@1claw/mcp 0.61.0 → 0.63.1

package/dist/toolsets/treasury.js

@@ -0,0 +1,14 @@
+import { treasuryListProposalsTool } from "../tools/treasury_list_proposals.js";
+import { treasuryProposeTool } from "../tools/treasury_propose.js";
+import { treasurySignProposalTool } from "../tools/treasury_sign_proposal.js";
+/** treasury: treasury_signer on the token exchange, else opt-in. */
+export const treasuryToolset = {
+    id: "treasury",
+    gate: "treasury_signer on the token exchange, else opt-in",
+    tools: [
+        treasuryProposeTool,
+        treasuryListProposalsTool,
+        treasurySignProposalTool,
+    ],
+};
+//# sourceMappingURL=treasury.js.map

package/dist/toolsets/treasury.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"treasury.js","sourceRoot":"","sources":["../../src/toolsets/treasury.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC1C,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,oDAAoD;IAC1D,KAAK,EAAE;QACH,mBAAmB;QACnB,yBAAyB;QACzB,wBAAwB;KAC3B;CACJ,CAAC"}

package/dist/toolsets/types.d.ts

@@ -0,0 +1,25 @@
+import type { z } from "zod";
+import type { OneClawClient } from "../client.js";
+export type ToolsetId = "inspect" | "local" | "vault" | "approvals" | "intents" | "execute" | "cards" | "treasury" | "memory" | "delegation" | "channels" | "chat" | "automations" | "runtimes" | "directory" | "notification" | "admin" | "platform";
+/** A tool factory: closes over a client, yields a FastMCP-shaped tool. */
+export type ToolFactory = (client: OneClawClient) => {
+    name: string;
+    description: string;
+    parameters: z.ZodTypeAny;
+    execute: (args: never, ctx: never) => Promise<string>;
+};
+/**
+ * One toolset, owned by one module under `src/toolsets/`. The module says
+ * which tools it contains and (as prose, for docs and the server card) when
+ * a session gets it; the gate logic itself lives in `toolsets.ts`.
+ *
+ * Boundary: a toolset module may import `./types`, `../tools/*` and
+ * `../client`; never another toolset module. `import_boundaries.test.ts`
+ * enforces it so Phase 3 extraction stays mechanical.
+ */
+export interface ToolsetModule {
+    id: ToolsetId;
+    gate: string;
+    tools: readonly ToolFactory[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/toolsets/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/toolsets/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,MAAM,SAAS,GACf,SAAS,GACT,OAAO,GACP,OAAO,GACP,WAAW,GACX,SAAS,GACT,SAAS,GACT,OAAO,GACP,UAAU,GACV,QAAQ,GACR,YAAY,GACZ,UAAU,GACV,MAAM,GACN,aAAa,GACb,UAAU,GACV,WAAW,GACX,cAAc,GACd,OAAO,GACP,UAAU,CAAC;AAEjB,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;IACzB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC1B,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACjC"}

package/dist/toolsets/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/toolsets/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/toolsets/types.ts"],"names":[],"mappings":""}

package/dist/toolsets/vault.d.ts

@@ -0,0 +1,4 @@
+import type { ToolsetModule } from "./types.js";
+/** vault: any agent session. */
+export declare const vaultToolset: ToolsetModule;
+//# sourceMappingURL=vault.d.ts.map

package/dist/toolsets/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/toolsets/vault.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAiBhD,gCAAgC;AAChC,eAAO,MAAM,YAAY,EAAE,aAuB1B,CAAC"}

