@agimon-ai/po-core 0.0.0-alpha.0

package/dist/src/server/sessionMcpHandler.cjs

@@ -0,0 +1,585 @@
+const require_headless = require("../schemas/headless.cjs");
+const require_index = require("../services/sessionMcpConversations/index.cjs");
+let node_crypto = require("node:crypto");
+let node_util = require("node:util");
+let _modelcontextprotocol_server = require("@modelcontextprotocol/server");
+//#region src/server/sessionMcpHandler.ts
+/** Stable transport tools stay available when a conversation changes its MCP composition. */
+const SESSION_MCP_EXTRA_TOOLS = [
+	{
+		name: "load_extra_tools",
+		title: "Load extra tools",
+		description: "List Po tools and skills added or changed in this conversation after your tool list loaded, for example after a mode change. Takes {}. Empty means nothing was added or changed. Run a returned tool with use_extra_tools.",
+		inputSchema: {
+			type: "object",
+			properties: {},
+			additionalProperties: false
+		},
+		annotations: { readOnlyHint: true },
+		_meta: { ui: { visibility: ["model"] } }
+	},
+	{
+		name: "use_extra_tools",
+		title: "Use extra tools",
+		description: "Run a Po tool returned by load_extra_tools, in the session's host repository. Pass { name, arguments }. Check isError in the result.",
+		inputSchema: {
+			type: "object",
+			properties: {
+				name: {
+					type: "string",
+					description: "Exact name returned by load_extra_tools, including any prefix."
+				},
+				arguments: {
+					type: "object",
+					description: "Arguments object matching that tool's input schema. Defaults to {}."
+				}
+			},
+			required: ["name"],
+			additionalProperties: false
+		},
+		_meta: { ui: { visibility: ["model"] } }
+	},
+	{
+		name: "session_capabilities",
+		title: "Session capabilities",
+		description: "List every Po tool and skill this connection is granted now, with input schemas. Takes {}. This is an inventory and does not add tools to your tool list. Call it once when a tool seems missing or the session mode changed.",
+		inputSchema: {
+			type: "object",
+			properties: {},
+			additionalProperties: false
+		},
+		annotations: { readOnlyHint: true },
+		_meta: { ui: { visibility: ["model"] } }
+	}
+];
+function presentationMeta(meta, presentation) {
+	if (presentation === "app" || meta === void 0) return meta;
+	return Object.fromEntries(Object.entries(meta).filter(([key]) => key !== "ui" && !key.startsWith("openai/") || key === "openai/fileParams").filter(([key]) => key !== "po/widget" && key !== "po/toolName"));
+}
+function publicTool(tool) {
+	return {
+		name: tool.name,
+		title: tool.label,
+		description: tool.description,
+		inputSchema: tool.parameters,
+		...tool.annotations === void 0 ? {} : { annotations: tool.annotations },
+		...tool.outputSchema === void 0 ? {} : { outputSchema: tool.outputSchema },
+		_meta: {
+			...tool._meta,
+			ui: {
+				...tool._meta?.ui,
+				visibility: tool._meta?.ui?.visibility ?? ["model"]
+			}
+		}
+	};
+}
+function grantedExtraTools(grant) {
+	return grant.scope === "session" ? SESSION_MCP_EXTRA_TOOLS : SESSION_MCP_EXTRA_TOOLS.filter((tool) => grant.tools.includes(tool.name));
+}
+function extraTools(baseline, tools, presentTool) {
+	return tools.map(publicTool).map(presentTool).filter((tool) => !SESSION_MCP_EXTRA_TOOLS.some((wrapper) => wrapper.name === tool.name) && !(0, node_util.isDeepStrictEqual)(baseline.tools.find((original) => original.name === tool.name), tool));
+}
+/** Remote agents see `${prefix}_${name}`; grants, baselines, and history keep internal names. */
+function sessionMcpWireName(prefix, name) {
+	return prefix === void 0 ? name : `${prefix}_${name}`;
+}
+/** Strips the prefix exactly once. A bare name on a prefixed connection maps to nothing. */
+function sessionMcpInternalName(prefix, wire) {
+	if (prefix === void 0) return wire;
+	const head = `${prefix}_`;
+	return wire.startsWith(head) && wire.length > head.length ? wire.slice(head.length) : void 0;
+}
+function wireTool(prefix, tool) {
