visual-remote 0.3.0 → 0.3.2

package/apps/cli/dist/direct-exec-mcp.js

@@ -0,0 +1,976 @@
+// src/direct-exec-mcp.ts
+import { resolve as resolve2 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// ../../packages/bridge-core/src/agents/direct-exec.ts
+import { spawn } from "node:child_process";
+import { realpath } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+
+// ../../packages/bridge-core/src/runtime/managed-process.ts
+function safeChildProcessId(child) {
+  const pid = child.pid;
+  if (pid === void 0 || !Number.isSafeInteger(pid) || pid <= 1 || pid === process.pid) {
+    return void 0;
+  }
+  return pid;
+}
+function safeDetachedProcessGroupId(child) {
+  return process.platform === "win32" ? void 0 : safeChildProcessId(child);
+}
+function isMissingProcess(error2) {
+  return typeof error2 === "object" && error2 !== null && "code" in error2 && error2.code === "ESRCH";
+}
+function processGroupIsAlive(processGroupId) {
+  try {
+    process.kill(-processGroupId, 0);
+    return true;
+  } catch (error2) {
+    if (isMissingProcess(error2)) return false;
+    if (typeof error2 === "object" && error2 !== null && "code" in error2 && error2.code === "EPERM") {
+      return true;
+    }
+    throw error2;
+  }
+}
+function childIsAlive(child) {
+  return child.exitCode === null && child.signalCode === null;
+}
+function signalChildProcessTree(child, signal) {
+  const pid = safeChildProcessId(child);
+  if (pid === void 0) return false;
+  try {
+    if (process.platform === "win32") {
+      if (!childIsAlive(child)) return false;
+      return child.kill(signal);
+    }
+    process.kill(-pid, signal);
+    return true;
+  } catch (error2) {
+    if (isMissingProcess(error2)) return false;
+    throw error2;
+  }
+}
+function installEmergencyChildExitHook(child, processLike = process) {
+  let removed = false;
+  const emergencyExit = () => {
+    removed = true;
+    try {
+      signalChildProcessTree(child, "SIGKILL");
+    } catch {
+    }
+  };
+  processLike.once("exit", emergencyExit);
+  return () => {
+    if (removed) return;
+    removed = true;
+    processLike.off("exit", emergencyExit);
+  };
+}
+async function waitForProcessTreeExit(child, processGroupId, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (processGroupId === void 0 ? childIsAlive(child) : processGroupIsAlive(processGroupId)) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) return false;
+    await new Promise((resolve3) => {
+      setTimeout(resolve3, Math.min(25, remaining));
+    });
+  }
+  return true;
+}
+async function terminateChildProcessTree(child, killGraceMs = 3e3) {
+  const processGroupId = safeDetachedProcessGroupId(child);
+  if (processGroupId === void 0 && !childIsAlive(child)) return;
+  const sendSignal = (signal) => {
+    signalChildProcessTree(child, signal);
+  };
+  sendSignal("SIGTERM");
+  if (await waitForProcessTreeExit(
+    child,
+    processGroupId,
+    Math.max(0, killGraceMs)
+  )) {
+    return;
+  }
+  sendSignal("SIGKILL");
+  await waitForProcessTreeExit(
+    child,
+    processGroupId,
+    Math.min(Math.max(0, killGraceMs), 1e3)
+  );
+}
+
+// ../../packages/bridge-core/src/agents/direct-exec.ts
+var MAX_COMMANDS = 8;
+var MAX_ARGUMENTS = 64;
+var MAX_ARGUMENT_LENGTH = 4096;
+var DEFAULT_TIMEOUT_MS = 3e4;
+var MAX_TIMEOUT_MS = 12e4;
+var DEFAULT_OUTPUT_BYTES = 64 * 1024;
+var KILL_GRACE_MS = 250;
+var READ_ONLY_GIT_COMMANDS = /* @__PURE__ */ new Set([
+  "describe",
+  "diff",
+  "grep",
+  "log",
+  "ls-files",
+  "rev-parse",
+  "show",
+  "status"
+]);
+var SAFE_NATIVE_PROGRAMS = /* @__PURE__ */ new Set([
+  "cat",
+  "find",
+  "git",
+  "ls",
+  "pwd",
+  "rg",
+  "wc"
+]);
+var VERSION_PROGRAMS = /* @__PURE__ */ new Set([
+  "codex",
+  "corepack",
+  "node",
+  "npm",
+  "pnpm",
+  "rtk",
+  "visual",
+  "visual-remote"
+]);
+var SAFE_RTK_COMMANDS = /* @__PURE__ */ new Set([
+  "deps",
+  "diff",
+  "find",
+  "git",
+  "ls",
+  "read",
+  "rg",
+  "wc"
+]);
+var FORBIDDEN_GIT_OPTIONS = [
+  "-C",
+  "-O",
+  "-c",
+  "--config-env",
