@agentwares/agentguard 0.1.6 → 0.1.7

package/dist/index.js

@@ -840,514 +840,6 @@ import {
   classifyTool,
   upstreamHeaders
 } from "@agentwares/agentguard-core";
-var ProxyRuntime = class {
-  loaded;
-  guard;
-  agent;
-  defaultRunId;
-  configured;
-  sessions = /* @__PURE__ */ new Set();
-  connections = /* @__PURE__ */ new Map();
-  exposed = [];
-  resourceOwner = /* @__PURE__ */ new Map();
-  templateOwner = /* @__PURE__ */ new Map();
-  promptOwner = /* @__PURE__ */ new Map();
-  log;
-  connectTimeoutMs;
-  testClients;
-  /** stop relaying upstream stderr once we are tearing down — shutdown noise is not the user's problem */
-  closing = false;
-  constructor(opts) {
-    this.loaded = opts.loaded;
-    this.guard = opts.guard;
-    this.agent = opts.agent;
-    this.defaultRunId = opts.defaultRunId;
-    this.configured = opts.configured ?? true;
-    this.log = opts.log ?? ((line) => process.stderr.write(`[agentguard] ${line}
-`));
-    this.connectTimeoutMs = opts.connectTimeoutMs ?? 15e3;
-    this.testClients = opts.clients ?? {};
-  }
-  get policy() {
-    return this.loaded.policy;
-  }
-  async start() {
-    await Promise.all(this.policy.upstreams.map((u) => this.connect(u)));
-    for (const [name, client] of Object.entries(this.testClients)) {
-      if (this.connections.has(name)) continue;
-      const upstream = {
-        name,
-        command: "in-memory",
-        args: [],
-        env: {},
-        headers: {},
-        prefix: false,
-        timeout_ms: 6e4
-      };
-      const conn = {
-        upstream,
-        client,
-        tools: [],
-        capabilities: client.getServerCapabilities(),
-        connected: true
-      };
-      this.connections.set(name, conn);
-      this.wire(conn);
-      await this.refreshTools(name);
-    }
-    this.rebuildExposed();
-    const status = this.upstreamStatus();
-    this.log(
-      `connected ${status.filter((s) => s.connected).length}/${status.length} upstreams, ${this.exposed.length} tools, mode ${this.policy.mode}`
-    );
-  }
-  async connect(upstream) {
-    const client = new Client(
-      { name: "agentguard", version: version() },
-      { capabilities: { sampling: {}, elicitation: {} } }
-    );
-    const conn = {
-      upstream,
-      client,
-      tools: [],
-      capabilities: void 0,
-      connected: false
-    };
-    this.connections.set(upstream.name, conn);
-    try {
-      const transport = upstream.url ? new StreamableHTTPClientTransport(new URL(upstream.url), {
-        requestInit: { headers: upstreamHeaders(upstream) }
-      }) : new StdioClientTransport({
-        command: upstream.command,
-        args: upstream.args,
-        env: { ...getDefaultEnvironment(), ...upstream.env },
-        cwd: upstream.cwd,
-        stderr: "pipe"
-      });
-      if (transport instanceof StdioClientTransport) {
-        transport.stderr?.on("data", (chunk) => {
-          if (this.closing) return;
-          for (const line of chunk.toString("utf8").split("\n"))
-            if (line.trim()) this.log(`${upstream.name}: ${line}`);
-        });
-      }
-      await withTimeout(
-        client.connect(transport),
-        this.connectTimeoutMs,
-        `connect to upstream "${upstream.name}"`
-      );
-      conn.capabilities = client.getServerCapabilities();
-      conn.connected = true;
-      this.wire(conn);
-      await this.refreshTools(upstream.name);
-    } catch (err) {
-      conn.connected = false;
-      conn.error = err instanceof Error ? err.message : String(err);
-      this.log(`upstream "${upstream.name}" unavailable: ${conn.error}`);
-    }
-  }
-  wire(conn) {
-    const { client, upstream } = conn;
-    client.onclose = () => {
-      conn.connected = false;
-      conn.error = "connection closed";
-      if (!this.closing) this.log(`upstream "${upstream.name}" closed`);
-    };
-    client.setNotificationHandler(LoggingMessageNotificationSchema, async (n) => {
-      await this.broadcast(upstream.name, n.method, n.params);
-    });
-    client.setNotificationHandler(ResourceUpdatedNotificationSchema, async (n) => {
-      await this.broadcast(upstream.name, n.method, n.params);
-    });
-    client.setNotificationHandler(ResourceListChangedNotificationSchema, async () => {
-      this.resourceOwner.clear();
-      await this.broadcast(upstream.name, "notifications/resources/list_changed", void 0);
-    });
-    client.setNotificationHandler(PromptListChangedNotificationSchema, async () => {
-      this.promptOwner.clear();
-      await this.broadcast(upstream.name, "notifications/prompts/list_changed", void 0);
-    });
-    client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {
-      await this.refreshTools(upstream.name);
-      this.rebuildExposed();
-      for (const s of this.sessions) s.server.server.sendToolListChanged().catch(() => void 0);
-    });
-    try {
-      client.setRequestHandler(CreateMessageRequestSchema, async (req) => {
-        const session = this.pickSession(upstream.name);
-        if (!session) throw new Error("no downstream client is connected to relay sampling to");
-        const related = session.inflight.get(upstream.name)?.at(-1);
-        return session.server.server.createMessage(req.params, { relatedRequestId: related });
-      });
-      client.setRequestHandler(ElicitRequestSchema, async (req) => {
-        const session = this.pickSession(upstream.name);
-        if (!session) throw new Error("no downstream client is connected to relay elicitation to");
-        const related = session.inflight.get(upstream.name)?.at(-1);
-        return session.server.server.elicitInput(req.params, { relatedRequestId: related });
-      });
-    } catch {
-    }
-  }
-  pickSession(upstream) {
-    let best;
-    for (const s of this.sessions) {
-      if ((s.inflight.get(upstream)?.length ?? 0) > 0) return s;
-      if (!best || s.lastActive > best.lastActive) best = s;
-    }
-    return best;
-  }
-  async broadcast(upstream, method, params) {
-    for (const s of this.sessions) {
-      const related = s.inflight.get(upstream)?.at(-1);
-      try {
-        await s.server.server.notification(
-          { method, params },
-          related !== void 0 ? { relatedRequestId: related } : void 0
-        );
-      } catch {
-      }
-    }
-  }
-  async refreshTools(name) {
-    const conn = this.connections.get(name);
-    if (!conn?.connected) return;
-    if (conn.capabilities && !conn.capabilities.tools) {
-      conn.tools = [];
-      return;
-    }
-    try {
-      const tools = [];
-      let cursor;
-      do {
-        const page = await conn.client.listTools(cursor ? { cursor } : void 0, {
-          timeout: conn.upstream.timeout_ms
-        });
-        tools.push(...page.tools);
-        cursor = page.nextCursor;
-      } while (cursor);
-      conn.tools = tools;
-    } catch (err) {
-      this.log(
-        `tools/list failed for "${name}": ${err instanceof Error ? err.message : String(err)}`
-      );
-      conn.tools = [];
-    }
-  }
-  rebuildExposed() {
-    const taken = /* @__PURE__ */ new Set();
-    const out = [];
-    const order = [...this.policy.upstreams.map((u) => u.name), ...Object.keys(this.testClients)];
-    for (const name of order) {
-      const conn = this.connections.get(name);
-      if (!conn) continue;
-      const prefix = conn.upstream.prefix === true ? name : typeof conn.upstream.prefix === "string" ? conn.upstream.prefix : void 0;
-      for (const tool of conn.tools) {
-        let exposedName = prefix ? `${prefix}__${tool.name}` : tool.name;
-        if (taken.has(exposedName)) exposedName = `${name}__${tool.name}`;
-        if (taken.has(exposedName)) {
-          this.log(`skipping duplicate tool ${exposedName} from ${name}`);