+	return prefix === void 0 ? tool : {
+		...tool,
+		name: sessionMcpWireName(prefix, tool.name)
+	};
+}
+/** Kept at or under 512 characters with a 24-character prefix. */
+function sessionMcpInstructions(prefix) {
+	return (prefix === void 0 ? "" : `Tool names here start with '${prefix}_'. `) + "Use only this Po session; tools run in its host repository, not locally. Call load_context first and after selection changes. session_capabilities lists granted tools; load_extra_tools lists additions or changes, run with use_extra_tools; load_skill loads guidance. Inspect before editing; follow repository checks. Assume no UI, downloads, or notifications. Read saved logs, do not relaunch work. Saving a plan does not authorize implementation.";
+}
+function toolArguments(name, value, wire) {
+	const invalid = (problem) => new require_index.SessionMcpConversationError("TOOL_ARGUMENTS_INVALID", `Invalid arguments for '${wire(name)}': ${problem}`);
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw invalid("pass a JSON object.");
+	const args = value;
+	const keys = Object.keys(args);
+	if (name !== "use_extra_tools") {
+		if (keys.length !== 0) throw invalid(`it takes no arguments. Remove: ${keys.join(", ")}. Call it with {}.`);
+		return args;
+	}
+	const unexpected = keys.filter((key) => key !== "name" && key !== "arguments");
+	if (unexpected.length !== 0) throw invalid(`unexpected keys: ${unexpected.join(", ")}. Pass { "name": string, "arguments"?: object }.`);
+	if (typeof args.name !== "string" || args.name.trim() === "") throw invalid(`"name" must be a tool name returned by ${wire("load_extra_tools")}.`);
+	if (args.arguments !== void 0 && (typeof args.arguments !== "object" || args.arguments === null || Array.isArray(args.arguments))) throw invalid("\"arguments\" must be an object.");
+	return args;
+}
+const LOCAL_AGENT_UNLOCKED_NOTICE = "The Po user unlocked the local agent in this session, so it may also act here. Check state before you edit.";
+function jsonError(status, message, authenticate = false, resourceMetadataUrl) {
+	return Response.json({
+		jsonrpc: "2.0",
+		error: {
+			code: -32e3,
+			message
+		},
+		id: null
+	}, {
+		status,
+		headers: {
+			"cache-control": "no-store",
+			...authenticate ? { "www-authenticate": resourceMetadataUrl === void 0 ? "Bearer" : `Bearer resource_metadata="${resourceMetadataUrl}"` } : {}
+		}
+	});
+}
+function bearerToken(request) {
+	const authorization = request.headers.get("authorization");
+	return (authorization === null ? void 0 : /^Bearer ([A-Za-z0-9_-]+)$/iu.exec(authorization))?.[1];
+}
+function currentUrl(request) {
+	try {
+		const url = new URL(request.url);
+		return url.search === "" && url.hash === "" ? url.href : void 0;
+	} catch {
+		return;
+	}
+}
+function grantedSurface(grant, surface) {
+	const snapshot = surface.readSurface();
+	if (snapshot.tools.some((tool) => SESSION_MCP_EXTRA_TOOLS.some((wrapper) => wrapper.name === tool.name))) throw new _modelcontextprotocol_server.ProtocolError(_modelcontextprotocol_server.ProtocolErrorCode.InvalidRequest, "A session tool conflicts with a reserved remote tool name.");
+	const toolNames = new Set(grant.tools);
+	const skillNames = new Set(grant.skills);
+	const tools = grant.scope === "session" ? snapshot.tools : snapshot.tools.filter((tool) => toolNames.has(tool.name));
+	const resourceUris = new Set(tools.map((tool) => tool._meta?.ui?.resourceUri));
+	return {
+		snapshot,
+		tools,
+		skills: grant.scope === "session" ? snapshot.skills : snapshot.skills.filter((skill) => skillNames.has(skill.name)),
+		uiResources: (snapshot.uiResources ?? []).filter((resource) => resourceUris.has(resource.uri))
+	};
+}
+/** Identity is supplied by the approved tool descriptor, never by upstream result metadata. */
+function widgetResult(tool, result, prefix) {
+	const widget = tool?._meta?.["po/widget"];
+	return typeof widget !== "string" ? result : {
+		...result,
+		_meta: {
+			...result._meta,
+			"po/widget": widget,
