@agentdocumentformat/cli 0.7.8 → 0.8.1

package/dist/chunks/{chunk-QPLEAE6V.mjs → chunk-SOSPQPEN.mjs}

@@ -4,385 +4,163 @@ import { dirname as __adfDirname } from 'node:path';
 const require = __adfCreateRequire(import.meta.url);
 const __filename = __adfFileURLToPath(import.meta.url);
 const __dirname = __adfDirname(__filename);
-import {
-  require_jsx_runtime
-} from "./chunk-7CV2SA3H.mjs";
-import {
-  WELCOME_OVERLAY
-} from "./chunk-I3UYSITV.mjs";
-import {
-  cjs
-} from "./chunk-SGUTYISF.mjs";
-import {
-  mcp_config_exports
-} from "./chunk-VMHTYDH4.mjs";
-import {
-  Box_default,
-  Text
-} from "./chunk-3AT7IIP7.mjs";
-import {
-  useTheme
-} from "./chunk-PRMGZZM5.mjs";
-import {
-  require_react
-} from "./chunk-6GJ4QHRI.mjs";
-import {
-  adapter_registry_exports
-} from "./chunk-UYY5M2PB.mjs";
 import {
   external_exports
 } from "./chunk-ZJKXHM4Q.mjs";
 import {
-  __export,
-  __toESM
+  __export
 } from "./chunk-M2RX3S2T.mjs";
 
-// src/main/tui/ui/KeyHint.tsx
-var import_react2 = __toESM(require_react(), 1);
-
-// src/main/tui/app/keys.tsx
-var import_react = __toESM(require_react(), 1), import_jsx_runtime = __toESM(require_jsx_runtime(), 1);
-function elementRect(element) {
-  if (!element?.yogaNode) return null;
-  let x = 0, y = 0;
-  for (let node = element; node; node = node.parentNode)
-    node.yogaNode && (x += node.yogaNode.getComputedLeft(), y += node.yogaNode.getComputedTop());
-  return { x, y, width: element.yogaNode.getComputedWidth(), height: element.yogaNode.getComputedHeight() };
-}
-function rectContains(rect, x, y) {
-  return !!rect && x >= rect.x && x < rect.x + rect.width && y >= rect.y && y < rect.y + rect.height;
-}
-function createKeyRouter() {
-  let bindings = [], wheels = [], clicks = [], nextId = 1;
-  return {
-    registerClick(binding) {
-      return clicks.push(binding), () => {
-        let index = clicks.indexOf(binding);
-        index >= 0 && clicks.splice(index, 1);
-      };
-    },
-    click(event) {
-      let best = null;
-      for (let binding of clicks) {
-        if (!binding.active.current) continue;
-        let rect = elementRect(binding.ref.current);
-        if (!rect || !rectContains(rect, event.x, event.y)) continue;
-        let area = rect.width * rect.height;
-        (!best || area <= best.area) && (best = { binding, area });
-      }
-      return best ? best.binding.handler.current(event) === !0 : !1;
-    },
-    registerWheel(binding) {
-      return wheels.push(binding), () => {
-        let index = wheels.indexOf(binding);
-        index >= 0 && wheels.splice(index, 1);
-      };
-    },
-    wheel(event, context) {
-      let best = null;
-      for (let binding of wheels) {
-        if (!binding.active.current || binding.layer === "overlay" !== context.overlayOpen) continue;
-        let rect = elementRect(binding.ref.current);
-        if (!rect || !rectContains(rect, event.x, event.y)) continue;
-        let area = rect.width * rect.height;
-        (!best || area <= best.area) && (best = { binding, area });
-      }
-      return !best || event.delta === 0 ? !!best : (best.binding.handler.current(event.delta, event), !0);
-    },
-    register(layer, handler, active) {
-      let binding = { id: nextId++, layer, handler, active };
-      return bindings.push(binding), () => {
-        let index = bindings.indexOf(binding);
-        index >= 0 && bindings.splice(index, 1);
-      };
-    },
-    dispatch(input, key, context) {
-      let order = context.overlayOpen ? ["overlay", "global"] : context.focus === "input" || context.focus === "tabs" ? [context.focus, "global"] : [context.focus, "view", "global"];
-      for (let layer of order) {
-        let candidates = bindings.filter((b) => b.layer === layer && b.active.current);
-        for (let i = candidates.length - 1; i >= 0; i--)
-          if (candidates[i].handler.current(input, key) === !0) return !0;
-      }
-      return !1;
-    }
-  };
-}
-var KeyRouterContext = (0, import_react.createContext)(null);
-function KeyRouterProvider({ router, children }) {
-  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(KeyRouterContext.Provider, { value: router, children });
-}
-function useKeyRouter() {
-  let router = (0, import_react.useContext)(KeyRouterContext);
-  if (!router) throw new Error("useKeys must be used inside the TUI shell");
-  return router;
-}
-function useKeys(handler, options) {
-  let router = useKeyRouter(), handlerRef = (0, import_react.useRef)(handler), activeRef = (0, import_react.useRef)(options.active !== !1);
-  handlerRef.current = handler, activeRef.current = options.active !== !1, (0, import_react.useEffect)(() => router.register(options.layer, handlerRef, activeRef), [router, options.layer]);
-}
-var WHEEL_STEP = 3;
-function useWheel(ref, onWheel, options = {}) {
-  let router = useKeyRouter(), handler = (0, import_react.useRef)(onWheel), active = (0, import_react.useRef)(options.active !== !1);
-  handler.current = onWheel, active.current = options.active !== !1;
-  let layer = options.layer ?? "main";
-  (0, import_react.useEffect)(() => router.registerWheel({ layer, ref, handler, active }), [router, layer, ref]);
-}
-function useClick(ref, onClick, options = {}) {
-  let router = useKeyRouter(), handler = (0, import_react.useRef)(onClick), active = (0, import_react.useRef)(options.active !== !1);
-  handler.current = onClick, active.current = options.active !== !1, (0, import_react.useEffect)(() => router.registerClick({ ref, handler, active }), [router, ref]);