-          continue;
-        }
-        taken.add(exposedName);
-        out.push({
-          name: exposedName,
-          upstream: name,
-          original: tool.name,
-          tool,
-          classification: classifyTool(
-            {
-              name: exposedName,
-              description: tool.description,
-              annotations: tool.annotations,
-              inputSchema: tool.inputSchema,
-              outputSchema: tool.outputSchema
-            },
-            this.policy
-          )
-        });
-      }
-    }
-    this.exposed = out;
-  }
-  listTools(agent) {
-    if (agent?.upstreams) return this.exposed.filter((t) => agent.upstreams.includes(t.upstream));
-    return this.exposed;
-  }
-  findTool(name) {
-    return this.exposed.find((t) => t.name === name);
-  }
-  upstreamStatus() {
-    return [...this.connections.values()].map((c) => ({
-      name: c.upstream.name,
-      connected: c.connected,
-      tools: c.tools.length,
-      transport: c.upstream.url ? "http" : "stdio",
-      error: c.error
-    }));
-  }
-  attach(session) {
-    this.sessions.add(session);
-  }
-  detach(session) {
-    this.sessions.delete(session);
-  }
-  /** Run a tool call through the policy engine and, if allowed, the upstream. */
-  async callTool(name, args, ctx) {
-    const tool = this.findTool(name);
-    const agent = ctx.agent === void 0 ? this.agent : ctx.agent;
-    if (!tool) {
-      const result2 = await this.guard.run(
-        { tool: { name }, args, runId: ctx.runId, agent, sessionId: ctx.sessionId },
-        async () => {
-          throw new GuardError({
-            code: "UNKNOWN_TOOL",
-            cause: `no upstream exposes a tool named "${name}"`,
-            fix: "call tools/list and use one of the listed names",
-            retryable: false
-          });
-        }
-      );
-      return { result: result2 };
-    }
-    const conn = this.connections.get(tool.upstream);
-    const track = () => {
-      if (!ctx.session || ctx.requestId === void 0) return () => void 0;
-      const list = ctx.session.inflight.get(tool.upstream) ?? [];
-      list.push(ctx.requestId);
-      ctx.session.inflight.set(tool.upstream, list);
-      return () => {
-        const l = ctx.session.inflight.get(tool.upstream) ?? [];
-        const i = l.indexOf(ctx.requestId);
-        if (i >= 0) l.splice(i, 1);
-      };
-    };
-    const result = await this.guard.run(
-      {
-        tool: {
-          name: tool.name,
-          description: tool.tool.description,
-          annotations: tool.tool.annotations,
-          inputSchema: tool.tool.inputSchema,
-          outputSchema: tool.tool.outputSchema
-        },
-        args,
-        runId: ctx.runId,
-        agent,
-        sessionId: ctx.sessionId,
-        upstream: tool.upstream
-      },
-      async (finalArgs) => {
-        if (!conn?.connected) {
-          throw new GuardError({
-            code: "UPSTREAM_ERROR",
-            cause: `upstream "${tool.upstream}" is not connected${conn?.error ? ` (${conn.error})` : ""}`,
-            fix: "check the upstream command/url in agentguard.yaml and restart the proxy",
-            retryable: true
-          });
-        }
-        const untrack = track();
-        try {
-          return await conn.client.callTool(
-            { name: tool.original, arguments: finalArgs ?? {} },
-            void 0,
-            {
-              timeout: conn.upstream.timeout_ms,
-              resetTimeoutOnProgress: true,
-              onprogress: ctx.onprogress
-            }
-          );
-        } finally {
-          untrack();
-        }
-      }
-    );
-    return { result, tool };
-  }
-  connectedWith(capability) {
-    return [...this.connections.values()].filter(
-      (c) => c.connected && (c.capabilities?.[capability] || c.capabilities === void 0)
-    );
-  }
-  async listResources() {
-    const resources = [];
-    for (const conn of this.connectedWith("resources")) {
-      try {
-        const page = await conn.client.listResources(void 0, {
-          timeout: conn.upstream.timeout_ms
-        });
-        for (const r of page.resources) {
-          this.resourceOwner.set(r.uri, conn.upstream.name);
-          resources.push(r);
-        }
-      } catch {
-      }
-    }
-    return { resources };
-  }
-  async listResourceTemplates() {
-    const resourceTemplates = [];
-    for (const conn of this.connectedWith("resources")) {
-      try {
-        const page = await conn.client.listResourceTemplates(void 0, {
-          timeout: conn.upstream.timeout_ms
-        });
-        for (const t of page.resourceTemplates) {
-          this.templateOwner.set(t.uriTemplate, conn.upstream.name);
-          resourceTemplates.push(t);
-        }
-      } catch {
-      }
-    }
-    return { resourceTemplates };
-  }
-  ownerForUri(uri) {
-    const owner = this.resourceOwner.get(uri);
-    if (owner && this.connections.get(owner)?.connected) return [this.connections.get(owner)];
-    for (const [template, name] of this.templateOwner) {
-      if (templateMatches(template, uri) && this.connections.get(name)?.connected)
-        return [this.connections.get(name)];
-    }
-    return this.connectedWith("resources");
-  }
-  async readResource(uri) {
-    let lastError;
-    for (const conn of this.ownerForUri(uri)) {
-      try {
-        const result = await conn.client.readResource(
-          { uri },
-          { timeout: conn.upstream.timeout_ms }
-        );
-        this.resourceOwner.set(uri, conn.upstream.name);
-        return result;
-      } catch (err) {
-        lastError = err;
-      }
-    }
-    throw lastError ?? new Error(`no upstream serves resource ${uri}`);
-  }
-  async subscribe(uri, on) {
-    for (const conn of this.ownerForUri(uri)) {
-      try {
-        if (on) await conn.client.subscribeResource({ uri });
-        else await conn.client.unsubscribeResource({ uri });
-        return;
-      } catch {
-      }
-    }
-  }
-  async listPrompts() {
-    const prompts = [];
-    const taken = /* @__PURE__ */ new Set();
-    this.promptOwner.clear();
-    for (const conn of this.connectedWith("prompts")) {
-      try {
-        const page = await conn.client.listPrompts(void 0, {
-          timeout: conn.upstream.timeout_ms
-        });
-        for (const p of page.prompts) {
-          const name = taken.has(p.name) ? `${conn.upstream.name}__${p.name}` : p.name;
-          taken.add(name);
-          this.promptOwner.set(name, { upstream: conn.upstream.name, original: p.name });
-          prompts.push({ ...p, name });
-        }
-      } catch {
-      }
-    }
-    return { prompts };
-  }
-  async getPrompt(name, args) {
-    if (this.promptOwner.size === 0) await this.listPrompts();
-    const owner = this.promptOwner.get(name);
-    const conns = owner ? [this.connections.get(owner.upstream)] : this.connectedWith("prompts");
-    let lastError;
-    for (const conn of conns) {
-      try {
-        return await conn.client.getPrompt(
-          { name: owner?.original ?? name, arguments: args },
-          { timeout: conn.upstream.timeout_ms }
-        );
-      } catch (err) {
-        lastError = err;
-      }
-    }
-    throw lastError ?? new Error(`no upstream serves prompt ${name}`);
-  }
-  async complete(params) {
-    let conns;
-    if (params.ref.type === "ref/prompt") {
-      if (this.promptOwner.size === 0) await this.listPrompts();
-      const owner = this.promptOwner.get(params.ref.name);
-      conns = owner ? [this.connections.get(owner.upstream)] : this.connectedWith("completions");
-      if (owner) params = { ...params, ref: { ...params.ref, name: owner.original } };
-    } else {
-      if (this.templateOwner.size === 0) await this.listResourceTemplates();
