terminal-commands 0.1.3 → 0.2.1

package/dist/agent.js

@@ -4154,13 +4154,14 @@ var require_fast_uri = __commonJS({
         if (!malformedIPLiteral) {
           malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
         }
-        if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
-          if (uri.indexOf("%") !== -1) {
-            if (parsed.host !== void 0 && !malformedIPLiteral) {
-              const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-              parsed.host = reescapeHostDelimiters(host, isIP);
-            }
+        if (uri.indexOf("%") !== -1 && parsed.host !== void 0 && !malformedIPLiteral) {
+          let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+          if (!isIP) {
+            host = normalizePercentEncoding(host.toLowerCase());
           }
+          parsed.host = reescapeHostDelimiters(host, isIP);
+        }
+        if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
@@ -32302,6 +32303,9 @@ var Protocol = class {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
         const handleTaskResult = async () => {
           const taskId = request.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -32332,12 +32336,12 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -32374,7 +32378,7 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
+          this._clearTaskQueue(request.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
@@ -32502,6 +32506,19 @@ var Protocol = class {
     const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== void 0) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler === void 0) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -32511,7 +32528,10 @@ var Protocol = class {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error62) => this._onerror(new Error(`Failed to send an error response: ${error62}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -32562,7 +32582,10 @@ var Protocol = class {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request.method);
       }
@@ -32597,7 +32620,7 @@ var Protocol = class {
           ...error62["data"] !== void 0 && { data: error62["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -33077,7 +33100,7 @@ var Protocol = class {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   /**
    * Clears the message queue for a task and rejects any pending request resolvers.
@@ -33106,12 +33129,13 @@ var Protocol = class {
    * Uses polling to check for updates at the task's configured poll interval.
    * @param taskId The task ID to wait for
    * @param signal Abort signal to cancel the wait
+   * @param sessionId Session of the request that waits, passed to the task store
    * @returns Promise that resolves when an update occurs or rejects if aborted
    */
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1e3;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -34026,6 +34050,68 @@ function createFetchWithInit(baseFetch = fetch, baseInit) {
     return baseFetch(url2, mergedInit);
   };
 }
+var MAX_REDIRECTS = 5;
+var REDIRECT_STATUSES = [301, 302, 303, 307, 308];
+function isWithinOrigin(from, to) {
+  if (from.protocol === to.protocol && from.hostname === to.hostname && from.port === to.port) {
+    return true;
+  }
+  return from.hostname === to.hostname && from.protocol === "http:" && from.port === "" && to.protocol === "https:" && to.port === "";
+}
+function redirectTarget(response, requestUrl) {
+  const location = REDIRECT_STATUSES.includes(response.status) ? response.headers.get("location") : null;
+  try {
+    return location ? new URL(location, requestUrl) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function followWithinOrigin(baseFetch, url2, init, response, followed = 0) {
+  const target = redirectTarget(response, url2);
+  const keepsMethod = response.status === 307 || response.status === 308 || (init?.method ?? "GET").toUpperCase() === "GET";
+  if (!target || followed === MAX_REDIRECTS || !keepsMethod) {
+    return void 0;
+  }
+  const from = new URL(url2);
+  const addsUserinfo = (target.username || target.password) && (target.username !== from.username || target.password !== from.password);
+  if (addsUserinfo || !isWithinOrigin(from, target)) {
+    return void 0;
+  }
+  return Promise.resolve(response.body?.cancel()).then(() => baseFetch(target, { ...init, redirect: "manual" })).then((next) => followWithinOrigin(baseFetch, target, init, next, followed + 1) ?? next);
+}
+var followingFetches = /* @__PURE__ */ new WeakSet();
+function fetchLeavingRedirects(baseFetch) {
+  const following = (url2, init) => (baseFetch ?? fetch)(url2, init);
+  followingFetches.add(following);
+  return following;
+}
+function fetchWithinOrigin(baseFetch = fetch) {
+  if (followingFetches.has(baseFetch)) {
+    return baseFetch;
+  }
+  return (url2, init) => {
+    if (init?.redirect === "error" || init?.redirect === "manual") {
+      return baseFetch(url2, init);
+    }
+    return Promise.resolve(baseFetch(url2, { ...init, redirect: "manual" })).then((response) => followWithinOrigin(baseFetch, url2, init, response) ?? response);
+  };
+}
+function unfollowedRedirect(response, requestUrl) {
+  if (response.type === "opaqueredirect") {
+    return "Redirect not followed: this runtime does not expose the redirect target";
+  }
+  const from = response.url || requestUrl;
+  const target = redirectTarget(response, from);
+  if (!target) {
+    return void 0;
+  }
+  target.username = target.password = target.search = target.hash = "";
+  if (target.protocol === "http:" && new URL(from).protocol === "https:") {
+    target.protocol = "https:";
+    return `Redirect to plain http not followed; try ${target.href} instead`;
+  }
+  return `Redirect to ${target.href} not followed`;
+}
 
 // node_modules/pkce-challenge/dist/index.node.js
 var crypto;
@@ -34172,7 +34258,12 @@ var OAuthTokensSchema = object2({
   token_type: string2(),
   expires_in: coerce_exports.number().optional(),
   scope: string2().optional(),
-  refresh_token: string2().optional()
+  refresh_token: string2().optional(),
+  /**
+   * Not part of the wire format: the authorization server this value was obtained from, added by
+   * the client's `auth()` before it is stored and compared when it is read back.
