@agimon-ai/po-core 0.0.0-alpha.0

package/dist/src/server/sessionMcpRoutes.cjs

@@ -0,0 +1,809 @@
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_index = require("../services/sessionMcpConversations/index.cjs");
+const require_index$1 = require("../services/sessionMcpAuthorization/index.cjs");
+const require_sessionMcpHandler = require("./sessionMcpHandler.cjs");
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+//#region src/server/sessionMcpRoutes.ts
+const AUTHORIZATION_SERVER_DISCOVERY = "/.well-known/oauth-authorization-server";
+const AUTHORIZE_ROUTE = "/oauth/authorize";
+const TOKEN_ROUTE = "/oauth/token";
+const SESSION_MCP_PATTERN = /^\/api\/workspaces\/([^/]+)\/sessions\/([^/]+)\/mcp(?:-app)?$/u;
+const SESSION_MCP_URL_TOKEN_PATTERN = /^\/api\/workspaces\/([^/]+)\/sessions\/([^/]+)\/mcp(?:-app)?\/([A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$/u;
+const SESSION_MCP_ACTIVITY_PATTERN = /^\/api\/workspaces\/([^/]+)\/sessions\/([^/]+)\/mcp\/activity$/u;
+const SESSION_MCP_CONFIG_PATTERN = /^\/api\/workspaces\/([^/]+)\/sessions\/([^/]+)\/mcp\/config$/u;
+const SESSION_MCP_CLIENTS_PATTERN = /^\/api\/workspaces\/([^/]+)\/sessions\/([^/]+)\/mcp\/clients(?:\/([^/]+))?$/u;
+const SESSION_MCP_CONVERSATIONS_PATTERN = /^\/api\/workspaces\/([^/]+)\/sessions\/([^/]+)\/mcp\/conversations(?:\/([^/]+))?$/u;
+/**
+* An OAuth resource as it can be logged: the URL with any URL-token segment and every query value
+* redacted, so a mismatch in origin, path, trailing slash or query is visible without a secret.
+*/
+function describeResource(resource) {
+	let parsed;
+	try {
+		parsed = new URL(resource);
+	} catch {
+		return "a resource that is not a URL";
+	}
+	const token = SESSION_MCP_URL_TOKEN_PATTERN.exec(parsed.pathname);
+	const pathname = token === null ? parsed.pathname : parsed.pathname.slice(0, -token[3].length) + "<token>";
+	const query = [...parsed.searchParams.keys()].map((key) => `${key}=<redacted>`).join("&");
+	return `${parsed.origin}${pathname}${query === "" ? "" : `?${query}`}${parsed.hash === "" ? "" : "#<redacted>"}`;
+}
+function redactUrlCredentials(text) {
+	return text.replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/?#]*@/giu, "$1***@");
+}
+const PROTECTED_RESOURCE_PATTERN = /^\/\.well-known\/oauth-protected-resource(\/api\/workspaces\/[^/]+\/sessions\/[^/]+\/mcp(?:-app)?)$/u;
+function json(status, value) {
+	return Response.json(value, {
+		status,
+		headers: { "cache-control": "no-store" }
+	});
+}
+function oauthError(error) {
+	if (error instanceof require_index$1.SessionMcpOAuthError) return json(error.code === "invalid_client" ? 401 : 400, {
+		error: error.code,
+		error_description: error.message
+	});
+	return json(400, {
+		error: "invalid_request",
+		error_description: "The OAuth request was invalid."
+	});
+}
+function trustedOrigin(value) {
+	if (value === void 0) return void 0;
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" && url.pathname === "/" && url.search === "" && url.hash === "" ? url.origin : void 0;
+	} catch {
+		return;
+	}
+}
+function sessionPath(workspaceId, sessionId) {
+	return `/api/workspaces/${encodeURIComponent(workspaceId)}/sessions/${encodeURIComponent(sessionId)}/mcp`;
+}
+function parseStringArray(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
+}
+function defaultClientName(origin) {
+	return `ChatGPT · ${new URL(origin).hostname}`;
+}
+function formString(form, name) {
+	const value = form.get(name);
+	return typeof value === "string" ? value : "";
+}
+function publicClient(client, binding) {
+	return {
+		clientId: client.clientId,
+		name: client.name,
+		redirectUri: client.redirectUri,
+		tokenEndpointAuthMethod: client.tokenEndpointAuthMethod,
+		createdAt: client.createdAt,
+		scope: binding.scope,
+		routing: require_index$1.sessionMcpRouting(binding.routing),
+		tools: binding.tools,
+		skills: binding.skills,
+		audience: binding.audience,
+		...binding.toolPrefix === void 0 ? {} : { toolPrefix: binding.toolPrefix }
+	};
+}
+/** Canonicalizes an intended directory without creating it or accepting symlink aliases. */
+function executionDirectory(value) {
+	if (!node_path.default.isAbsolute(value) || value.includes("\0") || value.length > 4096) throw new require_index.SessionMcpConversationError("INVALID_EXECUTION_DIRECTORY", "Choose an absolute execution directory.");
+	let ancestor = node_path.default.resolve(value);
+	const suffix = [];
+	for (;;) try {
+		return node_path.default.join(node_fs.default.realpathSync(ancestor), ...suffix);
+	} catch (error) {
+		if (error.code !== "ENOENT" || node_path.default.dirname(ancestor) === ancestor) throw new require_index.SessionMcpConversationError("INVALID_EXECUTION_DIRECTORY", "The execution directory cannot be resolved.");
+		suffix.unshift(node_path.default.basename(ancestor));
+		ancestor = node_path.default.dirname(ancestor);
+	}
+}
+function overlappingDirectories(left, right) {
+	const contained = (root, target) => {
+		const relative = node_path.default.relative(root, target);
+		return relative === "" || !node_path.default.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${node_path.default.sep}`);
+	};
+	return contained(left, right) || contained(right, left);
+}
+/** Routes the process-local session MCP authority and revokes every grant with its live incarnation. */
+function createSessionMcpRoutes(options) {
+	const authorization = options.authorization ?? require_index$1.createSessionMcpAuthorizationService();
