@akon-labs/nexus-cli 0.1.9 → 0.1.11-rc.2

package/dist/extensions/mcp/host-html-template.js

@@ -0,0 +1,442 @@
+import { VERSION } from "../../config.js";
+// Use locally bundled AppBridge to avoid CDN Zod bundling issues
+const DEFAULT_APP_BRIDGE_MODULE_URL = "/app-bridge.bundle.js";
+const APP_SANDBOX = "allow-scripts allow-forms allow-modals allow-popups allow-downloads";
+export function buildHostHtmlTemplate(input) {
+    const hostContext = input.hostContext ?? {};
+    const sessionToken = safeInlineJSON(input.sessionToken);
+    const uiResourceToken = safeInlineJSON(input.uiResourceToken);
+    const toolArgs = safeInlineJSON(input.toolArgs);
+    const serverName = safeInlineJSON(input.serverName);
+    const toolName = safeInlineJSON(input.toolName);
+    const hostContextJson = safeInlineJSON(hostContext);
+    const allowAttribute = safeInlineJSON(input.allowAttribute);
+    const requireToolConsent = safeInlineJSON(input.requireToolConsent);
+    const cacheToolConsent = safeInlineJSON(input.cacheToolConsent);
+    const moduleUrl = safeInlineJSON(input.appBridgeModuleUrl ?? DEFAULT_APP_BRIDGE_MODULE_URL);
+    const nexusVersion = safeInlineJSON(VERSION);
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>MCP UI - ${escapeHtml(input.serverName)} / ${escapeHtml(input.toolName)}</title>
+  <style>
+    :root {
+      color-scheme: light dark;
+      --bg: #0f1115;
+      --surface: #181c22;
+      --text: #ecf0f5;
+      --muted: #a9b2bf;
+      --accent: #43c0ff;
+      --border: rgba(255, 255, 255, 0.12);
+      --good: #34d399;
+      --warn: #fbbf24;
+      --bad: #f87171;
+    }
+    @media (prefers-color-scheme: light) {
+      :root {
+        --bg: #f6f7fb;
+        --surface: #ffffff;
+        --text: #1d2939;
+        --muted: #667085;
+        --accent: #0ea5e9;
+        --border: rgba(15, 23, 42, 0.14);
+        --good: #059669;
+        --warn: #b45309;
+        --bad: #b91c1c;
+      }
+    }
+    * { box-sizing: border-box; }
+    html, body { margin: 0; padding: 0; height: 100%; font-family: ui-sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background: var(--bg); color: var(--text); }
+    body { display: flex; flex-direction: column; min-height: 100vh; min-height: 100dvh; }
+    header { background: var(--surface); border-bottom: 1px solid var(--border); padding: calc(10px + env(safe-area-inset-top, 0px)) calc(14px + env(safe-area-inset-right, 0px)) 10px calc(14px + env(safe-area-inset-left, 0px)); display: flex; align-items: center; justify-content: space-between; gap: 10px; }
+    .title { display: flex; gap: 8px; align-items: baseline; min-width: 0; }
+    .server { font-size: 12px; color: var(--muted); text-transform: uppercase; letter-spacing: 0.08em; white-space: nowrap; }
+    .tool { font-size: 14px; font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+    .badge { border: 1px solid var(--border); border-radius: 999px; padding: 2px 8px; font-size: 11px; color: var(--muted); white-space: nowrap; }
+    .controls { display: flex; gap: 8px; align-items: center; }
+    .status { font-size: 12px; color: var(--muted); white-space: nowrap; }
+    button { border: 1px solid var(--border); background: transparent; color: var(--text); border-radius: 8px; padding: 6px 10px; cursor: pointer; font-size: 12px; }
+    button.primary { border-color: color-mix(in srgb, var(--good) 40%, var(--border) 60%); color: var(--good); }
+    button.danger { border-color: color-mix(in srgb, var(--bad) 40%, var(--border) 60%); color: var(--bad); }
+    button:hover { background: color-mix(in srgb, var(--surface) 75%, var(--accent) 25%); }
+    main { flex: 1; min-height: 0; padding: 10px; padding-inline: calc(10px + env(safe-area-inset-left, 0px)) calc(10px + env(safe-area-inset-right, 0px)); padding-bottom: calc(10px + env(safe-area-inset-bottom, 0px)); display: flex; }
+    iframe { width: 100%; height: 100%; border: 1px solid var(--border); border-radius: 10px; background: white; }
+    .overlay { position: fixed; inset: 0; background: color-mix(in srgb, var(--bg) 90%, black 10%); display: none; align-items: center; justify-content: center; z-index: 2; padding: 16px; }
+    .overlay.visible { display: flex; }
+    .panel { width: min(680px, calc(100vw - 40px)); background: var(--surface); border: 1px solid var(--border); border-radius: 12px; padding: 18px; }
+    .panel h2 { margin: 0 0 8px; font-size: 16px; }
+    .panel p { margin: 0; color: var(--muted); line-height: 1.4; font-size: 14px; white-space: pre-wrap; }
+    @media (max-width: 640px) {
+      header { align-items: stretch; flex-direction: column; gap: 8px; }
+      .title { flex-wrap: wrap; row-gap: 4px; }
+      .server { flex-basis: 100%; }
+      .controls { width: 100%; }
+      .status { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; }
+      button { min-height: 44px; padding: 10px 14px; }
+      main { padding: 6px; padding-inline: calc(6px + env(safe-area-inset-left, 0px)) calc(6px + env(safe-area-inset-right, 0px)); padding-bottom: calc(6px + env(safe-area-inset-bottom, 0px)); }
+      iframe { border-radius: 6px; }
+      .panel { width: 100%; }
+    }
+  </style>
+</head>