+   */
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthErrorResponseSchema = object2({
   error: string2(),
@@ -34202,7 +34293,12 @@ var OAuthClientInformationSchema = object2({
   client_id: string2(),
   client_secret: string2().optional(),
   client_id_issued_at: number2().optional(),
-  client_secret_expires_at: number2().optional()
+  client_secret_expires_at: number2().optional(),
+  /**
+   * Not part of the wire format: the authorization server this value was obtained from, added by
+   * the client's `auth()` before it is stored and compared when it is read back.
+   */
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
 var OAuthClientRegistrationErrorSchema = object2({
@@ -34400,10 +34496,31 @@ async function parseErrorResponse(input2) {
     const errorClass = OAUTH_ERRORS[error62] || ServerError;
     return new errorClass(error_description || "", error_uri);
   } catch (error62) {
-    const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}Invalid OAuth error response: ${error62}. Raw body: ${body}`;
+    const redirect = input2 instanceof Response ? unfollowedRedirect(input2, input2.url) : void 0;
+    const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}${redirect ?? `Invalid OAuth error response: ${error62}. Raw body: ${body}`}`;
     return new ServerError(errorMessage);
   }
 }
+function issuersMatch(a, b) {
+  let [x, y] = [a, b];
+  try {
+    [x, y] = [new URL(a).href, new URL(b).href];
+  } catch {
+  }
+  return x === y || x.endsWith("/") && x.slice(0, -1) === y || y.endsWith("/") && y.slice(0, -1) === x;
+}
+function discardIfIssuerMismatch(stored, issuer) {
+  if (!stored)
+    return void 0;
+  if (typeof stored.issuer !== "string")
+    return stored.issuer == null ? stored : { ...stored, issuer: void 0 };
+  return issuersMatch(stored.issuer, issuer) ? stored : void 0;
+}
+var TokenResponseSchema = OAuthTokensSchema.omit({ issuer: true });
+var RegistrationResponseSchema = OAuthClientInformationFullSchema.omit({ issuer: true });
+function boundElsewhereError(stored, issuer) {
+  return new Error(`OAuth client information is bound to authorization server ${stored.issuer} and is not presented to ${issuer}. Clear the stored client information, or correct \`expectedIssuer\`, if the authorization server has moved.`);
+}
 async function auth(provider, options) {
   try {
     return await authInternal(provider, options);
@@ -34457,9 +34574,24 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
       authorizationServerMetadata: metadata
     });
   }
-  const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+  const issuer = String(authorizationServerUrl);
+  const selectedResource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+  const resource = selectedResource && resourceMetadata && !provider.validateResourceURL ? resourceMetadata.resource : selectedResource;
   const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope;
-  let clientInformation = await Promise.resolve(provider.clientInformation());
+  const storedClientInformation = await Promise.resolve(provider.clientInformation());
+  let clientInformation = discardIfIssuerMismatch(storedClientInformation, issuer);
+  const canRegisterAgain = provider.saveClientInformation !== void 0 && !!provider.redirectUrl;
+  if (storedClientInformation && !clientInformation && !canRegisterAgain) {
+    throw boundElsewhereError(storedClientInformation, issuer);
+  }
+  const unstampedClientInformation = clientInformation?.issuer == null ? clientInformation : void 0;
+  const bindClientInformation = async () => {
+    try {
+      if (unstampedClientInformation)
+        await provider.saveClientInformation?.({ ...unstampedClientInformation, issuer });
+    } catch {
+    }
+  };
   if (!clientInformation) {
     if (authorizationCode !== void 0) {
       throw new Error("Existing OAuth client information is required when exchanging an authorization code");
@@ -34471,9 +34603,7 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
     }
     const shouldUseUrlBasedClientId = supportsUrlBasedClientId && clientMetadataUrl;
     if (shouldUseUrlBasedClientId) {
-      clientInformation = {
-        client_id: clientMetadataUrl
-      };
+      clientInformation = { client_id: clientMetadataUrl, issuer };
       await provider.saveClientInformation?.(clientInformation);
     } else {
       if (!provider.saveClientInformation) {
@@ -34485,8 +34615,8 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
         scope: resolvedScope,
         fetchFn
       });
-      await provider.saveClientInformation(fullInformation);
-      clientInformation = fullInformation;
+      clientInformation = { ...fullInformation, issuer };
+      await provider.saveClientInformation(clientInformation);
     }
   }
   const nonInteractiveFlow = !provider.redirectUrl;
@@ -34497,10 +34627,14 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
       authorizationCode,
       fetchFn
     });
-    await provider.saveTokens(tokens2);
+    await bindClientInformation();
+    await provider.saveTokens({ ...tokens2, issuer });
     return "AUTHORIZED";
   }
-  const tokens = await provider.tokens();
+  const tokens = discardIfIssuerMismatch(await provider.tokens(), issuer);
+  if (tokens?.refresh_token && tokens.issuer == null) {
+    console.warn("[mcp-sdk] stored OAuth tokens have no 'issuer' property (saved by an earlier version, or by a provider that does not keep it) and are used as-is; make sure your OAuthClientProvider stores what saveTokens() and saveClientInformation() receive unchanged.");
+  }
   if (tokens?.refresh_token) {
     try {
       const newTokens = await refreshAuthorization(authorizationServerUrl, {
@@ -34511,7 +34645,8 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
         addClientAuthentication: provider.addClientAuthentication,
         fetchFn
       });
-      await provider.saveTokens(newTokens);
+      await bindClientInformation();
+      await provider.saveTokens({ ...newTokens, issuer });
       return "AUTHORIZED";