-}
-function keyLabel(spec) {
-  let parts = spec.split("+"), ctrl = parts.some((p) => p.toLowerCase() === "ctrl");
-  return parts.map((part) => {
-    let p = part.toLowerCase();
-    return p === "ctrl" ? "Ctrl+" : p === "alt" || p === "meta" ? "Alt+" : p === "shift" ? "Shift+" : p === "cmd" || p === "super" ? "Cmd+" : p === "backspace" ? "Backspace" : p === "delete" || p === "del" ? "Delete" : p === "home" ? "Home" : p === "end" ? "End" : p === "enter" || p === "return" ? "Enter" : p === "esc" || p === "escape" ? "Esc" : p === "tab" ? "Tab" : p === "up" ? "\u2191" : p === "down" ? "\u2193" : p === "left" ? "\u2190" : p === "right" ? "\u2192" : p === "pgup" || p === "pageup" ? "PgUp" : p === "pgdn" || p === "pagedown" ? "PgDn" : part.length === 1 && ctrl ? part.toUpperCase() : part;
-  }).join("");
-}
-
-// src/main/tui/ui/KeyHint.tsx
-var import_jsx_runtime2 = __toESM(require_jsx_runtime(), 1);
-function KeyHint({ keys, label }) {
-  let theme = useTheme();
-  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(Text, { children: [
-    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { bold: !0, color: theme.color.accent, children: keys.split(" ").map(keyLabel).join("/") }),
-    /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(Text, { color: theme.color.muted, children: [
-      " ",
-      label
-    ] })
-  ] });
-}
-function KeyHints({ hints }) {
-  let theme = useTheme();
-  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { wrap: "truncate-end", children: hints.map((hint, index) => /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_react2.Fragment, { children: [
-    index > 0 ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(Text, { color: theme.color.dim, children: [
-      " ",
-      theme.glyph.sep,
-      " "
-    ] }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(KeyHint, { ...hint })
-  ] }, `${hint.keys}:${hint.label}`)) });
-}
-
-// src/main/tui/identity/model.ts
-var IDENTITY_OVERLAY = "identity", NEW_AGENT_OVERLAY = "new-agent", IDENTITY_BANNER_KEY = "shell.identity.banner";
-var SAVED_WORD = "saved";
-function shortDid(did, keep = 6) {
-  if (!did) return "";
-  let m = did.match(/^(did:[a-z0-9]+:)(.*)$/i);
-  if (!m) return did.length > 16 ? `${did.slice(0, 10)}\u2026${did.slice(-4)}` : did;
-  let id = m[2];
-  return id.length > keep + 5 ? `${m[1]}${id.slice(0, keep)}\u2026${id.slice(-4)}` : did;
-}
-function normalizePhrase(text) {
-  return phraseWords(text).join(" ");
-}
-function phraseWords(text) {
-  return text.toLowerCase().split(/[\s,;]+/).map((w) => w.replace(/^\d+[.):-]?$/, "").replace(/^\d+[.):-]/, "").replace(/[^a-z]/g, "")).filter(Boolean);
-}
-function isLoopbackUrl(url) {
-  try {
-    let host = new URL(url).hostname.replace(/^\[|\]$/g, "").toLowerCase();
-    return host === "localhost" || host === "::1" || /^127\./.test(host) || host.startsWith("::ffff:127.");
-  } catch {
-    return !1;
-  }
+// src/shared/utils/mcp-config.ts
+var mcp_config_exports = {};
+__export(mcp_config_exports, {
+  MCP_EXECUTABLE_IDENTITY_FIELDS: () => MCP_EXECUTABLE_IDENTITY_FIELDS,
+  buildEnvSchemaFromKeys: () => buildEnvSchemaFromKeys,
+  buildHeaderEnvSchemaFromEntries: () => buildHeaderEnvSchemaFromEntries,
+  buildMcpServerConfigFromRegistration: () => buildMcpServerConfigFromRegistration,
+  deriveRegistrationTestPlan: () => deriveRegistrationTestPlan,
+  getMcpRegistrationEnvKeys: () => getMcpRegistrationEnvKeys,
+  isRegistrationAgentVisible: () => isRegistrationAgentVisible,
+  isSensitiveMcpHeader: () => isSensitiveMcpHeader,
+  mcpCredentialNamespace: () => mcpCredentialNamespace,
+  mcpCredentialRef: () => mcpCredentialRef,
+  pinServerConfigToRegistration: () => pinServerConfigToRegistration,
+  reconcileHostApprovedRegistrations: () => reconcileHostApprovedRegistrations,
+  registrationSourceIdentity: () => registrationSourceIdentity,
+  sameExecutableIdentity: () => sameExecutableIdentity,
+  suggestedAgentVisible: () => suggestedAgentVisible
+});
+function sourcePackage(source) {
+  let s = source;
+  return s.npm_package ?? s.npmPackage ?? s.pypi_package ?? s.pypiPackage;
+}
+function mcpCredentialNamespace(source) {
+  return sourcePackage(source) ?? source.name;
+}
+function mcpCredentialRef(source, key) {
+  return `mcp:${mcpCredentialNamespace(source)}:${key}`;
+}
+function isSensitiveMcpHeader(header) {
+  let normalized = header.trim().toLowerCase();
+  return normalized === "authorization" || normalized === "proxy-authorization" || normalized === "x-api-key" || normalized === "api-key" || normalized === "apikey" || normalized === "x-auth-token" || normalized === "x-access-token" || normalized.includes("token") || normalized.includes("secret") || normalized.includes("credential");
+}
+function buildEnvSchemaFromKeys(source, keys, scope, requiredKeys = keys) {
+  let required = new Set(requiredKeys);
+  return [...new Set(keys.filter(Boolean))].map((key) => ({
+    key,
+    scope,
+    required: required.has(key) || void 0,
+    credential_ref: scope === "app" ? mcpCredentialRef(source, key) : void 0
+  }));
 }
-var LOOPBACK_ONLY_TEXT = "The seed phrase and passphrase never travel over the network: create, restore and unlock only work from the daemon\u2019s own machine. Run the terminal app (`adf`) or `adf identity` there.", IDENTITY_EXPLAINER = "Your owner identity proves these agents are yours. It is 12 words: the same words restore it anywhere, in the terminal or in ADF Studio.";