+	const incarnations = /* @__PURE__ */ new Map();
+	let nextGeneration = 1;
+	let publishPending = () => {};
+	const revokeIncarnation = (sessionId, generation) => {
+		authorization.revokeSessionGeneration(sessionId, generation);
+	};
+	const abortOperations = (operations) => {
+		for (const operation of operations.values()) operation.controller.abort();
+		operations.clear();
+	};
+	const register = (session) => {
+		const current = incarnations.get(session.id);
+		if (current?.host === session.host) return false;
+		if (current !== void 0) {
+			revokeIncarnation(session.id, current.generation);
+			abortOperations(current.operations);
+		}
+		incarnations.set(session.id, {
+			host: session.host,
+			generation: nextGeneration++,
+			handlers: /* @__PURE__ */ new Map(),
+			baselines: /* @__PURE__ */ new Map(),
+			operations: /* @__PURE__ */ new Map()
+		});
+		return true;
+	};
+	for (const session of options.headlessHub.snapshot()) register(session);
+	const unsubscribe = options.headlessHub.onEvent((event) => {
+		if (event.kind === "upsert" && register(event.session)) publishPending();
+		if (event.kind === "removed") {
+			const current = incarnations.get(event.sessionId);
+			if (current !== void 0) {
+				revokeIncarnation(event.sessionId, current.generation);
+				abortOperations(current.operations);
+			}
+			incarnations.delete(event.sessionId);
+		}
+	});
+	let observedOrigin;
+	let observedOriginRevision;
+	let originObserved = false;
+	const origin = () => {
+		const current = trustedOrigin(options.publicOrigin());
+		const revision = options.publicOriginRevision?.();
+		if (originObserved && current !== observedOrigin || revision !== void 0 && observedOriginRevision !== void 0 && revision !== observedOriginRevision) {
+			for (const client of authorization.listClients()) {
+				authorization.revokeClient(client.clientId);
+				options.registrationStore?.remove(client.clientId);
+			}
+			for (const incarnation of incarnations.values()) {
+				incarnation.handlers.clear();
+				incarnation.baselines.clear();
+				abortOperations(incarnation.operations);
+			}
+		}
+		observedOrigin = current;
+		observedOriginRevision = revision;
+		originObserved = true;
+		restorePersistedRegistrations(current);
+		return current;
+	};
+	const target = (workspaceId, sessionId) => {
+		if (options.headlessHub.computerUse?.ownsSession?.(sessionId)) return void 0;
+		const session = options.headlessHub.session(sessionId);
+		const incarnation = incarnations.get(sessionId);
+		return session !== void 0 && session.workspaceId === workspaceId && incarnation?.host === session.host ? {
+			session,
+			generation: incarnation.generation
+		} : void 0;
+	};
+	const restorePersistedRegistrations = (configuredOrigin) => {
+		if (configuredOrigin === void 0) return;
+		for (const registration of options.registrationStore?.registrations() ?? []) {
+			const audience = `${configuredOrigin}${sessionPath(registration.workspaceId, registration.binding.sessionId)}`;
+			if (registration.binding.audience !== audience) {
+				options.registrationStore?.remove(registration.client.clientId);
+				continue;
+			}
+			const resolved = target(registration.workspaceId, registration.binding.sessionId);
+			if (resolved !== void 0) authorization.restorePersistentRegistration(registration, resolved.generation);
+		}
+	};
+	const requireStore = () => {
+		if (!options.conversationStore) throw new require_index.SessionMcpConversationError("CONVERSATION_ROUTING_UNAVAILABLE", "Persistent conversation routing is unavailable.");
+		return options.conversationStore;
+	};
+	publishPending = () => {
+		if (!options.conversationStore) return;
+		try {
+			const records = options.conversationStore.list();
+			for (const parent of options.headlessHub.snapshot()) options.headlessHub.setPendingSessionSetups?.(parent.id, records.filter((record) => record.parentSessionId === parent.id && record.state === "pending").map((record) => ({
+				id: record.id,
+				name: `conversation ${record.id.slice(0, 8)}`,
+				createdAt: record.createdAt,
+				status: provision.has(record.id) || recoveries.has(record.id) ? "provisioning" : record.failureCode === void 0 ? "interrupted" : "failed",
+				...record.setupKind === void 0 ? {} : { setupKind: record.setupKind },
+				...record.failureCode === void 0 ? {} : { errorCode: record.failureCode },
+				...record.cwd === void 0 ? {} : { cwd: record.cwd }
+			})));
+		} catch (error) {
+			options.onNotice?.(error instanceof Error ? error.message : "Conversation bindings are unavailable.");
+		}
+	};
+	const readReservation = (id, parentSessionId) => {
+		origin();
+		const record = requireStore().get(id, parentSessionId);
+		const binding = authorization.readAuthorizationBinding(record.clientId);
+		const parent = target(record.parentWorkspaceId, parentSessionId);
+		if (!parent || binding?.routing !== "conversation" || binding.sessionId !== parentSessionId || binding.sessionGeneration !== parent.generation) throw new require_index.SessionMcpConversationError("SESSION_UNAVAILABLE", "The connection that owns this setup is no longer active.", id);
+		return {
+			record,
+			parent
+		};
+	};
+	const reservations = {
+		read(id, parentSessionId) {
+			const { record } = readReservation(id, parentSessionId);
+			return {
+				sessionId: record.id,
+				...record.cwd === void 0 ? {} : { cwd: record.cwd }
+			};
+		},
+		async prepare(id, parentSessionId, suppliedDirectory) {
+			const { record, parent } = readReservation(id, parentSessionId);