     } catch (error62) {
       if (!(error62 instanceof OAuthError) || error62 instanceof ServerError) {
@@ -34610,7 +34745,7 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn =
 }
 async function fetchWithCorsRetry(url2, headers, fetchFn = fetch) {
   try {
-    return await fetchFn(url2, { headers });
+    return await fetchWithinOrigin(fetchFn)(url2, { headers });
   } catch (error62) {
     if (error62 instanceof TypeError) {
       if (headers) {
@@ -34635,7 +34770,7 @@ async function tryMetadataDiscovery(url2, protocolVersion, fetchFn = fetch) {
   return await fetchWithCorsRetry(url2, headers, fetchFn);
 }
 function shouldAttemptFallback(response, pathname) {
-  return !response || response.status >= 400 && response.status < 500 && pathname !== "/";
+  return !response || !response.ok && response.status < 500 && pathname !== "/";
 }
 async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
   const issuer = new URL(serverUrl);
@@ -34701,7 +34836,7 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fet
     }
     if (!response.ok) {
       await response.body?.cancel();
-      if (response.status >= 400 && response.status < 500) {
+      if (response.status < 500) {
         continue;
       }
       throw new Error(`HTTP ${response.status} trying to load ${type === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
@@ -34734,6 +34869,9 @@ async function discoverOAuthServerInfo(serverUrl, opts) {
     resourceMetadata
   };
 }
+function resourceIndicatorToString(resource) {
+  return typeof resource === "string" ? resource : resource.href;
+}
 async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
   let authorizationUrl;
   if (metadata) {
@@ -34765,7 +34903,7 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
     authorizationUrl.searchParams.append("prompt", "consent");
   }
   if (resource) {
-    authorizationUrl.searchParams.set("resource", resource.href);
+    authorizationUrl.searchParams.set("resource", resourceIndicatorToString(resource));
   }
   return { authorizationUrl, codeVerifier };
 }
@@ -34784,7 +34922,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
     Accept: "application/json"
   });
   if (resource) {
-    tokenRequestParams.set("resource", resource.href);
+    tokenRequestParams.set("resource", resourceIndicatorToString(resource));
   }
   if (addClientAuthentication) {
     await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
@@ -34793,7 +34931,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
     const authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
     applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
   }
-  const response = await (fetchFn ?? fetch)(tokenUrl, {
+  const response = await fetchWithinOrigin(fetchFn ?? fetch)(tokenUrl, {
     method: "POST",
     headers,
     body: tokenRequestParams
@@ -34801,7 +34939,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
   if (!response.ok) {
     throw await parseErrorResponse(response);
   }
-  return OAuthTokensSchema.parse(await response.json());
+  return TokenResponseSchema.parse(await response.json());
 }
 async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
   const tokenRequestParams = new URLSearchParams({
@@ -34819,6 +34957,15 @@ async function refreshAuthorization(authorizationServerUrl, { metadata, clientIn
   return { refresh_token: refreshToken, ...tokens };
 }
 async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
+  const readClientInformation = async () => {
+    const storedClientInformation = await provider.clientInformation();
+    const checked = discardIfIssuerMismatch(storedClientInformation, String(authorizationServerUrl));
+    if (storedClientInformation && !checked) {
+      throw boundElsewhereError(storedClientInformation, String(authorizationServerUrl));
+    }
+    return checked;
+  };
+  let clientInformation = await readClientInformation();
   const scope = provider.clientMetadata.scope;
   let tokenRequestParams;
   if (provider.prepareTokenRequest) {
@@ -34834,11 +34981,11 @@ async function fetchToken(provider, authorizationServerUrl, { metadata, resource
     const codeVerifier = await provider.codeVerifier();
     tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
   }
-  const clientInformation = await provider.clientInformation();
+  clientInformation ?? (clientInformation = await readClientInformation());
   return executeTokenRequest(authorizationServerUrl, {
     metadata,
     tokenRequestParams,
-    clientInformation: clientInformation ?? void 0,
+    clientInformation,
     addClientAuthentication: provider.addClientAuthentication,
     resource,
     fetchFn
@@ -34854,7 +35001,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
   } else {
     registrationUrl = new URL("/register", authorizationServerUrl);
   }
-  const response = await (fetchFn ?? fetch)(registrationUrl, {
+  const response = await fetchWithinOrigin(fetchFn ?? fetch)(registrationUrl, {
     method: "POST",
     headers: {
       "Content-Type": "application/json"
@@ -34867,7 +35014,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
   if (!response.ok) {
     throw await parseErrorResponse(response);
   }
-  return OAuthClientInformationFullSchema.parse(await response.json());
+  return RegistrationResponseSchema.parse(await response.json());
 }
 
 // node_modules/eventsource-parser/dist/index.js
@@ -35094,9 +35241,19 @@ var StreamableHTTPClientTransport = class {
     this._authProvider = opts?.authProvider;
     this._fetch = opts?.fetch;
     this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
+    this._followRedirects = opts?.redirectPolicy === "follow";
+    if (this._followRedirects) {
+      this._fetch = fetchLeavingRedirects(this._fetch);
+      this._fetchWithInit = fetchLeavingRedirects(this._fetchWithInit);
+    }
     this._sessionId = opts?.sessionId;
     this._reconnectionOptions = opts?.reconnectionOptions ?? DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS;
   }