+  "--ext-diff",
+  "--exec-path",
+  "--git-dir",
+  "--namespace",
+  "--no-index",
+  "--open-files-in-pager",
+  "--output",
+  "--pathspec-from-file",
+  "--show-signature",
+  "--textconv",
+  "--work-tree"
+];
+var SAFE_FIND_FLAGS = /* @__PURE__ */ new Set([
+  "-empty",
+  "-false",
+  "-mount",
+  "-print",
+  "-print0",
+  "-prune",
+  "-quit",
+  "-readable",
+  "-true",
+  "-xdev"
+]);
+var SAFE_FIND_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "-iname",
+  "-ipath",
+  "-maxdepth",
+  "-mindepth",
+  "-mmin",
+  "-mtime",
+  "-name",
+  "-path",
+  "-size",
+  "-type"
+]);
+var SAFE_FIND_OPERATORS = /* @__PURE__ */ new Set([
+  "!",
+  "(",
+  ")",
+  ",",
+  "-a",
+  "-and",
+  "-not",
+  "-o",
+  "-or"
+]);
+var DirectExecPolicyError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DirectExecPolicyError";
+  }
+};
+function isWithin(root, candidate) {
+  const path = relative(root, candidate);
+  return path === "" || path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path);
+}
+function directFileTargets(argv) {
+  const [program, ...arguments_] = argv;
+  if (program === "cat" || program === "wc") {
+    const targets2 = [];
+    let positionalOnly2 = false;
+    for (const argument of arguments_) {
+      if (argument === "--" && !positionalOnly2) {
+        positionalOnly2 = true;
+        continue;
+      }
+      if (argument === "-") continue;
+      if (positionalOnly2 || !argument.startsWith("-")) targets2.push(argument);
+    }
+    return targets2;
+  }
+  if (program === "find") return findPathTargets(arguments_);
+  if (program === "rtk" && arguments_[0] === "find") {
+    return findPathTargets(arguments_.slice(1));
+  }
+  if (program !== "rtk" || !["read", "wc"].includes(arguments_[0] ?? "")) return [];
+  const subcommand = arguments_[0];
+  const values = subcommand === "read" ? /* @__PURE__ */ new Set(["-l", "--level", "-m", "--max-lines", "--tail-lines"]) : /* @__PURE__ */ new Set();
+  const targets = [];
+  let positionalOnly = false;
+  for (let index = 1; index < arguments_.length; index += 1) {
+    const argument = arguments_[index] ?? "";
+    if (argument === "--" && !positionalOnly) {
+      positionalOnly = true;
+      continue;
+    }
+    if (values.has(argument)) {
+      index += 1;
+      continue;
+    }
+    if (argument !== "-" && (positionalOnly || !argument.startsWith("-"))) {
+      targets.push(argument);
+    }
+  }
+  return targets;
+}
+function findPathTargets(arguments_) {
+  const targets = [];
+  for (const argument of arguments_) {
+    if (argument.startsWith("-") || SAFE_FIND_OPERATORS.has(argument)) break;
+    targets.push(argument);
+  }
+  return targets;
+}
+async function validateDirectFileTargets(argv, cwd, repoRoot) {
+  for (const target of directFileTargets(argv)) {
+    let resolvedTarget;
+    try {
+      resolvedTarget = await realpath(resolve(cwd, target));
+    } catch {
+      throw new DirectExecPolicyError(
+        `Direct file reads require an existing worktree path: ${target}`
+      );
+    }
+    if (!isWithin(repoRoot, resolvedTarget)) {
+      throw new DirectExecPolicyError(
+        `Direct file reads cannot follow a symlink outside the worktree: ${target}`
+      );
+    }
+  }
+}
+async function validateExistingArgumentPaths(argv, cwd, repoRoot) {
+  for (const argument of argv.slice(1)) {
+    const candidates = [argument];
+    const equalsIndex = argument.indexOf("=");
+    if (equalsIndex > 0 && equalsIndex < argument.length - 1) {
+      candidates.push(argument.slice(equalsIndex + 1));
+    }
+    for (const candidate of candidates) {
+      if (!candidate || candidate === "-" || candidate === "--") continue;
+      try {
+        const resolved = await realpath(resolve(cwd, candidate));
+        if (!isWithin(repoRoot, resolved)) {
+          throw new DirectExecPolicyError(
+            `Command arguments cannot follow a path outside the registered worktree: ${candidate}`
+          );
+        }
+      } catch (error2) {
+        if (error2 instanceof DirectExecPolicyError) throw error2;