+			const cwd = executionDirectory(suppliedDirectory);
+			if ([
+				options.headlessHub.workspaces().find((workspace) => workspace.id === parent.session.workspaceId)?.root ?? parent.session.cwd,
+				...options.headlessHub.snapshot().filter((session) => session.id !== id).map((session) => session.cwd),
+				...requireStore().list().filter((entry) => entry.id !== id && entry.state !== "closed" && entry.cwd !== void 0).map((entry) => entry.cwd)
+			].some((directory) => overlappingDirectories(cwd, executionDirectory(directory)))) throw new require_index.SessionMcpConversationError("EXECUTION_DIRECTORY_SHARED", "Choose a separate checkout, not a directory shared with another session.", id);
+			if (record.state === "bound" && record.cwd !== cwd) throw new require_index.SessionMcpConversationError("SESSION_TARGET_FIXED", "An initialized session cannot change its directory.", id);
+			requireStore().prepare(id, parentSessionId, cwd);
+			publishPending();
+			return {
+				sessionId: id,
+				cwd
+			};
+		},
+		async complete(id, parentSessionId) {
+			const { record } = readReservation(id, parentSessionId);
+			const child = options.headlessHub.session(id);
+			if (!record.cwd || !child?.workspaceId || child.parentSessionId !== parentSessionId || record.setupKind === "managed-worktree" && child.workspaceId !== record.parentWorkspaceId || executionDirectory(child.cwd) !== record.cwd || options.isSessionPersisted?.(id, child.cwd) === false) throw new require_index.SessionMcpConversationError("SESSION_SETUP_INCOMPLETE", "The reserved session is not durably ready. Recover the existing setup instead of creating another checkout.", id);
+			requireStore().bind(id, parentSessionId, child.workspaceId);
+			publishPending();
+			return {
+				sessionId: id,
+				workspaceId: child.workspaceId,
+				cwd: child.cwd
+			};
+		}
+	};
+	const provision = /* @__PURE__ */ new Map();
+	const recoveries = /* @__PURE__ */ new Map();
+	const setupDirectory = async (id, parentSessionId, directory) => {
+		const canonical = executionDirectory(directory);
+		if (!node_fs.default.statSync(canonical).isDirectory()) throw new Error("The execution directory is not a directory.");
+		const { record: current } = readReservation(id, parentSessionId);
+		if (provision.has(id) && current.setupKind === "managed-worktree") throw new require_index.SessionMcpConversationError("SESSION_TARGET_FIXED", "This setup belongs to a managed worktree.", id);
+		if (requireStore().selectSetup(id, parentSessionId, "existing-directory").setupKind !== "existing-directory") throw new require_index.SessionMcpConversationError("SESSION_TARGET_FIXED", "This setup belongs to a managed worktree.", id);
+		const prepared = await reservations.prepare(id, parentSessionId, canonical);
+		const pending = provision.get(id);
+		if (pending) return pending;
+		const setup = (async () => {
+			if (!options.headlessHub.session(id)) {
+				if (requireStore().get(id, parentSessionId).state === "bound" || options.isSessionPersisted?.(id, prepared.cwd)) throw new require_index.SessionMcpConversationError("SESSION_UNAVAILABLE", "Resume the existing session in Po. It will not be recreated automatically.", id);
+				if (!node_fs.default.statSync(prepared.cwd).isDirectory()) throw new Error("The execution directory is not a directory.");
+				await options.headlessHub.sessionService.create({
+					cwd: prepared.cwd,
+					name: `conversation ${id.slice(0, 8)}`,
+					parentSessionId,
+					sessionProvenance: "remote-conversation",
+					reservationId: id
+				});
+			}
+			return reservations.complete(id, parentSessionId);
+		})();
+		provision.set(id, setup);
+		publishPending();
+		try {
+			return await setup;
+		} catch (error) {
+			requireStore().fail(id, parentSessionId, "SESSION_UNAVAILABLE");
+			throw error;
+		} finally {
+			if (provision.get(id) === setup) provision.delete(id);
+			publishPending();
+		}
+	};
+	const provisionConversationWorktree = async (record, signal) => {
+		const pending = provision.get(record.id);
+		if (pending) return pending;
+		readReservation(record.id, record.parentSessionId);
+		requireStore().selectSetup(record.id, record.parentSessionId, "managed-worktree");
+		const setup = (async () => {
+			try {
+				const child = await options.headlessHub.sessionService.provisionReservedWorktree?.({
+					reservationId: record.id,
+					parentSessionId: record.parentSessionId,
+					signal
+				});
+				if (child === void 0 || child.sessionId !== record.id) throw new Error("Automatic worktree provisioning did not create the reserved session.");
+				return child;
+			} catch (error) {
+				if (error instanceof require_index.SessionMcpConversationError) throw error;
+				options.onNotice?.(`session MCP worktree provisioning failed for reservation ${record.id}: ${error instanceof Error ? redactUrlCredentials(error.message) : "Automatic worktree provisioning failed."}`);
+				throw new require_index.SessionMcpConversationError("SESSION_WORKTREE_PROVISION_FAILED", "An automatic worktree could not be created for this conversation. Resolve the host Git setup, then retry.", record.id);
+			}
+		})();
+		provision.set(record.id, setup);
+		publishPending();
+		try {
+			return await setup;
+		} catch (error) {
+			requireStore().fail(record.id, record.parentSessionId, "SESSION_WORKTREE_PROVISION_FAILED");
+			throw error;
+		} finally {
+			if (provision.get(record.id) === setup) provision.delete(record.id);
+			publishPending();