+  /** Error text for a redirect `response` that was not followed, or `undefined` for any other response. */
+  _unfollowedRedirect(response, url2) {
+    const text = unfollowedRedirect(response, url2);
+    return text && !this._followRedirects ? `${text} (redirectPolicy: 'same-origin')` : text;
+  }
   async _authThenStart() {
     if (!this._authProvider) {
       throw new UnauthorizedError("No auth provider");
@@ -35146,11 +35303,13 @@ var StreamableHTTPClientTransport = class {
       if (resumptionToken) {
         headers.set("last-event-id", resumptionToken);
       }
-      const response = await (this._fetch ?? fetch)(this._url, {
-        method: "GET",
-        headers,
-        signal: this._abortController?.signal
-      });
+      const fetchFn = this._fetch ?? fetch;
+      const init = { method: "GET", headers, signal: this._abortController?.signal };
+      let response = await fetchFn(this._url, this._followRedirects ? init : { ...init, redirect: "manual" });
+      const followed = this._followRedirects ? void 0 : followWithinOrigin(fetchFn, this._url, init, response);
+      if (followed) {
+        response = await followed;
+      }
       if (!response.ok) {
         await response.body?.cancel();
         if (response.status === 401 && this._authProvider) {
@@ -35159,7 +35318,7 @@ var StreamableHTTPClientTransport = class {
         if (response.status === 405) {
           return;
         }
-        throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${response.statusText}`);
+        throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${this._unfollowedRedirect(response, this._url) ?? response.statusText}`);
       }
       this._handleSseStream(response.body, options, true);
     } catch (error62) {
@@ -35322,7 +35481,7 @@ var StreamableHTTPClientTransport = class {
         body: JSON.stringify(message),
         signal: this._abortController?.signal
       };
-      const response = await (this._fetch ?? fetch)(this._url, init);
+      const response = await fetchWithinOrigin(this._fetch ?? fetch)(this._url, init);
       const sessionId = response.headers.get("mcp-session-id");
       if (sessionId) {
         this._sessionId = sessionId;
@@ -35374,7 +35533,7 @@ var StreamableHTTPClientTransport = class {
             return this.send(message);
           }
         }
-        throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${text}`);
+        throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${this._unfollowedRedirect(response, this._url) ?? text}`);
       }
       this._hasCompletedAuthFlow = false;
       this._lastUpscopingHeader = void 0;
@@ -35436,10 +35595,10 @@ var StreamableHTTPClientTransport = class {
         headers,
         signal: this._abortController?.signal
       };
-      const response = await (this._fetch ?? fetch)(this._url, init);
+      const response = await fetchWithinOrigin(this._fetch ?? fetch)(this._url, init);
       await response.body?.cancel();
       if (!response.ok && response.status !== 405) {
-        throw new StreamableHTTPError(response.status, `Failed to terminate session: ${response.statusText}`);
+        throw new StreamableHTTPError(response.status, `Failed to terminate session: ${this._unfollowedRedirect(response, this._url) ?? response.statusText}`);
       }
       this._sessionId = void 0;
     } catch (error62) {
@@ -35479,88 +35638,443 @@ var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 
+// src/process-event-forwarder.ts
+var eventSchema = external_exports.object({
+  sessionId: external_exports.string().uuid(),
+  taskId: external_exports.string().uuid().optional(),
+  sequence: external_exports.number().int().positive(),
+  kind: external_exports.enum(["started", "stdout", "stderr", "finished"]),
+  offset: external_exports.number().int().nonnegative().optional(),
+  data: external_exports.string().max(4096).optional(),
+  exitCode: external_exports.number().int().nullable().optional(),
+  signal: external_exports.string().nullable().optional(),
+  timedOut: external_exports.boolean().optional()
+});
+var batchSchema = external_exports.object({
+  sessionId: external_exports.string().uuid(),
+  events: external_exports.array(eventSchema).max(32),
+  nextSequence: external_exports.number().int().nonnegative(),
+  missedEvents: external_exports.boolean(),
+  finished: external_exports.boolean()
+});
+var processListSchema = external_exports.object({
+  processes: external_exports.array(
+    external_exports.object({
+      sessionId: external_exports.string().uuid(),
+      taskId: external_exports.string().uuid().optional()
+    })
+  )
+});
+function structuredContent(response) {
+  if (!response || typeof response !== "object") {
+    throw new Error("Local process tool returned an invalid response.");
+  }
+  const result = response;
+  if (result.isError || result.structuredContent === void 0) {
+    throw new Error("Local process event tool failed or returned no content.");
+  }
+  return result.structuredContent;
+}
+var ProcessEventForwarder = class {
+  constructor(callLocalTool, send, log, acknowledged = /* @__PURE__ */ new Map(), ackTimeoutMs = 3e3, onFatal) {
+    this.callLocalTool = callLocalTool;
+    this.send = send;
+    this.log = log;
+    this.acknowledged = acknowledged;
+    this.ackTimeoutMs = ackTimeoutMs;
+    this.onFatal = onFatal;
+  }
+  callLocalTool;
+  send;
+  log;
+  acknowledged;
+  ackTimeoutMs;
+  onFatal;
+  #watchers = /* @__PURE__ */ new Map();
+  #ackWaiters = /* @__PURE__ */ new Map();
+  #lastSent = /* @__PURE__ */ new Map();
+  #closed = false;
+  acknowledge(sessionId, sequence) {
+    if (!external_exports.string().uuid().safeParse(sessionId).success || !Number.isSafeInteger(sequence) || sequence < 1)
+      return;
+    const maximum = this.#lastSent.get(sessionId) ?? 0;
+    if (sequence > maximum) return;
+    const current = this.acknowledged.get(sessionId) ?? 0;
+    if (sequence <= current) return;
+    this.acknowledged.set(sessionId, sequence);
+    for (const wake of this.#ackWaiters.get(sessionId) ?? []) wake();