-      conns = this.ownerForUri(params.ref.uri);
-    }
-    let lastError;
-    for (const conn of conns) {
-      try {
-        return await conn.client.complete(params, { timeout: conn.upstream.timeout_ms });
-      } catch (err) {
-        lastError = err;
-      }
-    }
-    throw lastError ?? new Error("no upstream supports completions");
-  }
-  async setLevel(level) {
-    await Promise.all(
-      this.connectedWith("logging").map(
-        (c) => c.client.setLoggingLevel(level).catch(() => void 0)
-      )
-    );
-  }
-  async close() {
-    this.closing = true;
-    for (const conn of this.connections.values()) {
-      try {
-        await conn.client.close();
-      } catch {
-      }
-    }
-    this.connections.clear();
-  }
-};
-function templateMatches(template, uri) {
-  const re = new RegExp(
-    "^" + template.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\{[^}]+\\\}/g, "[^/]+") + "$"
-  );
-  return re.test(uri);
-}
-async function withTimeout(promise, ms, what) {
-  let timer;
-  const timeout = new Promise((_, reject) => {
-    timer = setTimeout(() => reject(new Error(`${what} timed out after ${ms}ms`)), ms);
-  });
-  try {
-    return await Promise.race([promise, timeout]);
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-}
-
-// src/proxy/server.ts
-import { McpServer as McpServer3 } from "@modelcontextprotocol/sdk/server/mcp.js";
-import {
-  CallToolRequestSchema as CallToolRequestSchema2,
-  CompleteRequestSchema,
-  GetPromptRequestSchema,
-  ListPromptsRequestSchema,
-  ListResourceTemplatesRequestSchema,
-  ListResourcesRequestSchema,
-  ListToolsRequestSchema as ListToolsRequestSchema2,
-  ReadResourceRequestSchema,
-  SetLevelRequestSchema,
-  SubscribeRequestSchema as SubscribeRequestSchema2,
-  UnsubscribeRequestSchema as UnsubscribeRequestSchema2
-} from "@modelcontextprotocol/sdk/types.js";
-import {
-  keyFromHeaders,
-  resolveAgent
-} from "@agentwares/agentguard-core";
 
 // ../../packages/mcp-kit/dist/chunk-7LRFDQNC.js
 import { completable } from "@modelcontextprotocol/sdk/server/completable.js";
@@ -2052,391 +1544,951 @@ function contextFromExtra(extra) {
     }
   };
 }
-function createMcpServer(opts) {
-  const byName = /* @__PURE__ */ new Map();
-  for (const tool of opts.tools) {
-    if (byName.has(tool.name)) throw new Error(`duplicate tool name: ${tool.name}`);
-    byName.set(tool.name, tool);
-  }
-  const server = new McpServer(
-    { name: opts.name, version: opts.version, title: opts.title, websiteUrl: opts.websiteUrl },
-    { instructions: opts.instructions, capabilities: { logging: {}, ...opts.capabilities } }
-  );
-  const registered = /* @__PURE__ */ new Map();
-  for (const tool of byName.values()) {
-    const config = {
-      title: tool.title,
-      description: tool.description,
-      inputSchema: tool.input,
-      annotations: tool.annotations
-    };
-    if (isZodObject(tool.output)) config.outputSchema = tool.output;
-    registered.set(
-      tool.name,
-      server.registerTool(tool.name, config, () => {
-        throw new Error("unreachable: mcp-kit dispatches tools/call itself");
-      })
-    );
-  }
-  if (byName.size > 0) {
-    server.server.setRequestHandler(ListToolsRequestSchema, async () => {
-      const enabled = [...byName.values()].filter(
-        (tool) => registered.get(tool.name)?.enabled !== false
-      );
-      return {
-        tools: listToolManifest(enabled).map((entry) => ({
-          ...entry,
-          inputSchema: entry.inputSchema,
-          outputSchema: entry.outputSchema
-        }))
-      };
-    });
-    server.server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
-      const name = request.params.name;
-      const tool = byName.get(name);
-      const entry = registered.get(name);
-      if (!tool || !entry) throw new McpError(ErrorCode.InvalidParams, `Tool ${name} not found`);
-      if (!entry.enabled) throw new McpError(ErrorCode.InvalidParams, `Tool ${name} disabled`);
-      return tool.invoke(request.params.arguments ?? {}, contextFromExtra(extra));
+function createMcpServer(opts) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const tool of opts.tools) {
+    if (byName.has(tool.name)) throw new Error(`duplicate tool name: ${tool.name}`);
+    byName.set(tool.name, tool);
+  }
+  const server = new McpServer(
+    { name: opts.name, version: opts.version, title: opts.title, websiteUrl: opts.websiteUrl },
+    { instructions: opts.instructions, capabilities: { logging: {}, ...opts.capabilities } }
+  );
+  const registered = /* @__PURE__ */ new Map();
+  for (const tool of byName.values()) {
+    const config = {
+      title: tool.title,
+      description: tool.description,
+      inputSchema: tool.input,
+      annotations: tool.annotations
+    };
+    if (isZodObject(tool.output)) config.outputSchema = tool.output;
+    registered.set(
+      tool.name,
+      server.registerTool(tool.name, config, () => {
+        throw new Error("unreachable: mcp-kit dispatches tools/call itself");
+      })
+    );
+  }
+  if (byName.size > 0) {
+    server.server.setRequestHandler(ListToolsRequestSchema, async () => {
+      const enabled = [...byName.values()].filter(
+        (tool) => registered.get(tool.name)?.enabled !== false
+      );
+      return {
+        tools: listToolManifest(enabled).map((entry) => ({
+          ...entry,
+          inputSchema: entry.inputSchema,
+          outputSchema: entry.outputSchema
+        }))
+      };
+    });
+    server.server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+      const name = request.params.name;
+      const tool = byName.get(name);
+      const entry = registered.get(name);
+      if (!tool || !entry) throw new McpError(ErrorCode.InvalidParams, `Tool ${name} not found`);
+      if (!entry.enabled) throw new McpError(ErrorCode.InvalidParams, `Tool ${name} disabled`);
+      return tool.invoke(request.params.arguments ?? {}, contextFromExtra(extra));
+    });
+  }
+  return server;
+}
+function toJsonSchema(schema, io = "input") {
+  const json2 = z4.toJSONSchema(schema, { io, target: "draft-2020-12" });
+  if (isZodObject(schema) && schema._zod.def.catchall === void 0 && json2.additionalProperties === void 0) {
+    json2.additionalProperties = false;
+  }
+  return json2;
+}
+function listToolManifest(tools) {
+  return tools.map((tool) => {
+    const entry = {
+      name: tool.name,
+      description: tool.description,
+      inputSchema: toJsonSchema(tool.input, "input")
+    };
+    if (tool.title !== void 0) entry.title = tool.title;
+    if (isZodObject(tool.output)) entry.outputSchema = toJsonSchema(tool.output, "output");
+    if (tool.annotations !== void 0) entry.annotations = tool.annotations;
+    return entry;
+  });
+}
+var DEFAULT_CORS = {
+  origin: "*",
+  methods: "GET, POST, DELETE, OPTIONS",
+  headers: "Content-Type, Accept, Authorization, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, PAYMENT, X-PAYMENT",
+  exposeHeaders: "Mcp-Session-Id, Mcp-Protocol-Version, WWW-Authenticate, X-Payment-Requirements, PAYMENT-REQUIRED",
+  maxAge: 86400
+};
+var DEFAULT_SESSION_TTL_MS = 30 * 6e4;
+function corsHeaders(cors) {
+  if (!cors) return {};
+  const c = { ...DEFAULT_CORS, ...typeof cors === "object" ? cors : {} };
+  return {
+    "Access-Control-Allow-Origin": c.origin,
+    "Access-Control-Allow-Methods": c.methods,
+    "Access-Control-Allow-Headers": c.headers,
+    "Access-Control-Expose-Headers": c.exposeHeaders,
+    "Access-Control-Max-Age": String(c.maxAge)
+  };
+}
+function jsonResponse(body, status, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json", "Cache-Control": "no-store", ...headers }
+  });
+}
+function methodNotAllowed(method, allow, cors) {
+  return jsonResponse(
+    {
