theus-cli-linux-arm64 1.2.2 → 1.3.0

package/vendor/theus-arsenal/scripts/hooks/salud-mcp.js

@@ -1,749 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/**
- * MCP health-check hook.
- *
- * Compatible con los eventos de hook del motor de Theus:
- * - PreToolUse: probe MCP server health before MCP tool execution
- * - PostToolUseFailure: mark unhealthy servers, attempt reconnect, and re-probe
- *
- * The hook persists health state outside the conversation context so it
- * survives compaction and later turns.
- */
-
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const http = require('http');
-const https = require('https');
-const { spawn, spawnSync } = require('child_process');
-
-const MAX_STDIN = 1024 * 1024;
-const DEFAULT_TTL_MS = 2 * 60 * 1000;
-const DEFAULT_TIMEOUT_MS = 5000;
-const DEFAULT_BACKOFF_MS = 30 * 1000;
-const MAX_BACKOFF_MS = 10 * 60 * 1000;
-// The preflight HTTP probe only checks reachability; it does not have access to
-// el token OAuth almacenado del CLI. Trata las respuestas con auth como
-// reachable so the real MCP client can attempt the authenticated call. A
-// Streamable HTTP MCP server can also return 406 to a bare GET that omits
-// Accept: text/event-stream; that still proves the endpoint is alive.
-const HEALTHY_HTTP_CODES = new Set([200, 201, 202, 204, 301, 302, 303, 304, 307, 308, 400, 401, 403, 405, 406]);
-const RECONNECT_STATUS_CODES = new Set([401, 403, 429, 503]);
-const FAILURE_PATTERNS = [
-  { code: 401, pattern: /\b401\b|unauthori[sz]ed|auth(?:entication)?\s+(?:failed|expired|invalid)/i },
-  { code: 403, pattern: /\b403\b|forbidden|permission denied/i },
-  { code: 429, pattern: /\b429\b|rate limit|too many requests/i },
-  { code: 503, pattern: /\b503\b|service unavailable|overloaded|temporarily unavailable/i },
-  { code: 'transport', pattern: /ECONNREFUSED|ENOTFOUND|EAI_AGAIN|timed? out|socket hang up|connection (?:failed|lost|reset|closed)/i }
-];
-
-function envNumber(name, fallback) {
-  const value = Number(process.env[name]);
-  return Number.isFinite(value) && value >= 0 ? value : fallback;
-}
-
-function stateFilePath() {
-  if (process.env.THEUS_SALUD_MCP_STATE_PATH) {
-    return path.resolve(process.env.THEUS_SALUD_MCP_STATE_PATH);
-  }
-  return path.join(require('../lib/agent-data-home').resolveAgentDataHome(), 'salud-mcp', 'cache-salud.json');
-}
-
-function configPaths() {
-  if (process.env.THEUS_SALUD_MCP_CONFIG_PATH) {
-    return process.env.THEUS_SALUD_MCP_CONFIG_PATH
-      .split(path.delimiter)
-      .map(entry => entry.trim())
-      .filter(Boolean)
-      .map(entry => path.resolve(entry));
-  }
-
-  const cwd = process.cwd();
-  const home = os.homedir();
-
-  return [
-    path.join(cwd, '.mcp.json'),
-    path.join(cwd, '.theus', 'settings.json'),
-    path.join(home, '.theus.json'),
-    path.join(home, '.theus', 'settings.json')
-  ];
-}
-
-function readJsonFile(filePath) {
-  try {
-    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
-  } catch {
-    return null;
-  }
-}
-
-function loadState(filePath) {
-  const state = readJsonFile(filePath);
-  if (!state || typeof state !== 'object' || Array.isArray(state)) {
-    return { version: 1, servers: {} };
-  }
-
-  if (!state.servers || typeof state.servers !== 'object' || Array.isArray(state.servers)) {
-    state.servers = {};
-  }
-
-  return state;
-}
-
-function saveState(filePath, state) {
-  try {
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, JSON.stringify(state, null, 2));
-  } catch {
-    // Never block the hook on state persistence errors.