+  }
+  async #waitForAck(sessionId, target, signal) {
+    if ((this.acknowledged.get(sessionId) ?? 0) >= target) return true;
+    if (signal.aborted) return false;
+    return new Promise((resolve) => {
+      const listeners = this.#ackWaiters.get(sessionId) ?? /* @__PURE__ */ new Set();
+      this.#ackWaiters.set(sessionId, listeners);
+      let timer;
+      const finish = () => {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", finish);
+        listeners.delete(wake);
+        if (listeners.size === 0) this.#ackWaiters.delete(sessionId);
+        resolve((this.acknowledged.get(sessionId) ?? 0) >= target);
+      };
+      const wake = () => {
+        if ((this.acknowledged.get(sessionId) ?? 0) >= target) finish();
+      };
+      listeners.add(wake);
+      signal.addEventListener("abort", finish, { once: true });
+      timer = setTimeout(finish, this.ackTimeoutMs);
+      wake();
+    });
+  }
+  async recover() {
+    if (this.#closed) return;
+    const result = await this.callLocalTool("list_processes", {});
+    const parsed = processListSchema.parse(structuredContent(result));
+    for (const process2 of parsed.processes) {
+      if (process2.taskId) this.watch(process2.sessionId);
+    }
+  }
+  watch(sessionId) {
+    if (this.#closed || this.#watchers.has(sessionId)) return;
+    if (!external_exports.string().uuid().safeParse(sessionId).success) return;
+    const controller2 = new AbortController();
+    this.#watchers.set(sessionId, controller2);
+    void this.#pump(sessionId, controller2.signal).catch((error62) => {
+      const failure2 = error62 instanceof Error ? error62 : new Error("Unknown process event failure.");
+      this.log?.("Process event watch failed: " + failure2.message);
+      if (!controller2.signal.aborted) this.onFatal?.(failure2);
+    }).finally(() => {
+      if (this.#watchers.get(sessionId) === controller2) {
+        this.#watchers.delete(sessionId);
+      }
+    });
+  }
+  async #pump(sessionId, signal) {
+    let afterSequence = this.acknowledged.get(sessionId) ?? 0;
+    while (!signal.aborted) {
+      const raw = await this.callLocalTool("watch_process_events", {
+        sessionId,
+        afterSequence,
+        timeoutMs: 1e4,
+        maxEvents: 32
+      });
+      if (signal.aborted) break;
+      const batch = batchSchema.parse(structuredContent(raw));
+      if (batch.sessionId !== sessionId) {
+        throw new Error("Process event watch returned a different session ID.");
+      }
+      if (batch.nextSequence < afterSequence) {
+        throw new Error("Process event cursor moved backwards.");
+      }
+      if (batch.events.length === 0 && batch.finished) break;
+      if (batch.events.length === 0) continue;
+      let confirmed = false;
+      for (let attempt = 0; attempt < 5 && !signal.aborted; attempt++) {
+        for (const [index, event] of batch.events.entries()) {
+          if (signal.aborted) break;
+          if (event.sessionId !== sessionId) {
+            throw new Error("Process event belongs to another session.");
+          }
+          this.#lastSent.set(
+            sessionId,
+            Math.max(this.#lastSent.get(sessionId) ?? 0, event.sequence)
+          );
+          this.send({
+            type: "process_event",
+            event,
+            missedEvents: index === 0 && batch.missedEvents
+          });
+        }
+        confirmed = await this.#waitForAck(
+          sessionId,
+          batch.nextSequence,
+          signal
+        );
+        if (confirmed) break;
+      }
+      if (!confirmed) {
+        if (signal.aborted) break;
+        throw new Error(
+          "PROCESS_EVENT_ACK_TIMEOUT: Gateway did not acknowledge event batch."
+        );
+      }
+      afterSequence = batch.nextSequence;
+      if (batch.finished && batch.events.length < 32) break;
+    }
+  }
+  close() {
+    this.#closed = true;
+    for (const controller2 of this.#watchers.values()) controller2.abort();
+    this.#watchers.clear();
+    for (const wake of this.#ackWaiters.values()) {
+      for (const notify of wake) notify();
+    }
+    this.#ackWaiters.clear();
+  }
+};
+
 // src/agent-core.ts
+var supportedAgentTools = [
+  "get_system_info",
+  "list_directory",
+  "read_text_file",
+  "start_process",
+  "read_process_output",
+  "watch_process_events",
+  "terminate_process",
+  "list_processes",
+  "write_text_file"
+];
 var destructiveTools = /* @__PURE__ */ new Set([
   "start_process",
   "terminate_process",
   "write_text_file"
 ]);
-var requestSchema = external_exports.object({
+var requestEnvelope = external_exports.object({
   type: external_exports.literal("request"),
-  requestId: external_exports.string().uuid(),
-  tool: external_exports.enum([
-    "get_system_info",
-    "list_directory",
-    "read_text_file",
-    "start_process",
-    "read_process_output",
-    "terminate_process",
-    "list_processes",
-    "write_text_file"
-  ]),
-  arguments: external_exports.record(external_exports.string(), external_exports.unknown())
-});
-async function authorizeToolCall(tool, args, allowDestructive, approve) {
+  requestId: external_exports.string().uuid()
+});
+var requestSchema = requestEnvelope.extend({
+  tool: external_exports.enum(supportedAgentTools),
+  arguments: external_exports.record(external_exports.string(), external_exports.unknown()),
+  deadlineAt: external_exports.number().int().positive().optional()
+});
+var cancelSchema = external_exports.object({
+  type: external_exports.literal("cancel"),
+  requestId: external_exports.string().uuid()
+});
+var ackSchema = external_exports.object({
+  type: external_exports.literal("process_event_ack"),
+  sessionId: external_exports.string().uuid(),
+  sequence: external_exports.number().int().positive()
+});
+var DEFAULT_REQUEST_LIFETIME_MS = 6e4;
+function assertActive(signal) {
+  if (signal?.aborted) {
+    throw new Error(
+      "REQUEST_EXPIRED: The operation was cancelled or its approval deadline expired."