+			"po/toolName": sessionMcpWireName(prefix, tool.name)
+		}
+	};
+}
+/** Creates a stateless Streamable HTTP MCP request handler for session capabilities. */
+function createSessionMcpHttpHandler(options) {
+	const audience = new URL(options.audience);
+	if (audience.protocol !== "https:" || audience.username !== "" || audience.password !== "" || audience.search !== "" || audience.hash !== "") throw new Error("Session MCP audience must be an absolute HTTPS URL without credentials, a query, or a fragment.");
+	const exactAudience = audience.href;
+	if (options.pathToken !== void 0 && !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(options.pathToken)) throw new Error("Session MCP path token must be a compact JWT.");
+	const presentation = options.presentation ?? "pure";
+	const resourceAudience = presentation === "app" ? exactAudience.replace(/\/mcp$/u, "/mcp-app") : exactAudience;
+	const presentTool = (tool) => ({
+		...tool,
+		_meta: presentationMeta(tool._meta, presentation)
+	});
+	const baselineKey = (clientId) => JSON.stringify([presentation, clientId]);
+	const exactResource = options.pathToken === void 0 ? resourceAudience : `${resourceAudience}/${options.pathToken}`;
+	const authenticate = options.pathToken === void 0 ? options.authorization.authenticateAccessToken : options.authorization.authenticateUrlToken;
+	const operations = options.operations ?? /* @__PURE__ */ new Map();
+	const baselines = options.baselines ?? /* @__PURE__ */ new Map();
+	const operationOwner = (grant, requestId) => JSON.stringify([
+		grant.clientId,
+		grant.sessionId,
+		grant.sessionGeneration,
+		grant.id,
+		requestId
+	]);
+	return async (request) => {
+		if (currentUrl(request) !== exactResource) return jsonError(404, "MCP resource not found.");
+		const token = options.pathToken ?? bearerToken(request);
+		if (token === void 0) return jsonError(401, "A Bearer access token is required.", true, options.resourceMetadataUrl);
+		const grant = authenticate(token, exactAudience);
+		if (grant === void 0) return options.pathToken === void 0 ? jsonError(401, "The Bearer access token is invalid or expired.", true, options.resourceMetadataUrl) : jsonError(401, "The signed MCP URL is invalid or revoked.");
+		const prefix = grant.toolPrefix;
+		const wire = (name) => sessionMcpWireName(prefix, name);
+		/** Names a wrapper as the next call only when this grant can use it. */
+		const nextCall = (tool, text) => grantedExtraTools(grant).some((wrapper) => wrapper.name === tool) ? ` Call ${wire(tool)}${text}` : "";
+		const surfaceChanged = () => new require_index.SessionMcpConversationError("SESSION_TOOL_SURFACE_CHANGED", `The session tools changed before this call ran.${nextCall("session_capabilities", ", then retry.")}`);
+		const authorizeOperation = async () => {
+			const activeGrant = authenticate(token, exactAudience);
+			if (activeGrant === void 0 || activeGrant.id !== grant.id) throw new _modelcontextprotocol_server.ProtocolError(_modelcontextprotocol_server.ProtocolErrorCode.InvalidRequest, "The session grant is no longer active.");
+			const target = await options.resolveSession(activeGrant.sessionId);
+			const recheckedGrant = authenticate(token, exactAudience);
+			if (recheckedGrant === void 0 || recheckedGrant.id !== activeGrant.id || target === void 0 || target.generation !== recheckedGrant.sessionGeneration) throw new _modelcontextprotocol_server.ProtocolError(_modelcontextprotocol_server.ProtocolErrorCode.InvalidRequest, "The session grant is no longer active.");
+			return {
+				grant: recheckedGrant,
+				target
+			};
+		};
+		try {
+			await authorizeOperation();
+		} catch {
+			return options.pathToken === void 0 ? jsonError(401, "The session grant is no longer active.", true, options.resourceMetadataUrl) : jsonError(401, "The signed MCP URL is invalid or revoked.");
+		}
+		const server = new _modelcontextprotocol_server.Server({
+			name: options.serverName ?? "po-session",
+			version: options.serverVersion ?? "1.0.0"