+<body>
+  <header>
+    <div class="title">
+      <span class="server">MCP · <span id="server-name"></span></span>
+      <span class="tool" id="tool-name"></span>
+      <span class="badge">Sandboxed</span>
+    </div>
+    <div class="controls">
+      <span class="status" id="status">Loading UI...</span>
+      <button class="primary" id="done-btn" title="Cmd/Ctrl+Enter">Done</button>
+      <button class="danger" id="cancel-btn" title="Escape">Cancel</button>
+    </div>
+  </header>
+  <main>
+    <iframe id="mcp-app" sandbox="${APP_SANDBOX}" referrerpolicy="no-referrer"></iframe>
+  </main>
+  <div class="overlay" id="error-overlay">
+    <div class="panel">
+      <h2>UI Error</h2>
+      <p id="error-message"></p>
+    </div>
+  </div>
+  <div class="overlay" id="completion-overlay">
+    <div class="panel">
+      <h2>Done</h2>
+      <p>MCP UI session finished. You can close this page and return to Nexus.</p>
+    </div>
+  </div>
+  <script type="module">
+    import { AppBridge, PostMessageTransport } from ${moduleUrl};
+
+    const SESSION_TOKEN = ${sessionToken};
+    const UI_RESOURCE_TOKEN = ${uiResourceToken};
+    const SERVER_NAME = ${serverName};
+    const TOOL_NAME = ${toolName};
+    const TOOL_ARGS = ${toolArgs};
+    const HOST_CONTEXT = ${hostContextJson};
+    const ALLOW_ATTRIBUTE = ${allowAttribute};
+    const REQUIRE_TOOL_CONSENT = ${requireToolConsent};
+    const CACHE_TOOL_CONSENT = ${cacheToolConsent};
+    const STREAM_CONTEXT_KEY = "nexus-mcp/stream";
+    const STREAM_PATCH_METHOD = "notifications/nexus-mcp/ui-result-patch";
+
+    const iframe = document.getElementById("mcp-app");
+    const statusNode = document.getElementById("status");
+    const doneBtn = document.getElementById("done-btn");
+    const cancelBtn = document.getElementById("cancel-btn");
+    const errorOverlay = document.getElementById("error-overlay");
+    const completionOverlay = document.getElementById("completion-overlay");
+    const errorMessage = document.getElementById("error-message");
+
+    document.getElementById("server-name").textContent = SERVER_NAME;
+    document.getElementById("tool-name").textContent = TOOL_NAME;
+
+    const setStatus = (text, isError = false) => {
+      statusNode.textContent = text;
+      statusNode.style.color = isError ? "var(--bad)" : "var(--muted)";
+    };
+
+    const showError = (message) => {
+      errorMessage.textContent = message;
+      errorOverlay.classList.add("visible");
+      setStatus("Error", true);
+    };
+
+    let completionPending = false;
+    const showCompletion = () => {
+      completionOverlay.classList.add("visible");
+      setStatus("Complete");
+    };
+    const closeOrShowDone = () => {
+      completionPending = true;
+      window.close();
+      setTimeout(() => {
+        if (!document.hidden) {
+          showCompletion();
+        }
+      }, 1000);
+    };
+    document.addEventListener("visibilitychange", () => {
+      if (completionPending && !document.hidden) {
+        showCompletion();
+      }
+    });
+
+    const post = async (endpoint, params) => {
+      const response = await fetch(endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ token: SESSION_TOKEN, params }),
+      });
+
+      const body = await response.json().catch(() => ({ ok: false, error: "Invalid JSON response" }));
+      if (!response.ok || !body.ok) {
+        const message = body.error || ("HTTP " + response.status);
+        throw new Error(message);
+      }
+      return body.result ?? {};
+    };
+
+    let consentGranted = !REQUIRE_TOOL_CONSENT;
+    const initialStreamContext = HOST_CONTEXT?.[STREAM_CONTEXT_KEY];
+    const streamMode = initialStreamContext?.mode === "stream-first" ? "stream-first" : "eager";
+
+    const bridge = new AppBridge(
+      null,
+      { name: "nexus", version: ${nexusVersion} },
+      { serverTools: {}, openLinks: {}, logging: {}, updateModelContext: {}, message: {} },
+      { hostContext: HOST_CONTEXT }
+    );
+
+    bridge.oncalltool = async (params) => {
+      if (!consentGranted) {
+        const accepted = window.confirm("Allow this UI to call server tools for this session?");
+        if (!accepted) {
+          await post("/proxy/ui/consent", { approved: false }).catch(() => {});
+          return {
+            isError: true,
+            content: [{ type: "text", text: "Tool call denied by user." }],
+          };
+        }
+        await post("/proxy/ui/consent", { approved: true });
+        if (CACHE_TOOL_CONSENT) {
+          consentGranted = true;
+        }
+      }
+      const result = await post("/proxy/tools/call", params);
+      // Notify agent about the tool call
+      await post("/proxy/ui/generated-tool-call-intent", {
+        tool: params.name,
+        arguments: params.arguments,
+        isError: result.isError
+      }).catch(() => {});
+      return result;
+    };
+
+    bridge.onmessage = async (params) => post("/proxy/ui/message", params);
+    bridge.onupdatemodelcontext = async (params) => post("/proxy/ui/context", params);
+
+    // Also listen for raw postMessage events with custom types (notify, prompt, intent, etc.)