-function identityErrorText(code, fallback, identity) {
-  switch (code) {
-    case "invalid_mnemonic":
-      return "Those are not 12 valid seed words. Check each word and the order.";
-    case "owner_mismatch":
-      return identity?.ownerDid ? `That phrase belongs to a different owner. This machine\u2019s owner is ${shortDid(identity.ownerDid)}: enter its phrase. (To switch owners, import the new phrase in ADF Studio.)` : "That phrase belongs to a different owner than this machine\u2019s.";
-    case "wrong_passphrase":
-      return "Wrong passphrase.";
-    case "weak_passphrase":
-      return "Choose a passphrase of at least 8 characters.";
-    case "passphrase_required":
-      return "This machine keeps the identity in a passphrase-protected file: enter the passphrase.";
-    case "loopback_only":
-      return LOOPBACK_ONLY_TEXT;
-    case "identity_exists":
-      return "An owner identity already exists here; nothing was created.";
-    case "nothing_to_unlock":
-      return "There is nothing to unlock yet: create or restore an identity.";
-    default:
-      return fallback;
-  }
+function buildHeaderEnvSchemaFromEntries(source, entries, appScoped = !0) {
+  return entries.filter((entry) => entry.header && entry.env).map((entry) => ({
+    header: entry.header,
+    env: entry.env,
+    required: !0,
+    credential_ref: appScoped ? mcpCredentialRef(source, entry.env) : void 0
+  }));
 }
-function identityBadge(identity) {
-  if (!identity) return null;
-  switch (identity.status) {
-    case "ready":
-      return identity.backupConfirmed ? { text: `owner ${shortDid(identity.ownerDid, 4).replace(/^did:key:/, "")}`, tone: "muted" } : { text: `owner ${shortDid(identity.ownerDid, 4).replace(/^did:key:/, "")} not backed up`, tone: "warn" };
-    case "locked":
-      return { text: "owner locked", tone: "warn" };
-    case "restore-needed":
-      return { text: "owner: restore", tone: "warn" };
-    default:
-      return { text: "no owner", tone: "warn" };
-  }
+function getMcpRegistrationEnvKeys(registration) {
+  return [.../* @__PURE__ */ new Set([
+    ...(registration.env ?? []).map((entry) => entry.key).filter(Boolean),
+    ...registration.bearerTokenEnvVar ? [registration.bearerTokenEnvVar] : [],
+    ...(registration.headerEnv ?? []).map((entry) => entry.value).filter(Boolean)
+  ])];
 }
-function onboardingLines(identity) {
-  switch (identity.status) {
-    case "locked":
-      return { title: "Your owner identity is locked", next: "Unlock it with its passphrase to create and seal agents." };
-    case "restore-needed":
-      return {
-        title: "Restore your owner identity",
-        next: `This machine already belongs to ${shortDid(identity.ownerDid)}: enter the 12-word phrase for this owner.`
-      };
-    case "ready":
-      return { title: "Owner identity ready", next: "" };
-    default:
-      return { title: "Set up your owner identity", next: "Create a new one, or restore yours from its 12-word seed phrase." };
+function buildMcpServerConfigFromRegistration(registration) {
+  let isHttp = registration.type === "http" || !!registration.url, serverCfg = {
+    name: registration.name,
+    transport: isHttp ? "http" : "stdio"
+  };
+  if (isHttp) {
+    serverCfg.url = registration.url, serverCfg.source = registration.url ? `http:${registration.url}` : "http";
+    let staticHeaders = {};
+    for (let { key, value } of registration.headers ?? [])
+      key && value && !isSensitiveMcpHeader(key) && (staticHeaders[key] = value);
+    Object.keys(staticHeaders).length && (serverCfg.headers = staticHeaders), registration.headerEnv?.length && (serverCfg.header_env = buildHeaderEnvSchemaFromEntries(
+      registration,
+      registration.headerEnv.map(({ key, value }) => ({ header: key, env: value })),
+      (registration.credentialStorage ?? "app") !== "agent"
+    )), registration.oauth ? serverCfg.oauth = !0 : registration.bearerTokenEnvVar && (serverCfg.bearer_token_env_var = registration.bearerTokenEnvVar);
+  } else registration.npmPackage ? (serverCfg.source = `npm:${registration.npmPackage}`, serverCfg.npm_package = registration.npmPackage) : registration.pypiPackage ? (serverCfg.source = `uvx:${registration.pypiPackage}`, serverCfg.pypi_package = registration.pypiPackage) : (serverCfg.source = "custom", serverCfg.command = registration.command, serverCfg.args = registration.args);
+  isHttp || (registration.command && (serverCfg.command = registration.command), registration.args?.length && (serverCfg.args = registration.args));
+  let envKeys = getMcpRegistrationEnvKeys(registration);
+  if (envKeys.length) {
+    let scope = (registration.credentialStorage ?? "app") === "agent" ? "agent" : "app";
+    scope === "agent" && (serverCfg.env_keys = envKeys), serverCfg.env_schema = buildEnvSchemaFromKeys(registration, envKeys, scope);
   }
+  return registration.toolCallTimeout && (serverCfg.tool_call_timeout_ms = registration.toolCallTimeout * 1e3), !isHttp && registration.runLocation && (serverCfg.run_location = registration.runLocation), registration.credentialFiles?.length && (serverCfg.credential_files = registration.credentialFiles.map((f) => ({
+    path: f.path,
+    ...f.required !== void 0 ? { required: f.required } : {},
+    ...f.writeBack !== void 0 ? { write_back: f.writeBack } : {}
+  }))), serverCfg;
+}
+function pinServerConfigToRegistration(connCfg, registration) {