+		}, {
+			capabilities: {
+				tools: {},
+				resources: {}
+			},
+			instructions: sessionMcpInstructions(prefix)
+		});
+		server.setNotificationHandler("notifications/cancelled", async (notification) => {
+			const active = await authorizeOperation();
+			if (notification.params.requestId === void 0) return;
+			const owner = operationOwner(active.grant, notification.params.requestId);
+			const conversation = require_index.sessionMcpConversationDigest(notification.params._meta);
+			if (conversation === void 0) return;
+			const candidates = [...operations.values()].filter((operation) => operation.owner === owner && operation.conversation === conversation);
+			if (candidates.length === 1) candidates[0].controller.abort();
+		});
+		server.setRequestHandler("tools/list", async () => {
+			const active = await authorizeOperation();
+			await options.onVerified?.(active.grant);
+			const { tools, skills } = grantedSurface(active.grant, active.target.toolSurface);
+			const parentTools = tools.map(publicTool).map(presentTool);
+			const wrappers = grantedExtraTools(active.grant);
+			const baseline = structuredClone({
+				tools: parentTools,
+				skills: skills.map(({ name, description }) => ({
+					name,
+					description
+				}))
+			});
+			await authorizeOperation();
+			baselines.set(baselineKey(active.grant.clientId), baseline);
+			return { tools: [...parentTools, ...wrappers].map((tool) => wireTool(prefix, presentTool(tool))) };
+		});
+		server.setRequestHandler("tools/call", async (message, ctx) => {
+			const conversation = require_index.sessionMcpConversationDigest(ctx.mcpReq._meta ?? message.params._meta);
+			const owner = operationOwner(grant, ctx.mcpReq.id);
+			const key = JSON.stringify([owner, conversation]);
+			if (operations.has(key)) throw new _modelcontextprotocol_server.ProtocolError(_modelcontextprotocol_server.ProtocolErrorCode.InvalidRequest, "A tool call with this request identity is already active.");
+			if (options.operations !== void 0 && operations.size >= 1024) throw new _modelcontextprotocol_server.ProtocolError(_modelcontextprotocol_server.ProtocolErrorCode.InvalidRequest, "Too many active MCP tool calls. Retry later.");
+			const controller = new AbortController();
+			operations.set(key, {
+				controller,
+				owner,
+				conversation
+			});
+			const signal = AbortSignal.any([
+				request.signal,
+				ctx.mcpReq.signal,
+				controller.signal
+			]);
+			const invocationId = (0, node_crypto.randomUUID)();
+			let skillAccessOpen = true;
+			let widgetTool;
+			let invocation;
+			let fileTransfer = false;
+			const publishInvocation = () => {
+				if (invocation?.sessionId === void 0) return;
+				try {
+					options.onInvocation?.(fileTransfer ? {
+						...invocation,
+						input: { redacted: "file transfer" },
+						...invocation.output === void 0 ? {} : { output: { redacted: "file transfer" } }
+					} : { ...invocation });
+				} catch {
+					options.onNotice?.("session MCP call history could not be saved");
+				}
+			};
+			const completeInvocation = (result) => {
+				if (invocation !== void 0) {
+					invocation = {
+						...invocation,
+						status: signal.aborted ? "cancelled" : result.isError ? "failed" : "succeeded",
+						finishedAt: Date.now(),
+						output: result.structuredContent ?? result.content
+					};
+					publishInvocation();
+				}
+				return {
+					...result,
+					_meta: presentationMeta(result._meta, presentation)
+				};
+			};
+			try {
+				const parent = await authorizeOperation();
+				const requested = sessionMcpInternalName(prefix, message.params.name);
+				invocation = {
+					id: invocationId,
+					parentSessionId: parent.grant.sessionId,
+					clientId: parent.grant.clientId,
+					conversationDigest: conversation,
+					toolName: requested ?? message.params.name,
+					startedAt: Date.now(),
+					status: "running",
+					input: { redacted: "pending tool authorization" }
+				};
+				const wrapper = grantedExtraTools(parent.grant).some((tool) => tool.name === requested);