+    // These bypass the AppBridge protocol but are used by some MCP UI implementations
+    window.addEventListener("message", async (event) => {
+      if (event.source !== iframe.contentWindow) return;
+      const data = event.data;
+      if (!data || typeof data !== "object") return;
+
+      // Skip AppBridge protocol messages (handled by bridge)
+      if (data.jsonrpc || (typeof data.method === "string" && (data.method.startsWith("app/") || data.method.startsWith("host/")))) return;
+
+      // Handle raw UI action messages
+      const msgType = data.type;
+      if (typeof msgType !== "string") return;
+
+      if (msgType === "notify" || msgType === "prompt" || msgType === "intent" || msgType === "message") {
+        // Standard MCP-UI types - preserve their semantics
+        // Support both { type, payload: {...} } and { type, field: value } formats
+        const { type: _, payload, ...directFields } = data;
+        await post("/proxy/ui/message", { type: msgType, ...directFields, ...(payload || {}) }).catch(() => {});
+      } else if (!msgType.startsWith("ui-lifecycle-") && !msgType.startsWith("ui-message-")) {
+        // Any other custom type - forward as intent with type as intent name
+        // (Skip internal lifecycle/ack messages)
+        const payload = data.payload || {};
+        await post("/proxy/ui/message", {
+          type: "intent",
+          intent: msgType,
+          params: payload,
+        }).catch(() => {});
+      }
+    });
+    bridge.ondownloadfile = async (params) => post("/proxy/ui/download-file", params);
+    bridge.onrequestdisplaymode = async (params) => post("/proxy/ui/request-display-mode", params);
+    bridge.onopenlink = async (params) => {
+	  let externalUrl;
+	  try {
+		externalUrl = new URL(params.url);
+	  } catch {
+		return { isError: true };
+	  }
+	  if ((externalUrl.protocol !== "http:" && externalUrl.protocol !== "https:") || externalUrl.username || externalUrl.password) {
+		return { isError: true };
+	  }
+      const result = await post("/proxy/ui/open-link", params);
+      if (!result.isError) {
+		window.open(externalUrl.href, "_blank", "noopener,noreferrer");
+        // Notify agent about the link open
+        await post("/proxy/ui/message", {
+          type: "intent",
+          intent: "open_link",
+          params: { url: params.url }
+        }).catch(() => {});
+      }
+      return result;
+    };
+
+    bridge.oninitialized = () => {
+      if (streamMode !== "stream-first") {
+        bridge.sendToolInput({ arguments: TOOL_ARGS });
+      }
+      setStatus(streamMode === "stream-first" ? "Streaming…" : "Connected");
+    };
+
+    bridge.onsizechange = ({ width, height }) => {
+      if (typeof width === "number" && width > 0) {
+        iframe.style.minWidth = Math.min(width, window.innerWidth - 24) + "px";
+      }
+      if (typeof height === "number" && height > 0) {
+        iframe.style.height = Math.max(height, 320) + "px";
+      }
+    };
+
+    if (ALLOW_ATTRIBUTE) {
+      iframe.setAttribute("allow", ALLOW_ATTRIBUTE);
+    }
+
+    // Connect bridge BEFORE loading iframe to ensure we're listening when the app sends ui/initialize
+    try {
+      const transport = new PostMessageTransport(iframe.contentWindow, window);
+      await bridge.connect(transport);
+    } catch (error) {
+      console.error("[host] Bridge connection failed:", error);
+      showError("Failed to initialize AppBridge: " + String(error));
+    }
+
+    const iframeLoaded = new Promise((resolve) => {
+      iframe.onload = resolve;
+    });
+    iframe.src = "/ui-app?resource=" + encodeURIComponent(UI_RESOURCE_TOKEN);
+    await iframeLoaded;
+
+    const eventSource = new EventSource("/events?session=" + encodeURIComponent(SESSION_TOKEN));
+    eventSource.addEventListener("tool-input", (event) => {
+      try {
+        bridge.sendToolInput(JSON.parse(event.data));
+      } catch (error) {
+        showError("Failed to forward tool input: " + String(error));
+      }
+    });
+    eventSource.addEventListener("tool-result", (event) => {
+      try {
+        bridge.sendToolResult(JSON.parse(event.data));
+      } catch (error) {
+        showError("Failed to forward tool result: " + String(error));
+      }
+    });
+    eventSource.addEventListener("tool-cancelled", (event) => {
+      try {
+        bridge.sendToolCancelled(JSON.parse(event.data));
+      } catch (error) {
+        showError("Failed to forward cancellation: " + String(error));
+      }
+    });
+    eventSource.addEventListener("result-patch", async (event) => {
+      try {
+        await bridge.notification({
+          method: STREAM_PATCH_METHOD,
+          params: JSON.parse(event.data),
+        });
+      } catch (error) {
+        showError("Failed to forward stream patch: " + String(error));
+      }
+    });
+    eventSource.addEventListener("host-context", (event) => {
+      try {
+        bridge.setHostContext(JSON.parse(event.data));
+      } catch {}
+    });
+    eventSource.addEventListener("session-complete", async () => {
+      await bridge.teardownResource({}).catch(() => {});
+      clearInterval(heartbeat);
+      eventSource.close();
+      closeOrShowDone();
+    });
+    eventSource.onerror = () => {
+      setStatus("Connection lost", true);
+    };
+
+    const heartbeat = setInterval(() => {
+      post("/proxy/ui/heartbeat", {}).catch(() => {});
+    }, 10000);
+
+    const complete = async (reason) => {
+      try {
+        await post("/proxy/ui/complete", { reason });
+      } catch {}
+      try {
+        await bridge.teardownResource({});
+      } catch {}
+      clearInterval(heartbeat);
+      eventSource.close();
+      closeOrShowDone();
+    };
+
+    doneBtn.addEventListener("click", () => complete("done"));
+    cancelBtn.addEventListener("click", () => complete("cancel"));
+    window.addEventListener("keydown", (event) => {
+      if (event.key === "Escape") {
+        event.preventDefault();
+        complete("cancel");
+      } else if ((event.metaKey || event.ctrlKey) && event.key === "Enter") {
+        event.preventDefault();
+        complete("done");
+      }
+    });
+  </script>
+</body>
+</html>`;
+}
+export function buildCspMetaContent(csp) {
+    const resourceDomains = sanitizeCspDomains(csp?.resourceDomains);
+    const connectDomains = sanitizeCspDomains(csp?.connectDomains);
+    const frameDomains = sanitizeCspDomains(csp?.frameDomains);
+    const baseUriDomains = sanitizeCspDomains(csp?.baseUriDomains);
+    return [
+        "default-src 'none'",
+        `sandbox ${APP_SANDBOX}`,
+        toDirective("script-src", ["'self'", "'unsafe-inline'"], resourceDomains),
+        toDirective("style-src", ["'self'", "'unsafe-inline'"], resourceDomains),
+        toDirective("font-src", ["'self'"], resourceDomains),
+        toDirective("img-src", ["'self'", "data:"], resourceDomains),
+        toDirective("media-src", ["'self'", "data:"], resourceDomains),
+        connectDomains.length > 0 ? `connect-src ${connectDomains.join(" ")}` : "connect-src 'none'",
+        frameDomains.length > 0 ? `frame-src ${frameDomains.join(" ")}` : "frame-src 'none'",
+        "worker-src 'none'",
+        "object-src 'none'",
+        baseUriDomains.length > 0 ? `base-uri ${baseUriDomains.join(" ")}` : "base-uri 'self'",
+    ].join("; ");
+}
+function toDirective(name, trustedSources, domains) {
+    return `${name} ${[...new Set([...trustedSources, ...domains])].join(" ")}`;
+}
+function sanitizeCspDomains(domains) {
+    if (!Array.isArray(domains))
+        return [];
+    return [
+        ...new Set(domains.filter((domain) => typeof domain === "string" &&
+            domain.length > 0 &&
+            // HTTP headers must be printable ASCII; rejecting all other code points also
+            // excludes every C0/C1 control character before Node serializes the policy.
