port, address: match[1], process: cols[0],
-                pid: /^\d+$/.test(cols[1] ?? "") ? Number(cols[1]) : null });
-    }
-    return ports;
-}
-function tunnelTarget(xml) {
-    // Only classify known filenames; never return full plist, identity or tokens.
-    for (const [file, target] of [
-        ["run_tunnel_workspace.py", "8793 · Project Workspace"],
-        ["run_tunnel_dc_bridge.py", "8792 · DC Standby"],
-        ["run_tunnel_pilot.py", "8790 · Synthetic Canary"],
-        ["run_tunnel.py", "8787 · P0"]
-    ])
-        if (xml.includes(file + "</string>"))
-            return target;
-    return "unknown (inspect LaunchAgent)";
-}
-async function projectGit(at) {
-    const r = await cmd(gitBinary, ["-C", at, "status", "--porcelain=v1"]);
-    const br = await cmd(gitBinary, ["-C", at, "branch", "--show-current"]);
-    const h = await cmd(gitBinary, ["-C", at, "rev-parse", "--short", "HEAD"]);
-    return { branch: br.ok ? br.stdout.trim() : "unavailable",
-        commit: h.ok ? h.stdout.trim() : "unavailable",
-        dirtyCount: r.ok ? r.stdout.split("\n").filter(Boolean).length : null };
-}
 export async function collectOperationsSnapshot() {
-    if (process.platform !== "darwin" || process.env.MAC_MCP_INSTANCE_ID)
-        return { capturedAt: new Date().toISOString(), host: process.platform + " local (loopback only)", mode: "read-only", tunnelBackend: "not verified", modules: [], git: await projectGit(root), workspaceGit: await projectGit(process.env.MAC_MCP_PROJECT_ROOT || root), errors: [], milestones: [] };
-    const uid = process.getuid?.();
-    const [jobs, disables, listeners, worker, git, plist] = await Promise.all([
-        cmd("/bin/launchctl", ["list"]),
-        cmd("/bin/launchctl", ["print-disabled", "gui/" + uid]),
-        cmd("/usr/sbin/lsof", ["-nP", "-iTCP", "-sTCP:LISTEN"]),
-        cmd("/bin/launchctl", ["print", "system/ai.home.mac-mcp-worker-v2"]),
-        projectGit(root),
-        readFile(path.join(home || "/", "Library/LaunchAgents/ai.home.mac-mcp-tunnel.plist"), "utf8")
-            .then(x => ({ ok: true, text: x })).catch(() => ({ ok: false, text: "" }))
-    ]);
-    const active = jobs.ok ? launched(jobs.stdout) : new Map();
-    const disabled = disables.ok ? disabledLabels(disables.stdout) : new Set();
-    const ports = listeners.ok ? listening(listeners.stdout) : new Map();
-    const modules = MODULES.map(m => {
-        const status = m.id === "uid450" ?
-            (worker.ok ? /state = running/.test(worker.stdout) ? "running" : "stopped" : "unknown") :
-            (!jobs.ok ? "unknown" : active.has(m.service) ? "running" :
-                disabled.has(m.service) ? "disabled" : "stopped");
-        const occupied = m.ports.map(p => ports.get(p)).filter((x) => x !== undefined);
-        const ready = status === "running" && (m.ports.length === 0 ||
-            occupied.length > 0);
-        return { ...m, status, ready, pid: m.id === "uid450" ?
-                Number(worker.stdout?.match(/pid = (\d+)/)?.[1]) || null :
-                active.get(m.service)?.pid || null, listeners: occupied };
-    });
-    const workspaceGit = await projectGit(process.env.MAC_MCP_PROJECT_ROOT || root);
-    const errors = [["launchctl", jobs], ["disabled", disables],
-        ["lsof", listeners], ["system-worker", worker], ["Tunnel plist", plist]]
-        .filter(([, value]) => !value.ok).map(([name]) => name + " unavailable");
-    return { capturedAt: new Date().toISOString(), host: "Mac local (loopback only)",
-        mode: "read-only", tunnelBackend: plist.ok ? tunnelTarget(plist.text) : "unknown",
-        modules, git, workspaceGit, errors,
-        milestones: [
-            { name: "P2 ChatGPT Workspace", status: "accepted", detail: "7/7 real DC calls; read/write/edit and .git denial" },
-            { name: "P3 Operations Dashboard", status: "active", detail: "Current service/port monitor on existing 8793" },
-            { name: "P3 Development Workflow", status: "limited-live", detail: "Git status / diff / npm smoke via real DC; Git commit approval pending" },
-            { name: "Direct URL deployment", status: "paused", detail: "Caddy disabled; HTTP ingress not public" }
-        ] };