package/dist/toolsets/vault.js

@@ -0,0 +1,41 @@
+import { createVaultTool } from "../tools/create_vault.js";
+import { deleteSecretTool } from "../tools/delete_secret.js";
+import { describeSecretTool } from "../tools/describe_secret.js";
+import { getEnvBundleTool, resolveEnvTool } from "../tools/env.js";
+import { getSecretTool } from "../tools/get_secret.js";
+import { grantAccessTool } from "../tools/grant_access.js";
+import { listOAuthConnectionsTool } from "../tools/list_oauth_connections.js";
+import { listOAuthProvidersTool } from "../tools/list_oauth_providers.js";
+import { listSecretsTool } from "../tools/list_secrets.js";
+import { listVaultsTool } from "../tools/list_vaults.js";
+import { oauthRevokeConsentTool } from "../tools/oauth_revoke_consent.js";
+import { oauthRevokeTokenTool } from "../tools/oauth_revoke_token.js";
+import { putSecretTool } from "../tools/put_secret.js";
+import { listVersionsTool, rotateAndStoreTool, rotateGenerateTool } from "../tools/secret_versions.js";
+import { shareSecretTool } from "../tools/share_secret.js";
+/** vault: any agent session. */
+export const vaultToolset = {
+    id: "vault",
+    gate: "any agent session",
+    tools: [
+        listSecretsTool,
+        getSecretTool,
+        putSecretTool,
+        deleteSecretTool,
+        describeSecretTool,
+        listVersionsTool,
+        rotateAndStoreTool,
+        rotateGenerateTool,
+        getEnvBundleTool,
+        resolveEnvTool,
+        shareSecretTool,
+        grantAccessTool,
+        createVaultTool,
+        listVaultsTool,
+        listOAuthConnectionsTool,
+        listOAuthProvidersTool,
+        oauthRevokeConsentTool,
+        oauthRevokeTokenTool,
+    ],
+};
+//# sourceMappingURL=vault.js.map

package/dist/toolsets/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/toolsets/vault.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,gCAAgC;AAChC,MAAM,CAAC,MAAM,YAAY,GAAkB;IACvC,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,mBAAmB;IACzB,KAAK,EAAE;QACH,eAAe;QACf,aAAa;QACb,aAAa;QACb,gBAAgB;QAChB,kBAAkB;QAClB,gBAAgB;QAChB,kBAAkB;QAClB,kBAAkB;QAClB,gBAAgB;QAChB,cAAc;QACd,eAAe;QACf,eAAe;QACf,eAAe;QACf,cAAc;QACd,wBAAwB;QACxB,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;KACvB;CACJ,CAAC"}