+  let canonical = buildMcpServerConfigFromRegistration(registration), agentEnvSchema = (connCfg.env_schema ?? []).filter((e) => e.scope === "agent"), mergedEnvSchema = [
+    ...canonical.env_schema ?? [],
+    ...agentEnvSchema.filter(
+      (a) => !(canonical.env_schema ?? []).some((c) => c.key === a.key && c.scope === a.scope)
+    )
+  ];
+  return {
+    ...canonical,
+    // Agent-owned state kept from the .adf copy:
+    env: connCfg.env,
+    env_keys: connCfg.env_keys,
+    available_tools: connCfg.available_tools,
+    restricted: connCfg.restricted,
+    ...mergedEnvSchema.length ? { env_schema: mergedEnvSchema } : {}
+  };
 }
-function onboardingChoices(identity) {
-  switch (identity.status) {
-    case "none":
-      return [
-        { key: "c", label: "Create new", mode: "create" },
-        { key: "r", label: "Restore from seed phrase", mode: "restore" }
-      ];
-    case "restore-needed":
-      return [{ key: "r", label: "Restore from seed phrase", mode: "restore" }];
-    case "locked":
-      return identity.storage === "file" && identity.passphraseRequired ? [{ key: "u", label: "Unlock with passphrase", mode: "unlock" }] : [];
-    default:
-      return [];
-  }
+function suggestedAgentVisible(reg) {
+  return reg.type === "http" || !!reg.url ? !0 : reg.runLocation !== "host";
 }
-function passphraseProblem(first, second, isNew) {
-  return first ? isNew ? first.length < 8 ? "At least 8 characters." : second !== null && first !== second ? "The two passphrases differ. Type them again." : null : null : "Enter the passphrase.";
+function isRegistrationAgentVisible(reg) {
+  return reg.agentVisible ?? suggestedAgentVisible(reg);
 }
-
-// src/main/tui/identity/Onboarding.tsx
-var import_jsx_runtime3 = __toESM(require_jsx_runtime(), 1);
-function openIdentity(store, props = {}) {
-  store.actions.pushOverlay({ kind: IDENTITY_OVERLAY, props: { ...props } });
+var MCP_EXECUTABLE_IDENTITY_FIELDS = ["type", "url", "command", "args", "npmPackage", "pypiPackage"];
+function sameExecutableIdentity(a, b) {
+  let argsA = a.args ?? [], argsB = b.args ?? [];
+  return a.type === b.type && a.url === b.url && a.command === b.command && a.npmPackage === b.npmPackage && a.pypiPackage === b.pypiPackage && argsA.length === argsB.length && argsA.every((arg, i) => arg === argsB[i]);
 }
-function openNewAgent(store, name) {
-  let identity = store.getState().identity;
-  if (identity && identity.status !== "ready") {
-    openIdentity(store, { mode: "status", then: NEW_AGENT_OVERLAY, name, reason: "Agents are sealed under your owner identity: set it up first, then the new agent follows." });
-    return;
+function deriveRegistrationTestPlan(reg, opts) {
+  if (reg.type === "http" || !!reg.url) {
+    let notes2 = reg.oauth ? ["Interactive OAuth sign-in runs in a browser during this test."] : [];
+    return { location: "remote http", authMode: reg.oauth ? "run" : "none", materializeFiles: !1, notes: notes2 };
   }
-  store.actions.pushOverlay({ kind: NEW_AGENT_OVERLAY, props: name ? { name } : {} });
-}
-function bannerKeyOf(identity) {
-  return `${identity.status}:${identity.backupConfirmed ? 1 : 0}`;
-}
-function needsAttention(identity) {
-  return !!identity && (identity.status !== "ready" || !identity.backupConfirmed);
-}
-function identityKey(store, identity, input, panel) {
-  if (!identity) return !1;
-  if (input === "i")
-    return openIdentity(store), !0;
-  if (input === "I" && !panel && needsAttention(identity))
-    return store.actions.setViewState(IDENTITY_BANNER_KEY, bannerKeyOf(identity)), !0;
-  if (!panel) return !1;
-  let choice = onboardingChoices(identity).find((c) => c.key === input);
-  return choice ? (openIdentity(store, { mode: choice.mode }), !0) : !1;
-}
-function IdentityOnboarding({ identity, width, focused }) {
-  let theme = useTheme(), { title, next } = onboardingLines(identity), choices = onboardingChoices(identity), inner = Math.max(30, Math.min(width - 2, 72));
-  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Box_default, { flexDirection: "column", width: inner, marginTop: 1, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Text, { bold: !0, color: theme.color.accent, children: [
-      theme.glyph.wordmark,
-      " ",
-      title
-    ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { children: " " }),
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { wrap: "wrap", color: theme.color.text, children: IDENTITY_EXPLAINER }),
-    next ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { wrap: "wrap", color: theme.color.muted, children: next }) : null,
-    identity.status === "locked" && choices.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { wrap: "wrap", color: theme.color.warn, children: identity.message }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { children: " " }),
-    choices.map((c) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Text, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Text, { bold: !0, color: theme.color.accent, children: [
-        "  [",
-        c.key,
-        "]"
-      ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Text, { color: theme.color.text, children: [
-        " ",
-        c.label
-      ] })
-    ] }, c.key)),
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { children: " " }),
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(KeyHints, { hints: focused ? [{ keys: "i", label: "details" }, { keys: "o", label: "load an existing .adf" }] : [{ keys: "shift+tab", label: "focus here to choose" }] })