+    );
+  }
+}
+async function authorizeToolCall(tool, args, allowDestructive, approve, signal, progress) {
+  const notify = (phase) => {
+    try {
+      progress?.(phase);
+    } catch {
+    }
+  };
+  assertActive(signal);
   if (!destructiveTools.has(tool)) return;
   if (!allowDestructive) {
+    notify("denied");
     throw new Error(
       "This action requires local approval. Commands and writes are disabled unless explicitly enabled."
     );
   }
-  if (!approve || !await approve(tool, args)) {
+  if (!approve) {
+    notify("denied");
+    throw new Error("The action was not approved on the connected machine.");
+  }
+  notify("awaiting_approval");
+  if (!await approve(tool, args, signal)) {
+    assertActive(signal);
+    notify("denied");
     throw new Error("The action was not approved on the connected machine.");
   }
+  assertActive(signal);
+  notify("approved");
 }
-async function connectOnce(options) {
+async function connectOnce(options, acknowledged) {
   const { config: config3, signal } = options;
+  if (!config3.MACHINE_TERMINAL_DEVICE_SECRET) {
+    throw new Error(
+      "DEVICE_PAIRING_REQUIRED: Connect using the CLI or set MACHINE_TERMINAL_DEVICE_SECRET."
+    );
+  }
   const client = new Client({
     name: "terminal-commands-cli",
-    version: "0.1.0"
-  });
-  await client.connect(
-    new StreamableHTTPClientTransport(
-      new URL(config3.MACHINE_TERMINAL_LOCAL_MCP_URL)
-    )
-  );
-  const token = options.getToken ? await options.getToken() : config3.MACHINE_TERMINAL_DEVICE_TOKEN;
-  const socket = new wrapper_default(config3.MACHINE_TERMINAL_GATEWAY_URL, {
-    headers: { Authorization: `Bearer ${token}` }
+    version: "0.2.1"
   });
-  const stop2 = () => socket.close(1e3, "Client stopping.");
-  signal?.addEventListener("abort", stop2, { once: true });
-  socket.on("open", () => {
-    socket.send(
-      JSON.stringify({
-        type: "hello",
-        deviceId: config3.MACHINE_TERMINAL_DEVICE_ID,
-        name: config3.MACHINE_TERMINAL_DEVICE_NAME,
-        platform: `${os.platform()}-${os.arch()}`
-      })
+  let disposeSocket;
+  try {
+    await client.connect(
+      new StreamableHTTPClientTransport(
+        new URL(config3.MACHINE_TERMINAL_LOCAL_MCP_URL),
+        {
+          requestInit: {
+            headers: config3.MACHINE_TERMINAL_LOCAL_AGENT_TOKEN ? {
+              "X-Terminal-Commands-Agent-Token": config3.MACHINE_TERMINAL_LOCAL_AGENT_TOKEN
+            } : {}
+          }
+        }
+      )
     );
-  });
-  socket.on("message", (raw) => {
-    void handleMessage(options, client, socket, raw);
-  });
-  await new Promise((resolve, reject) => {
-    socket.once("close", resolve);
-    socket.once("error", reject);
-  }).finally(() => signal?.removeEventListener("abort", stop2));
-  await client.close();
+    const token = options.getToken ? await options.getToken() : config3.MACHINE_TERMINAL_DEVICE_TOKEN;
+    const socket = new wrapper_default(config3.MACHINE_TERMINAL_GATEWAY_URL, {
+      headers: { Authorization: "Bearer " + token }
+    });
+    disposeSocket = () => socket.terminate();
+    const pending = /* @__PURE__ */ new Map();
+    let requestProgressEnabled = false;
+    const forwarder = new ProcessEventForwarder(
+      async (name, args) => client.callTool({ name, arguments: args }),
+      (message) => {
+        if (socket.readyState !== wrapper_default.OPEN) return;
+        if (socket.bufferedAmount > 512e3) {
+          socket.close(1013, "Process event backpressure");
+          throw new Error(
+            "Process event WebSocket backpressure limit reached."
