@agimon-ai/po-mcp 0.0.0-alpha.0

package/dist/extensions/server.mjs

@@ -0,0 +1,2839 @@
+import { _ as buildMcpConfigGroups, a as normalizeMcpAppMetadata, d as McpRuntimeOwner, h as readCachedCatalog, i as mcpToolExecutionMetadata, l as readSessionConfig, n as isAppVisibleMcpTool, o as toPiToolName, p as hubCallbackSink, r as isModelVisibleMcpTool, s as DIRECT_TOOLS_ENV, t as McpCatalog, v as __exportAll } from "../mcpCatalog-SlqWS-sb.mjs";
+import { t as mcpSessionConfigFromProjection } from "../projection-gyAA2jRB.mjs";
+import { randomUUID } from "node:crypto";
+import fs, { constants } from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { DOOM_MCP_PROJECTION_RESOLVER_SERVICE, isDoomMcpProjection } from "@agimon-ai/po-core/mcpProjection";
+import { composeServerProviderOverrides, defineServerMethod, defineServerPlugin, readPackageResource, writeSessionAttachment } from "@agimon-ai/po-core/serverFacet";
+import { composeRootHooks, defineResource, defineRoot, defineRoute, defineRoutedContribution, defineServerCommand } from "@agimon-ai/po-core/extensionFile";
+import { DOOM_CHILD_SESSION_MCP_TOOL_SERVICE } from "@agimon-ai/po-core/childSession";
+import { DOOM_HEADLESS_HOST_SERVICE } from "@agimon-ai/po-core/headless";
+import { DOOM_MCP_STATUS_SERVICE } from "@agimon-ai/po-core/mcpStatus";
+import { DOOM_MCP_TOOL_RESOLVER_SERVICE } from "@agimon-ai/po-core/mcpToolResolver";
+import { Value } from "typebox/value";
+import { Type } from "typebox";
+import dns from "node:dns/promises";
+import https from "node:https";
+import net from "node:net";
+import fs$1 from "node:fs/promises";
+import { defineDoomPluginMethod } from "@agimon-ai/po-core/pluginProtocol";
+import { loadHarnessState } from "@agimon-ai/po-config/harnessStore";
+import { CONTEXT_TOOL_WARNINGS_STATUS_KEY } from "@agimon-ai/po-core/contextApi";
+import { FileTokenStore } from "@agimon-ai/mcp-proxy";
+import { apiResponse, defineApiRoutes } from "@agimon-ai/po-core/web";
+import { DOOM_HELP_WHEN } from "@agimon-ai/po-core/help";
+//#region src/schemas/fileTransfer.ts
+const ShareFileParameters = Type.Object({ path: Type.String({ minLength: 1 }) }, { additionalProperties: false });
+const SaveFileParameters = Type.Object({
+	file: Type.Union([Type.Object({
+		download_url: Type.String(),
+		file_name: Type.String(),
+		file_id: Type.Optional(Type.String()),
+		mime_type: Type.Optional(Type.String())
+	}, { additionalProperties: false }), Type.Object({
+		name: Type.String(),
+		data_base64: Type.String()
+	}, { additionalProperties: false })]),
+	path: Type.Optional(Type.String())
+}, { additionalProperties: false });
+//#endregion
+//#region src/services/fileTransfer/download.ts
+const MAX_BYTES = 26214400;
+/** Conservative public-address allowlist. IPv6 is limited to global unicast, excluding special ranges. */
+function isPublicAddress(address) {
+	if (net.isIP(address) === 4) {
+		const [a, b] = address.split(".").map(Number);
+		return !(a === 0 || a === 10 || a === 127 || a >= 224 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && (b === 168 || b === 0 || b === 2) || a === 198 && (b === 18 || b === 19 || b === 51) || a === 203 && b === 0);
+	}
+	return net.isIP(address) === 6 && /^[23]/u.test(address) && !/^(2001:|2002:|3fff:)/iu.test(address);
+}
+async function downloadPublicFile(input, cancellation) {
+	const signal = AbortSignal.any([AbortSignal.timeout(3e4), ...cancellation ? [cancellation] : []]);
+	let url = new URL(input);
+	for (let redirects = 0;; redirects += 1) {
+		signal.throwIfAborted();
+		if (url.protocol !== "https:" || url.username || url.password) throw new Error("Only public HTTPS URLs without credentials are accepted.");
+		const hostname = url.hostname.replace(/^\[|\]$/gu, "");
+		const addresses = net.isIP(hostname) ? [{
+			address: hostname,
+			family: net.isIP(hostname)
+		}] : await new Promise((resolve, reject) => {
+			const abort = () => reject(signal.reason);
+			signal.addEventListener("abort", abort, { once: true });
+			dns.lookup(hostname, { all: true }).then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+			if (signal.aborted) abort();
+		});
+		signal.throwIfAborted();
+		if (!addresses.length || addresses.some(({ address }) => !isPublicAddress(address))) throw new Error("URL must resolve only to public addresses.");
+		const pinned = addresses[0];
+		const result = await new Promise((resolve, reject) => {
+			https.get(url, {
+				signal,
+				agent: false,
+				lookup: (_host, options, callback) => {
+					if (typeof options === "object" && options.all) callback(null, [pinned]);
+					else callback(null, pinned.address, pinned.family);
+				}
+			}, (response) => {
+				const status = response.statusCode ?? 0;
+				if ([
+					301,
+					302,
+					303,
+					307,
+					308
+				].includes(status)) {
+					response.destroy();
+					if (redirects >= 3 || !response.headers.location) reject(/* @__PURE__ */ new Error("Too many redirects or missing redirect location."));
+					else try {
+						resolve(new URL(response.headers.location, url));
+					} catch (error) {
+						reject(error);
+					}
+					return;
+				}
+				if (status !== 200 || Number(response.headers["content-length"]) > MAX_BYTES) {
+					response.destroy();
+					reject(/* @__PURE__ */ new Error("Download refused: status or size limit."));
+					return;
+				}
+				const chunks = [];
+				let size = 0;
+				response.on("data", (chunk) => {
+					size += chunk.length;
+					if (size > MAX_BYTES) response.destroy(/* @__PURE__ */ new Error("Download exceeds 25 MiB."));
+					else chunks.push(chunk);
+				});
+				response.on("error", reject);
+				response.on("aborted", () => reject(/* @__PURE__ */ new Error("Download response was interrupted.")));
+				response.on("close", () => {
+					if (!response.complete) reject(/* @__PURE__ */ new Error("Download response was interrupted."));
+				});
+				response.on("end", () => resolve(Buffer.concat(chunks, size)));
+			}).on("error", reject);
+		});
+		if (Buffer.isBuffer(result)) return result;
+		url = result;
+	}
+}
+function decodeFileBase64(data) {
+	if (data.length > 4 * Math.ceil(5242880 / 3) || data.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/u.test(data)) throw new Error("Invalid or oversized base64 file.");
+	const size = data.length / 4 * 3 - (data.endsWith("==") ? 2 : data.endsWith("=") ? 1 : 0);
+	if (size < 0 || data.includes("=") && data.length < 4) throw new Error("Invalid base64 padding.");
+	if (size > 5242880) throw new Error("Base64 file exceeds 5 MiB.");
+	return Buffer.from(data, "base64");
+}
+//#endregion
+//#region src/services/fileTransfer/storage.ts
+/** Existing parents only, pinned by identity before and after exclusive creation. */
+async function writeCwdFile(cwd, relative, bytes) {
+	if (!relative || path.isAbsolute(relative) || relative.includes("\\") || relative.includes("\0") || relative.split("/").some((part) => !part || part === "." || part === "..")) throw new Error("Path must be relative without traversal.");
+	const root = await fs$1.realpath(cwd);
+	const target = path.join(root, relative);
+	const parents = [root];
+	for (const segment of relative.split("/").slice(0, -1)) parents.push(path.join(parents.at(-1), segment));
+	const identities = await Promise.all(parents.map(async (parent) => {
+		const stat = await fs$1.lstat(parent);
+		if (!stat.isDirectory() || stat.isSymbolicLink() || await fs$1.realpath(parent) !== parent) throw new Error("Unsafe parent directory.");
+		return stat;
+	}));
+	const check = async () => {
+		for (let i = 0; i < parents.length; i += 1) {
+			const stat = await fs$1.lstat(parents[i]);
+			if (stat.dev !== identities[i].dev || stat.ino !== identities[i].ino || await fs$1.realpath(parents[i]) !== parents[i]) throw new Error("Parent directory changed.");
+		}
+	};
+	await check();
+	const handle = await fs$1.open(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+	try {
+		const identity = await handle.stat();
+		const checkFile = async () => {
+			const named = await fs$1.lstat(target);
+			if (named.dev !== identity.dev || named.ino !== identity.ino || await fs$1.realpath(target) !== target) throw new Error("File identity changed.");
+		};
+		await check();
+		await checkFile();
+		await handle.writeFile(bytes);
+		await check();
+		await checkFile();
+		return target;
+	} catch (error) {
+		await handle.truncate(0);
+		throw error;
+	} finally {
+		await handle.close();
+	}
+}
+//#endregion
+//#region src/services/fileTransfer/index.ts
+function createFileTransferTools(owner) {
+	return [{
+		name: "share_file",
+		description: "Publish a session file as a short-lived public download link. No consent prompt.",
+		parameters: ShareFileParameters,
+		_meta: { "doompi/fileTransfer": true },
+		async execute(_id, input, signal) {
+			const executionSignal = AbortSignal.any([...signal ? [signal] : [], ...owner?.signal ? [owner.signal] : []]);
+			executionSignal.throwIfAborted();
+			if (!Value.Check(ShareFileParameters, input)) throw new Error("Invalid share_file parameters.");
+			const host = owner?.host.context;
+			if (!host?.shareFile) throw new Error("File sharing is unavailable.");
+			const shared = await host.shareFile(input.path, "share_file");
+			if (executionSignal.aborted) {
+				shared.revoke();
+				executionSignal.throwIfAborted();
+			}
+			const result = {
+				url: shared.url,
+				fileName: shared.fileName,
+				mimeType: shared.mimeType,
+				size: shared.size,
+				expiresAt: shared.expiresAt,
+				maxDownloads: shared.maxDownloads
+			};
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(result)
+				}],
+				structuredContent: { ...result }
+			};
+		}
+	}, {
+		name: "save_file",
+		description: "Save a public HTTPS file (25 MiB maximum) or base64 file (5 MiB maximum) to session attachments or a new relative cwd path.",
+		parameters: SaveFileParameters,
+		_meta: {
+			"doompi/fileTransfer": true,
+			"openai/fileParams": ["file"]
+		},
+		async execute(_id, input, cancellation) {
+			if (!Value.Check(SaveFileParameters, input)) throw new Error("Provide exactly one file form.");
+			const context = owner?.agent?.context;
+			if (!context) throw new Error("Session file storage is unavailable.");
+			const signal = AbortSignal.any([...cancellation ? [cancellation] : [], ...owner?.signal ? [owner.signal] : []]);
+			signal.throwIfAborted();
+			const file = input.file;
+			const bytes = "download_url" in file ? await downloadPublicFile(file.download_url, signal) : decodeFileBase64(file.data_base64);
+			signal.throwIfAborted();
+			const name = "download_url" in file ? file.file_name : file.name;
+			const result = input.path === void 0 ? await writeSessionAttachment(context.sessionId, name, bytes, context.environment) : {
+				path: await writeCwdFile(context.cwd, input.path, bytes),
+				name: path.basename(input.path),
+				size: bytes.length,
+				mimeType: "application/octet-stream"
+			};
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(result)
+				}],
+				structuredContent: { ...result }
+			};
+		}
+	}];
+}
+//#endregion
+//#region src/schemas/mcpApps.ts
+const Lease = Type.String({
+	minLength: 1,
+	maxLength: 128
+});
+const JsonObject = Type.Record(Type.String(), Type.Unknown());
+const Empty = Type.Object({}, { additionalProperties: false });
+const Result = Type.Object({
+	content: Type.Array(Type.Unknown()),
+	structuredContent: Type.Optional(Type.Unknown()),
+	_meta: Type.Optional(JsonObject),
+	isError: Type.Optional(Type.Boolean())
+});
+const Address = {
+	service: "mcp.apps",
+	scope: "session",
+	direction: "client-to-server"
+};
+const mcpAppOpenMethod = defineDoomPluginMethod({
+	...Address,
+	method: "open",
+	input: Type.Object({ toolCallId: Type.String({
+		minLength: 1,
+		maxLength: 512
+	}) }, { additionalProperties: false }),
+	output: Type.Object({
+		leaseId: Lease,
+		html: Type.String(),
+		resourceUri: Type.String(),
+		protocol: Type.Union([Type.Literal("mcp"), Type.Literal("openai")]),
+		resourceMeta: JsonObject,
+		tool: Type.Object({
+			name: Type.String(),
+			description: Type.String(),
+			inputSchema: Type.Object({ type: Type.Literal("object") }, { additionalProperties: true }),
+			_meta: JsonObject
+		}),
+		args: JsonObject,
+		result: Result,
+		state: Type.Unknown(),
+		readOnly: Type.Boolean()
+	})
+});
+const mcpAppActivateMethod = defineDoomPluginMethod({
+	...Address,
+	method: "activate",
+	input: Type.Object({ leaseId: Lease }, { additionalProperties: false }),
+	output: Type.Object({ readOnly: Type.Literal(false) })
+});
+const mcpAppCallToolMethod = defineDoomPluginMethod({
+	...Address,
+	method: "callTool",
+	input: Type.Object({
+		leaseId: Lease,
+		name: Type.String({
+			minLength: 1,
+			maxLength: 256
+		}),
+		arguments: JsonObject
+	}, { additionalProperties: false }),
+	output: Result
+});
+const mcpAppSetStateMethod = defineDoomPluginMethod({
+	...Address,
+	method: "setState",
+	input: Type.Object({
+		leaseId: Lease,
+		state: Type.Unknown()
+	}, { additionalProperties: false }),
+	output: Empty
+});
+const mcpAppFollowUpMethod = defineDoomPluginMethod({
+	...Address,
+	method: "followUp",
+	input: Type.Object({
+		leaseId: Lease,
+		prompt: Type.String({
+			minLength: 1,
+			maxLength: 16e3
+		})
+	}, { additionalProperties: false }),
+	output: Empty
+});
+const mcpAppCloseMethod = defineDoomPluginMethod({
+	...Address,
+	method: "close",
+	input: Type.Object({ leaseId: Lease }, { additionalProperties: false }),
+	output: Empty
+});
+//#endregion
+//#region src/services/mcpFileParams/index.ts
+/** ChatGPT Apps metadata naming the top-level arguments that carry a file. */
+const FILE_PARAMS_META_KEY = "openai/fileParams";
+const MAX_FILE_PARAMS = 16;
+const FILE_ID_PREFIX = "doomfile_";
+const FILE_SHARE_ENTRY_TYPE = "mcp.file.share";
+const CONSENT_TIMEOUT_MS = 12e4;
+const NO_PUBLISHER = "This MCP tool takes a file, which needs the Po web host with remote access on.";
+function record$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function filePath(value) {
+	const path = record$1(value)?.path;
+	return typeof path === "string" ? path : void 0;
+}
+/** Declared file parameters that the input schema really has at its top level. */
+function fileParamNames(tool) {
+	const declared = tool._meta?.[FILE_PARAMS_META_KEY];
+	const properties = record$1(tool.inputSchema.properties);
+	if (!Array.isArray(declared) || properties === void 0) return [];
+	const names = declared.filter((name) => typeof name === "string" && Object.hasOwn(properties, name));
+	return [...new Set(names)].slice(0, MAX_FILE_PARAMS);
+}
+/** What the model is asked for: a `{path}` object in place of each server file shape. */
+function modelInputSchema(tool) {
+	if (Object.keys(tool.inputSchema).length === 0) return {
+		type: "object",
+		properties: {}
+	};
+	const names = fileParamNames(tool);
+	if (names.length === 0) return tool.inputSchema;
+	const properties = { ...record$1(tool.inputSchema.properties) };
+	for (const name of names) {
+		const description = record$1(properties[name])?.description;
+		properties[name] = {
+			type: "object",
+			description: `${typeof description === "string" ? description : "A file."} Pass {"path": "<file in the working directory, or the path from an Attached file note>"}.`,
+			properties: { path: { type: "string" } },
+			required: ["path"],
+			additionalProperties: false
+		};
+	}
+	return {
+		...tool.inputSchema,
+		properties
+	};
+}
+/**
+* Swaps each `{path}` file argument for a published link, on a copy.