+		}
+	};
+	const publicRoutes = async (request) => {
+		const url = new URL(request.url);
+		const configuredOrigin = origin();
+		const signedMcpMatch = SESSION_MCP_URL_TOKEN_PATTERN.exec(url.pathname);
+		const mcpMatch = SESSION_MCP_PATTERN.exec(url.pathname) ?? signedMcpMatch;
+		if (mcpMatch !== null) {
+			if (configuredOrigin === void 0) return json(503, { error: "Session MCP public origin is unavailable." });
+			const workspaceId = decodeURIComponent(mcpMatch[1]);
+			const sessionId = decodeURIComponent(mcpMatch[2]);
+			const pathToken = signedMcpMatch?.[3];
+			const canonicalPath = sessionPath(workspaceId, sessionId);
+			const presentation = url.pathname.startsWith(`${canonicalPath}-app`) ? "app" : "pure";
+			const basePath = presentation === "app" ? `${canonicalPath}-app` : canonicalPath;
+			const exactPath = pathToken === void 0 ? basePath : `${basePath}/${pathToken}`;
+			if (url.pathname !== exactPath || url.search !== "") return json(404, { error: "Not found." });
+			const audience = `${configuredOrigin}${canonicalPath}`;
+			const resource = `${configuredOrigin}${exactPath}`;
+			const incarnation = target(workspaceId, sessionId) === void 0 ? void 0 : incarnations.get(sessionId);
+			const handlers = incarnation?.handlers;
+			const handler = (pathToken === void 0 ? handlers?.get(resource) : void 0) ?? require_sessionMcpHandler.createSessionMcpHttpHandler({
+				audience,
+				presentation,
+				baselines: incarnation?.baselines ?? /* @__PURE__ */ new Map(),
+				authorization,
+				onNotice: options.onNotice,
+				onInvocation: (invocation) => {
+					if (invocation.sessionId === void 0 || invocation.conversationDigest === void 0) return;
+					const conversation = options.conversationStore?.find(invocation.clientId, invocation.parentSessionId, invocation.conversationDigest);
+					if (conversation?.state !== "bound" || conversation.id !== invocation.sessionId || conversation.workspaceId === void 0) return;
+					options.activityStore?.record(conversation.workspaceId, conversation.id, authorization.readClient(invocation.clientId)?.name ?? "remote agent", invocation);
+				},
+				...pathToken === void 0 ? {} : {
+					pathToken,
+					operations: incarnation?.operations
+				},
+				resolveConversation: async (grant, digest, reserve, signal) => {
+					const store = requireStore();
+					let record = reserve ? store.reserve(grant.clientId, sessionId, workspaceId, digest) : store.find(grant.clientId, sessionId, digest);
+					if (!record) throw new require_index.SessionMcpConversationError("SESSION_UNAVAILABLE", "This conversation binding is unavailable. It will not be recreated automatically.");
+					const restoring = recoveries.get(record.id);
+					if (restoring) await restoring;
+					else {
+						const existing = record.workspaceId === void 0 ? void 0 : target(record.workspaceId, record.id);
+						if (record.state === "closed" || record.state === "bound" && !existing) {
+							if (options.headlessHub.session(record.id) || !record.cwd || options.isSessionPersisted?.(record.id, record.cwd) !== false) throw new require_index.SessionMcpConversationError("SESSION_UNAVAILABLE", "The bound session is unavailable. Resume it in Po; no other session will be used.", record.id);
+							if (record.setupKind === void 0 && record.cwd !== void 0) throw new require_index.SessionMcpConversationError("SESSION_TARGET_FIXED", "This existing setup has no verified provider. Recover it without changing its ownership.", record.id);
+							record = store.recover(record.id, sessionId);
+							const recovery = record.setupKind === "existing-directory" && record.cwd ? setupDirectory(record.id, sessionId, record.cwd) : provisionConversationWorktree(record, signal);
+							recoveries.set(record.id, recovery);
+							publishPending();
+							try {
+								await recovery;
+							} finally {
+								if (recoveries.get(record.id) === recovery) recoveries.delete(record.id);
+								publishPending();
+							}
+						}
+					}
+					record = store.find(grant.clientId, sessionId, digest);
+					if (record.state === "pending") {
+						publishPending();
+						if (record.workspaceId !== void 0 && options.isSessionPersisted?.(record.id, record.cwd) !== false) throw new require_index.SessionMcpConversationError("SESSION_UNAVAILABLE", "The bound session is unavailable. Resume it in Po; no other session will be used.", record.id);
+						const pending = provision.get(record.id);
+						if (pending) await pending;
+						else if (record.setupKind === "existing-directory" && record.cwd) await setupDirectory(record.id, sessionId, record.cwd);
+						else await provisionConversationWorktree(record, signal);
+						record = store.find(grant.clientId, sessionId, digest);
+						if (!record || record.state !== "bound") throw new require_index.SessionMcpConversationError("SESSION_WORKTREE_PROVISION_FAILED", "The automatic worktree setup did not complete. Retry after resolving the host Git setup.");
+					}
+					const child = record.workspaceId === void 0 ? void 0 : target(record.workspaceId, record.id);
+					if (!child || child.session.parentSessionId !== sessionId || executionDirectory(child.session.cwd) !== record.cwd || !node_fs.default.existsSync(child.session.cwd)) throw new require_index.SessionMcpConversationError("SESSION_UNAVAILABLE", "The bound session is unavailable. Resume it in Po; no other session will be used.", record.id);
+					return {
+						sessionId: record.id,
+						generation: child.generation,