+          );
+        }
+        socket.send(JSON.stringify(message));
+      },
+      options.log,
+      acknowledged,
+      3e3,
+      () => {
+        if (socket.readyState === wrapper_default.OPEN) {
+          socket.close(1013, "Process event delivery stalled");
+        }
+      }
+    );
+    const stop2 = () => socket.close(1e3, "Client stopping.");
+    signal?.addEventListener("abort", stop2, { once: true });
+    socket.on("open", () => {
+      socket.send(
+        JSON.stringify({
+          type: "hello",
+          deviceId: config3.MACHINE_TERMINAL_DEVICE_ID,
+          deviceSecret: config3.MACHINE_TERMINAL_DEVICE_SECRET,
+          name: config3.MACHINE_TERMINAL_DEVICE_NAME,
+          platform: os.platform() + "-" + os.arch(),
+          protocolVersion: 2,
+          capabilities: supportedAgentTools
+        })
+      );
+    });
+    socket.on("message", (raw) => {
+      try {
+        const message = JSON.parse(raw.toString());
+        const cancelled = cancelSchema.safeParse(message);
+        if (cancelled.success) {
+          pending.get(cancelled.data.requestId)?.abort();
+          return;
+        }
+        const ack = ackSchema.safeParse(message);
+        if (ack.success) {
+          forwarder.acknowledge(ack.data.sessionId, ack.data.sequence);
+          return;
+        }
+        if (message && typeof message === "object" && "type" in message && message.type === "ready") {
+          requestProgressEnabled = message.requestProgressVersion === 1;
+          void forwarder.recover().catch(
+            (error62) => options.log?.(
+              "Could not recover local process streams: " + (error62 instanceof Error ? error62.message : "unknown error")
+            )
+          );
+          return;
+        }
+      } catch {
+        options.log?.("Ignoring a malformed gateway message.");
+        return;
+      }
+      void handleMessage(
+        options,
+        client,
+        socket,
+        raw,
+        pending,
+        forwarder,
+        requestProgressEnabled
+      );
+    });
+    socket.on("close", () => {
+      forwarder.close();
+      for (const controller2 of pending.values()) controller2.abort();
+    });
+    await new Promise((resolve, reject) => {
+      socket.once("close", resolve);
+      socket.once("error", reject);
+    }).finally(() => signal?.removeEventListener("abort", stop2));
+  } finally {
+    disposeSocket?.();
+    await client.close().catch(() => void 0);
+  }
 }
-async function handleMessage(options, client, socket, raw) {
+async function handleMessage(options, client, socket, raw, pending, forwarder, requestProgressEnabled) {
   let requestId;
+  let controller2;
+  let deadlineTimer;
   try {
-    const parsed = requestSchema.parse(JSON.parse(raw.toString()));
-    requestId = parsed.requestId;
+    const payload = JSON.parse(raw.toString());
+    const envelope = requestEnvelope.safeParse(payload);
+    if (!envelope.success) {
+      options.log?.("Ignoring a request with an invalid envelope.");
+      return;
+    }
+    requestId = envelope.data.requestId;
+    const parsed = requestSchema.safeParse(payload);
+    if (!parsed.success) {
+      const tool = payload && typeof payload === "object" && "tool" in payload ? payload.tool : void 0;
+      if (typeof tool === "string" && !supportedAgentTools.includes(tool)) {
+        throw new Error(
+          "UNSUPPORTED_TOOL: " + tool + ". Update the local companion."
+        );
+      }
+      throw new Error("INVALID_REQUEST: Invalid tool arguments or deadline.");
+    }
+    if (pending.has(requestId)) {
+      throw new Error(
+        "DUPLICATE_REQUEST: This request is already in progress."
+      );
+    }
+    const deadlineAt = parsed.data.deadlineAt ?? Date.now() + DEFAULT_REQUEST_LIFETIME_MS;
+    if (deadlineAt <= Date.now()) {
+      throw new Error("REQUEST_EXPIRED: The request deadline has passed.");
+    }
+    controller2 = new AbortController();
+    pending.set(requestId, controller2);
+    deadlineTimer = setTimeout(
+      () => controller2?.abort(),
+      Math.max(0, deadlineAt - Date.now())
+    );
+    let progressSequence = 0;
+    const progress = (phase) => {
+      if (!requestProgressEnabled || parsed.data.tool !== "start_process" || socket.readyState !== wrapper_default.OPEN)
+        return;
+      if (socket.bufferedAmount > 512e3) {
+        socket.close(1013, "Request progress backpressure");
+        return;
+      }
+      try {
+        socket.send(
+          JSON.stringify({
+            type: "request_progress",
+            requestId,
+            sequence: ++progressSequence,
+            phase,
+            ...phase === "approved" ? {
+              approvalMode: options.config.MACHINE_TERMINAL_AUTO_APPROVE === "1" ? "automatic" : "manual"
+            } : {}
+          })
+        );
+      } catch {
+      }
+    };
+    progress("received");
     await authorizeToolCall(
-      parsed.tool,
-      parsed.arguments,
+      parsed.data.tool,
+      parsed.data.arguments,
       options.config.MACHINE_TERMINAL_AGENT_ALLOW_DESTRUCTIVE === "1",
-      options.approve
+      options.approve,
+      controller2.signal,
+      progress
     );
+    assertActive(controller2.signal);
     const result = await client.callTool({
-      name: parsed.tool,
-      arguments: parsed.arguments
+      name: parsed.data.tool,
+      arguments: parsed.data.arguments
     });
     if (result.isError) {
       const content = Array.isArray(result.content) ? result.content : [];
@@ -35577,6 +36091,12 @@ async function handleMessage(options, client, socket, raw) {
           result: result.structuredContent ?? { content: result.content }
         })
       );
+      if (parsed.data.tool === "start_process") {
+        const snapshot = result.structuredContent;
+        if (snapshot && typeof snapshot === "object" && "sessionId" in snapshot && typeof snapshot.sessionId === "string" && "taskId" in snapshot && typeof snapshot.taskId === "string") {
+          forwarder.watch(snapshot.sessionId);
+        }
+      }
     }
   } catch (error62) {
     if (!requestId || socket.readyState !== wrapper_default.OPEN) return;
@@ -35587,18 +36107,24 @@ async function handleMessage(options, client, socket, raw) {
         error: error62 instanceof Error ? error62.message : "Local request failed."