+*
+* Runs before the server is dialled, so a refused share never reaches it. Values that
+* are not `{path}` objects pass through, including a file a widget already shaped.
+*/
+async function publishFileParams(tool, params, publish) {
+	const names = fileParamNames(tool).filter((name) => filePath(params[name]) !== void 0);
+	if (names.length === 0) return {
+		outbound: params,
+		release: () => void 0
+	};
+	if (publish === void 0) throw new Error(NO_PUBLISHER);
+	const outbound = { ...params };
+	const shared = [];
+	const release = () => {
+		for (const file of shared.splice(0)) file.revoke();
+	};
+	try {
+		for (const name of names) {
+			const file = await publish(filePath(params[name]));
+			shared.push(file);
+			outbound[name] = {
+				file_id: `${FILE_ID_PREFIX}${crypto.randomUUID()}`,
+				download_url: file.url,
+				file_name: file.fileName,
+				mime_type: file.mimeType
+			};
+		}
+	} catch (error) {
+		release();
+		throw error;
+	}
+	return {
+		outbound,
+		release
+	};
+}
+/**
+* Publishes a file only after the user approves it for this server and tool.
+*
+* The host mints first so the dialog can name the file and its size; the link leaves
+* this function only on approval. No client, no answer within two minutes, a
+* cancelled call, or a failed audit all revoke it.
+*/
+function createConsentedFilePublisher(options) {
+	return async (path, tool, signal) => {
+		const label = `${tool.serverName} / ${tool.toolName}`;
+		const shared = await options.shareFile(path, label);
+		try {
+			const host = options.host();
+			if (host === void 0) throw new Error(`There is no Po client to approve sharing "${shared.fileName}".`);
+			const deadline = new AbortController();
+			const timer = setTimeout(() => deadline.abort(/* @__PURE__ */ new Error("No answer within two minutes.")), CONSENT_TIMEOUT_MS);
+			const abort = AbortSignal.any([
+				deadline.signal,
+				signal,
+				options.signal
+			].filter((candidate) => candidate !== void 0));
+			const abandoned = new Promise((_resolve, reject) => {
+				if (abort.aborted) reject(abort.reason);
+				abort.addEventListener("abort", () => reject(abort.reason), { once: true });
+			});
+			const answer = await Promise.race([host.context.client.request({
+				kind: "confirm",
+				title: "Share a file with an MCP server?",
+				message: `Share "${shared.fileName}" (${shared.size} bytes) with ${label}? Po publishes it at a link on your remote-access tunnel until this call finishes (10 minutes at most). Cloudflare and ${tool.serverName} can read the file.`
+			}, abort), abandoned]).then((accepted) => accepted === true ? "shared" : "declined", () => "unanswered").finally(() => clearTimeout(timer));
+			await host.context.session.appendCustomEntry(FILE_SHARE_ENTRY_TYPE, {
+				file: shared.fileName,
+				server: tool.serverName,
+				tool: tool.toolName,
+				outcome: answer
+			});
+			if (answer !== "shared") throw new Error(`The user declined to share "${shared.fileName}".`);
+			return shared;
+		} catch (error) {
+			shared.revoke();
+			throw error;
+		}
+	};
+}
+//#endregion
+//#region src/services/mcpTools/index.ts
+const MAX_APP_RESULT_BYTES = 1048576;
+const appSnapshots = /* @__PURE__ */ new WeakMap();
+/** Clone before output guards can replace structured data or mutate the source. */
+function captureMcpAppResult(tool, result) {
+	const app = normalizeMcpAppMetadata(tool._meta);
+	if (!app.appVisible && !app.resourceUri) return void 0;
+	try {
+		const json = JSON.stringify(result);
+		if (Buffer.byteLength(json, "utf8") > MAX_APP_RESULT_BYTES) return void 0;
+		return {
+			version: 1,
+			...app.resourceUri === void 0 ? {} : {
+				resourceUri: app.resourceUri,
+				protocol: app.protocol
+			},
+			result: JSON.parse(json)
+		};
+	} catch {
+		return;
+	}
+}
+/** Historical details are untrusted JSON; reject malformed or unbounded snapshots. */
+function parseMcpAppSnapshot(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const record = value;
+	if (record.version !== 1 || typeof record.result !== "object" || record.result === null || Array.isArray(record.result)) return void 0;
+	if (record.resourceUri !== void 0 && (typeof record.resourceUri !== "string" || !record.resourceUri.startsWith("ui://") || record.resourceUri.length > 8192)) return void 0;
+	if (record.protocol !== void 0 && record.protocol !== "mcp" && record.protocol !== "openai") return void 0;
+	if (record.resourceUri === void 0 !== (record.protocol === void 0)) return void 0;
+	const result = record.result;
+	if (!Array.isArray(result.content) || result.isError !== void 0 && typeof result.isError !== "boolean") return void 0;
+	if (result.content.some((block) => typeof block !== "object" || block === null || !("type" in block) || typeof block.type !== "string")) return void 0;
+	try {
+		const json = JSON.stringify(value);
+		if (Buffer.byteLength(json, "utf8") > MAX_APP_RESULT_BYTES) return void 0;
+		return JSON.parse(json);
+	} catch {
+		return;
+	}
+}
+/** Associate the original private payload with the guarded result without widening MCP wire output. */
+function retainMcpAppResult(result, snapshot) {
+	if (snapshot) appSnapshots.set(result, snapshot);
+}
+/** The text of a downstream result: its text blocks joined, which is what the model reads. */
+function resultText(result) {
+	return (result.content ?? []).flatMap((block) => block.type === "text" ? [block.text] : []).join("\n").trim();
+}
+/** The image blocks, re-emitted as Pi's own image content so the model and the cockpit both see them. */
+function resultImages(result) {
+	return (result.content ?? []).flatMap((block) => block.type === "image" ? [{
+		type: "image",
+		data: block.data,
+		mimeType: block.mimeType
+	}] : []);
+}
+/**
+* Everything else a downstream result carried: audio, resource links, embedded
+* resources, and the structured content. Pi's content cannot hold them, so
+* they ride the result's details for the cockpit's MCP message to render.
+*/
+function resultBlocks(result) {
+	const blocks = [];
+	for (const block of result.content ?? []) if (block.type === "audio") blocks.push({
+		type: "audio",
+		data: block.data,
+		mimeType: block.mimeType
+	});
+	else if (block.type === "resource_link") blocks.push({
+		type: "resource_link",
+		uri: block.uri,
+		name: block.name,
+		...block.title === void 0 ? {} : { title: block.title },
+		...block.description === void 0 ? {} : { description: block.description },
+		...block.mimeType === void 0 ? {} : { mimeType: block.mimeType }
+	});
+	else if (block.type === "resource") {
+		const resource = block.resource;
+		blocks.push({
+			type: "resource",
+			uri: resource.uri,
+			...resource.mimeType === void 0 ? {} : { mimeType: resource.mimeType },
+			..."text" in resource && typeof resource.text === "string" ? { text: resource.text } : {},
+			..."blob" in resource && typeof resource.blob === "string" ? { blob: resource.blob } : {}
+		});
+	}
+	const structured = structuredRecord(result);
+	if (structured !== void 0) blocks.push({
+		type: "structured",
+		value: structured
+	});
+	return blocks;
+}
+/**
+* MCP v2 allows any JSON value as structured content; Po's contract carries an object, which
+* is all v1 permitted. Any other value still reaches the model through the text fallback.
+*/
+function structuredRecord(result) {
+	const value = result.structuredContent;
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+/** Remote MCP preserves error flags and public structured results instead of Pi's thrown-error convention. */
+function toHeadlessToolResult(tool, result) {
+	const text = resultText(result) || (result.structuredContent === void 0 ? "No output." : JSON.stringify(result.structuredContent));
+	const blocks = resultBlocks(result);
+	const structured = structuredRecord(result);
+	const app = appSnapshots.get(result) ?? (normalizeMcpAppMetadata(tool._meta).resourceUri === void 0 ? void 0 : captureMcpAppResult(tool, result));
+	return {
+		content: [{
+			type: "text",
+			text
+		}, ...resultImages(result)],
+		...structured === void 0 ? {} : { structuredContent: structured },
+		...result.isError === void 0 ? {} : { isError: result.isError },
+		...result._meta === void 0 ? {} : { _meta: result._meta },
+		details: {
+			server: tool.serverName,
+			tool: tool.toolName,
+			...blocks.length > 0 ? { blocks } : {},
+			...app === void 0 ? {} : { app }
+		}
+	};
+}
+//#endregion
+//#region src/services/mcpApps/index.ts
+const STATE_ENTRY = "mcp.app.state";
+const MAX_HTML_BYTES = 2097152;
+const MAX_RESULT_BYTES = 1048576;
+const MAX_STATE_BYTES = 65536;
+const MAX_LEASES = 64;
+function record(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function boundedJson(value, limit, label) {
+	const encoded = JSON.stringify(value);
+	if (encoded === void 0 || Buffer.byteLength(encoded) > limit) throw new Error(`${label} exceeds its size limit.`);
+	return JSON.parse(encoded);
+}
+/** Browser inputs identify a persisted invocation, never an upstream server or resource. */
+function createMcpAppsService(tools, getHost, lifetime) {
+	const leases = /* @__PURE__ */ new Map();
+	let disposed = false;
+	let opening = 0;
+	const revoke = (lease) => {
+		leases.delete(lease.id);
+		lease.controller.abort();
+	};
+	const check = (lease) => {
+		lease.signal.throwIfAborted();
+		if (disposed || getHost() !== lease.host) throw new Error("App session is no longer available.");
+		lease.host.assertActive();
+		const surface = lease.host.toolSurface;
+		const current = surface?.readSurface();
+		if (!surface || current?.revision !== lease.revision || tools.runtimeRevision() !== lease.runtimeRevision) throw new Error("App permissions changed. Reopen the App.");
+		const source = tools.snapshot().find((tool) => tool.serverName === lease.server && tool.toolName === lease.tool);
+		if (!source || normalizeMcpAppMetadata(source._meta).resourceUri !== lease.resourceUri) throw new Error("App resource is no longer available.");
+		if (!current.tools.some((tool) => tool.name === source.piName || tool.name === "mcp")) throw new Error("The original App tool is not admitted in this session.");
+		return surface;
+	};
+	const owned = (id, caller) => {
+		caller.signal?.throwIfAborted();
+		const lease = leases.get(id);
+		if (!lease || !caller.connectionId || lease.connectionId !== caller.connectionId) throw new Error("App lease is not owned by this connection.");
+		try {
+			check(lease);
+		} catch (error) {
+			revoke(lease);
+			throw error;
+		}
+		return lease;
+	};
+	const operation = async (id, caller, write, run) => {
+		const lease = owned(id, caller);
+		if (write && lease.readOnly) throw new Error("Enable App interactions before performing this action.");
+		if (lease.busy) throw new Error("An App action is already in progress.");
+		if (++lease.actions > 256) throw new Error("App action limit reached. Reopen the App.");
+		lease.busy = true;
+		try {
+			return await run(lease);
+		} finally {
+			lease.busy = false;
+		}
+	};
+	const confirm = async (lease, title, message) => {
+		check(lease);
+		const accepted = await lease.host.context.client.request({
+			kind: "confirm",
+			title,
+			message
+		}, AbortSignal.any([lease.signal, AbortSignal.timeout(12e4)]));
+		check(lease);
+		if (accepted !== true) throw new Error("App action was not approved.");
+	};
+	const invocation = async (host, toolCallId) => {
+		const entries = await host.context.session.entries({ type: "message" });
+		let call;
+		let result;
+		for (const entry of entries) {
+			const message = record(entry.message);
+			if (message?.role === "assistant" && Array.isArray(message.content)) for (const block of message.content) {
+				const candidate = record(block);
+				if (candidate?.type === "toolCall" && candidate.id === toolCallId) call = candidate;
+			}
+			if (message?.role === "toolResult" && message.toolCallId === toolCallId) result = message;
+		}
+		const details = record(result?.details);
+		const app = parseMcpAppSnapshot(details?.app);
+		if (!call || !app?.resourceUri || !app.protocol || typeof details?.server !== "string" || typeof details.tool !== "string") throw new Error("This invocation has no retained App result.");
+		return {
+			call,
+			details,
+			app
+		};
+	};
+	const stopTools = tools.onChange(() => {
+		for (const lease of leases.values()) try {
+			check(lease);
+		} catch {
+			revoke(lease);
+		}
+	});
+	const dispose = () => {
+		disposed = true;
+		stopTools();
+		for (const lease of leases.values()) revoke(lease);
+	};
+	lifetime?.addEventListener("abort", dispose, { once: true });
+	return {
+		dispose,
+		methods: [
+			defineServerMethod(mcpAppOpenMethod, async ({ toolCallId }, caller) => {
+				if (!caller.connectionId || !caller.signal) throw new Error("An authenticated live connection is required.");
+				caller.signal.throwIfAborted();
+				if (disposed || lifetime?.aborted) throw new Error("App session is no longer available.");
+				if (leases.size + opening >= MAX_LEASES) throw new Error("Too many open Apps. Close an App before opening another.");
+				opening++;
+				try {
+					const host = getHost();
+					if (!host?.toolSurface) throw new Error("App execution is unavailable in this session.");
+					host.assertActive();
+					const revision = host.toolSurface.readSurface().revision;
+					const runtimeRevision = tools.runtimeRevision();
+					const { call, details, app } = await invocation(host, toolCallId);
+					const source = tools.snapshot().find((tool) => tool.serverName === details.server && tool.toolName === details.tool);
+					const declared = normalizeMcpAppMetadata(source?._meta);
+					if (!source || declared.resourceUri !== app.resourceUri || declared.protocol !== app.protocol) throw new Error("The original App resource is no longer declared.");
+					const args = record(call.arguments) ?? {};
+					const generic = call.name === "mcp" && args.server === source.serverName && args.tool === source.toolName;
+					if (call.name !== source.piName && !generic) throw new Error("App invocation identity does not match its tool.");
+					const controller = new AbortController();
+					const lease = {
+						id: randomUUID(),
+						connectionId: caller.connectionId,
+						host,
+						toolCallId,
+						server: source.serverName,
+						tool: source.toolName,
+						resourceUri: app.resourceUri,
+						revision,
+						runtimeRevision,
+						controller,
+						signal: AbortSignal.any([
+							controller.signal,
+							caller.signal,
+							...lifetime ? [lifetime] : []
+						]),
+						readOnly: true,
+						busy: false,
+						actions: 0