+            /^[\x21-\x7E]+$/.test(domain) &&
+            !/[;'"]/.test(domain))),
+    ];
+}
+function safeInlineJSON(value) {
+    return JSON.stringify(value)
+        .replace(/</g, "\\u003c")
+        .replace(/>/g, "\\u003e")
+        .replace(/&/g, "\\u0026")
+        .replace(/\u2028/g, "\\u2028")
+        .replace(/\u2029/g, "\\u2029");
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+//# sourceMappingURL=host-html-template.js.map

package/dist/extensions/mcp/host-html-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-html-template.js","sourceRoot":"","sources":["../../../src/extensions/mcp/host-html-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAG1C,iEAAiE;AACjE,MAAM,6BAA6B,GAAG,uBAAuB,CAAC;AAC9D,MAAM,WAAW,GAAG,qEAAqE,CAAC;AAgB1F,MAAM,UAAU,qBAAqB,CAAC,KAA4B,EAAU;IAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IAE5C,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,eAAe,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5D,MAAM,kBAAkB,GAAG,cAAc,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,kBAAkB,IAAI,6BAA6B,CAAC,CAAC;IAC5F,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAE7C,OAAO;;;;;oBAKY,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA2E5C,WAAW;;;;;;;;;;;;;;;sDAeO,SAAS;;4BAEnC,YAAY;gCACR,eAAe;0BACrB,UAAU;wBACZ,QAAQ;wBACR,QAAQ;2BACL,eAAe;8BACZ,cAAc;mCACT,kBAAkB;iCACpB,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAmEf,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAuMtC,CAAC;AAAA,CACR;AAED,MAAM,UAAU,mBAAmB,CAAC,GAA8B,EAAU;IAC3E,MAAM,eAAe,GAAG,kBAAkB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAE/D,OAAO;QACN,oBAAoB;QACpB,WAAW,WAAW,EAAE;QACxB,WAAW,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,eAAe,CAAC;QACzE,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,eAAe,CAAC;QACxE,WAAW,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;QACpD,WAAW,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,eAAe,CAAC;QAC5D,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,eAAe,CAAC;QAC9D,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB;QAC5F,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB;QACpF,mBAAmB;QACnB,mBAAmB;QACnB,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB;KACtF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAAA,CACb;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,cAAwB,EAAE,OAAiB,EAAU;IACvF,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAAA,CAC5E;AAED,SAAS,kBAAkB,CAAC,OAAgB,EAAY;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,OAAO;QACN,GAAG,IAAI,GAAG,CACT,OAAO,CAAC,MAAM,CACb,CAAC,MAAM,EAAoB,EAAE,CAC5B,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,MAAM,GAAG,CAAC;YACjB,6EAA6E;YAC7E,4EAA4E;YAC5E,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CACtB,CACD;KACD,CAAC;AAAA,CACF;AAED,SAAS,cAAc,CAAC,KAAc,EAAU;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC1B,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAAA,CAChC;AAED,SAAS,UAAU,CAAC,KAAa,EAAU;IAC1C,OAAO,KAAK;SACV,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAAA,CACzB","sourcesContent":["import { VERSION } from \"../../config.ts\";\nimport type { UiHostContext, UiResourceContent, UiResourceCsp } from \"./types.ts\";\n\n// Use locally bundled AppBridge to avoid CDN Zod bundling issues\nconst DEFAULT_APP_BRIDGE_MODULE_URL = \"/app-bridge.bundle.js\";\nconst APP_SANDBOX = \"allow-scripts allow-forms allow-modals allow-popups allow-downloads\";\n\nexport interface HostHtmlTemplateInput {\n\tsessionToken: string;\n\tuiResourceToken: string;\n\tserverName: string;\n\ttoolName: string;\n\ttoolArgs: Record<string, unknown>;\n\tresource: UiResourceContent;\n\tallowAttribute: string;\n\trequireToolConsent: boolean;\n\tcacheToolConsent: boolean;\n\thostContext?: UiHostContext;\n\tappBridgeModuleUrl?: string;\n}\n\nexport function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {\n\tconst hostContext = input.hostContext ?? {};\n\n\tconst sessionToken = safeInlineJSON(input.sessionToken);\n\tconst uiResourceToken = safeInlineJSON(input.uiResourceToken);\n\tconst toolArgs = safeInlineJSON(input.toolArgs);\n\tconst serverName = safeInlineJSON(input.serverName);\n\tconst toolName = safeInlineJSON(input.toolName);\n\tconst hostContextJson = safeInlineJSON(hostContext);\n\tconst allowAttribute = safeInlineJSON(input.allowAttribute);\n\tconst requireToolConsent = safeInlineJSON(input.requireToolConsent);\n\tconst cacheToolConsent = safeInlineJSON(input.cacheToolConsent);\n\tconst moduleUrl = safeInlineJSON(input.appBridgeModuleUrl ?? DEFAULT_APP_BRIDGE_MODULE_URL);\n\tconst nexusVersion = safeInlineJSON(VERSION);\n\n\treturn `<!doctype html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\" />\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n  <title>MCP UI - ${escapeHtml(input.serverName)} / ${escapeHtml(input.toolName)}</title>\n  <style>\n    :root {\n      color-scheme: light dark;\n      --bg: #0f1115;\n      --surface: #181c22;\n      --text: #ecf0f5;\n      --muted: #a9b2bf;\n      --accent: #43c0ff;\n      --border: rgba(255, 255, 255, 