       })
     );
+  } finally {
+    if (deadlineTimer) clearTimeout(deadlineTimer);
+    if (requestId && controller2 && pending.get(requestId) === controller2) {
+      pending.delete(requestId);
+    }
   }
 }
 async function runAgent(options) {
   let reconnectDelayMs = 1e3;
+  const acknowledged = /* @__PURE__ */ new Map();
   while (!options.signal?.aborted) {
     try {
-      await connectOnce(options);
+      await connectOnce(options, acknowledged);
       reconnectDelayMs = 1e3;
     } catch (error62) {
       if (options.signal?.aborted) break;
       options.log?.(
-        `Connection failed: ${error62 instanceof Error ? error62.message : "unknown error"}`
+        "Connection failed: " + (error62 instanceof Error ? error62.message : "unknown error")
       );
     }
     if (options.signal?.aborted) break;
@@ -35622,7 +36148,9 @@ import os2 from "node:os";
 var schema = external_exports.object({
   MACHINE_TERMINAL_GATEWAY_URL: external_exports.string().url(),
   MACHINE_TERMINAL_DEVICE_TOKEN: external_exports.string().min(1),
+  MACHINE_TERMINAL_LOCAL_AGENT_TOKEN: external_exports.string().regex(/^[a-f0-9]{64}$/i).optional(),
   MACHINE_TERMINAL_DEVICE_ID: external_exports.string().min(1).max(128),
+  MACHINE_TERMINAL_DEVICE_SECRET: external_exports.string().regex(/^[a-f0-9]{64}$/i).optional(),
   MACHINE_TERMINAL_DEVICE_NAME: external_exports.string().min(1).max(128).default(os2.hostname()),
   MACHINE_TERMINAL_LOCAL_MCP_URL: external_exports.string().url().default("http://127.0.0.1:3333/mcp"),
   MACHINE_TERMINAL_AGENT_ALLOW_DESTRUCTIVE: external_exports.enum(["0", "1"]).default("0"),
@@ -35670,55 +36198,78 @@ var dim = (text) => paint("dim", text);
 var warn = (text) => paint("yellow", text);
 
 // src/approval.ts
+var DEFAULT_APPROVAL_TIMEOUT_MS = 3e4;
+function safeLabel(value) {
+  return JSON.stringify(String(value));
+}
 function approvalSummary(tool, args) {
   if (tool === "write_text_file") {
     const bytes = Buffer.byteLength(String(args.contents ?? ""));
-    return `Write ${bytes} bytes to ${String(args.path ?? "an unknown path")}${args.overwrite ? " (overwrite)" : ""}`;
+    return "Write " + bytes + " bytes to " + safeLabel(args.path ?? "an unknown path") + (args.overwrite ? " (overwrite)" : "");
   }
   if (tool === "start_process") {
     const command = [
-      String(args.program ?? ""),
-      ...Array.isArray(args.args) ? args.args.map(String) : []
+      safeLabel(args.program ?? ""),
+      ...Array.isArray(args.args) ? args.args.map(safeLabel) : []
     ];
-    return `Start: ${command.join(" ")}`;
+    return "Start: " + command.join(" ") + " (cwd: " + safeLabel(args.cwd ?? "configured root") + ")";
   }
   if (tool === "terminate_process") {
-    return `Terminate process session ${String(args.sessionId ?? "")}`;
+    return "Terminate process session " + safeLabel(args.sessionId ?? "");
   }
-  return `Run destructive tool: ${tool}`;
+  return "Run destructive tool: " + safeLabel(tool);
 }
 function createAutoApprover() {
-  return (tool, args) => {
+  return (tool, args, signal) => {
+    if (signal?.aborted) return Promise.resolve(false);
     console.log(
-      `
-${warn("Approval requested:")} ${approvalSummary(tool, args)} ${dim("(auto-approved)")}`
+      "\n" + warn("Approval requested:") + " " + approvalSummary(tool, args) + " " + dim("(auto-approved)")
     );
     return Promise.resolve(true);
   };
 }
-function createTerminalApprover() {
-  let queue = Promise.resolve(false);
-  return (tool, args) => {
-    queue = queue.catch(() => false).then(async () => {
-      if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+function createTerminalApprover(timeoutMs = DEFAULT_APPROVAL_TIMEOUT_MS) {
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1) {
+    throw new Error("Approval timeout must be a positive integer.");
+  }
+  let queue = Promise.resolve();
+  return (tool, args, signal) => {
+    const next = queue.then(async () => {
+      if (!process.stdin.isTTY || !process.stdout.isTTY || signal?.aborted) {
+        return false;
+      }
+      const controller2 = new AbortController();
+      const abort = () => controller2.abort();
+      signal?.addEventListener("abort", abort, { once: true });
+      const timer = setTimeout(abort, timeoutMs);
       const prompt = createInterface({
         input: process.stdin,
         output: process.stdout
       });
       try {
+        if (signal?.aborted) return false;
         console.log(
-          `
-${warn("Approval requested:")} ${approvalSummary(tool, args)}`
+          "\n" + warn("Approval requested:") + " " + approvalSummary(tool, args)
         );
         const answer = await prompt.question(
-          `${bold("Approve this action?")} [y/N] `
+          bold("Approve this action?") + " [y/N] ",
+          { signal: controller2.signal }
         );
-        return (/* @__PURE__ */ new Set(["y", "yes"])).has(answer.trim().toLowerCase());
+        return !controller2.signal.aborted && (/* @__PURE__ */ new Set(["y", "yes"])).has(answer.trim().toLowerCase());
+      } catch (error62) {
+        if (controller2.signal.aborted) return false;
+        throw error62;
       } finally {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", abort);
         prompt.close();
       }
     });
-    return queue;
+    queue = next.then(
+      () => void 0,
+      () => void 0
+    );
+    return next;
   };
 }