-  }
-}
-
-function readRawStdin() {
-  return new Promise(resolve => {
-    let raw = '';
-    let truncated = /^(1|true|yes)$/i.test(String(process.env.THEUS_HOOK_INPUT_TRUNCATED || ''));
-    process.stdin.setEncoding('utf8');
-    process.stdin.on('data', chunk => {
-      if (raw.length < MAX_STDIN) {
-        const remaining = MAX_STDIN - raw.length;
-        raw += chunk.substring(0, remaining);
-        if (chunk.length > remaining) {
-          truncated = true;
-        }
-      } else {
-        truncated = true;
-      }
-    });
-    process.stdin.on('end', () => resolve({ raw, truncated }));
-    process.stdin.on('error', () => resolve({ raw, truncated }));
-  });
-}
-
-function safeParse(raw) {
-  try {
-    return raw.trim() ? JSON.parse(raw) : {};
-  } catch {
-    return {};
-  }
-}
-
-function extractMcpTarget(input) {
-  const toolName = String(input.tool_name || input.name || '');
-  const explicitServer = input.server
-    || input.mcp_server
-    || input.tool_input?.server
-    || input.tool_input?.mcp_server
-    || input.tool_input?.connector
-    || null;
-  const explicitTool = input.tool
-    || input.mcp_tool
-    || input.tool_input?.tool
-    || input.tool_input?.mcp_tool
-    || null;
-
-  if (explicitServer) {
-    return {
-      server: String(explicitServer),
-      tool: explicitTool ? String(explicitTool) : toolName
-    };
-  }
-
-  if (!toolName.startsWith('mcp__')) {
-    return null;
-  }
-
-  const segments = toolName.slice(5).split('__');
-  if (segments.length < 2 || !segments[0]) {
-    return null;
-  }
-
-  return {
-    server: segments[0],
-    tool: segments.slice(1).join('__')
-  };
-}
-
-function extractMcpTargetFromRaw(raw) {
-  const toolNameMatch = raw.match(/"(?:tool_name|name)"\s*:\s*"([^"]+)"/);
-  const serverMatch = raw.match(/"(?:server|mcp_server|connector)"\s*:\s*"([^"]+)"/);
-  const toolMatch = raw.match(/"(?:tool|mcp_tool)"\s*:\s*"([^"]+)"/);
-
-  return extractMcpTarget({
-    tool_name: toolNameMatch ? toolNameMatch[1] : '',
-    server: serverMatch ? serverMatch[1] : undefined,
-    tool: toolMatch ? toolMatch[1] : undefined
-  });
-}
-
-function resolveServerConfig(serverName) {
-  for (const filePath of configPaths()) {
-    const data = readJsonFile(filePath);
-    const server = data?.mcpServers?.[serverName]
-      || data?.mcp_servers?.[serverName]
-      || null;
-
-    if (server && typeof server === 'object' && !Array.isArray(server)) {
-      return {
-        config: server,
-        source: filePath
-      };
-    }
-  }
-
-  return null;
-}
-
-function markHealthy(state, serverName, now, details = {}) {
-  state.servers[serverName] = {
-    status: 'healthy',
-    checkedAt: now,
-    expiresAt: now + envNumber('THEUS_SALUD_MCP_TTL_MS', DEFAULT_TTL_MS),
-    failureCount: 0,
-    lastError: null,
-    lastFailureCode: null,
-    nextRetryAt: now,
-    lastRestoredAt: now,
-    ...details
-  };
-}
-
-function markUnhealthy(state, serverName, now, failureCode, errorMessage) {
-  const previous = state.servers[serverName] || {};
-  const failureCount = Number(previous.failureCount || 0) + 1;
-  const backoffBase = envNumber('THEUS_SALUD_MCP_BACKOFF_MS', DEFAULT_BACKOFF_MS);
-  const nextRetryDelay = Math.min(backoffBase * (2 ** Math.max(failureCount - 1, 0)), MAX_BACKOFF_MS);
-
-  state.servers[serverName] = {
-    status: 'unhealthy',
-    checkedAt: now,
-    expiresAt: now,
-    failureCount,
-    lastError: errorMessage || null,