+					};
+					check(lease);
+					const resource = await tools.readAppResource(lease.server, lease.tool, lease.resourceUri, lease.signal);
+					check(lease);
+					const content = resource.contents.find((item) => item.uri === lease.resourceUri && "text" in item);
+					if (!content || !("text" in content) || typeof content.text !== "string") throw new Error("App resource must contain HTML text.");
+					if (content.mimeType !== "text/html;profile=mcp-app" && content.mimeType !== "text/html+skybridge") throw new Error("Unsupported App resource MIME type.");
+					if (Buffer.byteLength(content.text) > MAX_HTML_BYTES) throw new Error("App HTML exceeds its size limit.");
+					const states = await host.context.session.entries({
+						type: "custom",
+						customType: STATE_ENTRY
+					});
+					let state = null;
+					for (const entry of states) {
+						const data = record(entry.data);
+						if (data?.version === 1 && data.toolCallId === toolCallId && data.server === lease.server && data.tool === lease.tool && data.resourceUri === lease.resourceUri) state = data.state ?? null;
+					}
+					check(lease);
+					if (leases.size >= MAX_LEASES) throw new Error("Too many open Apps.");
+					const opened = {
+						leaseId: lease.id,
+						html: content.text,
+						resourceUri: lease.resourceUri,
+						protocol: app.protocol,
+						resourceMeta: boundedJson(record(content._meta) ?? record(resource._meta) ?? {}, MAX_STATE_BYTES, "Resource metadata"),
+						tool: {
+							name: source.toolName,
+							description: source.description ?? "",
+							inputSchema: boundedJson({
+								...source.inputSchema,
+								type: "object"
+							}, MAX_STATE_BYTES, "Tool schema"),
+							_meta: boundedJson(source._meta ?? {}, MAX_STATE_BYTES, "Tool metadata")
+						},
+						args: boundedJson(generic ? record(args.arguments) ?? {} : args, MAX_STATE_BYTES, "Tool input"),
+						result: app.result,
+						state: boundedJson(state, MAX_STATE_BYTES, "App state"),
+						readOnly: true
+					};
+					leases.set(lease.id, lease);
+					lease.signal.addEventListener("abort", () => leases.delete(lease.id), { once: true });
+					return opened;
+				} finally {
+					opening--;
+				}
+			}),
+			defineServerMethod(mcpAppActivateMethod, ({ leaseId }, caller) => operation(leaseId, caller, false, async (lease) => {
+				await confirm(lease, `Enable ${lease.server} App interactions?`, "This App may request tool calls and follow-up messages. Each action still requires approval.");
+				lease.readOnly = false;
+				return { readOnly: false };
+			})),
+			defineServerMethod(mcpAppCallToolMethod, ({ leaseId, name, arguments: args }, caller) => operation(leaseId, caller, true, async (lease) => {
+				boundedJson(args, MAX_STATE_BYTES, "Tool arguments");
+				const target = tools.snapshot().find((tool) => tool.serverName === lease.server && tool.toolName === name && isAppVisibleMcpTool(tool));
+				if (!target) throw new Error("This tool is not available to this App.");
+				const surface = check(lease);
+				const exposed = surface.readSurface().tools;
+				const direct = exposed.some((tool) => tool.name === target.piName);
+				if (!direct && !exposed.some((tool) => tool.name === "mcp")) throw new Error("This tool is not admitted in this session.");
+				await confirm(lease, `Allow ${lease.server} App to call ${name}?`, JSON.stringify(args, null, 2));
+				const result = await surface.invokeTool({
+					revision: lease.revision,
+					name: direct ? target.piName : "mcp",
+					arguments: direct ? args : {
+						server: lease.server,
+						tool: name,
+						arguments: args
+					},
+					signal: AbortSignal.any([lease.signal, AbortSignal.timeout(12e4)]),
+					authorize: () => {
+						check(lease);
+					}
+				});
+				check(lease);
+				return parseMcpAppSnapshot(record(result.details)?.app)?.result ?? boundedJson({
+					content: result.content,
+					...result.structuredContent === void 0 ? {} : { structuredContent: result.structuredContent },
+					...result._meta === void 0 ? {} : { _meta: result._meta },
+					...result.isError === void 0 ? {} : { isError: result.isError }
+				}, MAX_RESULT_BYTES, "Tool result");
+			})),
+			defineServerMethod(mcpAppSetStateMethod, ({ leaseId, state }, caller) => operation(leaseId, caller, false, async (lease) => {
+				const saved = boundedJson(state, MAX_STATE_BYTES, "App state");
+				await lease.host.context.session.appendCustomEntry(STATE_ENTRY, {
+					version: 1,
+					toolCallId: lease.toolCallId,
+					server: lease.server,
+					tool: lease.tool,
+					resourceUri: lease.resourceUri,
+					state: saved
+				});
+				check(lease);
+				return {};
+			})),
+			defineServerMethod(mcpAppFollowUpMethod, ({ leaseId, prompt }, caller) => operation(leaseId, caller, true, async (lease) => {
+				const session = lease.host.context.session;
+				if (!session.admitPrompt) throw new Error("App follow-up messages are unavailable in this session.");
+				await confirm(lease, `Send a follow-up from ${lease.server}?`, prompt);
+				await session.admitPrompt(`[MCP App ${lease.server}/${lease.tool}, invocation ${lease.toolCallId}]\n${prompt}`, "followUp");
+				check(lease);
+				return {};
+			})),
+			defineServerMethod(mcpAppCloseMethod, ({ leaseId }, caller) => {
+				const lease = leases.get(leaseId);
+				if (lease && lease.connectionId !== caller.connectionId) throw new Error("App lease is not owned by this connection.");
+				if (lease) revoke(lease);
+				return {};
+			})
+		]
+	};
+}
+//#endregion
+//#region src/services/mcpHeadlessTools/index.ts
+const MCP_HEADLESS_TOOLS_SERVICE = "doom/mcp-headless-tools";
+function mountMcpHeadlessTools(tools) {
+	return (context) => {
+		context.plugin((providerContext) => {
+			providerContext.provide(MCP_HEADLESS_TOOLS_SERVICE, { get: (name) => tools.find((tool) => tool.name === name) });
+		});
+	};
+}
+//#endregion
+//#region src/schemas/mcpHeadlessTool.ts
+const McpHeadlessToolParameters = Type.Object({
+	server: Type.String({ minLength: 1 }),
+	tool: Type.String({ minLength: 1 }),
+	arguments: Type.Optional(Type.Record(Type.String(), Type.Unknown()))
+});
+//#endregion
+//#region src/services/mcpSessionTools/index.ts
+const MCP_SESSION_TOOLS_SERVICE = "doom/mcp-session-tools";
+function createMcpSessionToolsService(session, generation, assertAvailable = () => void 0) {
+	let disposed = false;
+	const listeners = /* @__PURE__ */ new Set();
+	const retained = /* @__PURE__ */ new Map();
+	const snapshot = () => {
+		try {
+			if (disposed) return [];
+			assertAvailable();
+			return session.activeToolDefinitions();
+		} catch {
+			return [];
+		}
+	};
+	const project = () => {
+		const definitions = snapshot();
+		const names = new Set(definitions.map((tool) => tool.piName));
+		for (const [name, entry] of retained) {
+			if (names.has(name)) continue;
+			entry.retire();
+			retained.delete(name);
+		}
+		return definitions.map((definition) => {
+			const fingerprint = JSON.stringify([session.toolGeneration, definition]);
+			const previous = retained.get(definition.piName);
+			if (previous?.fingerprint === fingerprint) return previous.tool;
+			previous?.retire();
+			let retired = false;
+			const invoke = session.bindToolInvocation(definition);
+			const tool = {
+				name: definition.piName,
+				label: `${definition.serverName}: ${definition.toolName}`,
+				description: definition.description ?? `${definition.toolName} on the ${definition.serverName} MCP server.`,
+				...definition.annotations === void 0 ? {} : { annotations: definition.annotations },
+				...definition._meta === void 0 ? {} : { _meta: mcpToolExecutionMetadata(definition) },
+				...definition.outputSchema === void 0 ? {} : { outputSchema: definition.outputSchema },
+				parameters: modelInputSchema(definition),
+				async execute(_toolCallId, parameters, signal) {
+					assertAvailable();
+					if (retired) throw new Error(`MCP tool ${definition.piName} is no longer available.`);
+					signal?.throwIfAborted();
+					const arguments_ = parameters === void 0 ? {} : parameters;
+					if (!Value.Check(tool.parameters, arguments_)) throw new Error(`Invalid arguments for MCP tool ${definition.piName}.`);
+					const result = await invoke(arguments_, signal);
+					signal?.throwIfAborted();
+					return result;
+				}
+			};
+			retained.set(definition.piName, {
+				fingerprint,
+				tool,
+				retire: () => {
+					retired = true;
+				}
+			});
+			return tool;
+		});
+	};
+	const refresh = () => {
+		project();
+		for (const listener of listeners) listener();
+	};
+	const stopSession = session.onChange(refresh);
+	return Object.freeze({
+		generation,
+		runtimeRevision: () => session.toolGeneration,
+		readAppResource: async (server, tool, resourceUri, signal) => {
+			assertAvailable();
+			if (disposed) throw new Error("The MCP session is no longer available.");
+			const result = await session.readAppResource(server, tool, resourceUri, signal);
+			assertAvailable();
+			if (disposed) throw new Error("The MCP session is no longer available.");
+			return result;
+		},
+		snapshot,
+		project,
+		refresh,
+		dispose: () => {
+			disposed = true;
+			stopSession();
+			refresh();
+			listeners.clear();
+		},
+		resolveSelectors: (selectors) => {
+			const active = new Set(snapshot().map((tool) => tool.piName));
+			return session.resolveToolSelectors(selectors).map((tool) => tool.name).filter((name) => active.has(name));
+		},
+		onChange: (listener) => {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		},
+		invoke: async (name, parameters, signal) => {
+			assertAvailable();
+			const tool = project().find((candidate) => candidate.name === name);
+			if (!tool) throw new Error(`MCP tool ${name} is not available in this session.`);
+			return tool.execute("mcp", parameters, signal);
+		}
+	});
+}
+/** Borrow an existing MCP runtime; a child never starts or disposes its own upstream connections. */
+function createMcpChildTool(invoke, catalog) {
+	return {
+		name: "mcp",
+		...catalog === void 0 ? {} : { catalog },
+		description: "Call a tool exposed by a connected MCP server.",
+		parameters: McpHeadlessToolParameters,
+		async execute(_toolCallId, parameters, signal) {
+			signal?.throwIfAborted();
+			if (!Value.Check(McpHeadlessToolParameters, parameters)) throw new Error("Invalid MCP tool arguments.");
+			const result = await invoke(parameters, signal);
+			signal?.throwIfAborted();
+			return result;
+		}
+	};
+}
+//#endregion
+//#region src/constants/mcp.ts
+const SERVER_COMMAND_DESCRIPTION = "Show MCP configuration or begin an authorization request.";
+//#endregion
+//#region src/constants/piMcp.ts
+const PACKAGE_SOURCE = "@agimon-ai/po-mcp";
+/**
+* Footer status carrying the session's MCP server names, comma separated.
+*
+* MCP tools are registered under `<server>_<tool>`, a name only known at
+* runtime, so the cockpit's web plugin reads this status to recognise which
+* tool calls are MCP calls. The web half duplicates the literal (it may only
+* import src/types and src/constants), and a test keeps the two in step.
+*/
+const MCP_STATUS_KEY = "doom-mcp";
+//#endregion
+//#region src/types/webMcp.ts
+const MCP_SESSION_AUTH_STATUS_KEY = "doom-mcp-session-auth";
+new RegExp(`${String.fromCharCode(27)}\\[[0-?]*[ -/]*[@-~]`, "gu");
+const MAX_AUTHORIZATION_URL_LENGTH = 8192;
+const MAX_SERVER_TOOLS = 512;
+const MAX_TOOL_NAME_LENGTH = 256;
+const SESSION_AUTH_STATES = [
+	"not-connected",
+	"connecting",
+	"connected",
+	"degraded",
+	"needs-auth",
+	"failed",
+	"closed",
+	"disabled"
+];
+function isSessionAuthState(value) {
+	return SESSION_AUTH_STATES.some((state) => state === value);
+}
+/** Session route for one reachable tool's description and schema. */
+const MCP_SESSION_TOOL_API_PATH = "/tool";
+const MCP_SESSION_TOOL_SERVER_QUERY = "server";
+const MCP_SESSION_TOOL_NAME_QUERY = "tool";
+/** Keeps servers visible before discovery and after failures, without diagnostics or credentials. */
+function formatMcpSessionAuthStatus(servers) {
+	const items = servers.flatMap((server) => {
+		if (!isSessionAuthState(server.state)) return [];
+		const tools = (server.tools ?? []).filter((tool) => tool.active && isToolName(tool.toolName)).map((tool) => ({
+			name: tool.toolName,
+			...isToolName(tool.piName) ? { piName: tool.piName } : {},
+			...isTokenCount(tool.tokens) ? { tokens: tool.tokens } : {}
+		})).slice(0, MAX_SERVER_TOOLS);
+		return [{
+			name: server.name,
+			state: server.state,
+			...isAuthorizationUrl(server.authorizationUrl) ? { authorizationUrl: server.authorizationUrl } : {},
+			...tools.length === 0 ? {} : { tools }
+		}];
+	});
+	return items.length === 0 ? void 0 : JSON.stringify(items);
+}
+function hasControlCharacter(value) {
+	for (const character of value) {
+		const codePoint = character.codePointAt(0);
+		if (codePoint !== void 0 && (codePoint < 32 || codePoint >= 127 && codePoint <= 159)) return true;
+	}
+	return false;
+}
+function isAuthorizationUrl(value) {
+	if (typeof value !== "string" || value.length > MAX_AUTHORIZATION_URL_LENGTH || hasControlCharacter(value)) return false;
+	try {
+		const url = new URL(value);
+		return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "";
+	} catch {
+		return false;
+	}
+}
+function isToolName(value) {
+	return typeof value === "string" && value.trim() !== "" && value.length <= MAX_TOOL_NAME_LENGTH && !hasControlCharacter(value);
+}
+function isTokenCount(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+/** Hub API paths for repository-scoped MCP management. */
+const MCP_REPOSITORY_API_PATH = "/repository";
+const MCP_DISCOVERY_API_PATH = "/repository/discover";
+const MCP_AUTHORIZATION_API_PATH = "/repository/authorize";
+/** The repository every route is asked about, and the flow segment the two flow routes carry. */
+const MCP_REPOSITORY_ID_QUERY = "repositoryId";
+const MCP_FLOW_ID_PARAM = "flowId";
+//#endregion
+//#region src/services/mcpCommand/index.ts
+/** One line per server: its state, and how many tools it currently offers. */
+function formatStatus(session) {
+	const { servers } = session.getSnapshot();
+	if (servers.length === 0) return "No MCP servers are configured for this session.";
+	return [...servers.map((server) => {
+		const detail = server.error ? ` (${server.error})` : "";
+		return `${server.name}: ${server.state} · ${server.tools.length} tools${detail}`;
+	}), ...session.getDiagnostics()].join("\n");
+}
+//#endregion
+//#region src/services/directTools/index.ts
+const SELECTOR_SEPARATOR = "/";
+/**
+* Which downstream tools a child may see.