+						toolSurface: child.session.host.mcpSurface,
+						agentLocked: () => child.session.host.runtime.agentLocked()
+					};
+				},
+				onVerified: (grant) => {
+					if (options.registrationStore === void 0) return;
+					const active = target(workspaceId, sessionId);
+					if (active === void 0 || grant.sessionGeneration !== active.generation || grant.clientId === "") throw new Error("The session grant is no longer active.");
+					if (authorization.readClient(grant.clientId)?.tokenEndpointAuthMethod !== "client_secret_post") return;
+					const registration = authorization.persistentRegistration(grant.clientId, workspaceId, Date.now());
+					if (registration === void 0 || !options.registrationStore.save(registration)) throw new Error("The verified Session MCP client could not be saved.");
+				},
+				...pathToken === void 0 ? { resourceMetadataUrl: `${configuredOrigin}/.well-known/oauth-protected-resource${basePath}` } : {},
+				resolveSession: (grantedSessionId) => {
+					if (grantedSessionId !== sessionId) return void 0;
+					const resolved = target(workspaceId, sessionId);
+					return resolved === void 0 ? void 0 : {
+						sessionId,
+						generation: resolved.generation,
+						toolSurface: resolved.session.host.mcpSurface,
+						agentLocked: () => resolved.session.host.runtime.agentLocked()
+					};
+				}
+			});
+			if (pathToken === void 0) handlers?.set(resource, handler);
+			return handler(new Request(resource, request));
+		}
+		const protectedMatch = PROTECTED_RESOURCE_PATTERN.exec(url.pathname);
+		if (protectedMatch !== null && request.method === "GET") {
+			if (configuredOrigin === void 0) return json(503, { error: "Session MCP public origin is unavailable." });
+			return json(200, {
+				resource: `${configuredOrigin}${protectedMatch[1]}`,
+				authorization_servers: [configuredOrigin],
+				bearer_methods_supported: ["header"]
+			});
+		}
+		if (url.pathname === AUTHORIZATION_SERVER_DISCOVERY && request.method === "GET") {
+			if (configuredOrigin === void 0) return json(503, { error: "Session MCP public origin is unavailable." });
+			return json(200, {
+				issuer: configuredOrigin,
+				authorization_endpoint: `${configuredOrigin}${AUTHORIZE_ROUTE}`,
+				token_endpoint: `${configuredOrigin}${TOKEN_ROUTE}`,
+				response_types_supported: ["code"],
+				grant_types_supported: ["authorization_code", "refresh_token"],
+				code_challenge_methods_supported: ["S256"],
+				token_endpoint_auth_methods_supported: ["client_secret_post"]
+			});
+		}
+		if (url.pathname === AUTHORIZE_ROUTE && request.method === "GET") {
+			if (configuredOrigin === void 0) return json(503, { error: "Session MCP public origin is unavailable." });
+			const clientId = url.searchParams.get("client_id") ?? "";
+			const client = authorization.readClient(clientId);
+			const binding = authorization.readAuthorizationBinding(clientId);
+			const redirectUri = url.searchParams.get("redirect_uri") ?? "";
+			if (client === void 0 || client.tokenEndpointAuthMethod !== "client_secret_post" || binding === void 0 || redirectUri !== client.redirectUri) return oauthError(new require_index$1.SessionMcpOAuthError("invalid_client", "Unknown client or callback."));
+			const callback = new URL(client.redirectUri);
+			const state = url.searchParams.get("state");
+			try {
+				const boundSession = options.headlessHub.session(binding.sessionId);
+				const boundIncarnation = incarnations.get(binding.sessionId);
+				const expectedAudience = boundSession?.workspaceId === void 0 ? void 0 : `${configuredOrigin}${sessionPath(boundSession.workspaceId, binding.sessionId)}`;
+				if (expectedAudience === void 0 || binding.audience !== expectedAudience || boundIncarnation?.host !== boundSession?.host || binding.sessionGeneration !== boundIncarnation?.generation) {
+					authorization.revokeClient(clientId);
+					throw new require_index$1.SessionMcpOAuthError("invalid_grant", "The preauthorized session is no longer active.");
+				}
+				if (url.searchParams.get("response_type") !== "code") throw new require_index$1.SessionMcpOAuthError("invalid_request", "Only the code response type is supported.");
+				const resource = url.searchParams.get("resource");
+				if (url.searchParams.getAll("resource").length > 1 || resource !== null && resource !== binding.audience && resource !== `${binding.audience}-app`) {
+					options.onNotice?.(`session MCP authorize refused: client ${clientId} is bound to session ${binding.sessionId}, expecting ${binding.audience} but the connector asked for ${describeResource(resource ?? "")}`);
+					throw new require_index$1.SessionMcpOAuthError("invalid_request", "The requested resource is not preauthorized. The connector's MCP URL must be the session URL this client was created for.");
+				}
+				const code = authorization.issueAuthorizationCode({
+					clientId,
+					redirectUri,
+					codeChallenge: url.searchParams.get("code_challenge") ?? "",
+					codeChallengeMethod: url.searchParams.get("code_challenge_method")
+				});
+				callback.searchParams.set("code", code.code);
+			} catch (error) {
+				callback.searchParams.set("error", error instanceof require_index$1.SessionMcpOAuthError ? error.code : "invalid_request");
+				callback.searchParams.set("error_description", error instanceof Error ? error.message : "The OAuth request was invalid.");
+			}
+			if (state !== null) callback.searchParams.set("state", state);
+			return new Response(null, {
+				status: 302,