+				const advertised = wrapper ? void 0 : grantedSurface(parent.grant, parent.target.toolSurface).tools.find((tool) => tool.name === requested);
+				if (!wrapper && !advertised) throw new require_index.SessionMcpConversationError("TOOL_NOT_AVAILABLE", `Tool '${message.params.name}' is not available on this connection.` + (prefix === void 0 ? "" : ` Tool names here start with '${prefix}_'.`) + nextCall("session_capabilities", " for the current list."));
+				const transferName = requested === "use_extra_tools" && typeof message.params.arguments?.name === "string" ? sessionMcpInternalName(prefix, message.params.arguments.name) : requested;
+				fileTransfer = grantedSurface(parent.grant, parent.target.toolSurface).tools.some((tool) => tool.name === transferName && tool._meta?.["doompi/fileTransfer"] === true);
+				publishInvocation();
+				widgetTool = advertised;
+				const wrapperArgs = wrapper ? toolArguments(requested, message.params.arguments ?? {}, wire) : void 0;
+				await options.onVerified?.(parent.grant);
+				options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=started`);
+				const resolveTarget = async (reserve) => {
+					const active = await authorizeOperation();
+					if (!conversation) throw new require_index.SessionMcpConversationError("CONVERSATION_ID_REQUIRED", "This connection requires conversation metadata. Use a compatible ChatGPT conversation and retry.");
+					if (!options.resolveConversation) throw new require_index.SessionMcpConversationError("CONVERSATION_ROUTING_UNAVAILABLE", "Conversation routing is unavailable in this host.");
+					signal.throwIfAborted();
+					const target = await options.resolveConversation(active.grant, conversation, reserve, signal);
+					await authorizeOperation();
+					signal.throwIfAborted();
+					return {
+						grant: active.grant,
+						target
+					};
+				};
+				if (wrapper && !conversation) throw new require_index.SessionMcpConversationError("CONVERSATION_ID_REQUIRED", "This connection requires conversation metadata. Use a compatible ChatGPT conversation and retry.");
+				if ((requested === "load_extra_tools" || requested === "use_extra_tools") && !baselines.has(baselineKey(parent.grant.clientId))) throw new require_index.SessionMcpConversationError("SESSION_MCP_BASELINE_REQUIRED", "Refresh this MCP connection tool catalog before loading or using extra tools.");
+				const active = await resolveTarget(true);
+				invocation = {
+					...invocation,
+					sessionId: active.target.sessionId ?? parent.grant.sessionId
+				};
+				publishInvocation();
+				const { snapshot, tools, skills } = grantedSurface(active.grant, active.target.toolSurface);
+				const baseline = baselines.get(baselineKey(parent.grant.clientId));
+				const extras = wrapper && baseline ? extraTools(baseline, tools, presentTool) : [];
+				if (requested === "session_capabilities" && wrapper) {
+					const capabilities = {
+						sessionId: active.target.sessionId ?? parent.grant.sessionId,
+						generation: active.target.generation,
+						revision: snapshot.revision,
+						baseline: baseline === void 0 ? "missing" : "available",
+						inventory: "active_surface",
+						discovery: "unknown",
+						tools: [...tools.map(publicTool).map(presentTool), ...grantedExtraTools(active.grant)].map((tool) => wireTool(prefix, presentTool(tool))),
+						skills: skills.map(({ name, description }) => ({
+							name,
+							description
+						})),
+						...active.target.agentLocked === void 0 ? {} : { localAgent: active.target.agentLocked() ? "locked" : "unlocked" }
+					};
+					const current = await resolveTarget(false);
+					if (current.target.toolSurface !== active.target.toolSurface || current.target.generation !== active.target.generation || current.target.sessionId !== active.target.sessionId || current.target.toolSurface.readSurface().revision !== snapshot.revision) throw surfaceChanged();
+					options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=succeeded`);