+      code: "METHOD_NOT_ALLOWED",
+      cause: `${method} is not supported here without a session`,
+      fix: "send JSON-RPC over POST with `Accept: application/json, text/event-stream` (start with `initialize`)",
+      retryable: false
+    },
+    405,
+    { Allow: allow, ...cors }
+  );
+}
+function splitOptions(opts, transport) {
+  if (typeof opts === "function") return { factory: opts, transport };
+  const {
+    cors,
+    jsonResponse: jsonResponse2,
+    sessions,
+    allowedHosts,
+    allowedOrigins,
+    enableDnsRebindingProtection,
+    ...server
+  } = opts;
+  return {
+    factory: () => createMcpServer(server),
+    transport: {
+      cors,
+      jsonResponse: jsonResponse2,
+      sessions,
+      allowedHosts,
+      allowedOrigins,
+      enableDnsRebindingProtection,
+      ...transport
+    }
+  };
+}
+function withCors(response, cors) {
+  const keys = Object.keys(cors);
+  if (keys.length === 0) return response;
+  const headers = new Headers(response.headers);
+  for (const key of keys) headers.set(key, cors[key] ?? "");
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function errorResponse(err, cors) {
+  const error = normalizeError(err);
+  return jsonResponse(error.toJSON(), error.httpStatus, cors);
+}
+function createStatelessHandler({ factory, cors, transportBase }) {
+  return async (request) => {
+    if (request.method !== "POST") return methodNotAllowed(request.method, "POST, OPTIONS", cors);
+    const server = factory();
+    const transport = new WebStandardStreamableHTTPServerTransport({
+      ...transportBase,
+      sessionIdGenerator: void 0
+    });
+    let closed = false;
+    const cleanup = async () => {
+      if (closed) return;
+      closed = true;
+      try {
+        await server.close();
+      } catch {
+      }
+    };
+    try {
+      await server.connect(transport);
+      const response = withCors(await transport.handleRequest(request), cors);
+      if (!response.body) {
+        await cleanup();
+        return response;
+      }
+      request.signal?.addEventListener("abort", () => void cleanup(), { once: true });
+      const body = response.body.pipeThrough(
+        new TransformStream({ flush: () => cleanup() })
+      );
+      return new Response(body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+    } catch (err) {
+      await cleanup();
+      return errorResponse(err, cors);
+    }
+  };
+}
+function createStatefulHandler({ factory, cors, transportBase }, options) {
+  const ttlMs = options.ttlMs ?? DEFAULT_SESSION_TTL_MS;
+  const sessions = /* @__PURE__ */ new Map();
+  const drop = (id) => {
+    const session = sessions.get(id);
+    if (!session) return;
+    sessions.delete(id);
+    session.server.close().catch(() => void 0);
+  };
+  const sweep = () => {
+    const now = Date.now();
+    for (const [id, session] of sessions) if (now - session.lastSeen > ttlMs) drop(id);
+  };
+  return async (request) => {
+    const sessionId = request.headers.get("mcp-session-id");
+    if (sessionId) {
+      const session = sessions.get(sessionId);
+      if (!session) {
+        return jsonResponse(
+          {
+            code: "NOT_FOUND",
+            cause: "unknown or expired Mcp-Session-Id",
+            fix: "send `initialize` again without an Mcp-Session-Id header and use the id from the response",
+            retryable: true
+          },
+          404,
+          cors
+        );
+      }
+      session.lastSeen = Date.now();
+      try {
+        return withCors(await session.transport.handleRequest(request), cors);
+      } catch (err) {
+        return errorResponse(err, cors);
+      }
+    }
+    if (request.method !== "POST") return methodNotAllowed(request.method, "POST, OPTIONS", cors);
+    sweep();
+    const server = factory();
+    const transport = new WebStandardStreamableHTTPServerTransport({
+      ...transportBase,
+      sessionIdGenerator: () => crypto.randomUUID(),
+      onsessioninitialized: (id) => {
+        sessions.set(id, { server, transport, lastSeen: Date.now() });
+      },
+      onsessionclosed: (id) => {
+        sessions.delete(id);
+      }
     });
-  }
-  return server;
+    try {
+      await server.connect(transport);
+      const previousOnClose = transport.onclose;
+      transport.onclose = () => {
+        previousOnClose?.();
+        if (transport.sessionId) sessions.delete(transport.sessionId);
+      };
+      const response = withCors(await transport.handleRequest(request), cors);
+      if (!transport.sessionId) server.close().catch(() => void 0);
+      return response;
+    } catch (err) {
+      server.close().catch(() => void 0);
+      return errorResponse(err, cors);
+    }
+  };
 }
-function toJsonSchema(schema, io = "input") {
-  const json2 = z4.toJSONSchema(schema, { io, target: "draft-2020-12" });
-  if (isZodObject(schema) && schema._zod.def.catchall === void 0 && json2.additionalProperties === void 0) {
-    json2.additionalProperties = false;
-  }
-  return json2;
+function createHttpHandler(opts, transportOptions = {}) {
+  const { factory, transport: t } = splitOptions(opts, transportOptions);
+  const cors = corsHeaders(t.cors);
+  const sessions = t.sessions ? typeof t.sessions === "object" ? t.sessions : {} : void 0;
+  const context = {
+    factory,
+    cors,
+    transportBase: {
+      enableJsonResponse: t.jsonResponse ?? sessions === void 0,
+      allowedHosts: t.allowedHosts,
+      allowedOrigins: t.allowedOrigins,
+      enableDnsRebindingProtection: t.enableDnsRebindingProtection
+    }
+  };
+  const handler = sessions ? createStatefulHandler(context, sessions) : createStatelessHandler(context);
+  const allow = sessions ? "GET, POST, DELETE, OPTIONS" : "POST, OPTIONS";
+  return async (request) => {
+    if (request.method === "OPTIONS") {
+      return new Response(null, { status: 204, headers: { Allow: allow, ...cors } });
+    }
+    return handler(request);
+  };
 }
-function listToolManifest(tools) {
-  return tools.map((tool) => {
-    const entry = {
-      name: tool.name,
-      description: tool.description,
-      inputSchema: toJsonSchema(tool.input, "input")
-    };
-    if (tool.title !== void 0) entry.title = tool.title;
-    if (isZodObject(tool.output)) entry.outputSchema = toJsonSchema(tool.output, "output");
-    if (tool.annotations !== void 0) entry.annotations = tool.annotations;
-    return entry;
-  });
+function localhostHosts(port) {
+  const hosts = ["localhost", "127.0.0.1", "[::1]"];
+  return [...hosts, ...hosts.map((h) => `${h}:${port}`)];
 }
-var DEFAULT_CORS = {
-  origin: "*",
-  methods: "GET, POST, DELETE, OPTIONS",
-  headers: "Content-Type, Accept, Authorization, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, PAYMENT, X-PAYMENT",
-  exposeHeaders: "Mcp-Session-Id, Mcp-Protocol-Version, WWW-Authenticate, X-Payment-Requirements, PAYMENT-REQUIRED",
-  maxAge: 86400
-};
-var DEFAULT_SESSION_TTL_MS = 30 * 6e4;
-function corsHeaders(cors) {
-  if (!cors) return {};
-  const c = { ...DEFAULT_CORS, ...typeof cors === "object" ? cors : {} };
-  return {
-    "Access-Control-Allow-Origin": c.origin,
-    "Access-Control-Allow-Methods": c.methods,
-    "Access-Control-Allow-Headers": c.headers,
-    "Access-Control-Expose-Headers": c.exposeHeaders,
-    "Access-Control-Max-Age": String(c.maxAge)
-  };
+function handleHealth(info) {
+  const tools = typeof info.tools === "number" ? info.tools : info.tools.length;
+  return jsonResponse({ ok: true, name: info.name, version: info.version, tools }, 200);
 }
-function jsonResponse(body, status, headers = {}) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json", "Cache-Control": "no-store", ...headers }
+async function serveNodeHttp(opts) {
+  const http = await import("http");