-    lastFailureCode: failureCode || null,
-    nextRetryAt: now + nextRetryDelay,
-    lastRestoredAt: previous.lastRestoredAt || null
-  };
-}
-
-function failureSummary(input) {
-  const output = input.tool_output;
-  const pieces = [
-    typeof input.error === 'string' ? input.error : '',
-    typeof input.message === 'string' ? input.message : '',
-    typeof input.tool_response === 'string' ? input.tool_response : '',
-    typeof output === 'string' ? output : '',
-    typeof output?.output === 'string' ? output.output : '',
-    typeof output?.stderr === 'string' ? output.stderr : '',
-    typeof input.tool_input?.error === 'string' ? input.tool_input.error : ''
-  ].filter(Boolean);
-
-  return pieces.join('\n');
-}
-
-function detectFailureCode(text) {
-  const summary = String(text || '');
-  for (const entry of FAILURE_PATTERNS) {
-    if (entry.pattern.test(summary)) {
-      return entry.code;
-    }
-  }
-  return null;
-}
-
-function requestHttp(urlString, headers, timeoutMs) {
-  return new Promise(resolve => {
-    let settled = false;
-    let timedOut = false;
-
-    const url = new URL(urlString);
-    const client = url.protocol === 'https:' ? https : http;
-
-    const req = client.request(
-      url,
-      {
-        method: 'GET',
-        headers,
-      },
-      res => {
-        if (settled) return;
-        settled = true;
-        res.resume();
-        resolve({
-          ok: HEALTHY_HTTP_CODES.has(res.statusCode),
-          statusCode: res.statusCode,
-          reason: `HTTP ${res.statusCode}`
-        });
-      }
-    );
-
-    req.setTimeout(timeoutMs, () => {
-      timedOut = true;
-      req.destroy(new Error('timeout'));
-    });
-
-    req.on('error', error => {
-      if (settled) return;
-      settled = true;
-      resolve({
-        ok: false,
-        statusCode: null,
-        reason: timedOut ? 'request timed out' : error.message
-      });
-    });
-
-    req.end();
-  });
-}
-
-function probeCommandServer(serverName, config) {
-  return new Promise(resolve => {
-    const command = config.command;
-    const args = Array.isArray(config.args) ? config.args.map(arg => String(arg)) : [];
-    const timeoutMs = envNumber('THEUS_SALUD_MCP_TIMEOUT_MS', DEFAULT_TIMEOUT_MS);
-    const mergedEnv = {
-      ...process.env,
-      ...(config.env && typeof config.env === 'object' && !Array.isArray(config.env) ? config.env : {})
-    };
-
-    let done = false;
-
-    function finish(result) {
-      if (done) return;
-      done = true;
-      resolve(result);
-    }
-
-    // On Windows, commands like 'npx' are commonly exposed as npx.cmd.
-    // Probe bare PATH commands through platform-extension fallbacks, but keep
-    // absolute/relative path commands as a single candidate so their existing
-    // ENOENT failure semantics stay intact.
-    const commandIsString = typeof command === 'string' && command.length > 0;
-    const isPathLike = commandIsString && (
-      path.isAbsolute(command)
-      || command.includes('/')
-      || command.includes('\\')
-    );
-    const candidates = process.platform === 'win32'
-      && commandIsString
-      && !path.extname(command)
-      && !isPathLike
-        ? [command, `${command}.cmd`, `${command}.exe`, `${command}.bat`]
-        : [command];
-
-    // cmd.exe treats these as operators, grouping syntax, expansion markers,
-    // separators, or argument boundaries. Do not route such command strings
-    // through shell mode.