+					return completeInvocation({
+						content: [{
+							type: "text",
+							text: JSON.stringify(capabilities)
+						}],
+						structuredContent: capabilities,
+						isError: false
+					});
+				}
+				if (requested === "load_extra_tools" && wrapper) {
+					const discovery = {
+						tools: extras.map((tool) => wireTool(prefix, presentTool(tool))),
+						skills: (tools.some((tool) => tool.name === "load_skill") ? skills : []).map(({ name, description }) => ({
+							name,
+							description
+						})).filter((skill) => !(0, node_util.isDeepStrictEqual)(baseline.skills.find((original) => original.name === skill.name), skill))
+					};
+					const current = await resolveTarget(false);
+					if (current.target.toolSurface !== active.target.toolSurface || current.target.generation !== active.target.generation || current.target.sessionId !== active.target.sessionId || current.target.toolSurface.readSurface().revision !== snapshot.revision) throw surfaceChanged();
+					options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=succeeded`);
+					return completeInvocation({
+						content: [{
+							type: "text",
+							text: JSON.stringify(discovery)
+						}],
+						structuredContent: discovery,
+						isError: false
+					});
+				}
+				const name = wrapper ? sessionMcpInternalName(prefix, wrapperArgs.name) : requested;
+				const selected = tools.find((tool) => tool.name === name);
+				if (name === void 0 || wrapper && (!extras.some((tool) => tool.name === name) || !selected)) throw new require_index.SessionMcpConversationError("TOOL_NOT_AVAILABLE", `Extra tool '${wrapperArgs?.name ?? message.params.name}' is not available.` + nextCall("load_extra_tools", " and pass a name it returns."));
+				if (!wrapper && (!selected || !(0, node_util.isDeepStrictEqual)(selected.parameters, advertised.parameters) || !(0, node_util.isDeepStrictEqual)(selected.outputSchema, advertised.outputSchema) || !(0, node_util.isDeepStrictEqual)(selected.annotations, advertised.annotations) || !(0, node_util.isDeepStrictEqual)(selected._meta, advertised._meta))) throw new require_index.SessionMcpConversationError("SESSION_TOOL_SURFACE_CHANGED", `This tool changed or was removed after your tool list loaded.${nextCall("load_extra_tools", grantedExtraTools(grant).some((tool) => tool.name === "use_extra_tools") ? ", and if it lists the tool, run it with " + wire("use_extra_tools") + "." : ", then refresh the connection to call a returned tool.")}`);
+				fileTransfer ||= selected?._meta?.["doompi/fileTransfer"] === true;
+				widgetTool = wrapper ? void 0 : selected;
+				const recheck = async () => {
+					const current = await resolveTarget(false);
+					if (current.target.toolSurface !== active.target.toolSurface || current.target.generation !== active.target.generation || current.target.sessionId !== active.target.sessionId) throw surfaceChanged();
+					if (wrapper) {
+						if (!grantedExtraTools(current.grant).some((tool) => tool.name === requested)) throw surfaceChanged();
+					} else {
+						const currentAdvertised = grantedSurface(current.grant, parent.target.toolSurface).tools.find((tool) => tool.name === requested);
+						if (!currentAdvertised || !(0, node_util.isDeepStrictEqual)(currentAdvertised, advertised)) throw surfaceChanged();
+					}
+					return current;
+				};
+				const authorizedSkills = async () => {
+					if (!skillAccessOpen) throw new _modelcontextprotocol_server.ProtocolError(_modelcontextprotocol_server.ProtocolErrorCode.InvalidRequest, "Remote skill access is no longer active.");
+					signal.throwIfAborted();
+					const current = await recheck();
+					signal.throwIfAborted();
+					return grantedSurface(current.grant, current.target.toolSurface);
+				};
+				const mcpSkills = {
+					async list() {
+						const { skills } = await authorizedSkills();
+						return skills.map(({ name, description }) => ({
+							name,
+							description
+						}));
+					},
+					async read(name) {