+  const host = opts.host ?? "127.0.0.1";
+  const path2 = opts.path ?? "/mcp";
+  const server = http.createServer((req, res) => {
+    void (async () => {
+      const url = new URL(req.url ?? "/", `http://${req.headers.host ?? host}`);
+      let response;
+      if (url.pathname === path2) {
+        const controller = new AbortController();
+        res.on("close", () => {
+          if (!res.writableFinished) controller.abort();
+        });
+        const headers = new Headers();
+        for (const [key, value] of Object.entries(req.headers)) {
+          if (Array.isArray(value)) for (const item of value) headers.append(key, item);
+          else if (typeof value === "string") headers.set(key, value);
+        }
+        const method = req.method ?? "GET";
+        let body;
+        if (method !== "GET" && method !== "HEAD") {
+          const chunks = [];
+          for await (const chunk of req) chunks.push(chunk);
+          body = new Uint8Array(Buffer.concat(chunks));
+        }
+        response = await opts.handler(
+          new Request(url, { method, headers, body, signal: controller.signal })
+        );
+      } else if (url.pathname === "/health" && opts.health) {
+        response = opts.health();
+      } else {
+        response = new Response(
+          JSON.stringify({
+            code: "NOT_FOUND",
+            cause: `no route for ${url.pathname}`,
+            fix: `POST JSON-RPC to ${path2}`,
+            retryable: false
+          }),
+          { status: 404, headers: { "Content-Type": "application/json" } }
+        );
+      }
+      const outHeaders = {};
+      response.headers.forEach((value, key) => {
+        outHeaders[key] = value;
+      });
+      res.writeHead(response.status, outHeaders);
+      if (!response.body) {
+        res.end();
+        return;
+      }
+      const reader = response.body.getReader();
+      try {
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          res.write(value);
+        }
+      } catch {
+      }
+      res.end();
+    })().catch((err) => {
+      if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(
+        JSON.stringify({
+          code: "INTERNAL",
+          cause: err instanceof Error ? err.message : String(err),
+          fix: "retry; if it persists, report the request id",
+          retryable: false
+        })
+      );
+    });
+  });
+  await new Promise((resolve5, reject) => {
+    server.once("error", reject);
+    server.listen(opts.port ?? 8765, host, () => resolve5());
   });
-}
-function methodNotAllowed(method, allow, cors) {
-  return jsonResponse(
-    {
-      code: "METHOD_NOT_ALLOWED",
-      cause: `${method} is not supported here without a session`,
-      fix: "send JSON-RPC over POST with `Accept: application/json, text/event-stream` (start with `initialize`)",
-      retryable: false
-    },
-    405,
-    { Allow: allow, ...cors }
-  );
-}
-function splitOptions(opts, transport) {
-  if (typeof opts === "function") return { factory: opts, transport };
-  const {
-    cors,
-    jsonResponse: jsonResponse2,
-    sessions,
-    allowedHosts,
-    allowedOrigins,
-    enableDnsRebindingProtection,
-    ...server
-  } = opts;
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : opts.port ?? 8765;
   return {
-    factory: () => createMcpServer(server),
-    transport: {
-      cors,
-      jsonResponse: jsonResponse2,
-      sessions,
-      allowedHosts,
-      allowedOrigins,
-      enableDnsRebindingProtection,
-      ...transport
-    }
+    port,
+    url: `http://${host}:${port}${path2}`,
+    close: () => new Promise((resolve5, reject) => {
+      server.closeAllConnections();
+      server.close((err) => err ? reject(err) : resolve5());
+    })
   };
 }
-function withCors(response, cors) {
-  const keys = Object.keys(cors);
-  if (keys.length === 0) return response;
-  const headers = new Headers(response.headers);
-  for (const key of keys) headers.set(key, cors[key] ?? "");
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
+
+// ../../packages/mcp-kit/dist/chunk-M567BWMA.js
+var LIST_MAX_PAGES = 20;
+var LIST_MAX_ITEMS = 2e3;
+async function readAllPages(fetchPage, opts = {}) {
+  const maxPages = opts.maxPages ?? LIST_MAX_PAGES;
+  const maxItems = opts.maxItems ?? LIST_MAX_ITEMS;
+  const method = opts.method ?? "tools/list";
+  const items = [];
+  const followed = /* @__PURE__ */ new Set();
+  let cursor;
+  for (let page = 1; ; page++) {
+    const res = await fetchPage(cursor, page);
+    if (Array.isArray(res.items)) items.push(...res.items);
+    const next = res.nextCursor;
+    const more = typeof next === "string" && next !== "";
+    if (items.length > maxItems) {
+      return {
+        items,
+        pages: page,
+        truncated: {
+          ceiling: "items",
+          reason: `${method} listed more than ${maxItems} items in ${page} page${page === 1 ? "" : "s"}${more ? " and had more" : ""}; at most ${maxItems} are read`
+        }
+      };
+    }
+    if (!more) return { items, pages: page };
+    if (followed.has(next)) return { items, pages: page, repeatedCursor: true };
+    if (page >= maxPages) {
+      return {
+        items,
+        pages: page,
+        truncated: {
+          ceiling: "pages",
+          reason: `${method} had more than ${maxPages} pages (${items.length} items read); at most ${maxPages} pages are read`
+        }
+      };
+    }
+    followed.add(next);
+    cursor = next;
+  }
 }
-function errorResponse(err, cors) {
-  const error = normalizeError(err);
-  return jsonResponse(error.toJSON(), error.httpStatus, cors);
+
+// ../../packages/mcp-kit/dist/index.js
+import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
+async function serveStdio(serverOrOpts) {
+  const server = serverOrOpts instanceof McpServer2 ? serverOrOpts : createMcpServer(serverOrOpts);
+  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  await new Promise((resolve5) => {
+    const previous = transport.onclose;
+    transport.onclose = () => {
+      previous?.();
+      resolve5();
+    };
+  });
 }
-function createStatelessHandler({ factory, cors, transportBase }) {
-  return async (request) => {
-    if (request.method !== "POST") return methodNotAllowed(request.method, "POST, OPTIONS", cors);
-    const server = factory();
-    const transport = new WebStandardStreamableHTTPServerTransport({
-      ...transportBase,
-      sessionIdGenerator: void 0
-    });
-    let closed = false;
-    const cleanup = async () => {
-      if (closed) return;
-      closed = true;
-      try {
-        await server.close();
-      } catch {
-      }
+
+// src/proxy/runtime.ts
+var ProxyRuntime = class {
+  loaded;
+  guard;
+  agent;
+  defaultRunId;
+  configured;
+  sessions = /* @__PURE__ */ new Set();
+  connections = /* @__PURE__ */ new Map();
+  exposed = [];
+  resourceOwner = /* @__PURE__ */ new Map();
+  templateOwner = /* @__PURE__ */ new Map();
+  promptOwner = /* @__PURE__ */ new Map();
+  log;
+  connectTimeoutMs;
+  testClients;
+  /** stop relaying upstream stderr once we are tearing down — shutdown noise is not the user's problem */
+  closing = false;
+  constructor(opts) {
+    this.loaded = opts.loaded;
+    this.guard = opts.guard;
+    this.agent = opts.agent;
+    this.defaultRunId = opts.defaultRunId;
+    this.configured = opts.configured ?? true;
+    this.log = opts.log ?? ((line) => process.stderr.write(`[agentguard] ${line}
+`));
+    this.connectTimeoutMs = opts.connectTimeoutMs ?? 15e3;
+    this.testClients = opts.clients ?? {};
+  }
+  get policy() {
+    return this.loaded.policy;
+  }
+  async start() {
+    await Promise.all(this.policy.upstreams.map((u) => this.connect(u)));
+    for (const [name, client] of Object.entries(this.testClients)) {