+*
+* A selector is either a whole server (`pencil`) or one tool of it
+* (`pencil/get_screenshot`).
+*/
+var DirectToolFilter = class {
+	servers = /* @__PURE__ */ new Set();
+	tools = /* @__PURE__ */ new Map();
+	constructor(selectors) {
+		for (const raw of selectors) {
+			const selector = raw.trim().replace(/\/+$/, "");
+			if (!selector) continue;
+			const separator = selector.indexOf(SELECTOR_SEPARATOR);
+			if (separator === -1) {
+				this.servers.add(selector);
+				continue;
+			}
+			const server = selector.slice(0, separator);
+			const tool = selector.slice(separator + 1);
+			if (!server) continue;
+			if (!tool) {
+				this.servers.add(server);
+				continue;
+			}
+			const selected = this.tools.get(server) ?? /* @__PURE__ */ new Set();
+			selected.add(tool);
+			this.tools.set(server, selected);
+		}
+	}
+	allows(serverName, toolName) {
+		if (this.servers.has(serverName)) return true;
+		return this.tools.get(serverName)?.has(toolName) ?? false;
+	}
+};
+//#endregion
+//#region src/services/directToolsEnvironment/index.ts
+/** Reads a child agent's MCP tool selection from the process environment. */
+function readDirectToolFilter(environment = process.env) {
+	const raw = environment[DIRECT_TOOLS_ENV];
+	if (raw === void 0 || raw === "") return void 0;
+	if (raw === "__none__") return new DirectToolFilter([]);
+	return new DirectToolFilter(raw.split(","));
+}
+//#endregion
+//#region src/services/toolVisibility/index.ts
+/**
+* Hides every wrapper this extension owns that the catalog does not currently offer.
+*
+* The surface recomputes from the whole registered inventory, so this only ever
+* removes: a server that reconnected is already in `incoming` and nothing has to
+* put it back. Historical ownership matters after reconfiguration because Pi
+* cannot unregister a wrapper the new domain no longer selects.
+*
+* The visible set is read once, here, so the returned function stays pure and a
+* later re-apply by another owner cannot see half a catalog change.
+*/
+function mcpToolRestriction(catalog, historicallyOwnedNames = new Set(catalog.allTools().map((tool) => tool.piName)), incompatibleNames = /* @__PURE__ */ new Set()) {
+	const visible = new Set(catalog.activeToolNames().filter((name) => !incompatibleNames.has(name)));
+	return (incoming) => incoming.filter((name) => !historicallyOwnedNames.has(name) || visible.has(name));
+}
+//#endregion
+//#region src/services/mcpSession/index.ts
+/** Raised by anything needing a live container before one has been built. */
+const RUNTIME_NOT_STARTED = "The MCP runtime has not started yet.";
+const AUTHORIZATION_URL_NOT_READY = "No authorization page is waiting for this MCP server.";
+function canonicalJson(value) {
+	const normalize = (candidate) => {
+		if (Array.isArray(candidate)) return candidate.map(normalize);
+		if (typeof candidate !== "object" || candidate === null) return candidate;
+		return Object.fromEntries(Object.entries(candidate).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => [key, normalize(child)]));
+	};
+	return JSON.stringify(normalize(value));
+}
+function mcpConfigurationFingerprint(configuration) {
+	return canonicalJson({
+		enabled: configuration.enabled ?? true,
+		repoRoot: configuration.repoRoot,
+		stagingDirectory: configuration.stagingDirectory,
+		generatedConfigPath: configuration.generatedConfigPath,
+		pluginConfigPaths: configuration.pluginConfigPaths ?? [],
+		sources: configuration.sources ?? [],
+		allowlist: {
+			servers: [...configuration.allowlist?.servers ?? []].sort((left, right) => left.localeCompare(right)),
+			proxy: [...configuration.allowlist?.proxy ?? []].sort((left, right) => left.localeCompare(right))
+		}
+	});
+}
+function toolRegistrationFingerprint(tool) {
+	return canonicalJson({
+		serverName: tool.serverName,
+		toolName: tool.toolName,
+		inputSchema: tool.inputSchema,
+		_meta: tool._meta
+	});
+}
+/**
+* The MCP picture for one Pi session.
+*
+* Install is synchronous and cheap: the previous run's catalog is read off disk and
+* its tools registered, so Pi's first turn already has them. Connecting happens on
+* a detached promise afterwards, and each server folds into the active tool set as
+* it lands. Nothing on this path waits for a socket.
+*/
+var McpSession = class {
+	/** Created after session_start, never while Pi is importing extensions. */
+	runtime;
+	catalog;
+	groups = {
+		shared: {
+			configSources: [],
+			configPaths: [],
+			serverNames: []
+		},
+		sessionLocal: {
+			configSources: [],
+			configPaths: [],
+			serverNames: []
+		},
+		droppedServers: [],
+		diagnostics: []
+	};
+	options;
+	/** Credential persistence used by the active runtime and explicit reauthorization. */
+	tokenStore;
+	/** Resources per server, listed on demand. Errors are never cached, so a retry re-dials. */
+	resourceCache = /* @__PURE__ */ new Map();
+	changeListeners = /* @__PURE__ */ new Set();
+	/** Authorization URLs waiting to be opened, by server. */
+	authorizationUrls = /* @__PURE__ */ new Map();
+	/** Servers whose explicit auth action should launch the browser when its URL arrives. */
+	browserAuthorizationRequests = /* @__PURE__ */ new Set();
+	/** Explicit session disconnects fence late discovery and stale tool invocations. */
+	disconnectedServers = /* @__PURE__ */ new Set();
+	/** Bounded, session-local diagnostics. Never tool-result values or cached credentials. */
+	outputSchemaWarnings = [];
+	/** Invalidates deferred startup work when a session reloads or shuts down. */
+	lifecycleGeneration = 0;
+	configurationFingerprint;
+	workspaceRoot;
+	executionCwd;
+	/** Pi wrappers survive configuration changes because the host cannot unregister them. */
+	retainedTools = /* @__PURE__ */ new Map();
+	registeredToolFingerprints = /* @__PURE__ */ new Map();
+	historicallyOwnedNames = /* @__PURE__ */ new Set();
+	incompatibleNames = /* @__PURE__ */ new Set();
+	/** The session's slot in the tool surface, held only while a session fiber is up. */
+	toolRestriction;
+	/** Resolved per tool call, so a registration outlives the container it was made under. */
+	getClientManager = () => this.runtime?.getServices()?.clientManager;
+	constructor(options) {
+		this.options = options;
+		this.catalog = this.createCatalog();
+	}
+	/**
+	* Puts this session's tool visibility under the Doom tool surface.
+	*
+	* Registering applies the current restriction immediately, which is the first
+	* point the session can express that nothing has connected yet: the surface
+	* only exists once a session fiber is up, while the cached tools were
+	* registered back at install. Dropping the handle restores every wrapper, so
+	* nothing here keeps a snapshot of the tool list.
+	*/
+	bindToolSurface(surface) {
+		const handle = surface.register({
+			source: PACKAGE_SOURCE,
+			restrict: this.currentRestriction()
+		});
+		this.toolRestriction = handle;
+		return () => {
+			if (this.toolRestriction !== handle) return;
+			this.toolRestriction = void 0;
+			handle.dispose();
+		};
+	}
+	createCatalog() {
+		return new McpCatalog(readDirectToolFilter(this.options.environment));
+	}
+	/**
+	* Registers the cached catalog with Pi. Runs at extension install.
+	*
+	* Returns the servers it seeded, so a caller can report what the session started
+	* with before anything connected.
+	*/
+	install(configuration = readSessionConfig(this.options.environment)) {
+		this.executionCwd = configuration.repoRoot;
+		this.bindConfiguration(configuration);
+		this.emitChange();
+		return this.catalog.toSnapshot();
+	}
+	/** Replaces the complete MCP projection and retires the previous live owner. */
+	async reconfigure(configuration, executionCwd = configuration.repoRoot, workspaceRoot = configuration.repoRoot) {
+		if (mcpConfigurationFingerprint(configuration) === this.configurationFingerprint && executionCwd === this.executionCwd && workspaceRoot === this.workspaceRoot) {
+			if (!this.runtime?.getServices()) this.startDetached();
+			return;
+		}
+		const generation = ++this.lifecycleGeneration;
+		const retiredRuntime = this.runtime;
+		this.runtime = void 0;
+		await retiredRuntime?.dispose();
+		if (generation !== this.lifecycleGeneration) return;
+		this.resourceCache.clear();
+		this.authorizationUrls.clear();
+		this.browserAuthorizationRequests.clear();
+		this.executionCwd = executionCwd;
+		this.bindConfiguration(configuration);
+		this.workspaceRoot = workspaceRoot;
+		this.emitChange();
+		this.updateToolVisibility();
+		this.startDetached();
+	}
+	bindConfiguration(configuration) {
+		this.workspaceRoot = configuration.repoRoot;
+		this.configurationFingerprint = mcpConfigurationFingerprint(configuration);
+		this.groups = buildMcpConfigGroups(configuration);
+		this.disconnectedServers.clear();
+		this.catalog = this.createCatalog();
+		const configuredServers = [.../* @__PURE__ */ new Set([...this.groups.sessionLocal.serverNames, ...this.groups.shared.serverNames])];
+		this.catalog.seed(readCachedCatalog(this.configSources()), configuredServers);
+		for (const diagnostic of this.groups.diagnostics) this.catalog.addDiagnostic(diagnostic);
+		this.trackTools(this.catalog.allTools());
+	}
+	trackTools(tools) {
+		for (const tool of tools) {
+			const fingerprint = toolRegistrationFingerprint(tool);
+			const registered = this.registeredToolFingerprints.get(tool.piName);
+			this.historicallyOwnedNames.add(tool.piName);
+			if (registered === void 0) {
+				this.registeredToolFingerprints.set(tool.piName, fingerprint);
+				this.incompatibleNames.delete(tool.piName);
+				this.retainedTools.set(tool.piName, tool);
+				continue;
+			}
+			if (registered === fingerprint) {
+				this.incompatibleNames.delete(tool.piName);
+				continue;
+			}
+			this.incompatibleNames.add(tool.piName);
+			this.catalog.addDiagnostic(`MCP tool "${tool.piName}" changed identity, App metadata, or input schema and is hidden until Pi is relaunched.`);
+		}
+	}
+	/** Tools the session currently permits on both local and remote surfaces. */
+	activeToolDefinitions() {
+		const active = new Set(this.catalog.activeToolNames());
+		return this.toolDefinitions().flatMap((tool) => {
+			const current = this.catalog.findTool(tool.piName);
+			return active.has(tool.piName) && current !== void 0 ? [current] : [];
+		});
+	}
+	toolDefinitions() {
+		return [...this.retainedTools.values()].filter((tool) => this.catalog.findTool(tool.piName) !== void 0 && !this.incompatibleNames.has(tool.piName) && !this.disconnectedServers.has(tool.serverName));
+	}
+	isToolAvailable(registeredTool) {
+		if (!this.catalog.activeToolNames().includes(registeredTool.piName)) return false;
+		const current = this.catalog.findTool(registeredTool.piName);
+		return current !== void 0 && toolRegistrationFingerprint(current) === toolRegistrationFingerprint(registeredTool);
+	}
+	get toolGeneration() {
+		return this.lifecycleGeneration;
+	}
+	/** Capture a declaration's runtime, so retired wrappers cannot reach a same-name replacement. */
+	bindToolInvocation(tool) {
+		const generation = this.lifecycleGeneration;
+		return async (parameters, signal) => {
+			if (generation !== this.lifecycleGeneration || !this.isToolAvailable(tool)) throw new Error(`MCP tool ${tool.piName} is no longer available in the current session configuration.`);
+			return toHeadlessToolResult(tool, await this.callTool(tool, parameters, signal));
+		};
+	}
+	/** Executes through this session's existing manager, never a remote replacement runtime. */
+	async invokeTool(name, parameters, signal) {
+		const tool = this.activeToolDefinitions().find((candidate) => candidate.piName === name);
+		if (!tool || !this.isToolAvailable(tool)) throw new Error(`MCP tool ${name} is not available in the current session configuration.`);
+		return this.bindToolInvocation(tool)(parameters, signal);
+	}
+	/** Shared raw execution for Pi and headless, before their distinct result conventions. */
+	async callTool(tool, parameters, signal) {
+		const name = tool.piName;
+		if (!this.isToolAvailable(tool)) throw new Error(`MCP tool ${name} is not available in the current session configuration.`);
+		const runtime = this.runtime;
+		const services = runtime?.getServices();
+		if (!runtime || !services) throw new Error(RUNTIME_NOT_STARTED);
+		signal?.throwIfAborted();
+		const { publishFile } = this.options;
+		const files = await publishFileParams(tool, parameters, publishFile && ((path) => publishFile(path, tool, signal)));
+		try {
+			signal?.throwIfAborted();
+			const connection = await services.clientManager.ensureConnected(tool.serverName);
+			signal?.throwIfAborted();
+			if (!runtime.isCurrent(services) || !this.isToolAvailable(tool)) throw new Error(`MCP tool ${name} is no longer available in the current session configuration.`);
+			const timeout = services.clientManager.getServerRequestTimeout(tool.serverName);
+			this.clearToolWarnings(tool.serverName, "tools/call", tool.toolName);
+			let snapshot;
+			const result = await connection.callTool(tool.toolName, files.outbound, {
+				...timeout === void 0 ? {} : { timeout },
+				...signal === void 0 ? {} : { signal },
+				onResult: (original) => {
+					snapshot = captureMcpAppResult(tool, original);
+				}
+			});
+			signal?.throwIfAborted();
+			if (!runtime.isCurrent(services) || !this.isToolAvailable(tool)) throw new Error(`MCP tool ${name} is no longer available in the current session configuration.`);
+			retainMcpAppResult(result, snapshot);
+			return result;
+		} finally {
+			files.release();
+		}
+	}
+	/**
+	* What this extension hides right now.
+	*
+	* Rebuilt from scratch every time, so a server that failed drops out and one
+	* that reconnected comes back.