package/dist/toolsets.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Toolset gates — what a session must be entitled to before a toolset is
+ * offered. The tool → toolset mapping itself is owned by the modules under
+ * `src/toolsets/` and aggregated here into `TOOL_CATALOG`.
+ *
+ * No FastMCP, no network. `index.ts` consults it at
+ * registration time (stdio) and per session via `canAccess` (hosted), and
+ * `security/index.ts` derives its secret-carrying tool list from it so the
+ * "hide under execution_require_tee" list and the "don't redact" list can
+ * never drift apart.
+ */
+import type { ToolsetId, ToolsetModule } from "./toolsets/types.js";
+import { SECRET_READ_TOOLS, SECRET_WRITE_TOOLS } from "./toolsets/secret-tools.js";
+export type { ToolsetId, ToolsetModule, ToolFactory } from "./toolsets/types.js";
+export { SECRET_READ_TOOLS, SECRET_WRITE_TOOLS };
+/** How much the server actually knows about the session's entitlements. */
+export type EntitlementLookup = 
+/** Agent profile fetched — every gate below is authoritative. */
+"full"
+/** Only the JWT claims were available (static token, or profile GET failed softly). */
+ | "jwt_only"
+/** Profile GET failed hard; entitlement-gated toolsets are withheld. */
+ | "failed"
+/** No cloud credentials at all (local-only / local-daemon mode). */
+ | "none";
+export type Principal = "agent" | "user" | "platform" | "unknown";
+export interface Entitlements {
+    lookup: EntitlementLookup;
+    principal: Principal;
+    agentId?: string;
+    intentsApi: boolean;
+    executionIntents: boolean;
+    /** Vault refuses to hand secret *values* to this agent outside a TEE. */
+    executionRequireTee: boolean;
+    cards: boolean;
+    memory: boolean;
+    shroud: boolean;
+    discoverable: boolean;
+    /** Agent signs for ≥1 treasury. Undefined = the vault did not say. */
+    treasurySigner?: boolean;
+    /** Agent has an active delegation in either direction. Undefined = unknown. */
+    hasDelegations?: boolean;
+}
+/** The most conservative snapshot: an agent about which nothing is known. */
+export declare function unknownEntitlements(lookup?: EntitlementLookup): Entitlements;
+/**
+ * Every tool the server can register, by toolset — DERIVED from the toolset
+ * modules the entrypoint installs (`installToolsets`). This module does not
+ * import the modules itself, so an entrypoint that installs only `vault`
+ * and `approvals` (the `@1claw/mcp-vault` package) never has the signing or
+ * execute code in its tree. A tool missing from every installed module
+ * fails registration (see `toolsetOf`), so adding a tool means deciding
+ * where it belongs.
+ */
+export declare const TOOL_CATALOG: ReadonlyMap<string, ToolsetId>;
+/** The modules the entrypoint installed, in registration order. */
+export declare function installedToolsets(): readonly ToolsetModule[];
+/** Install the toolset modules this server offers. Idempotent for the same set. */
+export declare function installToolsets(modules: readonly ToolsetModule[]): void;
+export declare const TOOLSET_IDS: readonly ToolsetId[];
+export declare function toolsetOf(toolName: string): ToolsetId;
+/**
+ * Toolsets this session could ever be offered. `principal` decides the
+ * human/platform boundaries; the agent flags decide the rest. An explicit
+ * override can pick from this set but never add to it.
+ */
+export declare function availableToolsets(e: Entitlements): Set<ToolsetId>;
+/**
+ * What a session sees with no override: available minus the opt-in-only
+ * sets — except that treasury and delegation come on by default when the
+ * vault has positively said the agent uses them.
+ */
+export declare function defaultToolsets(e: Entitlements): Set<ToolsetId>;
+/**
+ * Parse an override string ("vault,intents", "all", "") into toolset ids.
+ * Unknown names are reported back so the caller can log them; they never
+ * throw, because a typo in a header must not take a session down.
+ */
+export declare function parseToolsetOverride(raw: string | undefined): {
+    all: boolean;
+    toolsets: ToolsetId[];
+    unknown: string[];
+} | undefined;
+/**
+ * Final toolset for a session. The override is intersected with what the
+ * entitlements allow — it can narrow or opt in, never widen past the vault.
+ */
+export declare function resolveToolsets(e: Entitlements, override?: string): Set<ToolsetId>;
+/** The per-tool decision: is `toolName` visible to a session with these toolsets? */
+export declare function toolVisible(toolName: string, toolsets: ReadonlySet<ToolsetId>, e: Entitlements): boolean;
+/** Tool names visible for a given toolset selection, in catalog order. */
+export declare function visibleToolNames(toolsets: ReadonlySet<ToolsetId>, e: Entitlements): string[];
+/** Stable, human-readable summary used for logs and the initialize `instructions`. */
+export declare function describeToolsets(toolsets: ReadonlySet<ToolsetId>): string;
+//# sourceMappingURL=toolsets.d.ts.map

package/dist/toolsets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolsets.d.ts","sourceRoot":"","sources":["../src/toolsets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEnF,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;AAEjD,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB;AACzB,iEAAiE;AAC/D,MAAM;AACR,uFAAuF;GACrF,UAAU;AACZ,wEAAwE;GACtE,QAAQ;AACV,oEAAoE;GAClE,MAAM,CAAC;AAEb,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;AAElE,MAAM,WAAW,YAAY;IACzB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,yEAAyE;IACzE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,iBAA4B,GAAG,YAAY,CAYtF;AAmBD;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAW,CAAC;AAEpE,mEAAmE;AACnE,wBAAgB,iBAAiB,IAAI,SAAS,aAAa,EAAE,CAE5D;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,IAAI,CAYvE;AAED,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAI3C,CAAC;AAcF,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CASrD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,YAAY,GAAG,GAAG,CAAC,SAAS,CAAC,CAyBjE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,YAAY,GAAG,GAAG,CAAC,SAAS,CAAC,CAW/D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,GAAG,EAAE,MAAM,GAAG,SAAS,GACxB;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAYxE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,CAYlF;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CACvB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,EAChC,CAAC,EAAE,YAAY,GAChB,OAAO,CAMT;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,YAAY,GAAG,MAAM,EAAE,CAM5F;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,MAAM,CAEzE"}

