toolhome 0.5.0

package/dist/server/cli-plane/models.js

@@ -0,0 +1,169 @@
+import { z } from 'zod';
+import { slugSchema } from '../domain/models.js';
+/**
+ * CLI plane record schemas (Form A of docs/cli-hosting-research.md).
+ *
+ * A CLI is a first-class entity: a command or container image plus a declarative
+ * allow-list, optional probe for status checks, and an optional Env Credential
+ * whose variables are injected into every execution.
+ */
+/** One argv rule: token patterns, where `*` matches a single argv token. */
+export const cliAllowRuleSchema = z.array(z.string().min(1)).min(1);
+export const cliAllowListSchema = z.object({
+    allow: z.array(cliAllowRuleSchema).default([]),
+    deny: z.array(cliAllowRuleSchema).default([]),
+});
+export const cliProbeSchema = z.object({
+    command: z.string().min(1).max(1024),
+    args: z.array(z.string()).default([]),
+});
+const cliCredentialBindingsValueSchema = z.record(z.string().min(1), z.string().min(1));
+export const cliCredentialBindingsSchema = cliCredentialBindingsValueSchema.default({});
+const cliAuthStrategyValueSchema = z.enum([
+    'none',
+    'azure-service-principal',
+    'tailscale-auth-key',
+]);
+export const cliAuthStrategySchema = cliAuthStrategyValueSchema.default('none');
+const namedVolumeSourceSchema = z
+    .string()
+    .min(1)
+    .max(128)
+    .regex(/^[A-Za-z0-9][A-Za-z0-9_.-]*$/, 'Only Docker named volumes are supported');
+const containerVolumeSchema = z.object({
+    source: namedVolumeSourceSchema,
+    target: z
+        .string()
+        .min(1)
+        .max(512)
+        .refine((value) => value.startsWith('/') && !/[\0\r\n:]/.test(value), 'Container volume targets must be absolute paths without control characters or colons'),
+    readOnly: z.boolean().default(false),
+});
+export const cliRuntimeConfigSchema = z
+    .object({
+    executionMode: z.enum(['host', 'docker']),
+    authStrategy: cliAuthStrategySchema,
+    containerVolumes: z.array(containerVolumeSchema).max(16),
+})
+    .superRefine((value, context) => {
+    if (value.executionMode === 'host' && value.authStrategy !== 'none') {
+        context.addIssue({
+            code: 'custom',
+            path: ['authStrategy'],
+            message: 'Authentication bootstrap requires Docker execution mode',
+        });
+    }
+    if (value.executionMode === 'host' && value.containerVolumes.length > 0) {
+        context.addIssue({
+            code: 'custom',
+            path: ['containerVolumes'],
+            message: 'Container volumes require Docker execution mode',
+        });
+    }
+    const targets = new Set();
+    for (const [index, volume] of value.containerVolumes.entries()) {
+        if (targets.has(volume.target)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['containerVolumes', index, 'target'],
+                message: 'Container volume targets must be unique',
+            });
+        }
+        targets.add(volume.target);
+    }
+});
+export const createCliInputSchema = z
+    .object({
+    slug: slugSchema,
+    name: z.string().min(1).max(120),
+    command: z.string().min(1).max(1024),
+    executionMode: z.enum(['host', 'docker']).default('host'),
+    entrypoint: z.string().min(1).max(256).nullable().default(null),
+    authStrategy: cliAuthStrategySchema,
+    containerVolumes: z.array(containerVolumeSchema).default([]),
+    platform: z.string().min(1).max(120).nullable().default(null),
+    allowList: cliAllowListSchema.default({ allow: [], deny: [] }),
+    interactive: z.boolean().default(false),
+    credentialId: z.string().nullable().default(null),
+    credentialBindings: cliCredentialBindingsSchema,
+    probe: cliProbeSchema.nullable().default(null),
+    enabled: z.boolean().default(true),
+    timeoutMs: z.number().int().min(100).max(3_600_000).default(60_000),
+    maxOutputBytes: z
+        .number()
+        .int()
+        .min(1024)
+        .max(64 * 1024 * 1024)
+        .default(64 * 1024),
+})
+    .superRefine((value, context) => {
+    const result = cliRuntimeConfigSchema.safeParse(value);
+    if (!result.success) {
+        for (const issue of result.error.issues) {
+            context.addIssue({
+                code: issue.code === 'custom' ? 'custom' : 'custom',
+                path: issue.path,
+                message: issue.message,
+            });
+        }
+    }
+});
+export const updateCliInputSchema = z.object({
+    name: z.string().min(1).max(120).optional(),
+    command: z.string().min(1).max(1024).optional(),
+    executionMode: z.enum(['host', 'docker']).optional(),
+    entrypoint: z.string().min(1).max(256).nullable().optional(),
+    authStrategy: cliAuthStrategyValueSchema.optional(),
+    containerVolumes: z.array(containerVolumeSchema).optional(),
+    platform: z.string().min(1).max(120).nullable().optional(),
+    allowList: cliAllowListSchema.optional(),
+    interactive: z.boolean().optional(),
+    credentialId: z.string().nullable().optional(),
+    credentialBindings: cliCredentialBindingsValueSchema.optional(),
+    probe: cliProbeSchema.nullable().optional(),
+    enabled: z.boolean().optional(),
+    timeoutMs: z.number().int().min(100).max(3_600_000).optional(),
+    maxOutputBytes: z
+        .number()
+        .int()
+        .min(1024)
+        .max(64 * 1024 * 1024)
+        .optional(),
+});
+export function assertCliRuntimeConfig(value) {
+    cliRuntimeConfigSchema.parse(value);
+}
+export const cliRecordSchema = z.object({
+    id: z.uuid(),
+    slug: slugSchema,
+    name: z.string(),
+    command: z.string(),
+    executionMode: z.enum(['host', 'docker']),
+    entrypoint: z.string().min(1).max(256).nullable(),
+    authStrategy: cliAuthStrategySchema,
+    containerVolumes: z.array(containerVolumeSchema),
+    platform: z.string().min(1).max(120).nullable(),
+    allowList: cliAllowListSchema,
+    interactive: z.boolean(),
+    credentialId: z.string().nullable(),
+    credentialBindings: cliCredentialBindingsSchema,
+    probe: cliProbeSchema.nullable(),
+    enabled: z.boolean(),
+    timeoutMs: z.number(),
+    maxOutputBytes: z.number(),
+    createdAt: z.iso.datetime(),
+    updatedAt: z.iso.datetime(),
+});
+/** Per-exec request body. `argv` is an array only — never a shell string. */
+export const cliExecInputSchema = z.object({
+    argv: z.array(z.string()).min(1),
+    stdin: z.string().nullable().optional(),
+    timeoutMs: z.number().int().min(100).max(3_600_000).optional(),
+    maxOutputBytes: z
+        .number()
+        .int()
+        .min(1024)
+        .max(64 * 1024 * 1024)
+        .optional(),
+});
+//# sourceMappingURL=models.js.map