0.12);\n      --good: #34d399;\n      --warn: #fbbf24;\n      --bad: #f87171;\n    }\n    @media (prefers-color-scheme: light) {\n      :root {\n        --bg: #f6f7fb;\n        --surface: #ffffff;\n        --text: #1d2939;\n        --muted: #667085;\n        --accent: #0ea5e9;\n        --border: rgba(15, 23, 42, 0.14);\n        --good: #059669;\n        --warn: #b45309;\n        --bad: #b91c1c;\n      }\n    }\n    * { box-sizing: border-box; }\n    html, body { margin: 0; padding: 0; height: 100%; font-family: ui-sans-serif, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif; background: var(--bg); color: var(--text); }\n    body { display: flex; flex-direction: column; min-height: 100vh; min-height: 100dvh; }\n    header { background: var(--surface); border-bottom: 1px solid var(--border); padding: calc(10px + env(safe-area-inset-top, 0px)) calc(14px + env(safe-area-inset-right, 0px)) 10px calc(14px + env(safe-area-inset-left, 0px)); display: flex; align-items: center; justify-content: space-between; gap: 10px; }\n    .title { display: flex; gap: 8px; align-items: baseline; min-width: 0; }\n    .server { font-size: 12px; color: var(--muted); text-transform: uppercase; letter-spacing: 0.08em; white-space: nowrap; }\n    .tool { font-size: 14px; font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }\n    .badge { border: 1px solid var(--border); border-radius: 999px; padding: 2px 8px; font-size: 11px; color: var(--muted); white-space: nowrap; }\n    .controls { display: flex; gap: 8px; align-items: center; }\n    .status { font-size: 12px; color: var(--muted); white-space: nowrap; }\n    button { border: 1px solid var(--border); background: transparent; color: var(--text); border-radius: 8px; padding: 6px 10px; cursor: pointer; font-size: 12px; }\n    button.primary { border-color: color-mix(in srgb, var(--good) 40%, var(--border) 60%); color: var(--good); }\n    button.danger { border-color: color-mix(in srgb, var(--bad) 40%, var(--border) 60%); color: var(--bad); }\n    button:hover { background: color-mix(in srgb, var(--surface) 75%, var(--accent) 25%); }\n    main { flex: 1; min-height: 0; padding: 10px; padding-inline: calc(10px + env(safe-area-inset-left, 0px)) calc(10px + env(safe-area-inset-right, 0px)); padding-bottom: calc(10px + env(safe-area-inset-bottom, 0px)); display: flex; }\n    iframe { width: 100%; height: 100%; border: 1px solid var(--border); border-radius: 10px; background: white; }\n    .overlay { position: fixed; inset: 0; background: color-mix(in srgb, var(--bg) 90%, black 10%); display: none; align-items: center; justify-content: center; z-index: 2; padding: 16px; }\n    .overlay.visible { display: flex; }\n    .panel { width: min(680px, calc(100vw - 40px)); background: var(--surface); border: 1px solid var(--border); border-radius: 12px; padding: 18px; }\n    .panel h2 { margin: 0 0 8px; font-size: 16px; }\n    .panel p { margin: 0; color: var(--muted); line-height: 1.4; font-size: 14px; white-space: pre-wrap; }\n    @media (max-width: 640px) {\n      header { align-items: stretch; flex-direction: column; gap: 8px; }\n      .title { flex-wrap: wrap; row-gap: 4px; }\n      .server { flex-basis: 100%; }\n      .controls { width: 100%; }\n      .status { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; }\n      button { min-height: 44px; padding: 10px 14px; }\n      main { padding: 6px; padding-inline: calc(6px + env(safe-area-inset-left, 0px)) calc(6px + env(safe-area-inset-right, 0px)); padding-bottom: calc(6px + env(safe-area-inset-bottom, 0px)); }\n      iframe { border-radius: 6px; }\n      .panel { width: 100%; }\n    }\n  </style>\n</head>\n<body>\n  <header>\n    <div class=\"title\">\n      <span class=\"server\">MCP · <span id=\"server-name\"></span></span>\n      <span class=\"tool\" id=\"tool-name\"></span>\n      <span class=\"badge\">Sandboxed</span>\n    </div>\n    <div class=\"controls\">\n      <span class=\"status\" id=\"status\">Loading UI...</span>\n      <button class=\"primary\" id=\"done-btn\" title=\"Cmd/Ctrl+Enter\">Done</button>\n      <button class=\"danger\" id=\"cancel-btn\" title=\"Escape\">Cancel</button>\n    </div>\n  </header>\n  <main>\n    <iframe id=\"mcp-app\" sandbox=\"${APP_SANDBOX}\" referrerpolicy=\"no-referrer\"></iframe>\n  </main>\n  <div class=\"overlay\" id=\"error-overlay\">\n    <div class=\"panel\">\n      <h2>UI Error</h2>\n      <p id=\"error-message\"></p>\n    </div>\n  </div>\n  <div class=\"overlay\" id=\"completion-overlay\">\n    <div class=\"panel\">\n      <h2>Done</h2>\n      <p>MCP UI session finished. You can close this page and return to Nexus.