package/dist/toolsets.js

@@ -0,0 +1,217 @@
+/**
+ * Toolset gates — what a session must be entitled to before a toolset is
+ * offered. The tool → toolset mapping itself is owned by the modules under
+ * `src/toolsets/` and aggregated here into `TOOL_CATALOG`.
+ *
+ * No FastMCP, no network. `index.ts` consults it at
+ * registration time (stdio) and per session via `canAccess` (hosted), and
+ * `security/index.ts` derives its secret-carrying tool list from it so the
+ * "hide under execution_require_tee" list and the "don't redact" list can
+ * never drift apart.
+ */
+import { SECRET_READ_TOOLS, SECRET_WRITE_TOOLS } from "./toolsets/secret-tools.js";
+export { SECRET_READ_TOOLS, SECRET_WRITE_TOOLS };
+/** The most conservative snapshot: an agent about which nothing is known. */
+export function unknownEntitlements(lookup = "failed") {
+    return {
+        lookup,
+        principal: "agent",
+        intentsApi: false,
+        executionIntents: false,
+        executionRequireTee: false,
+        cards: false,
+        memory: false,
+        shroud: false,
+        discoverable: false,
+    };
+}
+/** Tools whose factories take no client — registered by hand by the entrypoint. */
+const CLIENTLESS_TOOLS = [
+    ["inspect_content", "inspect"],
+    ["proxy_request", "local"],
+];
+/**
+ * Stand-in "client" for reading a factory's name. Factories only close over
+ * the client — none touches it at construction — and using a bare object
+ * here keeps the client out of this module's import closure (the guard
+ * package must not carry it).
+ */
+const PROBE_CLIENT = Object.freeze({});
+const catalog = new Map(CLIENTLESS_TOOLS);
+let installed = [];
+/**
+ * Every tool the server can register, by toolset — DERIVED from the toolset
+ * modules the entrypoint installs (`installToolsets`). This module does not
+ * import the modules itself, so an entrypoint that installs only `vault`
+ * and `approvals` (the `@1claw/mcp-vault` package) never has the signing or
+ * execute code in its tree. A tool missing from every installed module
+ * fails registration (see `toolsetOf`), so adding a tool means deciding
+ * where it belongs.
+ */
+export const TOOL_CATALOG = catalog;
+/** The modules the entrypoint installed, in registration order. */
+export function installedToolsets() {
+    return installed;
+}
+/** Install the toolset modules this server offers. Idempotent for the same set. */
+export function installToolsets(modules) {
+    for (const module of modules) {
+        for (const factory of module.tools) {
+            const name = factory(PROBE_CLIENT).name;
+            const prior = catalog.get(name);
+            if (prior && prior !== module.id) {
+                throw new Error(`Tool '${name}' is claimed by both '${prior}' and '${module.id}'`);
+            }
+            catalog.set(name, module.id);
+        }
+    }
+    installed = modules;
+}
+export const TOOLSET_IDS = [
+    "inspect", "local", "vault", "approvals", "intents", "execute", "cards", "treasury",
+    "memory", "delegation", "channels", "chat", "automations", "runtimes", "directory",
+    "notification", "admin", "platform",
+];
+/** Toolsets offered to every agent session without any flag. */
+const AGENT_DEFAULT = ["inspect", "vault", "approvals"];
+/**
+ * Toolsets the vault has no per-agent flag for. They are never on by
+ * default (the vault still authorizes each call) but an operator may opt in
+ * with `ONECLAW_MCP_TOOLSETS` / `X-1Claw-Toolsets`.
+ */
+const AGENT_OPT_IN = [
+    "treasury", "delegation", "chat", "automations", "runtimes", "notification",
+];
+export function toolsetOf(toolName) {
+    const ts = TOOL_CATALOG.get(toolName);
+    if (!ts) {
+        throw new Error(`Tool '${toolName}' is not in the toolset catalog (packages/mcp/src/toolsets.ts). ` +
+            `Every tool must be assigned to a toolset before it can be registered.`);
+    }
+    return ts;
+}
+/**
+ * Toolsets this session could ever be offered. `principal` decides the
+ * human/platform boundaries; the agent flags decide the rest. An explicit
+ * override can pick from this set but never add to it.