package/dist/server/cli-plane/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../../src/cli-plane/models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD;;;;;;GAMG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAExF,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IACxC,MAAM;IACN,yBAAyB;IACzB,oBAAoB;CACrB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAEhF,MAAM,uBAAuB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,8BAA8B,EAAE,yCAAyC,CAAC,CAAC;AAEpF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAC5D,sFAAsF,CACvF;IACH,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,YAAY,EAAE,qBAAqB;IACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACzD,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACpE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,yDAAyD;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,iDAAiD;SAC3D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,EAAE,QAAQ,CAAC;gBAC3C,OAAO,EAAE,yCAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACzD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/D,YAAY,EAAE,qBAAqB;IACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7D,SAAS,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC9D,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD,kBAAkB,EAAE,2BAA2B;IAC/C,KAAK,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACnE,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;SACrB,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;CACtB,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBACnD,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5D,YAAY,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1D,SAAS,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,kBAAkB,EAAE,gCAAgC,CAAC,QAAQ,EAAE;IAC/D,KAAK,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;SACrB,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CAAC,KAItC;IACC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACjD,YAAY,EAAE,qBAAqB;IACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,kBAAkB;IAC7B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,kBAAkB,EAAE,2BAA2B;IAC/C,KAAK,EAAE,cAAc,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;SACrB,QAAQ,EAAE;CACd,CAAC,CAAC"}