+    return { capturedAt: new Date().toISOString(), host: process.platform, architecture: process.arch, node: process.version, pid: process.pid };
 }
 const esc = (x) => String(x ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
-function stateLabel(x) {
-    return { running: "运行中", disabled: "已禁用", stopped: "已停止", unknown: "未能确定" }[x] || x;
-}
-function phaseLabel(x) {
-    return { active: "主线", standby: "回退", legacy: "历史", paused: "暂停", research: "研究" }[x] || x;
-}
 export function renderOperationsHtml(data) {
     if (data.instance) {
         const i = data.instance;
@@ -134,61 +12,7 @@ export function renderOperationsHtml(data) {
       <section><h2>Manage this instance</h2><nav><a href="/access">Credentials and OAuth sessions</a>${data.permissionManagementEnabled ? '<a href="/permissions">Workspace permissions</a>' : ''}${data.denyRuleManagementEnabled ? '<a href="/filters">Tool and directory filters</a>' : ''}</nav><p>Use the App or CLI to edit configuration, apply changes, inspect logs or stop this instance.</p></section>
       <section><h2>Additional upstreams</h2>${(data.configuredUpstreams ?? []).map(u => `<p>${esc(u.id)} · ${esc(u.status)} · ${u.toolCount} tools</p>`).join('') || '<p>No additional upstreams configured.</p>'}</section><small>Owner-local management · <a href="/dashboard.json">JSON status</a></small></main></body></html>`;
     }
-    const active = data.modules.filter(x => x.status === "running").length;
-    const livePorts = data.modules.flatMap(x => x.listeners).map(x => x.port);
-    const expected = data.modules.filter(x => x.phase === "active" && x.status !== "running");
-    const tr = data.modules.map(m => `<tr><td><strong>${esc(m.label)}</strong><small>${esc(m.role)}</small></td><td><span class="pill ${esc(m.status)}">${esc(stateLabel(m.status))}</span></td><td><span class="phase">${esc(phaseLabel(m.phase))}</span></td><td class="mono">${esc(m.ports.length ? m.ports.join(" / ") : "Unix Socket")}</td><td class="mono">${esc(m.listeners.length ? m.listeners.map(x => x.port + " · PID " + x.pid).join(", ") : m.status === "running" ? "-" : "未监听")}</td></tr>`).join("");
-    const additional = data.configuredUpstreams || [];
-    const upstreamRows = additional.map(u => "<tr><td><strong>" + esc(u.id) + "</strong></td><td>" +
-        esc(u.status) + "</td><td>" + esc(u.toolCount) + "</td><td>" +
-        esc(u.lastError || "—") + "</td></tr>").join("");
-    const upstreamPanel = additional.length ?
-        '<section class="panel"><h2>Configured MCP Upstreams</h2><table><thead><tr><th>上游</th><th>当前状态</th><th>已发现工具</th><th>错误代码</th></tr></thead><tbody>' + upstreamRows + '</tbody></table></section>' : '';
-    const milestones = data.milestones.map(x => `<li><span class="step">${esc(x.status)}</span><div><b>${esc(x.name)}</b><p>${esc(x.detail)}</p></div></li>`).join("");
-    const messages = data.errors.length ? [...data.errors] : [];
-    if (expected.length)
-        messages.push(expected.length + " 个主线服务不在运行");
-    return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="refresh" content="25"><title>Starmux · Operations</title><style>
-  :root{color-scheme:light;font-family:system-ui,-apple-system,"PingFang SC","Microsoft Yahei",sans-serif}
-  *{box-sizing:border-box}body{margin:0;background:#f4f7fb;color:#142138}
-  main{max-width:1220px;margin:0 auto;padding:34px 25px 64px}
-  header{display:flex;align-items:flex-end;justify-content:space-between;gap:22px;margin-bottom:27px;flex-wrap:wrap}
-  h1{font-size:26px;margin:0 0 8px}h2{font-size:16px;margin:0 0 17px}p{line-height:1.55}
-  .subtitle{color:#67748b;margin:0}.time{color:#697890;font-size:12px}
-  .stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:14px;margin:0 0 24px}
-  .stat,.panel{background:white;border:1px solid #e0e7f0;border-radius:13px;padding:18px}
-  .stat small{color:#6b7b93;display:block;margin-bottom:9px}.stat strong{font-size:23px}
-  .stat strong.short{font-size:16px}.status-good{color:#137a53}
-  .grid{display:grid;grid-template-columns:2fr 1fr;gap:18px}.panel{margin-bottom:18px;overflow:auto}
-  table{border-collapse:collapse;width:100%;font-size:13px}th{text-align:left;background:#f7f9fc;color:#687991;font-weight:600}
-  td,th{padding:13px 11px;border-bottom:1px solid #e9eef6;vertical-align:middle}tr:last-child td{border:0}