</p>\n    </div>\n  </div>\n  <script type=\"module\">\n    import { AppBridge, PostMessageTransport } from ${moduleUrl};\n\n    const SESSION_TOKEN = ${sessionToken};\n    const UI_RESOURCE_TOKEN = ${uiResourceToken};\n    const SERVER_NAME = ${serverName};\n    const TOOL_NAME = ${toolName};\n    const TOOL_ARGS = ${toolArgs};\n    const HOST_CONTEXT = ${hostContextJson};\n    const ALLOW_ATTRIBUTE = ${allowAttribute};\n    const REQUIRE_TOOL_CONSENT = ${requireToolConsent};\n    const CACHE_TOOL_CONSENT = ${cacheToolConsent};\n    const STREAM_CONTEXT_KEY = \"nexus-mcp/stream\";\n    const STREAM_PATCH_METHOD = \"notifications/nexus-mcp/ui-result-patch\";\n\n    const iframe = document.getElementById(\"mcp-app\");\n    const statusNode = document.getElementById(\"status\");\n    const doneBtn = document.getElementById(\"done-btn\");\n    const cancelBtn = document.getElementById(\"cancel-btn\");\n    const errorOverlay = document.getElementById(\"error-overlay\");\n    const completionOverlay = document.getElementById(\"completion-overlay\");\n    const errorMessage = document.getElementById(\"error-message\");\n\n    document.getElementById(\"server-name\").textContent = SERVER_NAME;\n    document.getElementById(\"tool-name\").textContent = TOOL_NAME;\n\n    const setStatus = (text, isError = false) => {\n      statusNode.textContent = text;\n      statusNode.style.color = isError ? \"var(--bad)\" : \"var(--muted)\";\n    };\n\n    const showError = (message) => {\n      errorMessage.textContent = message;\n      errorOverlay.classList.add(\"visible\");\n      setStatus(\"Error\", true);\n    };\n\n    let completionPending = false;\n    const showCompletion = () => {\n      completionOverlay.classList.add(\"visible\");\n      setStatus(\"Complete\");\n    };\n    const closeOrShowDone = () => {\n      completionPending = true;\n      window.close();\n      setTimeout(() => {\n        if (!document.hidden) {\n          showCompletion();\n        }\n      }, 1000);\n    };\n    document.addEventListener(\"visibilitychange\", () => {\n      if (completionPending && !document.hidden) {\n        showCompletion();\n      }\n    });\n\n    const post = async (endpoint, params) => {\n      const response = await fetch(endpoint, {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ token: SESSION_TOKEN, params }),\n      });\n\n      const body = await response.json().catch(() => ({ ok: false, error: \"Invalid JSON response\" }));\n      if (!response.ok || !body.ok) {\n        const message = body.error || (\"HTTP \" + response.status);\n        throw new Error(message);\n      }\n      return body.result ?? {};\n    };\n\n    let consentGranted = !REQUIRE_TOOL_CONSENT;\n    const initialStreamContext = HOST_CONTEXT?.[STREAM_CONTEXT_KEY];\n    const streamMode = initialStreamContext?.mode === \"stream-first\" ? \"stream-first\" : \"eager\";\n\n    const bridge = new AppBridge(\n      null,\n      { name: \"nexus\", version: ${nexusVersion} },\n      { serverTools: {}, openLinks: {}, logging: {}, updateModelContext: {}, message: {} },\n      { hostContext: HOST_CONTEXT }\n    );\n\n    bridge.oncalltool = async (params) => {\n      if (!consentGranted) {\n        const accepted = window.confirm(\"Allow this UI to call server tools for this session?\");\n        if (!accepted) {\n          await post(\"/proxy/ui/consent\", { approved: false }).catch(() => {});\n          return {\n            isError: true,\n            content: [{ type: \"text\", text: \"Tool call denied by user.\" }],\n          };\n        }\n        await post(\"/proxy/ui/consent\", { approved: true });\n        if (CACHE_TOOL_CONSENT) {\n          consentGranted = true;\n        }\n      }\n      const result = await post(\"/proxy/tools/call\", params);\n      // Notify agent about the tool call\n      await post(\"/proxy/ui/generated-tool-call-intent\", {\n        tool: params.name,\n        arguments: params.arguments,\n        isError: result.isError\n      }).catch(() => {});\n      return result;\n    };\n\n    bridge.onmessage = async (params) => post(\"/proxy/ui/message\", params);\n    bridge.onupdatemodelcontext = async (params) => post(\"/proxy/ui/context\", params);\n\n    // Also listen for raw postMessage events with custom types (notify, prompt, intent, etc.)\n    // These bypass the AppBridge protocol but are used by some MCP UI implementations\n    window.addEventListener(\"message\", async (event) => {\n      if (event.source !== iframe.contentWindow) return;\n      const data = event.data;\n      if (!data || typeof data !== \"object\") return;\n\n      // Skip AppBridge protocol messages (handled by bridge)\n      if (data.jsonrpc || (typeof data.method === \"string\" && (data.method.startsWith(\"app/\") || data.method.startsWith(\"host/\")))) return;\n\n      // Handle raw UI action messages\n      const msgType = data.type;\n      if (typeof msgType !== \"string\") return;\n\n      if (msgType === \"notify\" || msgType === \"prompt\" || msgType === \"intent\" || msgType === \"message\") {\n        // Standard MCP-UI types - preserve their semantics\n        // Support both { type, payload: {...} } and { type, field: value } formats\n        const { type: _, payload, ...directFields } = data;\n        await post(\"/proxy/ui/message\", { type: msgType, ...directFields, ...