+						const current = await authorizedSkills();
+						const skill = current.skills.find((candidate) => candidate.name === name);
+						if (!skill) throw new _modelcontextprotocol_server.ProtocolError(_modelcontextprotocol_server.ProtocolErrorCode.InvalidParams, `Skill '${name}' is not granted or active on this connection.${nextCall("session_capabilities", " to see available skills.")} Continue without it if unavailable.`);
+						const text = await active.target.toolSurface.readSkill(current.snapshot.revision, skill.uri);
+						signal.throwIfAborted();
+						if ((await authorizedSkills()).snapshot.revision !== current.snapshot.revision) throw surfaceChanged();
+						return text;
+					}
+				};
+				invocation = {
+					...invocation,
+					toolName: name,
+					input: wrapper ? wrapperArgs.arguments ?? {} : message.params.arguments ?? {}
+				};
+				publishInvocation();
+				let result;
+				try {
+					result = await active.target.toolSurface.invokeTool({
+						revision: snapshot.revision,
+						name,
+						arguments: wrapper ? wrapperArgs.arguments ?? {} : message.params.arguments ?? {},
+						signal,
+						mcpSkills,
+						authorize: async () => {
+							const current = await recheck();
+							if (wrapper) {
+								const currentTool = grantedSurface(current.grant, current.target.toolSurface).tools.find((tool) => tool.name === name);
+								if (!currentTool || !(0, node_util.isDeepStrictEqual)(currentTool, selected)) throw surfaceChanged();
+							}
+						}
+					});
+				} catch (error) {
+					if (signal.aborted || error instanceof _modelcontextprotocol_server.ProtocolError || error instanceof require_index.SessionMcpConversationError) throw error;
+					if (require_headless.isDoomHeadlessToolBusyError(error)) throw new require_index.SessionMcpConversationError("SESSION_BUSY", `The session stayed busy for 30 seconds, so ${wire(name)} did not start. Wait for the current turn to finish, then retry once.`);
+					throw new require_index.SessionMcpConversationError("TOOL_CALL_FAILED", `${wire(name)} did not return a result: ${error instanceof Error ? error.message : "unknown error"}. If the tool changes files or state, inspect before retrying.`);
+				}
+				try {
+					await recheck();
+				} catch (error) {
+					if (!(error instanceof require_index.SessionMcpConversationError)) throw error;
+					throw new require_index.SessionMcpConversationError("SESSION_RESULT_WITHHELD", "The call may have run, but its result was withheld because the session tools or grants changed. Inspect state before retrying.");
+				}
+				options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=succeeded`);
+				const content = result.content.length === 0 && result.structuredContent !== void 0 ? [{
+					type: "text",
+					text: JSON.stringify(result.structuredContent)
+				}] : result.content;
+				return completeInvocation(widgetResult(wrapper ? void 0 : selected, {
+					content: active.target.agentLocked?.() === false ? [...content, {
+						type: "text",
+						text: LOCAL_AGENT_UNLOCKED_NOTICE
+					}] : content,
+					...result.structuredContent === void 0 ? {} : { structuredContent: result.structuredContent },
+					...result._meta === void 0 ? {} : { _meta: result._meta },
+					isError: result.isError ?? false
+				}, prefix));
+			} catch (error) {
+				const cause = error instanceof require_index.SessionMcpConversationError ? error.code : signal.aborted ? "aborted" : error instanceof _modelcontextprotocol_server.ProtocolError ? `mcp_${String(error.code)}` : error instanceof Error ? error.name : "unknown";
+				options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=failed cause=${cause}`);
+				if (invocation !== void 0) {
+					invocation = {
+						...invocation,
+						status: signal.aborted ? "cancelled" : "failed",
+						finishedAt: Date.now(),
+						output: {
+							cause,
+							message: fileTransfer ? "File transfer failed." : error instanceof Error ? error.message : "Tool call failed."