+				headers: {
+					location: callback.href,
+					"cache-control": "no-store"
+				}
+			});
+		}
+		if (url.pathname === TOKEN_ROUTE && request.method === "POST") try {
+			const form = await request.formData();
+			const grantType = formString(form, "grant_type");
+			const clientId = formString(form, "client_id");
+			const clientSecret = formString(form, "client_secret");
+			const resource = form.get("resource");
+			const binding = authorization.readAuthorizationBinding(clientId);
+			if (form.getAll("resource").length > 1 || resource !== null && (typeof resource !== "string" || resource !== binding?.audience && resource !== `${binding?.audience}-app`)) throw new require_index$1.SessionMcpOAuthError("invalid_request", "The requested resource is not preauthorized.");
+			const result = grantType === "authorization_code" ? authorization.exchangeToken({
+				grantType,
+				clientId,
+				clientSecret,
+				code: formString(form, "code"),
+				redirectUri: formString(form, "redirect_uri"),
+				codeVerifier: formString(form, "code_verifier")
+			}) : grantType === "refresh_token" ? authorization.exchangeToken({
+				grantType,
+				clientId,
+				clientSecret,
+				refreshToken: formString(form, "refresh_token")
+			}) : (() => {
+				throw new require_index$1.SessionMcpOAuthError("unsupported_grant_type", "The grant type is not supported.");
+			})();
+			return json(200, {
+				access_token: result.accessToken,
+				refresh_token: result.refreshToken,
+				token_type: result.tokenType,
+				expires_in: result.expiresIn
+			});
+		} catch (error) {
+			return oauthError(error);
+		}
+	};
+	publishPending();
+	return {
+		reservations,
+		closeSessionBinding(sessionId) {
+			options.conversationStore?.closeSession(sessionId);
+			publishPending();
+		},
+		handlePublic: publicRoutes,
+		async handleHost(request) {
+			const url = new URL(request.url);
+			origin();
+			const configMatch = SESSION_MCP_CONFIG_PATTERN.exec(url.pathname);
+			const match = SESSION_MCP_CLIENTS_PATTERN.exec(url.pathname);
+			const conversationMatch = SESSION_MCP_CONVERSATIONS_PATTERN.exec(url.pathname);
+			const activityMatch = SESSION_MCP_ACTIVITY_PATTERN.exec(url.pathname);
+			if (configMatch === null && match === null && conversationMatch === null && activityMatch === null) return void 0;
+			const routeMatch = configMatch ?? match ?? conversationMatch ?? activityMatch;
+			const workspaceId = decodeURIComponent(routeMatch[1]);
+			const sessionId = decodeURIComponent(routeMatch[2]);
+			const clientId = match?.[3] === void 0 ? void 0 : decodeURIComponent(match[3]);
+			const resolved = target(workspaceId, sessionId);
+			if (activityMatch !== null) {
+				if (request.method !== "GET") return json(405, { error: "Method not allowed." });
+				const beforeText = url.searchParams.get("before");
+				const before = beforeText === null ? void 0 : Number(beforeText);
+				if ([...url.searchParams.keys()].some((key) => key !== "before") || before !== void 0 && (!Number.isSafeInteger(before) || before <= 0)) return json(400, { error: "Invalid history cursor." });
+				if (options.headlessHub.computerUse?.ownsSession?.(sessionId)) return json(404, { error: "Session not found." });
+				if (!options.activityStore) return json(503, { error: "MCP call history is unavailable in this host." });
+				try {
+					const conversation = options.conversationStore?.list().find((entry) => entry.id === sessionId && entry.state === "bound" && entry.workspaceId === workspaceId);
+					if (conversation === void 0) return json(200, {
+						enabled: false,
+						available: false,
+						tools: [],
+						calls: [],
+						total: 0
+					});
+					const history = options.activityStore.read(workspaceId, sessionId, before);
+					const parent = target(conversation.parentWorkspaceId, conversation.parentSessionId);
+					const bindings = authorization.listClients().flatMap((client) => {
+						const binding = authorization.readAuthorizationBinding(client.clientId);
+						return binding !== void 0 && client.clientId === conversation.clientId && binding.sessionId === conversation.parentSessionId && binding.sessionGeneration === parent?.generation ? [{
+							client,
+							binding
+						}] : [];
+					});
+					let available = false;
+					let tools = [];
+					if (resolved !== void 0 && bindings.length > 0) try {
+						tools = [...resolved.session.host.mcpSurface.readSurface().tools.map((tool) => ({
+							name: tool.name,
+							label: tool.label,
+							description: tool.description,
+							inputSchema: tool.parameters
+						})), ...require_sessionMcpHandler.SESSION_MCP_EXTRA_TOOLS.map((tool) => ({
+							name: tool.name,
+							label: tool.title ?? tool.name,
+							description: tool.description ?? "",
+							inputSchema: tool.inputSchema
+						}))].flatMap((tool) => {
+							const connections = bindings.filter(({ binding }) => binding.scope === "session" || binding.tools.includes(tool.name)).map(({ client }) => client.name);
+							return connections.length === 0 ? [] : [{
+								...tool,
+								connections
+							}];
+						});
+						available = true;
+					} catch {
+						available = false;
+					}
+					const toolPrefix = bindings[0]?.binding.toolPrefix;
+					return json(200, {
+						...history,
+						enabled: true,
+						available,
+						tools,
+						...toolPrefix === void 0 ? {} : { toolPrefix }
+					});
+				} catch {
+					return json(503, { error: "MCP call history could not be read. Check the host storage." });