-  ] });
-}
-function IdentityBanner({ identity, width }) {
-  let theme = useTheme(), text = identity.status === "ready" ? `Seed phrase backup not confirmed for ${shortDid(identity.ownerDid, 4)}. Make sure the 12 words are written down.` : identity.status === "locked" ? "Owner identity locked: new agents cannot be created until it is unlocked." : identity.status === "restore-needed" ? `Restore owner ${shortDid(identity.ownerDid, 4)} from its 12 words to create agents here.` : "No owner identity yet: set one up to create agents.";
-  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Text, { wrap: "truncate-end", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Text, { color: theme.color.warn, children: [
-      theme.glyph.warn,
-      " ",
-      text.slice(0, Math.max(10, width - 24))
-    ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { color: theme.color.dim, children: "  " }),
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { bold: !0, color: theme.color.accent, children: "i" }),
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { color: theme.color.muted, children: " open" }),
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Text, { color: theme.color.dim, children: [
-      " ",
-      theme.glyph.sep,
-      " "
-    ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { bold: !0, color: theme.color.accent, children: "I" }),
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { color: theme.color.muted, children: " hide" })
-  ] });
-}
-
-// src/main/tui/setup/channels.ts
-var { ADAPTER_REGISTRY } = cjs(adapter_registry_exports), CHANNELS_OVERLAY = "channels", CHANNEL_ORDER = ["telegram", "discord", "slack", "email", "whatsapp"];
-function channelEntries() {
-  let byType = new Map(ADAPTER_REGISTRY.map((e) => [e.type, e]));
-  return CHANNEL_ORDER.map((t) => byType.get(t)).filter((e) => !!e);
-}
-function findChannel(type) {
-  if (!type) return;
-  let wanted = type.trim().toLowerCase();
-  return channelEntries().find((e) => e.type === wanted || e.displayName.toLowerCase() === wanted);
-}
-function credentialFields(entry) {
-  return entry.credentials ?? [
-    ...entry.requiredEnvKeys.map((key) => ({ key, label: key, required: !0 })),
-    ...(entry.optionalEnvKeys ?? []).map((key) => ({ key, label: key, required: !1 }))
-  ];
-}
-var DEFAULT_ADAPTER_CONFIG = { enabled: !0, policy: { dm: "all", groups: "mention" } }, SHAPES = {
-  TELEGRAM_BOT_TOKEN: { test: /^\d{5,}:[A-Za-z0-9_-]{30,}$/, message: "A bot token looks like 123456789:AA\u2026 (digits, a colon, then 30+ characters)." },
-  DISCORD_BOT_TOKEN: { test: /^[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{20,}$/, message: "A Discord bot token has three dot-separated parts (Bot page \u2192 Reset Token)." },
-  DISCORD_APPLICATION_ID: { test: /^\d{15,22}$/, message: "The application ID is a long number (General Information page)." },
-  SLACK_APP_TOKEN: { test: /^xapp-/, message: "The app-level token starts with xapp- (Socket Mode page)." },
-  SLACK_BOT_TOKEN: { test: /^xoxb-/, message: "The bot token starts with xoxb- (Install App page)." },
-  EMAIL_USERNAME: { test: /^[^\s@]+@[^\s@]+\.[^\s@]+$/, message: "Enter the full email address." }
-};
-function validateCredentials(entry, values) {
-  let errors = {};
-  for (let field of credentialFields(entry)) {
-    let value = (values[field.key] ?? "").trim();
-    if (!value) {
-      field.required && (errors[field.key] = `${field.label} is required.`);
-      continue;
+  if (reg.runLocation === "host") {
+    if (!opts?.hostAccessEnabled) {
+      let notes2 = ["Host access is disabled app-wide \u2014 this test ran in the shared container. Turn on Host access in Settings \u2192 Compute to test on the host."];
+      return reg.auth && notes2.push("Authorization for containerized servers happens per-agent when an agent attaches this server."), { location: "shared container", authMode: reg.auth ? "skip" : "none", materializeFiles: !1, notes: notes2 };
     }
-    if (/\s/.test(value)) {
-      errors[field.key] = "No spaces: paste the value exactly.";
-      continue;
-    }
-    let shape = SHAPES[field.key];
-    shape && !shape.test.test(value) && (errors[field.key] = shape.message);
+    return {
+      location: "host",
+      authMode: reg.auth ? "run" : "none",
+      materializeFiles: !0,
+      notes: []
+    };
   }
-  return errors;
-}
-function adapterLiveState(diag, type) {
-  let state = diag?.states?.find((s) => s.type === type);
-  return state ? { status: ["connected", "connecting", "disconnected", "error"].includes(state.status) ? state.status : "unknown", ...state.error ? { error: state.error } : {} } : { status: diag?.configured?.some((c) => c.type === type) ? "not running" : "unknown" };
-}
-function configuredChannels(config) {
-  return Object.keys(config?.adapters ?? {});
+  let notes = [];
+  return reg.auth && notes.push("Authorization for containerized servers happens per-agent when an agent attaches this server."), reg.credentialFiles?.length && notes.push("Credential files for containerized servers are captured per-agent at attach; this test verifies the package launches and lists tools."), { location: "shared container", authMode: reg.auth ? "skip" : "none", materializeFiles: !1, notes };
+}
+function registrationSourceIdentity(reg) {
+  return reg.type === "http" || reg.url ? reg.url ? `http:${reg.url}` : "http" : reg.npmPackage ? `npm:${reg.npmPackage}` : reg.pypiPackage ? `uvx:${reg.pypiPackage}` : "custom";