-  td small{display:block;color:#718096;margin-top:5px}.pill{padding:5px 9px;border-radius:8px;background:#f2f4f7;font-size:12px;white-space:nowrap}
-  .pill.running{color:#0c7451;background:#ddf6e9}.pill.disabled{color:#9a5409;background:#fff1d9}
-  .pill.unknown{color:#aa251b;background:#ffefee}.phase{font-size:12px;color:#62728a}
-  .mono{font-family:ui-monospace,SFMono-Regular,Consolas,monospace;font-size:12px;white-space:nowrap}
-  ul{list-style:none;margin:0;padding:0}li{display:flex;gap:12px;padding:0 0 20px}li:last-child{padding-bottom:0}
-  li p{margin:5px 0 0;color:#718096;font-size:12px}
-  .step{background:#e9f0ff;color:#2755ad;border-radius:6px;padding:6px;align-self:flex-start;text-transform:uppercase;font-size:10px}
-  .notice{border-left:3px solid #7598d6;background:#f0f5ff;padding:11px;color:#425b88;font-size:12px;margin-top:20px}
-  footer{color:#8291a3;font-size:12px;padding:10px}
-  @media(max-width:950px){.stats{grid-template-columns:repeat(2,1fr)}.grid{grid-template-columns:1fr}}
-  @media(max-width:560px){main{padding:19px 10px}.stats{grid-template-columns:1fr 1fr}th,td{padding:10px 7px}}
-  </style></head><body><main><header><div><h1>Starmux <span style="color:#4777c6">/ Operations</span></h1><p class="subtitle">运行资产 · 端口占用 · 开发里程碑 · 双入口状态</p></div><div class="time">采样 ${esc(data.capturedAt)}<br>本机只读 · 每 25 秒刷新</div></header>
-  <section class="stats"><div class="stat"><small>当前在线服务</small><strong class="status-good">${active} / ${data.modules.length}</strong></div>
-  <div class="stat"><small>正在监听的项目端口</small><strong>${new Set(livePorts).size}</strong></div>
-  <div class="stat"><small>Private Tunnel 目标</small><strong class="short">${esc(data.tunnelBackend)}</strong></div>
-  <div class="stat"><small>正在运行的代码</small><strong class="short">${esc(data.git.branch)} · ${esc(data.git.commit)}</strong><small>${data.git.dirtyCount === null ? "状态未知" : data.git.dirtyCount + " 个未提交变更"}</small></div>
-  <div class="stat"><small>实际授权项目 Git</small><strong class="short">${esc(data.workspaceGit.branch)} · ${esc(data.workspaceGit.commit)}</strong><small>${data.workspaceGit.dirtyCount === null ? "状态未知" : data.workspaceGit.dirtyCount + " 个未提交变更"}</small></div></section>
-  <div class="grid"><section class="panel"><h2>服务运行清单</h2><table><thead><tr><th>模块</th><th>系统状态</th><th>研发定位</th><th>登记端口</th><th>实际监听</th></tr></thead><tbody>${tr}</tbody></table></section>
-  <section class="panel"><h2>里程碑与开发进度</h2><ul>${milestones}</ul><div class="notice">该面板只观察，不执行任何启动、停用、Git、Shell 命令。全量 DC 工具可发现 ≠ 全部已授权。</div></section></div>
-  ${upstreamPanel}
-  ${data.denyRuleManagementEnabled ? '<section class="panel"><h2>Tool Filters · Explicit Deny</h2><p>所有上游 MCP 工具默认允许。所有者可以禁用指定工具或添加非沙箱型目录过滤。<a href="/filters">管理黑名单</a></p></section>' : ''}
-  ${data.permissionManagementEnabled ? '<section class="panel"><h2>Workspace Permissions</h2><p>' +
-        (data.nativeAccessEnabled ? '当前为可信开发原生透传：Home/自定义目录授权开关不限制原生文件及 Shell 工具；由本地 Desktop Commander 与 macOS 用户权限控制。' : '当前支持 Home 与 Home 外只读扫描、自定义目录读写授权。') +
-        ' <a href="/permissions">查看目录授权与说明</a></p></section>' : ''}
-  ${messages.length ? `<section class="panel"><h2>采集警告</h2><p>${esc(messages.join("; "))}</p></section>` : ""}
-  <section><h2>Access control</h2><p><a href="/access">Manage authentication and client credentials</a></p><p>Credentials use the owner permission configuration. Network access and tool permissions are managed separately.</p></section>
-  <footer>JSON 数据接口：/dashboard.json · 不另占用端口 · 127.0.0.1 本机访问</footer></main></body></html>`;
+    return '<!doctype html><html lang="en"><meta charset="utf-8"><title>Starmux</title><body><h1>Starmux</h1><p>No instance context is available.</p></body></html>';
 }
 export const dashboardHeaders = Object.freeze({
     "cache-control": "no-store", "x-content-type-options": "nosniff",
@@ -197,4 +21,3 @@ export const dashboardHeaders = Object.freeze({
 export function instancePage(html, name, id) {
     return id ? html.replace(/<body([^>]*)>/, `<body$1><aside style="padding:12px 24px;border-bottom:1px solid #ddd">Gateway instance: <strong>${esc(name ?? id)}</strong> · <small>${esc(id)}</small> · <a href="/dashboard">Overview</a></aside>`) : html;
 }
-//# sourceMappingURL=ops-dashboard.js.map