+        const code = error2.code;
+        if (code !== "ENOENT" && code !== "ENOTDIR" && code !== "EINVAL") throw error2;
+      }
+    }
+  }
+}
+function optionMatches(argument, option) {
+  return argument === option || argument.startsWith(`${option}=`) || /^-[^-]$/u.test(option) && argument.length > option.length && argument.startsWith(option);
+}
+function validateArguments(arguments_) {
+  if (arguments_.length > MAX_ARGUMENTS) {
+    throw new DirectExecPolicyError(`A command may contain at most ${MAX_ARGUMENTS} arguments`);
+  }
+  for (const argument of arguments_) {
+    if (argument.length > MAX_ARGUMENT_LENGTH || argument.includes("\0")) {
+      throw new DirectExecPolicyError("Command arguments must be bounded text without NUL bytes");
+    }
+    if (isAbsolute(argument) || argument.split(/[\\/]/u).includes("..")) {
+      throw new DirectExecPolicyError(
+        `Command arguments cannot address paths outside the registered worktree: ${argument}`
+      );
+    }
+  }
+}
+function validateGit(arguments_) {
+  if (arguments_.some((argument) => FORBIDDEN_GIT_OPTIONS.some((option) => optionMatches(argument, option)))) {
+    throw new DirectExecPolicyError("Git path/config/output overrides are not allowed");
+  }
+  const subcommand = arguments_.find((argument) => !argument.startsWith("-"));
+  if (subcommand === void 0 || !READ_ONLY_GIT_COMMANDS.has(subcommand)) {
+    throw new DirectExecPolicyError(
+      `Only read-only Git commands are allowed (${[...READ_ONLY_GIT_COMMANDS].join(", ")})`
+    );
+  }
+}
+function validateFind(arguments_) {
+  let index = findPathTargets(arguments_).length;
+  while (index < arguments_.length) {
+    const argument = arguments_[index] ?? "";
+    if (SAFE_FIND_OPERATORS.has(argument) || SAFE_FIND_FLAGS.has(argument)) {
+      index += 1;
+      continue;
+    }
+    if (!SAFE_FIND_VALUE_FLAGS.has(argument)) {
+      throw new DirectExecPolicyError(
+        `find option or action is not allowed in direct inspection mode: ${argument || "<empty>"}`
+      );
+    }
+    const value = arguments_[index + 1];
+    if (value === void 0) {
+      throw new DirectExecPolicyError(`${argument} requires a value`);
+    }
+    if (["-maxdepth", "-mindepth"].includes(argument) && !/^\d+$/u.test(value)) {
+      throw new DirectExecPolicyError(`${argument} requires a non-negative integer`);
+    }
+    if (argument === "-type" && !/^[bcdpflsD]$/u.test(value)) {
+      throw new DirectExecPolicyError("find -type requires one supported file type");
+    }
+    index += 2;
+  }
+}
+function validateLs(arguments_) {
+  if (arguments_.some((argument) => [
+    "-H",
+    "-L",
+    "--dereference",
+    "--dereference-command-line",
+    "--dereference-command-line-symlink-to-dir"
+  ].some((option) => optionMatches(argument, option)))) {
+    throw new DirectExecPolicyError("Following ls symlinks is not allowed");
+  }
+}
+function validateRg(arguments_) {
+  if (arguments_.some((argument) => ["-f", "-L", "--file", "--follow", "--ignore-file", "--pre", "--pre-glob"].some((option) => optionMatches(argument, option)))) {
+    throw new DirectExecPolicyError(
+      "rg file inputs, preprocessors, and symlink traversal are not allowed"
+    );
+  }
+}
+function validateWc(arguments_) {
+  if (arguments_.some((argument) => optionMatches(argument, "--files0-from"))) {
+    throw new DirectExecPolicyError("wc --files0-from is not allowed");
+  }
+}
+function validateRtk(arguments_) {
+  if (arguments_.length === 1 && ["--version", "-V"].includes(arguments_[0] ?? "")) return;
+  const subcommand = arguments_[0];
+  if (subcommand === void 0 || !SAFE_RTK_COMMANDS.has(subcommand)) {
+    throw new DirectExecPolicyError(
+      `Only read-only RTK commands are allowed (${[...SAFE_RTK_COMMANDS].join(", ")})`
+    );
+  }
+  if (subcommand === "git") validateGit(arguments_.slice(1));
+  if (subcommand === "find") validateFind(arguments_.slice(1));
+  if (subcommand === "ls") validateLs(arguments_.slice(1));