+	*/
+	currentRestriction() {
+		const unavailable = new Set(this.incompatibleNames);
+		for (const tool of this.catalog.allTools()) if (this.disconnectedServers.has(tool.serverName)) unavailable.add(tool.piName);
+		return mcpToolRestriction(this.catalog, this.historicallyOwnedNames, unavailable);
+	}
+	updateToolVisibility() {
+		this.toolRestriction?.update(this.currentRestriction());
+	}
+	startDetached() {
+		this.start().catch((error) => {
+			this.catalog.addDiagnostic(`Could not start the MCP runtime: ${error instanceof Error ? error.message : String(error)}`);
+			this.emitChange();
+		});
+	}
+	/**
+	* Starts connecting. Never awaited on Pi's critical path.
+	*
+	* Resolves once the container exists, not once servers are reachable. A start
+	* that a newer generation superseded resolves to nothing and registers nothing.
+	*/
+	async start() {
+		const generation = ++this.lifecycleGeneration;
+		this.disconnectedServers.clear();
+		this.outputSchemaWarnings = [];
+		this.emitChange();
+		if (this.configuredServerNames().length === 0) return;
+		const [{ createTokenStore }, { McpRuntimeOwner }] = await Promise.all([Promise.resolve().then(() => keyringTokenStore_exports), import("../mcpCatalog-SlqWS-sb.mjs").then((n) => n.m)]);
+		if (generation !== this.lifecycleGeneration) return;
+		this.runtime ??= new McpRuntimeOwner();
+		const runtime = this.runtime;
+		this.resourceCache.clear();
+		const configSources = this.configSources();
+		const tokenStore = this.options.tokenStore ?? await createTokenStore();
+		this.tokenStore = tokenStore;
+		await runtime.start({
+			configSources,
+			workspaceRoot: this.workspaceRoot,
+			executionCwd: this.executionCwd,
+			environment: this.options.environment,
+			tokenStore,
+			onAuthorizationUrl: (url, serverName) => this.onAuthorizationUrl(url, serverName, generation),
+			onServerStateChange: (change) => this.onServerStateChange(change, generation),
+			onOutputSchemaWarning: (warning) => {
+				if (generation !== this.lifecycleGeneration || this.disconnectedServers.has(warning.serverName) || !this.configuredServerNames().includes(warning.serverName)) return;
+				if (this.outputSchemaWarnings.length >= 64) return;
+				if (this.outputSchemaWarnings.some((current) => canonicalJson(current) === canonicalJson(warning))) return;
+				this.outputSchemaWarnings.push(warning);
+				this.emitChange();
+			}
+		});
+		if (generation !== this.lifecycleGeneration) await runtime.dispose();
+	}
+	/**
+	* Records the URL a flow is waiting on, then passes it to the host.
+	*
+	* Kept here because the status panel a user starts the flow from is where the
+	* link is shown; hosts do not repeat it in the transcript. Host work is
+	* detached so a failed desktop browser launch never cancels a still-usable OAuth
+	* callback; the overlay retains a clickable fallback and a retry action.
+	*/
+	onAuthorizationUrl(url, serverName, generation) {
+		if (generation !== this.lifecycleGeneration || this.disconnectedServers.has(serverName)) return;
+		this.authorizationUrls.set(serverName, url.toString());
+		this.emitChange();
+		const openBrowser = this.browserAuthorizationRequests.has(serverName);
+		Promise.resolve().then(() => {
+			if (generation !== this.lifecycleGeneration || this.disconnectedServers.has(serverName)) return;
+			return this.options.onAuthorizationUrl?.(url, serverName, { openBrowser });
+		}).catch((error) => {
+			if (generation !== this.lifecycleGeneration) return;
+			const detail = error instanceof Error ? error.message : String(error);
+			this.catalog.addDiagnostic(`Could not open authorization page for "${serverName}": ${detail}`);
+			this.emitChange();
+		});
+	}
+	/** Ordered layers for the one in-process client container. */
+	configSources() {
+		return [...this.groups.sessionLocal.configSources, ...this.groups.shared.configSources];
+	}
+	configuredServerNames() {
+		return [.../* @__PURE__ */ new Set([...this.groups.sessionLocal.serverNames, ...this.groups.shared.serverNames])];
+	}
+	/** Closes only this session's connection. Saved OAuth credentials are untouched. */
+	async disconnect(serverName) {
+		if (!this.configuredServerNames().includes(serverName)) throw new Error(`Unknown MCP server: ${serverName}`);
+		const clientManager = this.getClientManager();
+		if (!clientManager) throw new Error(RUNTIME_NOT_STARTED);
+		const generation = this.lifecycleGeneration;
+		this.disconnectedServers.add(serverName);
+		try {
+			await clientManager.disconnectServer(serverName);
+		} catch (error) {
+			if (generation === this.lifecycleGeneration) this.disconnectedServers.delete(serverName);
+			throw error;
+		}
+		if (generation !== this.lifecycleGeneration) return;
+		this.clearToolWarnings(serverName);
+		this.resourceCache.delete(serverName);
+		this.authorizationUrls.delete(serverName);
+		this.browserAuthorizationRequests.delete(serverName);
+		this.catalog.applyStateChange({
+			serverName,
+			state: "closed"
+		}, []);
+		this.emitChange();
+		this.updateToolVisibility();
+	}
+	/**
+	* Reconnects one server with a fresh OAuth registration.
+	*
+	* The connection is dropped before credentials are cleared so a failed disconnect
+	* does not silently sign the user out. Clearing both tokens and dynamic client
+	* information prevents a server-side registration reset from replaying a stale
+	* `client_id` forever.
+	*/
+	async reauthorize(serverName) {
+		const clientManager = this.getClientManager();
+		if (!clientManager) throw new Error(RUNTIME_NOT_STARTED);
+		const generation = this.lifecycleGeneration;
+		const tokenStore = this.tokenStore;
+		this.disconnectedServers.delete(serverName);
+		this.resourceCache.delete(serverName);
+		if (this.authorizationUrls.delete(serverName)) this.emitChange();
+		this.browserAuthorizationRequests.add(serverName);
+		try {
+			await clientManager.disconnectServer(serverName);
+			if (generation !== this.lifecycleGeneration) return;
+			await tokenStore?.clear(serverName);
+			if (generation !== this.lifecycleGeneration) return;
+			await clientManager.ensureConnected(serverName);
+		} finally {
+			if (generation === this.lifecycleGeneration) this.browserAuthorizationRequests.delete(serverName);
+		}
+	}
+	/** Reopens the URL already reserved for a flow without restarting that flow. */
+	async openAuthorizationPage(serverName) {
+		const authorizationUrl = this.authorizationUrls.get(serverName);
+		if (!authorizationUrl) throw new Error(AUTHORIZATION_URL_NOT_READY);
+		const onAuthorizationUrl = this.options.onAuthorizationUrl;
+		if (!onAuthorizationUrl) throw new Error("This host cannot open authorization pages.");
+		await onAuthorizationUrl(new URL(authorizationUrl), serverName, { openBrowser: true });
+	}
+	getSnapshot() {
+		return this.catalog.toSnapshot();
+	}
+	resolveToolSelectors(selectors) {
+		return this.catalog.resolveToolSelectors(selectors);
+	}
+	/** The fuller picture the overlay renders, with tool names and descriptions. */
+	getServers() {
+		return this.catalog.toView().map((server) => {
+			const authorizationUrl = this.authorizationUrls.get(server.name);
+			return authorizationUrl ? {
+				...server,
+				authorizationUrl
+			} : server;
+		});
+	}
+	/** Both the proxy tool and direct tools point to the same live warning origins. */
+	getToolWarnings() {
+		const entries = this.activeToolDefinitions().filter(isModelVisibleMcpTool).flatMap((tool) => {
+			const warnings = this.outputSchemaWarnings.filter((warning) => warning.serverName === tool.serverName && warning.toolName === tool.toolName).map((warning) => ({
+				source: `${warning.serverName}/${warning.toolName} (${warning.method})`,
+				path: warning.path,
+				message: warning.message
+			}));
+			return warnings.length === 0 ? [] : [[tool.piName, warnings]];
+		});
+		if (entries.length === 0) return {};
+		return Object.fromEntries([...entries, ["mcp_use", entries.flatMap(([, warnings]) => warnings)]]);
+	}
+	clearToolWarnings(serverName, method, toolName) {
+		const remaining = this.outputSchemaWarnings.filter((warning) => warning.serverName !== serverName || method !== void 0 && warning.method !== method || toolName !== void 0 && warning.toolName !== toolName);
+		if (remaining.length === this.outputSchemaWarnings.length) return;
+		this.outputSchemaWarnings = remaining;
+		this.emitChange();
+	}
+	/**
+	* Hides or restores a server's tools for the rest of this session.
+	*
+	* Deliberately does not disconnect: this is a session visibility control, so a
+	* later enable is instant and does not discard an authenticated live connection.
+	* Because each catalog row is now an actual downstream server, the control acts
+	* on only that server's tools rather than on an aggregate proxy group.
+	*
+	* Nothing is re-registered on the way back: Pi 0.84 cannot unregister a tool, so
+	* every tool stays registered and only the restriction moves.
+	*/
+	setEnabled(serverName, enabled) {
+		this.catalog.setDisabled(serverName, !enabled);
+		this.emitChange();
+		this.updateToolVisibility();
+	}
+	/**
+	* Lists one server's resources, from cache unless asked for a fresh call.
+	*
+	* The cache lives here rather than in the overlay so closing and reopening the
+	* panel does not re-dial. A rejection is never cached, so a server that has no
+	* `resources/list` capability, or one that was briefly unreachable, is retried by
+	* the next request rather than remembered as empty.
+	*/
+	async listResources(serverName, options = {}) {
+		if (this.disconnectedServers.has(serverName)) throw new Error(`MCP server is disconnected: ${serverName}`);
+		if (!options.refresh) {
+			const cached = this.resourceCache.get(serverName);
+			if (cached) return cached;
+		}
+		const runtime = this.runtime;
+		const services = runtime?.getServices();
+		if (!runtime || !services) throw new Error(RUNTIME_NOT_STARTED);
+		const resources = await (await services.clientManager.ensureConnected(serverName)).listResources();
+		if (!runtime.isCurrent(services)) return resources;
+		this.resourceCache.set(serverName, resources);
+		this.catalog.setResourceCount(serverName, resources.length);
+		this.emitChange();
+		return resources;
+	}
+	/** Reads only the resource advertised by a currently admitted tool, on its existing server. */
+	async readAppResource(server, tool, resourceUri, signal) {
+		const declaration = this.activeToolDefinitions().find((candidate) => candidate.serverName === server && candidate.toolName === tool);
+		if (!declaration || normalizeMcpAppMetadata(declaration._meta).resourceUri !== resourceUri) throw new Error("This App resource is not available in the current session.");
+		const runtime = this.runtime;
+		const services = runtime?.getServices();
+		const generation = this.lifecycleGeneration;
+		if (!runtime || !services) throw new Error(RUNTIME_NOT_STARTED);
+		signal?.throwIfAborted();
+		const connection = await services.clientManager.ensureConnected(server);
+		const check = () => {
+			signal?.throwIfAborted();
+			if (generation !== this.lifecycleGeneration || !runtime.isCurrent(services) || !this.isToolAvailable(declaration)) throw new Error("This App resource belongs to a retired MCP runtime.");
+		};
+		check();
+		const options = {
+			timeout: services.clientManager.getServerRequestTimeout(server),
+			signal
+		};
+		const result = await connection.readResource(resourceUri, options);
+		check();
+		return result;
+	}
+	/** Fires whenever the server picture changes. Returns its own disposer. */
+	onChange(listener) {
+		this.changeListeners.add(listener);
+		return () => {
+			this.changeListeners.delete(listener);
+		};
+	}
+	/**
+	* Announces a change to whoever is watching.
+	*
+	* Listener failures are contained rather than propagated: this runs inside the
+	* continuation that folds a server into Pi's tool set, and a throw escaping here
+	* would abandon that fold, leaving the session silently short of tools because
+	* something failed to repaint.
+	*/
+	emitChange() {
+		for (const listener of this.changeListeners) try {
+			listener();
+		} catch (error) {
+			this.catalog.addDiagnostic(`An MCP change listener failed: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+	getDiagnostics() {
+		return this.catalog.getDiagnostics();
+	}
+	async dispose() {
+		++this.lifecycleGeneration;
+		this.browserAuthorizationRequests.clear();
+		this.authorizationUrls.clear();
+		this.resourceCache.clear();
+		this.outputSchemaWarnings = [];
+		const retiredRuntime = this.runtime;
+		this.runtime = void 0;
+		await retiredRuntime?.dispose();
+	}
+	/**
+	* Folds one server transition into Pi's tool set.
+	*
+	* The tool list is read from the live connection rather than the state event,
+	* which carries no tools; a server that is not readable contributes none and its
+	* cached tools simply stay inactive.
+	*
+	* `ensureConnected` rather than `getClient`: the manager announces `connected`
+	* before it registers the client, so a listener that looks the client up
+	* synchronously finds nothing and the server lands with an empty tool list.
+	* This handler runs detached from the connect, so awaiting it cannot deadlock.
+	*/
+	onServerStateChange(change, generation) {
+		if (generation !== this.lifecycleGeneration || this.disconnectedServers.has(change.serverName)) return;
+		if (change.state === "connecting") this.clearToolWarnings(change.serverName);
+		if (change.state !== "connecting" && change.state !== "needs-auth") this.authorizationUrls.delete(change.serverName);
+		const runtime = this.runtime;
+		const services = runtime?.getServices();
+		(change.state === "connected" && services ? services.clientManager.ensureConnected(change.serverName).then((connection) => connection.listTools()) : Promise.resolve([])).then((tools) => ({
+			tools,
+			error: void 0
+		}), () => ({
+			tools: [],
+			error: `Could not discover tools for MCP server "${change.serverName}".`
+		})).then(({ tools, error }) => {
+			if (generation !== this.lifecycleGeneration || !runtime?.isCurrent(services) || this.disconnectedServers.has(change.serverName)) return;
+			if (error) this.catalog.addDiagnostic(error);
+			this.catalog.applyStateChange(error ? {
+				...change,
+				error
+			} : change, tools);
+			this.trackTools(this.catalog.allTools());
+			this.emitChange();
+			this.updateToolVisibility();
+		});
+	}
+};
+//#endregion
+//#region src/services/mcpToolCost/index.ts
+/**
+* What one downstream tool would cost if it were added to the model's tool list directly: its
+* name, description and input schema, priced the way the context panel prices every other tool.
+*/
+function mcpToolTokens(tool, countTokens) {
+	return countTokens(JSON.stringify({
+		name: tool.piName,
+		...tool.description === void 0 ? {} : { description: tool.description },
+		parameters: tool.inputSchema
+	}));
+}
+//#endregion
+//#region src/services/mcpSessionApi/index.ts
+const JSON_HEADERS$1 = { "content-type": "application/json" };
+function json$1(body, status = 200) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: JSON_HEADERS$1
+	});
+}
+/**
+* This package's session mount, `mcp-session`: one reachable tool's description and schema.