package/dist/server/cli-plane/routes.d.ts

@@ -0,0 +1,32 @@
+import type { Logger } from '../observability/logger.js';
+import type { AuthService } from '../security/auth-service.js';
+import type { CliService } from './cli-service.js';
+interface HonoLike {
+    get(path: string, handler: (context: HonoContext) => Response | Promise<Response>): void;
+    post(path: string, handler: (context: HonoContext) => Response | Promise<Response>): void;
+}
+interface HonoContext {
+    req: {
+        raw: Request;
+        path: string;
+        param(name: string): string;
+        json(): Promise<unknown>;
+    };
+}
+/**
+ * Mount the CLI data-plane routes (docs/cli-hosting-research.md §2.2/§2.6):
+ *
+ *   POST /cli/{slug}/exec     NDJSON stream of stdout/stderr/exit frames
+ *   GET  /cli/{slug}/status   { installed, version, loggedIn, lastCheckedAt }
+ *
+ * Both require an admin Control Key. All validation and the allow-list verdict
+ * happen before the response stream starts, so 400/403/404 errors are returned
+ * as JSON without spawning anything.
+ */
+export declare function mountCliExecRoutes(app: HonoLike, options: {
+    service: CliService;
+    auth: AuthService;
+    logger: Logger;
+}): void;
+export {};
+//# sourceMappingURL=routes.d.ts.map

package/dist/server/cli-plane/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/cli-plane/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,UAAU,QAAQ;IAChB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACzF,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;CAC3F;AAED,UAAU,WAAW;IACnB,GAAG,EAAE;QACH,GAAG,EAAE,OAAO,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;QAC5B,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;KAC1B,CAAC;CACH;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClE,IAAI,CA0EN"}

package/dist/server/cli-plane/routes.js

@@ -0,0 +1,94 @@
+import { AppError } from '../domain/errors.js';
+import { errorResponse } from '../control/control-api.js';
+import { cliNdjsonContentType, encodeFrame } from './frames.js';
+/**
+ * Mount the CLI data-plane routes (docs/cli-hosting-research.md §2.2/§2.6):
+ *
+ *   POST /cli/{slug}/exec     NDJSON stream of stdout/stderr/exit frames
+ *   GET  /cli/{slug}/status   { installed, version, loggedIn, lastCheckedAt }
+ *
+ * Both require an admin Control Key. All validation and the allow-list verdict
+ * happen before the response stream starts, so 400/403/404 errors are returned
+ * as JSON without spawning anything.
+ */
+export function mountCliExecRoutes(app, options) {
+    const requireAdmin = (context) => {
+        const principal = options.auth.authenticateBearer('control', context.req.raw);
+        if (principal.scope !== 'admin') {
+            throw new AppError('forbidden', 'This operation requires an admin control key', 403);
+        }
+    };
+    app.post('/cli/:slug/exec', async (context) => {
+        try {
+            requireAdmin(context);
+            let body;
+            try {
+                body = await context.req.json();
+            }
+            catch {
+                throw new AppError('validation_error', 'Request body must be JSON', 400);
+            }
+            const prepared = options.service.prepareExec(context.req.param('slug'), body);
+            const abort = new AbortController();
+            const stream = new ReadableStream({
+                start(controller) {
+                    void (async () => {
+                        const emit = (frame) => {
+                            try {
+                                controller.enqueue(new TextEncoder().encode(encodeFrame(frame)));
+                            }
+                            catch {
+                                // stream already closed by the client
+                            }
+                        };
+                        try {
+                            await options.service.runExec(prepared.record, prepared.input, emit, abort.signal);
+                        }
+                        catch (error) {
+                            emit({
+                                type: 'stderr',
+                                data: error instanceof Error ? error.message : String(error),
+                            });
+                            emit({ type: 'exit', code: null, durationMs: 0, result: 'error' });
+                        }
+                        finally {
+                            try {
+                                controller.close();
+                            }
+                            catch {
+                                // already closed
+                            }
+                        }
+                    })();
+                },
+                cancel() {
+                    abort.abort();
+                },
+            });
+            return new Response(stream, {
+                status: 200,
+                headers: {
+                    'content-type': cliNdjsonContentType,
+                    'cache-control': 'no-store',
+                },
+            });
+        }
+        catch (error) {
+            return errorResponse(error, options.logger);
+        }
+    });
+    app.get('/cli/:slug/status', async (context) => {
+        try {
+            requireAdmin(context);
+            const status = await options.service.status(context.req.param('slug'));
+            return new Response(JSON.stringify(status), {
+                status: 200,
+                headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+            });
+        }
+        catch (error) {
+            return errorResponse(error, options.logger);
+        }
+    });
+}
+//# sourceMappingURL=routes.js.map