+						}
+					};
+					publishInvocation();
+				}
+				if (!(error instanceof require_index.SessionMcpConversationError)) throw error;
+				const failure = widgetResult(widgetTool, {
+					content: [{
+						type: "text",
+						text: error.message
+					}],
+					isError: true,
+					structuredContent: {
+						code: error.code,
+						message: error.message,
+						...error.bindingId === void 0 ? {} : { bindingId: error.bindingId }
+					}
+				}, prefix);
+				return {
+					...failure,
+					_meta: presentationMeta(failure._meta, presentation)
+				};
+			} finally {
+				skillAccessOpen = false;
+				operations.delete(key);
+			}
+		});
+		server.setRequestHandler("resources/list", async () => {
+			const active = await authorizeOperation();
+			const { uiResources } = grantedSurface(active.grant, active.target.toolSurface);
+			return { resources: presentation === "app" ? [...uiResources] : [] };
+		});
+		server.setRequestHandler("resources/read", async (message, ctx) => {
+			const conversation = require_index.sessionMcpConversationDigest(ctx.mcpReq._meta ?? message.params._meta);
+			const active = await authorizeOperation();
+			const { snapshot, skills, uiResources } = grantedSurface(active.grant, active.target.toolSurface);
+			const skill = skills.find((candidate) => candidate.uri === message.params.uri);
+			if (skill !== void 0) {
+				if (!conversation) throw new _modelcontextprotocol_server.ProtocolError(_modelcontextprotocol_server.ProtocolErrorCode.InvalidParams, `Use ${wire("load_skill")} with conversation metadata to read target-session guidance.`);
+				if (!options.resolveConversation) throw new _modelcontextprotocol_server.ProtocolError(_modelcontextprotocol_server.ProtocolErrorCode.InvalidRequest, "Conversation routing is unavailable in this host.");
+				const text = await (await options.resolveConversation(active.grant, conversation, false, request.signal)).toolSurface.readSkill(snapshot.revision, skill.uri);
+				await authorizeOperation();
+				return { contents: [{
+					uri: skill.uri,
+					mimeType: "text/markdown",
+					text
+				}] };
+			}
+			const resource = uiResources.find((candidate) => candidate.uri === message.params.uri);
+			if (presentation === "app" && resource !== void 0 && active.target.toolSurface.readUiResource !== void 0) {
+				request.signal.throwIfAborted();
+				const text = await active.target.toolSurface.readUiResource(snapshot.revision, resource.uri);
+				request.signal.throwIfAborted();
+				const current = await authorizeOperation();
+				const after = grantedSurface(current.grant, current.target.toolSurface);
+				if (current.target.toolSurface !== active.target.toolSurface || after.snapshot.revision !== snapshot.revision || !(0, node_util.isDeepStrictEqual)(after.uiResources.find((candidate) => candidate.uri === resource.uri), resource)) throw new _modelcontextprotocol_server.ProtocolError(_modelcontextprotocol_server.ProtocolErrorCode.InvalidRequest, "The session UI resource surface has changed.");
+				return { contents: [{
+					...resource,
+					text
+				}] };
+			}
+			if (message.params.uri.startsWith("ui:")) throw new _modelcontextprotocol_server.ProtocolError(_modelcontextprotocol_server.ProtocolErrorCode.InvalidParams, "UI resource is not granted or active.");
+			throw new _modelcontextprotocol_server.ProtocolError(_modelcontextprotocol_server.ProtocolErrorCode.InvalidParams, `Use ${wire("load_skill")} with conversation metadata to read target-session guidance.`);
+		});
+		const handler = (0, _modelcontextprotocol_server.createMcpHandler)(() => server, { legacy: "reject" });
+		try {
+			return await handler.fetch(request, { authInfo: {
+				token,
+				clientId: grant.clientId,
+				scopes: grant.scope === "session" ? ["session"] : [...grant.tools.map((name) => `tool:${name}`), ...grant.skills.map((name) => `skill:${name}`)],
+				expiresAt: Math.floor(grant.expiresAt / 1e3),
+				resource: new URL(exactResource)
+			} });
+		} catch {
+			return jsonError(500, "Internal MCP server error.");
+		}
+	};
+}
+//#endregion
+exports.SESSION_MCP_EXTRA_TOOLS = SESSION_MCP_EXTRA_TOOLS;
+exports.createSessionMcpHttpHandler = createSessionMcpHttpHandler;
+exports.sessionMcpInternalName = sessionMcpInternalName;
+exports.sessionMcpWireName = sessionMcpWireName;
+
+//# sourceMappingURL=sessionMcpHandler.cjs.map