+  if (subcommand === "rg") validateRg(arguments_.slice(1));
+  if (subcommand === "wc") validateWc(arguments_.slice(1));
+  if (subcommand === "deps" && arguments_.length > 1) {
+    throw new DirectExecPolicyError("rtk deps does not accept paths in direct inspection mode");
+  }
+}
+function validateDirectExecArgv(argv) {
+  const [program, ...arguments_] = argv;
+  if (program === void 0 || program.length === 0 || program.includes("/") || program.includes("\\")) {
+    throw new DirectExecPolicyError("Executable must be a PATH command name");
+  }
+  validateArguments(arguments_);
+  if (program === "rtk") {
+    validateRtk(arguments_);
+    return;
+  }
+  if (VERSION_PROGRAMS.has(program) && (arguments_.length === 1 && ["--version", "-v", "-V"].includes(arguments_[0] ?? ""))) {
+    return;
+  }
+  if (!SAFE_NATIVE_PROGRAMS.has(program)) {
+    throw new DirectExecPolicyError(`${program} is not allowed by the read-only direct executor`);
+  }
+  if (program === "git") validateGit(arguments_);
+  if (program === "find") validateFind(arguments_);
+  if (program === "ls") validateLs(arguments_);
+  if (program === "rg") validateRg(arguments_);
+  if (program === "wc") validateWc(arguments_);
+}
+async function directExecExecutableAvailable(executable, environment) {
+  return await new Promise((resolveAvailable) => {
+    const child = spawn(executable, ["--version"], {
+      env: environment,
+      shell: false,
+      stdio: "ignore",
+      windowsHide: true
+    });
+    const timer = setTimeout(() => child.kill("SIGKILL"), 1e3);
+    timer.unref();
+    child.once("error", () => {
+      clearTimeout(timer);
+      resolveAvailable(false);
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      resolveAvailable(code === 0);
+    });
+  });
+}
+function rtkRewrite(argv, rtkExecutable) {
+  const [program, ...arguments_] = argv;
+  if (program === "git" || program === "rg" || program === "ls" || program === "find" || program === "wc") {
+    return [rtkExecutable, program, ...arguments_];
+  }
+  if (program === "cat" && arguments_.length === 1 && !arguments_[0]?.startsWith("-")) {
+    return [rtkExecutable, "read", ...arguments_];
+  }
+  return void 0;
+}
+function hardenGitArgv(argv, usedRtk) {
+  const subcommandIndex = usedRtk && argv[1] === "git" ? 2 : argv[0] === "git" ? 1 : -1;
+  const subcommand = subcommandIndex < 0 ? void 0 : argv[subcommandIndex];
+  if (subcommand === void 0 || !["diff", "log", "show"].includes(subcommand)) {
+    return [...argv];
+  }
+  return [
+    ...argv.slice(0, subcommandIndex + 1),
+    "--no-ext-diff",
+    "--no-textconv",
+    ...argv.slice(subcommandIndex + 1)
+  ];
+}
+function appendBounded(current, chunk, maxBytes) {
+  const remaining = maxBytes - Buffer.byteLength(current);
+  if (remaining <= 0) return { text: current, truncated: true };
+  const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+  if (buffer.byteLength <= remaining) {
+    return { text: current + buffer.toString(), truncated: false };
+  }
+  return {
+    text: current + buffer.subarray(0, remaining).toString(),
+    truncated: true
+  };
+}
+async function runCommand(argv, cwd, environment, timeoutMs, maxOutputBytes, usedRtk) {
+  const startedAt = Date.now();
+  return await new Promise((resolveResult) => {
+    const [program, ...arguments_] = argv;
+    if (program === void 0) throw new DirectExecPolicyError("Command argv cannot be empty");
+    const usesGit = program === "git" || usedRtk && arguments_[0] === "git";
+    const commandEnvironment = usesGit ? {
+      ...environment,
+      GIT_CONFIG_COUNT: "4",
+      GIT_CONFIG_KEY_0: "core.fsmonitor",
+      GIT_CONFIG_VALUE_0: "false",
+      GIT_CONFIG_KEY_1: "core.hooksPath",
+      GIT_CONFIG_VALUE_1: process.platform === "win32" ? "NUL" : "/dev/null",
+      GIT_CONFIG_KEY_2: "diff.external",
+      GIT_CONFIG_VALUE_2: "",
+      GIT_CONFIG_KEY_3: "interactive.diffFilter",
+      GIT_CONFIG_VALUE_3: "",
+      GIT_OPTIONAL_LOCKS: "0",
+      GIT_PAGER: "cat",
+      PAGER: "cat"
+    } : environment;