package/dist/server/cli-plane/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/cli-plane/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAI1D,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAqB,MAAM,aAAa,CAAC;AAgBnF;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAa,EACb,OAAmE;IAEnE,MAAM,YAAY,GAAG,CAAC,OAAoB,EAAQ,EAAE;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9E,IAAI,SAAS,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,8CAA8C,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC5C,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9E,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;gBAC5C,KAAK,CAAC,UAAU;oBACd,KAAK,CAAC,KAAK,IAAI,EAAE;wBACf,MAAM,IAAI,GAAG,CAAC,KAAmB,EAAQ,EAAE;4BACzC,IAAI,CAAC;gCACH,UAAU,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;4BACnE,CAAC;4BAAC,MAAM,CAAC;gCACP,sCAAsC;4BACxC,CAAC;wBACH,CAAC,CAAC;wBACF,IAAI,CAAC;4BACH,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;wBACrF,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,IAAI,CAAC;gCACH,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;6BAC7D,CAAC,CAAC;4BACH,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;wBACrE,CAAC;gCAAS,CAAC;4BACT,IAAI,CAAC;gCACH,UAAU,CAAC,KAAK,EAAE,CAAC;4BACrB,CAAC;4BAAC,MAAM,CAAC;gCACP,iBAAiB;4BACnB,CAAC;wBACH,CAAC;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,CAAC;gBACD,MAAM;oBACJ,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,CAAC;aACF,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;gBAC1B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,oBAAoB;oBACpC,eAAe,EAAE,UAAU;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACvE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBAC1C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/cli-plane/runner.d.ts

@@ -0,0 +1,41 @@
+import type { CliExecFrame } from './frames.js';
+export interface ExecRequest {
+    /** Host: binary path/name. Docker: container image reference. */
+    command: string;
+    /** argv passed verbatim to the binary — never through a shell. */
+    argv: string[];
+    /** Full environment for the child (base env + enforcement vars + credential vars). */
+    env: Record<string, string>;
+    stdin?: string | null;
+    timeoutMs: number;
+    maxOutputBytes: number;
+    executionMode: 'host' | 'docker';
+    /** Environment variable names explicitly forwarded into the container. */
+    containerEnvKeys?: string[];
+    /** Persistent or bind-mounted state directories explicitly forwarded into the container. */
+    containerVolumes?: {
+        source: string;
+        target: string;
+        readOnly?: boolean;
+    }[];
+    /** Fixed authentication bootstrap performed inside a hosted container. */
+    authStrategy?: 'none' | 'azure-service-principal' | 'tailscale-auth-key';
+    entrypoint?: string | null;
+}
+export interface ExecOutcome {
+    code: number | null;
+    durationMs: number;
+    result: 'ok' | 'error' | 'timeout';
+    truncated: boolean;
+}
+/**
+ * Run a CLI process and stream its output as NDJSON frames.
+ *
+ * The process is spawned directly (no shell); stdout and stderr are forwarded
+ * as separate frames. A still-running child is SIGTERM'd at `timeoutMs` and
+ * SIGKILL'd after a grace period. Output is memory-bounded: once
+ * `maxOutputBytes` have been forwarded, further chunks are dropped and the
+ * final exit frame carries `truncated: true`.
+ */
+export declare function execCli(request: ExecRequest, emit: (frame: CliExecFrame) => void, signal?: AbortSignal): Promise<ExecOutcome>;
+//# sourceMappingURL=runner.d.ts.map

package/dist/server/cli-plane/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/cli-plane/runner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,WAAW;IAC1B,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,sFAAsF;IACtF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC;IACjC,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4FAA4F;IAC5F,gBAAgB,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC5E,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,yBAAyB,GAAG,oBAAoB,CAAC;IACzE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;CACpB;AAID;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CACrB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,EACnC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAsJtB"}