-    const UNSAFE_SHELL_CHARS = /[&|<>^%!()\s;]/;
-
-    // When spawning via cmd.exe (shell:true) on Windows, Node concatenates
-    // command + args WITHOUT quoting (DEP0190). An arg containing a space —
-    // such as a path under "C:\Program Files" — gets re-split by cmd.exe.
-    // Build a properly-quoted command line instead and pass it as a single
-    // string with no args array, so cmd.exe sees each token as one unit.
-    function quoteWin(token) {
-      // If the token has no characters that need quoting, return it as-is.
-      if (!/[\s"&|<>^%!();]/.test(token)) {
-        return token;
-      }
-      // Escape embedded double quotes by doubling them, then wrap in double
-      // quotes. cmd.exe uses "" as an escaped quote inside a quoted string.
-      return '"' + token.replace(/"/g, '""') + '"';
-    }
-
-    function attempt(idx) {
-      const tryCommand = candidates[idx];
-      const isLast = idx + 1 >= candidates.length;
-      let stderr = '';
-      let attemptDone = false;
-      let timer = null;
-
-      function retryNext() {
-        if (attemptDone) return;
-        attemptDone = true;
-        if (timer) {
-          clearTimeout(timer);
-          timer = null;
-        }
-        attempt(idx + 1);
-      }
-
-      function attemptFinish(result) {
-        if (attemptDone) return;
-        attemptDone = true;
-        if (timer) {
-          clearTimeout(timer);
-          timer = null;
-        }
-        finish(result);
-      }
-
-      // Node 18.20+/20.12+ refuse to spawn .cmd/.bat directly on Windows
-      // after the CVE-2024-27980 mitigation. Only those extension candidates
-      // go through cmd.exe, after the command string is shell-character clean.
-      const useShell = process.platform === 'win32'
-        && typeof tryCommand === 'string'
-        && /\.(cmd|bat)$/i.test(tryCommand)
-        && !UNSAFE_SHELL_CHARS.test(tryCommand);
-
-      let child;
-      try {
-        if (useShell) {
-          // Build a single quoted command line for cmd.exe. Passing an args
-          // array with shell:true causes Node to concatenate without quoting
-          // (DEP0190), which splits space-containing args (e.g. paths under
-          // "C:\Program Files") at every space boundary.
-          const quotedCmdline = [tryCommand, ...args].map(quoteWin).join(' ');
-          child = spawn(quotedCmdline, {
-            env: mergedEnv,
-            cwd: process.cwd(),
-            stdio: ['pipe', 'ignore', 'pipe'],
-            shell: true
-          });
-        } else {
-          child = spawn(tryCommand, args, {
-            env: mergedEnv,
-            cwd: process.cwd(),
-            stdio: ['pipe', 'ignore', 'pipe'],
-            shell: false
-          });
-        }
-      } catch (error) {
-        if ((error.code === 'ENOENT' || error.code === 'EINVAL') && !isLast) {
-          retryNext();
-          return;
-        }
-        attemptFinish({
-          ok: false,
-          statusCode: null,
-          reason: error.message
-        });
-        return;
-      }
-
-      child.stderr.on('data', chunk => {
-        if (stderr.length < 4000) {
-          const remaining = 4000 - stderr.length;
-          stderr += String(chunk).slice(0, remaining);
-        }
-      });
-
-      child.on('error', error => {
-        if ((error.code === 'ENOENT' || error.code === 'EINVAL') && !isLast) {
-          retryNext();
-          return;
-        }
-        attemptFinish({
-          ok: false,
-          statusCode: null,
-          reason: error.message
-        });
-      });
-
-      child.on('exit', (code, signal) => {
-        attemptFinish({
-          ok: false,
-          statusCode: code,
-          reason: stderr.trim() || `process exited before handshake (${signal || code || 'unknown'})`
-        });
-      });
-
-      timer = setTimeout(() => {
-        // A fast-crashing stdio server can finish before the timer callback runs
-        // on a loaded machine. Check the process state again before classifying it
-        // as healthy on timeout.