+				}
+			}
+			if (resolved === void 0) return json(404, { error: "Session not found." });
+			if (conversationMatch !== null) {
+				const id = conversationMatch[3] === void 0 ? void 0 : decodeURIComponent(conversationMatch[3]);
+				try {
+					if (request.method === "GET" && id === void 0) return json(200, { conversations: requireStore().list().filter((record) => record.parentSessionId === sessionId && record.state !== "closed").map(({ conversationDigest: _digest, clientId: _clientId, ...record }) => record) });
+					if (id !== void 0 && request.method === "DELETE") {
+						if (requireStore().get(id, sessionId).state !== "pending" || options.headlessHub.session(id)) return json(409, { error: "Remove the existing session instead." });
+						requireStore().closeSession(id);
+						publishPending();
+						return json(200, { ok: true });
+					}
+					if (id !== void 0 && request.method === "POST") {
+						const body = await request.json();
+						if (typeof body !== "object" || body === null || !("cwd" in body) || typeof body.cwd !== "string") return json(400, { error: "An execution directory is required." });
+						return json(200, { session: await setupDirectory(id, sessionId, body.cwd) });
+					}
+					return json(405, { error: "Method not allowed." });
+				} catch (error) {
+					return json(409, {
+						error: error instanceof require_index.SessionMcpConversationError ? error.message : "Session setup failed. Recover the existing setup before retrying.",
+						...error instanceof require_index.SessionMcpConversationError ? { code: error.code } : {}
+					});
+				}
+			}
+			if (configMatch !== null) {
+				if (request.method !== "GET") return json(405, { error: "Method not allowed." });
+				const configuredOrigin = origin();
+				if (configuredOrigin === void 0) return json(503, { error: "Session MCP public origin is unavailable." });
+				let surface;
+				try {
+					surface = resolved.session.host.mcpSurface.readSurface();
+				} catch {
+					return json(409, { error: "The session capability surface is not ready." });
+				}
+				if (surface.tools.some((tool) => require_sessionMcpHandler.SESSION_MCP_EXTRA_TOOLS.some((wrapper) => wrapper.name === tool.name))) return json(409, { error: "The session capability surface contains a reserved remote tool name." });
+				return json(200, {
+					audience: `${configuredOrigin}${sessionPath(workspaceId, sessionId)}`,
+					mcpUrl: `${configuredOrigin}${sessionPath(workspaceId, sessionId)}`,
+					mcpAppUrl: `${configuredOrigin}${sessionPath(workspaceId, sessionId)}-app`,
+					authorizationEndpoint: `${configuredOrigin}${AUTHORIZE_ROUTE}`,
+					tokenEndpoint: `${configuredOrigin}${TOKEN_ROUTE}`,
+					tools: [...surface.tools.map(({ name, label, description }) => ({
+						name,
+						label,
+						description
+					})), ...require_sessionMcpHandler.SESSION_MCP_EXTRA_TOOLS.map(({ name, title, description }) => ({
+						name,
+						label: title ?? name,
+						description
+					}))],
+					skills: surface.skills
+				});
+			}
+			if (clientId === void 0 && request.method === "GET") return json(200, { clients: authorization.listClients().flatMap((client) => {
+				const binding = authorization.readAuthorizationBinding(client.clientId);
+				return binding?.sessionId === sessionId ? [publicClient(client, binding)] : [];
+			}) });
+			if (clientId === void 0 && request.method === "POST") {
+				const configuredOrigin = origin();
+				if (configuredOrigin === void 0) return json(503, { error: "Session MCP public origin is unavailable." });
+				let body;
+				try {
+					body = await request.json();
+				} catch {
+					return json(400, { error: "Invalid client request." });
+				}
+				if (typeof body !== "object" || body === null) return json(400, { error: "Invalid client request." });
+				const input = body;
+				if (!options.conversationStore || !options.registrationStore) return json(503, { error: "Mandatory conversation routing requires persistent host state." });
+				if (input.routing !== void 0 && input.routing !== "session" && input.routing !== "conversation") return json(400, { error: "Session MCP routing is not supported." });
+				const routing = require_index$1.sessionMcpRouting(input.routing);
+				if (input.toolPrefix !== void 0 && typeof input.toolPrefix !== "string") return json(400, { error: "Tool prefix must be a string." });
+				const toolPrefix = input.toolPrefix?.trim() || require_index$1.defaultSessionMcpToolPrefix(resolved.session.name);
+				try {
+					require_index$1.sessionMcpToolPrefix(toolPrefix);
+				} catch (error) {
+					return json(400, { error: error.message });
+				}
+				const requestedScope = input.scope;
+				if (requestedScope !== void 0 && requestedScope !== "session" && requestedScope !== "restricted") return json(400, { error: "Authorization scope is not supported." });
+				const scope = requestedScope === "session" ? "session" : "restricted";
+				const hasTools = Object.hasOwn(input, "tools");
+				const hasSkills = Object.hasOwn(input, "skills");
+				const tools = parseStringArray(input.tools);
+				const skills = parseStringArray(input.skills);
+				const authMethod = input.authMethod;
+				const apiKey = authMethod === "api_key";
+				const urlToken = authMethod === "url_token";
+				const nonOAuthCredential = apiKey || urlToken;
+				if (authMethod !== void 0 && authMethod !== "oauth" && !nonOAuthCredential) return json(400, { error: "Authentication method is not supported." });