+    const child = spawn(program, arguments_, {
+      cwd,
+      env: commandEnvironment,
+      detached: process.platform !== "win32",
+      shell: false,
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true
+    });
+    const removeEmergencyExitHook = installEmergencyChildExitHook(child);
+    let stdout = "";
+    let stderr = "";
+    let truncated = false;
+    let timedOut = false;
+    let settled = false;
+    let termination;
+    let timer;
+    const finish = (exitCode) => {
+      if (settled) return;
+      settled = true;
+      if (timer !== void 0) clearTimeout(timer);
+      removeEmergencyExitHook();
+      resolveResult({
+        argv,
+        cwd,
+        durationMs: Date.now() - startedAt,
+        exitCode,
+        stdout: stdout.trimEnd(),
+        stderr: stderr.trimEnd(),
+        timedOut,
+        truncated,
+        usedRtk
+      });
+    };
+    child.stdout.on("data", (chunk) => {
+      const appended = appendBounded(stdout, chunk, maxOutputBytes);
+      stdout = appended.text;
+      truncated ||= appended.truncated;
+    });
+    child.stderr.on("data", (chunk) => {
+      const appended = appendBounded(stderr, chunk, maxOutputBytes);
+      stderr = appended.text;
+      truncated ||= appended.truncated;
+    });
+    child.once("error", (error2) => {
+      stderr = error2.message;
+      finish(127);
+    });
+    child.once("close", (code) => {
+      if (termination === void 0) {
+        finish(code ?? (timedOut ? 124 : 1));
+        return;
+      }
+      void termination.finally(() => finish(timedOut ? 124 : code ?? 1));
+    });
+    timer = setTimeout(() => {
+      timedOut = true;
+      termination ??= terminateChildProcessTree(child, KILL_GRACE_MS);
+      void termination.catch((error2) => {
+        const message = error2 instanceof Error ? error2.message : String(error2);
+        stderr = stderr ? `${stderr}
+${message}` : message;
+      }).finally(() => finish(124));
+    }, timeoutMs);
+    timer.unref();
+  });
+}
+async function executeReadOnlyBatch(request, options) {
+  if (!Array.isArray(request.commands) || request.commands.length === 0) {
+    throw new DirectExecPolicyError("At least one command is required");
+  }
+  if (request.commands.length > MAX_COMMANDS) {
+    throw new DirectExecPolicyError(`At most ${MAX_COMMANDS} commands may run in one batch`);
+  }
+  const repoRoot = await realpath(options.repoRoot);
+  const workspaceRoot = await realpath(options.workspaceRoot);
+  if (!isWithin(repoRoot, workspaceRoot)) {
+    throw new DirectExecPolicyError("Registered workspace must stay inside its Git worktree");
+  }
+  const environment = options.environment ?? process.env;
+  const timeoutMs = Math.min(
+    MAX_TIMEOUT_MS,
+    Math.max(1, request.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+  );
+  const maxOutputBytes = Math.max(1024, options.maxOutputBytes ?? DEFAULT_OUTPUT_BYTES);
+  const rtkExecutable = options.rtkExecutable === false ? void 0 : options.rtkExecutable ?? "rtk";
+  const rtkAvailable = options.rtkAvailable ?? (rtkExecutable === void 0 ? false : await directExecExecutableAvailable(rtkExecutable, environment));
+  const results = [];
+  let stoppedEarly = false;
+  for (const command of request.commands) {
+    if (!Array.isArray(command.argv)) {
+      throw new DirectExecPolicyError("Each command must provide an argv array");
+    }
+    validateDirectExecArgv(command.argv);
+    const requestedCwd = command.cwd === void 0 ? workspaceRoot : isAbsolute(command.cwd) ? command.cwd : resolve(workspaceRoot, command.cwd);
+    const cwd = await realpath(requestedCwd);
+    if (!isWithin(repoRoot, cwd)) {
+      throw new DirectExecPolicyError("Command cwd must stay inside the registered worktree");
+    }
+    await validateDirectFileTargets(command.argv, cwd, repoRoot);
+    await validateExistingArgumentPaths(command.argv, cwd, repoRoot);
+    let effectiveArgv = [...command.argv];
+    let usedRtk = effectiveArgv[0] === "rtk";
+    if (usedRtk) {
+      if (!rtkAvailable || rtkExecutable === void 0) {