-        if (child.exitCode !== null || child.signalCode !== null) {
-          attemptFinish({
-            ok: false,
-            statusCode: child.exitCode,
-            reason: stderr.trim() || `process exited before handshake (${child.signalCode || child.exitCode || 'unknown'})`
-          });
-          return;
-        }
-
-        try {
-          if (useShell && child.pid && process.platform === 'win32') {
-            // When spawned via shell on Windows, child is cmd.exe. kill() only
-            // terminates the shell and leaves the real server process orphaned.
-            // taskkill /T kills the entire process tree rooted at cmd.exe.
-            const killResult = spawnSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], {
-              stdio: 'ignore',
-              windowsHide: true
-            });
-            if (killResult.error || (typeof killResult.status === 'number' && killResult.status !== 0)) {
-              // taskkill not on PATH, permission denied, or already exited.
-              // Best-effort fallback: signal the cmd.exe shell directly. The
-              // child tree may still leak if it already detached, but this at
-              // least kills the shell we spawned.
-              try { child.kill('SIGKILL'); } catch { /* ignore */ }
-            }
-          } else {
-            child.kill('SIGTERM');
-            setTimeout(() => {
-              try {
-                child.kill('SIGKILL');
-              } catch {
-                // ignore
-              }
-            }, 200).unref?.();
-          }
-        } catch {
-          // ignore
-        }
-
-        attemptFinish({
-          ok: true,
-          statusCode: null,
-          reason: `${serverName} accepted a new stdio process`
-        });
-      }, timeoutMs);
-
-      if (typeof timer.unref === 'function') {
-        timer.unref();
-      }
-    }
-
-    attempt(0);
-  });
-}
-
-async function probeServer(serverName, resolvedConfig) {
-  const config = resolvedConfig.config;
-
-  if (config.type === 'http' || config.url) {
-    const result = await requestHttp(config.url, config.headers || {}, envNumber('THEUS_SALUD_MCP_TIMEOUT_MS', DEFAULT_TIMEOUT_MS));
-
-    return {
-      ok: result.ok,
-      failureCode: RECONNECT_STATUS_CODES.has(result.statusCode) ? result.statusCode : null,
-      reason: result.reason,
-      source: resolvedConfig.source
-    };
-  }
-
-  if (config.command) {
-    const result = await probeCommandServer(serverName, config);
-
-    return {
-      ok: result.ok,
-      failureCode: RECONNECT_STATUS_CODES.has(result.statusCode) ? result.statusCode : null,
-      reason: result.reason,
-      source: resolvedConfig.source
-    };
-  }
-
-  return {
-    ok: false,
-    failureCode: null,
-    reason: 'unsupported MCP server config',
-    source: resolvedConfig.source
-  };
-}
-
-function reconnectCommand(serverName) {
-  const key = `THEUS_SALUD_MCP_RECONEXION_${String(serverName).toUpperCase().replace(/[^A-Z0-9]/g, '_')}`;
-  const command = process.env[key] || process.env.THEUS_SALUD_MCP_COMANDO_RECONEXION || '';
-  if (!command.trim()) {
-    return null;
-  }
-
-  return command.includes('{server}')
-    ? command.replace(/\{server\}/g, serverName)
-    : command;
-}
-
-function attemptReconnect(serverName) {
-  const command = reconnectCommand(serverName);
-  if (!command) {
-    return { attempted: false, success: false, reason: 'no reconnect command configured' };