package/dist/src/permissions-dashboard.js

@@ -29,13 +29,13 @@ export function renderPermissionDashboard({ project, home, config, warning = "",
         'input,select,button{font:inherit;padding:6px;margin:4px}input[name=target]{width:90%;max-width:550px}' +
         'small{display:block;color:#657083}code{overflow-wrap:anywhere}button{cursor:pointer}</style></head><body>' +
         '<h1>Starmux · 目录授权</h1>' +
-        '<p>本页在 Mac 本机管理 Gateway 权限。远程 AI 不可自行增加权限。' +
+        '<p>本页在本机管理 Gateway 权限。远程 AI 不可自行增加权限。' +
         '增加或撤销授权后，下一次工具调用立即使用新权限。</p>' +
         (warning ? '<section role="alert">' + e(warning) + '</section>' : "") +
         (nativeAccessEnabled ? '<section role="alert"><h2>可信开发模式 · 完整本地执行权限</h2>' +
             '<p>此设备所有者启用了原生 Desktop Commander 工具透传。' +
             '以下 Home/外部/自定义目录开关<strong>不限制原生 DC 文件和 Shell 工具</strong>；' +
-            '可访问范围由 Desktop Commander 和 macOS 用户账户决定。' +
+            '可访问范围由 Desktop Commander 和操作系统用户账户决定。' +
             '开关仅在切回受限工作区模式后生效。请勿将此服务暴露给未经认证的客户端。</p>' +
             '</section>' : "") +
         '<section><h2>工作目录 · 读写范围</h2><code>' + e(project.path) + '</code>' +
@@ -58,7 +58,7 @@ export function renderPermissionDashboard({ project, home, config, warning = "",
         '<button type="submit">确认授权</button></form></section>' +
         '<p><a href="/dashboard">返回运行 Dashboard</a> · ' +
         '<a href="/filters">工具黑名单</a></p>' +
-        '<small>授权管理密钥仅在 Mac 本地终端显示；不可交给远程 Agent。' +
+        '<small>授权管理密钥仅在本地终端显示；不可交给远程 Agent。' +
         '本页不改变 trusted-project 的同 UID Shell 风险。</small></body></html>';
 }
 export async function applyPermissionPost(req, grants, host) {
@@ -94,4 +94,3 @@ export async function applyPermissionPost(req, grants, host) {
         return { status: 400, message: "Grant rejected: verify directory and permissions" };
     }
 }
-//# sourceMappingURL=permissions-dashboard.js.map