package/dist/server/cli-plane/runner.js

@@ -0,0 +1,163 @@
+import { spawn } from 'node:child_process';
+const killGraceMs = 1_000;
+/**
+ * Run a CLI process and stream its output as NDJSON frames.
+ *
+ * The process is spawned directly (no shell); stdout and stderr are forwarded
+ * as separate frames. A still-running child is SIGTERM'd at `timeoutMs` and
+ * SIGKILL'd after a grace period. Output is memory-bounded: once
+ * `maxOutputBytes` have been forwarded, further chunks are dropped and the
+ * final exit frame carries `truncated: true`.
+ */
+export function execCli(request, emit, signal) {
+    return new Promise((resolve) => {
+        const isDocker = request.executionMode === 'docker';
+        const spawnCommand = isDocker ? 'docker' : request.command;
+        const containerArgv = request.authStrategy === 'azure-service-principal'
+            ? [
+                '-c',
+                'az login --service-principal --username "$AZURE_CLIENT_ID" --password "$AZURE_CLIENT_SECRET" --tenant "$AZURE_TENANT_ID" --output none && exec az "$@"',
+                '--',
+                ...request.argv,
+            ]
+            : request.authStrategy === 'tailscale-auth-key'
+                ? [
+                    '-c',
+                    'mkdir -p /var/run/tailscale && tailscaled --tun=userspace-networking --statedir=/var/lib/tailscale --socket=/var/run/tailscale/tailscaled.sock >/tmp/tailscaled.log 2>&1 & daemon=$!; attempt=0; while [ "$attempt" -lt 50 ] && [ ! -S /var/run/tailscale/tailscaled.sock ]; do attempt=$((attempt + 1)); sleep 0.1; done; tailscale --socket=/var/run/tailscale/tailscaled.sock up --auth-key="$TS_AUTHKEY" --reset >/dev/null 2>&1 && exec tailscale --socket=/var/run/tailscale/tailscaled.sock "$@"; status=$?; kill "$daemon" >/dev/null 2>&1 || true; wait "$daemon" >/dev/null 2>&1 || true; exit "$status"',
+                    '--',
+                    ...request.argv,
+                ]
+                : request.argv;
+        const spawnArgs = isDocker
+            ? [
+                'run',
+                '--rm',
+                '-i',
+                ...(request.authStrategy === 'azure-service-principal' ||
+                    request.authStrategy === 'tailscale-auth-key'
+                    ? ['--entrypoint', '/bin/sh']
+                    : request.entrypoint
+                        ? ['--entrypoint', request.entrypoint]
+                        : []),
+                ...(request.containerVolumes ?? []).flatMap((volume) => [
+                    '--volume',
+                    `${volume.source}:${volume.target}${volume.readOnly ? ':ro' : ''}`,
+                ]),
+                ...(request.authStrategy === 'tailscale-auth-key'
+                    ? ['--env', 'TS_STATE_DIR=/var/lib/tailscale']
+                    : []),
+                ...(request.containerEnvKeys ?? []).flatMap((name) => ['--env', name]),
+                request.command,
+                ...containerArgv,
+            ]
+            : request.argv;
+        let child;
+        try {
+            child = spawn(spawnCommand, spawnArgs, {
+                env: request.env,
+                stdio: ['pipe', 'pipe', 'pipe'],
+                shell: false,
+            });
+        }
+        catch (error) {
+            emit({ type: 'stderr', data: error instanceof Error ? error.message : String(error) });
+            emit({ type: 'exit', code: null, durationMs: 0, result: 'error' });
+            resolve({ code: null, durationMs: 0, result: 'error', truncated: false });
+            return;
+        }
+        const started = Date.now();
+        let timedOut = false;
+        let aborted = false;
+        let truncated = false;
+        let forwardedBytes = 0;
+        let settled = false;
+        let killTimer;
+        let escalateTimer;
+        const forward = (stream, chunk) => {
+            if (settled || timedOut || aborted)
+                return;
+            const remaining = request.maxOutputBytes - forwardedBytes;
+            if (remaining <= 0) {
+                truncated = true;
+                return;
+            }
+            if (chunk.length > remaining) {
+                truncated = true;
+                forwardedBytes += remaining;
+                emit({ type: stream, data: chunk.subarray(0, remaining).toString('utf8') });
+                return;
+            }
+            forwardedBytes += chunk.length;
+            emit({ type: stream, data: chunk.toString('utf8') });
+        };
+        child.stdout.on('data', (chunk) => forward('stdout', chunk));
+        child.stderr.on('data', (chunk) => forward('stderr', chunk));
+        if (request.stdin !== null && request.stdin !== undefined) {
+            child.stdin.end(request.stdin);
+        }
+        else {
+            child.stdin.end();
+        }
+        const terminate = () => {
+            try {
+                child.kill('SIGTERM');
+            }
+            catch {
+                // child already gone
+            }
+            if (escalateTimer === undefined) {
+                escalateTimer = setTimeout(() => {
+                    try {
+                        child.kill('SIGKILL');
+                    }
+                    catch {
+                        // child already gone
+                    }
+                }, killGraceMs);
+                escalateTimer.unref();
+            }
+        };
+        killTimer = setTimeout(() => {
+            timedOut = true;
+            terminate();
+        }, request.timeoutMs);
+        killTimer.unref();
+        const onAbort = () => {
+            aborted = true;
+            terminate();
+        };
+        if (signal !== undefined) {
+            if (signal.aborted)
+                onAbort();
+            else
+                signal.addEventListener('abort', onAbort, { once: true });
+        }
+        const finish = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            if (killTimer !== undefined)
+                clearTimeout(killTimer);
+            if (escalateTimer !== undefined)
+                clearTimeout(escalateTimer);
+            signal?.removeEventListener('abort', onAbort);
+            const durationMs = Date.now() - started;
+            const result = aborted ? 'error' : timedOut ? 'timeout' : code === 0 ? 'ok' : 'error';
+            emit({
+                type: 'exit',
+                code: timedOut || aborted ? null : code,
+                durationMs,
+                result,
+                ...(truncated ? { truncated: true } : {}),
+            });
+            resolve({ code: timedOut || aborted ? null : code, durationMs, result, truncated });
+        };
+        child.on('error', (error) => {
+            if (!settled) {
+                emit({ type: 'stderr', data: error instanceof Error ? error.message : String(error) });
+            }
+        });
+        child.on('close', (code) => finish(code));
+    });
+}
+//# sourceMappingURL=runner.js.map