-  }
-
-  const result = spawnSync(command, {
-    shell: true,
-    env: process.env,
-    cwd: process.cwd(),
-    encoding: 'utf8',
-    timeout: envNumber('THEUS_SALUD_MCP_RECONEXION_TIMEOUT_MS', DEFAULT_TIMEOUT_MS)
-  });
-
-  if (result.error) {
-    return { attempted: true, success: false, reason: result.error.message };
-  }
-
-  if (result.status !== 0) {
-    return {
-      attempted: true,
-      success: false,
-      reason: (result.stderr || result.stdout || `reconnect exited ${result.status}`).trim()
-    };
-  }
-
-  return { attempted: true, success: true, reason: 'reconnect command completed' };
-}
-
-function shouldFailOpen() {
-  return /^(1|true|yes)$/i.test(String(process.env.THEUS_SALUD_MCP_FAIL_OPEN || ''));
-}
-
-function emitLogs(logs) {
-  for (const line of logs) {
-    process.stderr.write(`${line}\n`);
-  }
-}
-
-async function handlePreToolUse(rawInput, input, target, statePathValue, now) {
-  const logs = [];
-  const state = loadState(statePathValue);
-  const previous = state.servers[target.server] || {};
-
-  if (previous.status === 'healthy' && Number(previous.expiresAt || 0) > now) {
-    return { rawInput, exitCode: 0, logs };
-  }
-
-  if (previous.status === 'unhealthy' && Number(previous.nextRetryAt || 0) > now) {
-    logs.push(
-      `[salud-mcp] ${target.server} está marcado como no saludable hasta ${new Date(previous.nextRetryAt).toISOString()}; se omite ${target.tool || 'la tool'}`
-    );
-    return { rawInput, exitCode: shouldFailOpen() ? 0 : 2, logs };
-  }
-
-  const resolvedConfig = resolveServerConfig(target.server);
-  if (!resolvedConfig) {
-    logs.push(`[salud-mcp] No se encontró configuración MCP para ${target.server}; se omite el sondeo previo`);
-    return { rawInput, exitCode: 0, logs };
-  }
-
-  const probe = await probeServer(target.server, resolvedConfig);
-  if (probe.ok) {
-    markHealthy(state, target.server, now, { source: resolvedConfig.source });
-    saveState(statePathValue, state);
-
-    if (previous.status === 'unhealthy') {
-      logs.push(`[salud-mcp] ${target.server}: conexión restablecida`);
-    }
-
-    return { rawInput, exitCode: 0, logs };
-  }
-
-  let reconnect = { attempted: false, success: false, reason: 'probe failed' };
-  if (probe.failureCode || previous.status === 'unhealthy') {
-    reconnect = attemptReconnect(target.server);
-    if (reconnect.success) {
-      const reprobe = await probeServer(target.server, resolvedConfig);
-      if (reprobe.ok) {
-        markHealthy(state, target.server, now, {
-          source: resolvedConfig.source,
-          restoredBy: 'reconnect-command'
-        });
-        saveState(statePathValue, state);
-        logs.push(`[salud-mcp] ${target.server}: conexión restablecida tras la reconexión`);
-        return { rawInput, exitCode: 0, logs };
-      }
-      probe.reason = `${probe.reason}; reconnect reprobe failed: ${reprobe.reason}`;
-    }
-  }
-
-  markUnhealthy(state, target.server, now, probe.failureCode, probe.reason);
-  saveState(statePathValue, state);
-
-  const reconnectSuffix = reconnect.attempted
-    ? ` Reconnect attempt: ${reconnect.success ? 'ok' : reconnect.reason}.`
-    : '';
-  logs.push(
-    `[salud-mcp] ${target.server} no está disponible (${probe.reason}). Se bloquea ${target.tool || 'la tool'} para que el agente recurra a herramientas no MCP.${reconnectSuffix}`
-  );
-