+      if (this.connections.has(name)) continue;
+      const upstream = {
+        name,
+        command: "in-memory",
+        args: [],
+        env: {},
+        headers: {},
+        prefix: false,
+        timeout_ms: 6e4
+      };
+      const conn = {
+        upstream,
+        client,
+        tools: [],
+        capabilities: client.getServerCapabilities(),
+        connected: true
+      };
+      this.connections.set(name, conn);
+      this.wire(conn);
+      await this.refreshTools(name);
+    }
+    this.rebuildExposed();
+    const status = this.upstreamStatus();
+    this.log(
+      `connected ${status.filter((s) => s.connected).length}/${status.length} upstreams, ${this.exposed.length} tools, mode ${this.policy.mode}`
+    );
+  }
+  async connect(upstream) {
+    const client = new Client(
+      { name: "agentguard", version: version() },
+      { capabilities: { sampling: {}, elicitation: {} } }
+    );
+    const conn = {
+      upstream,
+      client,
+      tools: [],
+      capabilities: void 0,
+      connected: false
     };
+    this.connections.set(upstream.name, conn);
     try {
-      await server.connect(transport);
-      const response = withCors(await transport.handleRequest(request), cors);
-      if (!response.body) {
-        await cleanup();
-        return response;
+      const transport = upstream.url ? new StreamableHTTPClientTransport(new URL(upstream.url), {
+        requestInit: { headers: upstreamHeaders(upstream) }
+      }) : new StdioClientTransport({
+        command: upstream.command,
+        args: upstream.args,
+        env: { ...getDefaultEnvironment(), ...upstream.env },
+        cwd: upstream.cwd,
+        stderr: "pipe"
+      });
+      if (transport instanceof StdioClientTransport) {
+        transport.stderr?.on("data", (chunk) => {
+          if (this.closing) return;
+          for (const line of chunk.toString("utf8").split("\n"))
+            if (line.trim()) this.log(`${upstream.name}: ${line}`);
+        });
       }
-      request.signal?.addEventListener("abort", () => void cleanup(), { once: true });
-      const body = response.body.pipeThrough(
-        new TransformStream({ flush: () => cleanup() })
+      await withTimeout(
+        client.connect(transport),
+        this.connectTimeoutMs,
+        `connect to upstream "${upstream.name}"`
       );
-      return new Response(body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: response.headers
-      });
+      conn.capabilities = client.getServerCapabilities();
+      conn.connected = true;
+      this.wire(conn);
+      await this.refreshTools(upstream.name);
     } catch (err) {
-      await cleanup();
-      return errorResponse(err, cors);
+      conn.connected = false;
+      conn.error = err instanceof Error ? err.message : String(err);
+      this.log(`upstream "${upstream.name}" unavailable: ${conn.error}`);
+    }
+  }
+  wire(conn) {
+    const { client, upstream } = conn;
+    client.onclose = () => {
+      conn.connected = false;
+      conn.error = "connection closed";
+      if (!this.closing) this.log(`upstream "${upstream.name}" closed`);
+    };
+    client.setNotificationHandler(LoggingMessageNotificationSchema, async (n) => {
+      await this.broadcast(upstream.name, n.method, n.params);
+    });
+    client.setNotificationHandler(ResourceUpdatedNotificationSchema, async (n) => {
+      await this.broadcast(upstream.name, n.method, n.params);
+    });
+    client.setNotificationHandler(ResourceListChangedNotificationSchema, async () => {
+      this.resourceOwner.clear();
+      await this.broadcast(upstream.name, "notifications/resources/list_changed", void 0);
+    });
+    client.setNotificationHandler(PromptListChangedNotificationSchema, async () => {
+      this.promptOwner.clear();
+      await this.broadcast(upstream.name, "notifications/prompts/list_changed", void 0);
+    });
+    client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {
+      await this.refreshTools(upstream.name);
+      this.rebuildExposed();
+      for (const s of this.sessions) s.server.server.sendToolListChanged().catch(() => void 0);
+    });
+    try {
+      client.setRequestHandler(CreateMessageRequestSchema, async (req) => {
+        const session = this.pickSession(upstream.name);
+        if (!session) throw new Error("no downstream client is connected to relay sampling to");
+        const related = session.inflight.get(upstream.name)?.at(-1);
+        return session.server.server.createMessage(req.params, { relatedRequestId: related });
+      });
+      client.setRequestHandler(ElicitRequestSchema, async (req) => {
+        const session = this.pickSession(upstream.name);
+        if (!session) throw new Error("no downstream client is connected to relay elicitation to");
+        const related = session.inflight.get(upstream.name)?.at(-1);
+        return session.server.server.elicitInput(req.params, { relatedRequestId: related });
+      });
+    } catch {
     }
-  };
-}
-function createStatefulHandler({ factory, cors, transportBase }, options) {
-  const ttlMs = options.ttlMs ?? DEFAULT_SESSION_TTL_MS;
-  const sessions = /* @__PURE__ */ new Map();
-  const drop = (id) => {
-    const session = sessions.get(id);
-    if (!session) return;
-    sessions.delete(id);
-    session.server.close().catch(() => void 0);
-  };
-  const sweep = () => {
-    const now = Date.now();
-    for (const [id, session] of sessions) if (now - session.lastSeen > ttlMs) drop(id);
-  };
-  return async (request) => {
-    const sessionId = request.headers.get("mcp-session-id");
-    if (sessionId) {
-      const session = sessions.get(sessionId);
-      if (!session) {
-        return jsonResponse(
-          {
-            code: "NOT_FOUND",
-            cause: "unknown or expired Mcp-Session-Id",
-            fix: "send `initialize` again without an Mcp-Session-Id header and use the id from the response",
-            retryable: true
-          },
-          404,
-          cors
-        );
-      }
-      session.lastSeen = Date.now();
+  }
+  pickSession(upstream) {
+    let best;
+    for (const s of this.sessions) {
+      if ((s.inflight.get(upstream)?.length ?? 0) > 0) return s;
+      if (!best || s.lastActive > best.lastActive) best = s;
+    }
+    return best;
+  }
+  async broadcast(upstream, method, params) {
+    for (const s of this.sessions) {
+      const related = s.inflight.get(upstream)?.at(-1);
       try {
-        return withCors(await session.transport.handleRequest(request), cors);
-      } catch (err) {
-        return errorResponse(err, cors);
+        await s.server.server.notification(
+          { method, params },
+          related !== void 0 ? { relatedRequestId: related } : void 0
+        );
+      } catch {
       }
     }
-    if (request.method !== "POST") return methodNotAllowed(request.method, "POST, OPTIONS", cors);
-    sweep();
-    const server = factory();
-    const transport = new WebStandardStreamableHTTPServerTransport({
-      ...transportBase,
-      sessionIdGenerator: () => crypto.randomUUID(),
-      onsessioninitialized: (id) => {
-        sessions.set(id, { server, transport, lastSeen: Date.now() });
-      },
-      onsessionclosed: (id) => {
-        sessions.delete(id);
-      }
-    });
+  }
+  /**
+   * Re-read an upstream's tools, every page (mcp-kit's `readAllPages`): at most 20 requests, each
+   * under the upstream's `timeout_ms`, ending at a cursor already followed. It used to follow
+   * `nextCursor` with no bound, so an upstream that echoed its cursor kept the proxy asking for
+   * the same page forever. A refresh that fails, or stops at the 20-page / 2,000-tool ceiling,
+   * changes nothing: the agent keeps the last good list, and the log says why.