+ */
+export function availableToolsets(e) {
+    const out = new Set(["inspect"]);
+    if (e.lookup === "none")
+        return out;
+    if (e.principal === "platform") {
+        out.add("platform");
+        return out;
+    }
+    for (const ts of AGENT_DEFAULT)
+        out.add(ts);
+    for (const ts of AGENT_OPT_IN)
+        out.add(ts);
+    if (e.principal === "user")
+        out.add("admin");
+    // Entitlement-gated. Under "failed" every flag is false, so these stay
+    // off — fail closed with the signal carried in `lookup`.
+    if (e.intentsApi)
+        out.add("intents");
+    if (e.executionIntents)
+        out.add("execute");
+    if (e.cards)
+        out.add("cards");
+    if (e.memory)
+        out.add("memory");
+    if (e.shroud) {
+        out.add("channels");
+        out.add("chat");
+    }
+    if (e.discoverable)
+        out.add("directory");
+    return out;
+}
+/**
+ * What a session sees with no override: available minus the opt-in-only
+ * sets — except that treasury and delegation come on by default when the
+ * vault has positively said the agent uses them.
+ */
+export function defaultToolsets(e) {
+    const out = availableToolsets(e);
+    for (const ts of AGENT_OPT_IN)
+        out.delete(ts);
+    if (e.principal !== "platform" && e.lookup !== "none") {
+        if (e.treasurySigner === true)
+            out.add("treasury");
+        if (e.hasDelegations === true)
+            out.add("delegation");
+    }
+    // Chat is opt-in even for Shroud agents — `channels` is the working
+    // surface; `chat` is a self-conversation and rarely what a tool caller wants.
+    out.delete("chat");
+    return out;
+}
+/**
+ * Parse an override string ("vault,intents", "all", "") into toolset ids.
+ * Unknown names are reported back so the caller can log them; they never
+ * throw, because a typo in a header must not take a session down.
+ */
+export function parseToolsetOverride(raw) {
+    if (raw === undefined)
+        return undefined;
+    const parts = raw.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+    if (parts.length === 0)
+        return undefined;
+    if (parts.includes("all"))
+        return { all: true, toolsets: [], unknown: [] };
+    const toolsets = [];
+    const unknown = [];
+    for (const p of parts) {
+        if (TOOLSET_IDS.includes(p))
+            toolsets.push(p);
+        else
+            unknown.push(p);
+    }
+    return { all: false, toolsets, unknown };
+}
+/**
+ * Final toolset for a session. The override is intersected with what the
+ * entitlements allow — it can narrow or opt in, never widen past the vault.
+ */
+export function resolveToolsets(e, override) {
+    const parsed = parseToolsetOverride(override);
+    const available = availableToolsets(e);
+    if (!parsed)
+        return defaultToolsets(e);
+    if (parsed.all) {
+        // "all" = everything that could work on this session — the
+        // human/platform sets are still principal-gated inside `available`.
+        return available;
+    }
+    const out = new Set(["inspect"]);
+    for (const ts of parsed.toolsets)
+        if (available.has(ts))
+            out.add(ts);
+    return out;
+}
+/** The per-tool decision: is `toolName` visible to a session with these toolsets? */
+export function toolVisible(toolName, toolsets, e) {
+    const ts = TOOL_CATALOG.get(toolName);
+    if (!ts)
+        return false;
+    if (!toolsets.has(ts))
+        return false;
+    if (e.executionRequireTee && SECRET_READ_TOOLS.includes(toolName))
+        return false;
+    return true;
+}
+/** Tool names visible for a given toolset selection, in catalog order. */
+export function visibleToolNames(toolsets, e) {
+    const out = [];
+    for (const name of TOOL_CATALOG.keys()) {
+        if (toolVisible(name, toolsets, e))
+            out.push(name);
+    }
+    return out;
+}
+/** Stable, human-readable summary used for logs and the initialize `instructions`. */
+export function describeToolsets(toolsets) {
+    return TOOLSET_IDS.filter((t) => toolsets.has(t)).join(",");
+}
+//# sourceMappingURL=toolsets.js.map