package/dist/server/cli-plane/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../../src/cli-plane/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AA8BhF,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CACrB,OAAoB,EACpB,IAAmC,EACnC,MAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC;QACpD,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3D,MAAM,aAAa,GACjB,OAAO,CAAC,YAAY,KAAK,yBAAyB;YAChD,CAAC,CAAC;gBACE,IAAI;gBACJ,wJAAwJ;gBACxJ,IAAI;gBACJ,GAAG,OAAO,CAAC,IAAI;aAChB;YACH,CAAC,CAAC,OAAO,CAAC,YAAY,KAAK,oBAAoB;gBAC7C,CAAC,CAAC;oBACE,IAAI;oBACJ,olBAAolB;oBACplB,IAAI;oBACJ,GAAG,OAAO,CAAC,IAAI;iBAChB;gBACH,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACrB,MAAM,SAAS,GAAG,QAAQ;YACxB,CAAC,CAAC;gBACE,KAAK;gBACL,MAAM;gBACN,IAAI;gBACJ,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,yBAAyB;oBACtD,OAAO,CAAC,YAAY,KAAK,oBAAoB;oBAC3C,CAAC,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC;oBAC7B,CAAC,CAAC,OAAO,CAAC,UAAU;wBAClB,CAAC,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC;wBACtC,CAAC,CAAC,EAAE,CAAC;gBACT,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;oBACtD,UAAU;oBACV,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;iBACnE,CAAC;gBACF,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,oBAAoB;oBAC/C,CAAC,CAAC,CAAC,OAAO,EAAE,iCAAiC,CAAC;oBAC9C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACtE,OAAO,CAAC,OAAO;gBACf,GAAG,aAAa;aACjB;YACH,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAEjB,IAAI,KAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE;gBACrC,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvF,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAqC,CAAC;QAC1C,IAAI,aAAyC,CAAC;QAE9C,MAAM,OAAO,GAAG,CAAC,MAA2B,EAAE,KAAa,EAAQ,EAAE;YACnE,IAAI,OAAO,IAAI,QAAQ,IAAI,OAAO;gBAAE,OAAO;YAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;YAC1D,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACnB,SAAS,GAAG,IAAI,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC7B,SAAS,GAAG,IAAI,CAAC;gBACjB,cAAc,IAAI,SAAS,CAAC;gBAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5E,OAAO;YACT,CAAC;YACD,cAAc,IAAI,KAAK,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC;QAEF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1D,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;QAED,MAAM,SAAS,GAAG,GAAS,EAAE;YAC3B,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;YACD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC9B,IAAI,CAAC;wBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,qBAAqB;oBACvB,CAAC;gBACH,CAAC,EAAE,WAAW,CAAC,CAAC;gBAChB,aAAa,CAAC,KAAK,EAAE,CAAC;YACxB,CAAC;QACH,CAAC,CAAC;QAEF,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,EAAE,CAAC;QACd,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACtB,SAAS,CAAC,KAAK,EAAE,CAAC;QAElB,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS,EAAE,CAAC;QACd,CAAC,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,CAAC;;gBACzB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAQ,EAAE;YAC3C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,SAAS,KAAK,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,aAAa,KAAK,SAAS;gBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC7D,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACtF,IAAI,CAAC;gBACH,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;gBACvC,UAAU;gBACV,MAAM;gBACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACtF,CAAC,CAAC;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/cli-plane/status.d.ts