+   */
+  async refreshTools(name) {
+    const conn = this.connections.get(name);
+    if (!conn?.connected) return;
+    if (conn.capabilities && !conn.capabilities.tools) {
+      conn.tools = [];
+      return;
+    }
+    const kept = () => `keeping the last good list (${conn.tools.length} tool${conn.tools.length === 1 ? "" : "s"})`;
     try {
-      await server.connect(transport);
-      const previousOnClose = transport.onclose;
-      transport.onclose = () => {
-        previousOnClose?.();
-        if (transport.sessionId) sessions.delete(transport.sessionId);
-      };
-      const response = withCors(await transport.handleRequest(request), cors);
-      if (!transport.sessionId) server.close().catch(() => void 0);
-      return response;
+      const read = await readAllPages(async (cursor) => {
+        const page = await conn.client.listTools(cursor ? { cursor } : void 0, {
+          timeout: conn.upstream.timeout_ms
+        });
+        return { items: page.tools, nextCursor: page.nextCursor };
+      });
+      if (read.truncated) {
+        this.log(`tools/list for "${name}" not applied: ${read.truncated.reason}; ${kept()}`);
+        return;
+      }
+      conn.tools = read.items;
     } catch (err) {
-      server.close().catch(() => void 0);
-      return errorResponse(err, cors);
+      this.log(
+        `tools/list failed for "${name}": ${err instanceof Error ? err.message : String(err)}; ${kept()}`
+      );
     }
-  };
-}
-function createHttpHandler(opts, transportOptions = {}) {
-  const { factory, transport: t } = splitOptions(opts, transportOptions);
-  const cors = corsHeaders(t.cors);
-  const sessions = t.sessions ? typeof t.sessions === "object" ? t.sessions : {} : void 0;
-  const context = {
-    factory,
-    cors,
-    transportBase: {
-      enableJsonResponse: t.jsonResponse ?? sessions === void 0,
-      allowedHosts: t.allowedHosts,
-      allowedOrigins: t.allowedOrigins,
-      enableDnsRebindingProtection: t.enableDnsRebindingProtection
+  }
+  rebuildExposed() {
+    const taken = /* @__PURE__ */ new Set();
+    const out = [];
+    const order = [...this.policy.upstreams.map((u) => u.name), ...Object.keys(this.testClients)];
+    for (const name of order) {
+      const conn = this.connections.get(name);
+      if (!conn) continue;
+      const prefix = conn.upstream.prefix === true ? name : typeof conn.upstream.prefix === "string" ? conn.upstream.prefix : void 0;
+      for (const tool of conn.tools) {
+        let exposedName = prefix ? `${prefix}__${tool.name}` : tool.name;
+        if (taken.has(exposedName)) exposedName = `${name}__${tool.name}`;
+        if (taken.has(exposedName)) {
+          this.log(`skipping duplicate tool ${exposedName} from ${name}`);
+          continue;
+        }
+        taken.add(exposedName);
+        out.push({
+          name: exposedName,
+          upstream: name,
+          original: tool.name,
+          tool,
+          classification: classifyTool(
+            {
+              name: exposedName,
+              description: tool.description,
+              annotations: tool.annotations,
+              inputSchema: tool.inputSchema,
+              outputSchema: tool.outputSchema
+            },
+            this.policy
+          )
+        });
+      }
     }
-  };
-  const handler = sessions ? createStatefulHandler(context, sessions) : createStatelessHandler(context);
-  const allow = sessions ? "GET, POST, DELETE, OPTIONS" : "POST, OPTIONS";
-  return async (request) => {
-    if (request.method === "OPTIONS") {
-      return new Response(null, { status: 204, headers: { Allow: allow, ...cors } });
+    this.exposed = out;
+  }
+  listTools(agent) {
+    if (agent?.upstreams) return this.exposed.filter((t) => agent.upstreams.includes(t.upstream));
+    return this.exposed;
+  }
+  findTool(name) {
+    return this.exposed.find((t) => t.name === name);
+  }
+  upstreamStatus() {
+    return [...this.connections.values()].map((c) => ({
+      name: c.upstream.name,
+      connected: c.connected,
+      tools: c.tools.length,
+      transport: c.upstream.url ? "http" : "stdio",
+      error: c.error
+    }));
+  }
+  attach(session) {
+    this.sessions.add(session);
+  }
+  detach(session) {
+    this.sessions.delete(session);
+  }
+  /** Run a tool call through the policy engine and, if allowed, the upstream. */
+  async callTool(name, args, ctx) {
+    const tool = this.findTool(name);
+    const agent = ctx.agent === void 0 ? this.agent : ctx.agent;
+    if (!tool) {
+      const result2 = await this.guard.run(
+        { tool: { name }, args, runId: ctx.runId, agent, sessionId: ctx.sessionId },
+        async () => {
+          throw new GuardError({
+            code: "UNKNOWN_TOOL",
+            cause: `no upstream exposes a tool named "${name}"`,
+            fix: "call tools/list and use one of the listed names",
+            retryable: false
+          });
+        }
+      );
+      return { result: result2 };
     }
-    return handler(request);
-  };
-}
-function localhostHosts(port) {
-  const hosts = ["localhost", "127.0.0.1", "[::1]"];
-  return [...hosts, ...hosts.map((h) => `${h}:${port}`)];
-}
-function handleHealth(info) {
-  const tools = typeof info.tools === "number" ? info.tools : info.tools.length;
-  return jsonResponse({ ok: true, name: info.name, version: info.version, tools }, 200);
-}
-async function serveNodeHttp(opts) {
-  const http = await import("http");
-  const host = opts.host ?? "127.0.0.1";
-  const path2 = opts.path ?? "/mcp";
-  const server = http.createServer((req, res) => {
-    void (async () => {
-      const url = new URL(req.url ?? "/", `http://${req.headers.host ?? host}`);
-      let response;
-      if (url.pathname === path2) {
-        const controller = new AbortController();
-        res.on("close", () => {
-          if (!res.writableFinished) controller.abort();
+    const conn = this.connections.get(tool.upstream);
+    const track = () => {
+      if (!ctx.session || ctx.requestId === void 0) return () => void 0;
+      const list = ctx.session.inflight.get(tool.upstream) ?? [];
+      list.push(ctx.requestId);
+      ctx.session.inflight.set(tool.upstream, list);
+      return () => {
+        const l = ctx.session.inflight.get(tool.upstream) ?? [];
+        const i = l.indexOf(ctx.requestId);
+        if (i >= 0) l.splice(i, 1);
+      };
+    };
+    const result = await this.guard.run(
+      {
+        tool: {
+          name: tool.name,
+          description: tool.tool.description,
+          annotations: tool.tool.annotations,
+          inputSchema: tool.tool.inputSchema,
+          outputSchema: tool.tool.outputSchema
+        },
+        args,
+        runId: ctx.runId,
+        agent,
+        sessionId: ctx.sessionId,
+        upstream: tool.upstream
+      },
+      async (finalArgs) => {
+        if (!conn?.connected) {
+          throw new GuardError({
+            code: "UPSTREAM_ERROR",
+            cause: `upstream "${tool.upstream}" is not connected${conn?.error ? ` (${conn.error})` : ""}`,
+            fix: "check the upstream command/url in agentguard.yaml and restart the proxy",
+            retryable: true
+          });
+        }
+        const untrack = track();
+        try {
+          return await conn.client.callTool(
+            { name: tool.original, arguments: finalArgs ?? {} },
+            void 0,
+            {
+              timeout: conn.upstream.timeout_ms,
+              resetTimeoutOnProgress: true,
+              onprogress: ctx.onprogress
+            }
+          );
+        } finally {
+          untrack();
+        }
+      }
+    );
+    return { result, tool };
+  }
+  connectedWith(capability) {
+    return [...this.connections.values()].filter(
+      (c) => c.connected && (c.capabilities?.[capability] || c.capabilities === void 0)
+    );
+  }
+  async listResources() {
+    const resources = [];
+    for (const conn of this.connectedWith("resources")) {
+      try {
+        const page = await conn.client.listResources(void 0, {
+          timeout: conn.upstream.timeout_ms
         });
-        const headers = new Headers();
-        for (const [key, value] of Object.entries(req.headers)) {
-          if (Array.isArray(value)) for (const item of value) headers.append(key, item);