package/dist/toolsets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolsets.js","sourceRoot":"","sources":["../src/toolsets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGnF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;AAiCjD,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAA4B,QAAQ;IACpE,OAAO;QACH,MAAM;QACN,SAAS,EAAE,OAAO;QAClB,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,mBAAmB,EAAE,KAAK;QAC1B,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,KAAK;KACtB,CAAC;AACN,CAAC;AAED,mFAAmF;AACnF,MAAM,gBAAgB,GAAuC;IACzD,CAAC,iBAAiB,EAAE,SAAS,CAAC;IAC9B,CAAC,eAAe,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAA6B,CAAC;AAEnE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAoB,gBAAgB,CAAC,CAAC;AAC7D,IAAI,SAAS,GAA6B,EAAE,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAmC,OAAO,CAAC;AAEpE,mEAAmE;AACnE,MAAM,UAAU,iBAAiB;IAC7B,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,OAAiC;IAC7D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yBAAyB,KAAK,UAAU,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YACvF,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IACD,SAAS,GAAG,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAyB;IAC7C,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU;IACnF,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;IAClF,cAAc,EAAE,OAAO,EAAE,UAAU;CACtC,CAAC;AAEF,gEAAgE;AAChE,MAAM,aAAa,GAAyB,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAE9E;;;;GAIG;AACH,MAAM,YAAY,GAAyB;IACvC,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc;CAC9E,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,QAAgB;IACtC,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,EAAE,CAAC;QACN,MAAM,IAAI,KAAK,CACX,SAAS,QAAQ,kEAAkE;YAC/E,uEAAuE,CAC9E,CAAC;IACN,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAe;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IAEpC,IAAI,CAAC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC;IACf,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,aAAa;QAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,YAAY;QAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM;QAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE7C,uEAAuE;IACvE,yDAAyD;IACzD,IAAI,CAAC,CAAC,UAAU;QAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,gBAAgB;QAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,CAAC,YAAY;QAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,CAAe;IAC3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,YAAY;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,SAAS,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACpD,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;IACD,oEAAoE;IACpE,8EAA8E;IAC9E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAChC,GAAuB;IAEvB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACpB,IAAK,WAAiC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAc,CAAC,CAAC;;YAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,CAAe,EAAE,QAAiB;IAC9D,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACb,2DAA2D;QAC3D,oEAAoE;QACpE,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,QAAQ;QAAE,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,WAAW,CACvB,QAAgB,EAChB,QAAgC,EAChC,CAAe;IAEf,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,CAAC,mBAAmB,IAAI,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,QAAgC,EAAE,CAAe;IAC9E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,QAAgC;IAC7D,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/mcp",
-  "version": "0.61.0",
+  "version": "0.63.1",
   "mcpName": "io.github.1clawAI/1claw-mcp",
   "description": "MCP server for the 1claw secrets vault \u2014 lets AI agents fetch, store, and manage secrets at runtime",
   "type": "module",
@@ -31,7 +31,8 @@
     "inspect": "npx fastmcp inspect src/index.ts",
     "start": "node dist/index.js",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "build:packages": "npm run build --prefix packages/vault && npm run build --prefix packages/guard"
   },
   "keywords": [
     "1claw",
@@ -65,6 +66,7 @@
     "zod": "^3.24.0"
   },
   "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.24.3",
     "@types/node": "^20.19.33",
     "typescript": "^5.5.0",
     "vitest": "^4.1.0"