+}
+function reconcileHostApprovedRegistrations(prev, next, approved, approvedSources) {
+  let result = [...approved], sources = { ...approvedSources ?? {} }, prevByName = new Map(prev.filter((r) => r.name).map((r) => [r.name, r])), nextByName = new Map(next.filter((r) => r.name).map((r) => [r.name, r])), add = (name, reg) => {
+    result.includes(name) || result.push(name), sources[name] = registrationSourceIdentity(reg);
+  }, remove = (name) => {
+    let i = result.indexOf(name);
+    i >= 0 && result.splice(i, 1), delete sources[name];
+  };
+  for (let [name, reg] of nextByName) {
+    let wasHost = prevByName.get(name)?.runLocation === "host", isHost = reg.runLocation === "host" && reg.type !== "http";
+    isHost && !wasHost ? add(name, reg) : !isHost && wasHost ? remove(name) : isHost && wasHost && result.includes(name) && (sources[name] = registrationSourceIdentity(reg));
+  }
+  for (let [name, reg] of prevByName)
+    !nextByName.has(name) && reg.runLocation === "host" && remove(name);
+  return { approved: result, sources };
 }
 
 // src/shared/constants/provider-catalog.ts
@@ -442,6 +220,15 @@ var PROVIDER_CATALOG_GROUPS = [
     modelPlaceholder: "e.g. grok-4.5",
     iconKey: "x"
   },
+  {
+    key: "claude-subscription",
+    label: "Claude",
+    type: "claude-subscription",
+    group: "subscription",
+    description: "Use your Claude Pro or Max plan, via Claude Code.",
+    modelPlaceholder: "e.g. claude-sonnet-5-5",
+    iconKey: "anthropic"
+  },
   // ---- First-party APIs -----------------------------------------------------
   {
     key: "anthropic",
@@ -555,62 +342,12 @@ function providerTypeHint(type) {
       return "ChatGPT subscription (OAuth)";
     case "grok-subscription":
       return "Grok subscription (OAuth)";
+    case "claude-subscription":
+      return "Claude subscription (via Claude Code)";
   }
 }
 function isSubscriptionType(type) {
-  return type === "chatgpt-subscription" || type === "grok-subscription";
-}
-
-// src/main/tui/setup/provider.ts
-var { PROVIDER_CATALOG: PROVIDER_CATALOG2 } = cjs(provider_catalog_exports), PROVIDER_OVERLAY = "provider.add", API_TYPES = /* @__PURE__ */ new Set(["anthropic", "openai", "openrouter", "openai-compatible"]);
-function providerRows() {
-  let order = { subscription: 0, api: 1, local: 2, other: 3 };
-  return [...PROVIDER_CATALOG2].filter((e) => e.group === "subscription" || API_TYPES.has(e.type)).sort((a, b) => (order[a.group] ?? 9) - (order[b.group] ?? 9)).map((entry) => ({
-    entry,
-    ...entry.type === "chatgpt-subscription" ? { signIn: "chatgpt" } : entry.type === "grok-subscription" ? { signIn: "grok" } : {}
-  }));
-}
-function findProviderRow(key) {
-  if (!key) return;
-  let wanted = key.trim().toLowerCase();
-  return providerRows().find((r) => r.entry.key === wanted || r.entry.label.toLowerCase() === wanted || r.entry.type === wanted);
-}
-function keyOptional(entry) {
-  return entry.keyOptional === !0 || entry.group === "other";
-}
-function needsBaseUrl(entry) {
-  return entry.type === "openai-compatible";
-}
-function validateProvider(entry, v) {
-  let errors = {};
-  if (needsBaseUrl(entry)) {
-    let url = v.baseUrl.trim();
-    if (!url) errors.baseUrl = "The server\u2019s base URL, e.g. http://localhost:11434/v1.";
-    else if (/YOUR_[A-Z_]+/.test(url)) errors.baseUrl = "Replace the YOUR_\u2026 part of the URL with your own value.";
-    else
-      try {
-        let parsed = new URL(url);
-        parsed.protocol !== "http:" && parsed.protocol !== "https:" && (errors.baseUrl = "Use an http(s) URL.");
-      } catch {
-        errors.baseUrl = "Not a URL.";
-      }
-  }
-  let key = v.apiKey.trim();
-  return !key && !keyOptional(entry) ? errors.apiKey = "Paste the API key." : /\s/.test(key) && (errors.apiKey = "No spaces: paste the key exactly."), errors;
-}
-function providerInput(entry, v) {
-  let key = v.apiKey.trim();
-  return {
-    type: entry.type,
-    name: v.name.trim() || entry.label,
-    ...needsBaseUrl(entry) ? { baseUrl: v.baseUrl.trim() } : {},
-    ...v.defaultModel.trim() ? { defaultModel: v.defaultModel.trim() } : {},
-    preset: entry.key,
-    ...key ? { apiKey: key } : {}
-  };
-}
-function keyStorageText(storage) {
-  return storage === "file" ? "the daemon\u2019s passphrase-protected secret file" : "the OS keychain";
+  return type === "chatgpt-subscription" || type === "grok-subscription" || type === "claude-subscription";
 }
 
 // src/shared/constants/mcp-registry.ts
@@ -2233,240 +1970,20 @@ function findRegistryEntryByUrl(url) {
   return MCP_REGISTRY.find((e) => e.url === url);
 }
 
-// src/main/tui/setup/mcp.ts
-var { MCP_REGISTRY: MCP_REGISTRY2, registrationFromRegistryEntry: registrationFromRegistryEntry2, hasUnresolvedPlaceholderArgs: hasUnresolvedPlaceholderArgs2, REGISTRY_ARG_PLACEHOLDER_RE: REGISTRY_ARG_PLACEHOLDER_RE2 } = cjs(mcp_registry_exports), { buildMcpServerConfigFromRegistration, mcpCredentialNamespace } = cjs(mcp_config_exports), MCP_OVERLAY = "mcp";
-function mcpSourceRows() {
-  let custom = [
-    { kind: "npm", label: "npm package", detail: "Any MCP server published to npm (e.g. @modelcontextprotocol/server-everything)" },
-    { kind: "python", label: "Python package (uvx)", detail: "Any MCP server on PyPI, run with uvx (e.g. mcp-server-fetch)" },
-    { kind: "http", label: "Remote server (URL)", detail: "A Streamable HTTP MCP endpoint; token from an env var" }