+				if (nonOAuthCredential && (scope !== "session" || Object.hasOwn(input, "redirectUri"))) return json(400, { error: "Signed URLs and API keys require session scope and no redirectUri." });
+				if (!nonOAuthCredential && typeof input.redirectUri !== "string") return json(400, { error: "A redirectUri is required." });
+				if (scope === "session" && (hasTools || hasSkills)) return json(400, { error: "Session scope cannot include capability grants." });
+				if (scope === "restricted" && (typeof input.name !== "string" || !tools || !skills)) return json(400, { error: "Restricted scope requires a name, tools, and skills." });
+				if (scope === "restricted") {
+					let surface;
+					try {
+						surface = resolved.session.host.mcpSurface.readSurface();
+					} catch {
+						return json(409, { error: "The session capability surface is not ready." });
+					}
+					if (surface.tools.some((tool) => require_sessionMcpHandler.SESSION_MCP_EXTRA_TOOLS.some((wrapper) => wrapper.name === tool.name))) return json(409, { error: "The session capability surface contains a reserved remote tool name." });
+					const activeTools = /* @__PURE__ */ new Set([...surface.tools.map((tool) => tool.name), ...require_sessionMcpHandler.SESSION_MCP_EXTRA_TOOLS.map((tool) => tool.name)]);
+					const activeSkills = new Set(surface.skills.map((skill) => skill.name));
+					if (tools.some((name) => !activeTools.has(name)) || skills.some((name) => !activeSkills.has(name))) return json(400, { error: "Every requested grant must be active in the session." });
+				}
+				try {
+					const client = authorization.createClient(urlToken ? {
+						name: defaultClientName(configuredOrigin),
+						authMethod: "url_token"
+					} : apiKey ? {
+						name: typeof input.name === "string" ? input.name : "API key",
+						authMethod: "api_key"
+					} : {
+						name: scope === "session" ? defaultClientName(configuredOrigin) : input.name,
+						redirectUri: input.redirectUri
+					});
+					const audience = `${configuredOrigin}${sessionPath(workspaceId, sessionId)}`;
+					try {
+						const binding = scope === "session" ? authorization.createAuthorizationBinding({
+							clientId: client.clientId,
+							sessionId,
+							sessionGeneration: resolved.generation,
+							audience,
+							scope: "session",
+							routing,
+							toolPrefix
+						}) : authorization.createAuthorizationBinding({
+							clientId: client.clientId,
+							sessionId,
+							sessionGeneration: resolved.generation,
+							audience,
+							scope: "restricted",
+							routing,
+							toolPrefix,
+							tools: [...new Set(tools)],
+							skills: [...new Set(skills)]
+						});
+						const connectionUrl = urlToken ? `${audience}/${authorization.issueUrlToken(client.clientId)}` : void 0;
+						if (nonOAuthCredential) {
+							const registration = authorization.persistentRegistration(client.clientId, workspaceId, Date.now());
+							if (registration === void 0 || !options.registrationStore.save(registration)) {
+								authorization.revokeClient(client.clientId);
+								return json(500, { error: "Session MCP credential could not be saved." });
+							}
+						}
+						return json(201, { client: {
+							...publicClient(client, binding),
+							...connectionUrl === void 0 ? { clientSecret: client.clientSecret } : {
+								connectionUrl,
+								mcpAppConnectionUrl: `${audience}-app${connectionUrl.slice(audience.length)}`
+							}
+						} });
+					} catch (error) {
+						authorization.revokeClient(client.clientId);
+						throw error;
+					}
+				} catch (error) {
+					return oauthError(error);
+				}
+			}
+			if (clientId !== void 0 && request.method === "DELETE") {
+				if (authorization.readAuthorizationBinding(clientId)?.sessionId !== sessionId) return json(404, { error: "Client not found." });
+				if (options.registrationStore !== void 0 && !options.registrationStore.remove(clientId)) return json(500, { error: "Client revocation could not be saved." });
+				authorization.revokeClient(clientId);
+				for (const presentation of ["pure", "app"]) incarnations.get(sessionId)?.baselines.delete(JSON.stringify([presentation, clientId]));
+				options.conversationStore?.closeClient(clientId);
+				publishPending();
+				return json(200, { ok: true });
+			}
+			return json(405, { error: "Method not allowed." });
+		},
+		close() {
+			unsubscribe();
+			for (const [sessionId, incarnation] of incarnations) {
+				revokeIncarnation(sessionId, incarnation.generation);
+				abortOperations(incarnation.operations);
+			}
+			incarnations.clear();
+			options.activityStore?.close();
+		}
+	};
+}
+function isPublicSessionMcpRoute(method, pathname) {
+	return SESSION_MCP_PATTERN.test(pathname) || SESSION_MCP_URL_TOKEN_PATTERN.test(pathname) || method === "GET" && PROTECTED_RESOURCE_PATTERN.test(pathname) || method === "GET" && (pathname === AUTHORIZATION_SERVER_DISCOVERY || pathname === AUTHORIZE_ROUTE) || method === "POST" && pathname === TOKEN_ROUTE;
+}
+function isSessionMcpHostRoute(pathname) {
+	return SESSION_MCP_ACTIVITY_PATTERN.test(pathname) || SESSION_MCP_CONFIG_PATTERN.test(pathname) || SESSION_MCP_CLIENTS_PATTERN.test(pathname) || SESSION_MCP_CONVERSATIONS_PATTERN.test(pathname);
+}
+//#endregion
+exports.createSessionMcpRoutes = createSessionMcpRoutes;
+exports.isPublicSessionMcpRoute = isPublicSessionMcpRoute;
+exports.isSessionMcpHostRoute = isSessionMcpHostRoute;
+
+//# sourceMappingURL=sessionMcpRoutes.cjs.map