+        throw new DirectExecPolicyError("RTK was requested but is not available");
+      }
+      effectiveArgv[0] = rtkExecutable;
+    } else if (request.preferRtk !== false && rtkAvailable && rtkExecutable !== void 0) {
+      const rewritten = rtkRewrite(effectiveArgv, rtkExecutable);
+      if (rewritten !== void 0) {
+        effectiveArgv = rewritten;
+        usedRtk = true;
+      }
+    }
+    effectiveArgv = hardenGitArgv(effectiveArgv, usedRtk);
+    const result2 = await runCommand(
+      effectiveArgv,
+      cwd,
+      environment,
+      timeoutMs,
+      maxOutputBytes,
+      usedRtk
+    );
+    results.push(result2);
+    if (result2.exitCode !== 0 && request.stopOnError !== false) {
+      stoppedEarly = results.length < request.commands.length;
+      break;
+    }
+  }
+  return { results, stoppedEarly };
+}
+
+// ../../package.json
+var package_default = {
+  name: "visual-remote",
+  version: "0.3.2",
+  description: "Visual bridge from a running web UI to a coding agent in its Git worktree",
+  type: "module",
+  packageManager: "pnpm@10.34.5",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/elicie/visual-remote.git"
+  },
+  homepage: "https://github.com/elicie/visual-remote#readme",
+  bugs: {
+    url: "https://github.com/elicie/visual-remote/issues"
+  },
+  files: [
+    "apps/cli/dist/index.js",
+    "apps/cli/dist/direct-exec-mcp.js",
+    "apps/cli/dist/vite.js",
+    "apps/cli/dist/next.js",
+    "apps/cli/dist/next-client.js",
+    "apps/cli/vite.d.ts",
+    "apps/cli/next.d.ts",
+    "apps/cli/next-client.d.ts",
+    "packages/overlay/dist/client.js",
+    "packages/overlay/dist/viewer.js"
+  ],
+  bin: {
+    visual: "./apps/cli/dist/index.js",
+    "visual-remote": "./apps/cli/dist/index.js"
+  },
+  exports: {
+    "./vite": {
+      types: "./apps/cli/vite.d.ts",
+      import: "./apps/cli/dist/vite.js"
+    },
+    "./next": {
+      types: "./apps/cli/next.d.ts",
+      import: "./apps/cli/dist/next.js",
+      default: "./apps/cli/dist/next.js"
+    },
+    "./next/client": {
+      types: "./apps/cli/next-client.d.ts",
+      import: "./apps/cli/dist/next-client.js",
+      default: "./apps/cli/dist/next-client.js"
+    }
+  },
+  publishConfig: {
+    access: "public",
+    registry: "https://registry.npmjs.org"
+  },
+  engines: {
+    node: ">=24"
+  },
+  scripts: {
+    build: "corepack pnpm run build:overlay && corepack pnpm run build:server",
+    "build:overlay": "corepack pnpm --filter @visual-remote/overlay build",
+    "build:server": "corepack pnpm --filter @visual-remote/cli build",
+    dev: "corepack pnpm run build:overlay && tsx apps/cli/src/index.ts",
+    test: "vitest run",
+    "test:e2e": "corepack pnpm build && corepack pnpm exec playwright test --config tests/e2e/playwright.config.ts",
+    "test:watch": "vitest",
+    typecheck: "corepack pnpm -r --if-present typecheck && tsc --noEmit -p tsconfig.tests.json",
+    prepack: "corepack pnpm build"
+  },
+  dependencies: {
+    commander: "^15.0.0",
+    "http-proxy": "^1.18.1",
+    ws: "^8.21.1",
+    yaml: "^2.9.0",
+    zod: "^4.4.3"
+  },
+  peerDependencies: {
+    vite: ">=5"
+  },
+  peerDependenciesMeta: {
+    vite: {
+      optional: true
+    }
+  },
+  devDependencies: {
+    "@playwright/test": "^1.62.1",
+    "@types/http-proxy": "^1.17.17",
+    "@types/node": "^26.1.2",
+    "@types/ws": "^8.18.1",
+    "@visual-remote/bridge-core": "workspace:*",
+    "@visual-remote/cli": "workspace:*",
+    "@visual-remote/gateway": "workspace:*",
+    "@visual-remote/overlay": "workspace:*",
+    "@visual-remote/protocol": "workspace:*",
+    esbuild: "^0.28.1",
+    next: "15.5.16",
+    react: "19.1.0",
+    "react-dom": "19.1.0",
+    tsx: "^4.23.1",
+    typescript: "^7.0.2",
+    vite: "^8.1.5",
+    vitest: "^4.1.10"
+  }
+};
+
+// src/version.ts
+var VISUAL_REMOTE_VERSION = package_default.version;
+
+// src/direct-exec-mcp.ts
+var TOOL_NAME = "run_readonly";
+function recordOf(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function parseArguments(argv) {