-  ], catalog = MCP_REGISTRY2.filter((e) => !e.deprecated).map((entry) => ({ kind: "catalog", entry, label: entry.displayName, detail: entry.description }));
-  return [...custom, ...catalog];
-}
-function parseAddTarget(arg) {
-  let raw = (arg ?? "").trim();
-  if (!raw) return {};
-  let rows = mcpSourceRows();
-  if (/^https?:\/\//i.test(raw)) {
-    let known = rows.find((r) => r.entry?.url === raw);
-    return known ? { row: known } : { row: rows.find((r) => r.kind === "http"), value: raw };
-  }
-  let prefixed = raw.match(/^(npm|python|uvx|pip):(.+)$/i);
-  if (prefixed) {
-    let kind = prefixed[1].toLowerCase() === "npm" ? "npm" : "python";
-    return { row: rows.find((r) => r.kind === kind), value: prefixed[2].trim() };
-  }
-  let wanted = raw.toLowerCase(), entry = rows.find((r) => r.entry && (r.entry.name === wanted || r.entry.npmPackage === raw || r.entry.pypiPackage === raw || r.entry.displayName.toLowerCase() === wanted));
-  return entry ? { row: entry } : { row: rows.find((r) => r.kind === "npm"), value: raw };
-}
-function sanitizeServerName(value) {
-  return value.toLowerCase().replace(/^@[^/]+\//, "").replace(/^mcp-server-|-mcp-server$|^server-|-mcp$|^mcp-/g, "").replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
-}
-function defaultServerName(row, value = "") {
-  if (row.entry) return row.entry.name;
-  if (row.kind === "http")
-    try {
-      return sanitizeServerName(new URL(value).hostname.split(".").slice(-2, -1)[0] ?? "");
-    } catch {
-      return "";
-    }
-  return sanitizeServerName(value.split("/").pop() ?? value);
-}
-function envKeysOf(row) {
-  let e = row.entry;
-  if (!e) return row.kind === "http" ? [{ key: "MCP_TOKEN", required: !1 }] : [];
-  let keys = [
-    ...e.requiredEnvKeys.map((key) => ({ key, required: !0 })),
-    ...(e.optionalEnvKeys ?? []).map((key) => ({ key, required: !1 })),
-    ...e.bearerTokenEnvVar ? [{ key: e.bearerTokenEnvVar, required: !!e.url && !e.oauth }] : [],
-    ...(e.headerEnv ?? []).map((h) => ({ key: h.env, required: !0 }))
-  ];
-  return keys.filter((k, i) => keys.findIndex((x) => x.key === k.key) === i);
-}
-function studioOnlyReason(row) {
-  let e = row.entry;
-  return e ? e.url && e.oauth && !e.bearerTokenEnvVar && !e.headerEnv?.length ? `${e.displayName} signs in with OAuth in the browser, which only ADF Studio runs today. Add it in Studio (Settings \u2192 MCP \u2192 ${e.displayName}, Connect), then it shows up here.` : e.auth || (e.credentialFiles?.length ?? 0) > 0 ? `${e.displayName} needs a one-time sign-in step (it writes a credential file), which ADF Studio runs. Add it in Studio (Settings \u2192 MCP), then it shows up here.` : null : null;
-}
-function validateMcpForm(row, form, taken) {
-  let errors = {};
-  if (form.name ? form.name !== sanitizeServerName(form.name) || !/^[a-z0-9][a-z0-9_-]*$/.test(form.name) ? errors.name = "Lowercase letters, digits, - and _ only." : taken.includes(form.name) && (errors.name = `This agent already has a server named ${form.name}.`) : errors.name = "Give it a name (letters, digits, - and _).", !row.entry) {
-    let source = form.source.trim();
-    if (!source) errors.source = row.kind === "http" ? "The server URL." : "The package name.";
-    else if (row.kind === "http")
-      try {
-        /^https?:$/.test(new URL(source).protocol) || (errors.source = "Use an http(s) URL.");
-      } catch {
-        errors.source = "Not a URL.";
-      }
-    else /\s/.test(source) && (errors.source = "One package name, no spaces.");
-  }
-  hasUnresolvedPlaceholderArgs2(splitArgs(form.args)) && (errors.args = "Fill in the {placeholders}.");
-  for (let { key, required } of envKeysOf(row))
-    required && !(form.env[key] ?? "").trim() && (errors[`env:${key}`] = `${key} is required.`);
-  return errors;
-}
-function splitArgs(text) {
-  let out = [], pattern = /"((?:[^"\\]|\\.)*)"|'([^']*)'|(\S+)/g, m;
-  for (; m = pattern.exec(text); ) out.push(m[1] !== void 0 ? m[1].replace(/\\(.)/g, "$1") : m[2] ?? m[3]);
-  return out;
-}
-function joinArgs(args) {
-  return (args ?? []).map((a) => /\s/.test(a) ? `"${a.replace(/"/g, '\\"')}"` : a).join(" ");
-}
-function registrationFor(row, form) {
-  let envKeys = envKeysOf(row).map((k) => k.key), base = row.entry ? registrationFromRegistryEntry2(row.entry, `tui:${form.name}`) : row.kind === "http" ? { id: `tui:${form.name}`, name: form.name, type: "http", url: form.source.trim(), ...form.env.MCP_TOKEN?.trim() ? { bearerTokenEnvVar: "MCP_TOKEN" } : {} } : row.kind === "python" ? { id: `tui:${form.name}`, name: form.name, type: "uvx", pypiPackage: form.source.trim(), managed: !0 } : { id: `tui:${form.name}`, name: form.name, type: "npm", npmPackage: form.source.trim(), managed: !0 }, isHttp = base.type === "http", args = splitArgs(form.args), keysWithValues = envKeys.filter((k) => (form.env[k] ?? "").trim());
-  return {
-    ...base,
-    name: form.name,
-    credentialStorage: "agent",
-    // Keys only: values go to the agent's identity store.
-    env: (row.entry ? envKeys : keysWithValues).map((key) => ({ key, value: "" })),
-    // Remote catalog entries that also take a token: the token path (OAuth runs in Studio only).
-    ...isHttp && base.oauth && base.bearerTokenEnvVar ? { oauth: !1 } : {},
-    ...isHttp ? {} : { args: args.length ? args : void 0 },
-    // Container unless the user picked the host (a catalog entry's host default is only a preselection).