(payload || {}) }).catch(() => {});\n      } else if (!msgType.startsWith(\"ui-lifecycle-\") && !msgType.startsWith(\"ui-message-\")) {\n        // Any other custom type - forward as intent with type as intent name\n        // (Skip internal lifecycle/ack messages)\n        const payload = data.payload || {};\n        await post(\"/proxy/ui/message\", {\n          type: \"intent\",\n          intent: msgType,\n          params: payload,\n        }).catch(() => {});\n      }\n    });\n    bridge.ondownloadfile = async (params) => post(\"/proxy/ui/download-file\", params);\n    bridge.onrequestdisplaymode = async (params) => post(\"/proxy/ui/request-display-mode\", params);\n    bridge.onopenlink = async (params) => {\n\t  let externalUrl;\n\t  try {\n\t\texternalUrl = new URL(params.url);\n\t  } catch {\n\t\treturn { isError: true };\n\t  }\n\t  if ((externalUrl.protocol !== \"http:\" && externalUrl.protocol !== \"https:\") || externalUrl.username || externalUrl.password) {\n\t\treturn { isError: true };\n\t  }\n      const result = await post(\"/proxy/ui/open-link\", params);\n      if (!result.isError) {\n\t\twindow.open(externalUrl.href, \"_blank\", \"noopener,noreferrer\");\n        // Notify agent about the link open\n        await post(\"/proxy/ui/message\", {\n          type: \"intent\",\n          intent: \"open_link\",\n          params: { url: params.url }\n        }).catch(() => {});\n      }\n      return result;\n    };\n\n    bridge.oninitialized = () => {\n      if (streamMode !== \"stream-first\") {\n        bridge.sendToolInput({ arguments: TOOL_ARGS });\n      }\n      setStatus(streamMode === \"stream-first\" ? \"Streaming…\" : \"Connected\");\n    };\n\n    bridge.onsizechange = ({ width, height }) => {\n      if (typeof width === \"number\" && width > 0) {\n        iframe.style.minWidth = Math.min(width, window.innerWidth - 24) + \"px\";\n      }\n      if (typeof height === \"number\" && height > 0) {\n        iframe.style.height = Math.max(height, 320) + \"px\";\n      }\n    };\n\n    if (ALLOW_ATTRIBUTE) {\n      iframe.setAttribute(\"allow\", ALLOW_ATTRIBUTE);\n    }\n\n    // Connect bridge BEFORE loading iframe to ensure we're listening when the app sends ui/initialize\n    try {\n      const transport = new PostMessageTransport(iframe.contentWindow, window);\n      await bridge.connect(transport);\n    } catch (error) {\n      console.error(\"[host] Bridge connection failed:\", error);\n      showError(\"Failed to initialize AppBridge: \" + String(error));\n    }\n\n    const iframeLoaded = new Promise((resolve) => {\n      iframe.onload = resolve;\n    });\n    iframe.src = \"/ui-app?resource=\" + encodeURIComponent(UI_RESOURCE_TOKEN);\n    await iframeLoaded;\n\n    const eventSource = new EventSource(\"/events?session=\" + encodeURIComponent(SESSION_TOKEN));\n    eventSource.addEventListener(\"tool-input\", (event) => {\n      try {\n        bridge.sendToolInput(JSON.parse(event.data));\n      } catch (error) {\n        showError(\"Failed to forward tool input: \" + String(error));\n      }\n    });\n    eventSource.addEventListener(\"tool-result\", (event) => {\n      try {\n        bridge.sendToolResult(JSON.parse(event.data));\n      } catch (error) {\n        showError(\"Failed to forward tool result: \" + String(error));\n      }\n    });\n    eventSource.addEventListener(\"tool-cancelled\", (event) => {\n      try {\n        bridge.sendToolCancelled(JSON.parse(event.data));\n      } catch (error) {\n        showError(\"Failed to forward cancellation: \" + String(error));\n      }\n    });\n    eventSource.addEventListener(\"result-patch\", async (event) => {\n      try {\n        await bridge.notification({\n          method: STREAM_PATCH_METHOD,\n          params: JSON.parse(event.data),\n        });\n      } catch (error) {\n        showError(\"Failed to forward stream patch: \" + String(error));\n      }\n    });\n    eventSource.addEventListener(\"host-context\", (event) => {\n      try {\n        bridge.setHostContext(JSON.parse(event.data));\n      } catch {}\n    });\n    eventSource.addEventListener(\"session-complete\", async () => {\n      await bridge.teardownResource({}).catch(() => {});\n      clearInterval(heartbeat);\n      eventSource.close();\n      closeOrShowDone();\n    });\n    eventSource.onerror = () => {\n      setStatus(\"Connection lost\", true);\n    };\n\n    const heartbeat = setInterval(() => {\n      post(\"/proxy/ui/heartbeat\", {}).catch(() => {});\n    }, 10000);\n\n    const complete = async (reason) => {\n      try {\n        await post(\"/proxy/ui/complete\", { reason });\n      } catch {}\n      try {\n        await bridge.teardownResource({});\n      } catch {}\n      clearInterval(heartbeat);\n      eventSource.close();\n      closeOrShowDone();\n    };\n\n    doneBtn.addEventListener(\"click\", () => complete(\"done\"));\n    cancelBtn.addEventListener(\"click\", () => complete(\"cancel\"));\n    window.addEventListener(\"keydown\", (event) => {\n      if (event.key === \"Escape\") {\n        event.preventDefault();\n        complete(\"cancel\");\n      } else