+*
+* Read-only and bounded to available tools, so a page can inspect what the agent may
+* call without the status line carrying every schema.
+*/
+function createMcpSessionApi(source, countTokens) {
+	return {
+		basePath: "mcp-session",
+		start() {
+			return {
+				async fetch(request) {
+					const url = new URL(request.url);
+					if (request.method !== "GET" || url.pathname !== "/tool") return json$1({ error: "Not found." }, 404);
+					const server = url.searchParams.get("server") ?? "";
+					const name = url.searchParams.get("tool") ?? "";
+					if (!server || !name) return json$1({ error: "A tool is named by its server and tool name." }, 400);
+					const tool = source.activeToolDefinitions().find((candidate) => candidate.serverName === server && candidate.toolName === name);
+					if (!tool) return json$1({ error: `MCP tool ${server}/${name} is not available in this session.` }, 404);
+					const warnings = source.getToolWarnings?.()[tool.piName];
+					return json$1({
+						server,
+						tool: name,
+						piName: tool.piName,
+						...warnings?.length ? { warnings } : {},
+						...tool.description === void 0 ? {} : { description: tool.description },
+						inputSchema: tool.inputSchema,
+						...tool._meta === void 0 ? {} : { _meta: tool._meta },
+						tokens: mcpToolTokens(tool, await countTokens())
+					});
+				},
+				close: () => void 0
+			};
+		}
+	};
+}
+//#endregion
+//#region src/services/serverRuntime/index.ts
+function sessionConfiguration(execution, workspaceRoot) {
+	if (workspaceRoot !== void 0) {
+		const loaded = loadHarnessState({ ...execution.environment });
+		const projection = loaded.state.mcpProjection;
+		if (loaded.filePath && loaded.state.root === workspaceRoot && execution.repoRoot === workspaceRoot && loaded.state.mcp && loaded.state.majorMode === execution.selection.majorMode && JSON.stringify(loaded.state.domains) === JSON.stringify(execution.selection.domains) && JSON.stringify(loaded.state.layers) === JSON.stringify(execution.selection.activeLayers) && isDoomMcpProjection(projection) && projection.repoRoot === workspaceRoot) return mcpSessionConfigFromProjection(projection, execution.cwd);
+		return {
+			enabled: false,
+			repoRoot: execution.cwd,
+			stagingDirectory: path.join(execution.cwd, ".po", "mcp-disabled"),
+			sources: []
+		};
+	}
+	return readSessionConfig(execution.environment, execution.cwd);
+}
+function createMcpServerRuntime(environment = {}, workspaceRoot, getResolver, publishFile) {
+	let active;
+	let currentSelection;
+	let staleSelection = false;
+	let cleanup;
+	let transition = Promise.resolve();
+	const authorizing = /* @__PURE__ */ new Map();
+	const session = new McpSession({
+		environment: { ...environment },
+		...publishFile === void 0 ? {} : { publishFile }
+	});
+	const assertAvailable = () => {
+		if (!active) throw new Error("The MCP runtime has not started yet.");
+		if (staleSelection) throw new Error("The MCP projection is stale for the current selection.");
+	};
+	const sessionTools = createMcpSessionToolsService(session, crypto.randomUUID(), assertAvailable);
+	const refresh = (execution, selection) => {
+		staleSelection = true;
+		sessionTools.refresh();
+		authorizing.clear();
+		transition = transition.catch(() => {}).then(async () => {
+			if (active !== execution) return;
+			const previousCleanup = cleanup;
+			cleanup = void 0;
+			try {
+				await session.dispose();
+			} finally {
+				session.install({
+					enabled: false,
+					repoRoot: execution.cwd,
+					stagingDirectory: execution.cwd
+				});
+				await previousCleanup?.();
+			}
+			if (active !== execution) return;
+			const resolver = getResolver?.();
+			const loaded = workspaceRoot ? loadHarnessState({ ...execution.environment }) : void 0;
+			const authorized = workspaceRoot && loaded?.filePath && loaded.state.root === workspaceRoot && execution.repoRoot === workspaceRoot && loaded.state.mcp && isDoomMcpProjection(loaded.state.mcpProjection) && loaded.state.mcpProjection.repoRoot === workspaceRoot && loaded.state.mcpProjection.enabled;
+			if (!resolver || !authorized) {
+				if (active === execution && selection === currentSelection) {
+					if (workspaceRoot === void 0 || JSON.stringify(execution.selection.domains) === JSON.stringify(selection.domains)) await session.reconfigure(sessionConfiguration(execution, workspaceRoot), execution.cwd, execution.repoRoot);
+					staleSelection = workspaceRoot !== void 0 && JSON.stringify(execution.selection.domains) !== JSON.stringify(selection.domains);
+				}
+				return;
+			}
+			const candidate = await resolver.resolve(selection.domains);
+			if (active !== execution || selection !== currentSelection) {
+				await candidate.cleanup();
+				return;
+			}
+			try {
+				if (!isDoomMcpProjection(candidate.projection) || candidate.projection.repoRoot !== workspaceRoot || !candidate.projection.enabled) throw new Error("The selected domains returned an invalid MCP projection.");
+				await session.reconfigure(mcpSessionConfigFromProjection(candidate.projection, execution.cwd), execution.cwd, execution.repoRoot);
+				cleanup = () => candidate.cleanup();
+				if (active === execution && selection === currentSelection) staleSelection = false;
+			} catch (error) {
+				await candidate.cleanup();
+				throw error;
+			}
+		}).then(() => sessionTools.refresh()).catch(async (error) => {
+			if (active !== execution || selection !== currentSelection) return;
+			await execution.client.notify({
+				title: "Po MCP unavailable",
+				body: error instanceof Error ? error.message : String(error),
+				level: "warning"
+			});
+		});
+		return transition;
+	};
+	let countTokens;
+	let tokenizer;
+	const loadTokenizer = () => {
+		tokenizer ??= import("gpt-tokenizer").then((module) => {
+			countTokens = module.countTokens;
+			return module.countTokens;
+		});
+		return tokenizer;
+	};
+	const toolTokens = /* @__PURE__ */ new Map();
+	/** Each reachable tool's schema cost, keyed by its registered name, once the tokenizer is loaded. */
+	const reachableTokens = () => {
+		if (countTokens === void 0) return toolTokens;
+		for (const tool of session.activeToolDefinitions()) if (!toolTokens.has(tool.piName)) toolTokens.set(tool.piName, mcpToolTokens(tool, countTokens));
+		return toolTokens;
+	};
+	const api = createMcpSessionApi(session, loadTokenizer);
+	const activity = {
+		name: "po-mcp-runtime",
+		async start(execution) {
+			active = execution;
+			currentSelection = execution.selection;
+			staleSelection = false;
+			const reported = /* @__PURE__ */ new Set();
+			const publish = () => {
+				execution.client.setStatus(MCP_STATUS_KEY, session.getServers().map((server) => server.name).join(","));
+				const tokens = reachableTokens();
+				execution.client.setStatus(MCP_SESSION_AUTH_STATUS_KEY, formatMcpSessionAuthStatus(session.getServers().map((server) => ({
+					...server,
+					tools: server.tools.map((tool) => {
+						const cost = tokens.get(tool.piName);
+						return cost === void 0 ? tool : {
+							...tool,
+							tokens: cost
+						};
+					})
+				}))));
+				const warnings = session.getToolWarnings();
+				execution.client.setStatus(CONTEXT_TOOL_WARNINGS_STATUS_KEY, Object.keys(warnings).length === 0 ? void 0 : JSON.stringify(warnings));
+				for (const diagnostic of session.getDiagnostics()) {
+					if (reported.has(diagnostic)) continue;
+					reported.add(diagnostic);
+					execution.client.notify({
+						title: "Po MCP",
+						body: diagnostic,
+						level: "warning"
+					});
+				}
+			};
+			const stopPublishing = session.onChange(() => {
+				toolTokens.clear();
+				publish();
+			});
+			loadTokenizer().then(() => {
+				if (active === execution) publish();
+			});
+			try {
+				await refresh(execution, execution.selection);
+				publish();
+			} catch (error) {
+				await execution.client.notify({
+					title: "Po MCP unavailable",
+					body: error instanceof Error ? error.message : String(error),
+					level: "warning"
+				});
+			}
+			return async () => {
+				stopPublishing();
+				if (active !== execution) return;
+				active = void 0;
+				currentSelection = void 0;
+				staleSelection = true;
+				sessionTools.refresh();
+				authorizing.clear();
+				await transition;
+				const retiredCleanup = cleanup;
+				cleanup = void 0;
+				try {
+					await session.dispose();
+				} finally {
+					session.install({
+						enabled: false,
+						repoRoot: execution.cwd,
+						stagingDirectory: execution.cwd
+					});
+					await retiredCleanup?.();
+					execution.client.setStatus(MCP_STATUS_KEY, void 0);
+					execution.client.setStatus(MCP_SESSION_AUTH_STATUS_KEY, void 0);
+					execution.client.setStatus(CONTEXT_TOOL_WARNINGS_STATUS_KEY, void 0);
+				}
+			};
+		}
+	};
+	const invoke = async (parameters, signal) => {
+		assertAvailable();
+		const selected = sessionTools.snapshot().filter(isModelVisibleMcpTool).find((candidate) => candidate.serverName === parameters.server && candidate.toolName === parameters.tool);
+		if (!selected) throw new Error(`MCP tool ${parameters.server}/${parameters.tool} is not available in this session.`);
+		return sessionTools.invoke(selected.piName, parameters.arguments ?? {}, signal);
+	};
+	const childTool = createMcpChildTool(invoke, {
+		snapshot: () => sessionTools.project().filter(isModelVisibleMcpTool),
+		resolveSelectors: (selectors) => sessionTools.resolveSelectors(selectors),
+		subscribe: (listener) => sessionTools.onChange(listener)
+	});
+	return {
+		session,
+		sessionTools,
+		api: [api],
+		activities: [activity],
+		commands: [{
+			name: "mcp",
+			description: SERVER_COMMAND_DESCRIPTION,
+			async execute(args, execution) {
+				const [subcommand = "status", ...rest] = args.trim().split(/\s+/u).filter(Boolean);
+				const serverName = rest.join(" ");
+				const notify = (body, level = "info") => execution.client.notify({
+					title: "Po MCP",
+					body,
+					level
+				});
+				try {
+					if (subcommand === "status") {
+						await notify(formatStatus(session));
+						return;
+					}
+					if (!active) throw new Error("The MCP runtime has not started yet.");
+					if (staleSelection) throw new Error("The MCP projection is stale for the current selection.");
+					if (subcommand === "auth" || subcommand === "disconnect") {
+						if (!serverName) throw new Error(`Name the server, for example /mcp ${subcommand} <server>.`);
+						const server = session.getServers().find((candidate) => candidate.name === serverName);
+						if (!server) throw new Error(`Unknown MCP server: ${serverName}`);
+						if (subcommand === "disconnect") {
+							await session.disconnect(serverName);
+							authorizing.delete(serverName);
+							await notify(`${serverName} is disconnected from this session. Saved credentials were kept.`);
+							return;
+						}
+						if (server.authorizationUrl) {
+							await notify(`${serverName} is waiting for sign-in. Open it from the MCP servers panel.`);
+							return;
+						}
+						if (authorizing.has(serverName)) return;
+						const request = Symbol(serverName);
+						authorizing.set(serverName, request);
+						const owner = active;
+						session.reauthorize(serverName).then(async () => {
+							if (active !== owner || authorizing.get(serverName) !== request) return;
+							authorizing.delete(serverName);
+							await notify(`${serverName} is authorized.`);
+						}, async (error) => {
+							if (active !== owner || authorizing.get(serverName) !== request) return;
+							authorizing.delete(serverName);
+							await notify(`Could not authorize ${serverName}: ${error instanceof Error ? error.message : String(error)}`, "warning");
+						});
+						return;
+					}
+					if (subcommand === "reload") {
+						if (!currentSelection) throw new Error("The MCP runtime has not started yet.");
+						await refresh(active, currentSelection);
+						if (!staleSelection) await notify("Reconnecting MCP servers.");
+						return;
+					}
+					throw new Error(`Unknown /mcp subcommand "${subcommand}". Use status, auth, disconnect, reload.`);
+				} catch (error) {
+					await notify(error instanceof Error ? error.message : String(error), "warning");
+				}
+			}
+		}],
+		tools: [{
+			name: "mcp_use",
+			label: "MCP use",
+			description: "Call a tool exposed by a connected MCP server.",
+			parameters: McpHeadlessToolParameters,
+			executionMode: "serial",
+			async execute(_toolCallId, parameters, signal) {
+				try {
+					return await invoke(parameters, signal);
+				} catch (error) {
+					return {
+						content: [{
+							type: "text",
+							text: error instanceof Error ? error.message : String(error)
+						}],
+						isError: true
+					};
+				}
+			}
+		}],
+		childTool,
+		async onSelectionChange(selection) {
+			if (!active || workspaceRoot === void 0) return;
+			if (JSON.stringify(currentSelection) === JSON.stringify(selection)) return;
+			currentSelection = selection;
+			await refresh(active, selection);
+		}
+	};
+}
+//#endregion
+//#region src/extensions/workspaces/sessions/(backend)/_lib/serverRoot.ts
+const createMcpServerRoot = (context) => {
+	let resolver;
+	let appHost = context?.agent;
+	const hostContext = context?.host.context;
+	const publishFile = hostContext?.shareFile === void 0 ? void 0 : createConsentedFilePublisher({
+		shareFile: (path, label) => hostContext.shareFile(path, label),
+		host: () => appHost,
+		signal: context?.signal
+	});
+	const runtime = createMcpServerRuntime(context?.agent?.context?.environment, context?.host.context.workspaceRoot, () => resolver, publishFile);
+	const generation = `${context?.agent?.context?.sessionId ?? crypto.randomUUID()}:mcp-server`;
+	const { session } = runtime;
+	const tools = [...runtime.tools, ...createFileTransferTools(context)];
+	const apps = createMcpAppsService(runtime.sessionTools, () => appHost, context?.signal);
+	const mountSession = (cordis) => {
+		cordis.inject([DOOM_MCP_PROJECTION_RESOLVER_SERVICE], (resolverContext) => {
+			resolver = resolverContext.get(DOOM_MCP_PROJECTION_RESOLVER_SERVICE);
+			return () => {
+				resolver = void 0;
+			};
+		});
+		cordis.inject([DOOM_HEADLESS_HOST_SERVICE], (hostContext) => {
+			const host = hostContext.get(DOOM_HEADLESS_HOST_SERVICE);
+			appHost = host;
+			const registrations = /* @__PURE__ */ new Map();
+			const reconcile = () => {
+				const tools = runtime.sessionTools.project();
+				const names = new Set(tools.map((tool) => tool.name));
+				for (const [name, entry] of registrations) {
+					if (names.has(name)) continue;
+					entry.registration.dispose();
+					registrations.delete(name);
+				}
+				for (const tool of tools) {
+					const previous = registrations.get(tool.name);
+					if (previous?.tool === tool) continue;
+					previous?.registration.dispose();
+					registrations.set(tool.name, {
+						tool,
+						registration: host.registerTool(tool)
+					});
+				}
+			};
+			const stopTools = runtime.sessionTools.onChange(reconcile);
+			const stopSelection = host.subscribeSelection((selection) => runtime.onSelectionChange(selection));
+			reconcile();
+			return () => {
+				if (appHost === host) appHost = void 0;
+				stopTools();
+				stopSelection();
+				for (const entry of registrations.values()) entry.registration.dispose();
+				registrations.clear();
+			};
+		});
+		cordis.plugin((provider) => {
+			provider.provide(DOOM_MCP_STATUS_SERVICE, {
+				generation,
+				getSnapshot: () => session.getSnapshot(),
+				onChange: (listener) => session.onChange(listener)
+			});
+			provider.provide(DOOM_MCP_TOOL_RESOLVER_SERVICE, {
+				generation,
+				resolve: (selectors) => session.resolveToolSelectors(selectors)
+			});
+			provider.provide(MCP_SESSION_TOOLS_SERVICE, runtime.sessionTools);
+			provider.provide(DOOM_CHILD_SESSION_MCP_TOOL_SERVICE, runtime.childTool);
+			return () => runtime.sessionTools.dispose();
+		});
+	};
+	return {
+		value: {
+			...runtime,
+			appMethods: apps.methods
+		},
+		activities: runtime.activities,
+		services: [mountMcpHeadlessTools(tools), mountSession],
+		onDispose: apps.dispose
+	};
+};
+//#endregion
+//#region src/extensions/workspaces/sessions/(backend)/root.server.ts
+var root_server_default = defineRoot(createMcpServerRoot);
+//#endregion
+//#region src/services/keyringTokenStore/index.ts
+var keyringTokenStore_exports = /* @__PURE__ */ __exportAll({
+	KEYRING_SERVICE: () => KEYRING_SERVICE,
+	KeyringTokenStore: () => KeyringTokenStore,
+	createTokenStore: () => createTokenStore
+});
+/** Keyring service name. One credential per downstream MCP server. */
+const KEYRING_SERVICE = "ai.agimon.doom-mcp.oauth";
+/**
+* OAuth credentials in the OS keyring, with an owner-only file store behind it.