-          else if (typeof value === "string") headers.set(key, value);
+        for (const r of page.resources) {
+          this.resourceOwner.set(r.uri, conn.upstream.name);
+          resources.push(r);
         }
-        const method = req.method ?? "GET";
-        let body;
-        if (method !== "GET" && method !== "HEAD") {
-          const chunks = [];
-          for await (const chunk of req) chunks.push(chunk);
-          body = new Uint8Array(Buffer.concat(chunks));
+      } catch {
+      }
+    }
+    return { resources };
+  }
+  async listResourceTemplates() {
+    const resourceTemplates = [];
+    for (const conn of this.connectedWith("resources")) {
+      try {
+        const page = await conn.client.listResourceTemplates(void 0, {
+          timeout: conn.upstream.timeout_ms
+        });
+        for (const t of page.resourceTemplates) {
+          this.templateOwner.set(t.uriTemplate, conn.upstream.name);
+          resourceTemplates.push(t);
         }
-        response = await opts.handler(
-          new Request(url, { method, headers, body, signal: controller.signal })
-        );
-      } else if (url.pathname === "/health" && opts.health) {
-        response = opts.health();
-      } else {
-        response = new Response(
-          JSON.stringify({
-            code: "NOT_FOUND",
-            cause: `no route for ${url.pathname}`,
-            fix: `POST JSON-RPC to ${path2}`,
-            retryable: false
-          }),
-          { status: 404, headers: { "Content-Type": "application/json" } }
+      } catch {
+      }
+    }
+    return { resourceTemplates };
+  }
+  ownerForUri(uri) {
+    const owner = this.resourceOwner.get(uri);
+    if (owner && this.connections.get(owner)?.connected) return [this.connections.get(owner)];
+    for (const [template, name] of this.templateOwner) {
+      if (templateMatches(template, uri) && this.connections.get(name)?.connected)
+        return [this.connections.get(name)];
+    }
+    return this.connectedWith("resources");
+  }
+  async readResource(uri) {
+    let lastError;
+    for (const conn of this.ownerForUri(uri)) {
+      try {
+        const result = await conn.client.readResource(
+          { uri },
+          { timeout: conn.upstream.timeout_ms }
         );
+        this.resourceOwner.set(uri, conn.upstream.name);
+        return result;
+      } catch (err) {
+        lastError = err;
       }
-      const outHeaders = {};
-      response.headers.forEach((value, key) => {
-        outHeaders[key] = value;
-      });
-      res.writeHead(response.status, outHeaders);
-      if (!response.body) {
-        res.end();
+    }
+    throw lastError ?? new Error(`no upstream serves resource ${uri}`);
+  }
+  async subscribe(uri, on) {
+    for (const conn of this.ownerForUri(uri)) {
+      try {
+        if (on) await conn.client.subscribeResource({ uri });
+        else await conn.client.unsubscribeResource({ uri });
         return;
+      } catch {
       }
-      const reader = response.body.getReader();
+    }
+  }
+  async listPrompts() {
+    const prompts = [];
+    const taken = /* @__PURE__ */ new Set();
+    this.promptOwner.clear();
+    for (const conn of this.connectedWith("prompts")) {
       try {
-        for (; ; ) {
-          const { done, value } = await reader.read();
-          if (done) break;
-          res.write(value);
+        const page = await conn.client.listPrompts(void 0, {
+          timeout: conn.upstream.timeout_ms
+        });
+        for (const p of page.prompts) {
+          const name = taken.has(p.name) ? `${conn.upstream.name}__${p.name}` : p.name;
+          taken.add(name);
+          this.promptOwner.set(name, { upstream: conn.upstream.name, original: p.name });
+          prompts.push({ ...p, name });
         }
       } catch {
       }
-      res.end();
-    })().catch((err) => {
-      if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
-      res.end(
-        JSON.stringify({
-          code: "INTERNAL",
-          cause: err instanceof Error ? err.message : String(err),
-          fix: "retry; if it persists, report the request id",
-          retryable: false
-        })
-      );
-    });
-  });
-  await new Promise((resolve5, reject) => {
-    server.once("error", reject);
-    server.listen(opts.port ?? 8765, host, () => resolve5());
-  });
-  const address = server.address();
-  const port = typeof address === "object" && address ? address.port : opts.port ?? 8765;
-  return {
-    port,
-    url: `http://${host}:${port}${path2}`,
-    close: () => new Promise((resolve5, reject) => {
-      server.closeAllConnections();
-      server.close((err) => err ? reject(err) : resolve5());
-    })
-  };
+    }
+    return { prompts };
+  }
+  async getPrompt(name, args) {
+    if (this.promptOwner.size === 0) await this.listPrompts();
+    const owner = this.promptOwner.get(name);
+    const conns = owner ? [this.connections.get(owner.upstream)] : this.connectedWith("prompts");
+    let lastError;
+    for (const conn of conns) {
+      try {
+        return await conn.client.getPrompt(
+          { name: owner?.original ?? name, arguments: args },
+          { timeout: conn.upstream.timeout_ms }
+        );
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    throw lastError ?? new Error(`no upstream serves prompt ${name}`);
+  }
+  async complete(params) {
+    let conns;
+    if (params.ref.type === "ref/prompt") {
+      if (this.promptOwner.size === 0) await this.listPrompts();
+      const owner = this.promptOwner.get(params.ref.name);
+      conns = owner ? [this.connections.get(owner.upstream)] : this.connectedWith("completions");
+      if (owner) params = { ...params, ref: { ...params.ref, name: owner.original } };
+    } else {
+      if (this.templateOwner.size === 0) await this.listResourceTemplates();
+      conns = this.ownerForUri(params.ref.uri);
+    }
+    let lastError;
+    for (const conn of conns) {
+      try {
+        return await conn.client.complete(params, { timeout: conn.upstream.timeout_ms });
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    throw lastError ?? new Error("no upstream supports completions");
+  }
+  async setLevel(level) {
+    await Promise.all(
+      this.connectedWith("logging").map(
+        (c) => c.client.setLoggingLevel(level).catch(() => void 0)
+      )
+    );
+  }
+  async close() {
+    this.closing = true;
+    for (const conn of this.connections.values()) {
+      try {
+        await conn.client.close();
+      } catch {
+      }
+    }
+    this.connections.clear();
+  }
+};
+function templateMatches(template, uri) {
+  const re = new RegExp(
+    "^" + template.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\{[^}]+\\\}/g, "[^/]+") + "$"
+  );
+  return re.test(uri);
 }
-
-// ../../packages/mcp-kit/dist/index.js
-import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
-async function serveStdio(serverOrOpts) {
-  const server = serverOrOpts instanceof McpServer2 ? serverOrOpts : createMcpServer(serverOrOpts);
-  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-  await new Promise((resolve5) => {
-    const previous = transport.onclose;
-    transport.onclose = () => {
-      previous?.();
-      resolve5();
-    };
+async function withTimeout(promise, ms, what) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`${what} timed out after ${ms}ms`)), ms);
   });
+  try {
+    return await Promise.race([promise, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
 }
 
+// src/proxy/server.ts
+import { McpServer as McpServer3 } from "@modelcontextprotocol/sdk/server/mcp.js";
+import {
+  CallToolRequestSchema as CallToolRequestSchema2,
+  CompleteRequestSchema,
+  GetPromptRequestSchema,
+  ListPromptsRequestSchema,
+  ListResourceTemplatesRequestSchema,
+  ListResourcesRequestSchema,
+  ListToolsRequestSchema as ListToolsRequestSchema2,
+  ReadResourceRequestSchema,
+  SetLevelRequestSchema,
+  SubscribeRequestSchema as SubscribeRequestSchema2,
+  UnsubscribeRequestSchema as UnsubscribeRequestSchema2
+} from "@modelcontextprotocol/sdk/types.js";
+import {
+  keyFromHeaders,
+  resolveAgent
+} from "@agentwares/agentguard-core";
+
 // src/proxy/own-tools.ts
 import {
   buildReport,