if ((event.metaKey || event.ctrlKey) && event.key === \"Enter\") {\n        event.preventDefault();\n        complete(\"done\");\n      }\n    });\n  </script>\n</body>\n</html>`;\n}\n\nexport function buildCspMetaContent(csp: UiResourceCsp | undefined): string {\n\tconst resourceDomains = sanitizeCspDomains(csp?.resourceDomains);\n\tconst connectDomains = sanitizeCspDomains(csp?.connectDomains);\n\tconst frameDomains = sanitizeCspDomains(csp?.frameDomains);\n\tconst baseUriDomains = sanitizeCspDomains(csp?.baseUriDomains);\n\n\treturn [\n\t\t\"default-src 'none'\",\n\t\t`sandbox ${APP_SANDBOX}`,\n\t\ttoDirective(\"script-src\", [\"'self'\", \"'unsafe-inline'\"], resourceDomains),\n\t\ttoDirective(\"style-src\", [\"'self'\", \"'unsafe-inline'\"], resourceDomains),\n\t\ttoDirective(\"font-src\", [\"'self'\"], resourceDomains),\n\t\ttoDirective(\"img-src\", [\"'self'\", \"data:\"], resourceDomains),\n\t\ttoDirective(\"media-src\", [\"'self'\", \"data:\"], resourceDomains),\n\t\tconnectDomains.length > 0 ? `connect-src ${connectDomains.join(\" \")}` : \"connect-src 'none'\",\n\t\tframeDomains.length > 0 ? `frame-src ${frameDomains.join(\" \")}` : \"frame-src 'none'\",\n\t\t\"worker-src 'none'\",\n\t\t\"object-src 'none'\",\n\t\tbaseUriDomains.length > 0 ? `base-uri ${baseUriDomains.join(\" \")}` : \"base-uri 'self'\",\n\t].join(\"; \");\n}\n\nfunction toDirective(name: string, trustedSources: string[], domains: string[]): string {\n\treturn `${name} ${[...new Set([...trustedSources, ...domains])].join(\" \")}`;\n}\n\nfunction sanitizeCspDomains(domains: unknown): string[] {\n\tif (!Array.isArray(domains)) return [];\n\n\treturn [\n\t\t...new Set(\n\t\t\tdomains.filter(\n\t\t\t\t(domain): domain is string =>\n\t\t\t\t\ttypeof domain === \"string\" &&\n\t\t\t\t\tdomain.length > 0 &&\n\t\t\t\t\t// HTTP headers must be printable ASCII; rejecting all other code points also\n\t\t\t\t\t// excludes every C0/C1 control character before Node serializes the policy.\n\t\t\t\t\t/^[\\x21-\\x7E]+$/.test(domain) &&\n\t\t\t\t\t!/[;'\"]/.test(domain),\n\t\t\t),\n\t\t),\n\t];\n}\n\nfunction safeInlineJSON(value: unknown): string {\n\treturn JSON.stringify(value)\n\t\t.replace(/</g, \"\\\\u003c\")\n\t\t.replace(/>/g, \"\\\\u003e\")\n\t\t.replace(/&/g, \"\\\\u0026\")\n\t\t.replace(/\\u2028/g, \"\\\\u2028\")\n\t\t.replace(/\\u2029/g, \"\\\\u2029\");\n}\n\nfunction escapeHtml(value: string): string {\n\treturn value\n\t\t.replace(/&/g, \"&amp;\")\n\t\t.replace(/</g, \"&lt;\")\n\t\t.replace(/>/g, \"&gt;\")\n\t\t.replace(/\"/g, \"&quot;\")\n\t\t.replace(/'/g, \"&#39;\");\n}\n"]}

package/dist/extensions/mcp/index.d.ts

@@ -1,18 +1,23 @@
-import type { ExtensionAPI, ToolDefinition } from "../../core/extensions/types.ts";
-import { McpClient, type McpToolResult, type McpToolSchema } from "./client.ts";
+import type { ExtensionAPI } from "../../core/extensions/types.ts";
+import type { McpAdapterOptions, ServerEntry } from "./types.ts";
+export type { McpAdapterOptions, ServerEntry } from "./types.ts";
+export { MCP_STATUS_EVENT, MCP_STATUS_SNAPSHOT_VERSION, MCP_TOOL_APPROVAL_REQUEST_EVENT, type McpServerRuntimeStatus, type McpServerStatusSnapshot, type McpStatusSnapshot, type McpToolApprovalDecision, type McpToolApprovalHandler, type McpToolApprovalOrigin, type McpToolApprovalRequest, } from "./types.ts";
+export interface McpServerRegistration {
+    dispose(): Promise<void>;
+}
+export declare function createMcpAdapter(options?: McpAdapterOptions): (nexus: ExtensionAPI) => void;
 /**
- * MCP adapter: connects the servers named in mcp.json and exposes their tools
- * to the model.
- *
- * Every failure here is non-fatal. A server that is missing, misconfigured, or
- * down costs you its tools and a startup notice — it must never stop the agent
- * from running, the same contract the gitnexus extension follows.
+ * Register an MCP server with the adapter installed for this Nexus instance.
+ * Registrations are session/runtime scoped and never persisted. Duplicate
+ * names fail closed. Registered servers are proxy-tool-only; their tools
+ * become visible at the next tool sync. To change a definition, dispose the
+ * registration and register again.
  */
-/** Tool names are namespaced by server, so two servers can both export "search". */
-export declare function toolName(serverName: string, tool: string): string;
-/** Flatten an MCP result into the text the agent shows and feeds back to the model. */
-export declare function resultToText(result: McpToolResult): string;
-/** Build a nexus tool that proxies one MCP tool. */
-export declare function defineProxyTool(client: McpClient, serverName: string, schema: McpToolSchema): ToolDefinition;
-export default function mcpExtension(pi: ExtensionAPI): void;
+export declare function registerMcpServer(options: {
+    nexus: ExtensionAPI;
+    name: string;
+    definition: ServerEntry;
+}): McpServerRegistration;
+declare const _default: (nexus: ExtensionAPI) => void;
+export default _default;
 //# sourceMappingURL=index.d.ts.map