+*
+* The keyring is a native module and the platform service it talks to may be absent
+* (a headless Linux box with no secret service, an unsupported architecture). A
+* missing credential is reported as `undefined` rather than raised, so a rejection
+* means the keyring itself is unusable and the store degrades to the file fallback
+* for the rest of the session instead of failing the run.
+*/
+var KeyringTokenStore = class {
+	createEntry;
+	fallback;
+	degraded = false;
+	constructor(createEntry, fallback = new FileTokenStore()) {
+		this.createEntry = createEntry;
+		this.fallback = fallback;
+	}
+	/** True once the keyring has failed and the file store has taken over. */
+	get isDegraded() {
+		return this.degraded;
+	}
+	async read(serverName) {
+		if (this.degraded) return this.fallback.read(serverName);
+		let raw;
+		try {
+			raw = await this.createEntry(KEYRING_SERVICE, serverName).getPassword();
+		} catch {
+			this.degraded = true;
+			return this.fallback.read(serverName);
+		}
+		if (!raw) return void 0;
+		try {
+			return JSON.parse(raw);
+		} catch {
+			return;
+		}
+	}
+	async write(serverName, entry) {
+		if (!this.degraded) try {
+			await this.createEntry(KEYRING_SERVICE, serverName).setPassword(JSON.stringify(entry));
+			return;
+		} catch {
+			this.degraded = true;
+		}
+		await this.fallback.write(serverName, entry);
+	}
+	/**
+	* Removes the credential from both stores.
+	*
+	* A session that degraded part way through can have left a copy in either place,
+	* and "signed out" has to mean no credential survives anywhere. A keyring that
+	* refuses the delete is reported rather than absorbed: the caller was told the
+	* credential is gone, and it is not. The fallback is still cleared first so the
+	* failure leaves one surviving copy instead of two.
+	*/
+	async clear(serverName) {
+		let keyringFailure;
+		if (!this.degraded) try {
+			await this.createEntry(KEYRING_SERVICE, serverName).deletePassword();
+		} catch (error) {
+			keyringFailure = error;
+		}
+		await this.fallback.clear(serverName);
+		if (keyringFailure !== void 0) {
+			const detail = keyringFailure instanceof Error ? keyringFailure.message : JSON.stringify(keyringFailure);
+			throw new Error(`Keyring credential for "${serverName}" could not be removed: ${detail}`, { cause: keyringFailure });
+		}
+	}
+};
+/**
+* Builds the token store for this host, falling back when the native module is absent.
+*
+* doom-mcp loads inside Pi, so a platform without a prebuilt keyring binary must
+* still get a working session rather than a failed extension install.
+*/
+async function createTokenStore(fallback = new FileTokenStore()) {
+	try {
+		const { AsyncEntry } = await import("@napi-rs/keyring");
+		return new KeyringTokenStore((service, account) => new AsyncEntry(service, account), fallback);
+	} catch {
+		return fallback;
+	}
+}
+//#endregion
+//#region src/services/mcpSettingsManager/index.ts
+const DISCOVERY_TIMEOUT_MS = 3e4;
+const AUTHORIZATION_TIMEOUT_MS = 3e5;
+const TERMINAL_FLOW_RETENTION_MS = 3e5;
+const EMPTY_SYNC = {
+	fresh: false,
+	reasons: ["never-synced"]
+};
+function configuredServerNames(groups) {
+	return [.../* @__PURE__ */ new Set([...groups.sessionLocal.serverNames, ...groups.shared.serverNames])].sort((left, right) => left.localeCompare(right));
+}
+function configSources(groups) {
+	return [...groups.sessionLocal.configSources, ...groups.shared.configSources];
+}
+function toolView(serverName, tool) {
+	return {
+		name: tool.name,
+		piName: toPiToolName(serverName, tool.name),
+		...tool.description ? { description: tool.description } : {}
+	};
+}
+function sanitizeDiagnostic(message, repositoryRoot, stagingDirectory) {
+	let safe = message;
+	for (const value of [
+		stagingDirectory,
+		repositoryRoot,
+		os.homedir()
+	]) if (value) safe = safe.split(value).join(value === os.homedir() ? "~" : "<repository>");
+	return safe.replace(/[A-Za-z]:\\[^\s,;)'"`]+/gu, "<path>").replace(/(^|\s)\/(?!\/)[^\s,;)'"`]+/gu, "$1<path>");
+}
+function publicFlow(flow) {
+	return {
+		id: flow.id,
+		repositoryId: flow.repositoryId,
+		serverName: flow.serverName,
+		status: flow.status,
+		...flow.authorizationUrl ? { authorizationUrl: flow.authorizationUrl } : {},
+		...flow.error ? { error: flow.error } : {},
+		expiresAt: flow.expiresAt
+	};
+}
+function isTerminal(status) {
+	return status === "completed" || status === "failed" || status === "cancelled" || status === "expired";
+}
+function safeAuthorizationUrl(url) {
+	if (url.protocol !== "https:" && url.protocol !== "http:" || url.toString().length > 4096) return void 0;
+	return url.toString();
+}
+var McpSettingsManager = class {
+	discoveryTimeoutMs;
+	authorizationTimeoutMs;
+	injectedTokenStore;
+	busyRepositories = /* @__PURE__ */ new Set();
+	flows = /* @__PURE__ */ new Map();
+	constructor(options = {}) {
+		this.discoveryTimeoutMs = options.discoveryTimeoutMs ?? DISCOVERY_TIMEOUT_MS;
+		this.authorizationTimeoutMs = options.authorizationTimeoutMs ?? AUTHORIZATION_TIMEOUT_MS;
+		this.injectedTokenStore = options.tokenStore;
+	}
+	async tokenStore() {
+		return this.injectedTokenStore ?? await createTokenStore();
+	}
+	async credentialPresence(serverNames) {
+		const presence = /* @__PURE__ */ new Map();
+		try {
+			const tokenStore = await this.tokenStore();
+			await Promise.all(serverNames.map(async (serverName) => {
+				try {
+					presence.set(serverName, await tokenStore.read(serverName) !== void 0);
+				} catch {
+					presence.set(serverName, false);
+				}
+			}));
+		} catch {
+			for (const serverName of serverNames) presence.set(serverName, false);
+		}
+		return presence;
+	}
+	prepare(repositoryId, repositoryRoot, sync, onlyServer) {
+		if (!sync?.mcpProjection) {
+			const readiness = sync ?? EMPTY_SYNC;
+			return {
+				catalog: {
+					repositoryId,
+					sync: {
+						fresh: readiness.fresh,
+						reasons: [...readiness.reasons]
+					},
+					servers: [],
+					droppedServers: [],
+					diagnostics: []
+				},
+				configSources: [],
+				groups: {
+					shared: {
+						configSources: [],
+						configPaths: [],
+						serverNames: []
+					},
+					sessionLocal: {
+						configSources: [],
+						configPaths: [],
+						serverNames: []
+					},
+					droppedServers: [],
+					diagnostics: []
+				}
+			};
+		}
+		const stagingDirectory = fs.mkdtempSync(path.join(os.tmpdir(), "po-mcp-settings-"));
+		fs.chmodSync(stagingDirectory, 448);
+		try {
+			const configuration = {
+				...mcpSessionConfigFromProjection(sync.mcpProjection),
+				repoRoot: repositoryRoot,
+				stagingDirectory,
+				...onlyServer ? { allowlist: {
+					servers: [onlyServer],
+					proxy: []
+				} } : {}
+			};
+			const groups = buildMcpConfigGroups(configuration);
+			const sources = configSources(groups);
+			const names = configuredServerNames(groups);
+			const cachedByServer = new Map(readCachedCatalog(sources).servers.map((server) => [server.name, server.tools]));
+			const servers = names.map((name) => {
+				const tools = cachedByServer.get(name) ?? [];
+				return {
+					name,
+					state: "not-connected",
+					source: tools.length === 0 ? "configured" : "cached",
+					credentialPresent: false,
+					tools: tools.map((tool) => toolView(name, tool))
+				};
+			});
+			return {
+				catalog: {
+					repositoryId,
+					sync: {
+						fresh: sync.fresh,
+						reasons: [...sync.reasons]
+					},
+					servers,
+					droppedServers: [...groups.droppedServers],
+					diagnostics: groups.diagnostics.map((diagnostic) => sanitizeDiagnostic(diagnostic, repositoryRoot, stagingDirectory))
+				},
+				configSources: sources,
+				groups,
+				stagingDirectory
+			};
+		} catch (error) {
+			fs.rmSync(stagingDirectory, {
+				recursive: true,
+				force: true
+			});
+			throw error;
+		}
+	}
+	cleanupPrepared(prepared) {
+		if (prepared.stagingDirectory) fs.rmSync(prepared.stagingDirectory, {
+			recursive: true,
+			force: true
+		});
+	}
+	async readCatalog(repositoryId, repositoryRoot, sync) {
+		const prepared = this.prepare(repositoryId, repositoryRoot, sync);
+		try {
+			const presence = await this.credentialPresence(prepared.catalog.servers.map((server) => server.name));
+			return {
+				...prepared.catalog,
+				servers: prepared.catalog.servers.map((server) => ({
+					...server,
+					credentialPresent: presence.get(server.name) ?? false
+				}))
+			};
+		} finally {
+			this.cleanupPrepared(prepared);
+		}
+	}
+	async discover(repositoryId, repositoryRoot, sync) {
+		if (this.busyRepositories.has(repositoryId)) throw new Error("MCP management is already active for this repository.");
+		const prepared = this.prepare(repositoryId, repositoryRoot, sync);
+		if (!prepared.catalog.sync.fresh) {
+			this.cleanupPrepared(prepared);
+			throw new Error("Sync this repository before discovering MCP capabilities.");
+		}
+		if (prepared.configSources.length === 0) {
+			this.cleanupPrepared(prepared);
+			return prepared.catalog;
+		}
+		this.busyRepositories.add(repositoryId);
+		const owner = new McpRuntimeOwner();
+		const liveStates = /* @__PURE__ */ new Map();
+		try {
+			const handle = await owner.start({
+				configSources: prepared.configSources,
+				workspaceRoot: repositoryRoot,
+				executionCwd: repositoryRoot,
+				tokenStore: await this.tokenStore(),
+				onAuthorizationUrl: (_url, serverName) => {
+					liveStates.set(serverName, {
+						serverName,
+						state: "needs-auth"
+					});
+				},
+				onServerStateChange: (change) => liveStates.set(change.serverName, change)
+			});
+			if (handle) await Promise.race([handle.connectionsSettled, new Promise((resolve) => setTimeout(resolve, this.discoveryTimeoutMs))]);
+			const manager = handle?.services.clientManager;
+			const cachedByServer = new Map(readCachedCatalog(prepared.configSources).servers.map((server) => [server.name, server.tools]));
+			const presence = await this.credentialPresence(prepared.catalog.servers.map((server) => server.name));
+			const servers = await Promise.all(prepared.catalog.servers.map(async (server) => {
+				const change = liveStates.get(server.name);
+				const state = change?.state ?? manager?.getServerState(server.name) ?? server.state;
+				let tools = cachedByServer.get(server.name) ?? [];
+				let source = tools.length === 0 ? "configured" : "cached";
+				if (state === "connected" && manager) try {
+					tools = await manager.ensureConnected(server.name).then(async (connection) => await connection.listTools());
+					source = "live";
+				} catch {}
+				return {
+					name: server.name,
+					state,
+					source,
+					credentialPresent: presence.get(server.name) ?? false,
+					tools: tools.map((tool) => toolView(server.name, tool)),
+					...change?.error ? { error: "The server reported a connection error." } : {}
+				};
+			}));
+			return {
+				...prepared.catalog,
+				servers
+			};
+		} finally {
+			await owner.dispose();
+			this.cleanupPrepared(prepared);
+			this.busyRepositories.delete(repositoryId);
+		}
+	}
+	async authorize(repositoryId, repositoryRoot, sync, serverName, redirect) {
+		this.sweepFlows();
+		if (this.busyRepositories.has(repositoryId)) throw new Error("MCP management is already active for this repository.");
+		const full = this.prepare(repositoryId, repositoryRoot, sync);
+		const configured = full.catalog.servers.some((server) => server.name === serverName);
+		const fresh = full.catalog.sync.fresh;
+		this.cleanupPrepared(full);
+		if (!fresh) throw new Error("Sync this repository before authorizing an MCP server.");
+		if (!configured) throw new Error("That MCP server is not enabled for this repository.");
+		const prepared = this.prepare(repositoryId, repositoryRoot, sync, serverName);
+		const flow = {
+			id: randomUUID(),
+			repositoryId,
+			serverName,
+			status: "starting",
+			expiresAt: Date.now() + this.authorizationTimeoutMs,
+			stagingDirectory: prepared.stagingDirectory
+		};
+		this.flows.set(flow.id, flow);
+		this.busyRepositories.add(repositoryId);
+		this.runAuthorization(flow, prepared.configSources, repositoryRoot, redirect);
+		return publicFlow(flow);
+	}
+	getAuthorization(flowId, repositoryId) {
+		this.sweepFlows();
+		const flow = this.flows.get(flowId);
+		return flow?.repositoryId === repositoryId ? publicFlow(flow) : void 0;
+	}
+	async cancelAuthorization(flowId, repositoryId) {
+		const flow = this.flows.get(flowId);
+		if (!flow || flow.repositoryId !== repositoryId) return void 0;
+		if (!isTerminal(flow.status)) {
+			flow.status = "cancelled";
+			await this.finishFlow(flow);
+		}
+		return publicFlow(flow);
+	}
+	async runAuthorization(flow, sources, repositoryRoot, redirect) {
+		const owner = new McpRuntimeOwner();
+		flow.owner = owner;
+		flow.timeout = setTimeout(() => {
+			if (isTerminal(flow.status)) return;
+			flow.status = "expired";
+			flow.error = "Authorization timed out.";
+			this.finishFlow(flow);
+		}, this.authorizationTimeoutMs);
+		try {
+			const handle = await owner.start({
+				configSources: sources,
+				workspaceRoot: repositoryRoot,
+				executionCwd: repositoryRoot,
+				tokenStore: await this.tokenStore(),
+				...redirect ? { callbackServer: hubCallbackSink(redirect) } : {},
+				onAuthorizationUrl: (url, serverName) => {
+					if (serverName !== flow.serverName || isTerminal(flow.status)) return;
+					const safeUrl = safeAuthorizationUrl(url);
+					if (!safeUrl) {
+						flow.status = "failed";
+						flow.error = "The server returned an invalid authorization URL.";
+						this.finishFlow(flow);
+						return;
+					}
+					flow.authorizationUrl = safeUrl;
+					flow.status = "waiting";
+				},
+				onServerStateChange: (change) => this.applyAuthorizationState(flow, change)
+			});
+			if (!handle || isTerminal(flow.status)) return;
+			const manager = handle.services.clientManager;
+			await manager.disconnectServer(flow.serverName);
+			await manager.ensureConnected(flow.serverName);
+			if (!isTerminal(flow.status)) flow.status = "completed";
+		} catch {
+			if (!isTerminal(flow.status)) {
+				flow.status = "failed";
+				flow.error = "The MCP server could not complete authorization.";
+			}
+		} finally {
+			if (!isTerminal(flow.status)) flow.status = "completed";
+			await this.finishFlow(flow);
+		}
+	}
+	applyAuthorizationState(flow, change) {
+		if (change.serverName !== flow.serverName || isTerminal(flow.status)) return;
+		if (change.state === "connected") flow.status = "completed";
+		else if (change.state === "needs-auth" && flow.status === "starting") flow.status = "waiting";
+		else if (change.state === "failed") {
+			flow.status = "failed";
+			flow.error = "The MCP server rejected the authorization attempt.";
+		}
+	}
+	async finishFlow(flow) {
+		if (flow.timeout) clearTimeout(flow.timeout);
+		flow.timeout = void 0;
+		const owner = flow.owner;
+		flow.owner = void 0;
+		await owner?.dispose();
+		if (flow.stagingDirectory) fs.rmSync(flow.stagingDirectory, {
+			recursive: true,
+			force: true
+		});
+		flow.stagingDirectory = void 0;
+		this.busyRepositories.delete(flow.repositoryId);
+		flow.retainedUntil = Date.now() + TERMINAL_FLOW_RETENTION_MS;
+	}
+	sweepFlows() {
+		const now = Date.now();
+		for (const [id, flow] of this.flows) if (flow.retainedUntil !== void 0 && flow.retainedUntil <= now) this.flows.delete(id);
+	}
+	async dispose() {
+		await Promise.all([...this.flows.values()].map(async (flow) => {
+			if (!isTerminal(flow.status)) flow.status = "cancelled";
+			await this.finishFlow(flow);
+		}));
+		this.flows.clear();
+		this.busyRepositories.clear();
+	}
+};
+//#endregion
+//#region src/types/apiRoutes.ts
+/** One authorization flow, addressed by id below the flow collection. */
+const AUTHORIZATION_FLOW_PATH = `${MCP_AUTHORIZATION_API_PATH}/:${MCP_FLOW_ID_PARAM}`;
+/**
+* This package's routes, as data.