+  const values = /* @__PURE__ */ new Map();
+  let disableRtk = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--no-rtk") {
+      disableRtk = true;
+      continue;
+    }
+    if (!["--repo-root", "--workspace-root", "--rtk"].includes(argument ?? "")) {
+      throw new Error(`Unknown direct-exec MCP argument: ${argument ?? "<missing>"}`);
+    }
+    const value = argv[index + 1];
+    if (value === void 0 || value.length === 0) {
+      throw new Error(`${argument} requires a value`);
+    }
+    values.set(argument ?? "", value);
+    index += 1;
+  }
+  const repoRoot = values.get("--repo-root");
+  const workspaceRoot = values.get("--workspace-root");
+  if (repoRoot === void 0 || workspaceRoot === void 0) {
+    throw new Error("Direct-exec MCP requires --repo-root and --workspace-root");
+  }
+  return {
+    repoRoot,
+    workspaceRoot,
+    rtkExecutable: disableRtk ? false : values.get("--rtk") ?? "rtk"
+  };
+}
+function parseBatchRequest(value) {
+  const record = recordOf(value);
+  const commands = Array.isArray(record?.commands) ? record.commands : void 0;
+  if (commands === void 0) {
+    throw new DirectExecPolicyError("commands must be an array");
+  }
+  return {
+    commands: commands.map((candidate) => {
+      const command = recordOf(candidate);
+      if (!Array.isArray(command?.argv) || !command.argv.every((item) => typeof item === "string")) {
+        throw new DirectExecPolicyError("Each command argv must be a string array");
+      }
+      if (command.cwd !== void 0 && typeof command.cwd !== "string") {
+        throw new DirectExecPolicyError("Command cwd must be a string when provided");
+      }
+      return {
+        argv: command.argv,
+        ...typeof command.cwd === "string" ? { cwd: command.cwd } : {}
+      };
+    }),
+    preferRtk: true,
+    ...typeof record?.stopOnError === "boolean" ? { stopOnError: record.stopOnError } : {},
+    ...typeof record?.timeoutMs === "number" ? { timeoutMs: record.timeoutMs } : {}
+  };
+}
+function displayArgument(argument) {
+  return /^[A-Za-z0-9_./:=@%+,-]+$/u.test(argument) ? argument : JSON.stringify(argument);
+}
+function formatBatchResult(batch) {
+  const sections = batch.results.map((result2) => {
+    const metadata = [
+      `cwd=${result2.cwd}`,
+      `exit=${result2.exitCode}`,
+      `duration=${result2.durationMs}ms`,
+      ...result2.usedRtk ? ["rtk=yes"] : [],
+      ...result2.timedOut ? ["timed_out=yes"] : [],
+      ...result2.truncated ? ["truncated=yes"] : []
+    ].join(" ");
+    const output = [
+      result2.stdout,
+      result2.stderr.length > 0 ? `stderr:
+${result2.stderr}` : ""
+    ].filter(Boolean).join("\n");
+    return [
+      `$ ${result2.argv.map(displayArgument).join(" ")}`,
+      metadata,
+      output || "(no output)"
+    ].join("\n");
+  });
+  if (batch.stoppedEarly) sections.push("Batch stopped after the first failed command.");
+  return sections.join("\n\n");
+}
+function structuredBatchResult(batch) {
+  return {
+    stoppedEarly: batch.stoppedEarly,
+    results: batch.results.map(({ stdout: _stdout, stderr: _stderr, ...metadata }) => metadata)
+  };
+}
+function directExecToolResult(batch) {
+  return {
+    content: [{ type: "text", text: formatBatchResult(batch) }],
+    structuredContent: structuredBatchResult(batch),
+    isError: batch.results.some((command) => command.exitCode !== 0)
+  };
+}
+function send(message) {
+  process.stdout.write(`${JSON.stringify(message)}
+`);
+}
+function result(id, value) {
+  send({ jsonrpc: "2.0", id: id ?? null, result: value });
+}
+function error(id, code, message) {
+  send({ jsonrpc: "2.0", id: id ?? null, error: { code, message } });
+}
+async function handleRequest(request, options) {
+  if (request.method === "initialize") {
+    const params = recordOf(request.params);
+    result(request.id, {
+      protocolVersion: typeof params?.protocolVersion === "string" ? params.protocolVersion : "2024-11-05",
+      capabilities: { tools: { listChanged: false } },