@@ -0,0 +1,12 @@
+/**
+ * CLI status probe parsing (docs/cli-hosting-research.md §2.6).
+ *
+ * The probe command's stdout is key=value on each line; `version` surfaces as
+ * the version string and `loggedIn`/`logged_in` as the boolean login state.
+ * Absent keys keep their defaults.
+ */
+export declare function parseProbeOutput(stdout: string): {
+    version: string | null;
+    loggedIn: boolean;
+};
+//# sourceMappingURL=status.d.ts.map

package/dist/server/cli-plane/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/cli-plane/status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAgB9F"}

package/dist/server/cli-plane/status.js

@@ -0,0 +1,24 @@
+/**
+ * CLI status probe parsing (docs/cli-hosting-research.md §2.6).
+ *
+ * The probe command's stdout is key=value on each line; `version` surfaces as
+ * the version string and `loggedIn`/`logged_in` as the boolean login state.
+ * Absent keys keep their defaults.
+ */
+export function parseProbeOutput(stdout) {
+    let version = null;
+    let loggedIn = false;
+    for (const line of stdout.split('\n')) {
+        const trimmed = line.trim();
+        const versionMatch = /^version=(.*)$/.exec(trimmed);
+        if (versionMatch?.[1] !== undefined && versionMatch[1] !== '') {
+            version = versionMatch[1];
+        }
+        const loginMatch = /^loggedIn=(true|false)$/i.exec(trimmed) ?? /^logged_in=(true|false)$/i.exec(trimmed);
+        if (loginMatch?.[1] !== undefined) {
+            loggedIn = loginMatch[1].toLowerCase() === 'true';
+        }
+    }
+    return { version, loggedIn };
+}
+//# sourceMappingURL=status.js.map

package/dist/server/cli-plane/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/cli-plane/status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9D,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,UAAU,GACd,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxF,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAClC,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/server/config/harness-import.d.ts

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+import type { CredentialPayload, TransportConfig } from '../domain/models.js';
+export declare const harnessConfigSchema: z.ZodObject<{
+    mcpServers: z.ZodRecord<z.ZodString, z.ZodObject<{
+        command: z.ZodOptional<z.ZodString>;
+        args: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        url: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type HarnessConfig = z.infer<typeof harnessConfigSchema>;
+export interface HarnessImportedCredential {
+    name: string;
+    payload: CredentialPayload;
+}
+export interface HarnessImportedEntry {
+    name: string;
+    slug: string;
+    kind: 'remote' | 'home';
+    transport: TransportConfig;
+    credential: HarnessImportedCredential | null;
+    warnings: string[];
+}
+export interface HarnessImportPreview {
+    name: string;
+    slug: string;
+    kind: 'remote' | 'home';
+    transportSummary: string;
+    credential: {
+        name: string;
+        type: string;
+        fields: {
+            name: string;
+            masked: boolean;
+        }[];
+    } | null;
+    warnings: string[];
+}
+export declare function toSlug(name: string): string;
+export declare function parseHarnessConfig(value: unknown): HarnessImportedEntry[];
+/** Masked view for previews — never contains secret values. */
+export declare function toPreview(entry: HarnessImportedEntry): HarnessImportPreview;
+//# sourceMappingURL=harness-import.d.ts.map

package/dist/server/config/harness-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-import.d.ts","sourceRoot":"","sources":["../../../src/config/harness-import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAyB9E,eAAO,MAAM,mBAAmB;;;;;;;;iBAE9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAKhE,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,SAAS,EAAE,eAAe,CAAC;IAC3B,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC7C,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/F,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO3C;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,EAAE,CAkBzE;AAkGD,+DAA+D;AAC/D,wBAAgB,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,CA2B3E"}