+*
+* No scope and no base path. The build reads both off
+* `src/extensions/(backend)/api/mcp/`, so the mount is stated once, by the
+* folder that creates it. The sub-paths come from `webMcp`, which already owned
+* them, so this table names where a route sits and nothing else.
+*
+* This is the one file the hub handler and the settings panel both read, so a
+* path cannot move on one side alone. The handler matches on these strings
+* rather than parsing its own copies of them.
+*
+* `:flowId` is the client's parameter syntax; the handler reads the segment off
+* the same path, so the two cannot disagree about where the id sits.
+*/
+var apiRoutes_default = defineApiRoutes({
+	catalog: {
+		method: "GET",
+		path: MCP_REPOSITORY_API_PATH,
+		query: [MCP_REPOSITORY_ID_QUERY],
+		response: apiResponse()
+	},
+	discover: {
+		method: "POST",
+		path: MCP_DISCOVERY_API_PATH,
+		response: apiResponse()
+	},
+	authorize: {
+		method: "POST",
+		path: MCP_AUTHORIZATION_API_PATH,
+		response: apiResponse()
+	},
+	readAuthorization: {
+		method: "GET",
+		path: AUTHORIZATION_FLOW_PATH,
+		query: [MCP_REPOSITORY_ID_QUERY],
+		response: apiResponse()
+	},
+	/** The same path as `readAuthorization`; the method is the whole of the difference. */
+	cancelAuthorization: {
+		method: "DELETE",
+		path: AUTHORIZATION_FLOW_PATH,
+		query: [MCP_REPOSITORY_ID_QUERY],
+		response: apiResponse()
+	},
+	/** Session scope: one available tool's registered name, description and schema. */
+	sessionTool: {
+		method: "GET",
+		path: MCP_SESSION_TOOL_API_PATH,
+		query: [MCP_SESSION_TOOL_SERVER_QUERY, MCP_SESSION_TOOL_NAME_QUERY],
+		response: apiResponse()
+	}
+});
+//#endregion
+//#region src/services/mcpHubApi/index.ts
+/**
+* What sits above a flow id, read off the flow route itself.
+*
+* This handler matches paths by hand rather than through a router, so the one
+* route carrying a parameter is split here: everything before `:flowId` is the
+* prefix a request must start with, and what follows it is the id.
+*/
+const AUTHORIZATION_FLOW_PREFIX = apiRoutes_default.readAuthorization.path.replace(`:${MCP_FLOW_ID_PARAM}`, "");
+const JSON_HEADERS = { "content-type": "application/json" };
+const REPOSITORY_ID = /^(?:[a-f0-9]{32}|repo-[A-Za-z0-9_-]{24}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$/u;
+const FLOW_ID = /^[a-f0-9-]{36}$/u;
+const MAX_BODY_BYTES = 8192;
+const MAX_SERVER_NAME = 160;
+const manager = new McpSettingsManager();
+function json(body, status = 200) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: JSON_HEADERS
+	});
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function bodyOf(request) {
+	const text = await request.text();
+	if (text.length > MAX_BODY_BYTES) return void 0;
+	try {
+		const parsed = JSON.parse(text);
+		return isRecord(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+function repositoryIdOf(value) {
+	return typeof value === "string" && REPOSITORY_ID.test(value) ? value : void 0;
+}
+function serverNameOf(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= MAX_SERVER_NAME && !Array.from(value).some((character) => character.charCodeAt(0) <= 31) ? value : void 0;
+}
+function resolveRepository(context, repositoryId) {
+	return context.resolveRepository?.(repositoryId);
+}
+function errorStatus(error) {
+	const message = error instanceof Error ? error.message : "";
+	if (message.includes("already active")) return {
+		status: 409,
+		message
+	};
+	if (message.startsWith("Sync this repository")) return {
+		status: 409,
+		message
+	};
+	if (message.includes("not enabled")) return {
+		status: 404,
+		message
+	};
+	return {
+		status: 500,
+		message: "MCP management could not complete that request."
+	};
+}
+async function handleCatalog(request, context) {
+	const repositoryId = repositoryIdOf(new URL(request.url).searchParams.get(MCP_REPOSITORY_ID_QUERY));
+	if (!repositoryId) return json({ error: "A valid repositoryId is required." }, 400);
+	const repositoryRoot = resolveRepository(context, repositoryId);
+	if (!repositoryRoot) return json({ error: "That repository is not available to this hub." }, 404);
+	try {
+		return json(await manager.readCatalog(repositoryId, repositoryRoot, await context.readRepositorySync?.(repositoryId)));
+	} catch {
+		return json({ error: "The synced MCP catalog could not be read." }, 500);
+	}
+}
+async function handleDiscovery(request, context) {
+	const repositoryId = repositoryIdOf((await bodyOf(request))?.repositoryId);
+	if (!repositoryId) return json({ error: "A valid repositoryId is required." }, 400);
+	const repositoryRoot = resolveRepository(context, repositoryId);
+	if (!repositoryRoot) return json({ error: "That repository is not available to this hub." }, 404);
+	try {
+		return json(await manager.discover(repositoryId, repositoryRoot, await context.readRepositorySync?.(repositoryId)));
+	} catch (error) {
+		const failure = errorStatus(error);
+		return json({ error: failure.message }, failure.status);
+	}
+}
+async function handleAuthorize(request, context) {
+	const body = await bodyOf(request);
+	const repositoryId = repositoryIdOf(body?.repositoryId);
+	const serverName = serverNameOf(body?.serverName);
+	if (!repositoryId || !serverName) return json({ error: "A valid repositoryId and serverName are required." }, 400);
+	const repositoryRoot = resolveRepository(context, repositoryId);
+	if (!repositoryRoot) return json({ error: "That repository is not available to this hub." }, 404);
+	try {
+		return json(await manager.authorize(repositoryId, repositoryRoot, await context.readRepositorySync?.(repositoryId), serverName, context.oauthRedirect?.()), 202);
+	} catch (error) {
+		const failure = errorStatus(error);
+		return json({ error: failure.message }, failure.status);
+	}
+}
+async function handleAuthorizationFlow(request, context, path) {
+	const flowId = path.slice(AUTHORIZATION_FLOW_PREFIX.length);
+	const repositoryId = repositoryIdOf(new URL(request.url).searchParams.get(MCP_REPOSITORY_ID_QUERY));
+	if (!repositoryId || !FLOW_ID.test(flowId)) return json({ error: "A valid repositoryId and flow id are required." }, 400);
+	if (!resolveRepository(context, repositoryId)) return json({ error: "That repository is not available to this hub." }, 404);
+	if (request.method === apiRoutes_default.cancelAuthorization.method) {
+		const flow = await manager.cancelAuthorization(flowId, repositoryId);
+		return flow ? json(flow) : json({ error: "That authorization flow was not found." }, 404);
+	}
+	const flow = manager.getAuthorization(flowId, repositoryId);
+	return flow ? json(flow) : json({ error: "That authorization flow was not found." }, 404);
+}
+//#endregion
+//#region src/extensions/(backend)/api/mcp/route.server.ts
+/**
+* Mounts this package's HTTP API at `mcp`, which the folder names.
+*
+* The folder is the declaration: the build reads the base path off it and hands
+* the browser a client bound to the same segment, so the settings panel can no
+* longer spell a workspace mount by hand.
+*/
+var route_server_default$1 = defineRoute({
+	basePath: "mcp",
+	start(context) {
+		return {
+			async fetch(request) {
+				const path = new URL(request.url).pathname;
+				if (request.method === apiRoutes_default.catalog.method && path === apiRoutes_default.catalog.path) return await handleCatalog(request, context);
+				if (request.method === apiRoutes_default.discover.method && path === apiRoutes_default.discover.path) return await handleDiscovery(request, context);
+				if (request.method === apiRoutes_default.authorize.method && path === apiRoutes_default.authorize.path) return await handleAuthorize(request, context);
+				if ((request.method === apiRoutes_default.readAuthorization.method || request.method === apiRoutes_default.cancelAuthorization.method) && path.startsWith(AUTHORIZATION_FLOW_PREFIX)) return await handleAuthorizationFlow(request, context, path);
+				return json({ error: "Not found." }, 404);
+			},
+			close() {
+				manager.dispose();
+			}
+		};
+	}
+});
+//#endregion
+//#region src/extensions/workspaces/sessions/(backend)/api/mcp-session/route.server.ts
+/** Mounts the session's `mcp-session` API: the reachable tool detail the context panel opens. */
+var route_server_default = defineRoute((context) => context.root.api[0]);
+//#endregion
+//#region src/extensions/workspaces/sessions/(backend)/command/mcp.server.ts
+var mcp_server_default = defineServerCommand((context) => context.root.commands[0]);
+//#endregion
+//#region src/extensions/workspaces/sessions/(backend)/method/apps.server.ts
+var apps_server_default = defineRoutedContribution((context) => context.root.appMethods, { cardinality: "many" });
+//#endregion
+//#region src/extensions/workspaces/sessions/(backend)/resource/po-use-mcp.server.ts
+var po_use_mcp_server_default = defineResource({
+	name: "po-use-mcp",
+	description: "Inspect domain-scoped MCP servers, authenticate, reload configuration, and troubleshoot tool availability.",
+	when: DOOM_HELP_WHEN,
+	kind: "skill",
+	read: () => readPackageResource(import.meta.url, "src/prompts/po-use-mcp/SKILL.md")
+});
+//#endregion
+//#region generated/server.ts
+const at = (value, context) => typeof value === "function" ? value(context) : value;
+const many = (value, context) => {
+	const resolved = typeof value === "function" ? value(context) : value;
+	return Array.isArray(resolved) ? resolved : [resolved];
+};
+const via = (identity, value) => value === void 0 ? void 0 : {
+	...identity,
+	...value
+};
+const facet = defineServerPlugin({
+	name: "@agimon-ai/po-mcp",
+	providerOverrides: composeServerProviderOverrides(root_server_default),
+	global: (context) => ({ get api() {
+		return [at(route_server_default$1, context)];
+	} }),
+	workspace: (context) => ({ get api() {
+		return [at(route_server_default$1, context)];
+	} }),
+	session: async (context) => {
+		const scopeSession = await root_server_default(context);
+		const contextSession = {
+			...context,
+			root: scopeSession.value
+		};
+		return {
+			...composeRootHooks(scopeSession),
+			get api() {
+				return [at(route_server_default$1, context), at(route_server_default, contextSession)];
+			},
+			get commands() {
+				return [via({ name: "mcp" }, at(mcp_server_default, contextSession))];
+			},
+			get methods() {
+				return [...many(apps_server_default, contextSession)];
+			},
+			get resources() {
+				return [at(po_use_mcp_server_default, contextSession)];
+			},
+			services: [...scopeSession.services ?? []],
+			get activities() {
+				return [...scopeSession.activities ?? []];
+			}
+		};
+	}
+});
+//#endregion
+export { facet as default, facet };
+
+//# sourceMappingURL=server.mjs.map