-    runLocation: !isHttp && form.runOn === "host" ? "host" : void 0
-  };
-}
-function serverConfigFor(row, form) {
-  return buildMcpServerConfigFromRegistration(registrationFor(row, form));
-}
-function credentialNamespace(server) {
-  return mcpCredentialNamespace(server);
-}
-function packageToInstall(server) {
-  return server.transport === "http" ? null : server.npm_package ? { kind: "npm", name: server.npm_package } : server.pypi_package ? { kind: "python", name: server.pypi_package } : null;
-}
-function serverEnvKeys(server) {
-  return [.../* @__PURE__ */ new Set([
-    ...server.env_keys ?? [],
-    ...(server.env_schema ?? []).map((e) => e.key),
-    ...server.bearer_token_env_var ? [server.bearer_token_env_var] : [],
-    ...(server.header_env ?? []).map((h) => h.env)
-  ])];
-}
-function runsOnText(server, location) {
-  return location || (server ? server.transport === "http" ? "remote" : server.run_location === "host" ? "host" : server.run_location === "shared" ? "shared container" : "container" : "");
-}
-function serverToolDecls(tools, server) {
-  let prefix = `mcp_${server}_`;
-  return (tools ?? []).filter((t) => t.name.startsWith(prefix)).map((t) => ({ name: t.name, tool: t.name.slice(prefix.length), enabled: t.enabled !== !1 }));
-}
-
-// src/main/tui/setup/open.ts
-function channelsIdentityReady(store) {
-  let identity = store.getState().identity;
-  return !identity || identity.status === "ready";
-}
-function secretStoreReady(store) {
-  let identity = store.getState().identity;
-  return identity ? identity.storage === "keychain" ? identity.status !== "locked" : identity.status === "ready" : !0;
-}
-function openChannels(store, props = {}) {
-  let state = store.getState(), agentId = props.agentId ?? state.selectedAgentId;
-  if (!agentId || !state.agents[agentId]) {
-    store.actions.toast("Select an agent first (sidebar or /agent), or create one with /new", "warn");
-    return;
-  }
-  let next = { agentId, ...props.channel ? { channel: props.channel } : {} };
-  if (props.channel && !channelsIdentityReady(store)) {
-    identityFirst(store, CHANNELS_OVERLAY, next, "Channel credentials are sealed under your owner identity: set it up first, then the channel setup follows.");
-    return;
-  }
-  store.actions.pushOverlay({ kind: CHANNELS_OVERLAY, props: { ...next } });
-}
-function openProviderAdd(store, props = {}) {
-  if (!secretStoreReady(store)) {
-    identityFirst(store, PROVIDER_OVERLAY, { ...props }, "API keys go into the daemon\u2019s secret store, which is protected by your owner identity here: set it up or unlock it first.");
-    return;
-  }
-  store.actions.pushOverlay({ kind: PROVIDER_OVERLAY, props: { ...props } });
-}
-function openMcp(store, props = {}) {
-  let state = store.getState(), agentId = props.agentId ?? state.selectedAgentId;
-  if (!agentId || !state.agents[agentId]) {
-    store.actions.toast("Select an agent first (sidebar or /agent), or create one with /new", "warn");
-    return;
-  }
-  store.actions.pushOverlay({ kind: MCP_OVERLAY, props: { ...props, agentId } });
-}
-function openWelcome(store) {
-  store.actions.pushOverlay({ id: WELCOME_OVERLAY, kind: WELCOME_OVERLAY });
-}
-function identityFirst(store, then, thenProps, reason) {
-  openIdentity(store, { mode: "status", then, thenProps, reason });
-}
-
 export {
-  elementRect,
-  rectContains,
-  createKeyRouter,
-  KeyRouterProvider,
-  useKeyRouter,
-  useKeys,
-  WHEEL_STEP,
-  useWheel,
-  useClick,
-  keyLabel,
-  IDENTITY_OVERLAY,
-  NEW_AGENT_OVERLAY,
-  IDENTITY_BANNER_KEY,
-  SAVED_WORD,
-  shortDid,
-  normalizePhrase,
-  phraseWords,
-  isLoopbackUrl,
-  LOOPBACK_ONLY_TEXT,
-  IDENTITY_EXPLAINER,
-  identityErrorText,
-  identityBadge,
-  onboardingLines,
-  onboardingChoices,
-  passphraseProblem,
-  KeyHints,
-  openIdentity,
-  openNewAgent,
-  bannerKeyOf,
-  needsAttention,
-  identityKey,
-  IdentityOnboarding,
-  IdentityBanner,
-  CHANNELS_OVERLAY,
-  CHANNEL_ORDER,
-  channelEntries,
-  findChannel,
-  credentialFields,
-  DEFAULT_ADAPTER_CONFIG,
-  validateCredentials,
-  adapterLiveState,
-  configuredChannels,
-  PROVIDER_OVERLAY,
-  providerRows,
-  findProviderRow,
-  keyOptional,
-  needsBaseUrl,
-  validateProvider,
-  providerInput,
-  keyStorageText,
-  MCP_OVERLAY,
-  mcpSourceRows,
-  parseAddTarget,
-  defaultServerName,
-  envKeysOf,
-  studioOnlyReason,
-  validateMcpForm,
-  joinArgs,
-  serverConfigFor,
-  credentialNamespace,
-  packageToInstall,
-  serverEnvKeys,
-  runsOnText,
-  serverToolDecls,
-  channelsIdentityReady,
-  secretStoreReady,
-  openChannels,
-  openProviderAdd,
-  openMcp,
-  openWelcome,
-  identityFirst
+  mcpCredentialRef,
+  isSensitiveMcpHeader,
+  buildEnvSchemaFromKeys,
+  buildHeaderEnvSchemaFromEntries,
+  buildMcpServerConfigFromRegistration,
+  pinServerConfigToRegistration,
+  isRegistrationAgentVisible,
+  deriveRegistrationTestPlan,
+  mcp_config_exports,
+  isSubscriptionType,
+  provider_catalog_exports,
+  parseMcpRegistryDocument,
+  MCP_REGISTRY,
+  BUNDLED_REGISTRY_UPDATED_AT,
+  mcp_registry_exports
 };