-  return { rawInput, exitCode: shouldFailOpen() ? 0 : 2, logs };
-}
-
-async function handlePostToolUseFailure(rawInput, input, target, statePathValue, now) {
-  const logs = [];
-  const summary = failureSummary(input);
-  const failureCode = detectFailureCode(summary);
-
-  if (!failureCode) {
-    return { rawInput, exitCode: 0, logs };
-  }
-
-  const state = loadState(statePathValue);
-  markUnhealthy(state, target.server, now, failureCode, summary.slice(0, 500));
-  saveState(statePathValue, state);
-
-  logs.push(`[salud-mcp] ${target.server} reportó ${failureCode}; se marca el servidor como no saludable y se intenta reconectar`);
-
-  const reconnect = attemptReconnect(target.server);
-  if (!reconnect.attempted) {
-    logs.push(`[salud-mcp] ${target.server}: reconexión omitida: ${reconnect.reason}`);
-    return { rawInput, exitCode: 0, logs };
-  }
-
-  if (!reconnect.success) {
-    logs.push(`[salud-mcp] ${target.server}: la reconexión falló: ${reconnect.reason}`);
-    return { rawInput, exitCode: 0, logs };
-  }
-
-  const resolvedConfig = resolveServerConfig(target.server);
-  if (!resolvedConfig) {
-    logs.push(`[salud-mcp] ${target.server}: la reconexión terminó pero no había configuración para un sondeo de confirmación`);
-    return { rawInput, exitCode: 0, logs };
-  }
-
-  const reprobe = await probeServer(target.server, resolvedConfig);
-  if (!reprobe.ok) {
-    logs.push(`[salud-mcp] ${target.server}: el comando de reconexión corrió, pero el sondeo de salud siguió fallando: ${reprobe.reason}`);
-    return { rawInput, exitCode: 0, logs };
-  }
-
-  const refreshed = loadState(statePathValue);
-  markHealthy(refreshed, target.server, now, {
-    source: resolvedConfig.source,
-    restoredBy: 'post-failure-reconnect'
-  });
-  saveState(statePathValue, refreshed);
-  logs.push(`[salud-mcp] ${target.server}: conexión restablecida`);
-  return { rawInput, exitCode: 0, logs };
-}
-
-async function main() {
-  const { raw: rawInput, truncated } = await readRawStdin();
-  const input = safeParse(rawInput);
-  const target = extractMcpTarget(input) || (truncated ? extractMcpTargetFromRaw(rawInput) : null);
-
-  if (!target) {
-    process.stdout.write(rawInput);
-    process.exit(0);
-    return;
-  }
-
-  if (truncated) {
-    const limit = Number(process.env.THEUS_HOOK_INPUT_MAX_BYTES) || MAX_STDIN;
-    const logs = [
-      shouldFailOpen()
-        ? `[salud-mcp] La entrada del hook superó ${limit} bytes al revisar ${target.server}; se permite ${target.tool || 'la tool'} porque el modo fail-open está activo`
-        : `[salud-mcp] La entrada del hook superó ${limit} bytes al revisar ${target.server}; se bloquea ${target.tool || 'la tool'} para no eludir los chequeos de salud MCP`
-    ];
-    emitLogs(logs);
-    process.stdout.write(rawInput);
-    process.exit(shouldFailOpen() ? 0 : 2);
-    return;
-  }
-
-  const eventName = process.env.THEUS_HOOK_EVENT_NAME || 'PreToolUse';
-  const now = Date.now();
-  const statePathValue = stateFilePath();
-
-  const result = eventName === 'PostToolUseFailure'
-    ? await handlePostToolUseFailure(rawInput, input, target, statePathValue, now)
-    : await handlePreToolUse(rawInput, input, target, statePathValue, now);
-
-  emitLogs(result.logs);
-  process.stdout.write(result.rawInput);
-  process.exit(result.exitCode);
-}
-
-main().catch(error => {
-  process.stderr.write(`[salud-mcp] Error inesperado: ${error.message}\n`);
-  process.exit(0);
-});