package/dist/src/platform.js

@@ -1,4 +1,4 @@
-// Host integration for the shared CLI. macOS App and legacy paths stay stable.
+// Host integration for the shared CLI and native App.
 import { execFileSync } from 'node:child_process';
 import { lstatSync, mkdirSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
@@ -60,9 +60,9 @@ export function createPrivateDirectory(folder) {
 }
 export function controlRoot() {
     if (process.platform === 'darwin')
-        return `/private/tmp/mac-mcp-gateway-${process.getuid()}`;
+        return `/private/tmp/starmux-${process.getuid()}`;
     const id = windows ? createHash('sha256').update(homedir().toLowerCase()).digest('hex').slice(0, 16) : String(process.getuid());
-    return path.join(tmpdir(), `mac-mcp-gateway-${id}`);
+    return path.join(tmpdir(), `starmux-${id}`);
 }
 export function within(candidate, root) {
     const relative = path.relative(root, candidate);
@@ -99,4 +99,3 @@ export function diskUsageCommand(target, depth) {
     };` : ''}
     '{0} {1}' -f [math]::Ceiling((Measure-Tree $root)/1024),$root.FullName`;
 }
-//# sourceMappingURL=platform.js.map

package/dist/src/privacy-diagnostics.js

@@ -152,4 +152,3 @@ export async function privacyReport({ port, home = os.homedir(), all = false, ta
         note: "This tests actual directory access, not the TCC database or the responsible app identity. launchd and Termius may differ. No permission is changed."
     };
 }
-//# sourceMappingURL=privacy-diagnostics.js.map

package/dist/src/private-mcp-activity.js

@@ -60,4 +60,3 @@ export function createPrivateMCPActivity({ now = () => Date.now(), routeFor = ()
     }
     return Object.freeze({ observeAudit: observation, snapshot });
 }
-//# sourceMappingURL=private-mcp-activity.js.map

package/dist/src/private-store-lock.js

@@ -24,4 +24,3 @@ export async function withPrivateLock(file, action) {
         await rm(file, { recursive: true });
     }
 }
-//# sourceMappingURL=private-store-lock.js.map

package/dist/src/project-dev-presets.js

@@ -87,4 +87,3 @@ export function createDevPresets(projectRoot, mode, { now = () => Date.now() } =
         names: Object.keys(preset)
     });
 }
-//# sourceMappingURL=project-dev-presets.js.map

package/dist/src/project-git-workflow.js

@@ -139,4 +139,3 @@ export function createGitWorkflow({ policy, upstream, writesEnabled = false, pus
         }
     };
 }
-//# sourceMappingURL=project-git-workflow.js.map