+      serverInfo: {
+        name: "visual-remote-direct-exec",
+        version: VISUAL_REMOTE_VERSION
+      }
+    });
+    return;
+  }
+  if (request.method === "ping") {
+    result(request.id, {});
+    return;
+  }
+  if (request.method === "tools/list") {
+    result(request.id, {
+      tools: [
+        {
+          name: TOOL_NAME,
+          title: "Run read-only repository commands directly",
+          description: "Runs up to 8 read-only argv commands without a shell in the registered worktree. Uses the registered workspace as cwd and applies RTK automatically when supported.",
+          inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["commands"],
+            properties: {
+              commands: {
+                type: "array",
+                minItems: 1,
+                maxItems: 8,
+                items: {
+                  type: "object",
+                  additionalProperties: false,
+                  required: ["argv"],
+                  properties: {
+                    argv: {
+                      type: "array",
+                      minItems: 1,
+                      maxItems: 65,
+                      items: { type: "string", maxLength: 4096 }
+                    },
+                    cwd: {
+                      type: "string",
+                      description: "Optional absolute worktree path or path relative to the registered workspace."
+                    }
+                  }
+                }
+              },
+              stopOnError: { type: "boolean", default: true },
+              timeoutMs: { type: "integer", minimum: 1, maximum: 12e4 }
+            }
+          },
+          annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false
+          }
+        }
+      ]
+    });
+    return;
+  }
+  if (request.method === "tools/call") {
+    const params = recordOf(request.params);
+    if (params?.name !== TOOL_NAME) {
+      error(request.id, -32602, `Unknown tool: ${String(params?.name)}`);
+      return;
+    }
+    try {
+      const batch = await executeReadOnlyBatch(
+        parseBatchRequest(params.arguments),
+        options
+      );
+      result(request.id, directExecToolResult(batch));
+    } catch (caught) {
+      const message = caught instanceof Error ? caught.message : String(caught);
+      result(request.id, {
+        content: [{ type: "text", text: message }],
+        isError: true
+      });
+    }
+    return;
+  }
+  if (request.id !== void 0) error(request.id, -32601, `Method not found: ${request.method}`);
+}
+async function main() {
+  const parsed = parseArguments(process.argv.slice(2));
+  const options = {
+    ...parsed,
+    rtkAvailable: parsed.rtkExecutable === false ? false : await directExecExecutableAvailable(parsed.rtkExecutable, process.env)
+  };
+  process.stdin.setEncoding("utf8");
+  let remainder = "";
+  process.stdin.on("data", (chunk) => {
+    const lines = (remainder + chunk).split(/\r?\n/u);
+    remainder = lines.pop() ?? "";
+    for (const line of lines) {
+      if (line.trim().length === 0) continue;
+      try {
+        const request = JSON.parse(line);
+        if (request.jsonrpc !== "2.0" || typeof request.method !== "string") {
+          error(request.id, -32600, "Invalid JSON-RPC request");
+          continue;
+        }
+        void handleRequest(request, options).catch((caught) => {
+          error(
+            request.id,
+            -32603,
+            caught instanceof Error ? caught.message : String(caught)
+          );
+        });
+      } catch {
+        error(null, -32700, "Invalid JSON");
+      }
+    }
+  });
+}
+if (process.argv[1] !== void 0 && fileURLToPath(import.meta.url) === resolve2(process.argv[1])) {
+  void main().catch((caught) => {
+    process.stderr.write(
+      `${caught instanceof Error ? caught.message : String(caught)}
+`
+    );
+    process.exitCode = 1;
+  });
+}
+export {
+  directExecToolResult,
+  formatBatchResult,
+  parseArguments,
+  parseBatchRequest,
+  structuredBatchResult
+};