package/dist/src/project-workspace-policy.js

@@ -6,6 +6,7 @@ import { lstat, realpath } from "node:fs/promises";
 import { homedir } from "node:os";
 import path from "node:path";
 import { createDevPresets } from "./project-dev-presets.js";
+import { prepareBatchRead } from "./batch-read-policy.js";
 export class WorkspaceDenied extends Error {
     code;
     constructor(code) {
@@ -24,14 +25,14 @@ function keysExact(args, required, optional = []) {
         Object.keys(args).some(k => ![...required, ...optional].includes(k)))
         fail("ARGUMENTS_NOT_ALLOWED");
 }
-async function checked(target, kind, bytes) {
+async function checked(target, kind, bytes, allowMissing = false) {
     const st = await lstat(target).catch(e => {
         if (errorCode(e) === "ENOENT")
             return null;
         throw e;
     });
     if (!st) {
-        if (kind !== "new")
+        if (kind !== "new" && !allowMissing)
             fail("NOT_FOUND");
         return;
     }
@@ -68,7 +69,7 @@ export async function createProjectPolicy({ root, mode = "read-only", developerC
         fail("ROOT_MUST_BE_CANONICAL");
     await checked(base, "directory");
     const devPresets = createDevPresets(base, mode);
-    async function scoped(raw, kind, bytes) {
+    async function scoped(raw, kind, bytes, allowMissing = false) {
         if (typeof raw !== "string" || !raw || raw.length > 1024 ||
             raw.includes("\0") || (!windows && raw.includes("\\")) ||
             raw.startsWith("~") || /^[a-z]+:\/\//i.test(raw))
@@ -84,7 +85,7 @@ export async function createProjectPolicy({ root, mode = "read-only", developerC
         let current = base;
         for (let i = 0; i < parts.length; i++) {
             current = path.join(current, parts[i]);
-            await checked(current, i === parts.length - 1 ? kind : "directory", i === parts.length - 1 ? bytes : undefined);
+            await checked(current, i === parts.length - 1 ? kind : "directory", i === parts.length - 1 ? bytes : undefined, allowMissing);
         }
         if (parts.length === 0 && kind !== "directory")
             fail("ROOT_IS_DIRECTORY");
@@ -98,6 +99,8 @@ export async function createProjectPolicy({ root, mode = "read-only", developerC
         },
         observe(name, result, args) { devPresets.observe(name, result, args); },
         async prepare(name, args = {}) {
+            if (name === "read_multiple_files")
+                return prepareBatchRead(args, (tool, values) => this.prepare(tool, values));
             if (name === "start_process" && developerCommands === "trusted-project") {
                 keysExact(args, ["command", "timeout_ms"]);
                 if (typeof args.command !== "string" || !args.command.trim() ||
@@ -129,7 +132,9 @@ export async function createProjectPolicy({ root, mode = "read-only", developerC
                     fail("OFFSET_LIMIT");
                 if (args.length !== undefined && (!isInteger(args.length) || args.length < 1 || args.length > 1000))
                     fail("LENGTH_LIMIT");
-                return { name, arguments: { path: await scoped(args.path, "file", maxReadBytes),
+                // Missing files are an upstream read result, not a permission denial.
+                // Existing ancestors still undergo the same owner/link/scope checks.
+                return { name, arguments: { path: await scoped(args.path, "file", maxReadBytes, true),
                         offset: args.offset ?? 0, length: args.length ?? 1000 } };
             }
             if (mode !== "read-write")
@@ -158,4 +163,3 @@ export async function createProjectPolicy({ root, mode = "read-only", developerC
         }
     });
 }
-//# sourceMappingURL=project-workspace-policy.js.map

package/dist/src/runtime-identity.js

@@ -25,17 +25,3 @@ export async function runtimeIdentity() {
     return { coreProgram: path.join(root, 'dist', 'src', 'dc-workspace-http.js'),
         buildVersion: `${pkg.version} (sha256:${hash.digest('hex').slice(0, 16)})` };
 }
-export function formatStartup(details) {
-    const row = (name, value) => `  ${name.padEnd(17)}${value}`;
-    return [
-        '', '  Mac MCP Gateway · Starting', '  ' + '─'.repeat(64),
-        row('Config source', details.configSource),
-        row('Core program', details.coreProgram),
-        row('Build version', details.buildVersion),
-        row('Listening port', String(details.port) + ' (127.0.0.1)'),
-        row('Endpoint', `http://127.0.0.1:${details.port}/mcp`),
-        '  ' + '─'.repeat(64),
-        '  Starting the Core bundled with this CLI. Press Ctrl+C to stop.', ''
-    ].join('\n') + '\n';
-}
-//# sourceMappingURL=runtime-identity.js.map

package/dist/src/runtime-paths.js

@@ -6,6 +6,3 @@ export const cliEntry = (name = 'starmux') => path.join(packageRoot, 'bin', name
 // Vendored zero-telemetry build of Desktop Commander bundled inside dist/vendor.
 export const desktopCommanderEntry = path.join(packageRoot, 'dist', 'vendor', 'desktop-commander', 'dist', 'index.js');
 export const desktopCommanderPackageJson = path.join(packageRoot, 'dist', 'vendor', 'desktop-commander', 'package.json');
-export const fixtureRoot = path.join(packageRoot, 'test', 'fixtures');
-export const legacyCliEntry = () => path.join(packageRoot, 'dist/src/cli/mac-mcp-gateway.js');
-//# sourceMappingURL=runtime-paths.js.map